last executing test programs: 12.808836262s ago: executing program 4 (id=1671): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x24, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}]}, 0x24}}, 0x2) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000400), 0x0, 0x8080) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000500)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x7}, 0x3, 0x20, 0x5, 0x0, 0x2, 0x400, 'syz1\x00', &(0x7f0000000700)=[':#,\x00', '\\\x00'], 0x6}) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x32b, @tick=0x440, 0xff, {}, 0x0, 0x0, 0x4b}) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="12010000a13de30840205029f1850102030109022d0002000000000904210001d553e5000905060500000000000904000001f238b50009050102f7"], 0x0) syz_usb_connect$cdc_ecm(0x4, 0x117, &(0x7f0000000600)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x105, 0x1, 0x1, 0x8, 0x20, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x2, 0x6, 0x0, 0x8d, {{0xb, 0x24, 0x6, 0x0, 0x0, "c1529b6fa9d9"}, {0x5, 0x24, 0x0, 0x10}, {0xd, 0x24, 0xf, 0x1, 0xffffffff, 0xc08, 0x0, 0xc}, [@country_functional={0xe, 0x24, 0x7, 0xa2, 0x3, [0xac92, 0x8001, 0x200, 0x4]}, @mbim={0xc, 0x24, 0x1b, 0x9, 0x5, 0x19, 0x4, 0x9, 0x2}, @mdlm_detail={0x35, 0x24, 0x13, 0x81, "5fa1527b5b61f5d0e8b678205005aee399cafc377fb693978b551b10b823e382cd020c3cdf78a4b537a4b69201ee218a28"}, @network_terminal={0x7, 0x24, 0xa, 0x2, 0x8, 0x9, 0x7}, @mdlm_detail={0x65, 0x24, 0x13, 0x3c, "07639424cc53a0d350dbed9e04124394d634822ddbf334de2153b912cc5de509689c547793c03f59828de511c7d8f023612bd7c123fb635765b497006ca79c56bec0f0d77c31cfc0ff9e46b4c6d8df4066a90e3c0cd0a7e0408f9ce0b5c99620b7"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x40, 0xbe, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x400, 0x1, 0x47, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x4, 0xf, 0x7f}}}}}]}}]}}, &(0x7f00000007c0)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x201, 0x3, 0x87, 0x9, 0x20, 0x2}, 0xb, &(0x7f0000000780)={0x5, 0xf, 0xb, 0x2, [@ptm_cap={0x3}, @ptm_cap={0x3}]}}) syz_usb_control_io$uac2(r2, &(0x7f0000000280)={0x14, &(0x7f00000001c0)={0x20, 0x11, 0x3b, {0x3b, 0x8, "b8a8d0cdb7f8aeb8984f371b265ebd7277769b71d962ec3460d25a40519e8d89ecc5a3dab552132fbd35f06a2dfc60ee208ec428bf7de41835"}}, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41b}}}, &(0x7f0000000580)={0x44, &(0x7f0000000300)={0x20, 0x8}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x7}, 0x0, &(0x7f00000003c0)={0x20, 0x81, 0x1, "18"}, &(0x7f0000000400)={0x20, 0x82, 0x2, "69b6"}, &(0x7f0000000480)={0x20, 0x83, 0x3, 'Y`,'}, &(0x7f00000004c0)=ANY=[@ANYBLOB="000000eb0000000000"], &(0x7f0000000500)={0x20, 0x85, 0x3, "daed45"}}) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000000800)={0x40, 0x3, 0x1, 'queue1\x00', 0x7}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000180)=@allocspi={0x114, 0x16, 0x1, 0x70bd27, 0x25dfdbfb, {{{@in=@rand_addr=0x64010102, @in=@multicast2, 0x4e22, 0x0, 0x4e20, 0x1ff, 0xe, 0xa0, 0x20, 0x62}, {@in6=@dev={0xfe, 0x80, '\x00', 0x2d}, 0x4d6, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @remote}, {0xfffffffffffff801, 0x5, 0x9, 0x1, 0x6, 0x2, 0x1, 0x10001}, {0x3, 0xd05, 0xb, 0x5}, {0x9, 0x5, 0x1}, 0x70bd28, 0x3507, 0xa, 0x2, 0x2, 0x425f6b5a515837c7}, 0x200, 0x10000}, [@replay_esn_val={0x1c, 0x17, {0x0, 0x70bd23, 0x70bd2b, 0x70bd2c, 0x70bd2d, 0x8}}]}, 0x114}, 0x1, 0x0, 0x0, 0x80}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) r6 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000008c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x1c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4450}, 0x80) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=@known='trusted.overlay.impure\x00', &(0x7f0000000180)='{.\x00', 0x3, 0x1) creat(&(0x7f0000000040)='./cgroup\x00', 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xb4}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="280000003300070100000000000000000c7c00000c0006"], 0x28}, 0x1, 0x0, 0x0, 0x8080}, 0xc010) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, r7, 0x0, 0x41000004, &(0x7f0000000040)) 9.755978286s ago: executing program 2 (id=1683): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="3cedff00", @ANYRES16=r1, @ANYBLOB="010027bd7000fbdbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008a00", @ANYRES32, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x408c0}, 0x30) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x2, 0x0) r4 = syz_genetlink_get_family_id$ipvs(0x0, r3) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000080)={0x42, 0x80000009, 0x3}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000040)={0x80042, 0x1}, 0x10) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) r7 = accept4(r6, 0x0, 0x0, 0x80000) sendmmsg(r7, &(0x7f0000004bc0), 0x5b, 0x20048143) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r7, &(0x7f0000000180)={0x30000015}) bind$tipc(r5, 0x0, 0xffffffffffffff95) ioctl$XFS_IOC_GETBMAPA(r2, 0xc020582c, &(0x7f0000000280)={0x6, 0x4, 0x8, 0x7}) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x2, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x41}, 0x44) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x27}]}, @NFT_MSG_NEWSETELEM={0xdc, 0x1e, 0xa, 0x205, 0x0, 0x0, {0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xb0, 0x3, 0x0, 0x1, [{0xac, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xa8, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa4, 0x1, "0bba407e8b99721ba5620a72d0e61c07aacd0ac7580d807c409285db646dfe953b98b8516f4da6e8c60b65659199c23d80cf1715616d4168aade5fb09ee0731a43c22606f73741b686a5545837dda8b204a60830a49ff6ff1b6aead2c986b82f09433c18874d0421ddc5d321d99d61edd36876ca1e6994315e0e0337500482b4f095fe48468537a30f416a7f248ada0df2f19b7e056b28993a7d7b18af41ca36"}]}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0x140}}, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000140), 0xc, &(0x7f0000000640)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010) sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x30, r4, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x903e}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x62}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4002}, 0x4080) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc0100, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a4d2ff40f3054002241b0102030109021b00010000000009040000014eaf32000905d693"], 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'bond0\x00'}) 9.475780283s ago: executing program 4 (id=1685): ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) creat(0x0, 0x63) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x8417f, 0x3f00) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001ac0)=@newtfilter={0x88c, 0x2c, 0x8, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x10, 0xa}, {0x9, 0x5}, {0x1, 0x3}}, [@filter_kind_options=@f_route={{0xa}, {0x85c, 0x2, [@TCA_ROUTE4_POLICE={0x850, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x95a, 0x0, 0x6, 0x6, 0xffff6d2c, 0x81, 0x4, 0x5, 0xfffeffff, 0xcb, 0xe, 0x5b616068, 0xfffffff9, 0x8000, 0x2, 0x6, 0xffffffff, 0xae5, 0x400, 0x1, 0x294c, 0x6, 0x7e12, 0x4, 0x7, 0x0, 0xa, 0x3ff, 0x7, 0x40, 0x26, 0x85d827ea, 0x0, 0x5, 0x6, 0x3ff, 0x10001, 0x40, 0x7, 0x1, 0x9, 0x0, 0x8, 0x9, 0x7, 0x10000, 0x3, 0x7ff, 0x48000000, 0x6, 0x5, 0x2, 0x8, 0x4, 0x31, 0x3, 0x0, 0x0, 0x6, 0xfffff2d8, 0x5, 0x4, 0x1, 0xfa5, 0xfff, 0x5, 0x8001, 0x4, 0x8, 0x2, 0x7fff, 0x6, 0x84, 0x1000, 0x2, 0xffffc865, 0x1, 0x9, 0x0, 0x3, 0x9, 0x4, 0x580, 0x1, 0x1, 0x3, 0x8, 0x8, 0x8, 0x1000, 0x8, 0x952e, 0x7, 0x8, 0x8, 0x401, 0xfffffffc, 0x4, 0x1ff, 0x6416d30f, 0x0, 0x4, 0xeed8, 0x3ff, 0x77, 0x8, 0xe5a, 0x1, 0x1, 0xd, 0x1, 0x8, 0x6, 0x0, 0x3, 0x10, 0xffffffad, 0x7, 0x0, 0x6, 0x2, 0x6, 0xffffb000, 0xeebe, 0x84, 0x4, 0x1, 0x8, 0x8, 0xff, 0x9, 0x0, 0x10000, 0x8, 0x80800000, 0x1, 0x10, 0x400, 0x534, 0x7, 0xffffffff, 0x7, 0xa, 0x8, 0x0, 0x94, 0x8001, 0x8000, 0x6, 0x6, 0x0, 0xd460, 0x200, 0x80000001, 0x10, 0x2, 0x8, 0x7, 0x7, 0x2, 0x7, 0x3, 0xfffffff7, 0xfffffe01, 0x400, 0x122, 0x7, 0x2, 0x9, 0x2, 0x6, 0xbd18, 0x4, 0x4, 0x400, 0x1000, 0x4, 0xfffffff5, 0x1e, 0x544, 0x0, 0x200, 0x80, 0xfffffff9, 0x4, 0xffffffc0, 0x5, 0x6, 0x9, 0x6831, 0x2, 0x6, 0x7fffffff, 0x9, 0x0, 0x9, 0xc, 0x6, 0xffff999f, 0x6, 0x0, 0x7, 0x9, 0x101, 0x223, 0x1, 0xe, 0x27d2, 0x3, 0x7, 0x8, 0x8, 0x3a, 0x0, 0x6, 0x3, 0x2, 0x7, 0x131bc6ab, 0x4, 0x3, 0x2, 0x10001, 0x709, 0x5, 0x8, 0x0, 0x7, 0x0, 0x9, 0x5, 0x4, 0x25df, 0x5, 0x9, 0xbfe5, 0x6f, 0x80, 0x10, 0x5, 0x8, 0x670b, 0x81, 0x6, 0xfffffff7, 0x8000, 0x5d426142, 0x5, 0x2, 0x10001, 0x9, 0xfffffcc7, 0xb0d, 0x8, 0xa, 0xfffffffe]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x8001, 0x10000000, 0x9, 0x100, 0x9, {0x6, 0x0, 0x8001, 0x5, 0xf33, 0x67e2}, {0x9, 0x2, 0x3, 0x1, 0x6, 0x80}, 0x0, 0x200, 0x5}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x10000}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0x0, 0x80000000, 0x26, 0x7f56, 0x6, 0xf0a0, 0x2, 0x8, 0x80000000, 0x7, 0x101, 0x0, 0x3, 0x80, 0x8, 0x1ff, 0xf, 0x6, 0x2, 0x7, 0x3, 0xde3, 0x7b, 0x10000, 0x5, 0xa2, 0x8, 0x8001, 0x4, 0xffff, 0x672, 0xffff8325, 0x5, 0x4, 0x40, 0x5, 0x401, 0x3, 0x0, 0x2000200, 0x8, 0x3, 0x8, 0x4, 0x4, 0xfffffffb, 0x1, 0x7f, 0x5, 0x7, 0x7, 0x3, 0x1, 0x4db8, 0x589, 0x1ff, 0x100, 0x400, 0x2934, 0x9, 0x7, 0xff, 0x413, 0x7, 0x40, 0x9, 0x7, 0x3e, 0x63f, 0x400, 0x1, 0x3c9, 0xff, 0x9, 0x4, 0x81, 0x913, 0x8, 0x6, 0x0, 0x5, 0x6, 0xffffffff, 0x200, 0x0, 0x3ff, 0x9, 0x5, 0xc727, 0x8001, 0x8, 0x80, 0x143e, 0x8, 0x401, 0x2, 0x1, 0x3f, 0x200, 0x5, 0x1, 0x3, 0x6, 0xa, 0x4, 0x4, 0x401, 0x6, 0x9, 0x2, 0x0, 0x9, 0xc99, 0x800, 0x4, 0xc87da4, 0x925e, 0x9, 0x10000, 0x7ff, 0x401, 0x3c6, 0x4, 0x7, 0xea75, 0x100, 0x8894, 0x6, 0x7, 0xf7c, 0x9, 0x5, 0xfffffff9, 0xb, 0x3, 0x8, 0x5, 0xfffeffff, 0xb5, 0x0, 0x302, 0x1, 0x5, 0x3, 0x3, 0x401, 0x10001, 0x2, 0x0, 0x8, 0x6b, 0x4, 0x7e, 0xfffffb01, 0x4, 0x6, 0xd, 0x3ab, 0x2, 0xa, 0xfffffffc, 0x5, 0x401, 0x3, 0x80000000, 0x3e8, 0x9381, 0xffff, 0x2, 0x5, 0x6, 0x412, 0x4, 0x10000, 0x5b, 0x9e81, 0x0, 0x80000007, 0x62fa, 0x5, 0xc, 0x7fffffff, 0x80, 0x7, 0x4, 0x80, 0x2, 0x4, 0x8, 0xfffff8b3, 0x2f, 0x8001, 0x6, 0x9, 0x1, 0x8, 0x1, 0x1ff, 0x9, 0x800000, 0x6, 0x2, 0xd09c, 0xe, 0x7, 0x1, 0x2, 0x7fff, 0x80000000, 0xd, 0x1, 0xfff, 0x3, 0x8, 0x3, 0xdce, 0x2, 0x80, 0x3, 0x8, 0xfffffc01, 0x200, 0xdc, 0xde4, 0x9, 0x5, 0x6, 0x9, 0x0, 0x43a, 0xfffffffd, 0x0, 0x5, 0x4, 0x9cb, 0x3, 0xc, 0x80000000, 0x9, 0x1, 0x32b5, 0xb02, 0x1, 0x3, 0x0, 0x8000, 0xd42, 0x4, 0x5, 0xc, 0xc, 0xb, 0x1, 0x1ff, 0x2c45ab02]}]}, @TCA_ROUTE4_TO={0x8, 0x2, 0x8}]}}]}, 0x88c}}, 0x800) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, 0x0, 0xa0602, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0xff2b}], 0x2) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000440)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x12) ioctl$UI_DEV_CREATE(r3, 0x5501) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000004c0)={'syz0\x00', {0x7, 0x3, 0x1, 0x9}, 0x7, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x0, 0xa9ba, 0x41f, 0x1, 0x101, 0x3, 0x6, 0xffff, 0x10000, 0x2, 0x8, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x3, 0x3, 0x9, 0xfff, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xffffffdc, 0x0, 0x0, 0xf, 0xcc, 0x5, 0x80, 0x401, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x4, 0x80000000, 0x1, 0x9, 0x7, 0x0, 0x5, 0xfff, 0x1, 0x7fe, 0x7fff, 0x2, 0x1000002, 0x8], [0x2, 0x1, 0xffff, 0x7, 0xb66, 0x2, 0x5, 0x80000001, 0x1, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x6, 0x8, 0x5, 0xcc, 0xbc1, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0x5, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x9, 0x4, 0x1, 0x5, 0x5, 0xfffffb66, 0x80, 0x2, 0x81, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x8, 0x6f, 0x80b, 0x3, 0x6, 0x525ba681, 0x4f74, 0x4, 0x1, 0x1, 0x8, 0x100, 0x6, 0x10000, 0x1306, 0x10000ab, 0x10000, 0xfe4, 0x3ff], [0x2, 0x7, 0x4, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0x9, 0x8, 0x7fffffff, 0x1, 0x1, 0x6, 0x8, 0xfffffffa, 0x7, 0x9, 0x6, 0x4, 0xfffffff7, 0xa3, 0x3, 0x0, 0x0, 0x3, 0x4c, 0x3, 0x5, 0x2, 0x0, 0x9, 0x13, 0x1, 0x2, 0xfff, 0x6, 0x100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x7, 0x47, 0xfa1, 0x0, 0x11, 0x3, 0x1, 0x5, 0x7, 0x8000, 0x1000, 0x10, 0x2, 0x10001, 0x1, 0x0, 0x6, 0x71c], [0x81, 0x3, 0x10, 0x4e26, 0x6, 0x40, 0xfffffff3, 0x497, 0x4, 0x1, 0x3, 0x5, 0x56, 0xc28, 0x9, 0x10001, 0x5, 0xa, 0x79a, 0x40, 0x9, 0x6, 0xc421, 0x80000001, 0x6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x0, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x4f, 0x78d, 0x4, 0x1, 0xffffb029, 0xfffffff8, 0x9, 0x7, 0x6, 0x101, 0x3ff, 0x7, 0x4, 0x0, 0xb, 0x400, 0x2008, 0x0, 0x8, 0x7, 0x9a33247, 0x8, 0x0, 0x1, 0x8001, 0xfffffff7, 0x5]}, 0x45c) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x100000, 0x9, {}, {0x0, 0x2, 0x4, 0xc0, 0x0, 0xf0, "18a6fc23"}, 0x1, 0x1, {}, 0x1}) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) 7.884875169s ago: executing program 2 (id=1690): mkdir(&(0x7f0000000040)='./file1\x00', 0x40) mount$fuse(0x0, 0x0, 0x0, 0x1048001, 0x0) r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x2, 0x1000, 0x1}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) openat$6lowpan_enable(0xffffff9c, &(0x7f00000006c0), 0x2, 0x0) unshare(0x28000080) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000100)='ns/time_for_children\x00') r4 = syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000000540), r4, 0x250000) syz_ublk_setup_queues(r0, r6, &(0x7f0000000200)={0x0, 0x1460, 0x400, 0x3, 0xb4}, &(0x7f00000002c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x181b, 0x0, 0x2, 0x2ae, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1e40, 0x1, 0x9, 0x502, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3cb5, 0x1000, 0x3, 0x102c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0f, 0x1000, 0x2, 0x21b, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, r5, '\x00', {0x8001, 0x48a, 0x0, 0x0}}, 0x0) chdir(&(0x7f0000000080)='./file1\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r8 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r9 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_G_SELECTION(r9, 0xc040565e, &(0x7f0000000000)={0x2, 0x2, 0xcfcd4592ae3d59aa, {0x103b, 0x3, 0x6, 0x90}}) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0xf) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r10 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) 6.906957485s ago: executing program 0 (id=1692): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) connect$qrtr(0xffffffffffffffff, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r3, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c642b4a1b7880610cc96655b1b141ab05", 0x2d, 0x0, &(0x7f0000000540)={0xc9, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f000020f000/0x1000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f00002d9000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00005ab000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r5 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) writev(r5, &(0x7f0000000580)=[{&(0x7f0000000040)="cfcb13aafc", 0x5}, {&(0x7f0000000140)="bf7d774c48aade35f9f410", 0xb}], 0x2) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x2000, 0x8000, 0x0, 0x7, {{0x5, 0x4, 0x0, 0x12, 0x14, 0x20, 0x4000, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x41, 0x0}, @multicast1}}}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r6 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r8, 0x4048aecb, &(0x7f0000000240)={0x4, 0x0, [{0x2, 0xffff, 0x0, 0x8, 0x0, 0x4}, {0x80000019, 0x6, 0x6, 0xfffffffe, 0x40000, 0x0, 0xd}, {0x0, 0xffffffff, 0x1, 0x9, 0x1, 0x80000001, 0x8}, {0x80000001, 0xa948a1e9, 0x7, 0x1008, 0x8, 0x5f05, 0x5}, {0xc0000000, 0x10, 0x6, 0x4, 0xe231, 0x1, 0xffffffff}]}) io_uring_enter(r6, 0x498b, 0x7731, 0x16, 0x0, 0x0) 6.453244745s ago: executing program 0 (id=1695): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x24, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}]}, 0x24}}, 0x2) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000400), 0x0, 0x8080) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000500)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x7}, 0x3, 0x20, 0x5, 0x0, 0x2, 0x400, 'syz1\x00', &(0x7f0000000700)=[':#,\x00', '\\\x00'], 0x6}) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x32b, @tick=0x440, 0xff, {}, 0x0, 0x0, 0x4b}) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="12010000a13de30840205029f1850102030109022d0002000000000904210001d553e5000905060500000000000904000001f238b50009050102f7"], 0x0) syz_usb_connect$cdc_ecm(0x4, 0x117, &(0x7f0000000600)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x105, 0x1, 0x1, 0x8, 0x20, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x2, 0x6, 0x0, 0x8d, {{0xb, 0x24, 0x6, 0x0, 0x0, "c1529b6fa9d9"}, {0x5, 0x24, 0x0, 0x10}, {0xd, 0x24, 0xf, 0x1, 0xffffffff, 0xc08, 0x0, 0xc}, [@country_functional={0xe, 0x24, 0x7, 0xa2, 0x3, [0xac92, 0x8001, 0x200, 0x4]}, @mbim={0xc, 0x24, 0x1b, 0x9, 0x5, 0x19, 0x4, 0x9, 0x2}, @mdlm_detail={0x35, 0x24, 0x13, 0x81, "5fa1527b5b61f5d0e8b678205005aee399cafc377fb693978b551b10b823e382cd020c3cdf78a4b537a4b69201ee218a28"}, @network_terminal={0x7, 0x24, 0xa, 0x2, 0x8, 0x9, 0x7}, @mdlm_detail={0x65, 0x24, 0x13, 0x3c, "07639424cc53a0d350dbed9e04124394d634822ddbf334de2153b912cc5de509689c547793c03f59828de511c7d8f023612bd7c123fb635765b497006ca79c56bec0f0d77c31cfc0ff9e46b4c6d8df4066a90e3c0cd0a7e0408f9ce0b5c99620b7"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x40, 0xbe, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x400, 0x1, 0x47, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x4, 0xf, 0x7f}}}}}]}}]}}, &(0x7f00000007c0)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x201, 0x3, 0x87, 0x9, 0x20, 0x2}, 0xb, &(0x7f0000000780)={0x5, 0xf, 0xb, 0x2, [@ptm_cap={0x3}, @ptm_cap={0x3}]}}) syz_usb_control_io$uac2(r2, &(0x7f0000000280)={0x14, &(0x7f00000001c0)={0x20, 0x11, 0x3b, {0x3b, 0x8, "b8a8d0cdb7f8aeb8984f371b265ebd7277769b71d962ec3460d25a40519e8d89ecc5a3dab552132fbd35f06a2dfc60ee208ec428bf7de41835"}}, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41b}}}, &(0x7f0000000580)={0x44, &(0x7f0000000300)={0x20, 0x8}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x7}, 0x0, &(0x7f00000003c0)={0x20, 0x81, 0x1, "18"}, &(0x7f0000000400)={0x20, 0x82, 0x2, "69b6"}, &(0x7f0000000480)={0x20, 0x83, 0x3, 'Y`,'}, &(0x7f00000004c0)=ANY=[@ANYBLOB="000000eb0000000000"], &(0x7f0000000500)={0x20, 0x85, 0x3, "daed45"}}) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000000800)={0x40, 0x3, 0x1, 'queue1\x00', 0x7}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000180)=@allocspi={0x114, 0x16, 0x1, 0x70bd27, 0x25dfdbfb, {{{@in=@rand_addr=0x64010102, @in=@multicast2, 0x4e22, 0x0, 0x4e20, 0x1ff, 0xe, 0xa0, 0x20, 0x62}, {@in6=@dev={0xfe, 0x80, '\x00', 0x2d}, 0x4d6, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @remote}, {0xfffffffffffff801, 0x5, 0x9, 0x1, 0x6, 0x2, 0x1, 0x10001}, {0x3, 0xd05, 0xb, 0x5}, {0x9, 0x5, 0x1}, 0x70bd28, 0x3507, 0xa, 0x2, 0x2, 0x425f6b5a515837c7}, 0x200, 0x10000}, [@replay_esn_val={0x1c, 0x17, {0x0, 0x70bd23, 0x70bd2b, 0x70bd2c, 0x70bd2d, 0x8}}]}, 0x114}, 0x1, 0x0, 0x0, 0x80}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) r6 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000008c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x1c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4450}, 0x80) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=@known='trusted.overlay.impure\x00', &(0x7f0000000180)='{.\x00', 0x3, 0x1) creat(&(0x7f0000000040)='./cgroup\x00', 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xb4}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="280000003300070100000000000000000c7c00000c0006"], 0x28}, 0x1, 0x0, 0x0, 0x8080}, 0xc010) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, r7, 0x0, 0x41000004, &(0x7f0000000040)) 6.308450323s ago: executing program 2 (id=1696): ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) creat(0x0, 0x63) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x8417f, 0x3f00) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001ac0)=@newtfilter={0x88c, 0x2c, 0x8, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x10, 0xa}, {0x9, 0x5}, {0x1, 0x3}}, [@filter_kind_options=@f_route={{0xa}, {0x85c, 0x2, [@TCA_ROUTE4_POLICE={0x850, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x95a, 0x0, 0x6, 0x6, 0xffff6d2c, 0x81, 0x4, 0x5, 0xfffeffff, 0xcb, 0xe, 0x5b616068, 0xfffffff9, 0x8000, 0x2, 0x6, 0xffffffff, 0xae5, 0x400, 0x1, 0x294c, 0x6, 0x7e12, 0x4, 0x7, 0x0, 0xa, 0x3ff, 0x7, 0x40, 0x26, 0x85d827ea, 0x0, 0x5, 0x6, 0x3ff, 0x10001, 0x40, 0x7, 0x1, 0x9, 0x0, 0x8, 0x9, 0x7, 0x10000, 0x3, 0x7ff, 0x48000000, 0x6, 0x5, 0x2, 0x8, 0x4, 0x31, 0x3, 0x0, 0x0, 0x6, 0xfffff2d8, 0x5, 0x4, 0x1, 0xfa5, 0xfff, 0x5, 0x8001, 0x4, 0x8, 0x2, 0x7fff, 0x6, 0x84, 0x1000, 0x2, 0xffffc865, 0x1, 0x9, 0x0, 0x3, 0x9, 0x4, 0x580, 0x1, 0x1, 0x3, 0x8, 0x8, 0x8, 0x1000, 0x8, 0x952e, 0x7, 0x8, 0x8, 0x401, 0xfffffffc, 0x4, 0x1ff, 0x6416d30f, 0x0, 0x4, 0xeed8, 0x3ff, 0x77, 0x8, 0xe5a, 0x1, 0x1, 0xd, 0x1, 0x8, 0x6, 0x0, 0x3, 0x10, 0xffffffad, 0x7, 0x0, 0x6, 0x2, 0x6, 0xffffb000, 0xeebe, 0x84, 0x4, 0x1, 0x8, 0x8, 0xff, 0x9, 0x0, 0x10000, 0x8, 0x80800000, 0x1, 0x10, 0x400, 0x534, 0x7, 0xffffffff, 0x7, 0xa, 0x8, 0x0, 0x94, 0x8001, 0x8000, 0x6, 0x6, 0x0, 0xd460, 0x200, 0x80000001, 0x10, 0x2, 0x8, 0x7, 0x7, 0x2, 0x7, 0x3, 0xfffffff7, 0xfffffe01, 0x400, 0x122, 0x7, 0x2, 0x9, 0x2, 0x6, 0xbd18, 0x4, 0x4, 0x400, 0x1000, 0x4, 0xfffffff5, 0x1e, 0x544, 0x0, 0x200, 0x80, 0xfffffff9, 0x4, 0xffffffc0, 0x5, 0x6, 0x9, 0x6831, 0x2, 0x6, 0x7fffffff, 0x9, 0x0, 0x9, 0xc, 0x6, 0xffff999f, 0x6, 0x0, 0x7, 0x9, 0x101, 0x223, 0x1, 0xe, 0x27d2, 0x3, 0x7, 0x8, 0x8, 0x3a, 0x0, 0x6, 0x3, 0x2, 0x7, 0x131bc6ab, 0x4, 0x3, 0x2, 0x10001, 0x709, 0x5, 0x8, 0x0, 0x7, 0x0, 0x9, 0x5, 0x4, 0x25df, 0x5, 0x9, 0xbfe5, 0x6f, 0x80, 0x10, 0x5, 0x8, 0x670b, 0x81, 0x6, 0xfffffff7, 0x8000, 0x5d426142, 0x5, 0x2, 0x10001, 0x9, 0xfffffcc7, 0xb0d, 0x8, 0xa, 0xfffffffe]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x8001, 0x10000000, 0x9, 0x100, 0x9, {0x6, 0x0, 0x8001, 0x5, 0xf33, 0x67e2}, {0x9, 0x2, 0x3, 0x1, 0x6, 0x80}, 0x0, 0x200, 0x5}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x10000}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0x0, 0x80000000, 0x26, 0x7f56, 0x6, 0xf0a0, 0x2, 0x8, 0x80000000, 0x7, 0x101, 0x0, 0x3, 0x80, 0x8, 0x1ff, 0xf, 0x6, 0x2, 0x7, 0x3, 0xde3, 0x7b, 0x10000, 0x5, 0xa2, 0x8, 0x8001, 0x4, 0xffff, 0x672, 0xffff8325, 0x5, 0x4, 0x40, 0x5, 0x401, 0x3, 0x0, 0x2000200, 0x8, 0x3, 0x8, 0x4, 0x4, 0xfffffffb, 0x1, 0x7f, 0x5, 0x7, 0x7, 0x3, 0x1, 0x4db8, 0x589, 0x1ff, 0x100, 0x400, 0x2934, 0x9, 0x7, 0xff, 0x413, 0x7, 0x40, 0x9, 0x7, 0x3e, 0x63f, 0x400, 0x1, 0x3c9, 0xff, 0x9, 0x4, 0x81, 0x913, 0x8, 0x6, 0x0, 0x5, 0x6, 0xffffffff, 0x200, 0x0, 0x3ff, 0x9, 0x5, 0xc727, 0x8001, 0x8, 0x80, 0x143e, 0x8, 0x401, 0x2, 0x1, 0x3f, 0x200, 0x5, 0x1, 0x3, 0x6, 0xa, 0x4, 0x4, 0x401, 0x6, 0x9, 0x2, 0x0, 0x9, 0xc99, 0x800, 0x4, 0xc87da4, 0x925e, 0x9, 0x10000, 0x7ff, 0x401, 0x3c6, 0x4, 0x7, 0xea75, 0x100, 0x8894, 0x6, 0x7, 0xf7c, 0x9, 0x5, 0xfffffff9, 0xb, 0x3, 0x8, 0x5, 0xfffeffff, 0xb5, 0x0, 0x302, 0x1, 0x5, 0x3, 0x3, 0x401, 0x10001, 0x2, 0x0, 0x8, 0x6b, 0x4, 0x7e, 0xfffffb01, 0x4, 0x6, 0xd, 0x3ab, 0x2, 0xa, 0xfffffffc, 0x5, 0x401, 0x3, 0x80000000, 0x3e8, 0x9381, 0xffff, 0x2, 0x5, 0x6, 0x412, 0x4, 0x10000, 0x5b, 0x9e81, 0x0, 0x80000007, 0x62fa, 0x5, 0xc, 0x7fffffff, 0x80, 0x7, 0x4, 0x80, 0x2, 0x4, 0x8, 