last executing test programs:

8m16.350963107s ago: executing program 3 (id=1011):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = dup(r0)
sched_setscheduler(0x0, 0x1, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/slabinfo\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000000)=[{&(0x7f0000000100)=""/4147, 0x1033}], 0x1, 0x8b3, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r4)
sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000300)={0x4c, r5, 0x4, 0x70bd2a, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x460769a9}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0xfffffff7}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000014}, 0x0)
write$tun(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="083c86dd0001110004600000a60c6eec00be00443cfffe8000000000000000000000000000aaff020000000000000000000000000001"], 0xfdef)

8m15.867576118s ago: executing program 3 (id=1013):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000700)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000125bd7000fbdbdf25650000000c0099000180000069000000100003800c00008008000300060000000800020001000000080001007f000000080001000900000010000301040000800800030001000000b27b6ebf2d4ba9ebc93ee0d476da919d5ef87205411424cf2f541984378b18f627ff14ce78d6711ec1c6b74f17ff05746f9badad451c45fd7388941b4620f6e0640a7f6053e2ce776bce2586c35c5ecf4e4e0e02bd2354b7d3de422f35803cf4d1df1ede5112d46edbb0e62a9a955ff7a15e62ec3ca273266385882d8cbc1f0443840fff5122ed2594c23eeab5e351c6d57c7b0a26b7dc3b6bbaeb36386a4df4c068a6a5ed6abc66de7328f6a2cd3b82d8b8a9a4f984177fd50cde84112fc25cb3359ceec21edbc9a14e23abeff08a226c85b29027c2e7f226ee3bb74588b07dd07480b6793bdfaf4eec567e695895c5593425a1bce22369ec0691fb917ce82f183614cec1e283407f7c173e5feb16"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x2400c085)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_X2APIC_API(r2, 0x4068aea3, &(0x7f0000000240)={0x81, 0x0, 0x4})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
socket$inet6_mptcp(0xa, 0x1, 0x106)
socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="170000000500d9831b000100edd2fc51a8b600a17a00000000000000002594d0e0aa12aea407ade6364e9638e6ec829ec2ae8813c2db1b4a9612dd3562015011e9d479569e1450feb16bcd34053013e52b8c988c8606e6824c8a07a4c000000000000000d6e68ae72b808461a22cf6f9ba049c4dcd5f80ec1a1eee99060ee6c32fbf109afbf557aaab27cb0bdb9209e01bae15ac27addc"], 0x24}}, 0x24008800)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
r5 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x963b01)
ioctl$EVIOCSFF(r5, 0x40304580, &(0x7f00000003c0)={0x51, 0x8000, 0xfffd, {0x0, 0x1}, {0x53, 0x1b}, @const={0x739, {0xff, 0x805, 0x2, 0x6}}})
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x50)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r6, &(0x7f0000000340), &(0x7f0000000000)=""/3, 0x2}, 0x20)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r6, &(0x7f0000000640)="cb66ee74f1e62bd756c86c2df2303c2fa86fdd5cab05c6658158e13fc0842665279e3f7bf02cd22ec0c512bbae3f48938f5cf642b60900000000000078002b4ce07864bd296a82b88941080016db698cc6e9165c346378933c71c84e00fa9e0c00593834b9ca432149b197357d4b1fb69eb15cee3f367edf0d78b014f466231baaaf16fa15c99151b1de3c2a46e075a3d7ccfab038ef0f36c75595e2f4f4f82bdb19fc00"/179, &(0x7f0000000000), 0x2}, 0x20)
ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x40084503, &(0x7f0000ffcffc))
write$char_usb(r5, &(0x7f0000000040)="e2", 0x2250)
syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x14, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0)
write(r7, &(0x7f0000000040)='transport=tcp,traddr=127trsvcid=8009,nqn=t', 0x2a)
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000040)={[0xff, 0x2, 0x80, 0x5, 0x4, 0x7f, 0x4232, 0x0, 0x81, 0x9c1, 0x8001, 0x5, 0x7, 0x4db6, 0x0, 0xfffffdfffffffffd], 0xdddd1000, 0x3a0300})
ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000180)=@arm64={0x7f, 0x6, 0x3d, '\x00', 0xa})
r8 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
connect$x25(r8, &(0x7f0000000380)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

8m13.902025791s ago: executing program 3 (id=1018):
setns(0xc9, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1})
r1 = socket$inet(0x2, 0x2, 0x0)
sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYRES16, @ANYBLOB='`\x00'], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000180))
openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100), 0x20240, 0x0)
write$tun(r0, &(0x7f0000000140)=ANY=[], 0x88)
socket$inet_tcp(0x2, 0x1, 0x0)

8m13.067624369s ago: executing program 3 (id=1023):
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x2, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@printk={@llx, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}, @call={0x85, 0x0, 0x0, 0x5}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10)
syz_emit_ethernet(0x36, &(0x7f00000004c0)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x9, 0x28, 0x65, 0x0, 0x2, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x37}}, {{0x4e24, 0x4e23, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x80, 0x5, 0x0, 0x8}}}}}}, 0x0)
chdir(&(0x7f0000000100)='./file0\x00')
newfstatat(0xffffffffffffff9c, &(0x7f0000003580)='./dev\x00', 0x0, 0x800)
setresgid(0xee00, 0xee01, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
sendto$inet6(r0, 0x0, 0x0, 0x4885, 0x0, 0x0)

8m11.667872132s ago: executing program 3 (id=1027):
socket$igmp(0x2, 0x3, 0x2)
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw\x00')
readv(r0, &(0x7f0000000440)=[{&(0x7f00000001c0)=""/232, 0xe8}], 0x1)
mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./my_configfs/dlm/cluster1/comms/1/addr\x00', 0x1, 0x0)
write(r1, &(0x7f0000001100)="0200"/128, 0x80)

8m11.551747348s ago: executing program 3 (id=1029):
pipe(&(0x7f0000000340)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
pipe(&(0x7f00000000c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r3])
getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000100)={<r4=>0x0, @private, @private}, &(0x7f0000000140)=0xc)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000200)={'tunl0\x00', &(0x7f0000000180)={'gre0\x00', r4, 0x8000, 0x80, 0x7, 0xd3c, {{0x10, 0x4, 0x1, 0x7, 0x40, 0x65, 0x0, 0x7, 0x4, 0x0, @multicast1, @rand_addr=0x64010102, {[@generic={0x94, 0x5, "890ad0"}, @timestamp_addr={0x44, 0x24, 0x20, 0x1, 0x8, [{@remote, 0x8}, {@private=0xa010100, 0xa}, {@local, 0x8}, {@private=0xa010101, 0x3}]}]}}}}})
splice(r2, 0x0, r1, 0x0, 0xffffffffffff8000, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000d40)={{0x12, 0x1, 0x110, 0x23, 0x6b, 0x25, 0x10, 0x681, 0x10, 0x525e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x64, 0x99, 0x10, 0x70, "", [{{0x9, 0x4, 0x7c, 0x66, 0x1, 0xa, 0x65, 0x6d, 0xf2, [], [{{0x9, 0x5, 0x2, 0x0, 0x40, 0x3, 0x0, 0x6}}]}}]}}]}}, 0x0)

7m54.823222223s ago: executing program 32 (id=1029):
pipe(&(0x7f0000000340)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
pipe(&(0x7f00000000c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r3])
getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000100)={<r4=>0x0, @private, @private}, &(0x7f0000000140)=0xc)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000200)={'tunl0\x00', &(0x7f0000000180)={'gre0\x00', r4, 0x8000, 0x80, 0x7, 0xd3c, {{0x10, 0x4, 0x1, 0x7, 0x40, 0x65, 0x0, 0x7, 0x4, 0x0, @multicast1, @rand_addr=0x64010102, {[@generic={0x94, 0x5, "890ad0"}, @timestamp_addr={0x44, 0x24, 0x20, 0x1, 0x8, [{@remote, 0x8}, {@private=0xa010100, 0xa}, {@local, 0x8}, {@private=0xa010101, 0x3}]}]}}}}})
splice(r2, 0x0, r1, 0x0, 0xffffffffffff8000, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000d40)={{0x12, 0x1, 0x110, 0x23, 0x6b, 0x25, 0x10, 0x681, 0x10, 0x525e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x64, 0x99, 0x10, 0x70, "", [{{0x9, 0x4, 0x7c, 0x66, 0x1, 0xa, 0x65, 0x6d, 0xf2, [], [{{0x9, 0x5, 0x2, 0x0, 0x40, 0x3, 0x0, 0x6}}]}}]}}]}}, 0x0)

13.065752226s ago: executing program 1 (id=3176):
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000480)='/dev/comedi2\x00', 0x1, 0x0)
socket$l2tp(0x2, 0x2, 0x73)
r1 = socket$kcm(0x2, 0x2, 0x73)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045)
r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce})
writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bridge0\x00', <r4=>0x0})
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@RTM_NEWMDB={0x18, 0x55, 0x1, 0x70bd2b, 0x2, {0x7, r4}}, 0x18}, 0x1, 0x0, 0x0, 0x2000000}, 0x40080c0)
io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x20)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50)
r5 = socket$inet(0x2, 0x80001, 0x84)
ioctl$OCFS2_IOC_RESVSP64(r1, 0x4030582a, &(0x7f0000000180)={0x0, 0x0, 0xe8, 0xfffffffffffffff8, 0x7fffffff, 0x8000})
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x10}], 0x1}, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8)
sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="10", 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4020845)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'das16m1\x00', [0x140, 0x7, 0x7, 0x2, 0x10000007, 0x7, 0x8002, 0x8000, 0x7, 0xc72d, 0x0, 0x7, 0x3, 0xa, 0x29, 0x72ef, 0x101, 0x50, 0x6, 0x9, 0x4, 0x6, 0x4, 0x9, 0x1000, 0x8, 0x471, 0xffffff7f, 0x383, 0x8001, 0x4]})
syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0)
pselect6(0x0, 0x0, 0x0, &(0x7f0000000100)={0x18, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1981}, &(0x7f0000000140), 0x0)

11.244382137s ago: executing program 1 (id=3183):
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, 0x0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000080)={<r1=>0x0, @in={{0x2, 0x4e24, @remote}}, [0x8, 0x800, 0x4, 0x0, 0x100000001, 0x81, 0x9, 0x2, 0x3, 0x3, 0xdc9f, 0x0, 0x6, 0x10000, 0x1]}, &(0x7f0000000180)=0x100)
getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={r1, 0xad02, 0x30}, &(0x7f0000000200)=0xc)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x20a02, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080320904"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9)
ioctl$TCSETS(r2, 0x5402, &(0x7f0000000040)={0x17, 0x5, 0x8, 0x1, 0xa, "9591c289333bef7d35119544ed641462d4304c"})

10.720085893s ago: executing program 0 (id=3186):
openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x180100, 0x0)
write$binfmt_script(0xffffffffffffffff, &(0x7f0000000540)={'#! ', './config/usb_gadget/g1/strings/0x409/serialnumber', [{}, {0x20, ':'}, {0x20, '\'\\'}, {0x20, '/dev/sequencer2\x00'}, {0x20, '})}'}], 0xa, "34734795562c88870f4a889b5170384a9b2d897f9d84c1aa0445f02b69ccd37d8d197cd7628fe92f28ba686f468ff4ec79441ce753f039243a8f48f2dd21102fd670723d7271b75ed28cf29b2d0ed9d1071c6c0ecf20f0b44a9f42b61bfcb97f509a7f4aab923afadad8bc027a7e0bb69679c0299fe212b7bda9e7b59c21ffd76db63139ead8b018c5d29b1141d7b73f16733cecf79435776d0597daaa243724966b8fc64dfac6ab7be12d65e11df7e0b8cca46c7b33ca58310d42d099ffe49ef7242da7b47ee0"}, 0x117)
socket$netlink(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x25042f2ad3610f7, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$inet(0x2, 0x2, 0x1)
capset(&(0x7f0000000040)={0x20080522}, 0x0)
mkdir(&(0x7f0000000000)='./tracefs\x00', 0x196)
mount(0x0, &(0x7f0000000440)='./tracefs\x00', &(0x7f0000000480)='tracefs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./tracefs/trace_options\x00', 0x2, 0x0)
mkdir(&(0x7f0000000140)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000100)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1b1)
r4 = open(&(0x7f00000002c0)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x20241, 0x1ff)
close(r4)
openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x60881, 0x0)
mkdir(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff)
mkdir(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv\x00', 0x1ff)
mkdir(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p\x00', 0x1ff)
open(&(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/wWidth\x00', 0x241, 0x1ff)
syz_emit_ethernet(0x72, &(0x7f0000000680)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e400ff", 0x3c, 0x3a, 0x0, @private0={0xfc, 0x0, '\x00', 0x40}, @mcast2, {[], @param_prob={0x2, 0x1, 0x0, 0x0, {0x0, 0x6, '\x00', 0x0, 0x11, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, [], "17c17f070000000000880000"}}}}}}}, 0x0)
write$P9_RREADLINK(r3, 0x0, 0x0)

9.715682366s ago: executing program 4 (id=3190):
syz_open_dev$loop(&(0x7f0000000040), 0x100013, 0xa4a82)
syz_open_dev$loop(0x0, 0xfffffbff7ffffffb, 0x1222e2)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000300))
socket$tipc(0x1e, 0x2, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
socket$vsock_stream(0x28, 0x1, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
syz_open_dev$vbi(&(0x7f0000000100), 0x1, 0x2)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
fsopen(&(0x7f00000000c0)='bfs\x00', 0x1)
r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x3000004, 0x12, r3, 0x100000000)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000047000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a876d839240d29c035055b67db3e6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7e8dc34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bb44b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334583239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bf4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc508afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd360000000000000000ae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c97a088a22e8b15c3e233db00002e30d46a0024d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c29c5c0ed5bcdf510c3c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ced92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f68fa8d7c2dfb28e1f05e46b0933c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b19abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d588afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda6900002a070886df42b27098773b45198b4a34ac97febd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f0000000000f8e10238d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d63521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07afef12ef060cd4403a099f32468f658000b4082d43e12186195cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea209b53b230ef0f2ab85cbdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bd3339403004b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab900000000000000000000d71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdbf24a0c5441ce046078492b53467cfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89cb349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb15f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c00c57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137df47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b558982016b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8b49e3d0168bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85a3009a5d30f479e293a3302e11350ea857b37e76ca3f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c8ffe0d508dcee3070e8b42ac38545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f98117919472b61b20026d7e646174b55d251f7f8ca5ccc22a5efb33b217eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4444e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24000000000000000000000000000000000000cd3211b3842b68a4eddca2eae28529e97a98d7ec3fd902df1ba8fc2ad2377e72d4e7aeacbbccef5614cd965511558f40720025c022bc9c213e407f6bc4b673c55aa8e729299a37fd6339acd906ac861ba56c9fa9b8b12b5e68a3cdadb906355e1f1d336a243172affe50d0fb36c3718a7498eed3d398f405a34d494414e87ef1ce1845510d43d00171d6b4b762f89564c22d542a119878709cd6822c3a3eb47a849b0737929fe9e1eecd1bff5a2b9880e2a6d8a3b3b7e88a673c96cda4455eff1c530db0e6598a2686aa09aeaf0f1aed95aeb8b0a2cc5ca31c0f56285cc05f7090a0e0583cf540d18cd8817e685c7b4ff176178ac1234f23e54445ec20b2689832d78409897a0307e89ebcd5f4ba042a3d10237a5a8a9a6eda36d2f337dc54537b80e8433341b135b4c5bb0173ffde46ccd260e1d4f2c51e8b07bb256f1317912cb1fc9e491e0bb9109e475cc795c23ad9f4f0042c5e9c655a4d865bc4a266e6a1d3d2b7ee53be9efb33a98933b5ba74ee3ac8d34b6af8c1fdbffade3abc80842b74354162f5b994ab5254cb068bc5e2ae242a1d37d0d49947c9317fa1a46c9e259ce0e1f9db992c53f7830a5e8f4fac6b187eb9f15ba61f730f86d7d7b63bbc7a1d9ff37e87a90a14e0655304da069f9009b62717649b6c6af94fcba713f8ee6fcce25aef44d009966614b61be9369ffc589a79051b0a0000000000000003ebd34c41afe268c33c9322c3a783772aec998f51a6e70fb932a8019e72ef5ab127bb30c79ebfd867441083546305fb39449c40a166ea389a6b77b7c87f66e8bf5806726b8fc50b943627314803a12c33312dce0a10f852da3e000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x3e, 0xffffffffffffffff, 0x8, 0x0, 0xee, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x7}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001a00)={r4, 0x18000000000002a0, 0xfe2a, 0x0, &(0x7f0000001840)="b9ff0307683a268cb8091a99888e", 0x0, 0xfe, 0x60000009, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50)
r5 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VIDIOC_G_TUNER(r5, 0xc054561d, &(0x7f0000000240)={0x4, "b8aa84f7fff3edc826b177cd0e0a4f08257e95d8d71d262be3181f099e168622", 0x3, 0x800, 0xffffff9f, 0x4, 0x1, 0x2, 0x7, 0x5f40})
pselect6(0x40, &(0x7f0000000180)={0x6, 0x0, 0x1fd, 0x7d, 0xfffffffffffffffd, 0x7f, 0x104, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0)
mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000140)='vfat\x00', 0x208000, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000010900010073797a30000000003c000000090a030700000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021780000000c0a0103f143aff2ec86ae30070000083dc1098f2ff486e723c55c8721a60900020073797a31000000000900010073797a30000000004c0003804800008008000340000000023c000b80100001800c000100636f756e7465720028000180090001006c617374000000001800028008000140000000040c00024000800eb6c2e9ee1abdbb4dcba33a7facea0c13f8444add073ddea369cef7dacba8b4ac6a61968b27f6f30b3906486c02d9e593a75a21e3aa3c32d88dea1e94"], 0xfc}}, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="0403"], 0xe)
r6 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
ioctl$BTRFS_IOC_ENCODED_READ(0xffffffffffffffff, 0x80809440, &(0x7f00000009c0)={&(0x7f0000000940), 0x0, 0x7, 0x0, 0x80000001, 0x8, 0x2, 0x1, 0x5})

8.542979241s ago: executing program 5 (id=3192):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='vegas', 0x5)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4)
sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0)
recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25)

8.431946451s ago: executing program 4 (id=3193):
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0x40, 0x8, 0x1000c1})
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000007, 0x40032, 0xffffffffffffffff, 0x40000000)
syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00')
r0 = add_key$user(0x0, &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd)
r1 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00')
lseek(r1, 0x4, 0x1)
bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10)
r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
r3 = socket$kcm(0x29, 0x5, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r4 = fsmount(0xffffffffffffffff, 0x0, 0x80)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000300)={'tunl0\x00', <r5=>0x0, 0x89, 0x40, 0x401, 0x7, {{0x1d, 0x4, 0x1, 0x8, 0x74, 0x66, 0x0, 0x0, 0x29, 0x0, @loopback, @local, {[@timestamp_addr={0x44, 0x3c, 0xa9, 0x1, 0x4, [{@multicast1}, {@multicast2, 0xfffffffe}, {@remote, 0x3}, {@remote, 0x4}, {@empty, 0x7fffffff}, {@multicast1, 0x8}, {@local}]}, @timestamp={0x44, 0xc, 0xae, 0x0, 0x2, [0x9a6d, 0x20000000]}, @ra={0x94, 0x4}, @lsrr={0x83, 0x7, 0xc3, [@local]}, @generic={0x89, 0xd, "1e8e465ec4bc2dd5b23e03"}]}}}}})
sendmsg$nl_route(r4, &(0x7f0000000600)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000580)={&(0x7f00000009c0)=ANY=[@ANYBLOB="d002000011000000000000", @ANYRES32=r5, @ANYBLOB="020000000c000000ec0016805400018010000600ff0f000005000000090000000c00030003000000030000000c00070005000000060000000c00050002000000d50000000c000700090000000000000010000200140000008b0900007f0000003400018010000200ffffff7fd50300000c0000000c0003000d0000000004000014000a0009000000000000008f60ffffffffffff100001800c0009000f000000050000005000018014000b001000000000000000040000000000000014000a000600000000000000060000000000000004000c8014000a002e0000000000000004000000000000000c000500070000000600000008000d0000000000bc011880540001800b00020073686132353600000500020000000000060002007d0000000900020073797a30000000001400050098b00cfec51d2fa7db79ada64eb4acaf09000200c82d2f230000000005000600a90000002000018014000400683ff8919a71886c2f533ec4ee139eae0800010009000000340001801400050028896d132c36a5dd1412ca58f3c6f8ec060002002f0000001400040011510b9ab14b98d0d9a6aadd47584b913000018005000600070000001400050069f259c2dcf80efa6f9afc0b60524bc405000600f8000000080002002c2524005800018008000100f8ffffff0800010000000000140005008759013e3d6ae56ad528abd06cf0218b14000500520b47fac5036c4689c1322586dcd84214000400e0ee004a41f05b1638114aaf30296d570500020000000000280001800500060005000000140004007b4eb706bad46bdfadaea80eb2dd42c605000200000000001c000180080001000700000008000100010000000500060000000000400001800800010007000000050006000600000014000500845adaa5becf21242379032c1f32565605000600080000000800010005000000080001000300000004000180"], 0x2d0}}, 0x24040010)
r6 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0)
read$msr(r6, &(0x7f0000032680)=""/102392, 0x18ff8)
ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000180)={0xffffffffffffffff, r2})
sendmmsg$inet(r3, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f0000000340)}}], 0x1, 0x0)
close(r3)
syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c9"], 0x16)
ppoll(&(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r0}, 0x0, 0x26, &(0x7f0000000180)={&(0x7f0000000040)={'streebog256-generic\x00'}})
sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000680)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000640)={&(0x7f0000000280)=ANY=[@ANYBLOB="380000000406010100000000000700000000000000000100070000000900020073797a300000000005000100070000000500010007000000"], 0x38}, 0x1, 0x0, 0x0, 0x28094}, 0xc810)
syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000000), 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58)

7.823235892s ago: executing program 0 (id=3194):
r0 = socket(0x400000000010, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)
connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0)
socket$kcm(0x10, 0x2, 0x10)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="240000001800090400000003000000000a1d0000000000060000000008001e0001000000d2fcd58f3994e2a597bff17bac62679770b930fb834ae893e3aadd8e3398cf54a9d881559f1ad5f1ce7112ecfe5a3dddc52f512de84908769b9d10e4f873e2c68749ff30fbe8da649caeafbb86770210711e9fdf4361efd307d538428870d9e784db2ebb743af580bf9281bdb474923a"], 0x24}}, 0x80)

7.751773896s ago: executing program 0 (id=3195):
syz_emit_ethernet(0x56, &(0x7f0000000000)=ANY=[@ANYRES32=0x41424344], 0x0)
r0 = socket(0x2, 0x2, 0x1)
bind$unix(r0, &(0x7f0000000000)=@abs, 0x6e)
r1 = socket(0x2, 0x2, 0x1)
bind$unix(r1, &(0x7f0000000000)=@abs, 0x6e)
r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/icmp\x00')
preadv(r2, &(0x7f0000000700)=[{&(0x7f0000000200)=""/152, 0x9d}], 0x1, 0xdd, 0x9)
syz_usb_connect(0x5, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100022bc99f40470501688e8b0102030109021200010404a0f30904"], 0x0)

7.508798658s ago: executing program 5 (id=3196):
r0 = memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0)
pwrite64(r0, &(0x7f00000008c0)='/', 0x1, 0x0)
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0)
symlink(&(0x7f0000001000)='./file0\x00', &(0x7f00000000c0)='./file0\x00')
syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x105401, 0x0)
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x1c, 0x2f, 0x9, 0x70bd24, 0x25dfdbfb, {0x4}, [@typed={0x7, 0xb, 0x0, 0x0, @str='\x05\x00\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x20040004)

