last executing test programs: 2m53.456192333s ago: executing program 3 (id=261): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb3c5ca683a4b6fc89398f2b9000f224891060017c4700de60beac671e8e8fdecb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0d18a93ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4a801efdf008499d7aca1afac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x7, 0x4, 0x12}, 0x50) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd2b, 0x25dfdbbb, {0x0, 0x0, 0x0, 0x0, 0x50a10, 0x51a23}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x30}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000c0}, 0x9080) socket(0x10, 0x3, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/netstat\x00') fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000000000)=0x5) r4 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r6 = syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000000ac0)=""/102392, 0x18ff8) getdents64(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000000)='./control\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x8) mknodat(r4, &(0x7f0000000040)='./file1/file4/file5\x00', 0x100, 0xfffffffc) lseek(r3, 0x1000000, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r1, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6=r0}, 0x20) 2m52.199918479s ago: executing program 3 (id=262): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000085ff8208582005109b0d0000000109021200010900000009048f0000bf575a00"], 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x88, 0x2c, 0x6f14cf9ac61f9c9b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff8, 0xfff, 0x0, 0x5, 0xb}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x88}}, 0x24000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x80000000000002, &(0x7f0000000240)=0x6a, 0x4) bind$inet(r6, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, &(0x7f0000000180)=0x803, 0x4) connect$inet(r6, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendmmsg(r6, &(0x7f0000004fc0)=[{{0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000000400)="f2a3caf1952c87a38acd5773d122cb755867e6eb5188ea264a07a2f38b58c6338ec4f67c78fcd77e9f7d11fd8d50fb354b4d31782546bc2b3be2c5fbca0f7f7b57063937aff9c2d3f560c35c4303000000000000004d93d33bd26ec072165a8902b734f282d876c68369ee54253937a3db4200ecc2f177d174aa966e1ba47e88a8ed0e71dc51d3c7bee77a186d1e5a70c47a61455f269ee53bdfdc46dd854afbba774bac401cacb3c8c411724906a2d0761634e14d092dfdb6d91167d3076870743ad908e681", 0xc6}], 0x1}}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f00000001c0)="27a1288636", 0x5}], 0x1}}], 0x2, 0x4000) sendto$inet(r6, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b0073ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x5e, 0x0, 0x0) 2m47.476888054s ago: executing program 3 (id=274): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) pwritev(0xffffffffffffffff, 0x0, 0x0, 0xd, 0x10) syz_usb_connect(0x0, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102882333404f17cf8af4390102030109024500013f06400409044207000e0100010a240107000105ff010302070724050107638c0924030500030406810c2402"], &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0}) r0 = socket$key(0xf, 0x3, 0x2) sendmmsg(r0, &(0x7f0000000180), 0x400008a, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x9, 0x0, &(0x7f0000000100)={0x0}}, 0x0) syz_clone3(&(0x7f00000002c0)={0x10000, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)=0x0, {0x2f}, &(0x7f0000000140)=""/205, 0xcd, &(0x7f0000000240)=""/14, &(0x7f0000000280)=[0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x9}, 0x58) fcntl$lock(r0, 0x7, &(0x7f0000000340)={0x2, 0x3, 0x200, 0x5, r1}) 2m43.586202382s ago: executing program 3 (id=287): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r3, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r2, 0x3b8c, &(0x7f0000001800)={0x30, r4, 0x0, 0x0, 0x2, 0x1ff, 0x2, 0x0}) chown(&(0x7f0000001140)='./cgroup.cpu/cgroup.procs\x00', 0xee00, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r6, 0x0, 0xc8, &(0x7f0000000100), 0x4) setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004055) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r8, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @rand_addr=0x64010102}, 0x10) setsockopt$inet_mreq(r7, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x42, &(0x7f0000000040)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x6, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300, {[@generic={0x88, 0x2}]}}, @dest_unreach={0x3, 0x4, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r8, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xffffeff7, 0x40, 0x40000006}, 0x3c) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x1c, r1, 0x1, 0x0, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x44800}, 0x0) 2m42.589276042s ago: executing program 3 (id=290): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @rand_addr, 0x5}, 0x1c) socket$inet6_udp(0xa, 0x2, 0x0) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1b7b, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x100, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}}}, 