0xfffff8b3, 0x2f, 0x8001, 0x6, 0x9, 0x1, 0x8, 0x1, 0x1ff, 0x9, 0x800000, 0x6, 0x2, 0xd09c, 0xe, 0x7, 0x1, 0x2, 0x7fff, 0x80000000, 0xd, 0x1, 0xfff, 0x3, 0x8, 0x3, 0xdce, 0x2, 0x80, 0x3, 0x8, 0xfffffc01, 0x200, 0xdc, 0xde4, 0x9, 0x5, 0x6, 0x9, 0x0, 0x43a, 0xfffffffd, 0x0, 0x5, 0x4, 0x9cb, 0x3, 0xc, 0x80000000, 0x9, 0x1, 0x32b5, 0xb02, 0x1, 0x3, 0x0, 0x8000, 0xd42, 0x4, 0x5, 0xc, 0xc, 0xb, 0x1, 0x1ff, 0x2c45ab02]}]}, @TCA_ROUTE4_TO={0x8, 0x2, 0x8}]}}]}, 0x88c}}, 0x800) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r2, 0x0, 0x0) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000440)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x12) ioctl$UI_DEV_CREATE(r3, 0x5501) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000004c0)={'syz0\x00', {0x7, 0x3, 0x1, 0x9}, 0x7, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x0, 0xa9ba, 0x41f, 0x1, 0x101, 0x3, 0x6, 0xffff, 0x10000, 0x2, 0x8, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x3, 0x3, 0x9, 0xfff, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xffffffdc, 0x0, 0x0, 0xf, 0xcc, 0x5, 0x80, 0x401, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x4, 0x80000000, 0x1, 0x9, 0x7, 0x0, 0x5, 0xfff, 0x1, 0x7fe, 0x7fff, 0x2, 0x1000002, 0x8], [0x2, 0x1, 0xffff, 0x7, 0xb66, 0x2, 0x5, 0x80000001, 0x1, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x6, 0x8, 0x5, 0xcc, 0xbc1, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0x5, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x9, 0x4, 0x1, 0x5, 0x5, 0xfffffb66, 0x80, 0x2, 0x81, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x8, 0x6f, 0x80b, 0x3, 0x6, 0x525ba681, 0x4f74, 0x4, 0x1, 0x1, 0x8, 0x100, 0x6, 0x10000, 0x1306, 0x10000ab, 0x10000, 0xfe4, 0x3ff], [0x2, 0x7, 0x4, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0x9, 0x8, 0x7fffffff, 0x1, 0x1, 0x6, 0x8, 0xfffffffa, 0x7, 0x9, 0x6, 0x4, 0xfffffff7, 0xa3, 0x3, 0x0, 0x0, 0x3, 0x4c, 0x3, 0x5, 0x2, 0x0, 0x9, 0x13, 0x1, 0x2, 0xfff, 0x6, 0x100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x7, 0x47, 0xfa1, 0x0, 0x11, 0x3, 0x1, 0x5, 0x7, 0x8000, 0x1000, 0x10, 0x2, 0x10001, 0x1, 0x0, 0x6, 0x71c], [0x81, 0x3, 0x10, 0x4e26, 0x6, 0x40, 0xfffffff3, 0x497, 0x4, 0x1, 0x3, 0x5, 0x56, 0xc28, 0x9, 0x10001, 0x5, 0xa, 0x79a, 0x40, 0x9, 0x6, 0xc421, 0x80000001, 0x6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x0, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x4f, 0x78d, 0x4, 0x1, 0xffffb029, 0xfffffff8, 0x9, 0x7, 0x6, 0x101, 0x3ff, 0x7, 0x4, 0x0, 0xb, 0x400, 0x2008, 0x0, 0x8, 0x7, 0x9a33247, 0x8, 0x0, 0x1, 0x8001, 0xfffffff7, 0x5]}, 0x45c) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x100000, 0x9, {}, {0x0, 0x2, 0x4, 0xc0, 0x0, 0xf0, "18a6fc23"}, 0x1, 0x1, {}, 0x1}) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) 6.197957119s ago: executing program 1 (id=1697): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x24, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}]}, 0x24}}, 0x2) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000400), 0x0, 0x8080) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000500)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x7}, 0x3, 0x20, 0x5, 0x0, 0x2, 0x400, 'syz1\x00', &(0x7f0000000700)=[':#,\x00', '\\\x00'], 0x6}) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x32b, @tick=0x440, 0xff, {}, 0x0, 0x0, 0x4b}) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="12010000a13de30840205029f1850102030109022d0002000000000904210001d553e5000905060500000000000904000001f238b50009050102f7"], 0x0) syz_usb_connect$cdc_ecm(0x4, 0x117, &(0x7f0000000600)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x105, 0x1, 0x1, 0x8, 0x20, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x2, 0x6, 0x0, 0x8d, {{0xb, 0x24, 0x6, 0x0, 0x0, "c1529b6fa9d9"}, {0x5, 0x24, 0x0, 0x10}, {0xd, 0x24, 0xf, 0x1, 0xffffffff, 0xc08, 0x0, 0xc}, [@country_functional={0xe, 0x24, 0x7, 0xa2, 0x3, [0xac92, 0x8001, 0x200, 0x4]}, @mbim={0xc, 0x24, 0x1b, 0x9, 0x5, 0x19, 0x4, 0x9, 0x2}, @mdlm_detail={0x35, 0x24, 0x13, 0x81, "5fa1527b5b61f5d0e8b678205005aee399cafc377fb693978b551b10b823e382cd020c3cdf78a4b537a4b69201ee218a28"}, @network_terminal={0x7, 0x24, 0xa, 0x2, 0x8, 0x9, 0x7}, @mdlm_detail={0x65, 0x24, 0x13, 0x3c, "07639424cc53a0d350dbed9e04124394d634822ddbf334de2153b912cc5de509689c547793c03f59828de511c7d8f023612bd7c123fb635765b497006ca79c56bec0f0d77c31cfc0ff9e46b4c6d8df4066a90e3c0cd0a7e0408f9ce0b5c99620b7"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x40, 0xbe, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x400, 0x1, 0x47, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x4, 0xf, 0x7f}}}}}]}}]}}, &(0x7f00000007c0)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x201, 0x3, 0x87, 0x9, 0x20, 0x2}, 0xb, &(0x7f0000000780)={0x5, 0xf, 0xb, 0x2, [@ptm_cap={0x3}, @ptm_cap={0x3}]}}) syz_usb_control_io$uac2(r2, &(0x7f0000000280)={0x14, &(0x7f00000001c0)={0x20, 0x11, 0x3b, {0x3b, 0x8, "b8a8d0cdb7f8aeb8984f371b265ebd7277769b71d962ec3460d25a40519e8d89ecc5a3dab552132fbd35f06a2dfc60ee208ec428bf7de41835"}}, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41b}}}, &(0x7f0000000580)={0x44, &(0x7f0000000300)={0x20, 0x8}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x7}, 0x0, &(0x7f00000003c0)={0x20, 0x81, 0x1, "18"}, &(0x7f0000000400)={0x20, 0x82, 0x2, "69b6"}, &(0x7f0000000480)={0x20, 0x83, 0x3, 'Y`,'}, &(0x7f00000004c0)=ANY=[@ANYBLOB="000000eb0000000000"], &(0x7f0000000500)={0x20, 0x85, 0x3, "daed45"}}) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000000800)={0x40, 0x3, 0x1, 'queue1\x00', 0x7}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000180)=@allocspi={0x128, 0x16, 0x1, 0x70bd27, 0x25dfdbfb, {{{@in=@rand_addr=0x64010102, @in=@multicast2, 0x4e22, 0x0, 0x4e20, 0x1ff, 0xe, 0xa0, 0x20, 0x62}, {@in6=@dev={0xfe, 0x80, '\x00', 0x2d}, 0x4d6, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @remote}, {0xfffffffffffff801, 0x5, 0x9, 0x1, 0x6, 0x2, 0x1, 0x10001}, {0x3, 0xd05, 0xb, 0x5}, {0x9, 0x5, 0x1}, 0x70bd28, 0x3507, 0xa, 0x2, 0x2, 0x425f6b5a515837c7}, 0x200, 0x10000}, [@replay_esn_val={0x1c, 0x17, {0x0, 0x70bd23, 0x70bd2b, 0x70bd2c, 0x70bd2d, 0x8}}, @srcaddr={0x14, 0xd, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x128}, 0x1, 0x0, 0x0, 0x80}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) r6 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000008c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x1c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4450}, 0x80) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=@known='trusted.overlay.impure\x00', &(0x7f0000000180)='{.\x00', 0x3, 0x1) creat(&(0x7f0000000040)='./cgroup\x00', 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xb4}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x8080}, 0xc010) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, r7, 0x0, 0x41000004, &(0x7f0000000040)) 6.170299374s ago: executing program 4 (id=1698): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000ec0), 0x2, 0x0) setresuid(0xee01, 0xee01, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) 6.054296179s ago: executing program 4 (id=1699): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="3cedff00", @ANYRES16=r1, @ANYBLOB="010027bd7000fbdbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008a00", @ANYRES32, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x408c0}, 0x30) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x2, 0x0) r4 = syz_genetlink_get_family_id$ipvs(0x0, r3) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000080)={0x42, 0x80000009, 0x3}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000040)={0x80042, 0x1}, 0x10) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) r7 = accept4(r6, 0x0, 0x0, 0x80000) sendmmsg(r7, &(0x7f0000004bc0), 0x5b, 0x20048143) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r7, &(0x7f0000000180)={0x30000015}) bind$tipc(r5, 0x0, 0xffffffffffffff95) ioctl$XFS_IOC_GETBMAPA(r2, 0xc020582c, &(0x7f0000000280)={0x6, 0x4, 0x8, 0x7}) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x2, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x41}, 0x44) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x27}]}, @NFT_MSG_NEWSETELEM={0xdc, 0x1e, 0xa, 0x205, 0x0, 0x0, {0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xb0, 0x3, 0x0, 0x1, [{0xac, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xa8, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa4, 0x1, "0bba407e8b99721ba5620a72d0e61c07aacd0ac7580d807c409285db646dfe953b98b8516f4da6e8c60b65659199c23d80cf1715616d4168aade5fb09ee0731a43c22606f73741b686a5545837dda8b204a60830a49ff6ff1b6aead2c986b82f09433c18874d0421ddc5d321d99d61edd36876ca1e6994315e0e0337500482b4f095fe48468537a30f416a7f248ada0df2f19b7e056b28993a7d7b18af41ca36"}]}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0x140}}, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000140), 0xc, &(0x7f0000000640)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010) sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x30, r4, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x903e}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x62}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4002}, 0x4080) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc0100, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a4d2ff40f3054002241b0102030109021b00010000000009040000014eaf32000905d693"], 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) 5.938428074s ago: executing program 3 (id=1700): sigaltstack(&(0x7f0000000200)={0x0, 0x0, 0xfffffca4}, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000ec0), 0x2, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x80c00) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x23) ioctl$KVM_CAP_EXIT_HYPERCALL(r4, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_GSI_ROUTING(r4, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x4, 0x0, 0x0, @sint={0x0, 0xfff}}]}) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) sigaltstack(&(0x7f0000000440)={&(0x7f0000000380)=""/163, 0x2, 0xa3}, &(0x7f00000004c0)={&(0x7f0000000480)=""/56, 0x0, 0x38}) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_INITMSG(r6, 0x84, 0x2, &(0x7f0000000180)={0x7a2a, 0x9, 0x5a}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) ioctl$KVM_XEN_HVM_CONFIG(r8, 0x4038ae7a, &(0x7f0000000280)={0x4b8, 0x911, 0x0, &(0x7f0000000180)="d955e537df3bf8075927dfb63f3992a55e4dd008701b3d1c7456ef8c6add99b7370ea6c842f5acafad6c76ab19c9383f96adf0ce097f1d7168efb4a67ef1e0f818952a28dfecf2a0d3e0fee5a5d361252f772299ab3f43dbf82cc4d355ae73b406e66e43b7fec40be155d7d67034ab97eb7f5727d0ba0b1be93a9300ffe6c4123618094f68eadf4c023d7c4a428366158fd0d631244e58217a7777d8883a35be184912b14e736a1a6e83b84718f665fccf0915", 0x0, 0xb3}) ioctl$KVM_CAP_X2APIC_API(r8, 0x4068aea3, &(0x7f0000002a80)={0x81, 0x0, 0x3}) r10 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8d}) ioctl$KVM_SET_VCPU_EVENTS(r10, 0x4400ae8f, &(0x7f0000000140)=@x86={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}) sendmsg$inet_sctp(r6, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e1f, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000640)='\f', 0x1}], 0x1, 0x0, 0x0, 0x804c0c0}, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x6, 0x9}, 0x8) getsockopt$inet_int(r5, 0x0, 0xe, 0x0, &(0x7f0000000140)) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) sendmmsg$unix(r2, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x9802}}, {{&(0x7f0000000280)=@abs={0x0, 0x0, 0x4e23}, 0x6e, 0x0}}], 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) 4.614456966s ago: executing program 3 (id=1701): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000200000000000000000000000000a20000000000a01030000000000000000010000010900010073797a310000000054000000030a01040000000000000000010000000900030073797a31000000000900010073797a310000000028007280080002401886c3010800014000000005140003006d61637674617030000000000000000028000000000a05000000000000000000010000080900010073797a3100000000080002400000000114000000110001"], 0xc4}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) (fail_nth: 3) 4.269599498s ago: executing program 2 (id=1702): openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000190001000400000000000000e0000002000000000000000000000000fc00000000000000000000000000000000100008000000000a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000feffffffffffffff00000000000000000100000000000040ffffffffffffffff000000000000000000000000000000000000000000000800000a122e000000000000000000804000020000000000000800040000000000000000010000000000"], 0xb8}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000300), 0x4000, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x2014800, 0x0) chroot(&(0x7f0000000040)='./file0\x00') sendmsg$NFT_MSG_GETCHAIN(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000280), 0xc, 0x0}, 0x20044000) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 4.265116237s ago: executing program 3 (id=1703): socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f000004c000/0x4000)=nil, 0x4000, 0x5) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$nl_generic(0x10, 0x3, 0x10) timer_getoverrun(0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$rdma_cm(0xffffff9c, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmsg$can_bcm(0xffffffffffffffff, 0x0, 0x2100) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x4, 0x6, 0xbaa}, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, &(0x7f00000002c0)=""/251, &(0x7f0000000940), &(0x7f0000000200), 0xa7c, r2}, 0x38) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd2(0x4, 0x0) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000100)={r5, 0x8, 0x2, r5}) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000280)={r5, 0x8, 0x3, r5}) 4.155087852s ago: executing program 0 (id=1704): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a8d8006cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926", 0xfdba}], 0x2, 0x0, 0x0, 0x20000040}], 0x1, 0x40800) recvmsg$can_bcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000680)=""/112, 0xfdca}], 0x1}, 0x10150) 3.691643239s ago: executing program 2 (id=1705): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) connect$qrtr(0xffffffffffffffff, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r3, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c642b4a1b7880610cc96655b1b141ab05", 0x2d, 0x0, &(0x7f0000000540)={0xc9, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f000020f000/0x1000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f00002d9000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00005ab000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r5 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) writev(r5, &(0x7f0000000580)=[{&(0x7f0000000040)="cfcb13aafc", 0x5}, {&(0x7f0000000140)="bf7d774c48aade35f9f410", 0xb}], 0x2) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x2000, 0x8000, 0x0, 0x7, {{0x5, 0x4, 0x0, 0x12, 0x14, 0x20, 0x4000, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x41, 0x0}, @multicast1}}}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r6 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r8, 0x4048aecb, &(0x7f0000000240)={0x4, 0x0, [{0x2, 0xffff, 0x0, 0x8, 0x0, 0x4}, {0x80000019, 0x6, 0x6, 0xfffffffe, 0x40000, 0x0, 0xd}, {0x0, 0xffffffff, 0x1, 0x9, 0x1, 0x80000001, 0x8}, {0x80000001, 0xa948a1e9, 0x7, 0x1008, 0x8, 0x5f05, 0x5}, {0xc0000000, 0x10, 0x6, 0x4, 0xe231, 0x1, 0xffffffff}]}) io_uring_enter(r6, 0x498b, 0x7731, 0x16, 0x0, 0x0) 3.579753027s ago: executing program 0 (id=1706): r0 = socket$inet6(0xa, 0x80000, 0x8000000003c) r1 = syz_open_dev$sg(&(0x7f0000000140), 0xa, 0x28102) r2 = fcntl$dupfd(r1, 0x0, r1) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/151, 0x97}], 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, 0x0, 0x0) bind$rds(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x2, @loopback}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) get_robust_list(0x0, 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r5, 0x0, 0x30000000) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x40044) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write$snddsp(r2, &(0x7f0000000340)="87ecc00c05dbb58b776f34f9b779d998d21e0e3353174bb169f81d1590532836dee3667c58e173cdd67b", 0x2a) 3.538222684s ago: executing program 1 (id=1707): mkdir(&(0x7f0000000040)='./file1\x00', 0x40) mount$fuse(0x0, 0x0, 0x0, 0x1048001, 0x0) r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x2, 0x1000, 0x1}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) openat$6lowpan_enable(0xffffff9c, &(0x7f00000006c0), 0x2, 0x0) unshare(0x28000080) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000100)='ns/time_for_children\x00') r4 = syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000000540), r4, 0x250000) syz_ublk_setup_queues(r0, r6, &(0x7f0000000200)={0x0, 0x1460, 0x400, 0x3, 0xb4}, &(0x7f00000002c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x181b, 0x0, 0x2, 0x2ae, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1e40, 0x1, 0x9, 0x502, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3cb5, 0x1000, 0x3, 0x102c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0f, 0x1000, 0x2, 0x21b, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, r5, '\x00', {0x8001, 0x48a, 0x0, 0x0}}, 0x0) chdir(&(0x7f0000000080)='./file1\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r8 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0xf) r9 = syz_open_procfs(0x0, &(0x7f0000000840)='oom_adj\x00') readv(r9, &(0x7f0000001440)=[{&(0x7f0000000040)=""/20, 0x14}], 0x1) 2.689619203s ago: executing program 0 (id=1708): add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01070036dd0000001d00670000000c0099c300741300001f9abc7c03f30c3612b1e54443b0d5dce9b7ab9df0a8586fc114f90020fb417356d9814ba479382a56b8469dc10b0490172821a84a56c36232b49053fc09a3f6c57a02f1d25942af52a4ec112133591ef09bfe7c91951a142321bd4c6f71658c1efba739c6c591b704d52875c1f21434c98cdbe0a8a18fd6cad707eedad7262b7f324a4e91733fb668694d21e5b936844fee3a19e47d46d232b2547c46a59be90e3a42607eadd9db9ca83414569f16d8af91a608300ae61607ced5937269a83e586809cf03e21940d6f63a4998e32702189fb3be1d21358db2727474ba3322724c4b9efc700bbe0bc8826b3cc36e7d0dc6adb9d59f619ef96be30b51efe357"], 0x28}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r6], 0x44}}, 0x2000800) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000140)=0x200000000) preadv2(r1, &(0x7f0000000080)=[{&(0x7f0000000000)=""/72, 0x48}], 0x1, 0x0, 0x0, 0x3) 2.645275255s ago: executing program 4 (id=1709): r0 = socket$inet6(0xa, 0x80000, 0x8000000003c) r1 = syz_open_dev$sg(&(0x7f0000000140), 0xa, 0x28102) r2 = fcntl$dupfd(r1, 0x0, r1) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/151, 0x97}], 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, 0x0, 0x0) bind$rds(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x2, @loopback}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) get_robust_list(0x0, 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r5, 0x0, 0x30000000) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x40044) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write$snddsp(r2, &(0x7f0000000340)="87ecc00c05dbb58b776f34f9b779d998d21e0e3353174bb169f81d1590532836dee3667c58e173cdd67b", 0x2a) 2.141170033s ago: executing program 2 (id=1710): r0 = syz_usb_connect$uac3(0x0, 0xa0, &(0x7f0000002440)=ANY=[@ANYRES16], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000240)={0x20, 0x6, 0x4, "e971ec7b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000000180)={0x2c, &(0x7f0000000000)={0x0, 0x30, 0x62, {0x62, 0x24, "67e38af6c5a04185ec46cff9db4d875ee918ba98d1ae1c6d0722293368a3345b88d6a2c307021c07e388be0572325e1320ef95eef2505ae02ff61eb3f6fe0172f932f4937ef58aa1ce1ede1f82bf3aed1e73551a96f14c71b5c7c08c990ff25f"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41f}}, &(0x7f00000000c0)={0x0, 0xf, 0x31, {0x5, 0xf, 0x31, 0x4, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0x9, 0x9, 0x9e}, @ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x2, 0x50, 0x6, 0x3, 0x101, 0x6}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "62b9f6696c02494e4d496c590f533b3b"}]}}, &(0x7f0000000100)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1, 0x7ed3f859e9291448, 0x8, 0x3, "c0549bda", 'Mz2U'}}, &(0x7f0000000140)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x60, 0x6, 0xa0, 0x5, 0x6, 0x101}}}, &(0x7f00000008c0)={0x84, &(0x7f0000001840)={0x40, 0xd, 0x84, "40d79bf23ecc6f61c54a1ed6e7bebf84c80d5caf64201999e83b2a47673ff6e6359a1f9c188681410c274de568a32dafcb4cbef8c89c19581ad1dd68017b7b291782d11beddf01001c2e8df9fcec5c986dd81b1217ee465c5654c8f51cb472ea55955ed7184f8671de81fd1b61ee7903dc5dbf1b35d7fda7e9236c2cc06e7b5a50b96cb4"}, &(0x7f0000000340)={0x0, 0xa, 0x1}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x63}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000480)={0x20, 0x0, 0x8, {0x200, 0x1, [0x0]}}, &(0x7f00000004c0)={0x40, 0x7, 0x2, 0x401}, &(0x7f0000000500)={0x40, 0x9, 0x1, 0xf}, &(0x7f0000000540)={0x40, 0xb, 0x2, "ea39"}, &(0x7f0000000580)={0x40, 0xf, 0x2, 0xfff7}, &(0x7f0000000640)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000680)={0x40, 0x17, 0x6, @multicast}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "84e8"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x5}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x3}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x33}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0x10}}) syz_usb_control_io(r0, 0x0, &(0x7f0000002240)={0x88, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000001680)=ANY=[@ANYBLOB="201700000000dec2a327ab04222158003517c25533a216ff5eff640cbc345da920f0558e9cf05feac5bd95d710236d86f1962950ecb3006ec35542b37d2388975a780b1d1200a0416631b792d048ca30fdf753e46d3672a0facdefb7449d28a17000009a2348a831fcfa3cc5a7c2d7e6d2cb76bcec2e587cbfd4d5e845538d8dc6c0ffd9ac63a57d02b343e6996d3fc30863a56d8be4220ce92cede142050cdd58"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000980)={0x40, 0x23, 0x65, {0x65, 0xd, "c2c9efcf406271c4d029074a0d9f524125aae352175bf0a3e941fe6cdb23094d72fa332345f5eabc4e872e47e802e02344e09b7f655b12b380428609755df3d73ae3f657f0d5abe89c62c95d76f1288557a646dd6b009b1f51a278c20abb20d321d717"}}, &(0x7f0000000a00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x459}}, &(0x7f0000000a40)={0x0, 0xf, 0x39, {0x5, 0xf, 0x39, 0x2, [@ssp_cap={0x20, 0x10, 0xa, 0x6, 0x5, 0xc2420, 0xf000, 0x401, [0x0, 0xff00ff, 0xffc000, 0xff0000, 0x3f00]}, @ss_container_id={0x14, 0x10, 0x4, 0xb, "e0ec74f0714e435d96dcc39783ed8b95"}]}}, &(0x7f0000000a80)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x3, 0x0, 0x1, "aee4c6c2", "0a478d5e"}}, &(0x7f0000000ac0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x80, 0x4, 0x6, 0x5, 0x5, 0x1, 0x7}}}, &(0x7f0000001000)={0x84, &(0x7f0000000b40)={0x0, 0x15, 0xe0, "cb2f1e2c5f283e0044b76f8192bf27693d6a7b163c85b73671a4278114458da5df5c1bb25c02f1530654f6c482859ef4a4de301e6c8c41657a84871c615ec9c6a7735f4d82ed23d5f515f02380432965811b075be084ff9d65d9404a81eb10b34f000546d466610fc8e55c975be5834955c817fe3b93e47ace2cb589488a46fdf0cc7c74511b31b0d0dc0455f1060363c0b0cb6f52abc14ad7fa07c62ad8498ff50b2eefe0335d12c1ca357318731e958ceb0f4a307ca73aafa6f8be0b542a63e31aaf94bac9f11cea9aaa62fba9de529c4a45828bfea2aac1b3acb58fff6756"}, &(0x7f0000000c40)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000c80)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000cc0)={0x20, 0x0, 0x4, {0x2}}, &(0x7f0000000d00)={0x20, 0x0, 0x4, {0x200, 0x1}}, &(0x7f0000000d40)={0x40, 0x7, 0x2, 0x101}, &(0x7f0000000d80)={0x40, 0x9, 0x1, 