7.402305102s ago: executing program 1 (id=3197):
syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080))
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={<r2=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={r2, 0x5158}, &(0x7f0000000180)=0x8)

7.305087716s ago: executing program 4 (id=3198):
memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3)
socket$nl_generic(0x10, 0x3, 0x10)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={'\x00', 0x7, 0x40, 0x1, 0xb9e7, 0x3, <r0=>0xffffffffffffffff})
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e22, 0xb6, @ipv4={'\x00', '\xff\xff', @local}, 0xc4ca}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040), 0x3)
setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "25fd25990fe381b9", "f511161d94f179ecf85eb61b6a4762eb", "1e59ddbe", "06ed010001809f9b"}, 0x28)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4)
sendto$inet6(r1, &(0x7f0000000300)='S', 0xfffffffffffffe94, 0xc000, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
sched_setscheduler(r0, 0x1, &(0x7f0000000080)=0x5)
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0)
pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x3, 0x2, 0x9, 0xffff, 0xb, 0x80000003, 0x100000000000b06c}, 0x0, 0x0)

7.083550231s ago: executing program 1 (id=3199):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0)
r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
setsockopt$WPAN_SECURITY(r1, 0x0, 0x1, &(0x7f00000001c0)=0x1, 0x4)
r2 = eventfd2(0xffffffff, 0x1)
write$eventfd(r2, &(0x7f0000000080)=0xffffffff00000000, 0x8)
read$eventfd(r2, &(0x7f0000000040), 0x8)
bind$802154_dgram(r1, &(0x7f0000000000)={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0002}}}, 0x14)
connect$802154_dgram(r1, &(0x7f0000000080)={0x24, @none={0x0, 0x2}}, 0x14)
r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x40, 0x0)
ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f0000000100)={0x2b, 0x1e, 0x0, 0x2, 0x8, 0x63, 0x5, 0x2, 0x1})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000280)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x3000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6)
openat(0xffffffffffffffff, 0x0, 0x402000, 0x2)
ptrace(0x10, 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername(r7, 0x0, 0xffffffffffffffff)
r8 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'})
r9 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0)
write(r9, &(0x7f0000001300)="0600000000000000020000000400"/98, 0x62)
ioctl$XFS_IOC_FSGEOMETRY_V4(r0, 0x8070587c, &(0x7f0000000100))

6.811745528s ago: executing program 2 (id=3200):
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x35, 0x1, 0x8, 0x0, 0x0)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00')
read$FUSE(r0, &(0x7f0000003440)={0x2020}, 0x2020)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./dev/mtdblock0\x00', &(0x7f0000000180)='xfs\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r3 = openat(0xffffffffffffff9c, 0x0, 0x320800d, 0xb1)
openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00'})
read$FUSE(r3, &(0x7f0000002140)={0x2020}, 0xffffffffffffff7e)
bind$inet6(r1, &(0x7f0000000440)={0xa, 0x4e23, 0x7, @remote, 0x63}, 0x1c)
sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0)
ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, 0x0)
writev(r5, &(0x7f0000001600)=[{0x0}, {&(0x7f0000000180)="29e3e5864ceda68155960e4b20eb0403a71898733f0dcb64c38849be0185191621d8d87c521201593212da719d600d9262d4ac59dfb5ec2b503053b465b55ae5c7ca58b82c73ad9aa7872d1e4060a6112879a7afe128f10bf20cfd", 0x5b}, {&(0x7f0000000300)="ac3d900278bc4f673648008b3fd9da", 0xf}, {&(0x7f0000000340)="79baf7c80af72c6d074d7aa55d18c2b3f92fb55d09041ffa4b66a0ed18f71e54cc0a5bc1461a6d07e6d4f31058721987ab90040f06c98df9afdd7c6614915beee9a0bea8187c6315a4be760ebc06c000bbe9a766f3752ff9ed8b304d3378bfd1a88dfc510d611a8c13259173a7c957bdd73f4bc320391f6d862cfdd58f6c09abefc7302f22bf6795474455a958f56a17d1551e", 0x93}, {0x0}, {&(0x7f00000004c0)="a407d58cecfb1369d434cee2363e2e667262a9fda651de7eb280ec8ff5087e0036af2fef7939cac0a06e6169aa6caa951a4a9b35e608532fafaa74692296b26bf7525aefeadde445128254deda33cb8622aad1f5aa0ab3ba8a81949805c4de7209102f463431fb613efae16477340300ad74baf9e9dcf19667797369fdeb42", 0x7f}, {&(0x7f00000005c0)}], 0x7)
socket(0x2, 0x5, 0x0)

5.540235889s ago: executing program 0 (id=3201):
openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x80c41, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f000029a000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0)
r0 = io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0)

5.535929775s ago: executing program 4 (id=3202):
r0 = memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0)
pwrite64(r0, &(0x7f00000008c0)='/', 0x1, 0x0)
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0)
symlink(&(0x7f0000001000)='./file0\x00', &(0x7f00000000c0)='./file0\x00')
syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x105401, 0x0)
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x1c, 0x2f, 0x9, 0x70bd24, 0x25dfdbfb, {0x4}, [@typed={0x7, 0xb, 0x0, 0x0, @str='\x05\x00\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x20040004)

5.408715058s ago: executing program 2 (id=3203):
syz_open_dev$loop(&(0x7f0000000040), 0x100013, 0xa4a82)
syz_open_dev$loop(0x0, 0xfffffbff7ffffffb, 0x1222e2)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000300))
socket$tipc(0x1e, 0x2, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
socket$vsock_stream(0x28, 0x1, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
syz_open_dev$vbi(&(0x7f0000000100), 0x1, 0x2)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
fsopen(&(0x7f00000000c0)='bfs\x00', 0x1)
r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x3000004, 0x12, r3, 0x100000000)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000047000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a876d839240d29c035055b67db3e6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7e8dc34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bb44b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334583239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bf4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc508afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd360000000000000000ae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c97a088a22e8b15c3e233db00002e30d46a0024d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c29c5c0ed5bcdf510c3c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ced92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f68fa8d7c2dfb28e1f05e46b0933c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b19abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d588afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda6900002a070886df42b27098773b45198b4a34ac97febd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f0000000000f8e10238d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d63521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07afef12ef060cd4403a099f32468f658000b4082d43e12186195cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea209b53b230ef0f2ab85cbdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bd3339403004b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab900000000000000000000d71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdbf24a0c5441ce046078492b53467cfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89cb349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb15f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c00c57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137df47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b558982016b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8b49e3d0168bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85a3009a5d30f479e293a3302e11350ea857b37e76ca3f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c8ffe0d508dcee3070e8b42ac38545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f98117919472b61b20026d7e646174b55d251f7f8ca5ccc22a5efb33b217eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4444e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24000000000000000000000000000000000000cd3211b3842b68a4eddca2eae28529e97a98d7ec3fd902df1ba8fc2ad2377e72d4e7aeacbbccef5614cd965511558f40720025c022bc9c213e407f6bc4b673c55aa8e729299a37fd6339acd906ac861ba56c9fa9b8b12b5e68a3cdadb906355e1f1d336a243172affe50d0fb36c3718a7498eed3d398f405a34d494414e87ef1ce1845510d43d00171d6b4b762f89564c22d542a119878709cd6822c3a3eb47a849b0737929fe9e1eecd1bff5a2b9880e2a6d8a3b3b7e88a673c96cda4455eff1c530db0e6598a2686aa09aeaf0f1aed95aeb8b0a2cc5ca31c0f56285cc05f7090a0e0583cf540d18cd8817e685c7b4ff176178ac1234f23e54445ec20b2689832d78409897a0307e89ebcd5f4ba042a3d10237a5a8a9a6eda36d2f337dc54537b80e8433341b135b4c5bb0173ffde46ccd260e1d4f2c51e8b07bb256f1317912cb1fc9e491e0bb9109e475cc795c23ad9f4f0042c5e9c655a4d865bc4a266e6a1d3d2b7ee53be9efb33a98933b5ba74ee3ac8d34b6af8c1fdbffade3abc80842b74354162f5b994ab5254cb068bc5e2ae242a1d37d0d49947c9317fa1a46c9e259ce0e1f9db992c53f7830a5e8f4fac6b187eb9f15ba61f730f86d7d7b63bbc7a1d9ff37e87a90a14e0655304da069f9009b62717649b6c6af94fcba713f8ee6fcce25aef44d009966614b61be9369ffc589a79051b0a0000000000000003ebd34c41afe268c33c9322c3a783772aec998f51a6e70fb932a8019e72ef5ab127bb30c79ebfd867441083546305fb39449c40a166ea389a6b77b7c87f66e8bf5806726b8fc50b943627314803a12c33312dce0a10f852da3e000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x3e, 0xffffffffffffffff, 0x8, 0x0, 0xee, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x7}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001a00)={r4, 0x18000000000002a0, 0xfe2a, 0x0, &(0x7f0000001840)="b9ff0307683a268cb8091a99888e", 0x0, 0xfe, 0x60000009, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50)
r5 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VIDIOC_G_TUNER(r5, 0xc054561d, &(0x7f0000000240)={0x4, "b8aa84f7fff3edc826b177cd0e0a4f08257e95d8d71d262be3181f099e168622", 0x3, 0x800, 0xffffff9f, 0x4, 0x1, 0x2, 0x7, 0x5f40})
pselect6(0x40, &(0x7f0000000180)={0x6, 0x0, 0x1fd, 0x7d, 0xfffffffffffffffd, 0x7f, 0x104, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0)
mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000140)='vfat\x00', 0x208000, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000010900010073797a30000000003c000000090a030700000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021780000000c0a0103f143aff2ec86ae30070000083dc1098f2ff486e723c55c8721a60900020073797a31000000000900010073797a30000000004c0003804800008008000340000000023c000b80100001800c000100636f756e7465720028000180090001006c617374000000001800028008000140000000040c00024000800eb6c2e9ee1abdbb4dcba33a7facea0c13f8444add073ddea369cef7dacba8b4ac6a61968b27f6f30b3906486c02d9e593a75a21e3aa3c32d88dea1e94"], 0xfc}}, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="0403"], 0xe)
r6 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
ioctl$BTRFS_IOC_ENCODED_READ(0xffffffffffffffff, 0x80809440, &(0x7f00000009c0)={&(0x7f0000000940), 0x0, 0x7, 0x0, 0x80000001, 0x8, 0x2, 0x1, 0x5})

5.219475804s ago: executing program 0 (id=3204):
openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x180100, 0x0)
write$binfmt_script(0xffffffffffffffff, &(0x7f0000000540)={'#! ', './config/usb_gadget/g1/strings/0x409/serialnumber', [{}, {0x20, ':'}, {0x20, '\'\\'}, {0x20, '/dev/sequencer2\x00'}, {0x20, '})}'}], 0xa, "34734795562c88870f4a889b5170384a9b2d897f9d84c1aa0445f02b69ccd37d8d197cd7628fe92f28ba686f468ff4ec79441ce753f039243a8f48f2dd21102fd670723d7271b75ed28cf29b2d0ed9d1071c6c0ecf20f0b44a9f42b61bfcb97f509a7f4aab923afadad8bc027a7e0bb69679c0299fe212b7bda9e7b59c21ffd76db63139ead8b018c5d29b1141d7b73f16733cecf79435776d0597daaa243724966b8fc64dfac6ab7be12d65e11df7e0b8cca46c7b33ca58310d42d099ffe49ef7242da7b47ee0"}, 0x117)
socket$netlink(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x25042f2ad3610f7, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$inet(0x2, 0x2, 0x1)
capset(&(0x7f0000000040)={0x20080522}, 0x0)
mkdir(&(0x7f0000000000)='./tracefs\x00', 0x196)
mount(0x0, &(0x7f0000000440)='./tracefs\x00', &(0x7f0000000480)='tracefs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./tracefs/trace_options\x00', 0x2, 0x0)
mkdir(&(0x7f0000000140)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000100)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1b1)
r4 = open(&(0x7f00000002c0)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x20241, 0x1ff)
close(r4)
openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x60881, 0x0)
mkdir(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff)
mkdir(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv\x00', 0x1ff)
mkdir(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p\x00', 0x1ff)
open(&(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/wWidth\x00', 0x241, 0x1ff)
syz_emit_ethernet(0x72, &(0x7f0000000680)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e400ff", 0x3c, 0x3a, 0x0, @private0={0xfc, 0x0, '\x00', 0x40}, @mcast2, {[], @param_prob={0x2, 0x1, 0x0, 0x0, {0x0, 0x6, '\x00', 0x0, 0x11, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, [], "17c17f070000000000880000"}}}}}}}, 0x0)
write$P9_RREADLINK(r3, 0x0, 0x0)

3.209701244s ago: executing program 2 (id=3205):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8)
r1 = socket$kcm(0x10, 0x2, 0x0)
migrate_pages(0x0, 0x2, &(0x7f0000000000)=0x7b, &(0x7f0000000040)=0x1)
sendmsg$kcm(r1, 0x0, 0x20000004)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x3, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000008000000000000000000910095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94)
r3 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r2, r2, 0x2f, 0x0, @void}, 0x10)
bpf$LINK_DETACH(0x22, &(0x7f0000000080)=r3, 0x4)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d"], 0x184}}, 0x10)
recvmmsg(r4, &(0x7f0000005bc0)=[{{&(0x7f00000002c0)=@nl=@proc, 0x80, 0x0, 0x0, &(0x7f00000010c0)=""/4096, 0x1000}, 0x800}, {{&(0x7f0000000340)=@isdn, 0x80, &(0x7f00000021c0)=[{&(0x7f0000002140)=""/95, 0x5f}], 0x1, &(0x7f0000002200)=""/59, 0x3b}, 0xa}, {{&(0x7f0000002240)=@hci, 0x80, &(0x7f0000002400)=[{&(0x7f00000022c0)=""/194, 0xc2}, {&(0x7f00000023c0)=""/47, 0x2f}], 0x2, &(0x7f0000002440)=""/47, 0x2f}, 0x75}, {{&(0x7f0000002480)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c}, 0x80, &(0x7f0000002540)=[{&(0x7f0000002500)=""/52, 0x34}], 0x1, &(0x7f0000002580)=""/190, 0xbe}, 0x9}, {{&(0x7f0000002640)=@nfc, 0x80, &(0x7f00000028c0)=[{&(0x7f00000026c0)=""/228, 0xe4}, {&(0x7f00000027c0)=""/232, 0xe8}], 0x2, &(0x7f0000002900)=""/234, 0xea}, 0xd2d}, {{&(0x7f0000002a00)=@nfc_llcp, 0x80, &(0x7f0000002cc0)=[{&(0x7f0000002a80)=""/170, 0xaa}, {&(0x7f0000002b40)=""/53, 0x35}, {&(0x7f0000002b80)=""/97, 0x61}, {&(0x7f0000002c00)=""/7, 0x7}, {&(0x7f0000002c40)=""/10, 0xa}, {&(0x7f0000002c80)=""/22, 0x16}], 0x6, &(0x7f0000002d40)=""/177, 0xb1}}, {{&(0x7f0000002e00)=@isdn, 0x80, &(0x7f00000041c0)=[{&(0x7f0000002e80)=""/38, 0x26}, {&(0x7f0000002ec0)=""/90, 0x5a}, {&(0x7f0000002f40)=""/100, 0x64}, {&(0x7f0000002fc0)=""/31, 0x1f}, {&(0x7f0000003000)=""/80, 0x50}, {&(0x7f0000003080)=""/205, 0xcd}, {&(0x7f0000003180)=""/7, 0x7}, {0xfffffffffffffffc}, {&(0x7f00000031c0)=""/4096, 0x1000}], 0x9, &(0x7f0000004280)=""/30, 0x1e}, 0x400003ff}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000049c0)=""/118, 0x76}}, {{&(0x7f0000004a40)=@qipcrtr, 0x80, &(0x7f0000000580)=[{&(0x7f00000003c0)=""/9, 0x9}, {&(0x7f0000000400)=""/16, 0x10}, {&(0x7f0000000440)=""/68, 0x44}], 0x3, &(0x7f0000004bc0)=""/4096, 0x1000}, 0x8000}], 0x9, 0x0, &(0x7f0000005e00)={0x0, 0x989680})
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001080)={r3, 0x0, 0x0}, 0x10)
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='devpts\x00', 0x4, &(0x7f0000000280)=':-,\x00')
alarm(0x1003fffff)
alarm(0x7)
r5 = socket(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000005c0)={'hsr0\x00', <r6=>0x0})
bind$packet(r5, &(0x7f00000001c0)={0x11, 0x0, r6}, 0x14)
r7 = socket(0x400000000010, 0x3, 0x0)
r8 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'veth1_to_bond\x00', <r9=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x3, 0x8}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x3e8, 0x2c, 0xd27, 0x30bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0x2}, {0x2, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x3bc, 0x2, [@TCA_FW_ACT={0x58, 0x4, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7f, 0x4, 0x20000000, 0x4, 0x9}, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xff000000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}, @TCA_FW_CLASSID={0x8, 0x1, {0x4, 0xfff1}}, @TCA_FW_ACT={0x358, 0x4, [@m_mpls={0xc4, 0x1e, 0x0, 0x0, {{0x9}, {0x6c, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0xf37, 0x3, 0x6, 0x1, 0x100}, 0x1}}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x5, 0x7, 0x4, 0x4, 0x7}, 0x1}}, @TCA_MPLS_TTL={0x5, 0x7, 0x3}, @TCA_MPLS_TTL={0x5, 0x7, 0x1}, @TCA_MPLS_LABEL={0x8, 0x5, 0x9572e}, @TCA_MPLS_LABEL={0x8, 0x5, 0xfc2e9}, @TCA_MPLS_PROTO={0x6, 0x4, 0x60}, @TCA_MPLS_PROTO={0x6, 0x4, 0x6207}]}, {0x30, 0x6, "50f218624d5353c5f885e4bd2a0ac5df05fcc0858c85960b0dca50889240cbc755817381e2e6855960f6c9c9"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_mpls={0x110, 0x6, 0x0, 0x0, {{0x9}, {0x2c, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0xe4df5}, @TCA_MPLS_PROTO={0x6, 0x4, 0x11}, @TCA_MPLS_BOS={0x5, 0x8, 0x1}, @TCA_MPLS_TTL={0x5, 0x7, 0x5}, @TCA_MPLS_PROTO={0x6, 0x4, 0x2c4a}]}, {0xbc, 0x6, "4dbefa6e19577ca6b539532c6db239399136f14e06c6e318e5192059be94d1b2149ff25681780fd79b843ebf5112ec39c837bc6e4ecb08ab1d6d4ac71841e522b7207c4261d8a0fcdc8621160cfc98a75af53d3686a1c85d7e31fb15d4fc68390b9cacfc97963dd068e7165a360aa6ed2803c27cf5ea40d6dd3c9107615f62dcb31785ab9f9edc6b6eb952097266465ab68fdfd984510c18eec599e96d9a5d7e5f5461105e1eab6e638241ac87a01c8a98687214602f550f"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_ctinfo={0xc0, 0x17, 0x0, 0x0, {{0xb}, {0x34, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x401}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x2}, @TCA_CTINFO_ACT={0x18, 0x3, {0x70cb, 0x5, 0x2, 0x1ff, 0x3}}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0xd}]}, {0x61, 0x6, "27a40bad4c78e8ba0f5a270ce9812ce299bf4aa67d388e9ae564f0914ebbd274ecdcf8c1812d1211c3592478689611b124506916421b6612e1f55ffc413968f6cb0bffbbeae75e0dd31b08e62a7c7f55af40cdc7c626e7e882af4bcebe"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_bpf={0xc0, 0xf01, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS={0x24, 0x4, [{0x5, 0x5, 0x1, 0x97}, {0x2, 0x1, 0x80, 0x98}, {0x87, 0x7, 0x7, 0xf3b}, {0x3, 0x3, 0x3, 0x3ff}]}]}, {0x72, 0x6, "15df42b480d837ae3105160657015ee0863fffb3c89ba27f4cdb7d9fa5b0c4dafa8d7df119a6e7f6b7eb5351487928bb6b0c3a5df9df73a2c8165e71e3bc9cf2834c280edf80345868065ecaebe8d2a9ad3f241e7ba6e373d6b0692dcb06a2696e89184b1a8795ed8f402ed9e4f0"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x3e8}, 0x1, 0x0, 0x0, 0x4}, 0x4000800)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000b40)={'syztnl2\x00', &(0x7f0000000a80)={'erspan0\x00', 0x0, 0x700, 0x7800, 0x7, 0xe1d, {{0x1e, 0x4, 0x3, 0xe, 0x78, 0x66, 0xfff, 0x8, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x3b}, @loopback, {[@generic={0x83, 0x11, "497158d8001d8211eb151070acca80"}, @timestamp={0x44, 0x8, 0x5, 0x0, 0xa, [0x5]}, @timestamp={0x44, 0x14, 0xa8, 0x0, 0x9, [0x8, 0x0, 0xfffffff8, 0x80000000]}, @end, @lsrr={0x83, 0x27, 0xc9, [@initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x2c}, @local, @empty, @dev={0xac, 0x14, 0x14, 0x16}, @loopback, @multicast1, @rand_addr=0x64010101, @private=0xa010102]}, @timestamp={0x44, 0xc, 0xad, 0x0, 0x1, [0x6, 0x4]}]}}}}})
socket$unix(0x1, 0x5, 0x0)

2.935049381s ago: executing program 1 (id=3206):
r0 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0xc, '\x00', 0x0, 0x0, r0}, 0x94)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9)
r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r3=>0x0)
mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0)
r4 = accept4(r2, 0x0, &(0x7f00000002c0), 0x0)
copy_file_range(r4, &(0x7f0000000340)=0x5, r1, &(0x7f00000003c0)=0x9, 0x7, 0x0)
timer_settime(r3, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x11c0, 0x80000)
r5 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc)
fcntl$setlease(r5, 0x400, 0x0)
r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff)
r7 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r7, 0x0, 0x0)
connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
r8 = socket$inet_tcp(0x2, 0x1, 0x0)
listen(r8, 0x1000)
r9 = syz_open_procfs(0x0, &(0x7f0000002040)='net/tcp\x00')
read$FUSE(r9, &(0x7f0000000000)={0x2020}, 0x96)
close(r8)
read$FUSE(r9, &(0x7f0000004140)={0x2020}, 0x2020)
sendmsg$TIPC_CMD_SET_LINK_TOL(r5, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, r6, 0x739, 0x70bd27, 0x25dfdbfd, {{}, {}, {0x4c, 0x18, {0x0, @link='syz0\x00'}}}, [""]}, 0x68}}, 0x10)
openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file4\x00', &(0x7f0000000380)={0x8a001, 0x0, 0x12}, 0x18)
syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
r10 = socket$inet_sctp(0x2, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8)

2.879319581s ago: executing program 5 (id=3207):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='vegas', 0x5)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4)
sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0)
recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25)