0x24}}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='-', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2m41.468183901s ago: executing program 3 (id=291): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x80, 0x7, 0x7ffc0001}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x0, 0x3, &(0x7f00000000c0)={0x0, 0x48}, 0x1, 0x400000000000000}, 0x0) read$FUSE(r2, &(0x7f0000004100)={0x2020}, 0x2020) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000180)=@o_path={&(0x7f00000000c0)='./file0\x00', r2, 0x4000, r2}, 0x18) sync() r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) 2m26.128308421s ago: executing program 32 (id=291): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x80, 0x7, 0x7ffc0001}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x0, 0x3, &(0x7f00000000c0)={0x0, 0x48}, 0x1, 0x400000000000000}, 0x0) read$FUSE(r2, &(0x7f0000004100)={0x2020}, 0x2020) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000180)=@o_path={&(0x7f00000000c0)='./file0\x00', r2, 0x4000, r2}, 0x18) sync() r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) 1m42.210417557s ago: executing program 0 (id=486): socket$alg(0x26, 0x5, 0x0) setsockopt$CAN_RAW_FILTER(0xffffffffffffffff, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(0xffffffffffffffff, &(0x7f0000000040), 0x10) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x41) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000880)={0x14, 0x3a, 0x229, 0x0, 0x0, {0x2}}, 0x14}}, 0x1000000) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYBLOB='\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r5, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)='%-5lx \x00'}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000600)={{{@in, @in6=@empty}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000380)={@map=r6, 0x9, 0x1, 0x8, &(0x7f0000000180)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000240)=[0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000300)=[0x0]}, 0x40) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) 1m41.164082169s ago: executing program 0 (id=491): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_VDPA_SET_CONFIG_CALL(r3, 0x4004af77, &(0x7f0000000040)=0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="f0ff460c260f79f78117771c7f7fb9800000c00f326635010000000f30b8c6000f00d0b8f0000f00d8ba400066edcff30f08ea0f00f100"}], 0x1, 0x44, 0x0, 0x0) r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$lock(r4, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'vxcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)=@ipv6_getaddrlabel={0x68, 0x4a, 0x4, 0x70bd2a, 0x25dfdbfb, {0xa, 0x0, 0x40, 0x0, r5, 0x7fffffff}, [@IFAL_LABEL={0x8, 0x2, 0x4}, @IFAL_ADDRESS={0x14, 0x1, @mcast2}, @IFAL_ADDRESS={0x14, 0x1, @private0}, @IFAL_ADDRESS={0x14, 0x1, @private2}, @IFAL_LABEL={0x8, 0x2, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x4805}, 0x40) 1m39.588486701s ago: executing program 0 (id=496): fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000004c0)={'vcan0\x00'}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x404040) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f00000000c0)={0xfffffff8, 0x0, 0xfffbfffd, 0x981, 0x47, "0441920887e8d2b791f19dd026d76d7fcb3678", 0x4, 0x200}) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, 0x8) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f0000000200)={0x1d, r3}, 0x10) sendmsg$can_bcm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r3, @ANYRES64=r2, @ANYBLOB="3bf81bb9e9"], 0x20000600}}, 0x0) 1m38.500071432s ago: executing program 0 (id=501): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8014}, 0x4040) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24044800}, 0x0) r0 = socket$kcm(0x29, 0x0, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x119, 0x487, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x2000974) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f00000000c0)="1800000016005f0214fffffffffffff807000000010000", 0x17) bind$nfc_llcp(r2, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) 1m37.517312331s ago: executing program 0 (id=504): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) setsockopt$inet6_tcp_int(r0, 0x6, 0x25, &(0x7f0000000000)=0x8000, 0x34) 1m37.2199871s ago: executing program 0 (id=506): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(0xffffffffffffffff, 0x6a, 0x4, 0xfffffffa, 0x1f) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e1f, 0x3, 'wlc\x00', 0x0, 0x10000004, 0x5c}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) unshare(0x22020400) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockname(r4, 0x0, 0x0) r5 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SOCK(r5, 0xab00, 0xffffffffffffffff) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000007c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000800)={'wlan0\x00', 0x0}) recvfrom(r7, &(0x7f00000002c0)=""/101, 0x65, 0x10000, 0x0, 0x0) add_key(&(0x7f00000013c0)='big_key\x00', &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000380)="5b0ff16ad744051529a66c3802de290d57d2", 