0x8}, &(0x7f0000000dc0)={0x40, 0xb, 0x2, "55bf"}, &(0x7f0000000e00)={0x40, 0xf, 0x2, 0x7}, &(0x7f0000000e40)={0x40, 0x13, 0x6}, &(0x7f0000000e80)={0x40, 0x17, 0x6, @multicast}, &(0x7f0000000ec0)={0x40, 0x19, 0x2, "fc5d"}, &(0x7f0000000f00)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000f40)={0x40, 0x1c, 0x1, 0xfb}, &(0x7f0000000f80)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000fc0)={0x40, 0x21, 0x1, 0x40}}) 2.103644376s ago: executing program 1 (id=1711): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x3, @private=0xa010101}]}, &(0x7f0000000240)=0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x5) setsockopt(r0, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) 1.974321331s ago: executing program 1 (id=1712): ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) creat(0x0, 0x63) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x8417f, 0x3f00) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001ac0)=@newtfilter={0x88c, 0x2c, 0x8, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x10, 0xa}, {0x9, 0x5}, {0x1, 0x3}}, [@filter_kind_options=@f_route={{0xa}, {0x85c, 0x2, [@TCA_ROUTE4_POLICE={0x850, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x95a, 0x0, 0x6, 0x6, 0xffff6d2c, 0x81, 0x4, 0x5, 0xfffeffff, 0xcb, 0xe, 0x5b616068, 0xfffffff9, 0x8000, 0x2, 0x6, 0xffffffff, 0xae5, 0x400, 0x1, 0x294c, 0x6, 0x7e12, 0x4, 0x7, 0x0, 0xa, 0x3ff, 0x7, 0x40, 0x26, 0x85d827ea, 0x0, 0x5, 0x6, 0x3ff, 0x10001, 0x40, 0x7, 0x1, 0x9, 0x0, 0x8, 0x9, 0x7, 0x10000, 0x3, 0x7ff, 0x48000000, 0x6, 0x5, 0x2, 0x8, 0x4, 0x31, 0x3, 0x0, 0x0, 0x6, 0xfffff2d8, 0x5, 0x4, 0x1, 0xfa5, 0xfff, 0x5, 0x8001, 0x4, 0x8, 0x2, 0x7fff, 0x6, 0x84, 0x1000, 0x2, 0xffffc865, 0x1, 0x9, 0x0, 0x3, 0x9, 0x4, 0x580, 0x1, 0x1, 0x3, 0x8, 0x8, 0x8, 0x1000, 0x8, 0x952e, 0x7, 0x8, 0x8, 0x401, 0xfffffffc, 0x4, 0x1ff, 0x6416d30f, 0x0, 0x4, 0xeed8, 0x3ff, 0x77, 0x8, 0xe5a, 0x1, 0x1, 0xd, 0x1, 0x8, 0x6, 0x0, 0x3, 0x10, 0xffffffad, 0x7, 0x0, 0x6, 0x2, 0x6, 0xffffb000, 0xeebe, 0x84, 0x4, 0x1, 0x8, 0x8, 0xff, 0x9, 0x0, 0x10000, 0x8, 0x80800000, 0x1, 0x10, 0x400, 0x534, 0x7, 0xffffffff, 0x7, 0xa, 0x8, 0x0, 0x94, 0x8001, 0x8000, 0x6, 0x6, 0x0, 0xd460, 0x200, 0x80000001, 0x10, 0x2, 0x8, 0x7, 0x7, 0x2, 0x7, 0x3, 0xfffffff7, 0xfffffe01, 0x400, 0x122, 0x7, 0x2, 0x9, 0x2, 0x6, 0xbd18, 0x4, 0x4, 0x400, 0x1000, 0x4, 0xfffffff5, 0x1e, 0x544, 0x0, 0x200, 0x80, 0xfffffff9, 0x4, 0xffffffc0, 0x5, 0x6, 0x9, 0x6831, 0x2, 0x6, 0x7fffffff, 0x9, 0x0, 0x9, 0xc, 0x6, 0xffff999f, 0x6, 0x0, 0x7, 0x9, 0x101, 0x223, 0x1, 0xe, 0x27d2, 0x3, 0x7, 0x8, 0x8, 0x3a, 0x0, 0x6, 0x3, 0x2, 0x7, 0x131bc6ab, 0x4, 0x3, 0x2, 0x10001, 0x709, 0x5, 0x8, 0x0, 0x7, 0x0, 0x9, 0x5, 0x4, 0x25df, 0x5, 0x9, 0xbfe5, 0x6f, 0x80, 0x10, 0x5, 0x8, 0x670b, 0x81, 0x6, 0xfffffff7, 0x8000, 0x5d426142, 0x5, 0x2, 0x10001, 0x9, 0xfffffcc7, 0xb0d, 0x8, 0xa, 0xfffffffe]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x8001, 0x10000000, 0x9, 0x100, 0x9, {0x6, 0x0, 0x8001, 0x5, 0xf33, 0x67e2}, {0x9, 0x2, 0x3, 0x1, 0x6, 0x80}, 0x0, 0x200, 0x5}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x10000}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0x0, 0x80000000, 0x26, 0x7f56, 0x6, 0xf0a0, 0x2, 0x8, 0x80000000, 0x7, 0x101, 0x0, 0x3, 0x80, 0x8, 0x1ff, 0xf, 0x6, 0x2, 0x7, 0x3, 0xde3, 0x7b, 0x10000, 0x5, 0xa2, 0x8, 0x8001, 0x4, 0xffff, 0x672, 0xffff8325, 0x5, 0x4, 0x40, 0x5, 0x401, 0x3, 0x0, 0x2000200, 0x8, 0x3, 0x8, 0x4, 0x4, 0xfffffffb, 0x1, 0x7f, 0x5, 0x7, 0x7, 0x3, 0x1, 0x4db8, 0x589, 0x1ff, 0x100, 0x400, 0x2934, 0x9, 0x7, 0xff, 0x413, 0x7, 0x40, 0x9, 0x7, 0x3e, 0x63f, 0x400, 0x1, 0x3c9, 0xff, 0x9, 0x4, 0x81, 0x913, 0x8, 0x6, 0x0, 0x5, 0x6, 0xffffffff, 0x200, 0x0, 0x3ff, 0x9, 0x5, 0xc727, 0x8001, 0x8, 0x80, 0x143e, 0x8, 0x401, 0x2, 0x1, 0x3f, 0x200, 0x5, 0x1, 0x3, 0x6, 0xa, 0x4, 0x4, 0x401, 0x6, 0x9, 0x2, 0x0, 0x9, 0xc99, 0x800, 0x4, 0xc87da4, 0x925e, 0x9, 0x10000, 0x7ff, 0x401, 0x3c6, 0x4, 0x7, 0xea75, 0x100, 0x8894, 0x6, 0x7, 0xf7c, 0x9, 0x5, 0xfffffff9, 0xb, 0x3, 0x8, 0x5, 0xfffeffff, 0xb5, 0x0, 0x302, 0x1, 0x5, 0x3, 0x3, 0x401, 0x10001, 0x2, 0x0, 0x8, 0x6b, 0x4, 0x7e, 0xfffffb01, 0x4, 0x6, 0xd, 0x3ab, 0x2, 0xa, 0xfffffffc, 0x5, 0x401, 0x3, 0x80000000, 0x3e8, 0x9381, 0xffff, 0x2, 0x5, 0x6, 0x412, 0x4, 0x10000, 0x5b, 0x9e81, 0x0, 0x80000007, 0x62fa, 0x5, 0xc, 0x7fffffff, 0x80, 0x7, 0x4, 0x80, 0x2, 0x4, 0x8, 0xfffff8b3, 0x2f, 0x8001, 0x6, 0x9, 0x1, 0x8, 0x1, 0x1ff, 0x9, 0x800000, 0x6, 0x2, 0xd09c, 0xe, 0x7, 0x1, 0x2, 0x7fff, 0x80000000, 0xd, 0x1, 0xfff, 0x3, 0x8, 0x3, 0xdce, 0x2, 0x80, 0x3, 0x8, 0xfffffc01, 0x200, 0xdc, 0xde4, 0x9, 0x5, 0x6, 0x9, 0x0, 0x43a, 0xfffffffd, 0x0, 0x5, 0x4, 0x9cb, 0x3, 0xc, 0x80000000, 0x9, 0x1, 0x32b5, 0xb02, 0x1, 0x3, 0x0, 0x8000, 0xd42, 0x4, 0x5, 0xc, 0xc, 0xb, 0x1, 0x1ff, 0x2c45ab02]}]}, @TCA_ROUTE4_TO={0x8, 0x2, 0x8}]}}]}, 0x88c}}, 0x800) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000440)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x12) ioctl$UI_DEV_CREATE(r3, 0x5501) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000004c0)={'syz0\x00', {0x7, 0x3, 0x1, 0x9}, 0x7, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x0, 0xa9ba, 0x41f, 0x1, 0x101, 0x3, 0x6, 0xffff, 0x10000, 0x2, 0x8, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x3, 0x3, 0x9, 0xfff, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xffffffdc, 0x0, 0x0, 0xf, 0xcc, 0x5, 0x80, 0x401, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x4, 0x80000000, 0x1, 0x9, 0x7, 0x0, 0x5, 0xfff, 0x1, 0x7fe, 0x7fff, 0x2, 0x1000002, 0x8], [0x2, 0x1, 0xffff, 0x7, 0xb66, 0x2, 0x5, 0x80000001, 0x1, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x6, 0x8, 0x5, 0xcc, 0xbc1, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0x5, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x9, 0x4, 0x1, 0x5, 0x5, 0xfffffb66, 0x80, 0x2, 0x81, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x8, 0x6f, 0x80b, 0x3, 0x6, 0x525ba681, 0x4f74, 0x4, 0x1, 0x1, 0x8, 0x100, 0x6, 0x10000, 0x1306, 0x10000ab, 0x10000, 0xfe4, 0x3ff], [0x2, 0x7, 0x4, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0x9, 0x8, 0x7fffffff, 0x1, 0x1, 0x6, 0x8, 0xfffffffa, 0x7, 0x9, 0x6, 0x4, 0xfffffff7, 0xa3, 0x3, 0x0, 0x0, 0x3, 0x4c, 0x3, 0x5, 0x2, 0x0, 0x9, 0x13, 0x1, 0x2, 0xfff, 0x6, 0x100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x7, 0x47, 0xfa1, 0x0, 0x11, 0x3, 0x1, 0x5, 0x7, 0x8000, 0x1000, 0x10, 0x2, 0x10001, 0x1, 0x0, 0x6, 0x71c], [0x81, 0x3, 0x10, 0x4e26, 0x6, 0x40, 0xfffffff3, 0x497, 0x4, 0x1, 0x3, 0x5, 0x56, 0xc28, 0x9, 0x10001, 0x5, 0xa, 0x79a, 0x40, 0x9, 0x6, 0xc421, 0x80000001, 0x6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x0, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x4f, 0x78d, 0x4, 0x1, 0xffffb029, 0xfffffff8, 0x9, 0x7, 0x6, 0x101, 0x3ff, 0x7, 0x4, 0x0, 0xb, 0x400, 0x2008, 0x0, 0x8, 0x7, 0x9a33247, 0x8, 0x0, 0x1, 0x8001, 0xfffffff7, 0x5]}, 0x45c) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x100000, 0x9, {}, {0x0, 0x2, 0x4, 0xc0, 0x0, 0xf0, "18a6fc23"}, 0x1, 0x1, {}, 0x1}) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) 1.946269388s ago: executing program 4 (id=1713): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="3cedff00", @ANYRES16=r1, @ANYBLOB="010027bd7000fbdbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008a00", @ANYRES32, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x408c0}, 0x30) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x2, 0x0) r4 = syz_genetlink_get_family_id$ipvs(0x0, r3) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000080)={0x42, 0x80000009, 0x3}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000040)={0x80042, 0x1}, 0x10) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) r7 = accept4(r6, 0x0, 0x0, 0x80000) sendmmsg(r7, &(0x7f0000004bc0), 0x5b, 0x20048143) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r7, &(0x7f0000000180)={0x30000015}) bind$tipc(r5, 0x0, 0xffffffffffffff95) ioctl$XFS_IOC_GETBMAPA(r2, 0xc020582c, &(0x7f0000000280)={0x6, 0x4, 0x8, 0x7}) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x2, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x41}, 0x44) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x27}]}, @NFT_MSG_NEWSETELEM={0xdc, 0x1e, 0xa, 0x205, 0x0, 0x0, {0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xb0, 0x3, 0x0, 0x1, [{0xac, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xa8, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa4, 0x1, "0bba407e8b99721ba5620a72d0e61c07aacd0ac7580d807c409285db646dfe953b98b8516f4da6e8c60b65659199c23d80cf1715616d4168aade5fb09ee0731a43c22606f73741b686a5545837dda8b204a60830a49ff6ff1b6aead2c986b82f09433c18874d0421ddc5d321d99d61edd36876ca1e6994315e0e0337500482b4f095fe48468537a30f416a7f248ada0df2f19b7e056b28993a7d7b18af41ca36"}]}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0x140}}, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000140), 0xc, &(0x7f0000000640)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010) sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x30, r4, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x903e}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x62}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4002}, 0x4080) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc0100, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a4d2ff40f3054002241b0102030109021b00010000000009040000014eaf32000905d693"], 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) 1.751768944s ago: executing program 0 (id=1714): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x24, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}]}, 0x24}}, 0x2) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000400), 0x0, 0x8080) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000500)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x7}, 0x3, 0x20, 0x5, 0x0, 0x2, 0x400, 'syz1\x00', &(0x7f0000000700)=[':#,\x00', '\\\x00'], 0x6}) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x32b, @tick=0x440, 0xff, {}, 0x0, 0x0, 0x4b}) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="12010000a13de30840205029f1850102030109022d0002000000000904210001d553e5000905060500000000000904000001f238b50009050102f7"], 0x0) syz_usb_connect$cdc_ecm(0x4, 0x117, &(0x7f0000000600)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x105, 0x1, 0x1, 0x8, 0x20, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x2, 0x6, 0x0, 0x8d, {{0xb, 0x24, 0x6, 0x0, 0x0, "c1529b6fa9d9"}, {0x5, 0x24, 0x0, 0x10}, {0xd, 0x24, 0xf, 0x1, 0xffffffff, 0xc08, 0x0, 0xc}, [@country_functional={0xe, 0x24, 0x7, 0xa2, 0x3, [0xac92, 0x8001, 0x200, 0x4]}, @mbim={0xc, 0x24, 0x1b, 0x9, 0x5, 0x19, 0x4, 0x9, 0x2}, @mdlm_detail={0x35, 0x24, 0x13, 0x81, "5fa1527b5b61f5d0e8b678205005aee399cafc377fb693978b551b10b823e382cd020c3cdf78a4b537a4b69201ee218a28"}, @network_terminal={0x7, 0x24, 0xa, 0x2, 0x8, 0x9, 0x7}, @mdlm_detail={0x65, 0x24, 0x13, 0x3c, "07639424cc53a0d350dbed9e04124394d634822ddbf334de2153b912cc5de509689c547793c03f59828de511c7d8f023612bd7c123fb635765b497006ca79c56bec0f0d77c31cfc0ff9e46b4c6d8df4066a90e3c0cd0a7e0408f9ce0b5c99620b7"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x40, 0xbe, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x400, 0x1, 0x47, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x4, 0xf, 0x7f}}}}}]}}]}}, &(0x7f00000007c0)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x201, 0x3, 0x87, 0x9, 0x20, 0x2}, 0xb, &(0x7f0000000780)={0x5, 0xf, 0xb, 0x2, [@ptm_cap={0x3}, @ptm_cap={0x3}]}}) syz_usb_control_io$uac2(r2, &(0x7f0000000280)={0x14, &(0x7f00000001c0)={0x20, 0x11, 0x3b, {0x3b, 0x8, "b8a8d0cdb7f8aeb8984f371b265ebd7277769b71d962ec3460d25a40519e8d89ecc5a3dab552132fbd35f06a2dfc60ee208ec428bf7de41835"}}, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41b}}}, &(0x7f0000000580)={0x44, &(0x7f0000000300)={0x20, 0x8}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x7}, 0x0, &(0x7f00000003c0)={0x20, 0x81, 0x1, "18"}, &(0x7f0000000400)={0x20, 0x82, 0x2, "69b6"}, &(0x7f0000000480)={0x20, 0x83, 0x3, 'Y`,'}, &(0x7f00000004c0)=ANY=[@ANYBLOB="000000eb0000000000"], &(0x7f0000000500)={0x20, 0x85, 0x3, "daed45"}}) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000000800)={0x40, 0x3, 0x1, 'queue1\x00', 0x7}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000180)=@allocspi={0x114, 0x16, 0x1, 0x70bd27, 0x25dfdbfb, {{{@in=@rand_addr=0x64010102, @in=@multicast2, 0x4e22, 0x0, 0x4e20, 0x1ff, 0xe, 0xa0, 0x20, 0x62}, {@in6=@dev={0xfe, 0x80, '\x00', 0x2d}, 0x4d6, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @remote}, {0xfffffffffffff801, 0x5, 0x9, 0x1, 0x6, 0x2, 0x1, 0x10001}, {0x3, 0xd05, 0xb, 0x5}, {0x9, 0x5, 0x1}, 0x70bd28, 0x3507, 0xa, 0x2, 0x2, 0x425f6b5a515837c7}, 0x200, 0x10000}, [@replay_esn_val={0x1c, 0x17, {0x0, 0x70bd23, 0x70bd2b, 0x70bd2c, 0x70bd2d, 0x8}}]}, 0x114}, 0x1, 0x0, 0x0, 0x80}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) r6 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000008c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x1c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4450}, 0x80) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=@known='trusted.overlay.impure\x00', &(0x7f0000000180)='{.\x00', 0x3, 0x1) creat(&(0x7f0000000040)='./cgroup\x00', 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xb4}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="280000003300070100000000000000000c7c00000c0006"], 0x28}, 0x1, 0x0, 0x0, 0x8080}, 0xc010) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, r7, 0x0, 0x41000004, &(0x7f0000000040)) 1.598479979s ago: executing program 3 (id=1715): shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r3 = dup(r2) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) write$FUSE_CREATE_OPEN(r3, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="120000000b000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="0f0041985e000000000000d061250f4f66f9744d8c7a9e3b62b4824f6c06698a587b7b2f3a305a6d4e2882d67f98a517358fe16eba6e1d3515374aef3bd453de186541e49e6f55939371c1070a417658f4d2d200b5eae5062d1a124b0b509d83d1adf165255778c5a23b35162bf51b26a5c3c1cf2385d9d876db67ea41b8ab1b7f437812987f8f32eba6260b83c564ad08bdfb27327ebf77000000000000000000000000000000000000803406fd2e77c8ca908c432d4c08e63ae15e44f403e4c60180b6643f5a4a4863a74376ebc5d24e9de6f2fb8a495275713dd531dda4bbfccbd0ad61c7743739ce6cd0f8430a4089492ce8973bc06823ba2dcb41fac0e078dde9bd45243de6bd8e5fa14820acb9e0c55ea46c5782ed7c1cb60d22d9f219081fc72d655eee16a7215b03aa07da161274732fdd71bc3b73b6234bcd33c30c6ec58d30dbfa7e7d5918c1d3dbd9b896eac832cd2cda546ef108e0d901ea532de52d7bcc9ed6698de82849b20b82443fbdcb114924d6a34185fd74f82b252d7d96ff14d8ebe3d5f535419d39fbd5f0aabf63e571b0926f1b410e63a01984a98ee07019d1821eeba2178b56257bbbd0063b151037e0f5f89d7a9910d46ebc7c4453104fe810e6bf9e0c0204e210aa6ef01cac97160d40121bce0427453eddedc7bd9a540596f592f687d023fdd796f726a2fdb6f084b48958863d8b63946363f7ba7ca8f922aa3f7b6aac728685ea53d7a76f97abc2abeebc4a4f08ebb9bcff2f22dcd0863518ec4be56486b9bfa2a839fde22a7df505a6c511fb87d18f77c4b1c0bc570ff79e273872b8d49c4d64e941bc6a0c55ec12819a9852747fcfcb7aaaa1c068037428602515ef39354269b98159e403184e2b587ddcba1510135f92250b1967c18947b350ec678275cb0168ac053d113b4dbbd77dd24f26cb0cd06526a741e818", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) r6 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r5, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r7, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000280)=r4}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r8, &(0x7f0000000080), 0x0}, 0x20) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000000100)=0x101, 0x8629c1f1118832d4) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={0x0}, 0x1, 0x0, 0x0, 0x4040080}, 0x8000) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) sendmsg$inet(r1, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000c80)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x3}}], 0x18}, 0x10) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) r9 = getpid() r10 = syz_pidfd_open(r9, 0x0) setns(r10, 0x24020000) r11 = syz_clone(0x102c8000, 0x0, 0xfffffffffffffef7, 0x0, 0x0, 0x0) ptrace(0x10, r11) ptrace(0x8, r11) 1.182076511s ago: executing program 3 (id=1716): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r2, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@userxattr}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 530.875495ms ago: executing program 1 (id=1717): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) connect$qrtr(0xffffffffffffffff, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r4, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c642b4a1b7880610cc96655b1b141ab05", 0x2d, 0x0, &(0x7f0000000540)={0xc9, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f000020f000/0x1000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f00002d9000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00005ab000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) writev(r6, &(0x7f0000000580)=[{&(0x7f0000000040)="cfcb13aafc", 0x5}, {&(0x7f0000000140)="bf7d774c48aade35f9f410", 0xb}], 0x2) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x2000, 0x8000, 0x0, 0x7, {{0x5, 0x4, 0x0, 0x12, 0x14, 0x20, 0x4000, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x41, 0x0}, @multicast1}}}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r9, 0x4048aecb, &(0x7f0000000240)={0x4, 0x0, [{0x2, 0xffff, 0x0, 0x8, 0x0, 0x4}, {0x80000019, 0x6, 0x6, 0xfffffffe, 0x40000, 0x0, 0xd}, {0x0, 0xffffffff, 0x1, 0x9, 0x1, 0x80000001, 0x8}, {0x80000001, 0xa948a1e9, 0x7, 0x1008, 0x8, 0x5f05, 0x5}, {0xc0000000, 0x10, 0x6, 0x4, 0xe231, 0x1, 0xffffffff}]}) io_uring_enter(0xffffffffffffffff, 0x498b, 0x7731, 0x16, 0x0, 0x0) 176.667802ms ago: executing program 3 (id=1718): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYRES8=r1], 0x14}}, 0x4044) recvmmsg(r1, &(0x7f0000003900)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x12000, 0x0) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x1, 0x1}) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0xc004) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r0, &(0x7f00003a1000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYRESHEX], 0x0, 0xc, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f0000002180)=[{{&(0x7f0000000280)={0x2, 0x4e20, @private=0xa010101}, 0x10, &(0x7f0000001140)=[{&(0x7f0000000200)}], 0x1}}, {{&(0x7f0000000180)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10, &(0x7f0000000480)=[{&(0x7f0000000500)="c4", 0x1}], 0x1}}], 0x2, 0x48000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffccc, &(0x7f00000002c0)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f0000000100), 0xdc, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x4000000000000, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x4001, 0x3, 0x568, 0x0, 0x0, 0x148, 0x2d0, 0x148, 0x4d0, 0x240, 0x240, 0x4d0, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x0, 0x288, 0x2d0, 0x0, {}, [@common=@unspec=@comment={{0x120}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x6, 0x1, 0x1, 'syz1\x00', 0xc}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x8, 0x5, 0x1, 'netbios-ns\x00'}}}, {{@ip={@local, @multicast1, 0xff000000, 0xffffff00, 'tunl0\x00', 'pimreg1\x00', {0xff}, {0xff}, 0x11, 0x3, 0x60}, 0x0, 0x1b8, 0x200, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0xa, 0x9, 0x1, 0x0, 'syz1\x00', 0x10}}, @common=@inet=@multiport={{0x50}, {0x1, 0x6, [0x4e24, 0x4e22, 0x4e24, 0x4e22, 0x4e22, 0x4e24, 0x4e21, 0x4e21, 0xe20, 0x4e22, 0x4e20, 0x4e23, 0x4e23, 0x4e24, 0x4e24], [0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1], 0x1}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0xc7e, 0x8, 0x7, '\x00', {0x20}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x5c8) 0s ago: executing program 1 (id=1719): syz_usb_connect(0x2, 0x36, &(0x7f0000004a80)=ANY=[@ANYBLOB="12011001309bdd205e048402a6a7010203010902240001ce0010050904537f"], 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'vxcan1\x00', &(0x7f0000000000)=@ethtool_eeprom={0xb, 0x0, 0x1, 0x42, "f4382abc6afddc5081383b6027004f620f38c491137f30debed74ac83ce374ef82b2820844d8dc5485825952fa4e1d69754fe072b9abaec9ff31a58cae27976e85bb"}}) kernel console output (not intermixed with test programs): tdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.208033][ T1586] usb 4-1: config 0 descriptor?? [ 725.228005][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 725.239613][ T9] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 725.250355][ T992] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 725.264480][ T9] usb 1-1: USB disconnect, device number 20 [ 725.280549][ T5944] udevd[5944]: setting owner of /dev/bus/usb/001/020 to uid=0, gid=0 failed: No such file or directory [ 725.334995][ T5944] udevd[5944]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 725.441485][ T992] usb 3-1: config 0 has no interfaces? [ 725.441999][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 725.448901][ T992] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 725.466178][ T992] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 725.474347][ T992] usb 3-1: Product: syz [ 725.478588][ T992] usb 3-1: Manufacturer: syz [ 725.483876][ T992] usb 3-1: SerialNumber: syz [ 725.491224][ T992] usb 3-1: config 0 descriptor?? [ 725.610111][ T5885] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 725.810408][T10591] virt_wifi0 speed is unknown, defaulting to 1000 [ 726.151978][ T5885] usb 5-1: Using ep0 maxpacket: 8 [ 726.179985][ T5885] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 726.239090][ T5885] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 726.390787][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.392010][T10577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 726.400967][ T5885] usb 5-1: Product: syz [ 726.418926][T10577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 726.438354][ T5885] usb 5-1: Manufacturer: syz [ 726.476367][ T5885] usb 5-1: SerialNumber: syz [ 726.581435][ T5885] usb 5-1: config 0 descriptor?? [ 726.628498][ T5885] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 726.649935][T10600] FAULT_INJECTION: forcing a failure. [ 726.649935][T10600] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 726.690137][T10600] CPU: 0 UID: 0 PID: 10600 Comm: syz.1.1237 Tainted: G L syzkaller #0 PREEMPT(full) [ 726.690165][T10600] Tainted: [L]=SOFTLOCKUP [ 726.690172][T10600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 726.690181][T10600] Call Trace: [ 726.690187][T10600] [ 726.690194][T10600] dump_stack_lvl+0x100/0x190 [ 726.690223][T10600] should_fail_ex.cold+0x5/0xa [ 726.690250][T10600] _copy_to_user+0x32/0xd0 [ 726.690275][T10600] simple_read_from_buffer+0xcb/0x170 [ 726.690296][T10600] proc_fail_nth_read+0x1af/0x230 [ 726.690323][T10600] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 726.690349][T10600] ? rw_verify_area+0xce/0x6d0 [ 726.690373][T10600] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 726.690398][T10600] vfs_read+0x1e4/0xb40 [ 726.690424][T10600] ? __pfx_vfs_read+0x10/0x10 [ 726.690448][T10600] ? __fget_files+0x215/0x3d0 [ 726.690471][T10600] ? __fget_files+0x21f/0x3d0 [ 726.690495][T10600] ksys_read+0x12a/0x250 [ 726.690521][T10600] ? __pfx_ksys_read+0x10/0x10 [ 726.690554][T10600] do_syscall_64+0x115/0x870 [ 726.690578][T10600] ? clear_bhb_loop+0x40/0x90 [ 726.690599][T10600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.690616][T10600] RIP: 0033:0x7fd40cf5d68e [ 726.690631][T10600] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 726.690647][T10600] RSP: 002b:00007fd40defcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 