2.788763947s ago: executing program 5 (id=3208):
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000280)={{0x2, 0x4e24, @remote}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x16, {0x2, 0x4e22, @private=0xa010102}, 'vlan0\x00'})
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff)
creat(&(0x7f00000000c0)='./file0\x00', 0x48)
socket$key(0xf, 0x3, 0x2)
lsetxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000240)=@v3={0x3000300, [{0xffff4a0c, 0x7}], 0xee01}, 0x18, 0x0)
pipe2(&(0x7f0000000200)={<r0=>0x0, <r1=>0x0}, 0x0)
write(r1, &(0x7f00000001c0)='functionfs', 0xa)
read(r0, &(0x7f0000000100), 0xb)
r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x28182, 0x0)
ioctl$AUTOFS_IOC_FAIL(r2, 0x4c80, 0xffffffffffffffb6)
mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={<r4=>0xffffffffffffffff})
getsockopt$sock_int(r4, 0x1, 0xc, 0x0, &(0x7f00000004c0))
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c000280080005000100000014000700000000000000000500000000000000010800"], 0x74}}, 0x0)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xd, &(0x7f0000000940)=ANY=[@ANYBLOB="180000850000002a000000181c00008fa6e7e634485e949f59c3e11bd65271d020ca46da526ffd80c1dc910d9c0e991cb1ff67d5a6341a9eed76633b74f402d8bb0000000000b002ff06b7740724e6e3111cbdaf360bd4efaed74250604c61032ae7b4ed70f9a42badb0", @ANYRES32, @ANYBLOB="0000000000000000b708000000bc7a007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc)
write$uinput_user_dev(r3, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xd4b7, 0x4, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x912, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0xa, 0x17, 0x1, 0x107, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x7, 0x4, 0x0, 0x40], [0x753, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x4, 0x101, 0xf9, 0xf, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x2, 0xea4, 0x4, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0x102, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e4, 0x2, 0x200004, 0x1b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x3, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc0a, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x42080, 0x1ef, 0x0, 0x8, 0x4, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x4, 0x2000000c, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000ad, 0x5, 0xa, 0x0, 0x800bf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x1007, 0x2, 0x1c, 0x8864, 0x3, 0x2006, 0x80a2f0, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x0, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x800006, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x33f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x9, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10010000, 0x3, 0x7e, 0xe3d, 0xfc, 0x47, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x2, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
lgetxattr(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='.wecuri4y.capability\x00'], &(0x7f0000000340)=""/170, 0xaa)
write$binfmt_misc(r7, &(0x7f0000000000), 0x0)
r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})

2.570741736s ago: executing program 5 (id=3209):
timer_create(0x0, 0x0, &(0x7f0000000080))
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$VHOST_RESET_OWNER(0xffffffffffffffff, 0xaf02, 0x0)
syz_emit_ethernet(0xdc, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000188480000000000000400000000000000000000000400007094000000000000dd458f4ae5e126481500b6006600007f0290780a010100640101028309cbac141442ac1414aae0000001e0000001ac1e010144243981ac1e0101ffffffffac1414bb00000080ac14143300000003ac1414bb0000d71a890f15000000007f000001ffffffff00005a18b064016cc47a69002865dc80915c3e5f71d443476d1ae034be6d6a4ac5f36abc4a40ad4547a29bdfe017bb6b540a20b480e6b39267981aee12b7c40b9e648c2ca6be8abe466e1e627a23173586fa5e"], 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000180)=0x15)
ioctl(r1, 0x404c4701, &(0x7f0000000040)="010000000000000000000000d0e9b4bf7f2f17f7010099099e65de31f8188900000000000020000000a020d5bdd9ed6fc15dc86f200000000100000001")

2.429982206s ago: executing program 5 (id=3210):
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000180)={0x0, 0x7}, &(0x7f00000001c0)=0x8)
r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f00000000c0)={{0xf}, 0x1000000, 0x5, 0x7000, {0x2, 0x1}, 0x2, 0x40})
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000012e00)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4040000}, 0x4004)
sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a010400000000000000000200ffff540004803c0001800e000100696d6d6564696174650000002800028008000140000000001c000280180002800900020073797a320000000008000180fffffffd140001800c0001006e6f747261636b00040002800900010073797a30000000000900020073797a32"], 0xa8}}, 0x0)
socket$inet6_sctp(0xa, 0x5, 0x84)
r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80)
r4 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r3}, 0x8)
close(r4)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50)
bpf$BPF_GET_PROG_INFO(0xf, 0xfffffffffffffffe, 0x0)
ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1, {<r5=>r1}}, './file0\x00'})
ioctl$BTRFS_IOC_SPACE_INFO(r0, 0xc0109414, &(0x7f0000000380)={0xc6f, 0x10000, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']})
r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000240), 0x60000)
ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r6, 0x40a85323, &(0x7f00000002c0)={{0x9, 0x9}, 'port1\x00', 0x44, 0x10, 0xffff, 0x5, 0x9, 0xa68, 0xffff, 0x0, 0x1, 0xff})
syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), 0xffffffffffffffff)
r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0xe8f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x50, 0x6, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1, 0x47, 0x1, {0x22, 0x27}}, {{{0x9, 0x5, 0x81, 0x3, 0x420, 0x2, 0x81, 0xc3}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r7, 0x0, 0x0)
stat(&(0x7f0000000500)='./cgroup\x00', &(0x7f0000000240))
syz_usb_control_io(r7, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)={0x20, 0xa, 0x2d, {0x2d, 0x0, "c5caf62a15f28789cb9371f0db74264497bacc251a67ae007d6111128a28c1fc3e595620db3794d917f94a"}}, &(0x7f00000000c0)=ANY=[], 0x0, &(0x7f0000000340)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2, 0x10, 0x41, 0x2, "587e06fb", "a3000f63"}}, 0x0}, 0x0)
syz_usb_control_io(r7, &(0x7f0000000a40)={0x2c, &(0x7f0000000500)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, 0x0, 0x0}, 0x0)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r8, 0x0, 0x0)
sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[], 0xac}, 0x1, 0x0, 0x0, 0x3}, 0x20020884)

2.39873965s ago: executing program 0 (id=3211):
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, &(0x7f0000000080)=0x10, 0x4)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000001c0)={'vxcan0\x00', <r1=>0x0})
bind$can_raw(r0, &(0x7f0000000200)={0x1d, r1}, 0x10)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="740000000001010400000000000000000a000002300001802c00018014000300fe8000000000000000000000000000aa14000400ff010000000000000000000000000001300002802c00018014000300fe8000000000004000000000000000aa14000400fe880000000000000000000000000101"], 0x74}}, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000005600010000000000000000000700c6c9", @ANYRES32=r2, @ANYBLOB="200001"], 0x38}}, 0x0)
bind$can_raw(r0, &(0x7f00000003c0), 0x10)
socket$nl_xfrm(0x10, 0x3, 0x6)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x27ca16e45f0dbb89, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000140)={0xa000201e})
writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0xfffe}], 0x1)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
socket(0x400000000010, 0x3, 0x0)
r7 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r8 = socket(0x400000000010, 0x3, 0x0)
r9 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r10=>0x0})
sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002000)=@delchain={0x24, 0x66, 0x49404108a2eb2df, 0x30bd2c, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x0, 0xfff3}, {}, {0xffeb, 0x1d0c5d7c03b59b98}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004880)
connect$can_bcm(r8, &(0x7f0000000280), 0x10)
r11 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r11, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1})
ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f0000000380)={0x1, 0x0, [{0x4b564d05, 0xec000000, 0xcd}]})
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})

2.167920223s ago: executing program 2 (id=3212):
memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3)
socket$nl_generic(0x10, 0x3, 0x10)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={'\x00', 0x7, 0x40, 0x1, 0xb9e7, 0x3, <r0=>0xffffffffffffffff})
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e22, 0xb6, @ipv4={'\x00', '\xff\xff', @local}, 0xc4ca}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040), 0x3)
setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "25fd25990fe381b9", "f511161d94f179ecf85eb61b6a4762eb", "1e59ddbe", "06ed010001809f9b"}, 0x28)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4)
sendto$inet6(r1, &(0x7f0000000300)='S', 0xfffffffffffffe94, 0xc000, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
sched_setscheduler(r0, 0x1, &(0x7f0000000080)=0x5)
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0)
pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x3, 0x2, 0x9, 0xffff, 0xb, 0x80000003, 0x100000000000b06c}, 0x0, 0x0)

2.139461432s ago: executing program 4 (id=3213):
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x35, 0x1, 0x8, 0x0, 0x0)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00')
read$FUSE(r0, &(0x7f0000003440)={0x2020}, 0x2020)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./dev/mtdblock0\x00', &(0x7f0000000180)='xfs\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r3 = openat(0xffffffffffffff9c, 0x0, 0x320800d, 0xb1)
openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00'})
read$FUSE(r3, &(0x7f0000002140)={0x2020}, 0xffffffffffffff7e)
bind$inet6(r1, &(0x7f0000000440)={0xa, 0x4e23, 0x7, @remote, 0x63}, 0x1c)
sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0)
ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, 0x0)
writev(r5, &(0x7f0000001600)=[{0x0}, {&(0x7f0000000180)="29e3e5864ceda68155960e4b20eb0403a71898733f0dcb64c38849be0185191621d8d87c521201593212da719d600d9262d4ac59dfb5ec2b503053b465b55ae5c7ca58b82c73ad9aa7872d1e4060a6112879a7afe128f10bf20cfd", 0x5b}, {&(0x7f0000000300)="ac3d900278bc4f673648008b3fd9da", 0xf}, {&(0x7f0000000340)="79baf7c80af72c6d074d7aa55d18c2b3f92fb55d09041ffa4b66a0ed18f71e54cc0a5bc1461a6d07e6d4f31058721987ab90040f06c98df9afdd7c6614915beee9a0bea8187c6315a4be760ebc06c000bbe9a766f3752ff9ed8b304d3378bfd1a88dfc510d611a8c13259173a7c957bdd73f4bc320391f6d862cfdd58f6c09abefc7302f22bf6795474455a958f56a17d1551e", 0x93}, {0x0}, {&(0x7f00000004c0)="a407d58cecfb1369d434cee2363e2e667262a9fda651de7eb280ec8ff5087e0036af2fef7939cac0a06e6169aa6caa951a4a9b35e608532fafaa74692296b26bf7525aefeadde445128254deda33cb8622aad1f5aa0ab3ba8a81949805c4de7209102f463431fb613efae16477340300ad74baf9e9dcf19667797369fdeb42", 0x7f}, {&(0x7f00000005c0)}], 0x7)
socket(0x2, 0x5, 0x0)

1.08687055s ago: executing program 2 (id=3214):
memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3)
socket$nl_generic(0x10, 0x3, 0x10)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={'\x00', 0x7, 0x40, 0x1, 0xb9e7, 0x3, <r0=>0xffffffffffffffff})
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59)
connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4e22, 0xb6, @ipv4={'\x00', '\xff\xff', @local}, 0xc4ca}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040), 0x3)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "25fd25990fe381b9", "f511161d94f179ecf85eb61b6a4762eb", "1e59ddbe", "06ed010001809f9b"}, 0x28)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000300)='S', 0xfffffffffffffe94, 0xc000, 0x0, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000000)=0x2100e6d4, 0x4)
socket$nl_netfilter(0x10, 0x3, 0xc)
sched_setscheduler(r0, 0x1, &(0x7f0000000080)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0)
pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x3, 0x2, 0x9, 0xffff, 0xb, 0x80000003, 0x100000000000b06c}, 0x0, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_MCAST_LEAVE_GROUP(r2, 0x29, 0x2d, 0x0, 0x88)
socket$alg(0x26, 0x5, 0x0)

1.077408563s ago: executing program 1 (id=3215):
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0xa0000000, 0x81)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000200)={0x38, 0x3ed, 0x46f131212115be36, 0x70bd2b, 0x25dfdbfe, "b0f1742148524707eb5042d6c3654d6b2e3b2ec0d368f5f34c9121dbabf137f6f8532bbdb80b5204", [""]}, 0x38}, 0x1, 0x0, 0x0, 0x810}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000010c0)={0x48, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004001}, 0x8000)
syz_usb_disconnect(r0)
syz_usb_connect$rtl8150(0x2, 0xffffffffffffff61, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x4b, [{{0x9, 0x2, 0x2d}}]}}, 0x0)
ioctl$EVIOCRMFF(r0, 0x4004550e, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xc, 0x5, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x11}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000180)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
r4 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep1(r4, 0x82, 0xb0, &(0x7f0000000400)={[{0x6f, 0x4e00, "855e3bdc700a569c8279b29736fb134118f402d45d9209ee759b48b15ee169695714a9993f2d86a4f44d0a5e368d7f68a80ccbe46d321e3219b4dcabccf4fff2d3797f16cc426168524fc11065d3899d9c43310c6f7cbcec7b2e5575a295820ab43c903a2f6ff7d789c7c0ac629c41"}, {0x38, 0x4e00, "c96709dda20fc19891e165266562d523a4a542eb67e04d9927513c2a2f6f8e527a0c5edaa46ce62d4ce28423895ae7eb8108d9a9a920c776"}]})
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c)
syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000b3838108480b0310547b010203010902120001000000000904"], 0x0)

63.471244ms ago: executing program 4 (id=3216):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/subsystems/testnqn\x00', 0x1ff)
rmdir(&(0x7f0000000040)='./config/nvmet/subsystems/testnqn\x00')
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000b98bc2c900000000f91f20207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x41100}, 0x94)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/mem_sleep', 0x101a02, 0x0)
copy_file_range(r1, &(0x7f0000000000)=0x7, r1, 0x0, 0x7, 0x0)
ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8983, &(0x7f0000000040))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0)
write(r2, &(0x7f0000000700)='disable=', 0x8)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x3, 0xb, &(0x7f0000000200)=ANY=[@ANYRES8=r0, @ANYBLOB="3a408ae6ed66006b16e33aad5905c791e046db83aa87858799a9a7b47272d8c1089a51ee2fbff4b413b3fdb1bd3e18385fa148f4d63ba6c39e7e87f4f9eb332e6ebaf87c3be40250c3fa952bb7b6960b136b813224b7ca5782d84560a7dbf952055dd4f5fad861936343520f05d9a3953e04e63f451d7ff163fbb51f86c7ffc76804e06015f7688a87a8bc1c4dc5bd7142e74d3159be707dc90b6171dd6e0a5e33544d30c1fb20e11f98"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000005880)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000001240)="14051b5ae730a16b38ec3c25a36f", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xa}, 0x50)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0xffffffffffffffb7)

0s ago: executing program 2 (id=3217):
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/4094, 0xffe}], 0x1, 0x33, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000002f000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0xc08, 0x3, 0x478, 0x310, 0x5002004a, 0xb, 0x310, 0xea13, 0x3e0, 0x3c8, 0x3c8, 0x3e0, 0x3c8, 0x3, 0x0, {[{{@ip={@remote, @private=0xa010101, 0xff, 0xffffffff, 'bridge0\x00', 'veth0_macvtap\x00', {}, {0xff}, 0x5c, 0x3, 0x2}, 0x0, 0x2c8, 0x310, 0x0, {0x5c00000000000000}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r3}}, @common=@inet=@socket3={{0x28}}]}, @unspec=@CT0={0x20, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, '\x00', {0x4}}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x4, [0x5, 0x1, 0x6, 0x1, 0x7, 0x2], 0x6, 0x7}, {0xffffffffffffffff, [0x4, 0x4, 0x2, 0x5, 0x8], 0x6, 0x2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4d8)
flock(r0, 0x2)
r4 = gettid()
prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/sda\x00', 0x2, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f00000000c0)={'batadv0\x00', <r6=>0x0})
r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r7, 0x20, &(0x7f0000000100)={0x0, 0x0, <r8=>0x0, 0x0}}, 0x10)
bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=r8, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xe, 0x5, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}, [@map_idx_val={0x18, 0x1, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x40f00, 0x40, '\x00', r6, @fallback=0xb, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000100)={0x5, 0x5, 0x81, 0x1}, 0x10, r8, 0xffffffffffffffff, 0x4, 0x0, &(0x7f0000000140)=[{0x2, 0x1, 0x4, 0x9}, {0x0, 0x5, 0x7, 0x7}, {0x3, 0x4, 0x10}, {0x5, 0x4, 0xd, 0x4}], 0x10, 0x2}, 0x94)
ioctl$BLKDISCARD(r5, 0x1277, &(0x7f0000000000))
syz_open_procfs(r4, 0x0)

kernel console output (not intermixed with test programs):