0xffffffffffffff17, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r9, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000600)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010a2dbd7000fadbdf254f00000008000300", @ANYRESOCT=r11, @ANYBLOB="50007a801ceb020e00abeb5e61404fd781bd11d76c2cdb854a6cdf1b4e3f586a0c000300d7ab9f15d39c9aea59811ace37cd6ad04eabc0c60577f6609f8bad3ca6f0984d279774bd80cc58f306680856f013a5858021a637a0115607d9d85857643e218913425b4df0b188580e0667bcc8b5d36028a4c264faf1a3c69ac42672af97c5c096d897ae9da4fc3d27f6f19cdaa171248ccb5f7534f238e24fa11887e1e0663e3b552c4e08d7babcb4d86e78057bf8a310cbe870dbd37f10ae03f0ca4e"], 0x6c}}, 0x40004) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="000229bd7000fcdbdf251700000008000300", @ANYRES32=r12, @ANYBLOB="0c009900f801000008000a00060008021100000000000a001a000802110000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40c7) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e1f, 0x0, @dev, 0xfffffeec}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@timestamping={{0x14, 0x1, 0x25, 0x8}}], 0x18}, 0x0) 1m31.905550282s ago: executing program 1 (id=527): unshare(0x6a040000) (async, rerun: 32) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 32) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x10, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "c9988fef16969584"}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x40004) close(r0) (async, rerun: 32) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) (async, rerun: 32) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r5, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r7 = accept(r5, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYRES64, @ANYRESDEC=r7, @ANYRES32, @ANYRESDEC, @ANYRESOCT=r0], 0xfffffdef}, 0x1, 0x0, 0x0, 0x8004}, 0x808d) sendto$packet(r7, &(0x7f0000000400)="f47145b1285570f8ab008b120a", 0xd, 0x0, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x14, 0x0, 0x1, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r8 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IP_VS_SO_SET_STARTDAEMON(r8, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'lo\x00', 0x3}, 0x18) 1m30.583641452s ago: executing program 1 (id=532): sched_setattr(0x0, 0x0, 0x0) r0 = semget$private(0x0, 0x2, 0x473) semop(r0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000240)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000080)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) open$dir(0x0, 0x0, 0x8) r4 = openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) write$dsp(r4, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r5 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r5, 0x40045532, &(0x7f0000000040)) r6 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r6, 0xc0884123, &(0x7f0000000280)={0x1, "728d0a484585ec93a59baeb6831b8ef110181595fe49bc4ac10b67b1b99eeeaa18e15a525115cc71983456358ceb7e1a6f926168ce0c3c2b0f3513a5f2674185", {0x800000000000004, 0x50000000000}}) syz_emit_ethernet(0x0, 0x0, 0x0) 1m28.529898339s ago: executing program 1 (id=535): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) pwritev(0xffffffffffffffff, 0x0, 0x0, 0xd, 0x10) syz_usb_connect(0x0, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102882333404f17cf8af4390102030109024500013f06400409044207000e0100010a240107000105ff010302070724050107638c0924030500030406810c2402"], &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0}) r0 = socket$key(0xf, 0x3, 0x2) sendmmsg(r0, &(0x7f0000000180), 0x400008a, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x9, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x2, 0x9, 0x0, 0x9, 0x2, 0x0, 0x70bd2b, 0x25dfdbfe}, 0x10}}, 0x0) syz_clone3(&(0x7f00000002c0)={0x10000, &(0x7f0000000080), &(0x7f00000000c0), 0x0, {0x2f}, &(0x7f0000000140)=""/205, 0xcd, &(0x7f0000000240)=""/14, 0x0}, 0x58) fcntl$lock(r0, 0x7, &(0x7f0000000340)={0x2, 0x3, 0x200, 0x5}) 1m24.648225123s ago: executing program 1 (id=549): mkdir(&(0x7f00000001c0)='./file1\x00', 0xb) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000000), r1) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002abd7000fddbdf25010000000800020002000000080001"], 0x24}, 0x1, 0x0, 0x0, 0x1508a1a9b469814b}, 0x8094) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r4) socket$packet(0x11, 0x3, 0x300) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000340)='./bus\x00') pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x4e21, 0x1, @loopback, 0x13}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$pokeuser(0x6, r7, 0x378, 0x3) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5998c867c22b401046a89606ffcf92e", "2c5be7ad", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r6, &(0x7f00000000c0)=""/3, 0x3, 0x300, 0x0, 0x0) splice(r6, 0x0, r5, 0x0, 0xfffffffffffffffc, 0x0) unlink(&(0x7f0000000140)='./file0\x00') symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') 1m23.778155828s ago: executing program 1 (id=553): r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[], 