726.690664][T10600] RAX: ffffffffffffffda RBX: 00007fd40defd6c0 RCX: 00007fd40cf5d68e [ 726.690675][T10600] RDX: 000000000000000f RSI: 00007fd40defd0a0 RDI: 0000000000000004 [ 726.690685][T10600] RBP: 00007fd40defd090 R08: 0000000000000000 R09: 0000000000000000 [ 726.690695][T10600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 726.690705][T10600] R13: 00007fd40d216038 R14: 00007fd40d215fa0 R15: 00007ffe7fb14568 [ 726.690729][T10600] [ 726.923859][T10585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 726.933250][ T9] usb 3-1: USB disconnect, device number 22 [ 726.940718][T10585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 726.975941][ T1586] usb 4-1: USB disconnect, device number 33 [ 727.026468][ T30] audit: type=1400 audit(1782631091.114:764): avc: denied { read write } for pid=10602 comm="syz.1.1238" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 727.098136][ T1586] pvrusb2: Device being rendered inoperable [ 727.108505][ T1586] pvrusb2: Device being rendered inoperable [ 727.154488][T10585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 727.159453][ T5885] gspca_zc3xx: reg_w_i err -110 [ 727.170449][ T30] audit: type=1400 audit(1782631091.114:765): avc: denied { open } for pid=10602 comm="syz.1.1238" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 727.191389][T10585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 727.229187][ T30] audit: type=1400 audit(1782631091.184:766): avc: denied { ioctl } for pid=10602 comm="syz.1.1238" path="/dev/cachefiles" dev="devtmpfs" ino=4 ioctlcmd=0x64c1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 727.233453][T10585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 727.276363][T10585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 727.328960][T10585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 727.340473][T10585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 727.410223][ T30] audit: type=1400 audit(1782631091.524:767): avc: denied { listen } for pid=10609 comm="syz.1.1241" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 727.455672][ T30] audit: type=1400 audit(1782631091.554:768): avc: denied { connect } for pid=10609 comm="syz.1.1241" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 727.541320][ T30] audit: type=1400 audit(1782631091.654:769): avc: denied { setopt } for pid=10613 comm="syz.0.1242" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 727.639349][T10620] binder_alloc: binder_alloc_mmap_handler: 10619 200000ffd000-200001000000 already mapped failed -16 [ 727.830103][ T5885] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 727.850070][ T803] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 727.866924][ T5885] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 728.024759][ T803] usb 1-1: config 0 has an invalid interface number: 38 but max is 0 [ 728.080135][ T5666] Bluetooth: hci0: command 0x0406 tx timeout [ 728.080388][ T5662] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 728.179008][ T6236] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.192097][ T6236] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.207691][ T803] usb 1-1: config 0 has an invalid descriptor of length 102, skipping remainder of the config [ 728.323991][ T6236] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.335542][ T803] usb 1-1: config 0 has no interface number 0 [ 728.366872][ T803] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 728.376828][ T6236] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.395984][ T803] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.433468][ T803] usb 1-1: Product: syz [ 728.445553][ T803] usb 1-1: Manufacturer: syz [ 728.464191][ T803] usb 1-1: SerialNumber: syz [ 728.535615][T10630] netlink: 148 bytes leftover after parsing attributes in process `syz.3.1246'. [ 728.549277][ T803] usb 1-1: config 0 descriptor?? [ 728.778903][ T803] yurex 1-1:0.38: Could not find endpoints [ 728.805611][ T803] usb 1-1: USB disconnect, device number 21 [ 728.967396][T10634] xt_l2tp: missing protocol rule (udp|l2tpip) [ 728.969229][ T30] audit: type=1400 audit(1782631093.084:770): avc: denied { ioctl } for pid=10584 comm="syz.4.1234" path="socket:[44402]" dev="sockfs" ino=44402 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 729.634117][T10640] syz.0.1249 (10640): drop_caches: 2 [ 730.040314][ T1586] usb 5-1: USB disconnect, device number 33 [ 730.560692][T10662] virt_wifi0 speed is unknown, defaulting to 1000 [ 731.503233][ T2364] pvrusb2: request_firmware fatal error with code=-110 [ 731.693251][ T2364] pvrusb2: Failure uploading firmware1 [ 731.758343][ T2364] pvrusb2: Device initialization was not successful. [ 731.769531][T10675] netlink: 148 bytes leftover after parsing attributes in process `syz.4.1258'. [ 731.796530][ T2364] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 731.833108][ T2364] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 731.871478][ T2364] pvrusb2: Failed to submit write-control URB status=-19 [ 731.881374][ T5737] pvrusb2: Device being rendered inoperable [ 731.913950][ T2364] usb 2-1: Direct firmware load for v4l-pvrusb2-29xxx-01.fw failed with error -2 [ 731.947246][ T2364] usb 2-1: Falling back to sysfs fallback for: v4l-pvrusb2-29xxx-01.fw [ 732.840107][ T5666] Bluetooth: hci0: command 0x0406 tx timeout [ 732.871731][ T5662] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 733.885815][T10701] autofs4:pid:10701:validate_dev_ioctl: invalid path supplied for cmd(0xc0189371) [ 733.909120][T10699] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1264'. [ 733.937271][ T30] audit: type=1400 audit(1782631098.054:771): avc: denied { read write } for pid=10700 comm="syz.0.1265" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 733.996148][T10699] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1264'. [ 734.005235][ T30] audit: type=1400 audit(1782631098.054:772): avc: denied { open } for pid=10700 comm="syz.0.1265" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 734.180121][ T1586] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 734.286188][T10699] 8021q: adding VLAN 0 to HW filter on device bond6 [ 734.445305][ T1586] usb 1-1: config 0 has no interfaces? [ 734.480987][ T1586] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 734.629708][ T1586] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.726953][ T1586] usb 1-1: config 0 descriptor?? [ 734.777906][T10709] bond6: (slave veth3): Enslaving as an active interface with an up link [ 734.821774][T10713] bond6 (unregistering): (slave veth3): Releasing backup interface [ 734.868001][T10713] bond6 (unregistering): Released all slaves [ 734.993817][T10701] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1265'. [ 735.011129][T10727] netlink: 148 bytes leftover after parsing attributes in process `syz.4.1270'. [ 735.031935][T10725] trusted_key: syz.1.1269 sent an empty control message without MSG_MORE. [ 735.082220][ T30] audit: type=1400 audit(1782631099.204:773): avc: denied { node_bind } for pid=10723 comm="syz.1.1269" saddr=172.20.20.58 src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 735.312786][T10739] FAULT_INJECTION: forcing a failure. [ 735.312786][T10739] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 735.326290][T10739] CPU: 0 UID: 0 PID: 10739 Comm: syz.3.1274 Tainted: G L syzkaller #0 PREEMPT(full) [ 735.326316][T10739] Tainted: [L]=SOFTLOCKUP [ 735.326321][T10739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 735.326331][T10739] Call Trace: [ 735.326335][T10739] [ 735.326339][T10739] dump_stack_lvl+0x100/0x190 [ 735.326357][T10739] should_fail_ex.cold+0x5/0xa [ 735.326373][T10739] _copy_from_user+0x2e/0xd0 [ 735.326387][T10739] binder_ioctl+0x4cb/0x74a0 [ 735.326405][T10739] ? tomoyo_path_number_perm+0x188/0x580 [ 735.326424][T10739] ? __pfx_binder_ioctl+0x10/0x10 [ 735.326437][T10739] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 735.326451][T10739] ? do_vfs_ioctl+0x226/0x13e0 [ 735.326467][T10739] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 735.326483][T10739] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 735.326503][T10739] ? hook_file_ioctl_common+0x140/0x440 [ 735.326518][T10739] ? selinux_file_ioctl+0x13b/0x290 [ 735.326533][T10739] ? selinux_file_ioctl+0xb6/0x290 [ 735.326549][T10739] ? __pfx_binder_ioctl+0x10/0x10 [ 735.326562][T10739] __x64_sys_ioctl+0x18e/0x210 [ 735.326578][T10739] do_syscall_64+0x115/0x870 [ 735.326594][T10739] ? clear_bhb_loop+0x40/0x90 [ 735.326607][T10739] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 735.326617][T10739] RIP: 0033:0x7f6d8d79ce59 [ 735.326627][T10739] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 735.326637][T10739] RSP: 002b:00007f6d8e6f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 735.326648][T10739] RAX: ffffffffffffffda RBX: 00007f6d8da15fa0 RCX: 00007f6d8d79ce59 [ 735.326655][T10739] RDX: 00002000000001c0 RSI: 00000000c0306201 RDI: 0000000000000003 [ 735.326661][T10739] RBP: 00007f6d8e6f2090 R08: 0000000000000000 R09: 0000000000000000 [ 735.326667][T10739] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 735.326673][T10739] R13: 00007f6d8da16038 R14: 00007f6d8da15fa0 R15: 00007ffc8051ae28 [ 735.326686][T10739] [ 735.326703][T10739] binder: 10738:10739 ioctl c0306201 2000000001c0 returned -14 [ 735.689632][ T992] usb 1-1: USB disconnect, device number 22 [ 736.158572][T10749] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 736.613093][T10756] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 736.633103][T10756] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 738.844322][T10791] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1287'. [ 739.267617][T10801] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1291'. [ 739.484809][T10802] syz.2.1290 (10802): drop_caches: 2 [ 739.713158][T10805] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1292'. [ 741.223321][T10834] input: syz0 as /devices/virtual/input/input69 [ 741.600838][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 741.607161][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 742.703151][ T5662] Bluetooth: hci0: unexpected cc 0x203b length: 238 > 2 [ 742.710294][ T5662] Bluetooth: hci0: unexpected event for opcode 0x203b [ 742.843867][T10866] input: syz0 as /devices/virtual/input/input70 [ 745.900508][T10895] input: syz0 as /devices/virtual/input/input71 [ 745.998436][T10899] input: syz0 as /devices/virtual/input/input72 [ 747.389465][T10912] FAULT_INJECTION: forcing a failure. [ 747.389465][T10912] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 747.430975][T10912] CPU: 0 UID: 0 PID: 10912 Comm: syz.4.1319 Tainted: G L syzkaller #0 PREEMPT(full) [ 747.431010][T10912] Tainted: [L]=SOFTLOCKUP [ 747.431015][T10912] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 747.431025][T10912] Call Trace: [ 747.431029][T10912] [ 747.431035][T10912] dump_stack_lvl+0x100/0x190 [ 747.431063][T10912] should_fail_ex.cold+0x5/0xa [ 747.431086][T10912] _copy_to_user+0x32/0xd0 [ 747.431109][T10912] simple_read_from_buffer+0xcb/0x170 [ 747.431128][T10912] proc_fail_nth_read+0x1af/0x230 [ 747.431154][T10912] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 747.431179][T10912] ? rw_verify_area+0xce/0x6d0 [ 747.431202][T10912] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 747.431225][T10912] vfs_read+0x1e4/0xb40 [ 747.431253][T10912] ? __pfx_vfs_read+0x10/0x10 [ 747.431276][T10912] ? __fget_files+0x215/0x3d0 [ 747.431297][T10912] ? __fget_files+0x21f/0x3d0 [ 747.431320][T10912] ksys_read+0x12a/0x250 [ 747.431343][T10912] ? __pfx_ksys_read+0x10/0x10 [ 747.431375][T10912] do_syscall_64+0x115/0x870 [ 747.431399][T10912] ? clear_bhb_loop+0x40/0x90 [ 747.431418][T10912] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.431433][T10912] RIP: 0033:0x7fa0ef75d68e [ 747.431446][T10912] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 747.431461][T10912] RSP: 002b:00007fa0f0589fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 747.431476][T10912] RAX: ffffffffffffffda RBX: 00007fa0f058a6c0 RCX: 00007fa0ef75d68e [ 747.431487][T10912] RDX: 000000000000000f RSI: 00007fa0f058a0a0 RDI: 0000000000000004 [ 747.431495][T10912] RBP: 00007fa0f058a090 R08: 0000000000000000 R09: 0000000000000000 [ 747.431505][T10912] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 747.431513][T10912] R13: 00007fa0efa16038 R14: 00007fa0efa15fa0 R15: 00007ffe2c879008 [ 747.431535][T10912] [ 748.113171][T10915] syz.4.1320 (10915): drop_caches: 2 [ 748.872119][T10932] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 749.014850][T10934] input: syz0 as /devices/virtual/input/input73 [ 749.678743][T10946] input: syz0 as /devices/virtual/input/input74 [ 750.551548][T10968] virt_wifi0 speed is unknown, defaulting to 1000 [ 751.910319][T10984] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 751.939450][T10977] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 752.230109][ T992] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 752.400757][T10991] netlink: 148 bytes leftover after parsing attributes in process `syz.4.1339'. [ 752.410689][ T992] usb 3-1: Using ep0 maxpacket: 8 [ 752.427709][ T992] usb 3-1: config 0 has an invalid interface number: 33 but max is 1 [ 752.441628][ T5651] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 752.454760][ T992] usb 3-1: config 0 has no interface number 1 [ 752.472863][ T992] usb 3-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 752.507209][ T992] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 752.535158][ T992] usb 3-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 752.546873][ T992] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.569710][ T992] usb 3-1: Product: syz [ 752.582901][ T992] usb 3-1: Manufacturer: syz [ 752.596964][ T992] usb 3-1: SerialNumber: syz [ 752.605079][ T992] usb 3-1: config 0 descriptor?? [ 752.614658][ T992] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 752.623618][ T5651] usb 1-1: config 7 has an invalid interface number: 223 but max is 0 [ 752.632775][ T5651] usb 1-1: config 7 has no interface number 0 [ 752.639821][ T5651] usb 1-1: too many endpoints for config 7 interface 223 altsetting 7: 36, using maximum allowed: 30 [ 752.653484][ T5651] usb 1-1: config 7 interface 223 altsetting 7 has an endpoint descriptor with address 0x52, changing to 0x2 [ 752.687976][ T5651] usb 1-1: config 7 interface 223 altsetting 7 endpoint 0x2 has invalid maxpacket 60846, setting to 64 [ 753.014126][ T992] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 753.022941][ T5651] usb 1-1: config 7 interface 223 altsetting 7 has a duplicate endpoint with address 0x5, skipping [ 753.035267][ T5651] usb 1-1: config 7 interface 223 altsetting 7 has 5 endpoint descriptors, different from the interface descriptor's value: 36 [ 753.057768][ T5651] usb 1-1: config 7 interface 223 has no altsetting 0 [ 753.072225][ T5651] usb 1-1: New USB device found, idVendor=1199, idProduct=0023, bcdDevice=58.16 [ 753.081750][ T5651] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 753.096896][ T5651] usb 1-1: Product: syz [ 753.108871][ T5651] usb 1-1: Manufacturer: syz [ 753.124213][ T5651] usb 1-1: SerialNumber: syz [ 753.684915][ T5651] sierra 1-1:7.223: Sierra USB modem converter detected [ 753.712309][ T5651] usb 1-1: Sierra USB modem converter now attached to ttyUSB0 [ 753.785219][T11009] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 753.807748][ T5651] usb 1-1: USB disconnect, device number 23 [ 753.845018][ T992] usb 3-1: USB disconnect, device number 23 [ 753.867800][ T5651] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 753.876970][ T992] pvrusb2: Device being rendered inoperable [ 753.892893][ T992] pvrusb2: Device being rendered inoperable [ 753.899378][ T5651] sierra 1-1:7.223: device disconnected [ 754.063048][T11012] vxcan1: tx drop: invalid da for name 0x0000000000000002 [ 754.094972][T11014] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1346'. [ 754.120055][ T5766] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 754.146743][T11014] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1346'. [ 754.192684][T11012] bridge0: port 2(bridge_slave_1) entered disabled state [ 754.270044][ T5766] usb 4-1: Using ep0 maxpacket: 8 [ 754.277817][ T5766] usb 4-1: config 0 has an invalid interface number: 33 but max is 1 [ 754.287287][ T5766] usb 4-1: config 0 has no interface number 1 [ 754.293826][ T5766] usb 4-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 754.305387][ T5766] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 754.326197][ T5766] usb 4-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 754.336647][ T5766] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 754.373683][ T5766] usb 4-1: Product: syz [ 754.385724][ T5766] usb 4-1: Manufacturer: syz [ 754.412527][ T5766] usb 4-1: SerialNumber: syz [ 754.441153][ T5766] usb 4-1: config 0 descriptor?? [ 754.454656][ T5766] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 754.489805][T11024] input: syz0 as /devices/virtual/input/input75 [ 754.652572][T11012] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 754.688052][ T5766] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 754.701380][T11012] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 754.875336][T11012] 0·: left allmulticast mode [ 754.893176][T11012] hsr_slave_0: left allmulticast mode [ 754.901523][T11012] hsr_slave_1: left allmulticast mode [ 755.104896][ T5766] usb 4-1: USB disconnect, device number 34 [ 755.130532][ T5766] pvrusb2: Device being rendered inoperable [ 755.158561][ T5766] pvrusb2: Device being rendered inoperable [ 755.349054][T11012] mac80211_hwsim hwsim3 wlan1: left allmulticast mode [ 755.382624][T11012] bond3: left promiscuous mode [ 755.391333][T11014] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 755.497717][ T8124] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 755.545847][ T8124] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 755.582297][ T8124] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 755.940107][ T8124] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.000500][ T8124] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 756.037140][ T8124] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.068411][ T8124] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 756.096571][ T8124] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.299200][T11048] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1353'. [ 756.622100][ T30] audit: type=1400 audit(1782631120.734:774): avc: denied { connect } for pid=11050 comm="syz.4.1355" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 756.828374][T11059] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 756.940867][ T9] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 756.968318][T11062] vxcan1: tx drop: invalid da for name 0x0000000000000002 [ 757.101234][ T5885] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 757.101396][ T9] usb 5-1: config 0 has no interfaces? [ 757.122433][ T9] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 757.140065][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 757.174560][ T9] usb 5-1: config 0 descriptor?? [ 757.270369][ T5885] usb 1-1: Using ep0 maxpacket: 8 [ 757.288207][ T5885] usb 1-1: config 0 has an invalid interface number: 33 but max is 1 [ 757.304755][T11068] input: syz0 as /devices/virtual/input/input76 [ 757.336660][ T5885] usb 1-1: config 0 has no interface number 1 [ 757.356845][ T5885] usb 1-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 757.386245][ T5885] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 757.421356][ T5885] usb 1-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 757.447087][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 757.469508][ T5885] usb 1-1: Product: syz [ 757.482516][ T5885] usb 1-1: Manufacturer: syz [ 757.493483][ T5885] usb 1-1: SerialNumber: syz [ 757.512373][ T5885] usb 1-1: config 0 descriptor?? [ 757.532265][ T5885] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 757.630066][ T30] audit: type=1400 audit(1782631121.744:775): avc: denied { read } for pid=11050 comm="syz.4.1355" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 757.634511][T11051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 757.703174][T11051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 757.744880][ T5885] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 757.808095][ T5752] usb 5-1: USB disconnect, device number 34 [ 758.406423][ T5885] usb 1-1: USB disconnect, device number 24 [ 758.416888][ T5885] pvrusb2: Device being rendered inoperable [ 758.426355][T11062] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 758.435373][ T5885] pvrusb2: Device being rendered inoperable [ 758.466383][T11062] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 758.655188][T11062] mac80211_hwsim hwsim8 wlan0: left allmulticast mode [ 758.694285][ T8124] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 758.751683][ T8124] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 758.843590][ T8124] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 758.856430][ T8124] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 758.865615][T11074] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1361'. [ 758.893079][T11074] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1361'. [ 759.809504][T11074] 8021q: adding VLAN 0 to HW filter on device bond3 [ 759.835710][T11079] bond3 (unregistering): Released all slaves [ 759.899749][T11090] netlink: 136 bytes leftover after parsing attributes in process `syz.3.1363'. [ 761.566947][T11107] input: syz0 as /devices/virtual/input/input77 [ 762.240272][ T5666] Bluetooth: hci0: command 0x0406 tx timeout [ 762.246437][ T5662] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 762.636021][T11129] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 763.960285][T11140] input: syz0 as /devices/virtual/input/input78 [ 765.374544][T11146] bond0: (slave bond_slave_1): Releasing backup interface [ 765.406369][T11150] openvswitch: netlink: IP tunnel dst address not specified [ 765.820125][T11164] virt_wifi0 speed is unknown, defaulting to 1000 [ 767.007277][T11177] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1382'. [ 767.843336][T11196] input: syz0 as /devices/virtual/input/input79 [ 767.866570][T11195] input: syz0 as /devices/virtual/input/input80 [ 768.080132][ T5662] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 768.086454][ T5662] Bluetooth: hci0: command 0x0406 tx timeout [ 768.866986][T11205] [U] ¥ [ 769.246232][T11222] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 769.600517][T11226] virt_wifi0 speed is unknown, defaulting to 1000 [ 770.020933][ T1586] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 770.300046][ T1586] usb 4-1: Using ep0 maxpacket: 8 [ 770.308335][T11235] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11235 comm=syz.4.1396 [ 770.323490][ T1586] usb 4-1: config 0 has an invalid interface number: 33 but max is 1 [ 770.491030][ T1586] usb 4-1: config 0 has no interface number 1 [ 770.507228][ T1586] usb 4-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 770.521276][T11235] xt_hashlimit: size too large, truncated to 1048576 [ 770.598564][ T1586] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 770.655280][ T1586] usb 4-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 770.672873][ T1586] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.719247][ T1586] usb 4-1: Product: syz [ 770.729976][ T1586] usb 4-1: Manufacturer: syz [ 