445][T22260] hsr_slave_0: entered promiscuous mode
[  677.825357][T22260] hsr_slave_1: entered promiscuous mode
[  677.839187][T22260] debugfs: 'hsr0' already exists in 'hsr'
[  677.845255][T22260] Cannot create hsr debugfs directory
[  678.499618][ T5717] usb 6-1: new full-speed USB device number 54 using dummy_hcd
[  678.581155][T22696] netlink: 'syz.2.2795': attribute type 12 has an invalid length.
[  678.589765][T22696] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2795'.
[  678.611748][   T30] audit: type=1400 audit(2000000191.074:2352): avc:  denied  { write } for  pid=22677 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  678.684568][ T5717] usb 6-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00
[  678.696785][ T5717] usb 6-1: config 0 interface 0 has no altsetting 0
[  678.704166][ T5717] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  678.742725][ T5717] usb 6-1: config 0 descriptor??
[  678.754913][ T9933] bridge_slave_1: left allmulticast mode
[  678.773895][ T9933] bridge_slave_1: left promiscuous mode
[  678.792397][ T9933] bridge0: port 2(bridge_slave_1) entered disabled state
[  678.838824][ T9933] bridge_slave_0: left allmulticast mode
[  678.851525][ T9933] bridge_slave_0: left promiscuous mode
[  678.862260][ T9933] bridge0: port 1(bridge_slave_0) entered disabled state
[  678.880509][   T30] audit: type=1400 audit(2000000191.323:2353): avc:  denied  { write } for  pid=22724 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  678.931915][T22725] read descriptors
[  680.014925][T22683] ipt_REJECT: ECHOREPLY no longer supported.
[  680.147958][T22683] rdma_rxe: rxe_newlink: failed to add veth1_vlan
[  680.359259][T22683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  680.359750][T22683] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  680.623206][ T9933] bond1 (unregistering): (slave bridge1): Releasing active interface
[  680.640252][ T5717] hid_parser_main: 348 callbacks suppressed
[  680.640273][ T5717] holtek 0003:1241:5015.0012: unknown main item tag 0x0
[  680.662183][ T5717] holtek 0003:1241:5015.0012: report_id 13214 is invalid
[  680.670238][ T9933] bond0 (unregistering): (slave 
c
@0�): Releasing backup interface
[  680.678669][ T5717] holtek 0003:1241:5015.0012: item 0 2 1 8 parsing failed
[  680.686692][ T9933] bond0 (unregistering): Released all slaves
[  680.695715][ T5717] holtek 0003:1241:5015.0012: parse failed
[  680.707213][ T9933] bond1 (unregistering): Released all slaves
[  680.713491][ T5717] holtek 0003:1241:5015.0012: probe with driver holtek failed with error -22
[  680.789711][ T5257] 8021q: adding VLAN 0 to HW filter on device eth2
[  680.871535][T21112] ffs_data_put(): freeing
[  680.965090][ T5781] usb 6-1: USB disconnect, device number 54
[  681.111909][T22790] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030
[  681.150195][ T9933] tipc: Left network mode
[  681.267206][ T9933] IPVS: stopping master sync thread 16710 ...
[  681.808215][ T5602] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci6/hci6:201'
[  681.820750][ T5602] CPU: 0 UID: 0 PID: 5602 Comm: kworker/u9:3 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  681.820785][ T5602] Tainted: [L]=SOFTLOCKUP
[  681.820792][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  681.820807][ T5602] Workqueue: hci6 hci_rx_work
[  681.820834][ T5602] Call Trace:
[  681.820841][ T5602]  <TASK>
[  681.820852][ T5602]  dump_stack_lvl+0x100/0x190
[  681.820879][ T5602]  sysfs_warn_dup.cold+0x1c/0x28
[  681.820916][ T5602]  sysfs_create_dir_ns+0x24b/0x2b0
[  681.820937][ T5602]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  681.820956][ T5602]  ? find_held_lock+0x2b/0x80
[  681.820975][ T5602]  ? kobject_add_internal+0x25f/0x930
[  681.820997][ T5602]  ? kobject_add_internal+0x25f/0x930
[  681.821020][ T5602]  ? do_raw_spin_unlock+0x145/0x1e0
[  681.821050][ T5602]  kobject_add_internal+0x2c8/0x930
[  681.821074][ T5602]  kobject_add+0x16a/0x1e0
[  681.821092][ T5602]  ? __pfx_kobject_add+0x10/0x10
[  681.821110][ T5602]  ? class_to_subsys+0x10f/0x150
[  681.821142][ T5602]  ? kobject_put+0xb9/0x640
[  681.821169][ T5602]  ? _raw_spin_unlock+0x28/0x50
[  681.821199][ T5602]  device_add+0x294/0x1970
[  681.821228][ T5602]  ? __pfx_dev_set_name+0x10/0x10
[  681.821247][ T5602]  ? __pfx_device_add+0x10/0x10
[  681.821274][ T5602]  ? mgmt_send_event_skb+0x2fb/0x460
[  681.821305][ T5602]  hci_conn_add_sysfs+0x1a3/0x260
[  681.821333][ T5602]  le_conn_complete_evt+0x11eb/0x1f60
[  681.821361][ T5602]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  681.821379][ T5602]  ? hci_event_packet+0x186/0xcd0
[  681.821405][ T5602]  hci_le_conn_complete_evt+0x23c/0x3a0
[  681.821428][ T5602]  ? skb_pull_data+0x15f/0x1e0
[  681.821460][ T5602]  hci_le_meta_evt+0x34a/0x5f0
[  681.821486][ T5602]  ? __pfx_hci_le_conn_complete_evt+0x10/0x10
[  681.821511][ T5602]  hci_event_packet+0x51c/0xcd0
[  681.821533][ T5602]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  681.821557][ T5602]  ? __pfx_hci_event_packet+0x10/0x10
[  681.821584][ T5602]  ? kcov_remote_start+0x394/0x670
[  681.821609][ T5602]  hci_rx_work+0x451/0xfc0
[  681.821634][ T5602]  process_one_work+0xa23/0x1940
[  681.821666][ T5602]  ? __pfx_process_one_work+0x10/0x10
[  681.821691][ T5602]  ? __pfx_hci_rx_work+0x10/0x10
[  681.821714][ T5602]  worker_thread+0x5ef/0xe50
[  681.821742][ T5602]  ? kthread+0x13a/0x450
[  681.821759][ T5602]  ? __pfx_worker_thread+0x10/0x10
[  681.821787][ T5602]  kthread+0x370/0x450
[  681.821807][ T5602]  ? __pfx_kthread+0x10/0x10
[  681.821829][ T5602]  ret_from_fork+0x72b/0xd50
[  681.821857][ T5602]  ? __pfx_ret_from_fork+0x10/0x10
[  681.821882][ T5602]  ? rcu_is_watching+0x12/0xc0
[  681.821917][ T5602]  ? __switch_to+0x800/0x10f0
[  681.821938][ T5602]  ? __pfx_kthread+0x10/0x10
[  681.821958][ T5602]  ret_from_fork_asm+0x1a/0x30
[  681.821994][ T5602]  </TASK>
[  681.822083][ T5602] kobject: kobject_add_internal failed for hci6:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  682.107236][ T5602] Bluetooth: hci6: failed to register connection device
[  682.583032][T22837] netlink: 'syz.5.2809': attribute type 12 has an invalid length.
[  682.594169][T22837] netlink: 132 bytes leftover after parsing attributes in process `syz.5.2809'.
[  682.710235][T22845] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2810'.
[  682.870292][   T30] audit: type=1400 audit(2000000195.007:2354): avc:  denied  { write } for  pid=22815 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  682.960155][T22859] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2811'.
[  683.002918][T22863] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2813'.
[  683.226844][   T30] audit: type=1400 audit(2000000195.339:2355): avc:  denied  { write } for  pid=22865 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  683.596556][ T5696] usb 1-1: new high-speed USB device number 74 using dummy_hcd
[  683.752138][T22119] usb 3-1: new full-speed USB device number 47 using dummy_hcd
[  684.360730][   T50] Bluetooth: hci6: command 0x2016 tx timeout
[  684.381991][ T5696] usb 1-1: Using ep0 maxpacket: 32
[  684.396606][ T5696] usb 1-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64
[  684.454453][T22898] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2819'.
[  684.487344][T22901] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2820'.
[  684.535547][ T5696] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  684.549567][T22119] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea
[  684.571594][T22119] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  684.598997][ T5696] usb 1-1: config 0 descriptor??
[  684.678775][T22119] usb 3-1: Product: syz
[  684.741704][T22119] usb 3-1: Manufacturer: syz
[  684.773178][T22119] usb 3-1: SerialNumber: syz
[  684.951648][T22119] usb 3-1: config 0 descriptor??
[  684.973501][ T5696] as10x_usb: device has been detected
[  685.013397][ T5696] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle)
[  685.076732][ T5696] usb 1-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)...
[  685.225216][T22119] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state
[  685.302492][ T5696] as10x_usb: error during firmware upload part1
[  685.316469][ T5696] Registered device nBox DVB-T Dongle
[  685.392777][   T30] audit: type=1400 audit(2000000197.334:2356): avc:  denied  { write } for  pid=22904 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  685.609820][ T5717] usb 1-1: USB disconnect, device number 74
[  685.630041][   T30] audit: type=1400 audit(2000000197.546:2357): avc:  denied  { write } for  pid=22943 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  685.668203][ T9937] smc: removing ib device syz0
[  685.678651][T22885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  685.696269][ T5717] Unregistered device nBox DVB-T Dongle
[  685.700987][ T5717] as10x_usb: device has been disconnected
[  685.719153][T22885] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  685.801022][ T9933] team0 (unregistering): Port device team_slave_1 removed
[  685.821267][ T9933] team0 (unregistering): Port device team_slave_0 removed
[  686.043187][ T5703] virt_wifi0 speed is unknown, defaulting to 1000
[  686.045574][ T5257] 8021q: adding VLAN 0 to HW filter on device eth5
[  686.515627][ T9937] smbdirect: ib_dev[syz0] removed
[  686.544237][T22260] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  686.594267][   T50] Bluetooth: hci6: command 0x2016 tx timeout
[  686.624603][T22260] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  686.642469][T22260] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  686.806387][T22260] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  686.835966][T22260] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  686.966808][T22119] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71
[  687.059855][T22970] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  687.117271][T22119] usb 3-1: USB disconnect, device number 47
[  687.127373][T22970] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  687.142266][T22970] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  687.162641][T22260] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  687.216166][T22260] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  687.364328][T22260] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  687.394395][T22970] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  687.420582][T22970] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  687.424637][T23005] tmpfs: Unknown parameter '���'
[  687.434559][T22970] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  687.459677][T22970] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  687.467519][   T30] audit: type=1400 audit(2000000199.245:2358): avc:  denied  { write } for  pid=22968 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  687.496850][T22970] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  687.531748][T22970] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  687.559552][T22970] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  687.627569][T22970] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  687.673402][T22970] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  687.700951][T22970] Bluetooth: hci6: Opcode 0x0406 failed: -4
[  687.758428][T22260] 8021q: adding VLAN 0 to HW filter on device bond0
[  687.779214][   T30] audit: type=1400 audit(2000000199.540:2359): avc:  denied  { write } for  pid=23016 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  687.803323][T22970] Bluetooth: hci6: Opcode 0x0406 failed: -4
[  687.827834][T22260] 8021q: adding VLAN 0 to HW filter on device team0
[  687.856194][T22970] Bluetooth: hci6: Opcode 0x0406 failed: -4
[  687.867398][ T9943] bridge0: port 1(bridge_slave_0) entered blocking state
[  687.874609][ T9943] bridge0: port 1(bridge_slave_0) entered forwarding state
[  687.914417][T22970] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  687.943730][T22970] Bluetooth: hci1: Opcode 0x0406 failed: -4
[  687.953050][   T57] bridge0: port 2(bridge_slave_1) entered blocking state
[  687.960343][   T57] bridge0: port 2(bridge_slave_1) entered forwarding state
[  688.062650][T22970] Bluetooth: hci1: Opcode 0x0406 failed: -4
[  688.107216][T23034] XFS (mtdblock0): Invalid superblock magic number
[  688.431908][   T30] audit: type=1400 audit(2000000200.140:2360): avc:  denied  { ioctl } for  pid=23047 comm="syz.5.2831" path="socket:[55737]" dev="sockfs" ino=55737 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1
[  688.551607][T22119] usb 3-1: new high-speed USB device number 48 using dummy_hcd
[  688.725679][T22119] usb 3-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00
[  688.747262][   T50] Bluetooth: hci4: command 0x0c1a tx timeout
[  688.755384][T22119] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  688.778894][T22119] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0
[  688.862179][T22119] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 0
[  688.889374][T22119] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4
[  688.922723][T22119] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  688.973530][T22119] usb 3-1: probing VID:PID(0424:012C)   
[  688.997589][T22119] usb 3-1: vub300 testing BULK IN EndPoint(0) 81
[  689.031484][T22119] usb 3-1: vub300 testing BULK OUT EndPoint(1) 02
[  689.042538][T22119] usb 3-1: vub300 testing BULK IN EndPoint(2) 83
[  689.065718][T22119] usb 3-1: Could not find two sets of bulk-in/out endpoint pairs
[  689.102747][T22119] vub300 3-1:1.0: probe with driver vub300 failed with error -22
[  689.196385][T23017] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2827'.
[  689.242525][T23017] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2827'.
[  689.301491][T23084] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2827'.
[  689.353519][   T50] Bluetooth: hci5: command 0x2016 tx timeout
[  689.359897][T23084] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2827'.
[  689.427088][T22119] usb 3-1: USB disconnect, device number 48
[  689.487715][   T30] audit: type=1400 audit(2000000201.119:2361): avc:  denied  { write } for  pid=23046 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  689.731960][T22260] 8021q: adding VLAN 0 to HW filter on device batadv0
[  689.897805][   T50] Bluetooth: hci6: command 0x2016 tx timeout
[  690.133504][   T50] Bluetooth: hci1: command 0x0c1a tx timeout
[  690.815326][   T30] audit: type=1400 audit(2000000202.337:2362): avc:  denied  { write } for  pid=23100 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  690.938611][T23105] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2838'.
[  691.078143][T23121] XFS (mtdblock0): Invalid superblock magic number
[  691.606835][   T50] Bluetooth: hci5: command 0x2016 tx timeout
[  692.165337][ T9933] IPVS: stop unused estimator thread 0...
[  692.176001][   T50] Bluetooth: hci6: command 0x2016 tx timeout
[  692.301990][   T30] audit: type=1400 audit(2000000203.704:2363): avc:  denied  { load_policy } for  pid=23146 comm="syz.0.2844" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1
[  692.303569][T23147] SELinux:  policydb string length 0 does not match expected length 8
[  692.337577][T23147] SELinux: failed to load policy
[  692.386552][   T50] Bluetooth: hci1: command 0x0c1a tx timeout
[  692.583667][T22260] veth0_vlan: entered promiscuous mode
[  692.758440][T23163] netlink: 'syz.5.2847': attribute type 21 has an invalid length.
[  692.785642][T23163] netlink: 156 bytes leftover after parsing attributes in process `syz.5.2847'.
[  692.795927][T22260] veth1_vlan: entered promiscuous mode
[  692.836551][ T5681] IPVS: starting estimator thread 0...
[  692.871854][   T30] audit: type=1400 audit(2000000204.239:2364): avc:  denied  { write } for  pid=23122 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  692.943392][T22260] veth0_macvtap: entered promiscuous mode
[  692.987889][T22260] veth1_macvtap: entered promiscuous mode
[  692.992720][T23165] IPVS: using max 52 ests per chain, 124800 per kthread
[  693.161507][T23176] netlink: 'syz.1.2850': attribute type 12 has an invalid length.
[  693.204668][T23176] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2850'.
[  693.285919][   T30] audit: type=1400 audit(2000000204.608:2365): avc:  denied  { write } for  pid=23178 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  693.397368][T23179] 8021q: adding VLAN 0 to HW filter on device bond0
[  693.410180][T23179] 8021q: adding VLAN 0 to HW filter on device team0
[  693.420343][T23179] dummy0: left promiscuous mode
[  693.428201][T23179] dummy0: left allmulticast mode
[  693.743300][T23179] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  693.760782][T23179] veth1_vlan: left promiscuous mode
[  693.767710][T23179] veth0_vlan: left promiscuous mode
[  693.775147][T23179] veth0_vlan: entered promiscuous mode
[  693.783258][T23179] veth1_vlan: entered promiscuous mode
[  693.797806][T23179] veth1_macvtap: left promiscuous mode
[  693.804328][T23179] veth0_macvtap: left promiscuous mode
[  693.811020][T23179] veth0_macvtap: entered promiscuous mode
[  693.819088][T23179] veth0_macvtap: entered allmulticast mode
[  693.824972][T23179] macvtap0: left allmulticast mode
[  693.830320][T23179] veth0_macvtap: left allmulticast mode
[  693.837164][T23179] veth1_macvtap: entered promiscuous mode
[  693.849531][T23179] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  693.857914][T23179] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  693.869206][T23179] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  693.877930][T23179] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  693.886591][T23179] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check.
[  693.902311][   T50] Bluetooth: hci5: command 0x2016 tx timeout
[  694.126604][ T9927] bridge0: port 1(bridge_slave_0) entered blocking state
[  694.133985][ T9927] bridge0: port 1(bridge_slave_0) entered forwarding state
[  694.168770][T23182] XFS (mtdblock0): Invalid superblock magic number
[  694.390087][   T50] Bluetooth: hci6: command 0x2016 tx timeout
[  694.659181][   T50] Bluetooth: hci1: command 0x0c1a tx timeout
[  694.691582][ T9927] bridge0: port 2(bridge_slave_1) entered blocking state
[  694.698802][ T9927] bridge0: port 2(bridge_slave_1) entered forwarding state
[  694.957305][T23195] ffs_data_put(): freeing
[  694.984464][T23195] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2854'.
[  695.087132][T22260] batman_adv: batadv0: Interface activated: batadv_slave_0
[  695.110657][T23200] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check.
[  695.185672][T22260] batman_adv: batadv0: Interface activated: batadv_slave_1
[  695.389809][ T9941] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  695.403284][ T9941] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  695.453212][ T9931] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  695.507743][ T9931] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  695.751644][ T9942] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  695.789482][ T9942] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  695.969995][T23108] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  695.989567][T23108] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  696.113578][   T50] Bluetooth: hci5: command 0x2016 tx timeout
[  696.147200][    T9] usb 3-1: new high-speed USB device number 49 using dummy_hcd
[  696.174910][   T30] audit: type=1400 audit(2000000207.286:2366): avc:  denied  { write } for  pid=23203 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  696.383092][    T9] usb 3-1: Using ep0 maxpacket: 32
[  696.402254][    T9] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f
[  696.439243][    T9] usb 3-1: config 0 has an invalid interface number: 51 but max is 0
[  696.465205][   T30] audit: type=1400 audit(2000000207.553:2367): avc:  denied  { write } for  pid=23262 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  696.531114][    T9] usb 3-1: config 0 has no interface number 0
[  696.612554][    T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  696.622349][    T9] usb 3-1: Product: syz
[  696.627007][    T9] usb 3-1: Manufacturer: syz
[  696.631688][    T9] usb 3-1: SerialNumber: syz
[  696.632421][   T50] Bluetooth: hci6: command 0x2016 tx timeout
[  696.644407][    T9] usb 3-1: config 0 descriptor??
[  696.655954][    T9] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected
[  697.111522][    T9] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0
[  697.186395][    T9] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1
[  697.515679][    C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71
[  697.524869][    T9] usb 3-1: USB disconnect, device number 49
[  697.590919][    T9] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0
[  697.651533][T22119] usb 1-1: new high-speed USB device number 75 using dummy_hcd
[  697.666621][    T9] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1
[  697.712594][    T9] quatech2 3-1:0.51: device disconnected
[  697.868750][T22119] usb 1-1: Using ep0 maxpacket: 16
[  697.903106][T22119] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  697.952592][   T30] audit: type=1400 audit(2000000208.929:2368): avc:  denied  { write } for  pid=23281 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  698.110638][T22119] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  698.158346][T22119] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  698.265233][T22119] usb 1-1: Manufacturer: syz
[  698.330223][T22119] usb 1-1: config 0 descriptor??
[  698.366146][   T50] Bluetooth: hci5: command 0x2016 tx timeout
[  698.456514][   T30] audit: type=1400 audit(2000000209.400:2369): avc:  denied  { write } for  pid=23327 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  698.665183][ T5793] usb 1-1: USB disconnect, device number 75
[  698.853051][T22119] usb 3-1: new high-speed USB device number 50 using dummy_hcd
[  698.972032][ T5602] Bluetooth: hci1: command 0x0c1a tx timeout
[  699.083378][T22119] usb 3-1: Using ep0 maxpacket: 16
[  699.103948][T23359] 9p: Bad value for 'rfdno'
[  699.112426][   T30] audit: type=1400 audit(2000000209.981:2370): avc:  denied  { mounton } for  pid=23358 comm="syz.4.2871" path="/2/file0" dev="tmpfs" ino=29 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1
[  699.116086][T22119] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  699.168811][T23360] 9p: Bad value for 'rfdno'
[  699.177184][T22119] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  699.191472][T22119] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  699.203024][T22119] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 6144, setting to 1024
[  699.216733][T22119] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024
[  699.242823][T22119] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  699.255748][   T30] audit: type=1400 audit(2000000210.120:2371): avc:  denied  { write } for  pid=23331 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  699.303201][T22119] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  699.311718][T22119] usb 3-1: Manufacturer: syz
[  699.345456][T23367] tmpfs: Unknown parameter '�p'
[  699.367006][T22119] usb 3-1: config 0 descriptor??
[  699.488053][ T4912] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  699.528771][ T4912] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  699.544557][ T4912] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  699.552525][ T4912] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  699.562243][ T4912] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  699.677694][ T5793] usb 5-1: new high-speed USB device number 49 using dummy_hcd
[  699.719217][   T30] audit: type=1400 audit(2000000210.554:2372): avc:  denied  { write } for  pid=23382 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  699.775014][T22119] rc_core: IR keymap rc-hauppauge not found
[  699.799012][T22119] Registered IR keymap rc-empty
[  699.820332][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  699.844881][T23395] XFS (mtdblock0): Invalid superblock magic number
[  699.860513][ T5793] usb 5-1: Using ep0 maxpacket: 8
[  699.868124][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  699.874948][ T5793] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a
[  699.888832][ T5793] usb 5-1: config 0 has an invalid interface number: 55 but max is 0
[  699.897312][ T5793] usb 5-1: config 0 has no interface number 0
[  699.904120][T22119] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0
[  699.915777][ T5793] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[  699.930674][T22119] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input40
[  699.944911][ T5793] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B
[  699.956775][ T5793] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[  699.986917][ T5793] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[  700.244355][ T5793] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  700.289073][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  700.326267][    C0] rc rc0: IR event FIFO is full!