0x3c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8080) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fd7000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r4, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x0, {}, 0x1, 0xffffffffffffffff}}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000300)=[@text16={0x10, &(0x7f0000000340)="660f388084000072baf86766c744240065d400006766c7442402f4ffff7f6766c744240600000000670f0114240f18c5498c66efbafc0c66b80e00000066ef64f30fc7b000100f850100f30fc7b103006bb18000ffc00f326635000400000f30d2bc0a000f23c80f21f86635040040000f23f8b8f4008ee0", 0x78}], 0x1, 0x6a, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = gettid() r6 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) r7 = syz_open_procfs(0x0, 0x0) fchdir(r7) mount$bind(&(0x7f0000000180)='./cgroup\x00', &(0x7f0000000140)='./cgroup\x00', 0x0, 0x3a87406, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r6, 0x4040534e, &(0x7f0000000080)={0x335, @time={0x7fff, 0x5}, 0x9, {}, 0x0, 0x1c236f933e004a55}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r6, 0x40bc5311, &(0x7f00000000c0)={0x9ee, 0x1, 'client1\x00', 0x0, "a44bf30000051057", "c2382b4c6bb0e6576c93d30263c40dbdd1b75d7917ca30cb00", 0x15, 0x800}) tkill(r5, 0x7) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) recvmmsg(r0, &(0x7f00000000c0), 0x40000000000014a, 0x40000100, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) r9 = syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000059770c40c009030243d3000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r9, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000280)={0x40, 0x0, 0x2, "8558"}, 0x0, 0x0, 0x0, 0x0}) 1m23.056136086s ago: executing program 1 (id=555): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f0000000140)={"c14a7b741dbde86bb2dbb521a2b07e9566639c2cf78df8255ff0815d223546e2", r3}) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f0000000a40)=0xfff) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x4, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x1, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0x4, 0xffff, 0x2, 0x4, 0x2, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x2000000c, 0x4, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x1, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xbc, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (fail_nth: 1) 1m22.799308614s ago: executing program 33 (id=555): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f0000000140)={"c14a7b741dbde86bb2dbb521a2b07e9566639c2cf78df8255ff0815d223546e2", r3}) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f0000000a40)=0xfff) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x4, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x1, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0x4, 0xffff, 0x2, 0x4, 0x2, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x2000000c, 0x4, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x1, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xbc, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (fail_nth: 1) 1m21.461433971s ago: executing program 34 (id=506): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(0xffffffffffffffff, 0x6a, 0x4, 0xfffffffa, 0x1f) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e1f, 0x3, 'wlc\x00', 0x0, 0x10000004, 0x5c}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) unshare(0x22020400) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockname(r4, 0x0, 0x0) r5 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SOCK(r5, 0xab00, 0xffffffffffffffff) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000007c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000800)={'wlan0\x00', 0x0}) recvfrom(r7, &(0x7f00000002c0)=""/101, 0x65, 0x10000, 0x0, 0x0) add_key(&(0x7f00000013c0)='big_key\x00', &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000380)="5b0ff16ad744051529a66c3802de290d57d2", 0xffffffffffffff17, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r9, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000600)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010a2dbd7000fadbdf254f00000008000300", @ANYRESOCT=r11, @ANYBLOB="50007a801ceb020e00abeb5e61404fd781bd11d76c2cdb854a6cdf1b4e3f586a0c000300d7ab9f15d39c9aea59811ace37cd6ad04eabc0c60577f6609f8bad3ca6f0984d279774bd80cc58f306680856f013a5858021a637a0115607d9d85857643e218913425b4df0b188580e0667bcc8b5d36028a4c264faf1a3c69ac42672af97c5c096d897ae9da4fc3d27f6f19cdaa171248ccb5f7534f238e24fa11887e1e0663e3b552c4e08d7babcb4d86e78057bf8a310cbe870dbd37f10ae03f0ca4e"], 0x6c}}, 0x40004) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="000229bd7000fcdbdf251700000008000300", @ANYRES32=r12, @ANYBLOB="0c009900f801000008000a00060008021100000000000a001a000802110000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40c7) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e1f, 0x0, @dev, 0xfffffeec}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@timestamping={{0x14, 0x1, 0x25, 0x8}}], 0x18}, 0x0) 13.942496525s ago: executing program 6 (id=746): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6c", 0x2d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80", 0x63}], 0x2}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/67, 0x43}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x2000) r2 = socket(0x10, 0x803, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x0, 0x7ff, 0x33d4, 0x0, 0xffffffffffffffff, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x0, 0x6}, 0x48) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="580000001000370402000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="83040500000000002c0012800e000100697036677265746170000000180002ff07000000fc000000000000000000feffffffffff090001"], 0x58}, 0x1, 0x0, 0x0, 0x4009004}, 0x4040004) 13.692590179s ago: executing program 6 (id=748): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109021b0001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, &(0x7f00000002c0)={0x14, &(0x7f00000001c0)={0x0, 0x11, 0x89, {0x89, 0x9, "e6cf94072b89cd66eaa240eb3ad0f6977155d58fcc2d9bdedcb1f1cf362a299f6e4285ba32e736af66893dc4a3c4fd7f426ead297c68458393f4a0ef13a9fbc4934b5a29612433e2f50b5609514960b9a82532659d1e6c342aa12d0077688fff0b1ff173eed156f372040388e70fa1bfde40ee67fba51c7581f960b669b98d9c321b7688ff2a1b"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x43f}}}, &(0x7f0000000580)={0x44, &(0x7f0000000300)={0x20, 0x14, 0x33, "39d3bcb3f539a5120d9e149c1cc18577c29820581ea4302d831dafe32cefb7c7cd7b7bbde1c2c91e07a75210df1dab99632e0a"}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x45}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x6}, &(0x7f00000003c0)={0x20, 0x81, 0x1, 'p'}, &(0x7f0000000400)={0x20, 0x82, 0x3, '|\nW'}, &(0x7f0000000440)={0x20, 0x83, 0x1, "19"}, &(0x7f0000000480)={0x20, 0x84, 0x4, "59f39966"}, &(0x7f00000004c0)={0x20, 0x85, 0x3, "8a3cba"}}) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000040)) stat(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000100)) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f00000000c0), 0x8, &(0x7f0000000180)) 10.527814103s ago: executing program 2 (id=751): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400df0325010ebc000000000000008000f0fffeffe809035300fff5dd0000001000020008000140040000006da2898e", 0x58}], 0x1) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, 0x0, 0xf2f2a21bddaf39ea, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x40}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x8800}, 0x4044800) r1 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) r2 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE(r2, 0x40084504, &(0x7f0000000700)=[0x2a]) socket(0x29, 0x6, 0x0) ioctl$DVB_DEMUX_DMX_ADD_PID(r1, 0x40026f33, &(0x7f0000000100)=0x808c) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r1, 0x40026f34, &(0x7f0000000040)=0x808c) 10.444712659s ago: executing program 6 (id=752): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000200)={'wpan1\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r3, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000fc0)={0x1c, r5, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0xd1}, 0x8004) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, &(0x7f0000000040)=0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r6, 0x0) ioctl$KVM_INTERRUPT(r6, 0x4004ae86, &(0x7f0000000240)=0x4) r7 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x8, 0x100000f, 0x9, 0x0, 0x1, 0x0, 0x2, 0x87b, 0x2, 0x0, 0x0, 0x0, 0x6, 0x6, 0x1, 0x3], 0x0, 0x8340}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 8.113306045s ago: executing program 4 (id=755): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0x22}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000000000005f0600000000000095"], &(0x7f0000000040)='GPL\x00', 0x5}, 0x94) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r1, 0x20, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x2c}}, 0x40031) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4c050}, 0x44004000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[], 0xa4}, 0x1, 0x0, 0x0, 0x24008085}, 0x0) r3 = syz_open_dev$video4linux(&(0x7f0000000000), 0x7, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r3, 0xc0845658, &(0x7f0000000040)={0x0, @reserved}) r4 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000002c0), 0x42200, 0x0) r5 = syz_open_dev$media(&(0x7f00000000c0), 0x3, 0x800) r6 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc0287c02, &(0x7f0000000000)={0x80000000, 0x0, &(0x7f0000000100)=[{{}, {0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r5, 0xc0347c03, &(0x7f0000001280)={{0x80000000, 0x0, 0x5, [0x8000, 0x348f]}, {r7, 0x0, 0x4, [0x7, 0x1]}, 0x2, [0x9]}) ioctl$MEDIA_IOC_ENUM_LINKS(r4, 0xc0287c02, &(0x7f00000003c0)={r7, &(0x7f0000000300), &(0x7f0000000340)}) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4e20, 0x101, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3c}, 0x1c) 7.102147269s ago: executing program 2 (id=756): syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ptype\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000700)=@file={0x0, './bus\x00'}, 