770.747208][ T1586] usb 4-1: SerialNumber: syz [ 770.807823][ T1586] usb 4-1: config 0 descriptor?? [ 770.830269][ T5752] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 770.842232][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 771.035281][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 771.044860][ T5752] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 771.053984][ T5752] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 771.065214][ T5752] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 771.077389][ T5752] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 771.096945][ T5752] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 771.575091][ T30] audit: type=1400 audit(1782631135.294:776): avc: denied { listen } for pid=11241 comm="syz.2.1398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 771.822614][ T5752] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 771.831761][ T5752] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 771.840557][ T5752] usb 5-1: Product: syz [ 771.844776][ T5752] usb 5-1: Manufacturer: syz [ 771.881483][ T5666] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 771.881660][ T5662] Bluetooth: hci0: command 0x0406 tx timeout [ 771.975331][ T5752] cdc_wdm 5-1:1.0: skipping garbage [ 771.980609][ T5752] cdc_wdm 5-1:1.0: skipping garbage [ 771.986995][ T5752] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 771.992978][ T5752] cdc_wdm 5-1:1.0: Unknown control protocol [ 772.442471][ T1586] usb 4-1: USB disconnect, device number 35 [ 772.457482][ T1586] pvrusb2: Device being rendered inoperable [ 772.481706][ T1586] pvrusb2: Device being rendered inoperable [ 772.526250][ T30] audit: type=1400 audit(1782631136.644:777): avc: denied { read write } for pid=11234 comm="syz.4.1396" name="cdc-wdm0" dev="devtmpfs" ino=3374 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 772.571178][ T30] audit: type=1400 audit(1782631136.674:778): avc: denied { open } for pid=11234 comm="syz.4.1396" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3374 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 772.597037][ T5885] usb 5-1: USB disconnect, device number 35 [ 773.316235][T11275] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11275 comm=syz.2.1405 [ 773.436827][T11275] xt_hashlimit: size too large, truncated to 1048576 [ 773.700203][ T5885] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 774.019154][T11287] input: syz0 as /devices/virtual/input/input81 [ 774.034602][ T5885] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 774.059346][ T5885] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 774.072098][ T5885] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 774.125710][ T5885] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 774.155490][ T5885] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 774.173841][ T5885] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 774.184124][ T5885] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 774.220074][ T5885] usb 3-1: Product: syz [ 774.270537][ T5885] usb 3-1: Manufacturer: syz [ 774.546808][ T5885] cdc_wdm 3-1:1.0: skipping garbage [ 774.579233][ T5885] cdc_wdm 3-1:1.0: skipping garbage [ 774.646853][ T5885] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 774.672789][ T5885] cdc_wdm 3-1:1.0: Unknown control protocol [ 774.758092][ T5885] usb 3-1: USB disconnect, device number 24 [ 775.077783][T11297] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 776.113449][T11351] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 776.460277][ T5885] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 776.904418][ T5885] usb 5-1: unable to get BOS descriptor or descriptor too short [ 776.914172][ T5885] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 776.925349][ T5885] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 776.936494][ T5885] usb 5-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 776.947927][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 776.956310][ T5885] usb 5-1: Product: syz [ 776.967088][ T5885] usb 5-1: Manufacturer: syz [ 776.973555][ T5885] usb 5-1: SerialNumber: syz [ 776.997226][ T5885] usb 5-1: selecting invalid altsetting 1 [ 777.003655][ T5885] usb 5-1: unit 6 not found! [ 777.069328][T11372] tc_dump_action: action bad kind [ 777.078613][T11372] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1421'. [ 777.250070][ T5752] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 777.347103][ T30] audit: type=1400 audit(1782631141.444:779): avc: denied { map } for pid=11373 comm="syz.3.1422" path="/dev/comedi4" dev="devtmpfs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 777.383062][ T30] audit: type=1400 audit(1782631141.454:780): avc: denied { execute } for pid=11373 comm="syz.3.1422" path="/dev/comedi4" dev="devtmpfs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 777.645895][T11378] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11378 comm=syz.2.1423 [ 777.665975][T11378] xt_hashlimit: size too large, truncated to 1048576 [ 777.691380][ T5752] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 777.702613][ T5752] usb 1-1: New USB device found, idVendor=2040, idProduct=5530, bcdDevice=a8.82 [ 777.711983][ T5752] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 777.732872][ T5752] usb 1-1: config 0 descriptor?? [ 777.741377][ T5752] smsusb:smsusb_probe: board id=8, interface number 0 [ 777.749796][ T5752] smsusb:smsusb_probe: Device initialized with return code -19 [ 777.950096][ T992] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 777.960031][ T5752] usb 1-1: USB disconnect, device number 25 [ 778.369053][ T992] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 778.380292][ T992] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 778.417449][ T992] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 778.441944][ T992] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 778.476826][ T992] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 778.501360][ T5885] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 778.534775][ T992] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 778.552317][ T5885] usb 5-1: USB disconnect, device number 36 [ 778.569574][ T992] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 778.579781][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 778.597105][ T992] usb 3-1: Product: syz [ 778.601613][ T992] usb 3-1: Manufacturer: syz [ 778.626668][ T992] cdc_wdm 3-1:1.0: skipping garbage [ 778.650215][ T992] cdc_wdm 3-1:1.0: skipping garbage [ 778.665458][ T992] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 778.681652][ T992] cdc_wdm 3-1:1.0: Unknown control protocol [ 778.843841][ T1586] usb 3-1: USB disconnect, device number 25 [ 779.811295][T11399] input: syz0 as /devices/virtual/input/input82 [ 779.879011][T11417] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 780.128930][ T30] audit: type=1400 audit(1782631144.244:781): avc: denied { write } for pid=11421 comm="syz.0.1434" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 780.160315][ T5885] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 780.176459][ T30] audit: type=1400 audit(1782631144.294:782): avc: denied { name_bind } for pid=11421 comm="syz.0.1434" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 780.320120][ T5885] usb 5-1: Using ep0 maxpacket: 8 [ 780.331357][ T5885] usb 5-1: config 0 has an invalid interface number: 33 but max is 1 [ 780.346086][ T5885] usb 5-1: config 0 has no interface number 1 [ 780.352685][ T5885] usb 5-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 780.363816][ T5885] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 780.375697][ T5885] usb 5-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 780.387094][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.395354][ T5885] usb 5-1: Product: syz [ 780.401045][ T5885] usb 5-1: Manufacturer: syz [ 780.405687][ T5885] usb 5-1: SerialNumber: syz [ 780.415770][ T5885] usb 5-1: config 0 descriptor?? [ 780.423099][T11425] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1435'. [ 780.433884][ T5885] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 780.447300][T11425] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1435'. [ 780.450061][ T1586] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 780.476586][T11425] 8021q: adding VLAN 0 to HW filter on device bond6 [ 780.600104][ T1586] usb 1-1: device descriptor read/64, error -71 [ 780.652229][ T5885] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 780.717327][T11434] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 780.747933][T11435] macvtap1: entered promiscuous mode [ 780.754456][T11435] macvtap1: entered allmulticast mode [ 780.759863][T11435] veth1_vlan: entered allmulticast mode [ 780.780098][ T992] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 780.860503][ T1586] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 780.892869][T11437] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11437 comm=syz.1.1440 [ 780.909943][T11437] xt_hashlimit: size too large, truncated to 1048576 [ 780.934090][ T992] usb 4-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=c6.98 [ 780.943379][ T992] usb 4-1: New USB device strings: Mfr=0, Product=229, SerialNumber=0 [ 780.951621][ T992] usb 4-1: Product: syz [ 780.966037][ T992] usb 4-1: config 0 descriptor?? [ 780.974321][ T5766] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 780.989224][ T992] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 780.999681][ T992] ftdi_sio ttyUSB0: unknown device type: 0xc698 [ 781.010206][ T1586] usb 1-1: device descriptor read/64, error -71 [ 781.074024][ T5885] usb 5-1: USB disconnect, device number 37 [ 781.081217][ T5885] pvrusb2: Device being rendered inoperable [ 781.088314][ T5885] pvrusb2: Device being rendered inoperable [ 781.120454][ T1586] usb usb1-port1: attempt power cycle [ 781.140050][ T5766] usb 3-1: Using ep0 maxpacket: 8 [ 781.146327][ T5766] usb 3-1: config 0 has an invalid interface number: 33 but max is 1 [ 781.154464][ T5766] usb 3-1: config 0 has no interface number 1 [ 781.160592][ T5766] usb 3-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 781.171631][ T5766] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 781.183276][ T5766] usb 3-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 781.192350][ T5766] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 781.197120][ T5752] usb 4-1: USB disconnect, device number 36 [ 781.200471][ T5766] usb 3-1: Product: syz [ 781.213285][ T5752] ftdi_sio 4-1:0.0: device disconnected [ 781.213470][ T5766] usb 3-1: Manufacturer: syz [ 781.224004][ T5766] usb 3-1: SerialNumber: syz [ 781.230911][ T5766] usb 3-1: config 0 descriptor?? [ 781.239246][ T5766] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 781.441700][ T5766] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 781.472179][ T1586] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 781.500488][ T1586] usb 1-1: device descriptor read/8, error -71 [ 781.740235][ T1586] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 781.783550][ T1586] usb 1-1: device descriptor read/8, error -71 [ 781.913783][ T1586] usb usb1-port1: unable to enumerate USB device [ 782.045901][ T5766] usb 3-1: USB disconnect, device number 26 [ 782.064300][ T5766] pvrusb2: Device being rendered inoperable [ 782.088104][ T5766] pvrusb2: Device being rendered inoperable [ 782.112504][T11448] netlink: 'syz.3.1442': attribute type 39 has an invalid length. [ 782.165129][ T30] audit: type=1400 audit(1782631146.284:783): avc: denied { create } for pid=11447 comm="syz.3.1442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 782.184836][ T30] audit: type=1400 audit(1782631146.284:784): avc: denied { connect } for pid=11447 comm="syz.3.1442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 782.312428][T11453] FAULT_INJECTION: forcing a failure. [ 782.312428][T11453] name failslab, interval 1, probability 0, space 0, times 0 [ 782.325122][T11453] CPU: 0 UID: 0 PID: 11453 Comm: syz.4.1443 Tainted: G L syzkaller #0 PREEMPT(full) [ 782.325148][T11453] Tainted: [L]=SOFTLOCKUP [ 782.325154][T11453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 782.325164][T11453] Call Trace: [ 782.325170][T11453] [ 782.325177][T11453] dump_stack_lvl+0x100/0x190 [ 782.325205][T11453] should_fail_ex.cold+0x5/0xa [ 782.325230][T11453] should_failslab+0xc2/0x120 [ 782.325253][T11453] kmem_cache_alloc_noprof+0x91/0x6a0 [ 782.325275][T11453] ? sk_prot_alloc+0x60/0x2a0 [ 782.325302][T11453] sk_prot_alloc+0x60/0x2a0 [ 782.325325][T11453] sk_alloc+0x36/0xe80 [ 782.325343][T11453] inet6_create+0x385/0x12b0 [ 782.325368][T11453] ? inet6_create+0x7f/0x12b0 [ 782.325395][T11453] __sock_create+0x339/0x860 [ 782.325422][T11453] __sys_socket+0x14d/0x260 [ 782.325445][T11453] ? fput+0x79/0x100 [ 782.325465][T11453] ? __pfx___sys_socket+0x10/0x10 [ 782.325489][T11453] ? rcu_is_watching+0x12/0xc0 [ 782.325516][T11453] ? trace_hardirqs_off+0x70/0x170 [ 782.325544][T11453] __x64_sys_socket+0x72/0xb0 [ 782.325567][T11453] ? lockdep_hardirqs_on+0x78/0x100 [ 782.325594][T11453] do_syscall_64+0x115/0x870 [ 782.325618][T11453] ? clear_bhb_loop+0x40/0x90 [ 782.325639][T11453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.325657][T11453] RIP: 0033:0x7fa0ef79ce59 [ 782.325671][T11453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 782.325689][T11453] RSP: 002b:00007fa0ed9d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 782.325707][T11453] RAX: ffffffffffffffda RBX: 00007fa0efa16180 RCX: 00007fa0ef79ce59 [ 782.325719][T11453] RDX: 000000000000003a RSI: 0000000000000002 RDI: 000000000000000a [ 782.325730][T11453] RBP: 00007fa0ed9d5090 R08: 0000000000000000 R09: 0000000000000000 [ 782.325740][T11453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 782.325751][T11453] R13: 00007fa0efa16218 R14: 00007fa0efa16180 R15: 00007ffe2c879008 [ 782.325776][T11453] [ 783.119318][T11462] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1446'. [ 783.252076][T11472] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1446'. [ 783.374318][T11472] 8021q: adding VLAN 0 to HW filter on device bond3 [ 783.408195][T11468] input: syz0 as /devices/virtual/input/input83 [ 784.510086][T11500] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 784.540866][T11504] input: syz0 as /devices/virtual/input/input84 [ 784.684526][T11508] FAULT_INJECTION: forcing a failure. [ 784.684526][T11508] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 784.728609][T11508] CPU: 1 UID: 0 PID: 11508 Comm: syz.3.1458 Tainted: G L syzkaller #0 PREEMPT(full) [ 784.728627][T11508] Tainted: [L]=SOFTLOCKUP [ 784.728631][T11508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 784.728637][T11508] Call Trace: [ 784.728642][T11508] [ 784.728646][T11508] dump_stack_lvl+0x100/0x190 [ 784.728665][T11508] should_fail_ex.cold+0x5/0xa [ 784.728681][T11508] _copy_to_user+0x32/0xd0 [ 784.728696][T11508] simple_read_from_buffer+0xcb/0x170 [ 784.728709][T11508] proc_fail_nth_read+0x1af/0x230 [ 784.728727][T11508] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 784.728743][T11508] ? rw_verify_area+0xce/0x6d0 [ 784.728758][T11508] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 784.728774][T11508] vfs_read+0x1e4/0xb40 [ 784.728792][T11508] ? __pfx_vfs_read+0x10/0x10 [ 784.728807][T11508] ? __fget_files+0x215/0x3d0 [ 784.728821][T11508] ? __fget_files+0x21f/0x3d0 [ 784.728842][T11508] ksys_read+0x12a/0x250 [ 784.728858][T11508] ? __pfx_ksys_read+0x10/0x10 [ 784.728878][T11508] do_syscall_64+0x115/0x870 [ 784.728893][T11508] ? clear_bhb_loop+0x40/0x90 [ 784.728906][T11508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.728917][T11508] RIP: 0033:0x7f6d8d75d68e [ 784.728927][T11508] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 784.728938][T11508] RSP: 002b:00007f6d8e6f1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 784.728948][T11508] RAX: ffffffffffffffda RBX: 00007f6d8e6f26c0 RCX: 00007f6d8d75d68e [ 784.728955][T11508] RDX: 000000000000000f RSI: 00007f6d8e6f20a0 RDI: 0000000000000004 [ 784.728961][T11508] RBP: 00007f6d8e6f2090 R08: 0000000000000000 R09: 0000000000000000 [ 784.728967][T11508] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 784.728973][T11508] R13: 00007f6d8da16038 R14: 00007f6d8da15fa0 R15: 00007ffc8051ae28 [ 784.728987][T11508] [ 785.117911][ T1586] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 785.245871][T11510] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1460'. [ 785.285780][T11510] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1460'. [ 785.300044][ T1586] usb 1-1: Using ep0 maxpacket: 8 [ 785.307088][ T1586] usb 1-1: config 0 has an invalid interface number: 33 but max is 1 [ 785.328684][ T1586] usb 1-1: config 0 has no interface number 1 [ 785.356871][ T1586] usb 1-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 785.409583][ T1586] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 785.436650][ T1586] usb 1-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 785.465199][ T1586] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 785.495622][ T1586] usb 1-1: Product: syz [ 785.514662][ T1586] usb 1-1: Manufacturer: syz [ 785.526167][ T1586] usb 1-1: SerialNumber: syz [ 785.541264][ T1586] usb 1-1: config 0 descriptor?? [ 785.557222][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 785.581007][ T1586] pvrusb2: Failed to create hdw handler [ 785.607119][ T1586] pvrusb2 1-1:0.33: probe with driver pvrusb2 failed with error -12 [ 785.628000][T11524] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11524 comm=syz.4.1464 [ 785.746904][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 785.764834][T11524] xt_hashlimit: size too large, truncated to 1048576 [ 785.777684][ T1586] pvrusb2: Failed to create hdw handler [ 785.783291][ T1586] pvrusb2 1-1:0.0: probe with driver pvrusb2 failed with error -12 [ 785.935472][T11528] virt_wifi0 speed is unknown, defaulting to 1000 [ 786.574942][ T5885] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 786.765213][ T5885] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 786.782697][ T30] audit: type=1400 audit(1782631150.904:785): avc: denied { getopt } for pid=11538 comm="syz.3.1467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 786.790193][ T5885] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 786.812583][ T5885] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 786.822250][ T30] audit: type=1400 audit(1782631150.934:786): avc: denied { read } for pid=11540 comm="syz.1.1468" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 786.823928][ T5885] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 786.859954][ T5885] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 786.884755][ T5885] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 786.896962][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 786.911518][ T5885] usb 5-1: Product: syz [ 786.915742][ T5885] usb 5-1: Manufacturer: syz [ 786.928841][T11554] openvswitch: netlink: IP tunnel dst address not specified [ 786.947695][ T5885] cdc_wdm 5-1:1.0: skipping garbage [ 786.960822][ T5885] cdc_wdm 5-1:1.0: skipping garbage [ 786.973263][ T5885] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 786.979482][ T5885] cdc_wdm 5-1:1.0: Unknown control protocol [ 787.069326][ T30] audit: type=1326 audit(1782631151.184:787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11558 comm="syz.2.1471" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f313f19ce59 code=0x0 [ 787.162293][ T1586] usb 5-1: USB disconnect, device number 38 [ 787.637630][ T1586] usb 1-1: USB disconnect, device number 30 [ 787.780554][T11575] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1474'. [ 787.922084][T11579] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1475'. [ 787.939761][T11582] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1474'. [ 787.989293][T11579] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1475'. [ 788.180329][ T5662] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 788.315863][ T5662] Bluetooth: hci0: command 0x0406 tx timeout [ 788.434412][T11579] 8021q: adding VLAN 0 to HW filter on device bond4 [ 788.713219][T11588] bond4: (slave veth3): Enslaving as an active interface with an up link [ 788.730871][ T30] audit: type=1400 audit(1782631152.844:788): avc: denied { mounton } for pid=11593 comm="syz.4.1478" path="/301/file0" dev="tmpfs" ino=1672 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 789.113418][T11592] bond4 (unregistering): (slave veth3): Releasing backup interface [ 789.128517][T11592] bond4 (unregistering): Released all slaves [ 789.178781][T11594] netlink: 65185 bytes leftover after parsing attributes in process `syz.4.1478'. [ 789.188654][T11594] veth0_to_bond: default FDB implementation only supports local addresses [ 789.707414][T11612] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11612 comm=syz.1.1484 [ 789.852484][T11613] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 790.058045][T11612] xt_hashlimit: size too large, truncated to 1048576 [ 790.310089][ T5752] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 790.326336][T11618] fuse: Unknown parameter '000000000000000000030x000000000000000400000000000000000000' [ 790.366079][T11622] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1487'. [ 790.470266][ T5752] usb 3-1: Using ep0 maxpacket: 8 [ 790.479195][ T5752] usb 3-1: config 0 has an invalid interface number: 33 but max is 1 [ 790.487616][T11628] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1487'. [ 790.496661][ T5752] usb 3-1: config 0 has no interface number 1 [ 790.503292][ T5752] usb 3-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 790.515748][ T5752] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 790.529948][ T5752] usb 3-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 790.539243][ T5752] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 790.547760][ T5752] usb 3-1: Product: syz [ 790.552537][ T5752] usb 3-1: Manufacturer: syz [ 790.557709][ T5752] usb 3-1: SerialNumber: syz [ 790.600260][ T5885] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 790.689153][ T5752] usb 3-1: config 0 descriptor?? [ 790.767358][ T5752] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 790.827082][ T5752] pvrusb2: Failed to create hdw handler [ 790.854089][ T5752] pvrusb2 3-1:0.33: probe with driver pvrusb2 failed with error -12 [ 790.946862][ T5752] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 790.996310][ T5752] pvrusb2: Failed to create hdw handler [ 791.017830][ T5752] pvrusb2 3-1:0.0: probe with driver pvrusb2 failed with error -12 [ 791.711356][ T5885] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 791.721491][ T5885] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 791.731369][ T5885] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 791.742452][ T5885] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 791.764049][ T5885] usb 4-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 791.785120][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.812298][ T5885] usb 4-1: Product: syz [ 791.817716][ T5885] usb 4-1: Manufacturer: syz [ 791.825534][ T5885] usb 4-1: SerialNumber: syz [ 791.839877][ T5885] usb 4-1: config 0 descriptor?? [ 791.855974][ T5885] ums-isd200 4-1:0.0: USB Mass Storage device detected [ 792.170588][T11652] virt_wifi0 speed is unknown, defaulting to 1000 [ 792.950844][ T2364] pvrusb2: request_firmware fatal error with code=-110 [ 792.965548][ T1586] usb 3-1: USB disconnect, device