[  700.331263][    C0] rc rc0: IR event FIFO is full!
[  700.336637][    C0] rc rc0: IR event FIFO is full!
[  700.341582][    C0] rc rc0: IR event FIFO is full!
[  700.346506][    C0] rc rc0: IR event FIFO is full!
[  700.351427][    C0] rc rc0: IR event FIFO is full!
[  700.356366][    C0] rc rc0: IR event FIFO is full!
[  700.361295][    C0] rc rc0: IR event FIFO is full!
[  700.366222][    C0] rc rc0: IR event FIFO is full!
[  700.371166][    C0] rc rc0: IR event FIFO is full!
[  700.376094][    C0] rc rc0: IR event FIFO is full!
[  700.383512][    C0] rc rc0: IR event FIFO is full!
[  700.388489][    C0] rc rc0: IR event FIFO is full!
[  700.393424][    C0] rc rc0: IR event FIFO is full!
[  700.399575][    C0] rc rc0: IR event FIFO is full!
[  700.404540][    C0] rc rc0: IR event FIFO is full!
[  700.409475][    C0] rc rc0: IR event FIFO is full!
[  700.414403][    C0] rc rc0: IR event FIFO is full!
[  700.419336][    C0] rc rc0: IR event FIFO is full!
[  700.424663][    C0] rc rc0: IR event FIFO is full!
[  700.429610][    C0] rc rc0: IR event FIFO is full!
[  700.434545][    C0] rc rc0: IR event FIFO is full!
[  700.439474][    C0] rc rc0: IR event FIFO is full!
[  700.444407][    C0] rc rc0: IR event FIFO is full!
[  700.450049][    C0] rc rc0: IR event FIFO is full!
[  700.454998][    C0] rc rc0: IR event FIFO is full!
[  700.459934][    C0] rc rc0: IR event FIFO is full!
[  700.465354][    C0] rc rc0: IR event FIFO is full!
[  700.470330][    C0] rc rc0: IR event FIFO is full!
[  700.475268][    C0] rc rc0: IR event FIFO is full!
[  700.480200][    C0] rc rc0: IR event FIFO is full!
[  700.485131][    C0] rc rc0: IR event FIFO is full!
[  700.490079][    C0] rc rc0: IR event FIFO is full!
[  700.495013][    C0] rc rc0: IR event FIFO is full!
[  700.499945][    C0] rc rc0: IR event FIFO is full!
[  700.506433][    C0] rc rc0: IR event FIFO is full!
[  700.512170][    C0] rc rc0: IR event FIFO is full!
[  700.517145][    C0] rc rc0: IR event FIFO is full!
[  700.522100][    C0] rc rc0: IR event FIFO is full!
[  700.527280][    C0] rc rc0: IR event FIFO is full!
[  700.532244][    C0] rc rc0: IR event FIFO is full!
[  700.537181][    C0] rc rc0: IR event FIFO is full!
[  700.542113][    C0] rc rc0: IR event FIFO is full!
[  700.547589][    C0] rc rc0: IR event FIFO is full!
[  700.552736][    C0] rc rc0: IR event FIFO is full!
[  700.557692][    C0] rc rc0: IR event FIFO is full!
[  700.562623][    C0] rc rc0: IR event FIFO is full!
[  700.567556][    C0] rc rc0: IR event FIFO is full!
[  700.573107][    C0] rc rc0: IR event FIFO is full!
[  700.578052][    C0] rc rc0: IR event FIFO is full!
[  700.582986][    C0] rc rc0: IR event FIFO is full!
[  700.587920][    C0] rc rc0: IR event FIFO is full!
[  700.592853][    C0] rc rc0: IR event FIFO is full!
[  700.597799][    C0] rc rc0: IR event FIFO is full!
[  700.605057][    C0] rc rc0: IR event FIFO is full!
[  700.610029][    C0] rc rc0: IR event FIFO is full!
[  700.614962][    C0] rc rc0: IR event FIFO is full!
[  700.619891][    C0] rc rc0: IR event FIFO is full!
[  700.624823][    C0] rc rc0: IR event FIFO is full!
[  700.629751][    C0] rc rc0: IR event FIFO is full!
[  700.634686][    C0] rc rc0: IR event FIFO is full!
[  700.640801][    C0] rc rc0: IR event FIFO is full!
[  700.645756][    C0] rc rc0: IR event FIFO is full!
[  700.650690][    C0] rc rc0: IR event FIFO is full!
[  700.650950][ T4912] Bluetooth: hci5: command 0x2016 tx timeout
[  700.655622][    C0] rc rc0: IR event FIFO is full!
[  700.655842][    C0] rc rc0: IR event FIFO is full!
[  700.698338][ T5793] usb 5-1: config 0 descriptor??
[  700.705140][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  700.728936][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  700.735908][ T5793] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0
[  700.772148][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  700.846360][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  701.014001][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  701.070906][T22125] usb 5-1: USB disconnect, device number 49
[  701.107046][T22125] ldusb 5-1:0.55: LD USB Device #0 now disconnected
[  701.113950][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  701.173719][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  701.216039][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  701.258395][ T5607] Bluetooth: hci1: command 0x0c1a tx timeout
[  701.267815][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  701.326817][T22119] mceusb 3-1:0.0: Error: mce write urb status = -71
[  701.381927][T22119] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  701.440503][T22119] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  701.599565][T22119] usb 3-1: USB disconnect, device number 50
[  701.774325][   T30] audit: type=1400 audit(2000000212.456:2373): avc:  denied  { write } for  pid=23400 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  701.837632][ T5602] Bluetooth: hci3: command tx timeout
[  702.211470][   T30] audit: type=1400 audit(2000000212.843:2374): avc:  denied  { write } for  pid=23480 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  702.459223][T22119] syz1: Port: 1 Link DOWN
[  702.518751][T23490] F2FS-fs (nbd2): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[  702.531248][ T9942] smbdirect: ib_dev[syz1] removed
[  702.576494][T23490] F2FS-fs (nbd2): Can't find valid F2FS filesystem in 1th superblock
[  702.593766][T23490] F2FS-fs (nbd2): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[  702.643884][T23490] F2FS-fs (nbd2): Can't find valid F2FS filesystem in 2th superblock
[  702.959504][ T5602] Bluetooth: hci5: command 0x2016 tx timeout
[  703.229786][   T30] audit: type=1400 audit(2000000213.794:2375): avc:  denied  { write } for  pid=23493 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  703.472531][ T9942] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  703.489144][ T9942] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0
[  703.508822][   T30] audit: type=1400 audit(2000000214.053:2376): avc:  denied  { write } for  pid=23555 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  703.886524][ T9942] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  703.909246][ T9942] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0
[  704.084825][ T5602] Bluetooth: hci3: command tx timeout
[  704.179445][T23580] FAT-fs (nbd2): unable to read boot sector
[  704.205379][T23580] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2885'.
[  704.508444][ T9942] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  704.580148][T23598] hub 8-0:1.0: USB hub found
[  704.589980][T23598] hub 8-0:1.0: 1 port detected
[  704.757603][ T9942] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0
[  705.213696][ T5602] Bluetooth: hci5: command 0x2016 tx timeout
[  706.337688][ T5607] Bluetooth: hci3: command tx timeout
[  706.479049][    T9] usb 1-1: new full-speed USB device number 76 using dummy_hcd
[  707.475075][ T5607] Bluetooth: hci5: command 0x2016 tx timeout
[  708.590676][ T5607] Bluetooth: hci3: command tx timeout
[  710.670049][ T5607] Bluetooth: hci5: command 0x2016 tx timeout
[  712.043859][    T9] usb 1-1: device descriptor read/all, error -71
[  713.101218][ T5607] Bluetooth: hci5: command 0x2016 tx timeout
[  713.123176][   T30] audit: type=1400 audit(2000000222.934:2377): avc:  denied  { remount } for  pid=23644 comm="syz.4.2889" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1
[  713.165848][ T9942] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  713.303713][ T9942] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0
[  713.485802][T23661] sctp: [Deprecated]: syz.0.2892 (pid 23661) Use of struct sctp_assoc_value in delayed_ack socket option.
[  713.485802][T23661] Use struct sctp_sack_info instead
[  713.568901][T23377] bridge0: port 1(bridge_slave_0) entered blocking state
[  713.693462][T23377] bridge0: port 1(bridge_slave_0) entered disabled state
[  713.866412][T23377] bridge_slave_0: entered allmulticast mode
[  713.895863][T23377] bridge_slave_0: entered promiscuous mode
[  713.922924][T23377] bridge0: port 2(bridge_slave_1) entered blocking state
[  713.955215][T23377] bridge0: port 2(bridge_slave_1) entered disabled state
[  713.980351][T23377] bridge_slave_1: entered allmulticast mode
[  714.000076][T23377] bridge_slave_1: entered promiscuous mode
[  714.201609][ T5696] usb 1-1: new high-speed USB device number 78 using dummy_hcd
[  714.484694][T23687] XFS (mtdblock0): Invalid superblock magic number
[  714.620456][ T5696] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13
[  714.717918][ T5696] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7
[  714.819068][ T5696] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  714.905856][ T5696] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7
[  714.967561][T23377] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  714.970851][ T5696] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0
[  715.040240][ T5696] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  715.082547][ T5696] usb 1-1: Product: syz
[  715.086935][T23377] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  715.109041][ T5696] usb 1-1: Manufacturer: syz
[  715.124502][ T5696] usb 1-1: SerialNumber: syz
[  715.157325][ T5696] usb 1-1: config 0 descriptor??
[  715.194377][ T5602] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201'
[  715.205367][ T5602] CPU: 0 UID: 0 PID: 5602 Comm: kworker/u9:3 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  715.205400][ T5602] Tainted: [L]=SOFTLOCKUP
[  715.205408][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  715.205421][ T5602] Workqueue: hci1 hci_rx_work
[  715.205452][ T5602] Call Trace:
[  715.205459][ T5602]  <TASK>
[  715.205467][ T5602]  dump_stack_lvl+0x100/0x190
[  715.205493][ T5602]  sysfs_warn_dup.cold+0x1c/0x28
[  715.205522][ T5602]  sysfs_create_dir_ns+0x24b/0x2b0
[  715.205543][ T5602]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  715.205561][ T5602]  ? find_held_lock+0x2b/0x80
[  715.205577][ T5602]  ? kobject_add_internal+0x25f/0x930
[  715.205595][ T5602]  ? kobject_add_internal+0x25f/0x930
[  715.205616][ T5602]  ? do_raw_spin_unlock+0x145/0x1e0
[  715.205643][ T5602]  kobject_add_internal+0x2c8/0x930
[  715.205666][ T5602]  kobject_add+0x16a/0x1e0
[  715.205686][ T5602]  ? __pfx_kobject_add+0x10/0x10
[  715.205702][ T5602]  ? class_to_subsys+0x10f/0x150
[  715.205732][ T5602]  ? kobject_put+0xb9/0x640
[  715.205755][ T5602]  ? _raw_spin_unlock+0x28/0x50
[  715.205780][ T5602]  device_add+0x294/0x1970
[  715.205806][ T5602]  ? __pfx_dev_set_name+0x10/0x10
[  715.205824][ T5602]  ? __pfx_device_add+0x10/0x10
[  715.205849][ T5602]  ? mgmt_send_event_skb+0x2fb/0x460
[  715.205880][ T5602]  hci_conn_add_sysfs+0x1a3/0x260
[  715.205908][ T5602]  le_conn_complete_evt+0x11eb/0x1f60
[  715.205938][ T5602]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  715.205961][ T5602]  ? hci_event_packet+0x186/0xcd0
[  715.205990][ T5602]  hci_le_conn_complete_evt+0x23c/0x3a0
[  715.206015][ T5602]  ? skb_pull_data+0x15f/0x1e0
[  715.206048][ T5602]  hci_le_meta_evt+0x34a/0x5f0
[  715.206074][ T5602]  ? __pfx_hci_le_conn_complete_evt+0x10/0x10
[  715.206103][ T5602]  hci_event_packet+0x51c/0xcd0
[  715.206125][ T5602]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  715.206147][ T5602]  ? __pfx_hci_event_packet+0x10/0x10
[  715.206169][ T5602]  ? kcov_remote_start+0x384/0x670
[  715.206191][ T5602]  ? lockdep_hardirqs_on+0x78/0x100
[  715.206221][ T5602]  hci_rx_work+0x451/0xfc0
[  715.206249][ T5602]  process_one_work+0xa23/0x1940
[  715.206289][ T5602]  ? __pfx_process_one_work+0x10/0x10
[  715.206321][ T5602]  ? __pfx_hci_rx_work+0x10/0x10
[  715.206348][ T5602]  worker_thread+0x5ef/0xe50
[  715.206381][ T5602]  ? kthread+0x13a/0x450
[  715.206400][ T5602]  ? __pfx_worker_thread+0x10/0x10
[  715.206419][ T5602]  kthread+0x370/0x450
[  715.206437][ T5602]  ? __pfx_kthread+0x10/0x10
[  715.206458][ T5602]  ret_from_fork+0x72b/0xd50
[  715.206486][ T5602]  ? __pfx_ret_from_fork+0x10/0x10
[  715.206512][ T5602]  ? rcu_is_watching+0x12/0xc0
[  715.206535][ T5602]  ? __switch_to+0x800/0x10f0
[  715.206553][ T5602]  ? __pfx_kthread+0x10/0x10
[  715.206572][ T5602]  ret_from_fork_asm+0x1a/0x30
[  715.206607][ T5602]  </TASK>
[  715.371385][ T4912] Bluetooth: hci5: command 0x2016 tx timeout
[  715.381991][ T5602] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  715.499529][ T5696] adutux 1-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0
[  715.517231][ T5602] Bluetooth: hci1: failed to register connection device
[  715.595691][T23377] team0: Port device team_slave_0 added
[  715.608249][T23377] team0: Port device team_slave_1 added
[  715.649177][T23683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  715.707489][ T5602] Bluetooth: hci1: command 0x0c1a tx timeout
[  715.711954][T23683] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  715.770786][ T5681] usb 1-1: USB disconnect, device number 78
[  715.813627][T23377] batman_adv: batadv0: Adding interface: batadv_slave_0
[  715.836259][T23377] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  715.923752][T23377] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  715.936596][ T5696] usb 3-1: new high-speed USB device number 51 using dummy_hcd
[  715.973267][T23377] batman_adv: batadv0: Adding interface: batadv_slave_1
[  715.984838][T23377] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  716.017605][T23377] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  716.045211][ T9942] vlan3: left allmulticast mode
[  716.050118][ T9942] geneve0: left allmulticast mode
[  716.061997][ T9942] vlan3: left promiscuous mode
[  716.079502][ T9942] geneve0: left promiscuous mode
[  716.095158][ T9942] bridge0: port 3(vlan3) entered disabled state
[  716.119198][ T5696] usb 3-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7
[  716.134033][ T9942] bridge_slave_1: left allmulticast mode
[  716.159131][ T5696] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  716.167424][ T5696] usb 3-1: Product: syz
[  716.167910][ T9942] bridge_slave_1: left promiscuous mode
[  716.178789][ T5696] usb 3-1: Manufacturer: syz
[  716.179204][ T9942] bridge0: port 2(bridge_slave_1) entered disabled state
[  716.194149][ T5696] usb 3-1: SerialNumber: syz
[  716.194774][ T9942] bridge_slave_0: left allmulticast mode
[  716.207263][ T9942] bridge_slave_0: left promiscuous mode
[  716.208617][ T5696] usb 3-1: config 0 descriptor??
[  716.219329][ T9942] bridge0: port 1(bridge_slave_0) entered disabled state
[  716.685285][ T5696] usb 3-1: f81604_write: reg: 105 data: 9 failed: -EPROTO
[  716.704634][ T5696] f81604 3-1:0.0: Setting termination of CH#0 failed: -EPROTO
[  716.719741][ T5696] f81604 3-1:0.0: probe with driver f81604 failed with error -71
[  716.744614][ T5696] usb 3-1: USB disconnect, device number 51
[  716.772850][ T9942] bond1 (unregistering): (slave geneve3): Releasing active interface
[  716.890605][ T9942] bond2 (unregistering): (slave bridge1): Releasing active interface
[  716.933968][ T9942] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  716.956086][ T9942] bond0 (unregistering): (slave 
c
@0�): Releasing backup interface
[  716.973708][ T9942] bond0 (unregistering): Released all slaves
[  716.987032][ T9942] bond1 (unregistering): Released all slaves
[  717.005015][T23810] IPv6: addrconf: prefix option has invalid lifetime
[  717.021075][ T9942] bond2 (unregistering): Released all slaves
[  717.170976][ T9942] tipc: Left network mode
[  717.398079][T23377] hsr_slave_0: entered promiscuous mode
[  717.418688][T23377] hsr_slave_1: entered promiscuous mode
[  717.434967][T23377] debugfs: 'hsr0' already exists in 'hsr'
[  717.453393][T23377] Cannot create hsr debugfs directory
[  717.631455][ T5602] Bluetooth: hci5: command 0x2016 tx timeout
[  717.951830][ T5602] Bluetooth: hci1: command 0x0c1a tx timeout
[  718.637299][   T30] audit: type=1400 audit(2000000228.021:2378): avc:  denied  { write } for  pid=23841 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  719.182217][ T1301] ieee802154 phy1 wpan1: encryption failed: -22
[  719.964539][ T5602] Bluetooth: hci5: command 0x2016 tx timeout
[  719.986845][   T30] audit: type=1400 audit(2000000229.276:2379): avc:  denied  { write } for  pid=23960 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  720.203116][ T5602] Bluetooth: hci1: command 0x0c1a tx timeout
[  720.265782][T23975] netlink: 84 bytes leftover after parsing attributes in process `syz.4.2909'.
[  720.326966][T23981] read descriptors
[  720.353626][ T5257] 8021q: adding VLAN 0 to HW filter on device eth1
[  720.809668][T22260] ffs_data_put(): freeing
[  721.166441][T24013] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check.
[  722.301367][ T9942] hsr_slave_0: left promiscuous mode
[  722.307445][ T9942] hsr_slave_1: left promiscuous mode
[  722.385618][ T9942] veth1_macvtap: left promiscuous mode
[  722.398571][ T9942] veth0_macvtap: left promiscuous mode
[  722.406083][ T9942] veth1_vlan: left promiscuous mode
[  722.413104][ T9942] veth0_vlan: left promiscuous mode
[  722.455778][ T5602] Bluetooth: hci1: command 0x0c1a tx timeout
[  722.683383][T24051] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2916'.
[  722.727336][ T5607] Bluetooth: hci6: command 0x2016 tx timeout
[  722.771168][T24055] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  722.875140][T24053] smpboot: CPU 1 is now offline
[  722.891536][   T30] audit: type=1400 audit(2000000231.954:2380): avc:  denied  { write } for  pid=24035 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  723.050946][   T30] audit: type=1400 audit(2000000232.055:2381): avc:  denied  { write } for  pid=24057 comm="syz.5.2918" name="functions" dev="configfs" ino=19418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  723.155790][T24072] trusted_key: encrypted_key: master key parameter 'defau!$' is invalid
[  723.206099][   T30] audit: type=1400 audit(2000000232.064:2382): avc:  denied  { write } for  pid=24057 comm="syz.5.2918" name="naa.1234567890abcdef" dev="configfs" ino=21714 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  723.499969][   T30] audit: type=1400 audit(2000000232.138:2383): avc:  denied  { write } for  pid=24057 comm="syz.5.2918" name="core" dev="configfs" ino=151 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  723.609570][   T60] smc: removing ib device syz2
[  723.656279][   T30] audit: type=1400 audit(2000000232.424:2384): avc:  denied  { write } for  pid=24071 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  724.766468][T24017] process 24019 (syz.4.2911) no longer affine to cpu1
[  724.799417][ T9942] team0 (unregistering): Port device team_slave_1 removed
[  724.819029][ T9942] team0 (unregistering): Port device team_slave_0 removed
[  724.969940][ T5602] Bluetooth: hci6: command 0x2016 tx timeout
[  725.129282][ T5696] syz2: Port: 1 Link DOWN
[  725.241711][   T60] smbdirect: ib_dev[syz2] removed
[  727.236739][T24143] FAULT_INJECTION: forcing a failure.
[  727.236739][T24143] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[  727.274931][   T30] audit: type=1400 audit(2000000235.997:2385): avc:  denied  { write } for  pid=24110 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  727.390672][T23377] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  727.401390][T24143] CPU: 0 UID: 0 PID: 24143 Comm: syz.2.2931 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  727.401411][T24143] Tainted: [L]=SOFTLOCKUP
[  727.401415][T24143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  727.401422][T24143] Call Trace:
[  727.401426][T24143]  <TASK>
[  727.401431][T24143]  dump_stack_lvl+0x100/0x190
[  727.401450][T24143]  should_fail_ex.cold+0x5/0xa
[  727.401462][T24143]  ? prepare_alloc_pages+0x16d/0x5f0
[  727.401481][T24143]  should_fail_alloc_page+0xeb/0x140
[  727.401498][T24143]  prepare_alloc_pages+0x1f0/0x5f0
[  727.401517][T24143]  __alloc_frozen_pages_noprof+0x1af/0x2dc0
[  727.401538][T24143]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  727.401551][T24143]  ? is_bpf_text_address+0x8a/0x1a0
[  727.401567][T24143]  ? is_bpf_text_address+0x8a/0x1a0
[  727.401594][T24143]  ? __sanitizer_cov_trace_switch+0x54/0x90
[  727.401610][T24143]  ? policy_nodemask+0xed/0x4f0
[  727.401628][T24143]  alloc_pages_mpol+0x1fb/0x540
[  727.401644][T24143]  ? __pfx_alloc_pages_mpol+0x10/0x10
[  727.401660][T24143]  ? ktime_get+0x1a4/0x320
[  727.401678][T24143]  folio_alloc_mpol_noprof+0x36/0x260
[  727.401697][T24143]  shmem_alloc_folio+0x135/0x160
[  727.401716][T24143]  shmem_alloc_and_add_folio+0x371/0xd40
[  727.401732][T24143]  ? __pfx_shmem_alloc_and_add_folio+0x10/0x10
[  727.401745][T24143]  ? shmem_allowable_huge_orders+0x2bd/0x400
[  727.401767][T24143]  shmem_get_folio_gfp+0x6ad/0x1910
[  727.401783][T24143]  ? __pfx_shmem_get_folio_gfp+0x10/0x10
[  727.401795][T24143]  ? __lock_acquire+0x49f/0x1a40
[  727.401813][T24143]  shmem_fault+0x1f9/0xa20
[  727.401825][T24143]  ? __lock_acquire+0x49f/0x1a40
[  727.401839][T24143]  ? __pfx_shmem_fault+0x10/0x10
[  727.401852][T24143]  ? clockevents_program_event+0x23e/0x820
[  727.401877][T24143]  ? __pfx_filemap_map_pages+0x10/0x10
[  727.401895][T24143]  __do_fault+0x10b/0x440
[  727.401908][T24143]  ? find_held_lock+0x2b/0x80
[  727.401920][T24143]  do_fault+0x2db/0x1750
[  727.401938][T24143]  __handle_mm_fault+0x187d/0x2a00
[  727.401951][T24143]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  727.401970][T24143]  ? __pfx___handle_mm_fault+0x10/0x10
[  727.401982][T24143]  ? pte_offset_map_lock+0x174/0x320
[  727.401997][T24143]  ? find_held_lock+0x2b/0x80
[  727.402012][T24143]  ? follow_page_pte+0x4d0/0x13f0
[  727.402031][T24143]  handle_mm_fault+0x37b/0xa30
[  727.402045][T24143]  __get_user_pages+0x1178/0x32a0
[  727.402064][T24143]  ? down_read_killable+0x35e/0x520
[  727.402084][T24143]  ? __pfx___get_user_pages+0x10/0x10
[  727.402100][T24143]  ? __pfx_gup_fast_fallback+0x10/0x10
[  727.402119][T24143]  get_user_pages_unlocked+0x1cb/0x7d0
[  727.402138][T24143]  ? __pfx_get_user_pages_unlocked+0x10/0x10
[  727.402154][T24143]  ? get_user_pages_fast_only+0xae/0xf0
[  727.402171][T24143]  ? __pfx_get_user_pages_fast_only+0x10/0x10
[  727.402187][T24143]  ? __pfx___might_resched+0x10/0x10
[  727.402202][T24143]  ? __mutex_lock+0x26d/0x1bd0
[  727.402219][T24143]  hva_to_pfn+0x871/0xd60
[  727.402234][T24143]  ? kvm_hv_setup_tsc_page+0x290/0x870
[  727.402249][T24143]  ? __pfx_hva_to_pfn+0x10/0x10
[  727.402266][T24143]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  727.402284][T24143]  ? __lock_acquire+0x49f/0x1a40
[  727.402303][T24143]  kvm_follow_pfn+0x291/0x430
[  727.402320][T24143]  __kvm_faultin_pfn+0x11c/0x1a0
[  727.402336][T24143]  ? __pfx___kvm_faultin_pfn+0x10/0x10
[  727.402358][T24143]  vmx_set_apic_access_page_addr+0x3e8/0x910
[  727.402379][T24143]  ? __pfx_vmx_set_apic_access_page_addr+0x10/0x10
[  727.402398][T24143]  ? vmx_flush_tlb_all+0x14a/0x2e0
[  727.402413][T24143]  ? record_steal_time+0x452/0xbb0
[  727.402429][T24143]  vcpu_run+0x457a/0x5de0
[  727.402453][T24143]  ? __pfx_vcpu_run+0x10/0x10
[  727.402475][T24143]  ? rcu_is_watching+0x12/0xc0
[  727.402496][T24143]  ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960
[  727.402513][T24143]  kvm_arch_vcpu_ioctl_run+0x103d/0x1960
[  727.402535][T24143]  kvm_vcpu_ioctl+0x730/0x1700
[  727.402550][T24143]  ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[  727.402563][T24143]  ? __sanitizer_cov_trace_switch+0x54/0x90
[  727.402578][T24143]  ? do_vfs_ioctl+0x226/0x13e0
[  727.402596][T24143]  ? __pfx_do_vfs_ioctl+0x10/0x10
[  727.402614][T24143]  ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10
[  727.402639][T24143]  ? __fget_files+0x215/0x3d0
[  727.402650][T24143]  ? hook_file_ioctl_common+0x140/0x440
[  727.402668][T24143]  ? selinux_file_ioctl+0x13b/0x290
[  727.402685][T24143]  ? selinux_file_ioctl+0xb6/0x290
[  727.402704][T24143]  ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[  727.402718][T24143]  __x64_sys_ioctl+0x18e/0x210
[  727.402736][T24143]  do_syscall_64+0x115/0x870
[  727.402750][T24143]  ? clear_bhb_loop+0x70/0xc0
[  727.402769][T24143]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  727.402781][T24143] RIP: 0033:0x7f42c599e0d9
[  727.402791][T24143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  727.402802][T24143] RSP: 002b:00007f42c6865028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  727.402813][T24143] RAX: ffffffffffffffda RBX: 00007f42c5c26090 RCX: 00007f42c599e0d9
[  727.402821][T24143] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
[  727.402827][T24143] RBP: 00007f42c6865090 R08: 0000000000000000 R09: 0000000000000000
[  727.402834][T24143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  727.402840][T24143] R13: 00007f42c5c26128 R14: 00007f42c5c26090 R15: 00007fff13d53d08
[  727.402855][T24143]  </TASK>
[  728.887680][ T5602] Bluetooth: hci6: command 0x2016 tx timeout
[  729.685553][T23377] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  730.444960][T24166] device-mapper: ioctl: Unable to rename non-existent device,  to j