0xfffffe77) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r3, &(0x7f0000000100)={0x20000014}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x5, 0x8, 0x5, 0x0, 0x9, 0x0, 0x2, 0xfa11, 0xffffffff}, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) poll(&(0x7f0000000140)=[{r2, 0x2141}, {r2, 0x1}], 0x2, 0x8000004) recvmmsg(0xffffffffffffffff, &(0x7f00000051c0)=[{{0x0, 0x0, 0x0}, 0x40}], 0x1, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[], 0x64}}, 0x0) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) r6 = socket$kcm(0x10, 0x2, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000280)=ANY=[@ANYRES16=0x0, @ANYBLOB="df4800000000000000000c0000000c000380040005"], 0x20}}, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) connect$l2tp6(r5, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r5, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c0000004400090000000000000000000500000008000200", @ANYRES16, @ANYBLOB="ca20419e9287a26425a3486c7d5c56d9a49e036c611573cbe4ed30384af023a533c889458b311204cd89dc21eae6569404bcfb2a41a5983f487cbbf5aea686925bd96a79d6211f51a403f7aaed329bb6591f038bc33b6279270e1228dd070a9e5b4bebfce822a49c1fe3302c59bb1c88306052d48f3a5617e33c0dd5e71e805973bc70e0b896a6484ddae36ba04b3f176bacace18938310680947990d515cb164bff4e2667e5f1854b99c90ac73805e140b441"], 0x1c}, 0x1, 0x0, 0x0, 0x1041}, 0x4000044) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000ec0)=@raw={'raw\x00', 0x8, 0x3, 0x410, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x340, 0xffffffff, 0xffffffff, 0x340, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0x0, 0xffffffff, 0x164d2c527ac5db29], [], 'team_slave_1\x00', 'vlan1\x00', {}, {}, 0x0, 0x40}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @dev={0xfe, 0x80, '\x00', 0x2e}, [0x0, 0xff], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x2b}, 0x0, 0x230, 0x270, 0x0, {}, [@common=@srh={{0x30}, {0xd1, 0x8, 0x8, 0x8, 0xf, 0x4c, 0x400}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x52, 0x1, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x4, 0x1, 0x9, 0x9, 0x80000000, 0x5, 0x0, 0x80000000]}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x470) r7 = socket$nl_audit(0x10, 0x3, 0x9) io_uring_register$IORING_UNREGISTER_PERSONALITY(r1, 0xa, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r7, 0x8993, &(0x7f0000000080)={'bond0\x00', &(0x7f0000000780)=@ethtool_per_queue_op={0x4b, 0xe, [0x3, 0x2, 0xffffff38, 0x5, 0x10001, 0x7, 0x10000, 0x2, 0xd7, 0x627, 0x6, 0x496, 0xca81, 0xffff0001, 0x343bae66, 0x8001, 0x10, 0x3, 0x10, 0x65d, 0xc, 0x7, 0x3, 0x5, 0xffff0001, 0x5, 0x3, 0x5, 0x6, 0x4, 0x8196, 0x9, 0x5, 0x4, 0x7, 0x0, 0x6, 0x4, 0x82, 0x7, 0x10, 0xfffffffc, 0x81, 0x4, 0x1000, 0xf1a0, 0x2, 0x3, 0x9, 0x1000, 0xd5, 0xffffffff, 0x2, 0x6, 0x8, 0x1, 0x2, 0x7fffffff, 0x9, 0x401, 0x0, 0x9, 0x5, 0x6e9, 0x3, 0x1, 0x80000000, 0x7, 0x7ff, 0x3d7f, 0x4, 0x9, 0x9, 0xffffffff, 0x1e1, 0x3a, 0x6f9, 0x49, 0x3, 0x80, 0x7, 0xe, 0x2, 0x3, 0x1, 0x5, 0x8, 0x3, 0x33d24a43, 0x4, 0x3, 0x1, 0x10000, 0xff, 0x80000000, 0x10000, 0x7, 0x8d758ba, 0x9, 0x2, 0x2, 0xdb73, 0x3, 0x1ffe0, 0x6, 0x8001, 0x5, 0x10000005, 0x5, 0x8001, 0xa, 0x8, 0xa0000000, 0x7, 0xb1, 0xc, 0x3, 0x7, 0x6, 0x8, 0x1, 0x100, 0x7, 0x5, 0x80000000, 0x9, 0xfff, 0x1], "ca5e310220d82ef162ed4f96269a84803e1dde7f75c063a687f567dd9dd687987c73898d3fd5cd31748794f54333a3be74f7b0cc5cbc3012f6b5c4c7d427b867c1044c5ca898a2e203545ee5b4593fa8b79fd31a02283a12f8115b25bf4463773b4ae297664fdb69a6e131d333389fb3784948d034c2544a93ad0aa913d78a4c117c2af6cc0a793e22356ea8233a7fddc50c6897e8d6f48b9fa8f1cda541a0b76b4555eb491b68c6594762ee35f1b507d9e23a2d22160e84f748b41bcf810b5dcaeb076c649688f617a589aa"}}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r8, &(0x7f00000004c0)=[{&(0x7f0000000340)="a0", 0x1}], 0x2be, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) 7.034085765s ago: executing program 6 (id=758): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x7, 0x20000007, &(0x7f0000000280)=ANY=[@ANYRES64=r0, @ANYRES64=r0, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESHEX=r0], &(0x7f0000000080)='GPL\x00', 0x0, 0x29, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x1}}}) ioctl$VIDIOC_QBUF(r4, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x3, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000001c0)={0x10b8, 0x5, 0x4, 0x0, 0x7f}) r5 = gettid() timer_create(0x2, &(0x7f0000000040)={0x0, 0x1c, 0x1, @tid=r5}, &(0x7f0000000080)) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/bus/input/handlers\x00', 0x0, 0x0) pread64(r2, &(0x7f0000000340)=""/105, 0x69, 