number 27 [ 792.976137][ T2364] pvrusb2: Failure uploading firmware1 [ 793.002819][ T2364] pvrusb2: Device initialization was not successful. [ 793.036385][ T2364] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 793.074463][ T2364] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 793.097521][ T5737] pvrusb2: Device being rendered inoperable [ 793.894159][ T5766] libceph: connect (1)[c::]:6789 error -101 [ 793.903907][T11666] ceph: No mds server is up or the cluster is laggy [ 793.924039][ T5766] libceph: mon0 (1)[c::]:6789 connect error [ 793.996412][T11618] misc userio: Invalid payload size [ 794.134143][ T5885] scsi host1: usb-storage 4-1:0.0 [ 794.166848][ T30] audit: type=1400 audit(1782631158.284:789): avc: denied { ioctl } for pid=11674 comm="syz.2.1497" path="socket:[49928]" dev="sockfs" ino=49928 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 794.199424][ T5885] usb 4-1: USB disconnect, device number 37 [ 796.103717][T11710] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 796.202087][ T5885] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 796.370133][ T5766] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 796.390079][ T992] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 796.813605][ T5885] usb 4-1: Using ep0 maxpacket: 16 [ 797.305513][ T5885] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 797.316012][ T5885] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 797.326862][ T5885] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 797.336085][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 797.344099][ T5885] usb 4-1: Product: syz [ 797.348430][ T5885] usb 4-1: Manufacturer: syz [ 797.353184][ T5885] usb 4-1: SerialNumber: syz [ 797.375143][ T5885] usb 4-1: 0:2 : does not exist [ 797.382459][ T5885] usb 4-1: unit 9 not found! [ 797.450131][ T992] usb 5-1: Using ep0 maxpacket: 8 [ 797.456271][ T5766] usb 1-1: config 7 has an invalid interface number: 223 but max is 0 [ 797.471179][ T992] usb 5-1: config 0 has an invalid interface number: 33 but max is 1 [ 797.482348][ T5766] usb 1-1: config 7 has no interface number 0 [ 797.489906][ T992] usb 5-1: config 0 has no interface number 1 [ 797.501246][ T5766] usb 1-1: too many endpoints for config 7 interface 223 altsetting 7: 36, using maximum allowed: 30 [ 797.514848][ T992] usb 5-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 797.534076][ T5766] usb 1-1: config 7 interface 223 altsetting 7 has an endpoint descriptor with address 0x52, changing to 0x2 [ 797.548120][ T992] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 797.558068][ T5766] usb 1-1: config 7 interface 223 altsetting 7 endpoint 0x2 has invalid maxpacket 60846, setting to 64 [ 797.569333][ T5766] usb 1-1: config 7 interface 223 altsetting 7 has a duplicate endpoint with address 0x5, skipping [ 797.580902][ T5766] usb 1-1: config 7 interface 223 altsetting 7 has 5 endpoint descriptors, different from the interface descriptor's value: 36 [ 797.594416][ T30] audit: type=1400 audit(1782631161.704:790): avc: denied { append } for pid=11706 comm="syz.3.1503" name="uinput" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 797.618940][ T992] usb 5-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 797.628239][ T992] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 797.633520][T11707] loop6: detected capacity change from 0 to 2640 [ 797.636388][ T5766] usb 1-1: config 7 interface 223 has no altsetting 0 [ 797.649438][ T992] usb 5-1: Product: syz [ 797.653677][ T992] usb 5-1: Manufacturer: syz [ 797.656324][T11707] Buffer I/O error on dev loop6, logical block 0, async page read [ 797.659791][ T992] usb 5-1: SerialNumber: syz [ 797.673725][ T5766] usb 1-1: New USB device found, idVendor=1199, idProduct=0023, bcdDevice=58.16 [ 797.677227][T11707] Buffer I/O error on dev loop6, logical block 0, async page read [ 797.682834][ T5766] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 797.682857][ T5766] usb 1-1: Product: syz [ 797.682872][ T5766] usb 1-1: Manufacturer: syz [ 797.682886][ T5766] usb 1-1: SerialNumber: syz [ 797.712903][ T992] usb 5-1: config 0 descriptor?? [ 797.742776][ T992] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 797.959101][T11719] loop6: detected capacity change from 2640 to 524288000 [ 797.976235][ T5766] sierra 1-1:7.223: Sierra USB modem converter detected [ 797.982150][T11707] Buffer I/O error on dev loop6, logical block 0, async page read [ 797.998076][ T2364] pvrusb2: Invalid read control endpoint [ 798.004184][ T992] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 798.014432][ T5766] usb 1-1: Sierra USB modem converter now attached to ttyUSB0 [ 798.023339][ T2364] usb 5-1: Direct firmware load for v4l-pvrusb2-29xxx-01.fw failed with error -2 [ 798.038850][T11707] Buffer I/O error on dev loop6, logical block 0, async page read [ 798.062050][ T2364] usb 5-1: Falling back to sysfs fallback for: v4l-pvrusb2-29xxx-01.fw [ 798.093532][ T5766] usb 1-1: USB disconnect, device number 31 [ 798.145516][T11707] Buffer I/O error on dev loop6, logical block 0, async page read [ 798.152185][ T5766] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 798.206874][T11707] Buffer I/O error on dev loop6, logical block 0, async page read [ 798.216788][T11707] Buffer I/O error on dev loop6, logical block 0, async page read [ 798.225037][ T5766] sierra 1-1:7.223: device disconnected [ 798.225484][T11707] Buffer I/O error on dev loop6, logical block 0, async page read [ 798.240383][T11707] ldm_validate_partition_table(): Disk read failed. [ 798.247699][T11707] Buffer I/O error on dev loop6, logical block 0, async page read [ 798.269722][T11707] Buffer I/O error on dev loop6, logical block 0, async page read [ 798.280805][T11707] Dev loop6: unable to read RDB block 0 [ 798.287761][T11707] loop6: unable to read partition table [ 798.294902][T11707] loop_reread_partitions: partition scan of loop6 (ir¡c‡’ úÒVUŸX¯ÃG¨½›˜ñZtM<IÆ i8NL í á·ùWû@©àQ6ÒÝ%ž…û¥¡Úè) failed (rc=-5) [ 798.346339][ T4978] ldm_validate_partition_table(): Disk read failed. [ 798.361993][ T4978] Dev loop6: unable to read RDB block 0 [ 798.368862][ T4978] loop6: unable to read partition table [ 798.377081][ T5885] usb 4-1: USB disconnect, device number 38 [ 798.475019][ T992] usb 5-1: USB disconnect, device number 39 [ 798.479126][T11724] netlink: 'syz.2.1508': attribute type 9 has an invalid length. [ 798.924315][T11727] 9pnet_fd: Insufficient options for proto=fd [ 799.353377][ T5737] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 799.901026][T11748] overlayfs: overlapping lowerdir path [ 799.949871][ T5737] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 799.961727][T11750] overlayfs: overlapping lowerdir path [ 800.225233][ T5737] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 800.236881][ T5737] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 800.270563][ T5737] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 800.296531][ T5737] usb 2-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 800.308697][ T5737] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.329330][ T5737] usb 2-1: Product: syz [ 800.333644][ T5737] usb 2-1: Manufacturer: syz [ 800.341975][ T5737] usb 2-1: SerialNumber: syz [ 800.350912][ T5737] usb 2-1: config 0 descriptor?? [ 800.359450][ T5737] adutux 2-1:0.0: interrupt endpoints not found [ 800.581740][T11753] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1516'. [ 800.735843][T11758] input: syz0 as /devices/virtual/input/input86 [ 800.928102][T11762] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 801.290130][ T5885] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 801.757750][ T5766] usb 2-1: USB disconnect, device number 37 [ 801.860085][ T5885] usb 3-1: Using ep0 maxpacket: 8 [ 801.868445][ T5885] usb 3-1: config 0 has an invalid interface number: 33 but max is 1 [ 801.945350][ T5885] usb 3-1: config 0 has no interface number 1 [ 801.974024][ T5885] usb 3-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 801.999471][ T5885] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 802.022165][ T5885] usb 3-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 802.031739][ T5885] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 802.052785][ T5885] usb 3-1: Product: syz [ 802.063627][ T5885] usb 3-1: Manufacturer: syz [ 802.088579][ T5885] usb 3-1: SerialNumber: syz [ 802.108385][ T5885] usb 3-1: config 0 descriptor?? [ 802.123959][ T5885] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 802.200039][ T5737] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 802.347463][ T5885] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 802.361785][ T5737] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 802.392690][ T5737] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 802.885948][ T5737] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 802.920613][ T5737] usb 4-1: config 0 descriptor?? [ 802.938829][ T5737] pwc: Askey VC010 type 2 USB webcam detected. [ 803.042866][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 803.042947][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 803.117211][T11782] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 803.134056][ T5885] usb 3-1: USB disconnect, device number 28 [ 803.141343][ T5885] pvrusb2: Device being rendered inoperable [ 803.151897][ T5885] pvrusb2: Device being rendered inoperable [ 803.340107][ T5737] pwc: recv_control_msg error -32 req 02 val 2b00 [ 803.380063][ T1586] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 803.520028][ T5766] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 803.530037][ T1586] usb 2-1: Using ep0 maxpacket: 8 [ 803.536606][ T1586] usb 2-1: config 0 has an invalid interface number: 33 but max is 1 [ 803.544879][ T1586] usb 2-1: config 0 has no interface number 1 [ 803.551163][ T5737] pwc: recv_control_msg error -71 req 02 val 2c00 [ 803.561089][ T1586] usb 2-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 803.572808][ T5737] pwc: recv_control_msg error -71 req 04 val 1000 [ 803.579289][ T1586] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 803.589795][ T5737] pwc: recv_control_msg error -71 req 04 val 1300 [ 803.597006][ T5737] pwc: recv_control_msg error -71 req 04 val 1400 [ 803.603986][ T5737] pwc: recv_control_msg error -71 req 02 val 2000 [ 803.610695][ T1586] usb 2-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 803.619835][ T5737] pwc: recv_control_msg error -71 req 02 val 2100 [ 803.626722][ T1586] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 803.635437][ T5737] pwc: recv_control_msg error -71 req 04 val 1500 [ 803.642783][ T1586] usb 2-1: Product: syz [ 803.648458][ T1586] usb 2-1: Manufacturer: syz [ 803.653304][ T1586] usb 2-1: SerialNumber: syz [ 803.657956][ T5737] pwc: recv_control_msg error -71 req 02 val 2500 [ 803.667228][ T1586] usb 2-1: config 0 descriptor?? [ 803.673043][ T5737] pwc: recv_control_msg error -71 req 02 val 2400 [ 803.681960][ T5766] usb 1-1: Using ep0 maxpacket: 16 [ 803.684118][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 803.690626][ T5766] usb 1-1: unable to get BOS descriptor or descriptor too short [ 803.716905][ T5766] usb 1-1: config 1 interface 0 altsetting 127 endpoint 0x81 has invalid wMaxPacketSize 0 [ 803.734760][ T5766] usb 1-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 803.751946][ T5766] usb 1-1: config 1 interface 0 has no altsetting 0 [ 803.759404][ T5737] pwc: recv_control_msg error -71 req 02 val 2600 [ 803.768156][ T5766] usb 1-1: New USB device found, idVendor=05ac, idProduct=0242, bcdDevice= 0.40 [ 803.769376][ T5737] pwc: recv_control_msg error -71 req 02 val 2900 [ 803.785718][ T5737] pwc: recv_control_msg error -71 req 02 val 2800 [ 803.796665][ T5737] pwc: recv_control_msg error -71 req 04 val 1100 [ 803.797273][ T5766] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 803.805976][ T5737] pwc: recv_control_msg error -71 req 04 val 1200 [ 803.830201][ T5737] pwc: Registered as video103. [ 803.832303][ T5766] usb 1-1: Product: syz [ 803.849396][ T5737] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input87 [ 803.851644][ T5766] usb 1-1: Manufacturer: syz [ 803.885321][ T5737] usb 4-1: USB disconnect, device number 39 [ 803.891454][ T5766] usb 1-1: SerialNumber: syz [ 803.901859][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 803.956613][T11793] netlink: 'syz.2.1528': attribute type 3 has an invalid length. [ 804.156443][ T5766] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input88 [ 804.204934][ T30] audit: type=1400 audit(1782631168.324:791): avc: denied { setopt } for pid=11792 comm="syz.2.1528" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 804.425731][T11784] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 804.446013][T11784] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 804.485733][T11784] loop9: detected capacity change from 0 to 7 [ 804.507658][T11784] Dev loop9: unable to read RDB block 7 [ 804.513755][T11784] loop9: AHDI p1 p2 p3 [ 804.517962][T11784] loop9: partition table partially beyond EOD, truncated [ 804.527450][T11784] loop9: p1 start 1601398130 is beyond EOD, truncated [ 804.534314][T11784] loop9: p2 start 1702059890 is beyond EOD, truncated [ 804.548346][T11784] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 804.558965][T11784] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 804.600881][ T1586] usb 2-1: USB disconnect, device number 38 [ 804.614357][ T1586] pvrusb2: Device being rendered inoperable [ 804.626069][ T1586] pvrusb2: Device being rendered inoperable [ 804.851340][ T4963] bcm5974 1-1:1.0: could not write to device [ 804.885907][ T5766] bcm5974 1-1:1.0: could not read from device [ 804.998832][ T4963] bcm5974 1-1:1.0: could not read from device [ 805.017135][ T5766] input: failed to attach handler mousedev to device input88, error: -5 [ 805.049026][ T4963] bcm5974 1-1:1.0: could not read from device [ 805.080753][ T5766] usb 1-1: USB disconnect, device number 32 [ 805.080781][ T4963] bcm5974 1-1:1.0: could not read from device [ 805.464542][T11821] openvswitch: netlink: IP tunnel dst address not specified [ 805.494439][T11819] input: syz1 as /devices/virtual/input/input89 [ 805.782825][T11832] binder: BINDER_SET_CONTEXT_MGR already set [ 805.929832][T11834] virt_wifi0 speed is unknown, defaulting to 1000 [ 806.293927][T11832] binder: 11831:11832 ioctl 4018620d 2000000002c0 returned -16 [ 806.310103][ T30] audit: type=1400 audit(1782631170.424:792): avc: denied { connect } for pid=11831 comm="syz.2.1536" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 806.337119][T11839] kAFS: Can only specify source 'none' with -o dyn [ 806.407375][T11828] macvtap1: left promiscuous mode [ 806.610050][ T5766] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 807.321736][ T5766] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 807.331823][ T5766] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 807.347008][ T5766] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 807.697565][ T5766] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 807.709654][ T5766] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 807.727077][ T5766] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 807.736787][ T5766] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 807.745236][ T5766] usb 1-1: Product: syz [ 807.756702][ T5766] usb 1-1: Manufacturer: syz [ 807.870664][ T5766] cdc_wdm 1-1:1.0: skipping garbage [ 807.883761][ T5766] cdc_wdm 1-1:1.0: skipping garbage [ 808.020051][T11855] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 808.398680][T11839] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 808.420809][ T5766] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 808.422494][T11839] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 808.459177][ T5766] cdc_wdm 1-1:1.0: Unknown control protocol [ 808.507875][ T30] audit: type=1400 audit(1782631172.624:793): avc: denied { write } for pid=11833 comm="syz.0.1535" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 808.663849][ T5737] usb 1-1: USB disconnect, device number 33 [ 808.836051][T11868] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 808.881349][ T5662] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 808.896735][ T5662] Bluetooth: hci0: command 0x0406 tx timeout [ 809.489885][T11876] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11876 comm=syz.1.1544 [ 809.526462][T11876] xt_hashlimit: size too large, truncated to 1048576 [ 809.830197][ T5766] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 809.856690][T11889] FAULT_INJECTION: forcing a failure. [ 809.856690][T11889] name failslab, interval 1, probability 0, space 0, times 0 [ 809.890799][ T5737] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 809.968494][T11889] CPU: 1 UID: 0 PID: 11889 Comm: syz.3.1548 Tainted: G L syzkaller #0 PREEMPT(full) [ 809.968525][T11889] Tainted: [L]=SOFTLOCKUP [ 809.968531][T11889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 809.968540][T11889] Call Trace: [ 809.968545][T11889] [ 809.968552][T11889] dump_stack_lvl+0x100/0x190 [ 809.968582][T11889] should_fail_ex.cold+0x5/0xa [ 809.968608][T11889] should_failslab+0xc2/0x120 [ 809.968632][T11889] __kmalloc_noprof+0xfc/0x820 [ 809.968654][T11889] ? video_usercopy+0x1a3/0x1730 [ 809.968676][T11889] video_usercopy+0x1a3/0x1730 [ 809.968695][T11889] ? __pfx___video_do_ioctl+0x10/0x10 [ 809.968712][T11889] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 809.968738][T11889] ? __pfx_video_usercopy+0x10/0x10 [ 809.968769][T11889] v4l2_ioctl+0x1bd/0x250 [ 809.968787][T11889] ? __pfx_v4l2_ioctl+0x10/0x10 [ 809.968808][T11889] __x64_sys_ioctl+0x18e/0x210 [ 809.968836][T11889] do_syscall_64+0x115/0x870 [ 809.968860][T11889] ? clear_bhb_loop+0x40/0x90 [ 809.968880][T11889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 809.968896][T11889] RIP: 0033:0x7f6d8d79ce59 [ 809.968910][T11889] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 809.968925][T11889] RSP: 002b:00007f6d8e6f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 809.968941][T11889] RAX: ffffffffffffffda RBX: 00007f6d8da15fa0 RCX: 00007f6d8d79ce59 [ 809.968959][T11889] RDX: 0000200000000200 RSI: 00000000c100565c RDI: 0000000000000003 [ 809.968970][T11889] RBP: 00007f6d8e6f2090 R08: 0000000000000000 R09: 0000000000000000 [ 809.968979][T11889] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 809.968988][T11889] R13: 00007f6d8da16038 R14: 00007f6d8da15fa0 R15: 00007ffc8051ae28 [ 809.969009][T11889] [ 810.290104][ T5737] usb 1-1: Using ep0 maxpacket: 16 [ 810.292196][ T5766] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 810.297718][ T5737] usb 1-1: unable to get BOS descriptor or descriptor too short [ 810.304493][ T5766] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 810.314661][ T5737] usb 1-1: config 1 interface 0 altsetting 127 endpoint 0x81 has invalid wMaxPacketSize 0 [ 810.322457][ T5766] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 810.342168][ T5766] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 810.342173][ T5737] usb 1-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 810.342202][ T5737] usb 1-1: config 1 interface 0 has no altsetting 0 [ 810.353371][ T5766] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 810.368815][ T5737] usb 1-1: New USB device found, idVendor=05ac, idProduct=0242, bcdDevice= 0.40 [ 810.404147][ T5766] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 810.413409][ T5737] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 810.427498][ T5766] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 810.437060][ T5737] usb 1-1: Product: syz [ 810.437417][ T5766] usb 2-1: Product: syz [ 810.441452][ T5737] usb 1-1: Manufacturer: syz [ 810.454269][ T5737] usb 1-1: SerialNumber: syz [ 810.557089][ T5766] usb 2-1: Manufacturer: syz [ 810.730446][T11894] syz.2.1550 (11894): drop_caches: 2 [ 810.781152][ T5766] cdc_wdm 2-1:1.0: skipping garbage [ 810.782382][ T5737] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input90 [ 810.790031][ T5766] cdc_wdm 2-1:1.0: skipping garbage [ 810.825927][ T5766] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 810.844655][ T5766] cdc_wdm 2-1:1.0: Unknown control protocol [ 811.058145][T11881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 811.071330][T11881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 811.083926][ T5766] usb 2-1: USB disconnect, device number 39 [ 811.085226][T11881] loop9: detected capacity change from 0 to 7 [ 811.550680][ T30] audit: type=1400 audit(1782631175.624:794): avc: denied { ioctl } for pid=11898 comm="syz.3.1552" path="socket:[50989]" dev="sockfs" ino=50989 ioctlcmd=0x52d2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 812.020259][T11881] Dev loop9: unable to read RDB block 7 [ 812.033286][T11906] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 812.056324][T11881] loop9: AHDI p1 p2 p3 [ 812.088158][T11881] loop9: partition table partially beyond EOD, truncated [ 812.110466][T11906] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 812.119225][T11881] loop9: p1 start 1601398130 is beyond EOD, truncated [ 812.128388][T11881] loop9: p2 start 1702059890 is beyond EOD, truncated [ 812.357969][ T5752] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 812.509270][ T4963] bcm5974 1-1:1.0: could not write to device [ 812.533423][ T4963] bcm5974 1-1:1.0: could not read from device [ 812.556101][ T5737] bcm5974 1-1:1.0: could not read from device [ 812.571464][ T5737] input: failed to attach handler mousedev to device input90, error: -5 [ 812.590661][ T4963] bcm5974 1-1:1.0: could not read from device [ 812.609143][ T5737] usb 1-1: USB disconnect, device number 34 [ 812.618778][ T4963] bcm5974 1-1:1.0: could not read from device [ 812.690044][ T5752] usb 3-1: Using ep0 maxpacket: 16 [ 812.702574][ T5752] usb 3-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 812.720353][ T5752] usb 3-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 812.759510][T11921] input: syz0 as /devices/virtual/input/input91 [ 812.787164][ T5752] usb 3-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid wMaxPacketSize 0 [ 812.826664][ T5752] usb 3-1: config 0 interface 0 has no altsetting 0 [ 812.839528][ T5752] usb 3-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 812.849093][ T5752] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 812.858169][ T5752] usb 3-1: Product: syz [ 812.862513][ T5752] usb 3-1: Manufacturer: syz [ 812.867380][ T5752] usb 3-1: SerialNumber: syz [ 812.883768][ T5752] usb 3-1: config 0 descriptor?? [ 812.985258][T11926] ipvlan2: entered allmulticast mode [ 812.997561][T11926] batadv_slave_1: entered allmulticast mode [ 813.010181][T11926] batman_adv: batadv0: Adding interface: ipvlan2 [ 813.020648][T11926] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 813.071533][T11926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 813.087912][T11926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 813.105928][ T5752] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input92 [ 813.134826][T11926] batman_adv: batadv0: Interface activated: ipvlan2 [ 813.153805][ T4963] synaptics_usb 3-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 813.200838][ T4963] synaptics_usb 3-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 813.211627][T11930] macsec1: entered allmulticast mode [ 813.242214][T11930] veth1_macvtap: entered allmulticast mode [ 813.272332][ T4963] synaptics_usb 3-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 