[  730.491564][T23377] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  730.570488][ T9942] IPVS: stop unused estimator thread 0...
[  730.614978][T23377] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  730.664207][T23377] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  730.773530][T23377] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  730.831288][T23377] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  730.850527][   T30] audit: type=1400 audit(2000000239.302:2386): avc:  denied  { write } for  pid=24175 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  730.911111][T23377] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  731.034613][T22125] usb 1-1: new high-speed USB device number 79 using dummy_hcd
[  731.121297][ T5607] Bluetooth: hci6: command 0x2016 tx timeout
[  731.229682][T22125] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[  732.093666][T22125] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  732.165890][T22125] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  732.203106][T23377] 8021q: adding VLAN 0 to HW filter on device bond0
[  732.226646][T22125] usb 1-1: config 0 descriptor??
[  732.307329][T23377] 8021q: adding VLAN 0 to HW filter on device team0
[  732.378256][   T60] bridge0: port 1(bridge_slave_0) entered blocking state
[  732.385392][   T60] bridge0: port 1(bridge_slave_0) entered forwarding state
[  732.475406][   T60] bridge0: port 2(bridge_slave_1) entered blocking state
[  732.482559][   T60] bridge0: port 2(bridge_slave_1) entered forwarding state
[  732.505910][T22125] usbhid 1-1:0.0: can't add hid device: -71
[  732.531605][T22125] usbhid 1-1:0.0: probe with driver usbhid failed with error -71
[  732.587592][T22125] usb 1-1: USB disconnect, device number 79
[  733.525945][ T4912] Bluetooth: hci5: command 0x2016 tx timeout
[  733.532177][   T30] audit: type=1400 audit(2000000241.767:2387): avc:  denied  { write } for  pid=24202 comm="syz.5.2943" name="720p" dev="configfs" ino=19449 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  733.925167][T22125] usb 1-1: new full-speed USB device number 80 using dummy_hcd
[  735.708079][T23377] 8021q: adding VLAN 0 to HW filter on device batadv0
[  735.715328][ T5607] Bluetooth: hci5: command 0x2016 tx timeout
[  735.882389][T23377] veth0_vlan: entered promiscuous mode
[  735.940307][T23377] veth1_vlan: entered promiscuous mode
[  736.060266][ T4912] Bluetooth: hci1: command 0x0c1a tx timeout
[  736.873648][   T30] audit: type=1400 audit(2000000244.694:2388): avc:  denied  { connect } for  pid=24264 comm="syz.0.2949" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1
[  736.926003][T23377] veth0_macvtap: entered promiscuous mode
[  736.967362][T23377] veth1_macvtap: entered promiscuous mode
[  737.043831][T23377] batman_adv: batadv0: Interface activated: batadv_slave_0
[  737.170116][T23377] batman_adv: batadv0: Interface activated: batadv_slave_1
[  738.239978][ T9932] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  738.271013][ T4912] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201'
[  738.280582][ T4912] CPU: 0 UID: 0 PID: 4912 Comm: kworker/u9:1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  738.280603][ T4912] Tainted: [L]=SOFTLOCKUP
[  738.280608][ T4912] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  738.280617][ T4912] Workqueue: hci1 hci_rx_work
[  738.280636][ T4912] Call Trace:
[  738.280640][ T4912]  <TASK>
[  738.280646][ T4912]  dump_stack_lvl+0x100/0x190
[  738.280666][ T4912]  sysfs_warn_dup.cold+0x1c/0x28
[  738.280685][ T4912]  sysfs_create_dir_ns+0x24b/0x2b0
[  738.280698][ T4912]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  738.280710][ T4912]  ? find_held_lock+0x2b/0x80
[  738.280722][ T4912]  ? kobject_add_internal+0x25f/0x930
[  738.280734][ T4912]  ? kobject_add_internal+0x25f/0x930
[  738.280746][ T4912]  ? do_raw_spin_unlock+0x145/0x1e0
[  738.280765][ T4912]  kobject_add_internal+0x2c8/0x930
[  738.280780][ T4912]  kobject_add+0x16a/0x1e0
[  738.280792][ T4912]  ? __pfx_kobject_add+0x10/0x10
[  738.280804][ T4912]  ? class_to_subsys+0x10f/0x150
[  738.280825][ T4912]  ? kobject_put+0xb9/0x640
[  738.280842][ T4912]  ? _raw_spin_unlock+0x28/0x50
[  738.280858][ T4912]  device_add+0x294/0x1970
[  738.280874][ T4912]  ? __pfx_dev_set_name+0x10/0x10
[  738.280886][ T4912]  ? __pfx_device_add+0x10/0x10
[  738.280902][ T4912]  ? mgmt_send_event_skb+0x2fb/0x460
[  738.280924][ T4912]  hci_conn_add_sysfs+0x1a3/0x260
[  738.280943][ T4912]  le_conn_complete_evt+0x11eb/0x1f60
[  738.280962][ T4912]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  738.280975][ T4912]  ? hci_event_packet+0x186/0xcd0
[  738.280992][ T4912]  hci_le_conn_complete_evt+0x23c/0x3a0
[  738.281007][ T4912]  ? skb_pull_data+0x15f/0x1e0
[  738.281026][ T4912]  hci_le_meta_evt+0x34a/0x5f0
[  738.281041][ T4912]  ? __pfx_hci_le_conn_complete_evt+0x10/0x10
[  738.281058][ T4912]  hci_event_packet+0x51c/0xcd0
[  738.281072][ T4912]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  738.281087][ T4912]  ? __pfx_hci_event_packet+0x10/0x10
[  738.281103][ T4912]  ? kcov_remote_start+0x384/0x670
[  738.281117][ T4912]  ? lockdep_hardirqs_on+0x78/0x100
[  738.281135][ T4912]  hci_rx_work+0x451/0xfc0
[  738.281151][ T4912]  process_one_work+0xa23/0x1940
[  738.281171][ T4912]  ? __pfx_process_one_work+0x10/0x10
[  738.281194][ T4912]  ? __pfx_hci_rx_work+0x10/0x10
[  738.281209][ T4912]  worker_thread+0x5ef/0xe50
[  738.281227][ T4912]  ? kthread+0x13a/0x450
[  738.281238][ T4912]  ? __pfx_worker_thread+0x10/0x10
[  738.281250][ T4912]  kthread+0x370/0x450
[  738.281262][ T4912]  ? __pfx_kthread+0x10/0x10
[  738.281275][ T4912]  ret_from_fork+0x72b/0xd50
[  738.281294][ T4912]  ? __pfx_ret_from_fork+0x10/0x10
[  738.281311][ T4912]  ? __switch_to+0x800/0x10f0
[  738.281323][ T4912]  ? __pfx_kthread+0x10/0x10
[  738.281336][ T4912]  ret_from_fork_asm+0x1a/0x30
[  738.281360][ T4912]  </TASK>
[  739.144801][ T4912] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  739.159755][ T4912] Bluetooth: hci1: failed to register connection device
[  739.189275][ T4912] Bluetooth: hci1: command 0x0c1a tx timeout
[  739.198241][ T9932] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  739.303023][   T60] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  739.483080][ T5688] usb 3-1: new full-speed USB device number 52 using dummy_hcd
[  740.305040][T24292] 9p: Bad value for 'rfdno'
[  740.395480][T24296] FAT-fs (nbd0): unable to read boot sector
[  740.431484][T24296] netlink: 100 bytes leftover after parsing attributes in process `syz.0.2955'.
[  740.471437][T23799] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  740.514642][ T5688] usb 3-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22
[  740.546178][T23799] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  740.573732][ T5688] usb 3-1: config index 0 descriptor too short (expected 40210, got 18)
[  740.588132][T23797] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  740.604812][ T5688] usb 3-1: config 92 has too many interfaces: 81, using maximum allowed: 32
[  740.645984][ T5688] usb 3-1: config 92 has an invalid descriptor of length 82, skipping remainder of the config
[  740.673202][T23799] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  740.701146][ T5688] usb 3-1: config 92 has 0 interfaces, different from the descriptor's value: 81
[  740.713931][T23799] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  740.735055][T24312] batman_adv: batadv0: Adding interface: veth0
[  740.748290][ T5688] usb 3-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3
[  740.768952][T24312] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  740.801811][ T5688] usb 3-1: Product: syz
[  740.813442][ T5688] usb 3-1: Manufacturer: syz
[  740.824022][ T5688] usb 3-1: SerialNumber: syz
[  740.841100][T24312] batman_adv: batadv0: Interface activated: veth0
[  740.858949][T24318] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  740.887563][T24318] batman_adv: batadv0: Removing interface: batadv_slave_0
[  741.118215][T24320] netlink: 'syz.2.2953': attribute type 1 has an invalid length.
[  741.433051][ T4912] Bluetooth: hci1: command 0x0c1a tx timeout
[  742.082541][T24318] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  742.119167][T24318] batman_adv: batadv0: Removing interface: batadv_slave_1
[  742.173674][T24318] batman_adv: batadv0: Interface deactivated: veth0
[  742.193114][T24318] batman_adv: batadv0: Removing interface: veth0
[  742.276062][T24320] 8021q: adding VLAN 0 to HW filter on device bond1
[  742.291200][T24321] bond1: (slave geneve2): making interface the new active one
[  742.302008][T24321] bond1: (slave geneve2): Enslaving as an active interface with an up link
[  743.062879][T24383] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2963'.
[  743.109322][T24383] read descriptors
[  743.201800][T24391] XFS (mtdblock0): Invalid superblock magic number
[  743.226549][T23377] ffs_data_put(): freeing
[  743.685891][ T5602] Bluetooth: hci1: command 0x0c1a tx timeout
[  744.624539][ T5688] usb 3-1: USB disconnect, device number 52
[  744.691556][T24413] FAT-fs (nbd2): unable to read boot sector
[  744.722168][T24413] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2966'.
[  744.776130][T22125] usb 2-1: new high-speed USB device number 24 using dummy_hcd
[  745.972710][T22125] usb 2-1: Using ep0 maxpacket: 8
[  745.995300][T22125] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a
[  748.850952][T22125] usb 2-1: unable to read config index 0 descriptor/start: -71
[  749.289540][T22125] usb 2-1: can't read configurations, error -71
[  749.565214][T24449] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2972'.
[  749.587923][ T5602] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201'
[  749.597790][ T5602] CPU: 0 UID: 0 PID: 5602 Comm: kworker/u9:3 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  749.597816][ T5602] Tainted: [L]=SOFTLOCKUP
[  749.597822][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  749.597831][ T5602] Workqueue: hci3 hci_rx_work
[  749.597851][ T5602] Call Trace:
[  749.597857][ T5602]  <TASK>
[  749.597862][ T5602]  dump_stack_lvl+0x100/0x190
[  749.597881][ T5602]  sysfs_warn_dup.cold+0x1c/0x28
[  749.597900][ T5602]  sysfs_create_dir_ns+0x24b/0x2b0
[  749.597915][ T5602]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  749.597929][ T5602]  ? find_held_lock+0x2b/0x80
[  749.597940][ T5602]  ? kobject_add_internal+0x25f/0x930
[  749.597953][ T5602]  ? kobject_add_internal+0x25f/0x930
[  749.597969][ T5602]  ? do_raw_spin_unlock+0x145/0x1e0
[  749.597989][ T5602]  kobject_add_internal+0x2c8/0x930
[  749.598004][ T5602]  kobject_add+0x16a/0x1e0
[  749.598016][ T5602]  ? __pfx_kobject_add+0x10/0x10
[  749.598027][ T5602]  ? class_to_subsys+0x10f/0x150
[  749.598051][ T5602]  ? kobject_put+0xb9/0x640
[  749.598069][ T5602]  ? _raw_spin_unlock+0x28/0x50
[  749.598085][ T5602]  device_add+0x294/0x1970
[  749.598102][ T5602]  ? __pfx_dev_set_name+0x10/0x10
[  749.598114][ T5602]  ? __pfx_device_add+0x10/0x10
[  749.598131][ T5602]  ? mgmt_send_event_skb+0x2fb/0x460
[  749.598153][ T5602]  hci_conn_add_sysfs+0x1a3/0x260
[  749.598176][ T5602]  le_conn_complete_evt+0x11eb/0x1f60
[  749.598194][ T5602]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  749.598208][ T5602]  ? hci_event_packet+0x186/0xcd0
[  749.598225][ T5602]  hci_le_conn_complete_evt+0x23c/0x3a0
[  749.598240][ T5602]  ? skb_pull_data+0x15f/0x1e0
[  749.598272][ T5602]  hci_le_meta_evt+0x34a/0x5f0
[  749.598290][ T5602]  ? __pfx_hci_le_conn_complete_evt+0x10/0x10
[  749.598307][ T5602]  hci_event_packet+0x51c/0xcd0
[  749.598323][ T5602]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  749.598341][ T5602]  ? __pfx_hci_event_packet+0x10/0x10
[  749.598359][ T5602]  ? kcov_remote_start+0x384/0x670
[  749.598375][ T5602]  ? lockdep_hardirqs_on+0x78/0x100
[  749.598394][ T5602]  hci_rx_work+0x451/0xfc0
[  749.598411][ T5602]  process_one_work+0xa23/0x1940
[  749.598430][ T5602]  ? __pfx_process_one_work+0x10/0x10
[  749.598447][ T5602]  ? __pfx_hci_rx_work+0x10/0x10
[  749.598462][ T5602]  worker_thread+0x5ef/0xe50
[  749.598480][ T5602]  ? kthread+0x13a/0x450
[  749.598490][ T5602]  ? __pfx_worker_thread+0x10/0x10
[  749.598502][ T5602]  kthread+0x370/0x450
[  749.598513][ T5602]  ? __pfx_kthread+0x10/0x10
[  749.598526][ T5602]  ret_from_fork+0x72b/0xd50
[  749.598546][ T5602]  ? __pfx_ret_from_fork+0x10/0x10
[  749.598562][ T5602]  ? rcu_is_watching+0x12/0xc0
[  749.598580][ T5602]  ? __switch_to+0x800/0x10f0
[  749.598592][ T5602]  ? __pfx_kthread+0x10/0x10
[  749.598604][ T5602]  ret_from_fork_asm+0x1a/0x30
[  749.598629][ T5602]  </TASK>
[  749.598668][ T5602] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  749.923607][ T5602] Bluetooth: hci3: failed to register connection device
[  750.009542][T24449] netlink: 'syz.2.2972': attribute type 5 has an invalid length.
[  750.969291][T24442] read descriptors
[  751.014920][T24449] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2972'.
[  751.181243][T24449] geneve3: entered promiscuous mode
[  751.196331][T24469] comedi comedi3: comedi_config --init_data is deprecated
[  751.210589][T24449] geneve3: entered allmulticast mode
[  751.265368][T24472] netlink: 'syz.0.2978': attribute type 12 has an invalid length.
[  751.279214][T24472] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2978'.
[  751.334728][T23108] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0
[  751.392615][T23108] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0
[  751.450499][T21112] ffs_data_put(): freeing
[  751.479400][   T30] audit: type=1400 audit(2000000258.348:2389): avc:  denied  { accept } for  pid=24487 comm="syz.0.2980" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1
[  751.530285][ T9933] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0
[  751.594516][ T9933] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0
[  751.673923][T24499] XFS (mtdblock0): Invalid superblock magic number
[  752.180225][ T4912] Bluetooth: hci3: command 0x2016 tx timeout
[  753.990255][T24522] batman_adv: batadv0: Adding interface: veth0
[  754.431096][ T5602] Bluetooth: hci3: command 0x2016 tx timeout
[  754.861638][T24522] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  755.062523][T24531] FAT-fs (nbd2): unable to read boot sector
[  755.113667][T24531] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2988'.
[  755.185204][T24522] batman_adv: batadv0: Interface activated: veth0
[  755.225827][T24525] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  755.267035][T24525] batman_adv: batadv0: Removing interface: batadv_slave_0
[  756.358373][T24543] read descriptors
[  756.450029][T24525] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  756.488866][T24525] batman_adv: batadv0: Removing interface: batadv_slave_1
[  756.529035][T24525] batman_adv: batadv0: Interface deactivated: veth0
[  756.559237][T24525] batman_adv: batadv0: Removing interface: veth0
[  756.665431][ T5598] ffs_data_put(): freeing
[  757.731374][   T30] audit: type=1400 audit(2000000264.118:2390): avc:  denied  { write } for  pid=24562 comm="syz.1.2998" name="720p" dev="configfs" ino=19449 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  757.785384][T24566] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5 sclass=netlink_route_socket pid=24566 comm=syz.0.2997
[  757.806483][T24571] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1040 sclass=netlink_route_socket pid=24571 comm=syz.5.2996
[  757.835894][   T30] audit: type=1400 audit(2000000264.118:2391): avc:  denied  { write } for  pid=24562 comm="syz.1.2998" name="wWidth" dev="configfs" ino=63966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1
[  758.927690][   T30] audit: type=1400 audit(2000000264.118:2392): avc:  denied  { open } for  pid=24562 comm="syz.1.2998" path="/7/config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/wWidth" dev="configfs" ino=63966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1
[  759.020610][T24574] nvme_tcp: malformed address passed: 127trsvcid=8009:8009
[  759.348857][T22119] usb 6-1: new high-speed USB device number 55 using dummy_hcd
[  760.317536][T24598] FAT-fs (nbd1): unable to read boot sector
[  760.356411][T24598] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3003'.
[  760.412681][T22119] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a
[  760.473816][T22119] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  760.528009][T22119] usb 6-1: Product: syz
[  760.561637][T22119] usb 6-1: Manufacturer: syz
[  760.587271][T24608] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3007'.
[  760.611334][T22119] usb 6-1: SerialNumber: syz
[  760.649408][T22119] usb 6-1: config 0 descriptor??
[  760.804776][T24618] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3008'.
[  760.895642][T24613] read descriptors
[  760.912724][T24618] netlink: 'syz.1.3008': attribute type 5 has an invalid length.
[  760.987290][T24618] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3008'.
[  761.119395][T24618] geneve2: entered promiscuous mode
[  761.159524][T24618] geneve2: entered allmulticast mode
[  761.211987][ T9932] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0
[  761.320317][T23108] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0
[  762.379843][T23108] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0
[  762.464187][T23791] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0
[  762.476602][T23377] ffs_data_put(): freeing
[  762.497335][T22119] usb 6-1: Firmware version (0.0) predates our first public release.
[  762.556317][T22119] usb 6-1: Please update to version 0.2 or newer
[  762.624666][T22119] usb 6-1: Firmware: build �
[  763.272690][ T5793] usb 5-1: new high-speed USB device number 50 using dummy_hcd
[  763.328569][T24646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  763.409837][T24646] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  763.476164][T24301] usb 3-1: new high-speed USB device number 53 using dummy_hcd
[  763.498075][ T5793] usb 5-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00
[  763.523826][ T5793] usb 5-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid maxpacket 9865, setting to 1024
[  763.558570][ T5793] usb 5-1: config 0 interface 0 has no altsetting 0
[  763.570130][T22119] usb 6-1: USB disconnect, device number 55
[  763.596161][ T5793] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  763.643863][ T5793] usb 5-1: config 0 descriptor??
[  763.667826][T24648] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  763.680048][T24301] usb 3-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00
[  763.715633][T24301] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024
[  763.752850][T24301] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  763.801583][T24301] usb 3-1: config 0 descriptor??
[  763.824030][T24660] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22
[  764.164477][T24648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  764.195315][T24648] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  764.252837][T24648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  764.299977][T24301] uclogic 0003:5543:0064.0013: unknown main item tag 0x0
[  764.312308][T24648] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  764.340730][T24301] uclogic 0003:5543:0064.0013: unknown main item tag 0x0
[  764.350755][T24648] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3014'.
[  764.379349][T24301] uclogic 0003:5543:0064.0013: unknown main item tag 0x0
[  764.412310][ T5793] usbhid 5-1:0.0: can't add hid device: -71
[  764.431194][T24301] uclogic 0003:5543:0064.0013: unknown main item tag 0x0
[  764.439916][ T5793] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[  764.459352][T24301] uclogic 0003:5543:0064.0013: unknown main item tag 0x0
[  764.481633][ T5793] usb 5-1: USB disconnect, device number 50
[  764.509383][T24301] uclogic 0003:5543:0064.0013: unknown main item tag 0x0
[  764.543822][T24301] uclogic 0003:5543:0064.0013: unknown main item tag 0x0
[  764.575327][T24301] uclogic 0003:5543:0064.0013: unknown main item tag 0x0
[  764.597266][T24301] uclogic 0003:5543:0064.0013: unknown main item tag 0x0
[  764.627199][T24301] uclogic 0003:5543:0064.0013: unknown main item tag 0x0
[  764.666393][T24301] uclogic 0003:5543:0064.0013: hidraw0: USB HID v7b.fd Device [HID 5543:0064] on usb-dummy_hcd.2-1/input0
[  764.729787][T24301] usb 3-1: USB disconnect, device number 53
[  764.804711][T24735] fido_id[24735]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory
[  765.047027][ T5793] usb 6-1: new high-speed USB device number 56 using dummy_hcd
[  765.245495][ T5793] usb 6-1: Using ep0 maxpacket: 32
[  765.271910][ T5793] usb 6-1: New USB device found, idVendor=07ca, idProduct=a805, bcdDevice=2d.9e
[  765.307276][T24779] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5 sclass=netlink_route_socket pid=24779 comm=syz.2.3022
[  765.327770][T24784] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3023'.
[  765.340603][ T5793] usb 6-1: config 16 interface 0 has no altsetting 0
[  765.358099][ T5793] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  765.386352][ T5793] usb 6-1: Product: syz
[  765.395624][T24786] read descriptors
[  765.400949][ T5793] usb 6-1: Manufacturer: syz
[  765.422859][ T5793] usb 6-1: SerialNumber: syz
[  765.437515][T24784] netlink: 'syz.4.3023': attribute type 5 has an invalid length.
[  765.531985][T24784] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3023'.
[  765.554303][T24779] nvme_tcp: malformed address passed: 127trsvcid=8009:8009
[  765.632891][T24784] geneve2: entered promiscuous mode
[  765.638336][T24784] geneve2: entered allmulticast mode
[  765.675100][ T9933] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0
[  765.692923][T22260] ffs_data_put(): freeing
[  765.704653][T24734] syzkaller0: entered promiscuous mode
[  765.736532][T24734] syzkaller0: entered allmulticast mode
[  765.761719][T23799] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0
[  765.772687][ T5688] usb 1-1: new high-speed USB device number 81 using dummy_hcd
[  765.798461][T23799] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0
[  765.808128][ T5793] usb 6-1: dvb_usb_v2: usb_bulk_msg() failed=-22
[  765.824884][T24810] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.
[  765.854341][ T5793] dvb_usb_af9015 6-1:16.0: probe with driver dvb_usb_af9015 failed with error -22
[  765.876016][ T5793] usb 6-1: USB disconnect, device number 56
[  765.902701][ T9933] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0
[  765.978123][ T5688] usb 1-1: Using ep0 maxpacket: 8
[  765.989404][ T5688] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a
[  766.017977][ T5688] usb 1-1: config 0 has an invalid interface number: 55 but max is 0
[  766.031088][ T5688] usb 1-1: config 0 has no interface number 0
[  766.040630][ T5688] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[  766.056148][ T5688] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B
[  766.080271][ T5688] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[  766.102825][ T5688] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[  766.132293][ T5688] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  766.144627][   T30] audit: type=1400 audit(2000000271.882:2393): avc:  denied  { watch_mount } for  pid=24826 comm="syz.4.3028" path="/39" dev="tmpfs" ino=227 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[  766.172752][ T5688] usb 1-1: config 0 descriptor??
[  766.192396][ T5688] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0
[  767.080499][T24839] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3029'.
[  767.283098][ T5688] usb 1-1: USB disconnect, device number 81
[  767.289129][    C0] ldusb 1-1:0.55: usb_submit_urb failed (-19)
[  767.459103][T24856] XFS (mtdblock0): Invalid superblock magic number
[  767.688445][T24867] netlink: 'syz.1.3034': attribute type 4 has an invalid length.
[  768.518727][ T5688] ldusb 1-1:0.55: LD USB Device #0 now disconnected
[  768.525516][T24792] ldusb: No device or device unplugged -19
[  768.547620][   T30] audit: type=1400 audit(2000000274.088:2394): avc:  denied  { name_bind } for  pid=24855 comm="syz.5.3033" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1
[  768.920607][T24876] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3036'.
[  768.987386][T24883] read descriptors
[  769.027461][T24876] netlink: 'syz.0.3036': attribute type 5 has an invalid length.
[  769.071598][T24876] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3036'.
[  769.088617][ T5688] usb 5-1: new high-speed USB device number 51 using dummy_hcd
[  769.192305][ T5598] ffs_data_put(): freeing
[  769.295175][ T5688] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[  769.340649][ T5688] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  769.393338][ T5688] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  769.442783][ T5688] usb 5-1: config 0 descriptor??
[  769.565527][   T30] audit: type=1400 audit(2000000275.048:2395): avc:  denied  { write } for  pid=24905 comm="syz.1.3042" name="usbmon6" dev="devtmpfs" ino=733 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1