0x841) write$snddsp(r6, &(0x7f0000002040)="e8c5b4df9b4af4233e03b9169360df00f52105b1a4f62dd0e48eaf72d127b14e416ffe5d2704e038c891d791668f17c8e8e783c800000efa73f7a99c6207efe95fe4de602f558696cac9359434a19243b19b259daa6ad364bb21a22d6c8f37328a78d4e20addd05a372be03b894e4c889354df4a4efb3199e129d0863bd53785d6d34e745988a5bd4781767d7ce2dc3657cccf62b0df050edc9176998253d641791db5df56bed9d41ec659e9ceb46d73b17014986def11c88d9afadaeba6822236251c6db05ba84ea6faf080920ea14ecf40aa2249948844e5afab7b1f00eece43fa32c94522c7aa00838a2efd27caa71a261d91cb4ab150edaa8e3c39032fee69b948832f35c0f1f5df518bccd2db47ca885965e12b0fa36c7f544119f43dfcaa80618e7d069d3408b7f273143d54c9c8cbe1bff7c49910b8d7c5e7364eb17ce3530ff1398c651c81b0348234097591863c5969e6777423f792e6d80496c1672e79b2a27dee79a2b54a388dfeee25d53a897fd9d154aeba5ee28a166a832bea3af4716ab0b1be444ef8994d3dca21df5080f296fceaa288772d91150ade6bba029d40a690d12221aba9d4d30f64905690d793c8ed8c9236ab2f771f27dcc5df4afa69ae3344711e00651b05ef1b393409297ae18da450c3b1fce3ae6cc4a1ad12b5390ab609729a14aa7cca027c510d414e1f944740f7367d1fdccf6b4e6dd626b83fe14781f84051a069b0dbac5868321e1ae17615817ede90d3ce1f96dafdb3d41d664756d74604aa987ff47e5ddb974d4a1f68f71476008c4e9e614e04b06c0be5ef36731b0809dce1f1d105a22fe348bd10226b38a5f6ad57b0e142b55d563a1bf4b3db9bb227b1a87a39e497b788332b5699aabe5e3165bd09b4af3d664439e6a6ddb28d774b3674f0a6814b14d1bdbd726abfab313bf894fc552cb480c42fe121eb83816c52acc2c6b79d211c55273aea116436de424dd7406246971ace64b99da5bde7c9628c6b016d746458342944b8a964de5248d0eb57db27a00f07589dd36932619845287a5f9148fbf87ae218eaeabb174e2c8a44fe1ed8bdca2bf62e7653211515fdd608aa84d9c21f473b51add0594a86da4c7b54565ece8f8d4e8bcb3d1f642778ce1165ddc0e4a93d5df766fbcf9abdf5b026b87fe24ca0d6ca1790412fa114fa8abb4bc52bf51ed68a9db139e8c408b398191af401f30be82cccec45e25d2e8547392382bd897fe5afa0fd1fc37f07317bf3c16f76e14138e9c1a85d36dfc61523d9d1460879053126f8dd6b77c2454e111daa3f58fe2f68e1aef6fecfdb2ce2707bc905cabd3abd1d99c89960a678fe3985c65c7804509608cab7d98b06eb297bdbd52f871cd2a44e3e8bf2547845aceda3d684995e9e4ca594f56968a92d4ae11e2921fc06f190f9ef99be0bbbd8c5d63e853efc02fd96bb88a9bb0dddc3f8005e5362af2e4da2bebf1b03e557c14575f6308649b80c19b1e985f242774bebf5526b6f9092d8b8072f186f8de315245b7d7d297e6ef75f7667ad706e6aaf68717a2834d1f08eeff65e5fd139661e33d65a279932011cd7156be433322816a91c49f5c74d692529020d4301c6613bbe581658ba5dba3d540216e854f70983b2cafbe740cd52788f83092aa071ace05364c13a204bb8e51117162f51877fcc223002efb0e187e27825f1d0623775d1da39205d0bbb281475d9124da33412ce2aa7b3bfaaf4308d83c25f636297e93851e68490846cee610b8af51b3d7fcbc47b20de4958d0ad305c0917feb4159ae425dfde7456d67dcb21711bdb1d3f780d85879cf5235f195825d0a59a0df1eb2011cf40c19afacafdb25c5c64d9eaafba4eb17663a5eba1ed365e6993ead095bf1bd64c2d92109f9a3156db994bd025283e9fbb0fc52577e9d97760526988bd963aac709800f19c1b841d6cb180e64f63f53c81de005c51485829c23c3d7db802632570a05395ddf774b5cd4a6266eed90acfbef3199e07f79a4c6912b7eeb5ff33d8827bc98c6d2943a6134a5a4285a66b0eaf8766166a8f6faec94f17159032653b4af7f0a3ed6f0e441237b3c065fa19135da31a953a0dc315d73210233b43491d6823368c366877456bbd99425eff5b2ab7cb98fd71208803686092ffc41ad599cb1da2560015120b0016ce90427c54a0a8e43f14103ae9ba39b43bc4b877460b4ef96e28b0b060ef887f2514dd149beca46f49b7cc6e4bf0e74eb951305ca7f187fafd038aee92ca53d3fc93fddfa13aff6e2a99022f9320f099a507a9ebff7c25f90cc8220da462201c5f464cb5979900d3482f3f3fd944396f97d8a894d8eb6c0727b9686bfa41aeb57eb5c8a3f8b591e030e66e95fea3ce3dd8467b1335874de8718796666e02f9da80229e1d71ae01b74db91b5c1fa206e584c161b97cc53649b9673342a5da93fc81402c394eae3012455ac917721c8714fe15fb24532f6c1700d4d28f10dafd2b291aa6ee0d4504a8f08905c5eb80700b2e4622b1631d65d81751e282389e33bae812cce74ad8887bfe2938783a03dc634d43621db675feb49f67288514fb07dde94d92e21efacaf9ed9eb53372c053eb160f4c2efb207c29db3718d7f8400c24ce8416ac7d853bdfcbab34e6f8a9c808e8977823bf7fae5544a76523a1aefc0dd91d142f739c714859262048dd4afc2d0d4b665d85d75a9bcd122cf29b35a8125a4692f6454e4f11f3c9a69ec963d598851374e47a45e323f0cf819febda3c190dfd6fbab3f197120de9716fdecf5563623db9d9c9e14702a8ead49f7a8c5486ccd32456f5fea437a50bb08b6b6816d07a39438f5fbf4e84a722513dcc4066ea7aecee06f4112285b607cc6ddb7aecb51ade19dac690c0ce355eb2486cffcbca4db4ed8dc013a4cbee81e1523001ed4bcf7844312295cf781fec9946bd4d3b8f23b33e7b3113181849d975ec9beb2d18002591dc00871e018524072d79dd7ded2d740fa859b3ec15264d58a1db60a19f24929eeb4549a2dd36cbc046f1f9bf96982a13cdc46863ed6955e24ededb6337d191955b3ac196e07109d6813766c92241ea60024a2a47a452998078e3828462648ba33ae8cd494c157db738691d37d22b82f3151f79b30ebdf3ff14c0dc74e220b7e96e36d8eaa3da30f615d2feebb4a9aef25072c9b48f31e829aee4b3fceb5e7467fd426206ccf00d77aacd191d958543dd3b44f09f7e6b16b850e19b7d3f31f600248d41f9940d4c6e3b6fd5546cd8b9fc8a88c8470d8750bbd1ea72e44f8bae6d6a52f65c5e3221c3862cc4fd6f8bfcb293df53a715d3e8030b63456139a41fd792ab9d2b19ec1b6985c699175732a7139f2104300f8a8aeaf3ade9e9ac334f2672c5be8b036709cf903f0e1a89b1f079e9c3cdc5a1076e44fb4ace5c0ddafa48c942c21c025592dbf74ae5b84d856374b45505bb847f273d49418b52df318e195b22c75323dc6b7178b8f0a752e67a3720bf24ad15f74a64b0e231251f69a4a6b295cecff8b52216a0c3bce94dff35e65c0ba82144c9fa78d45fce2cf900100c7828cd6582a15edbc4e48cc55632f16aad4c9174f99597ac410ea3b1a2a9fa2757802814904decb6a32b1eb48b3da0b0b3152554077d7ebc4c0ac538b7aa9192c66ccfcbf0f75cf0355d3ef9b022b0056368f62d026ae3ad2eee439477a9ce8b11532dd74f372426d04cc92fdb259325cca3cd22e120b98845ffb34e31364c82da2fe1d3666d3cd356f378b3376020dde6866a897a84485b00912d59ea01f6229c7e9346e48ea0b50148855d80c0187679dd5bda65dcca7e76e278fdb9721740743b740640a88654b627bf787f544036720f0edd7a70340c4cd95a8fcce585667d696201e3e0b89056a9a2c8be4a7c716a1bf8bb394d9870f47b27f3bbdf