813.282058][T11926] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1557'. [ 813.314837][ T30] audit: type=1400 audit(1782631177.424:795): avc: denied { write } for pid=11909 comm="syz.2.1553" name="mice" dev="devtmpfs" ino=917 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 813.362505][ T5639] synaptics_usb 3-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 813.383999][T11926] veth1_macvtap (unregistering): left allmulticast mode [ 813.407030][T11911] synaptics_usb 3-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 813.455062][ T4963] synaptics_usb 3-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 813.471434][ T5752] usb 3-1: USB disconnect, device number 29 [ 813.783241][T11942] input: syz0 as /devices/virtual/input/input93 [ 814.543478][T11951] syz.2.1561 (11951): drop_caches: 2 [ 814.717035][T11957] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 814.791899][T11960] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 814.922643][ T5885] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 814.990438][ T5766] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 815.060140][ T5651] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 815.082142][ T5885] usb 4-1: unable to get BOS descriptor or descriptor too short [ 815.091453][ T5885] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 815.102887][ T5885] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 815.115975][ T5885] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 815.125528][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 815.134106][ T5885] usb 4-1: Product: syz [ 815.136370][T11964] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11964 comm=syz.0.1567 [ 815.138451][ T5885] usb 4-1: Manufacturer: syz [ 815.155897][ T5885] usb 4-1: SerialNumber: syz [ 815.164864][T11964] xt_hashlimit: size too large, truncated to 1048576 [ 815.171011][ T5885] usb 4-1: selecting invalid altsetting 1 [ 815.180085][ T5766] usb 3-1: Using ep0 maxpacket: 8 [ 815.192307][ T5885] usb 4-1: unit 6 not found! [ 815.197847][ T5766] usb 3-1: config 0 has an invalid interface number: 33 but max is 1 [ 815.206318][ T5766] usb 3-1: config 0 has no interface number 1 [ 815.213562][ T5651] usb 2-1: Using ep0 maxpacket: 8 [ 815.220832][ T5766] usb 3-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 815.232114][ T5651] usb 2-1: config 0 has an invalid interface number: 33 but max is 1 [ 815.240352][ T5766] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 815.250334][ T5651] usb 2-1: config 0 has no interface number 1 [ 815.256560][ T5651] usb 2-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 815.267837][ T5651] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 815.279780][ T5766] usb 3-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 815.294812][ T5766] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 815.303086][ T5766] usb 3-1: Product: syz [ 815.307702][ T5766] usb 3-1: Manufacturer: syz [ 815.312589][ T5766] usb 3-1: SerialNumber: syz [ 815.318242][ T5651] usb 2-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 815.328910][ T5651] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 815.337995][ T5766] usb 3-1: config 0 descriptor?? [ 815.344534][ T5651] usb 2-1: Product: syz [ 815.352212][ T5766] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 815.360677][ T5651] usb 2-1: Manufacturer: syz [ 815.365399][ T5651] usb 2-1: SerialNumber: syz [ 815.388677][ T5651] usb 2-1: config 0 descriptor?? [ 815.409748][ T5651] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 815.569328][ T5766] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 815.622692][ T5651] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 815.886659][T11975] FAULT_INJECTION: forcing a failure. [ 815.886659][T11975] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 815.904268][T11975] CPU: 0 UID: 0 PID: 11975 Comm: syz.4.1570 Tainted: G L syzkaller #0 PREEMPT(full) [ 815.904302][T11975] Tainted: [L]=SOFTLOCKUP [ 815.904309][T11975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 815.904324][T11975] Call Trace: [ 815.904330][T11975] [ 815.904338][T11975] dump_stack_lvl+0x100/0x190 [ 815.904371][T11975] should_fail_ex.cold+0x5/0xa [ 815.904397][T11975] _copy_from_user+0x2e/0xd0 [ 815.904422][T11975] tipc_setsockopt+0x927/0xe30 [ 815.904447][T11975] ? __pfx_tipc_setsockopt+0x10/0x10 [ 815.904469][T11975] ? __fget_files+0x215/0x3d0 [ 815.904488][T11975] ? selinux_socket_setsockopt+0x6a/0x80 [ 815.904512][T11975] ? __pfx_tipc_setsockopt+0x10/0x10 [ 815.904532][T11975] do_sock_setsockopt+0xf3/0x1d0 [ 815.904555][T11975] __sys_setsockopt+0x195/0x220 [ 815.904578][T11975] __x64_sys_setsockopt+0xbd/0x160 [ 815.904595][T11975] ? do_syscall_64+0x90/0x870 [ 815.904620][T11975] ? lockdep_hardirqs_on+0x78/0x100 [ 815.904645][T11975] do_syscall_64+0x115/0x870 [ 815.904668][T11975] ? clear_bhb_loop+0x40/0x90 [ 815.904687][T11975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 815.904704][T11975] RIP: 0033:0x7fa0ef79ce59 [ 815.904720][T11975] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 815.904737][T11975] RSP: 002b:00007fa0f058a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 815.904757][T11975] RAX: ffffffffffffffda RBX: 00007fa0efa15fa0 RCX: 00007fa0ef79ce59 [ 815.904768][T11975] RDX: 000000000000008a RSI: 000000000000010f RDI: 0000000000000003 [ 815.904779][T11975] RBP: 00007fa0f058a090 R08: 0000000000000044 R09: 0000000000000000 [ 815.904789][T11975] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 815.904800][T11975] R13: 00007fa0efa16038 R14: 00007fa0efa15fa0 R15: 00007ffe2c879008 [ 815.904823][T11975] [ 816.130927][ T5651] usb 2-1: USB disconnect, device number 40 [ 816.144284][ T5651] pvrusb2: Device being rendered inoperable [ 816.193918][ T5766] usb 3-1: USB disconnect, device number 30 [ 816.227960][ T5766] pvrusb2: Device being rendered inoperable [ 816.243745][ T5651] pvrusb2: Device being rendered inoperable [ 816.255115][ T5766] pvrusb2: Device being rendered inoperable [ 816.349679][ T5885] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 816.392045][T11808] udevd[11808]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 816.395971][T11983] input: syz0 as /devices/virtual/input/input94 [ 816.470131][ T5752] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 816.537257][ T1586] usb 4-1: USB disconnect, device number 40 [ 816.621644][ T5752] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 816.633789][ T5752] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 816.646062][ T5752] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 816.665980][ T5752] usb 1-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 816.694186][ T5752] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.705344][ T5752] usb 1-1: Product: syz [ 816.709762][ T5752] usb 1-1: Manufacturer: syz [ 816.722373][ T5752] usb 1-1: SerialNumber: syz [ 816.741810][ T5752] usb 1-1: config 0 descriptor?? [ 816.919484][T11988] veth1_vlan: left allmulticast mode [ 816.925359][T11988] macvtap1: left allmulticast mode [ 816.942567][T11988] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 816.951854][T11988] ipvlan2: left allmulticast mode [ 816.957136][T11988] batadv_slave_1: left allmulticast mode [ 816.972273][T11979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1573'. [ 817.030078][ T5766] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 817.042576][ T5752] powermate: unknown product id 0240 [ 817.057265][ T5752] powermate: Expected payload of 3--6 bytes, found 0 bytes! [ 817.092816][ T5752] powermate 1-1:0.0: probe with driver powermate failed with error -5 [ 817.143332][ T5752] usb 1-1: USB disconnect, device number 35 [ 817.162455][T11991] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1576'. [ 817.198107][ T5766] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 817.238859][ T5766] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 817.272194][ T5766] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 817.304913][ T5766] usb 3-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 817.329675][ T5766] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 817.347910][ T5766] usb 3-1: Product: syz [ 817.358596][ T5766] usb 3-1: Manufacturer: syz [ 817.385576][ T5766] usb 3-1: SerialNumber: syz [ 817.418304][ T5766] usb 3-1: config 0 descriptor?? [ 817.537335][T11995] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1577'. [ 817.643754][T11987] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1575'. [ 817.806089][ T5766] powermate: unknown product id 0240 [ 817.812715][ T5766] powermate: Expected payload of 3--6 bytes, found 0 bytes! [ 817.821945][ T5766] powermate 3-1:0.0: probe with driver powermate failed with error -5 [ 817.877597][ T5766] usb 3-1: USB disconnect, device number 31 [ 819.560485][T12016] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1582'. [ 819.747289][T12020] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 820.224933][T12026] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 820.483858][ T5752] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 820.833873][T12032] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1587'. [ 820.882023][ T5752] usb 1-1: Using ep0 maxpacket: 8 [ 820.888585][ T5752] usb 1-1: config 0 has an invalid interface number: 33 but max is 1 [ 820.926684][ T5752] usb 1-1: config 0 has no interface number 1 [ 820.978541][ T5752] usb 1-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 821.028305][ T5752] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 821.039628][T12039] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1585'. [ 821.066793][ T5752] usb 1-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 821.088057][ T5752] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.109149][T12039] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1585'. [ 821.126304][ T5752] usb 1-1: Product: syz [ 821.134954][ T5752] usb 1-1: Manufacturer: syz [ 821.141564][ T5752] usb 1-1: SerialNumber: syz [ 821.157913][ T5752] usb 1-1: config 0 descriptor?? [ 821.181340][ T5752] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 821.196643][T12039] 8021q: adding VLAN 0 to HW filter on device bond7 [ 821.221857][T12045] bond7 (unregistering): Released all slaves [ 821.397694][ T5752] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 821.702753][T12056] input: syz0 as /devices/virtual/input/input97 [ 821.846484][T12060] macsec1: entered promiscuous mode [ 821.891392][T12060] virt_wifi0: entered promiscuous mode [ 821.899771][ T5752] usb 1-1: USB disconnect, device number 36 [ 821.923178][ T5752] pvrusb2: Device being rendered inoperable [ 821.967567][ T5752] pvrusb2: Device being rendered inoperable [ 825.522133][T12116] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 825.584781][ T5655] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 825.595359][ T5655] Bluetooth: hci0: command 0x0406 tx timeout [ 825.806876][T12112] input: syz0 as /devices/virtual/input/input98 [ 825.904767][T12122] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 826.900069][ T5885] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 827.571485][ T5885] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 827.587346][ T5885] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 827.600601][ T5885] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 827.616241][ T5885] usb 1-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 827.625661][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 827.633973][ T5885] usb 1-1: Product: syz [ 827.639077][ T5885] usb 1-1: Manufacturer: syz [ 827.643992][ T5885] usb 1-1: SerialNumber: syz [ 827.667631][ T5885] usb 1-1: config 0 descriptor?? [ 827.898755][T12129] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1608'. [ 827.941220][ T5885] powermate: unknown product id 0240 [ 827.957955][ T5885] powermate: Expected payload of 3--6 bytes, found 0 bytes! [ 827.974251][ T5885] powermate 1-1:0.0: probe with driver powermate failed with error -5 [ 828.002685][T12146] openvswitch: netlink: IP tunnel dst address not specified [ 828.018969][ T5885] usb 1-1: USB disconnect, device number 37 [ 828.849899][T12171] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1618'. [ 828.934268][T12171] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1618'. [ 829.120080][ T5655] Bluetooth: hci0: command 0x0406 tx timeout [ 829.126215][ T5662] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 829.490714][T12179] input: syz0 as /devices/virtual/input/input100 [ 831.840189][ T5655] Bluetooth: hci0: command 0x0406 tx timeout [ 831.846323][ T5662] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 832.737359][T12218] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 833.072891][ T5752] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 833.340111][ T5752] usb 4-1: Using ep0 maxpacket: 8 [ 833.349947][ T5752] usb 4-1: config 0 has an invalid interface number: 33 but max is 1 [ 833.401914][ T5752] usb 4-1: config 0 has no interface number 1 [ 833.430130][ T5752] usb 4-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 833.449667][ T5752] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 833.471582][ T5752] usb 4-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 833.759562][ T5752] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 833.769270][ T5752] usb 4-1: Product: syz [ 833.781081][ T5752] usb 4-1: Manufacturer: syz [ 833.787805][ T5752] usb 4-1: SerialNumber: syz [ 833.804640][ T5752] usb 4-1: config 0 descriptor?? [ 833.828901][ T5752] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 834.053860][ T5885] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 834.265429][ T5752] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 834.358976][ T5655] Bluetooth: hci4: unexpected event for opcode 0xfa29 [ 834.440114][ T5885] usb 1-1: Using ep0 maxpacket: 32 [ 834.453841][ T5885] usb 1-1: config 0 has no interfaces? [ 834.478250][ T5885] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 834.532278][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 834.569096][ T5885] usb 1-1: Product: syz [ 834.643005][ T5885] usb 1-1: Manufacturer: syz [ 834.707507][ T5885] usb 1-1: SerialNumber: syz [ 834.826238][ T5885] usb 1-1: config 0 descriptor?? [ 834.865019][ T5752] usb 4-1: USB disconnect, device number 41 [ 834.880089][ T5737] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 834.899484][ T5752] pvrusb2: Device being rendered inoperable [ 834.914300][ T5752] pvrusb2: Device being rendered inoperable [ 835.016718][ T5885] usb 1-1: USB disconnect, device number 38 [ 835.083242][ T5737] usb 3-1: unable to get BOS descriptor or descriptor too short [ 835.092194][ T5737] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 835.117190][ T5737] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 50, changing to 7 [ 835.450055][ T5655] Bluetooth: hci0: command 0x0406 tx timeout [ 835.456343][ T5662] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 835.478494][ T5737] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 835.516935][ T5737] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 835.532300][ T5737] usb 3-1: string descriptor 0 read error: -22 [ 835.538733][ T5737] usb 3-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 835.548128][ T5737] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 835.896915][T12267] input: syz0 as /devices/virtual/input/input101 [ 836.319886][ T5737] usb 3-1: USB disconnect, device number 32 [ 836.350912][ T5885] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 836.530074][ T5885] usb 1-1: Using ep0 maxpacket: 32 [ 836.544231][ T5885] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 836.574407][ T5885] usb 1-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 836.592502][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.611595][ T5885] usb 1-1: Product: syz [ 836.622573][ T5885] usb 1-1: Manufacturer: syz [ 836.628168][ T5885] usb 1-1: SerialNumber: syz [ 836.666130][ T5885] usb 1-1: config 0 descriptor?? [ 836.720537][ T5885] usb 1-1: no audio or video endpoints found [ 837.336439][T12296] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 837.369545][ T5737] usb 1-1: USB disconnect, device number 39 [ 837.432137][ T30] audit: type=1400 audit(1782631201.554:796): avc: denied { ioctl } for pid=12297 comm="syz.4.1650" path="socket:[53101]" dev="sockfs" ino=53101 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 837.630095][ T5885] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 837.790356][ T5885] usb 3-1: Using ep0 maxpacket: 8 [ 837.799085][ T5885] usb 3-1: config 0 has an invalid interface number: 33 but max is 1 [ 837.807439][ T5885] usb 3-1: config 0 has no interface number 1 [ 837.814936][ T5885] usb 3-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 837.826311][ T5885] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 837.843217][ T5885] usb 3-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 837.852645][ T5885] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 837.860998][ T5885] usb 3-1: Product: syz [ 837.865498][ T5885] usb 3-1: Manufacturer: syz [ 837.870786][ T5885] usb 3-1: SerialNumber: syz [ 837.891051][ T5885] usb 3-1: config 0 descriptor?? [ 837.910882][ T5885] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 838.272746][ T5885] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 838.320008][ T5662] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 838.320174][ T5655] Bluetooth: hci0: command 0x0406 tx timeout [ 838.785089][ T5885] usb 3-1: USB disconnect, device number 33 [ 838.796323][ T5885] pvrusb2: Device being rendered inoperable [ 838.825753][ T5885] pvrusb2: Device being rendered inoperable [ 839.637591][ T30] audit: type=1400 audit(1782631203.754:797): avc: denied { mount } for pid=12319 comm="syz.1.1656" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 839.668231][T12323] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 839.733350][ T30] audit: type=1400 audit(1782631203.784:798): avc: denied { mounton } for pid=12319 comm="syz.1.1656" path="/320/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 839.803383][T12345] input: syz0 as /devices/virtual/input/input102 [ 840.530663][ T30] audit: type=1400 audit(1782631204.654:799): avc: denied { unmount } for pid=5648 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 840.847564][T12357] netlink: 136 bytes leftover after parsing attributes in process `syz.0.1665'. [ 841.691377][ T5885] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 841.902935][ T5885] usb 2-1: config 7 has an invalid interface number: 223 but max is 0 [ 841.942345][ T5885] usb 2-1: config 7 has no interface number 0 [ 842.024500][ T5885] usb 2-1: too many endpoints for config 7 interface 223 altsetting 7: 36, using maximum allowed: 30 [ 842.120644][ T5885] usb 2-1: config 7 interface 223 altsetting 7 has an endpoint descriptor with address 0x52, changing to 0x2 [ 842.165535][ T5885] usb 2-1: config 7 interface 223 altsetting 7 endpoint 0x2 has invalid maxpacket 60846, setting to 64 [ 842.250179][ T5885] usb 2-1: config 7 interface 223 altsetting 7 has a duplicate endpoint with address 0x5, skipping [ 842.283373][ T5885] usb 2-1: config 7 interface 223 altsetting 7 has 5 endpoint descriptors, different from the interface descriptor's value: 36 [ 842.347244][ T5885] usb 2-1: config 7 interface 223 has no altsetting 0 [ 842.370820][ T5885] usb 2-1: New USB device found, idVendor=1199, idProduct=0023, bcdDevice=58.16 [ 842.408024][ T30] audit: type=1400 audit(1782631206.524:800): avc: denied { getopt } for pid=12374 comm="syz.4.1670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 842.461436][ T5885] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.490718][ T5885] usb 2-1: Product: syz [ 842.502218][ T5885] usb 2-1: Manufacturer: syz [ 842.518722][ T5885] usb 2-1: SerialNumber: syz [ 842.869929][T12380] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 843.056408][ T5885] sierra 2-1:7.223: Sierra USB modem converter detected [ 843.083487][ T5885] usb 2-1: Sierra USB modem converter now attached to ttyUSB0 [ 843.132671][ T5885] usb 2-1: USB disconnect, device number 41 [ 843.172398][ T5885] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 843.198982][ T5885] sierra 2-1:7.223: device disconnected [ 843.923218][T12398] netlink: 'syz.3.1677': attribute type 1 has an invalid length. [ 843.952471][T12400] openvswitch: netlink: IP tunnel dst address not specified [ 844.147793][T12405] virt_wifi0 speed is unknown, defaulting to 1000 [ 844.552869][T12398] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1677'. [ 844.635418][T12411] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1679'. [ 844.752368][T12411] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1679'. [ 845.625396][ T30] audit: type=1400 audit(1782631209.744:801): avc: denied { create } for pid=12429 comm="syz.2.1683" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 845.657036][ T30] audit: type=1400 audit(1782631209.764:802): avc: denied { setopt } for pid=12429 comm="syz.2.1683" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 845.820053][ T5651] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 845.883360][ T30] audit: type=1400 audit(1782631210.004:803): avc: denied { read } for pid=12427 comm="poweroff" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 845.943979][T12440] openvswitch: netlink: IP tunnel dst address not specified [ 845.961289][ T5737] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 846.000038][ T5651] usb 1-1: Using ep0 maxpacket: 32 [ 846.009708][ T5651] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 846.066874][ T5651] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 846.082502][T12445] input: syz0 as /devices/virtual/input/input103 [ 846.187458][ T5651] usb 1-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 846.201528][ T5737] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 846.245666][ T5651] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.260240][ T5737] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 846.294622][ T5651] usb 1-1: Product: syz [ 846.295881][T12450] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1688'. [ 846.301249][ T5651] usb 1-1: Manufacturer: syz [ 846.314371][ T5737] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 846.349462][ T5651] usb 1-1: SerialNumber: syz [ 846.351794][ T5737] usb 3-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 846.384569][ T5651] usb 1-1: config 0 descriptor?? [ 846.398973][ T30] audit: type=1326 audit(1782631210.504:804): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12449 comm="syz.1.1688" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd40cf9ce59 code=0x0 [ 846.425042][ T5737] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.436992][ T5737] usb 3-1: Product: syz [ 846.444940][ T5737] usb 3-1: Manufacturer: syz [ 846.455418][ T5651] usb 1-1: no audio or video endpoints found [ 846.472454][ T5737] usb 3-1: SerialNumber: syz [ 846.500126][ T1586] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 846.512094][ T5737] usb 3-1: config 0 descriptor?? [ 846.662362][ T1586] usb 4-1: unable to get BOS descriptor or descriptor too short [ 846.671302][ T1586] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 846.682008][ T1586] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 846.695453][ T1586] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 846.704974][ T1586] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.733679][ T1586] usb 4-1: Product: syz [ 846.746680][ T5737] powermate: unknown product id 0240 [ 846.763457][ T5737] powermate: Expected payload of 3--6 bytes, found 0 bytes! [ 846.777437][ T1586] usb 4-1: Manufacturer: syz [ 846.793882][ T1586] usb 4-1: SerialNumber: syz [ 846.799947][ T5737] powermate 3-1:0.0: probe with driver powermate failed with error -5 [ 846.829816][ T1586] usb 4-1: selecting invalid altsetting 1 [ 846.868215][ T5737] usb 3-1: USB disconnect, device number 34 [ 846.874685][ T1586] usb 4-1: unit 6 not found! [ 847.139261][ T1586] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 847.306583][T11808] udevd[11808]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 847.355826][ T1586] usb 1-1: USB disconnect, device number 40 Stopping sshd: stopped /usr/sbin/sshd (pid 5367) OK [ 848.287342][T12466] syz.0.1691 (12466): drop_caches: 2 Stopping crond: [ 848.588388][T12475] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12475 comm=syz.1.1693 [ 848.626916][ T30] audit: type=1400 audit(1782631212.744:805): avc: denied { create } for pid=12473 comm="syz.1.1693" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 stopped /usr/sbin/crond (pid 5347) OK [ 848.848163][T12480] macsec0: entered promiscuous mode [ 848.861968][T12483] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 848.870866][T12480] macsec0: entered allmulticast mode [ 848.887882][ T30] audit: type=1400 audit(1782631213.004:806): avc: denied { bpf } for pid=12479 comm="syz.1.1694" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 Stopping dhcpcd... [ 849.100066][T12490] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present stopped /sbin/dhcpcd (pid 5272) [ 849.146489][T12495] ucma_write: process 1209 (syz.4.1698) changed security contexts after opening file descriptor, this is not allowed. [ 849.223993][ T5885] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 849.244651][ T30] audit: type=1400 audit(1782631213.364:807): avc: denied { search } for pid=12494 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 849.275548][T12496] input: syz0 as /devices/virtual/input/input105 [ 849.301982][ T5737] usb 4-1: USB disconnect, device number 42 [ 849.420128][ T1586] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 849.420143][ T5885] usb 1-1: Using ep0 maxpacket: 8 [ 849.421576][ T5885] usb 1-1: config 0 has an invalid interface number: 33 but max is 1 [ 849.489216][ T5885] usb 1-1: config 0 has no interface number 1 [ 849.502658][ T5885] usb 1-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 Stopping network: [ 849.533998][ T5885] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 849.577589][ T5885] usb 1-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 849.600476][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 849.611154][ T1586] usb 2-1: Using ep0 maxpacket: 8 [ 849.622387][ T5885] usb 1-1: Product: syz [ 849.622394][ T1586] usb 2-1: config 0 has an invalid interface number: 33 but max is 1 [ 849.622416][ T1586] usb 2-1: config 0 has no interface number 1 [ 849.637515][ T5885] usb 1-1: Manufacturer: syz [ 849.667623][ T1586] usb 2-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 849.670634][ T5885] usb 1-1: SerialNumber: syz [ 849.688775][ T1586] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 849.716484][ T1586] usb 2-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 849.729189][ T5885] usb 1-1: config 0 descriptor?? [ 849.733213][ T1586] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 849.754318][ T1586] usb 2-1: Product: syz [ 849.765336][ T1586] usb 2-1: Manufacturer: syz [ 849.768954][ T5885] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 849.786828][ T1586] usb 2-1: SerialNumber: syz [ 849.803851][ T1586] usb 2-1: config 0 descriptor?? [ 849.817854][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 849.974199][ T5885] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 849.995989][ T5885] pvrusb2: Failed to create hdw handler [ 850.018917][ T5885] pvrusb2 1-1:0.0: probe with driver pvrusb2 failed with error -12 [ 850.045920][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 850.092291][ T1586] pvrusb2: Failed to create hdw handler [ 850.113208][ T1586] pvrusb2 2-1:0.0: probe with driver pvrusb2 failed with error -12 [ 850.183571][ T30] audit: type=1400 audit(1782631214.304:808): avc: denied { map_create } for pid=12482 comm="syz.0.1695" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 OK [ 850.281821][ T30] audit: type=1400 audit(1782631214.304:809): avc: denied { map_read map_write } for pid=12482 comm="syz.0.1695" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 850.352877][ T30] audit: type=1400 audit(1782631214.334:810): avc: denied { prog_load } for pid=12482 comm="syz.0.1695" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 Stopping iptables: [ 850.440190][ T5885] usb 1-1: USB disconnect, device number 41 [ 850.451272][ T5885] pvrusb2: Device being rendered inoperable OK [ 850.578935][ T1586] usb 2-1: USB disconnect, device number 42 [ 850.586227][ T1586] pvrusb2: Device being rendered inoperable [ 850.681373][T12529] FAULT_INJECTION: forcing a failure. [ 850.681373][T12529] name fail_usercopy, interval 1, probability 0, space 0, times 0 Stopping system message bus: [ 850.711635][T12529] CPU: 0 UID: 0 PID: 12529 Comm: syz.3.1701 Tainted: G L syzkaller #0 PREEMPT(full) [ 850.711665][T12529] Tainted: [L]=SOFTLOCKUP [ 850.711672][T12529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 850.711682][T12529] Call Trace: [ 850.711688][T12529] [ 850.711696][T12529] dump_stack_lvl+0x100/0x190 [ 850.711724][T12529] should_fail_ex.cold+0x5/0xa [ 850.711751][T12529] _copy_from_iter+0x1f4/0x1690 [ 850.711783][T12529] ? __asan_memset+0x23/0x50 [ 850.711801][T12529] ? __pfx__copy_from_iter+0x10/0x10 [ 850.711822][T12529] ? __pfx___alloc_skb+0x10/0x10 [ 850.711846][T12529] netlink_sendmsg+0x808/0xda0 [ 850.711876][T12529] ? __pfx_netlink_sendmsg+0x10/0x10 [ 850.711898][T12529] ? __might_fault+0x60/0x140 [ 850.711922][T12529] ____sys_sendmsg+0xa4d/0xbe0 [ 850.711942][T12529] ? __pfx_netlink_sendmsg+0x10/0x10 [ 850.711965][T12529] ? __pfx_____sys_sendmsg+0x10/0x10 [ 850.712001][T12529] ___sys_sendmsg+0x190/0x1e0 [ 850.712026][T12529] ? __pfx____sys_sendmsg+0x10/0x10 [ 850.712047][T12529] ? __lock_acquire+0x49f/0x1a40 [ 850.712070][T12529] ? get_pid_task+0x106/0x250 [ 850.712113][T12529] __sys_sendmsg+0x160/0x210 [ 850.712132][T12529] ? __pfx___sys_sendmsg+0x10/0x10 [ 850.712162][T12529] do_syscall_64+0x115/0x870 [ 850.712185][T12529] ? clear_bhb_loop+0x40/0x90 [ 850.712206][T12529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 850.712224][T12529] RIP: 0033:0x7f6d8d79ce59 [ 850.712239][T12529] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 850.712256][T12529] RSP: 002b:00007f6d8e6f2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 850.712274][T12529] RAX: ffffffffffffffda RBX: 00007f6d8da15fa0 RCX: 00007f6d8d79ce59 [ 850.712285][T12529] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 850.712296][T12529] RBP: 00007f6d8e6f2090 R08: 0000000000000000 R09: 0000000000000000 [ 850.712305][T12529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 850.712315][T12529] R13: 00007f6d8da16038 R14: 00007f6d8da15fa0 R15: 00007ffc8051ae28 [ 850.712336][T12529] [ 851.051904][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 851.051921][ T30] audit: type=1400 audit(1782631215.144:820): avc: denied { write } for pid=5273 comm="dhcpcd" name="dhcpcd" dev="tmpfs" ino=1772 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 done [ 851.516657][T12536] syz.2.1702 (12536): drop_caches: 2 [ 851.644201][ T30] audit: type=1400 audit(1782631215.144:821): avc: denied { remove_name } for pid=5273 comm="dhcpcd" name="sock" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 851.771232][ T30] audit: type=1400 audit(1782631215.144:822): avc: denied { unlink } for pid=5273 comm="dhcpcd" name="sock" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=sock_file permissive=1 [ 851.798179][ T30] audit: type=1400 audit(1782631215.144:823): avc: denied { write } for pid=5273 comm="dhcpcd" name="dhcpcd" dev="tmpfs" ino=1772 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 852.178209][ T30] audit: type=1400 audit(1782631215.294:824): avc: denied { read } for pid=12535 comm="syz.2.1702" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 852.280051][ T30] audit: type=1400 audit(1782631215.294:825): avc: denied { open } for pid=12535 comm="syz.2.1702" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 852.534516][ T30] audit: type=1400 audit(1782631215.304:826): avc: denied { create } for pid=12535 comm="syz.2.1702" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 852.656815][T12562] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1708'. [ 852.686302][ T30] audit: type=1400 audit(1782631215.304:827): avc: denied { write } for pid=12535 comm="syz.2.1702" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 852.727632][ T30] audit: type=1400 audit(1782631215.304:828): avc: denied { nlmsg_write } for pid=12535 comm="syz.2.1702" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 853.039766][ T30] audit: type=1400 audit(1782631215.324:829): avc: denied { write } for pid=5273 comm="dhcpcd" name="dhcpcd" dev="tmpfs" ino=1772 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 853.410502][ T5737] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 853.543970][T12582] snd_dummy snd_dummy.0: control 0:0:0:syz0:7 is already present [ 853.550257][ T5737] usb 3-1: device descriptor read/64, error -71 [ 853.604141][T12583] input: syz0 as /devices/virtual/input/input106 [ 853.800165][ T5737] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 853.820049][ T1586] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 853.950065][ T5737] usb 3-1: device descriptor read/64, error -71 [ 853.990070][ T1586] usb 1-1: Using ep0 maxpacket: 8 [ 854.025671][ T1586] usb 1-1: config 0 has an invalid interface number: 33 but max is 1 [ 854.067713][ T1586] usb 1-1: config 0 has no interface number 1 [ 854.096902][ T5737] usb usb3-port1: attempt power cycle [ 854.103850][ T1586] usb 1-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 854.132738][ T1586] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 247 [ 854.242176][ T1586] usb 1-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 854.252152][ T1586] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.265251][ T1586] usb 1-1: Product: syz [ 854.270108][ T1586] usb 1-1: Manufacturer: syz [ 854.274815][ T1586] usb 1-1: SerialNumber: syz [ 854.285955][ T1586] usb 1-1: config 0 descriptor?? [ 854.324023][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx Stopping klogd: [ 854.335471][ T1586] pvrusb2: Failed to create hdw handler [ 854.345774][ T1586] pvrusb2 1-1:0.33: probe with driver pvrusb2 failed with error -12 [ 854.366347][ T1586] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 854.385369][ T1586] pvrusb2: Failed to create hdw handler [ 854.393456][ T1586] pvrusb2 1-1:0.0: probe with driver pvrusb2 failed with error -12 OK Stopping acpid: [ 854.500089][ T5737] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 854.541782][ T5737] usb 3-1: device descriptor read/8, error -71 [ 854.820052][ T5737] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 854.950022][ T5737] usb 3-1: device descriptor read/8, error -71 [ 855.083944][ T5737] usb usb3-port1: unable to enumerate USB device [ 855.550162][ T5737] usb 2-1: new full-speed USB device number 43 using dummy_hcd OK Stopping syslogd: stopped /sbin/syslogd (pid 4960) OK [ 855.717486][ T5737] usb 2-1: config 206 has an invalid interface number: 83 but max is 0 [ 855.734787][ T5737] usb 2-1: config 206 has an invalid descriptor of length 0, skipping remainder of the config [ 855.750311][ T5737] usb 2-1: config 206 has no interface number 0 [ 855.756628][ T5737] usb 2-1: config 206 interface 83 has no altsetting 0 [ 855.767312][ T5737] usb 2-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a7.a6 [ 855.777397][ T5737] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 855.785784][ T5737] usb 2-1: Product: syz [ 855.791080][ T5737] usb 2-1: Manufacturer: syz [ 855.795779][ T5737] usb 2-1: SerialNumber: syz umount: can't remount debugfs read-only umount: tmpfs busy - remounted read-only umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! [ 855.940022][ T4978] udevd[4978]: could not touch /run/udev/queue: Read-only file system Sent SIGTERM to all processes Connection to 10.128.1.67 closed by remote host. [ 856.042982][ T5737] usb 2-1: USB disconnect, device number 43 [ 856.117170][ T5651] usb 1-1: USB disconnect, device number 42 [ 857.192858][ T5886] bridge_slave_1: left allmulticast mode [ 857.198600][ T5886] bridge_slave_1: left promiscuous mode [ 857.206496][ T5886] bridge0: port 2(bridge_slave_1) entered disabled state [ 857.216568][ T5886] bridge_slave_0: left allmulticast mode [ 857.222405][ T5886] bridge_slave_0: left promiscuous mode [ 857.229393][ T5886] bridge0: port 1(bridge_slave_0) entered disabled state [ 857.309725][ T5886] bond2 (unregistering): (slave geneve2): Releasing active interface [ 857.321070][ T5886] team0: Port device geneve1 removed [ 857.337533][ T5886] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 857.348617][ T5886] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 857.357925][ T5886] bond0 (unregistering): Released all slaves [ 857.368139][ T5886] bond1 (unregistering): (slave dummy0): Releasing active interface [ 857.377706][ T5886] bond1 (unregistering): Released all slaves [ 857.389297][ T5886] bond2 (unregistering): Released all slaves [ 857.400873][ T5886] bond3 (unregistering): Released all slaves Sent SIGKILL to all processes Requesting system poweroff [ 857.704807][ T5886] hsr_slave_0: left promiscuous mode [ 857.711078][ T5886] hsr_slave_1: left promiscuous mode [ 857.716783][ T5886] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 857.725531][ T5886] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 857.822102][ T5886] team0 (unregistering): Port device team_slave_1 removed [ 857.836617][ T5886] team0 (unregistering): Port device team_slave_0 removed [ 858.260871][ T5886] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 858.349695][ T5886] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 858.426889][ T5886] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 858.435871][ T2364] pvrusb2: ***WARNING*** Device fx2 controller firmware seems to be missing. [ 858.442678][T12618] smc: removing smcd device lo [ 858.446100][ T2364] pvrusb2: Did you install the pvrusb2 firmware files in their proper location? [ 858.460243][ T2364] pvrusb2: request_firmware unable to locate fx2 controller file v4l-pvrusb2-29xxx-01.fw [ 858.470109][ T2364] pvrusb2: Failure uploading firmware1 [ 858.475573][ T2364] pvrusb2: Device initialization was not successful. [ 858.482781][ T2364] pvrusb2: Giving up since device microcontroller firmware appears to be missing. [ 858.492041][ T2364] pvrusb2: Failed to submit write-control URB status=-19 [ 858.499108][ T992] pvrusb2: Device being rendered inoperable [ 858.510951][ T2364] usb 5-1: Direct firmware load for v4l-pvrusb2-29xxx-01.fw failed with error -2 [ 858.520675][ T2364] usb 5-1: Falling back to sysfs fallback for: v4l-pvrusb2-29xxx-01.fw [ 858.520764][ T30] kauditd_printk_skb: 18 callbacks suppressed [ 858.520776][ T30] audit: type=1400 audit(1782631222.644:848): avc: denied { firmware_load } for pid=2364 comm="pvrusb2-context" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 858.529396][ T2364] ------------[ cut here ]------------ [ 858.561416][ T2364] ret [ 858.561425][ T2364] WARNING: drivers/base/firmware_loader/fallback.c:148 at firmware_fallback_sysfs+0x6d5/0xc20, CPU#1: pvrusb2-context/2364 [ 858.576886][ T2364] Modules linked in: [ 858.580972][ T2364] CPU: 1 UID: 0 PID: 2364 Comm: pvrusb2-context Tainted: G L syzkaller #0 PREEMPT(full) [ 858.592296][ T2364] Tainted: [L]=SOFTLOCKUP [ 858.596603][ T2364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 858.606647][ T2364] RIP: 0010:firmware_fallback_sysfs+0x6d5/0xc20 [ 858.612894][ T2364] Code: ff ff e9 27 d0 f8 fa e8 b9 52 c2 fb e8 64 49 86 fb 31 ff 89 c3 89 c6 e8 19 4d c2 fb 85 db 0f 84 0f fb ff ff e8 9c 52 c2 fb 90 <0f> 0b 90 48 8b 3c 24 4c 89 e2 48 c7 c6 80 6b 70 8c e8 05 9f f8 fa [ 858.632681][ T2364] RSP: 0018:ffffc9000752f8d0 EFLAGS: 00010293 [ 858.638737][ T2364] RAX: 0000000000000000 RBX: 00000000fffffff5 RCX: ffffffff86472d77 [ 858.646703][ T2364] RDX: ffff88802d880000 RSI: ffffffff86472d84 RDI: ffff88802d880000 [ 858.654668][ T2364] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 858.662636][ T2364] R10: 00000000fffffff5 R11: 000000000000753b R12: ffffffff8cdb2b40 [ 858.670592][ T2364] R13: ffff888075cbf740 R14: 0000000000001770 R15: ffff888075cbf750 [ 858.678537][ T2364] FS: 0000000000000000(0000) GS:ffff8881241e0000(0000) knlGS:0000000000000000 [ 858.687460][ T2364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 858.694399][ T2364] CR2: 000055556273b7d0 CR3: 00000000237de000 CR4: 00000000003526f0 [ 858.702360][ T2364] Call Trace: [ 858.705613][ T2364] [ 858.708519][ T2364] ? kfree+0x22b/0x6c0 [ 858.712583][ T2364] _request_firmware+0xfd7/0x13c0 [ 858.717586][ T2364] ? __pfx__request_firmware+0x10/0x10 [ 858.723146][ T2364] ? pvr2_send_request_ex+0x13d6/0x1ea0 [ 858.728716][ T2364] request_firmware+0x35/0x50 [ 858.733395][ T2364] pvr2_locate_firmware+0x8f/0x330 [ 858.738490][ T2364] pvr2_upload_firmware1+0x1ca/0x920 [ 858.743770][ T2364] ? __pfx_pvr2_ctl_timeout+0x10/0x10 [ 858.749121][ T2364] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 858.755100][ T2364] ? __pfx_pvr2_upload_firmware1+0x10/0x10 [ 858.760933][ T2364] pvr2_hdw_initialize+0x3e6/0x3710 [ 858.766111][ T2364] ? pvr2_context_set_notify+0x1c/0x2f0 [ 858.771645][ T2364] ? find_held_lock+0x2b/0x80 [ 858.776293][ T2364] ? pvr2_context_set_notify+0x292/0x2f0 [ 858.781925][ T2364] ? __pfx_pvr2_hdw_initialize+0x10/0x10 [ 858.787534][ T2364] ? __mutex_unlock_slowpath+0x35d/0x930 [ 858.793171][ T2364] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 858.799142][ T2364] ? __pfx___schedule+0x10/0x10 [ 858.804128][ T2364] ? find_held_lock+0x2b/0x80 [ 858.808800][ T2364] ? schedule+0x225/0x2c0 [ 858.813150][ T2364] ? kthread+0x13a/0x450 [ 858.817371][ T2364] pvr2_context_thread_func+0x253/0x920 [ 858.822906][ T2364] ? __pfx_pvr2_context_thread_func+0x10/0x10 [ 858.828947][ T2364] ? rcu_is_watching+0x12/0xc0 [ 858.833718][ T2364] ? __pfx_autoremove_wake_function+0x10/0x10 [ 858.839760][ T2364] ? __kthread_parkme+0x18c/0x230 [ 858.844794][ T2364] ? kthread+0x13a/0x450 [ 858.849010][ T2364] ? __pfx_pvr2_context_thread_func+0x10/0x10 [ 858.855072][ T2364] kthread+0x370/0x450 [ 858.859133][ T2364] ? __pfx_kthread+0x10/0x10 [ 858.863731][ T2364] ret_from_fork+0x72b/0xd50 [ 858.868302][ T2364] ? __pfx_ret_from_fork+0x10/0x10 [ 858.873409][ T2364] ? __switch_to+0x800/0x10f0 [ 858.878067][ T2364] ? __pfx_kthread+0x10/0x10 [ 858.882674][ T2364] ret_from_fork_asm+0x1a/0x30 [ 858.887445][ T2364] [ 858.890457][ T2364] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 858.897711][ T2364] CPU: 1 UID: 0 PID: 2364 Comm: pvrusb2-context Tainted: G L syzkaller #0 PREEMPT(full) [ 858.908969][ T2364] Tainted: [L]=SOFTLOCKUP [ 858.913264][ T2364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 858.923292][ T2364] Call Trace: [ 858.926548][ T2364] [ 858.929452][ T2364] dump_stack_lvl+0x100/0x190 [ 858.934108][ T2364] vpanic+0x552/0x970 [ 858.938061][ T2364] ? __pfx_vpanic+0x10/0x10 [ 858.942539][ T2364] panic+0xd1/0xe0 [ 858.946232][ T2364] ? __pfx_panic+0x10/0x10 [ 858.950623][ T2364] ? check_panic_on_warn+0x1f/0x90 [ 858.955707][ T2364] check_panic_on_warn.cold+0x19/0x34 [ 858.961051][ T2364] ? firmware_fallback_sysfs+0x6d5/0xc20 [ 858.966658][ T2364] __warn.cold+0x191/0x318 [ 858.971055][ T2364] __report_bug+0x30f/0x440 [ 858.975544][ T2364] ? firmware_fallback_sysfs+0x6d5/0xc20 [ 858.981160][ T2364] ? __pfx___report_bug+0x10/0x10 [ 858.986165][ T2364] ? do_raw_spin_lock+0x128/0x260 [ 858.991167][ T2364] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 858.996514][ T2364] ? rcu_is_watching+0x12/0xc0 [ 859.001255][ T2364] ? _raw_spin_lock_irqsave+0x52/0x60 [ 859.006605][ T2364] ? find_held_lock+0x2b/0x80 [ 859.011253][ T2364] ? firmware_fallback_sysfs+0x6d5/0xc20 [ 859.016871][ T2364] report_bug+0xb2/0x220 [ 859.021090][ T2364] ? firmware_fallback_sysfs+0x6d5/0xc20 [ 859.026730][ T2364] handle_bug+0x16a/0x2a0 [ 859.031034][ T2364] exc_invalid_op+0x17/0x50 [ 859.035520][ T2364] asm_exc_invalid_op+0x1a/0x20 [ 859.040344][ T2364] RIP: 0010:firmware_fallback_sysfs+0x6d5/0xc20 [ 859.046559][ T2364] Code: ff ff e9 27 d0 f8 fa e8 b9 52 c2 fb e8 64 49 86 fb 31 ff 89 c3 89 c6 e8 19 4d c2 fb 85 db 0f 84 0f fb ff ff e8 9c 52 c2 fb 90 <0f> 0b 90 48 8b 3c 24 4c 89 e2 48 c7 c6 80 6b 70 8c e8 05 9f f8 fa [ 859.066157][ T2364] RSP: 0018:ffffc9000752f8d0 EFLAGS: 00010293 [ 859.072203][ T2364] RAX: 0000000000000000 RBX: 00000000fffffff5 RCX: ffffffff86472d77 [ 859.080148][ T2364] RDX: ffff88802d880000 RSI: ffffffff86472d84 RDI: ffff88802d880000 [ 859.088090][ T2364] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 859.096032][ T2364] R10: 00000000fffffff5 R11: 000000000000753b R12: ffffffff8cdb2b40 [ 859.103983][ T2364] R13: ffff888075cbf740 R14: 0000000000001770 R15: ffff888075cbf750 [ 859.111947][ T2364] ? firmware_fallback_sysfs+0x6c7/0xc20 [ 859.117573][ T2364] ? firmware_fallback_sysfs+0x6d4/0xc20 [ 859.123203][ T2364] ? kfree+0x22b/0x6c0 [ 859.127265][ T2364] _request_firmware+0xfd7/0x13c0 [ 859.132267][ T2364] ? __pfx__request_firmware+0x10/0x10 [ 859.137703][ T2364] ? pvr2_send_request_ex+0x13d6/0x1ea0 [ 859.143244][ T2364] request_firmware+0x35/0x50 [ 859.147903][ T2364] pvr2_locate_firmware+0x8f/0x330 [ 859.153005][ T2364] pvr2_upload_firmware1+0x1ca/0x920 [ 859.158268][ T2364] ? __pfx_pvr2_ctl_timeout+0x10/0x10 [ 859.163637][ T2364] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 859.169605][ T2364] ? __pfx_pvr2_upload_firmware1+0x10/0x10 [ 859.175405][ T2364] pvr2_hdw_initialize+0x3e6/0x3710 [ 859.180585][ T2364] ? pvr2_context_set_notify+0x1c/0x2f0 [ 859.186118][ T2364] ? find_held_lock+0x2b/0x80 [ 859.190766][ T2364] ? pvr2_context_set_notify+0x292/0x2f0 [ 859.196375][ T2364] ? __pfx_pvr2_hdw_initialize+0x10/0x10 [ 859.201982][ T2364] ? __mutex_unlock_slowpath+0x35d/0x930 [ 859.207595][ T2364] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 859.213553][ T2364] ? __pfx___schedule+0x10/0x10 [ 859.218379][ T2364] ? find_held_lock+0x2b/0x80 [ 859.223028][ T2364] ? schedule+0x225/0x2c0 [ 859.227351][ T2364] ? kthread+0x13a/0x450 [ 859.231568][ T2364] pvr2_context_thread_func+0x253/0x920 [ 859.237090][ T2364] ? __pfx_pvr2_context_thread_func+0x10/0x10 [ 859.243129][ T2364] ? rcu_is_watching+0x12/0xc0 [ 859.247877][ T2364] ? __pfx_autoremove_wake_function+0x10/0x10 [ 859.253924][ T2364] ? __kthread_parkme+0x18c/0x230 [ 859.258939][ T2364] ? kthread+0x13a/0x450 [ 859.263154][ T2364] ? __pfx_pvr2_context_thread_func+0x10/0x10 [ 859.269196][ T2364] kthread+0x370/0x450 [ 859.273246][ T2364] ? __pfx_kthread+0x10/0x10 [ 859.277818][ T2364] ret_from_fork+0x72b/0xd50 [ 859.282386][ T2364] ? __pfx_ret_from_fork+0x10/0x10 [ 859.287474][ T2364] ? __switch_to+0x800/0x10f0 [ 859.292124][ T2364] ? __pfx_kthread+0x10/0x10 [ 859.296687][ T2364] ret_from_fork_asm+0x1a/0x30 [ 859.301428][ T2364] [ 859.304631][ T2364] Kernel Offset: disabled [ 859.308944][ T2364] Rebooting in 86400 seconds..