[  769.668141][   T30] audit: type=1400 audit(2000000275.085:2396): avc:  denied  { ioctl } for  pid=24905 comm="syz.1.3042" path="/dev/usbmon6" dev="devtmpfs" ino=733 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1
[  769.721550][ T5688] usbhid 5-1:0.0: can't add hid device: -71
[  769.756342][ T5688] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[  769.829259][ T5688] usb 5-1: USB disconnect, device number 51
[  769.869768][   T30] audit: type=1400 audit(2000000275.095:2397): avc:  denied  { write } for  pid=24905 comm="syz.1.3042" name="functions" dev="configfs" ino=19418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  770.070228][   T30] audit: type=1400 audit(2000000275.252:2398): avc:  denied  { mounton } for  pid=24905 comm="syz.1.3042" path="/18/config" dev="configfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  770.120333][T24932] vcan0: tx address claim with dlc 0
[  770.321475][ T5688] usb 5-1: new full-speed USB device number 52 using dummy_hcd
[  771.244145][ T5602] Bluetooth: hci5: command 0x2016 tx timeout
[  771.265047][   T30] audit: type=1400 audit(2000000275.252:2399): avc:  denied  { mount } for  pid=24905 comm="syz.1.3042" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1
[  771.473064][ T5688] usb 5-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice= 0.40
[  771.495282][   T30] audit: type=1400 audit(2000000275.409:2400): avc:  denied  { getopt } for  pid=24917 comm="syz.5.3043" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1
[  772.280556][ T5607] Bluetooth: hci6: command 0x2016 tx timeout
[  772.336570][ T5688] usb 5-1: unable to read config index 0 descriptor/start: -71
[  772.383788][ T5688] usb 5-1: can't read configurations, error -71
[  772.491792][   T30] audit: type=1400 audit(2000000275.464:2401): avc:  denied  { unmount } for  pid=23377 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1
[  772.645916][   T30] audit: type=1400 audit(2000000275.593:2402): avc:  denied  { remount } for  pid=24934 comm="syz.2.3045" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1
[  772.766130][   T30] audit: type=1400 audit(2000000277.541:2403): avc:  denied  { write } for  pid=24940 comm="syz.1.3046" name="720p" dev="configfs" ino=19449 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  772.802915][T24962] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3050'.
[  772.898961][   T30] audit: type=1800 audit(2000000277.855:2404): pid=24913 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.3040" name="bus" dev="ramfs" ino=65191 res=0 errno=0
[  773.495416][ T4912] Bluetooth: hci5: command 0x2016 tx timeout
[  773.520252][T24962] netlink: 'syz.1.3050': attribute type 5 has an invalid length.
[  773.954927][T24962] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3050'.
[  773.984526][T24958] binder: 24957:24958 ioctl c00c6211 0 returned -14
[  774.213866][T23377] ffs_data_put(): freeing
[  774.344424][T24952] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3049'.
[  774.458195][ T5602] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201'
[  774.468180][ T5602] CPU: 0 UID: 0 PID: 5602 Comm: kworker/u9:3 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  774.468207][ T5602] Tainted: [L]=SOFTLOCKUP
[  774.468212][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  774.468221][ T5602] Workqueue: hci3 hci_rx_work
[  774.468241][ T5602] Call Trace:
[  774.468245][ T5602]  <TASK>
[  774.468250][ T5602]  dump_stack_lvl+0x100/0x190
[  774.468268][ T5602]  sysfs_warn_dup.cold+0x1c/0x28
[  774.468286][ T5602]  sysfs_create_dir_ns+0x24b/0x2b0
[  774.468300][ T5602]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  774.468312][ T5602]  ? find_held_lock+0x2b/0x80
[  774.468324][ T5602]  ? kobject_add_internal+0x25f/0x930
[  774.468336][ T5602]  ? kobject_add_internal+0x25f/0x930
[  774.468350][ T5602]  ? do_raw_spin_unlock+0x145/0x1e0
[  774.468369][ T5602]  kobject_add_internal+0x2c8/0x930
[  774.468383][ T5602]  kobject_add+0x16a/0x1e0
[  774.468394][ T5602]  ? __pfx_kobject_add+0x10/0x10
[  774.468405][ T5602]  ? class_to_subsys+0x10f/0x150
[  774.468426][ T5602]  ? kobject_put+0xb9/0x640
[  774.468443][ T5602]  ? _raw_spin_unlock+0x28/0x50
[  774.468460][ T5602]  device_add+0x294/0x1970
[  774.468479][ T5602]  ? __pfx_dev_set_name+0x10/0x10
[  774.468493][ T5602]  ? __pfx_device_add+0x10/0x10
[  774.468510][ T5602]  ? mgmt_send_event_skb+0x2fb/0x460
[  774.468530][ T5602]  hci_conn_add_sysfs+0x1a3/0x260
[  774.468548][ T5602]  le_conn_complete_evt+0x11eb/0x1f60
[  774.468566][ T5602]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  774.468585][ T5602]  ? hci_event_packet+0x186/0xcd0
[  774.468602][ T5602]  hci_le_conn_complete_evt+0x23c/0x3a0
[  774.468617][ T5602]  ? skb_pull_data+0x15f/0x1e0
[  774.468639][ T5602]  hci_le_meta_evt+0x34a/0x5f0
[  774.468655][ T5602]  ? __pfx_hci_le_conn_complete_evt+0x10/0x10
[  774.468675][ T5602]  hci_event_packet+0x51c/0xcd0
[  774.468696][ T5602]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  774.468715][ T5602]  ? __pfx_hci_event_packet+0x10/0x10
[  774.468731][ T5602]  ? kcov_remote_start+0x384/0x670
[  774.468751][ T5602]  ? lockdep_hardirqs_on+0x78/0x100
[  774.468775][ T5602]  hci_rx_work+0x451/0xfc0
[  774.468792][ T5602]  process_one_work+0xa23/0x1940
[  774.468812][ T5602]  ? __pfx_process_one_work+0x10/0x10
[  774.468829][ T5602]  ? __pfx_hci_rx_work+0x10/0x10
[  774.468844][ T5602]  worker_thread+0x5ef/0xe50
[  774.468863][ T5602]  ? kthread+0x13a/0x450
[  774.468874][ T5602]  ? __pfx_worker_thread+0x10/0x10
[  774.468885][ T5602]  kthread+0x370/0x450
[  774.468897][ T5602]  ? __pfx_kthread+0x10/0x10
[  774.468910][ T5602]  ret_from_fork+0x72b/0xd50
[  774.468928][ T5602]  ? __pfx_ret_from_fork+0x10/0x10
[  774.468945][ T5602]  ? rcu_is_watching+0x12/0xc0
[  774.468962][ T5602]  ? __switch_to+0x800/0x10f0
[  774.468975][ T5602]  ? __pfx_kthread+0x10/0x10
[  774.468998][ T5602]  ret_from_fork_asm+0x1a/0x30
[  774.469028][ T5602]  </TASK>
[  774.469082][ T5602] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  774.760242][ T4912] Bluetooth: hci6: command 0x2016 tx timeout
[  774.790146][ T5602] Bluetooth: hci3: failed to register connection device
[  774.895132][T24998] kAFS: No cell specified
[  775.017250][T24994] netlink: 'syz.0.3057': attribute type 4 has an invalid length.
[  775.325879][T24301] usb 6-1: new high-speed USB device number 57 using dummy_hcd
[  775.978026][T25012] jffs2: notice: (25012) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 4 of xref (0 dead, 1 orphan) found.
[  776.042475][   T30] audit: type=1400 audit(2000000281.003:2405): avc:  denied  { write } for  pid=25011 comm="syz.2.3061" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[  776.171995][T24301] usb 6-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00
[  776.202036][   T30] audit: type=1400 audit(2000000281.160:2406): avc:  denied  { write } for  pid=25011 comm="syz.2.3061" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[  776.241765][T24301] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024
[  776.410012][T24301] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  777.200027][ T5607] Bluetooth: hci3: command 0x2016 tx timeout
[  777.225082][   T30] audit: type=1400 audit(2000000282.083:2407): avc:  denied  { write } for  pid=25019 comm="syz.1.3063" name="720p" dev="configfs" ino=19449 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  777.268009][T24301] usb 6-1: config 0 descriptor??
[  777.299181][T25000] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22
[  777.863406][ T5602] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201'
[  777.873302][ T5602] CPU: 0 UID: 0 PID: 5602 Comm: kworker/u9:3 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  777.873324][ T5602] Tainted: [L]=SOFTLOCKUP
[  777.873329][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  777.873337][ T5602] Workqueue: hci3 hci_rx_work
[  777.873357][ T5602] Call Trace:
[  777.873361][ T5602]  <TASK>
[  777.873366][ T5602]  dump_stack_lvl+0x100/0x190
[  777.873386][ T5602]  sysfs_warn_dup.cold+0x1c/0x28
[  777.873404][ T5602]  sysfs_create_dir_ns+0x24b/0x2b0
[  777.873420][ T5602]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  777.873433][ T5602]  ? find_held_lock+0x2b/0x80
[  777.873445][ T5602]  ? kobject_add_internal+0x25f/0x930
[  777.873457][ T5602]  ? kobject_add_internal+0x25f/0x930
[  777.873470][ T5602]  ? do_raw_spin_unlock+0x145/0x1e0
[  777.873487][ T5602]  kobject_add_internal+0x2c8/0x930
[  777.873502][ T5602]  kobject_add+0x16a/0x1e0
[  777.873514][ T5602]  ? __pfx_kobject_add+0x10/0x10
[  777.873525][ T5602]  ? class_to_subsys+0x10f/0x150
[  777.873546][ T5602]  ? kobject_put+0xb9/0x640
[  777.873562][ T5602]  ? _raw_spin_unlock+0x28/0x50
[  777.873580][ T5602]  device_add+0x294/0x1970
[  777.873598][ T5602]  ? __pfx_dev_set_name+0x10/0x10
[  777.873609][ T5602]  ? __pfx_device_add+0x10/0x10
[  777.873626][ T5602]  ? mgmt_send_event_skb+0x2fb/0x460
[  777.873645][ T5602]  hci_conn_add_sysfs+0x1a3/0x260
[  777.873662][ T5602]  le_conn_complete_evt+0x11eb/0x1f60
[  777.873680][ T5602]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  777.873694][ T5602]  ? hci_event_packet+0x186/0xcd0
[  777.873711][ T5602]  hci_le_conn_complete_evt+0x23c/0x3a0
[  777.873726][ T5602]  ? skb_pull_data+0x15f/0x1e0
[  777.873746][ T5602]  hci_le_meta_evt+0x34a/0x5f0
[  777.873762][ T5602]  ? __pfx_hci_le_conn_complete_evt+0x10/0x10
[  777.873778][ T5602]  hci_event_packet+0x51c/0xcd0
[  777.873793][ T5602]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  777.873808][ T5602]  ? __pfx_hci_event_packet+0x10/0x10
[  777.873824][ T5602]  ? kcov_remote_start+0x384/0x670
[  777.873839][ T5602]  ? lockdep_hardirqs_on+0x78/0x100
[  777.873857][ T5602]  hci_rx_work+0x451/0xfc0
[  777.873874][ T5602]  process_one_work+0xa23/0x1940
[  777.873893][ T5602]  ? __pfx_process_one_work+0x10/0x10
[  777.873910][ T5602]  ? __pfx_hci_rx_work+0x10/0x10
[  777.873925][ T5602]  worker_thread+0x5ef/0xe50
[  777.873944][ T5602]  ? kthread+0x13a/0x450
[  777.873955][ T5602]  ? __pfx_worker_thread+0x10/0x10
[  777.873967][ T5602]  kthread+0x370/0x450
[  777.873978][ T5602]  ? __pfx_kthread+0x10/0x10
[  777.873991][ T5602]  ret_from_fork+0x72b/0xd50
[  777.874008][ T5602]  ? __pfx_ret_from_fork+0x10/0x10
[  777.874024][ T5602]  ? rcu_is_watching+0x12/0xc0
[  777.874042][ T5602]  ? __switch_to+0x800/0x10f0
[  777.874054][ T5602]  ? __pfx_kthread+0x10/0x10
[  777.874066][ T5602]  ret_from_fork_asm+0x1a/0x30
[  777.874090][ T5602]  </TASK>
[  777.874916][ T5602] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  778.172361][ T5602] Bluetooth: hci3: failed to register connection device
[  778.362722][   T30] audit: type=1400 audit(2000000283.163:2408): avc:  denied  { write } for  pid=25028 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  778.568399][   T30] audit: type=1400 audit(2000000283.357:2409): avc:  denied  { write } for  pid=25063 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  778.839314][T25014] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  778.862420][T25014] Bluetooth: hci4: Error when powering off device on rfkill (-4)
[  779.280877][ T5602] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201'
[  779.290545][ T5602] CPU: 0 UID: 0 PID: 5602 Comm: kworker/u9:3 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  779.290566][ T5602] Tainted: [L]=SOFTLOCKUP
[  779.290573][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  779.290582][ T5602] Workqueue: hci3 hci_rx_work
[  779.290601][ T5602] Call Trace:
[  779.290606][ T5602]  <TASK>
[  779.290611][ T5602]  dump_stack_lvl+0x100/0x190
[  779.290629][ T5602]  sysfs_warn_dup.cold+0x1c/0x28
[  779.290647][ T5602]  sysfs_create_dir_ns+0x24b/0x2b0
[  779.290661][ T5602]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  779.290673][ T5602]  ? find_held_lock+0x2b/0x80
[  779.290684][ T5602]  ? kobject_add_internal+0x25f/0x930
[  779.290696][ T5602]  ? kobject_add_internal+0x25f/0x930
[  779.290709][ T5602]  ? do_raw_spin_unlock+0x145/0x1e0
[  779.290728][ T5602]  kobject_add_internal+0x2c8/0x930
[  779.290743][ T5602]  kobject_add+0x16a/0x1e0
[  779.290755][ T5602]  ? __pfx_kobject_add+0x10/0x10
[  779.290767][ T5602]  ? class_to_subsys+0x10f/0x150
[  779.290787][ T5602]  ? kobject_put+0xb9/0x640
[  779.290804][ T5602]  ? _raw_spin_unlock+0x28/0x50
[  779.290820][ T5602]  device_add+0x294/0x1970
[  779.290837][ T5602]  ? __pfx_dev_set_name+0x10/0x10
[  779.290848][ T5602]  ? __pfx_device_add+0x10/0x10
[  779.290865][ T5602]  ? mgmt_send_event_skb+0x2fb/0x460
[  779.290885][ T5602]  hci_conn_add_sysfs+0x1a3/0x260
[  779.290904][ T5602]  le_conn_complete_evt+0x11eb/0x1f60
[  779.290922][ T5602]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  779.290935][ T5602]  ? hci_event_packet+0x186/0xcd0
[  779.290952][ T5602]  hci_le_conn_complete_evt+0x23c/0x3a0
[  779.290967][ T5602]  ? skb_pull_data+0x15f/0x1e0
[  779.290987][ T5602]  hci_le_meta_evt+0x34a/0x5f0
[  779.291002][ T5602]  ? __pfx_hci_le_conn_complete_evt+0x10/0x10
[  779.291019][ T5602]  hci_event_packet+0x51c/0xcd0
[  779.291033][ T5602]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  779.291049][ T5602]  ? __pfx_hci_event_packet+0x10/0x10
[  779.291064][ T5602]  ? kcov_remote_start+0x384/0x670
[  779.291078][ T5602]  ? lockdep_hardirqs_on+0x78/0x100
[  779.291097][ T5602]  hci_rx_work+0x451/0xfc0
[  779.291115][ T5602]  process_one_work+0xa23/0x1940
[  779.291134][ T5602]  ? __pfx_process_one_work+0x10/0x10
[  779.291150][ T5602]  ? __pfx_hci_rx_work+0x10/0x10
[  779.291165][ T5602]  worker_thread+0x5ef/0xe50
[  779.291183][ T5602]  ? kthread+0x13a/0x450
[  779.291194][ T5602]  ? __pfx_worker_thread+0x10/0x10
[  779.291206][ T5602]  kthread+0x370/0x450
[  779.291217][ T5602]  ? __pfx_kthread+0x10/0x10
[  779.291229][ T5602]  ret_from_fork+0x72b/0xd50
[  779.291246][ T5602]  ? __pfx_ret_from_fork+0x10/0x10
[  779.291262][ T5602]  ? rcu_is_watching+0x12/0xc0
[  779.291280][ T5602]  ? __switch_to+0x800/0x10f0
[  779.291292][ T5602]  ? __pfx_kthread+0x10/0x10
[  779.291304][ T5602]  ret_from_fork_asm+0x1a/0x30
[  779.291329][ T5602]  </TASK>
[  779.291363][ T5602] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  779.613934][ T5602] Bluetooth: hci3: failed to register connection device
[  779.626907][ T5602] Bluetooth: hci3: command 0x2016 tx timeout
[  779.809538][T25014] tipc: Resetting bearer <eth:syzkaller0>
[  779.830771][T25096] kAFS: No cell specified
[  779.850117][   T30] audit: type=1400 audit(2000000284.539:2410): avc:  denied  { write } for  pid=25073 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  781.086586][   T30] audit: type=1400 audit(2000000285.675:2411): avc:  denied  { write } for  pid=25101 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  781.236228][T25104] FAT-fs (nbd1): unable to read boot sector
[  781.260888][T25104] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3072'.
[  781.276634][T25014] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  781.287379][T25014] Bluetooth: hci5: Error when powering off device on rfkill (-4)
[  781.307830][ T5602] Bluetooth: hci3: unexpected event 0x05 length: 11 > 4
[  781.460958][T25014] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  781.521042][T25014] Bluetooth: hci6: Error when powering off device on rfkill (-4)
[  781.699768][T25014] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  781.709248][   T30] audit: type=1400 audit(2000000286.256:2412): avc:  denied  { write } for  pid=25107 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  781.734720][T25014] Bluetooth: hci1: Error when powering off device on rfkill (-4)
[  781.815216][ T5602] Bluetooth: hci3: command 0x2016 tx timeout
[  781.866457][   T30] audit: type=1400 audit(2000000286.395:2413): avc:  denied  { write } for  pid=25142 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  782.089651][   T30] audit: type=1400 audit(2000000286.607:2414): avc:  denied  { write } for  pid=25146 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  782.173956][   T30] audit: type=1400 audit(2000000286.690:2415): avc:  denied  { write } for  pid=25157 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  782.397134][   T30] audit: type=1400 audit(2000000286.884:2416): avc:  denied  { write } for  pid=25159 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  782.475364][   T30] audit: type=1400 audit(2000000286.967:2417): avc:  denied  { write } for  pid=25170 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  782.859114][T24301] usbhid 6-1:0.0: can't add hid device: -32
[  782.866815][T24301] usbhid 6-1:0.0: probe with driver usbhid failed with error -32
[  784.074369][ T5607] Bluetooth: hci3: command 0x2016 tx timeout
[  784.081089][T25014] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  784.090273][T25014] Bluetooth: hci3: Error when powering off device on rfkill (-4)
[  784.300503][T22125] usb 6-1: USB disconnect, device number 57
[  784.367204][T25247] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 疽m�%A����AZ�Z����I����� ���%
[  784.383694][T25246] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  784.530595][   T30] kauditd_printk_skb: 8 callbacks suppressed
[  784.530608][   T30] audit: type=1400 audit(2000000288.860:2426): avc:  denied  { map } for  pid=25249 comm="syz.0.3078" path="/proc/1806/net/arp" dev="proc" ino=4026533142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1
[  785.090264][T25277] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.
[  785.717557][ T1301] ieee802154 phy1 wpan1: encryption failed: -22
[  786.383740][T25318] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8274 sclass=netlink_route_socket pid=25318 comm=syz.4.3089
[  786.531397][T25328] netlink: 56 bytes leftover after parsing attributes in process `syz.5.3090'.
[  786.548989][T22125] usb 2-1: new high-speed USB device number 26 using dummy_hcd
[  786.623599][T24306] usb 3-1: new high-speed USB device number 54 using dummy_hcd
[  786.681905][   T30] audit: type=1400 audit(2000000290.844:2427): avc:  denied  { read } for  pid=25331 comm="syz.0.3091" path="socket:[66428]" dev="sockfs" ino=66428 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1
[  786.786679][T25332] loop3: detected capacity change from 0 to 7
[  786.798330][T25332] Dev loop3: unable to read RDB block 7
[  786.803948][T25332]  loop3: unable to read partition table
[  786.809738][T25332] loop3: partition table beyond EOD, truncated
[  786.815881][T25332] loop_reread_partitions: partition scan of loop3 (�被x������ ) failed (rc=-5)
[  786.875353][T22125] usb 2-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00
[  786.896449][T24306] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32
[  786.921949][T22125] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024
[  786.945398][T24306] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16
[  786.975095][T22125] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  786.983590][   T30] audit: type=1400 audit(2000000290.983:2428): avc:  denied  { listen } for  pid=25331 comm="syz.0.3091" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1
[  787.011014][T24306] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64
[  787.040079][T22125] usb 2-1: config 0 descriptor??
[  787.070418][T24306] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  787.081411][T25307] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  787.098403][T24306] usb 3-1: Product: syz
[  787.126672][T24306] usb 3-1: Manufacturer: syz
[  787.186530][T24306] usb 3-1: SerialNumber: syz
[  787.229888][T24306] usb 3-1: config 0 descriptor??
[  787.253233][T25313] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22
[  787.285659][T25313] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22
[  787.444166][   T30] audit: type=1400 audit(2000000291.546:2429): avc:  denied  { write } for  pid=25362 comm="syz.5.3097" name="nullb" dev="configfs" ino=3398 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  787.533187][   T30] audit: type=1400 audit(2000000291.574:2430): avc:  denied  { read } for  pid=25362 comm="syz.5.3097" name="memory_backed" dev="configfs" ino=66634 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1
[  787.564302][T25313] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22
[  787.610741][T25313] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22
[  787.645611][T22125] hid_parser_main: 451 callbacks suppressed
[  787.645627][T22125] uclogic 0003:5543:0064.0014: unknown main item tag 0x0
[  787.680539][   T30] audit: type=1800 audit(2000000291.592:2431): pid=25363 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.3097" name="memory_backed" dev="configfs" ino=66634 res=0 errno=0
[  787.726393][T22125] uclogic 0003:5543:0064.0014: unknown main item tag 0x0
[  787.775199][T22125] uclogic 0003:5543:0064.0014: unknown main item tag 0x0
[  787.828667][T22125] uclogic 0003:5543:0064.0014: unknown main item tag 0x0
[  787.837646][   T30] audit: type=1400 audit(2000000291.592:2432): avc:  denied  { getopt } for  pid=25362 comm="syz.5.3097" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1
[  787.894327][T25376] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3099'.
[  787.908960][T22125] uclogic 0003:5543:0064.0014: unknown main item tag 0x0
[  787.936426][T22125] uclogic 0003:5543:0064.0014: unknown main item tag 0x0
[  787.962370][T25376] netlink: 'syz.4.3099': attribute type 5 has an invalid length.
[  787.970440][   T30] audit: type=1800 audit(2000000291.592:2433): pid=25363 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.3097" name="power" dev="configfs" ino=66639 res=0 errno=0
[  787.998545][T22125] uclogic 0003:5543:0064.0014: unknown main item tag 0x0
[  788.022462][T22125] uclogic 0003:5543:0064.0014: unknown main item tag 0x0
[  788.035368][T25376] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3099'.
[  788.055694][T22125] uclogic 0003:5543:0064.0014: unknown main item tag 0x0
[  788.080915][   T30] audit: type=1400 audit(2000000291.962:2434): avc:  denied  { append } for  pid=25312 comm="syz.2.3088" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1
[  788.109266][T22125] uclogic 0003:5543:0064.0014: unknown main item tag 0x0
[  788.122156][T24306] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00
[  788.134600][T25363] null_blk: disk my_zoned_dev created
[  788.160819][T22125] uclogic 0003:5543:0064.0014: hidraw0: USB HID v7b.fd Device [HID 5543:0064] on usb-dummy_hcd.1-1/input0
[  788.187827][T22260] ffs_data_put(): freeing
[  788.226687][T22125] usb 2-1: USB disconnect, device number 26
[  788.300119][T25393] fido_id[25393]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory
[  788.527383][T25416] 9p: Bad value for 'rfdno'
[  788.564334][T24306] dm9601 3-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID
[  788.610647][T24306] usb 3-1: USB disconnect, device number 54
[  788.802227][T25437] loop5: detected capacity change from 0 to 7
[  788.816160][T25437]  loop5: [CUMANA/ADFS] p1 [ADFS] p1
[  788.828351][T25437] loop5: partition table partially beyond EOD, truncated
[  788.853501][T25437] loop5: p1 size 487441168 extends beyond EOD, truncated
[  789.136449][T22125] usb 5-1: new high-speed USB device number 54 using dummy_hcd
[  789.829205][   T30] audit: type=1400 audit(2000000293.743:2435): avc:  denied  { unmount } for  pid=21112 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1
[  789.981378][T22125] usb 5-1: Using ep0 maxpacket: 16
[  790.297748][T22125] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  790.354886][T22125] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  790.395752][T25447] FAT-fs (nbd1): unable to read boot sector
[  790.404290][T25447] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3107'.
[  790.426625][T22125] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  790.461867][T25459] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3110'.
[  790.483599][T22125] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  790.499069][T25459] netlink: 'syz.5.3110': attribute type 5 has an invalid length.
[  790.512836][T22125] usb 5-1: Product: syz
[  790.527478][T22125] usb 5-1: Manufacturer: syz
[  790.544969][T25459] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3110'.
[  790.560169][T22125] usb 5-1: SerialNumber: syz
[  790.579147][T22125] usb 5-1: config 0 descriptor??
[  790.597089][T25466] read descriptors
[  790.618237][T22125] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  790.680165][T22125] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class)
[  790.731254][T12978] ffs_data_put(): freeing
[  790.800905][T25484] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3112'.
[  790.825299][T25484] netlink: 'syz.1.3112': attribute type 5 has an invalid length.
[  790.833315][ T5793] usb 3-1: new high-speed USB device number 55 using dummy_hcd
[  790.846810][T25484] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3112'.
[  790.888049][T25484] read descriptors
[  790.973550][T23377] ffs_data_put(): freeing
[  791.022126][ T5793] usb 3-1: New USB device found, idVendor=046d, idProduct=0900, bcdDevice= 0.00
[  791.044435][ T5793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  791.058757][ T5793] usb 3-1: Product: syz
[  791.069135][T25501] XFS (mtdblock0): Invalid superblock magic number
[  791.075807][T24306] usb 6-1: new high-speed USB device number 58 using dummy_hcd
[  791.083583][ T5793] usb 3-1: Manufacturer: syz
[  791.089422][ T5793] usb 3-1: SerialNumber: syz
[  791.270811][T24306] usb 6-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00
[  791.637659][ T5793] gspca_main: spca500-2.14.0 probing 046d:0900
[  791.704509][T22125] em28xx 5-1:0.0: unknown em28xx chip ID (0)
[  792.057217][T22125] em28xx 5-1:0.0: Config register raw data: 0x94
[  792.067752][T24306] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024
[  792.135658][T24306] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  792.172341][T24306] usb 6-1: config 0 descriptor??
[  792.211662][T25489] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22
[  792.313638][T25470] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  792.335372][T22125] em28xx 5-1:0.0: AC97 chip type couldn't be determined
[  792.358225][T25470] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  792.367610][T22125] em28xx 5-1:0.0: No AC97 audio processor
[  792.415643][T22125] usb 5-1: USB disconnect, device number 54
[  792.460074][T22125] em28xx 5-1:0.0: Disconnecting em28xx
[  792.622224][T22125] em28xx 5-1:0.0: Freeing device
[  792.629620][ T5793] gspca_spca500: reg write: error -32
[  792.642486][ T5793] gspca_spca500: reg write: error -32
[  792.670967][ T5793] gspca_spca500: reg write: error -32
[  792.700007][ T5793] gspca_spca500: reg write: error -32
[  792.732948][ T5793] gspca_spca500: reg write: error -32
[  792.741728][T24306] uclogic 0003:5543:0064.0015: hidraw0: USB HID v7b.fd Device [HID 5543:0064] on usb-dummy_hcd.5-1/input0
[  792.762016][ T5793] gspca_spca500: reg write: error -32
[  792.774467][ T5793] gspca_spca500: reg write: error -32
[  792.791389][ T5793] gspca_spca500: reg write: error -32
[  792.800795][ T5793] gspca_spca500: reg write: error -32
[  792.824029][ T5793] gspca_spca500: reg write: error -32
[  792.843791][ T5793] gspca_spca500: reg write: error -32
[  792.863894][ T5793] gspca_spca500: reg write: error -32
[  792.888595][ T5793] gspca_spca500: reg write: error -32
[  792.899868][ T5793] gspca_spca500: reg write: error -32
[  792.917065][T22125] usb 6-1: USB disconnect, device number 58
[  793.386053][T25574] XFS (mtdblock0): Invalid superblock magic number
[  793.501241][ T5793] usb 3-1: USB disconnect, device number 55
[  794.586643][T25598] XFS (mtdblock0): Invalid superblock magic number
[  795.618736][T25615] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3123'.
[  795.707778][T25625] read descriptors
[  795.743519][T25615] netlink: 'syz.1.3123': attribute type 5 has an invalid length.
[  795.839212][T25615] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'.
[  795.928092][ T5793] usb 6-1: new high-speed USB device number 59 using dummy_hcd
[  796.159532][T25633] jffs2: notice: (25633) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 4 of xref (0 dead, 1 orphan) found.
[  796.858934][T23377] ffs_data_put(): freeing
[  796.979017][ T5793] usb 6-1: Using ep0 maxpacket: 8
[  797.006929][ T5793] usb 6-1: New USB device found, idVendor=17cc, idProduct=1011, bcdDevice= 0.40
[  797.061232][   T30] audit: type=1400 audit(2000000300.418:2436): avc:  denied  { write } for  pid=25631 comm="syz.2.3125" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[  797.109950][ T5793] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  797.137244][ T5793] usb 6-1: Product: syz
[  797.179109][ T5793] usb 6-1: Manufacturer: syz
[  797.202087][ T5793] usb 6-1: SerialNumber: syz
[  797.213816][   T30] audit: type=1400 audit(2000000300.455:2437): avc:  denied  { write } for  pid=25631 comm="syz.2.3125" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[  797.446353][T24306] usb 2-1: new high-speed USB device number 27 using dummy_hcd
[  797.596384][T22119] usb 3-1: new high-speed USB device number 56 using dummy_hcd
[  797.618551][T24306] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[  797.630500][T24306] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  797.640930][T24306] usb 2-1: Product: syz
[  797.648876][T24306] usb 2-1: Manufacturer: syz
[  797.659303][T24306] usb 2-1: SerialNumber: syz
[  797.692848][T22125] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[  797.770537][T22119] usb 3-1: Using ep0 maxpacket: 32
[  797.781210][T22119] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1c09, bcdDevice= 0.00
[  797.795932][T22119] usb 3-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7
[  797.815581][T22119] usb 3-1: config 0 interface 0 has no altsetting 0
[  797.831583][T22119] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  797.857207][T22119] usb 3-1: config 0 descriptor??
[  797.982899][T25672] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8274 sclass=netlink_route_socket pid=25672 comm=syz.4.3131
[  798.145937][T25639] syz_tun: entered allmulticast mode
[  798.183271][T24306] usb 2-1: USB disconnect, device number 27
[  798.195211][T25639] syz_tun: left allmulticast mode
[  798.768726][   T30] audit: type=1400 audit(2000000302.006:2438): avc:  denied  { write } for  pid=25645 comm="syz.2.3127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1
[  798.829822][T22119] hid_parser_main: 793 callbacks suppressed
[  798.829838][T22119] corsair-psu 0003:1B1C:1C09.0016: unknown main item tag 0x0
[  798.895402][T22119] corsair-psu 0003:1B1C:1C09.0016: unknown main item tag 0x0
[  798.916874][T22119] corsair-psu 0003:1B1C:1C09.0016: unknown main item tag 0x0
[  798.944495][T22119] corsair-psu 0003:1B1C:1C09.0016: unknown main item tag 0x0
[  798.963473][ T5793] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found
[  799.399451][T22125] usb 2-1: Service connection timeout for: 256
[  799.747738][T22119] corsair-psu 0003:1B1C:1C09.0016: unknown main item tag 0x0
[  799.921136][T22125] ath9k_htc 2-1:1.0: ath9k_htc: Unable to initialize HTC services
[  799.986664][T22125] ath9k_htc: Failed to initialize the device
[  800.015492][T22119] corsair-psu 0003:1B1C:1C09.0016: hidraw0: USB HID v4.08 Device [HID 1b1c:1c09] on usb-dummy_hcd.2-1/input0
[  800.027295][ T5793] usb 6-1: 2:1 : UAC_AS_GENERAL descriptor not found
[  800.064914][T24306] usb 2-1: ath9k_htc: USB layer deinitialized
[  800.078106][ T5793] usb 6-1: unable to issue vendor read request (ret = -71)
[  800.115184][ T5793] usb 6-1: unable to issue vendor read request (ret = -71)
[  800.132899][T25705] FAT-fs (nbd4): unable to read boot sector
[  800.169859][ T5793] usb 6-1: unable to issue vendor read request (ret = -71)
[  800.179946][T25705] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3133'.
[  800.216538][ T5793] usb 6-1: unable to issue vendor read request (ret = -71)
[  800.339836][ T5793] usb 6-1: USB disconnect, device number 59
[  800.445306][T24306] usb 2-1: new high-speed USB device number 28 using dummy_hcd
[  800.477766][T22119] corsair-psu 0003:1B1C:1C09.0016: unable to initialize device (-110)
[  800.549439][T22119] corsair-psu 0003:1B1C:1C09.0016: probe with driver corsair-psu failed with error -110
[  800.684676][T24306] usb 2-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00
[  800.719369][T25724] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3137'.
[  800.754497][T24306] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024
[  800.797475][   T30] audit: type=1400 audit(2000000303.880:2439): avc:  denied  { write } for  pid=25694 comm="syz.5.3134" name="720p" dev="configfs" ino=19449 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  800.839898][T24306] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  800.895782][T24306] usb 2-1: config 0 descriptor??
[  800.925563][T25681] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22
[  801.089635][T25758] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3142'.
[  802.063199][T24306] uclogic 0003:5543:0064.0017: unknown main item tag 0x0
[  802.293590][T22119] usb 3-1: USB disconnect, device number 56
[  802.326547][T24306] uclogic 0003:5543:0064.0017: unknown main item tag 0x0
[  802.390465][T24306] uclogic 0003:5543:0064.0017: unknown main item tag 0x0
[  802.436386][T24306] uclogic 0003:5543:0064.0017: unknown main item tag 0x0
[  802.495320][T24306] uclogic 0003:5543:0064.0017: unknown main item tag 0x0
[  802.640528][T24306] uclogic 0003:5543:0064.0017: hidraw0: USB HID v7b.fd Device [HID 5543:0064] on usb-dummy_hcd.1-1/input0
[  803.728784][T24306] usb 2-1: USB disconnect, device number 28
[  803.938790][   T30] audit: type=1400 audit(2000000306.779:2440): avc:  denied  { listen } for  pid=25757 comm="syz.0.3142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1
[  804.076793][   T30] audit: type=1400 audit(2000000306.797:2441): avc:  denied  { accept } for  pid=25757 comm="syz.0.3142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1
[  807.755770][T25837] FAT-fs (nbd0): unable to read boot sector
[  807.767295][T25837] netlink: 100 bytes leftover after parsing attributes in process `syz.0.3155'.
[  807.785745][   T30] audit: type=1400 audit(2000000310.324:2442): avc:  denied  { append } for  pid=25840 comm="syz.5.3156" name="sg0" dev="devtmpfs" ino=778 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1
[  807.972977][T25841] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff)
[  809.097991][T25864] XFS (mtdblock0): Invalid superblock magic number
[  811.934260][   T30] audit: type=1400 audit(2000000314.155:2443): avc:  denied  { write } for  pid=25879 comm="syz.1.3163" name="720p" dev="configfs" ino=19449 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  816.485352][T25981] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1)
[  816.571122][T25983] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1)
[  816.891788][ T5696] usb 2-1: new high-speed USB device number 29 using dummy_hcd
[  817.653641][T25994] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1)
[  817.832824][ T5696] usb 2-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00
[  817.882879][ T5696] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  818.155100][T22125] usb 3-1: new full-speed USB device number 57 using dummy_hcd
[  818.483548][ T5696] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  818.899369][ T5696] keyspan 2-1:1.0: Keyspan 2 port adapter converter detected
[  818.933552][T26013] FAT-fs (nbd4): unable to read boot sector
[  818.947783][ T5696] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 81
[  818.961795][T26013] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3190'.
[  818.977088][ T5696] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 1
[  819.017837][ T5696] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 84
[  819.045149][T22125] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0014, bcdDevice= 0.40
[  819.058072][ T5696] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 2
[  819.083742][T22125] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 4
[  819.103693][ T5696] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB0
[  819.156035][T22125] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 4
[  819.175169][ T5696] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 88
[  819.212947][   T30] audit: type=1400 audit(2000000320.876:2444): avc:  denied  { write } for  pid=25998 comm="syz.0.3186" name="720p" dev="configfs" ino=19449 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  819.247920][ T5696] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 6
[  819.268947][T22125] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 1023
[  819.303808][ T5696] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB1
[  819.334945][T22125] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  819.367450][T22125] usb 3-1: Product: syz
[  819.390209][T22125] usb 3-1: Manufacturer: syz
[  819.410361][T22125] usb 3-1: SerialNumber: syz
[  819.518419][ T5696] usb 2-1: USB disconnect, device number 29
[  819.580100][ T5696] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0
[  819.619687][ T5696] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1
[  819.646281][ T5696] keyspan 2-1:1.0: device disconnected
[  819.914565][T22125] usb 3-1: Can't get UAC3 power state for id 10
[  819.925048][T22125] usb 3-1: 2:0: failed to get current value for ch 0 (-71)
[  819.960111][T22125] usb 3-1: applying playback min mute quirk
[  819.970016][T22125] usb 3-1: 2:0: cannot get min/max values for control 2 (id 2)
[  819.977889][T22125] usb 3-1: applying playback min mute quirk
[  819.983946][T22125] usb 3-1: Warning! Unlikely small volume range (=1), linear volume or custom curve?
[  819.993678][T22125] usb 3-1: [2] FU [Generic Out Playback Volume] ch = 1, val = 0/1/1
[  820.041887][T22125] usb 3-1: USB disconnect, device number 57
[  820.094065][ T5793] usb 1-1: new high-speed USB device number 82 using dummy_hcd
[  820.130097][T26081] udevd[26081]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  820.376479][ T5793] usb 1-1: New USB device found, idVendor=0547, idProduct=6801, bcdDevice=8b.8e
[  820.400890][T26099] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1)
[  820.438479][ T5793] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  820.463628][ T5793] usb 1-1: Product: syz
[  820.480959][ T5793] usb 1-1: Manufacturer: syz
[  820.507124][ T5793] usb 1-1: SerialNumber: syz
[  820.773828][ T5793] gspca_main: touptek-2.14.0 probing 0547:6801
[  820.816693][ T5793] usb 1-1: USB disconnect, device number 82
[  820.878739][T26125] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[23377] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26125]
[  820.989879][T26128] XFS (mtdblock0): Invalid superblock magic number
[  824.176425][T26159] FAT-fs (nbd2): unable to read boot sector
[  824.208364][T26159] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3203'.
[  824.492048][   T30] audit: type=1400 audit(2000000325.760:2445): avc:  denied  { read } for  pid=26165 comm="syz.2.3205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1
[  824.607594][   T30] audit: type=1400 audit(2000000325.824:2446): avc:  denied  { write } for  pid=26157 comm="syz.0.3204" name="720p" dev="configfs" ino=19449 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  824.923647][T26177] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3208'.
[  824.950194][T26177] netlink: 'syz.5.3208': attribute type 5 has an invalid length.
[  824.968121][T26177] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3208'.
[  824.992001][T26177] read descriptors
[  825.050447][T12978] ffs_data_put(): freeing
[  825.542525][T22119] usb 6-1: new high-speed USB device number 60 using dummy_hcd
[  825.556922][T26201] XFS (mtdblock0): Invalid superblock magic number
[  825.840010][T22119] usb 6-1: Using ep0 maxpacket: 32
[  826.485742][T22119] usb 6-1: New USB device found, idVendor=0e8f, idProduct=0003, bcdDevice= 0.00
[  826.562095][T22119] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 1056, setting to 1024
[  826.635042][T22119] usb 6-1: config 0 interface 0 has no altsetting 0
[  827.560994][T22119] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  827.605105][T22119] usb 6-1: config 0 descriptor??
[  827.669334][T26190] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22
[  827.681841][   T30] audit: type=1400 audit(2000000328.677:2447): avc:  denied  { write } for  pid=26222 comm="syz.4.3216" name="subsystems" dev="configfs" ino=147 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  827.708742][T26223] 
[  827.711077][T26223] ======================================================
[  827.718069][T26223] WARNING: possible circular locking dependency detected
[  827.725057][T26223] syzkaller #0 Tainted: G             L     
[  827.731012][T26223] ------------------------------------------------------
[  827.738000][T26223] syz.4.3216/26223 is trying to acquire lock:
[  827.744039][T26223] ffff888027c19b70 (&p->frag_sem){++++}-{4:4}, at: configfs_rmdir+0x3fa/0x950
[  827.752892][T26223] 
[  827.752892][T26223] but task is already holding lock:
[  827.760237][T26223] ffff88802871a280 (&sb->s_type->i_mutex_key#30){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0
[  827.769871][T26223] 
[  827.769871][T26223] which lock already depends on the new lock.
[  827.769871][T26223] 
[  827.780240][T26223] 
[  827.780240][T26223] the existing dependency chain (in reverse order) is:
[  827.789223][T26223] 
[  827.789223][T26223] -> #3 (&sb->s_type->i_mutex_key#30){++++}-{4:4}:
[  827.797890][T26223]        lock_acquire+0x1b9/0x370
[  827.802891][T26223]        down_write+0x8b/0x1f0
[  827.807630][T26223]        configfs_depend_item_unlocked+0xf3/0x6a0
[  827.814021][T26223]        usbg_make_tpg+0x261/0x620
[  827.819104][T26223]        target_fabric_make_tpg+0xab/0x8c0
[  827.824885][T26223]        configfs_mkdir+0x51e/0xb70
[  827.830069][T26223]        vfs_mkdir+0x361/0x850
[  827.834819][T26223]        filename_mkdirat+0x48b/0x5e0
[  827.840161][T26223]        __x64_sys_mkdir+0x6b/0x90
[  827.845258][T26223]        do_syscall_64+0x115/0x870
[  827.850353][T26223]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  827.856750][T26223] 
[  827.856750][T26223] -> #2 (&opts->dep_lock){+.+.}-{4:4}:
[  827.864370][T26223]        lock_acquire+0x1b9/0x370
[  827.869370][T26223]        __mutex_lock+0x1a4/0x1bd0
[  827.874468][T26223]        tcm_set_name+0x29/0xb0
[  827.879299][T26223]        function_make+0x21c/0x3f0
[  827.884394][T26223]        configfs_mkdir+0x51e/0xb70
[  827.889570][T26223]        vfs_mkdir+0x361/0x850
[  827.894323][T26223]        filename_mkdirat+0x48b/0x5e0
[  827.899679][T26223]        __x64_sys_mkdir+0x6b/0x90
[  827.904779][T26223]        do_syscall_64+0x115/0x870
[  827.909878][T26223]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  827.916263][T26223] 
[  827.916263][T26223] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}:
[  827.924483][T26223]        lock_acquire+0x1b9/0x370
[  827.929493][T26223]        __mutex_lock+0x1a4/0x1bd0
[  827.934577][T26223]        uvcg_extension_ba_source_id_show+0x7c/0x310
[  827.941236][T26223]        configfs_read_iter+0x426/0x6f0
[  827.946754][T26223]        __kernel_read+0x397/0xad0
[  827.951851][T26223]        integrity_kernel_read+0x7e/0xb0
[  827.957469][T26223]        ima_calc_file_hash_tfm+0x25e/0x350
[  827.963333][T26223]        ima_calc_file_hash+0x1e3/0x380
[  827.968849][T26223]        ima_collect_measurement+0x94f/0xb30
[  827.974810][T26223]        process_measurement+0xdfe/0x2350
[  827.980499][T26223]        ima_file_check+0xc3/0x110
[  827.985588][T26223]        security_file_post_open+0xc4/0x210
[  827.991468][T26223]        path_openat+0x985/0x4280
[  827.996464][T26223]        do_file_open+0x20e/0x430
[  828.001471][T26223]        do_sys_openat2+0x10f/0x1e0
[  828.006653][T26223]        __x64_sys_openat+0x12d/0x210
[  828.011996][T26223]        do_syscall_64+0x115/0x870
[  828.017090][T26223]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  828.023473][T26223] 
[  828.023473][T26223] -> #0 (&p->frag_sem){++++}-{4:4}:
[  828.030832][T26223]        check_prev_add+0xeb/0xe60
[  828.035926][T26223]        __lock_acquire+0x136c/0x1a40
[  828.041273][T26223]        lock_acquire+0x1b9/0x370
[  828.046270][T26223]        down_write_killable+0x93/0x250
[  828.051791][T26223]        configfs_rmdir+0x3fa/0x950
[  828.056973][T26223]        vfs_rmdir+0x328/0x8a0
[  828.061721][T26223]        filename_rmdir+0x31a/0x5c0
[  828.066900][T26223]        __x64_sys_rmdir+0x46/0x70
[  828.071981][T26223]        do_syscall_64+0x115/0x870
[  828.077076][T26223]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  828.083462][T26223] 
[  828.083462][T26223] other info that might help us debug this:
[  828.083462][T26223] 
[  828.093669][T26223] Chain exists of:
[  828.093669][T26223]   &p->frag_sem --> &opts->dep_lock --> &sb->s_type->i_mutex_key#30
[  828.093669][T26223] 
[  828.107450][T26223]  Possible unsafe locking scenario:
[  828.107450][T26223] 
[  828.114880][T26223]        CPU0                    CPU1
[  828.120215][T26223]        ----                    ----
[  828.125548][T26223]   lock(&sb->s_type->i_mutex_key#30);
[  828.130990][T26223]                                lock(&opts->dep_lock);
[  828.137904][T26223]                                lock(&sb->s_type->i_mutex_key#30);
[  828.145858][T26223]   lock(&p->frag_sem);
[  828.149993][T26223] 
[  828.149993][T26223]  *** DEADLOCK ***
[  828.149993][T26223] 
[  828.158104][T26223] 3 locks held by syz.4.3216/26223:
[  828.163279][T26223]  #0: ffff88801dfe4450 (sb_writers#16){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0
[  828.172642][T26223]  #1: ffff888024465440 (&default_group_class[depth - 1]#9/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0
[  828.183929][T26223]  #2: ffff88802871a280 (&sb->s_type->i_mutex_key#30){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0
[  828.194002][T26223] 
[  828.194002][T26223] stack backtrace:
[  828.199873][T26223] CPU: 0 UID: 0 PID: 26223 Comm: syz.4.3216 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  828.199890][T26223] Tainted: [L]=SOFTLOCKUP
[  828.199894][T26223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  828.199901][T26223] Call Trace:
[  828.199907][T26223]  <TASK>
[  828.199912][T26223]  dump_stack_lvl+0x100/0x190
[  828.199927][T26223]  print_circular_bug.cold+0x178/0x1c7
[  828.199949][T26223]  check_noncircular+0x146/0x160
[  828.199965][T26223]  check_prev_add+0xeb/0xe60
[  828.199979][T26223]  __lock_acquire+0x136c/0x1a40
[  828.199996][T26223]  lock_acquire+0x1b9/0x370
[  828.200009][T26223]  ? configfs_rmdir+0x3fa/0x950
[  828.200025][T26223]  ? __pfx___might_resched+0x10/0x10
[  828.200040][T26223]  down_write_killable+0x93/0x250
[  828.200057][T26223]  ? configfs_rmdir+0x3fa/0x950
[  828.200073][T26223]  ? __pfx_down_write_killable+0x10/0x10
[  828.200089][T26223]  ? configfs_rmdir+0x3be/0x950
[  828.200106][T26223]  configfs_rmdir+0x3fa/0x950
[  828.200123][T26223]  ? __pfx_configfs_rmdir+0x10/0x10
[  828.200139][T26223]  ? __pfx_down_write+0x10/0x10
[  828.200157][T26223]  vfs_rmdir+0x328/0x8a0
[  828.200173][T26223]  filename_rmdir+0x31a/0x5c0
[  828.200186][T26223]  ? __pfx_filename_rmdir+0x10/0x10
[  828.200201][T26223]  ? do_getname+0x191/0x390
[  828.200216][T26223]  __x64_sys_rmdir+0x46/0x70
[  828.200229][T26223]  do_syscall_64+0x115/0x870
[  828.200244][T26223]  ? clear_bhb_loop+0x70/0xc0
[  828.200256][T26223]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  828.200268][T26223] RIP: 0033:0x7fabe6d9e0d9
[  828.200279][T26223] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  828.200290][T26223] RSP: 002b:00007fabe7c78028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
[  828.200301][T26223] RAX: ffffffffffffffda RBX: 00007fabe7025fa0 RCX: 00007fabe6d9e0d9
[  828.200308][T26223] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040
[  828.200315][T26223] RBP: 00007fabe6e35024 R08: 0000000000000000 R09: 0000000000000000
[  828.200322][T26223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  828.200328][T26223] R13: 00007fabe7026038 R14: 00007fabe7025fa0 R15: 00007ffec00916d8
[  828.200339][T26223]  </TASK>
[  828.443095][T22125] usb 2-1: new full-speed USB device number 30 using dummy_hcd
[  828.469480][T26195] syz.0.3211 (26195): drop_caches: 2
[  828.496281][   T30] audit: type=1400 audit(2000000328.723:2448): avc:  denied  { write } for  pid=26222 comm="syz.4.3216" name="subsystems" dev="configfs" ino=147 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  828.519178][   T30] audit: type=1400 audit(2000000328.723:2449): avc:  denied  { remove_name } for  pid=26222 comm="syz.4.3216" name="testnqn" dev="configfs" ino=69050 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  828.542462][   T30] audit: type=1400 audit(2000000328.723:2450): avc:  denied  { rmdir } for  pid=26222 comm="syz.4.3216" name="testnqn" dev="configfs" ino=69050 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  828.567678][T26227] x_tables: ip_tables: CT.0 target: invalid size 40 (kernel) != (user) 0
[  828.588750][   T30] audit: type=1326 audit(2000000329.527:2451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26225 comm="syz.2.3217" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f42c599e0d9 code=0x0
[  828.654806][T22119] usbhid 6-1:0.0: can't add hid device: -71
[  828.660827][T22119] usbhid 6-1:0.0: probe with driver usbhid failed with error -71
[  828.673353][T22119] usb 6-1: USB disconnect, device number 60
[  828.777751][T26214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  828.787836][T26214] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  828.800401][T26214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  828.810260][T26214] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  828.826119][T22125] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00
[  828.835738][T22125] usb 2-1: too many configurations: 75, using maximum allowed: 8
[  828.845115][T22125] usb 2-1: unable to read config index 0 descriptor/start: -71
[  828.852988][T22125] usb 2-1: can't read configurations, error -71