9590211ea189924da07cb03a29f16de3601257a27072b71c21d6bf4768ee2ae2d52b537b96de8a774dcf155e4575dd259c1047d13436d1834d01767f9f00d542260fe78b00c82e3773938f4af67ae2669de20590215ffdd9200bd4e8592a57258aae47c56ec21e0fe28e7a480bd91aba860acf02f2ab4365ef74076bc90960d125b8b30d9d62302e8ff4f81a542027ea33d70aa277ef5bb6290ebdc9d8c83fe6ce8b2fdde3c9bc9c48ce88c48f9de4e6b48a01ef26a819cd91ac1846a9be02a098aa21160874c781454f450ff9cf306185b661796c8390cb927a029f116babcf7ab3fc309b11448440c44c5af3e341bc5f6f2a4b2e04095224b4db2406afa3b99246b42c37fb11cb288fbada3474791f5349e626d92508ba8aeabd3b8c0823fcfcbc351ef6934e238d9a8fafeebbd5a51af6eb7728abd6d4dbfdb2478465de81cb4fa515a02cecf399edc43269ed000a29831a90ad449129b048f35e77ef7af272150bd2f5a3005bb4e5ef61aeb05d489038fad93a6758b5bc239c1dfaad8214e2de8af71683f92f1b939f252055460181d8ced861a4e0aeebdbffbd530bcab87cf944da6d67e7b8a75f6cfcc288ebefeb32f3260ae5349f4977bdcc590746b371c5dd2fc775e03ef362f9e27684e496c5644eef39ea95800a8b4ff85e2b067de35fe6434cd2f1cd9ee96d7b5348cbccac603a67ba15968ddf40557ab4dee537defcedbd921392aa0825fc6082866fbc2f0b240f069dd7db4a9f7232d7eee6905fc8855a2d1acd8f0e41127cb30c5d64326fcc43fb71048230d973e93ebaa15b0b975f4e790b8b8e6531a6540f43af5af3356b9dd1d97984638e69ec2624cc959b4aa1bc19409231a560821c4fe5d3db05cab87b45acbf2131732c5750d9923274e3b390b7c4dea585d182e293d8d31f2429afbf2ee806463092133f25f5976c106964cea090dc54427a26f5373571679b828965396a4108c37c47c6271aae759d33f861e929f5162ec4bfc8a573c2cdbd41c8d0da0adbd0b2fbcec2ebd656094e7971ec516919247502a5a31985153955ee025e33a8891adb5cb24643922e9a58dc3d1d3076b2de5c6805e51799c599c1e0eb1366abe02456216ca61e8426076651222d84ce1e1d2a8fae6c02084f6b47c041f1ddbee5600910e123e85fdcd7172e9f675540f544477c3467cd7f7700ca35e38e52825eb0424056ac03b3fc42a1a862a298e2a5a2141e689d60a04320de81717ae121fa1d1c639b0f2572e1cf983ae8ae0e93d04cbbc0221b13267eac285f5adc3c8d98baa237180747715a9e6ec93f4feb1adba034f5c57c2c2500c0ef2af9111332b98c9c35d89ee5b228e47ca6557e083ac6f5edb2ddf67684623eae980c32c941deb13acae2ba762888a4ac4839df53d43af6635220ef1731d7d8e21d51d3913117040074c0f9afe33e923299c96fc51a603179475974cf2e821acc4b0248026516fc5619345fec5e4c375f9e0fb38947e9d4874f04e22b021bec6bb5405b17194f28a87a880d98088533cb2d048ec4ce8b8449778b356cb42c89385295597debced5859df6e845b2b756fcb8f375a1e52c66d63fa0d832736f2c4ec5b8684070bdef418751408b4730a3e863db9e94afb0085f2ee04f1c83d6133e647ee41f121600262faa61d6b481894488add3e8c81bfdec488c284af7cc4dd4da671029659e3f2f9de1eba1f9bb9b0b90e61251a6645fed1e522783b88d2eae34219a2bc85cf8691a0a2ecf09b7d7216228c3f6a8e66483bcac75924947adce5b0767c7591b6b89769146e5af9ee84147ecf2636e86597e276af72f214ad914bbfe03da062223adc10e818e7da41f4ec4adec72f87b44c116e1", 0x1000) mremap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000003000/0x3000)=nil) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r8 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r9 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r13 = syz_ublk_add_dev(r9, r10, r11, r12, &(0x7f0000000200)={0x2e, 0x0, 0x0, r8, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=0x0) r15 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r13, 0x2) syz_ublk_setup_queues(r15, r14, &(0x7f0000000700), &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5, 0xed}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9c, 0x0, 0x2, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x40}}], 0x1, &(0x7f0000000900)={0x2e, 0xe, 0x0, r15, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, &(0x7f0000000b00)) sendmsg$netlink(r7, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc00455d0, 0x0) 6.838414339s ago: executing program 4 (id=759): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01020301090212000100000000090401"], 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/slabinfo\x00', 0x0, 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000200)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xe1, 0x80, 0xa, "", [{{0x9, 0x4, 0x0, 0x10, 0x2, 0x7, 0x1, 0x2, 0xd1, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0x2, 0x1, 0x8}}}}}]}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x310, 0x7, 0x0, 0xff, 0x10}, 0xd9, &(0x7f0000000280)={0x5, 0xf, 0xd9, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0x8, "e90aaf10a0e61955b20bb5af66235dee"}, @ssp_cap={0x10, 0x10, 0xa, 0x10, 0x1, 0x1, 0xf, 0xfe01, [0xff0030]}, @ext_cap={0x7, 0x10, 0x2, 0x12, 0x2, 0x8, 0xd}, @ss_container_id={0x14, 0x10, 0x4, 0x40, "cc288d61baf6ab78a278c7a9d9bea54f"}, @generic={0x95, 0x10, 0xb, "f7f8839ebf3c70c34ae8f85e381a2240055ac919eaf7cd4360464c2ef3ac49578c632f53e95600435761f47f2b64e4247c7d0380ddd3dfb41a2865f1a28ae32118c4da256f37e87111cb4ff6ee8bd1b3e11c271ceea162b141c4a934ccb7605c472bfa9215a6cf655f254916f9600eb56fd2fbb86927744257d41fda51095416f1ca1cf7d31b60ab8134ee37bc90c0acb4df"}]}, 0x2, [{0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x44d}}, {0xe, &(0x7f00000003c0)=@string={0xe, 0x3, "9d06b744639af49134992041"}}]}) pread64(r1, &(0x7f0000002240)=""/193, 0xc1, 0x8d35) write$sndseq(r1, &(0x7f00000000c0)=[{0x80, 0x0, 0x5, 0x0, @tick=0xfffffff8, {0x3, 0xf}, {0xff, 0xf4}, @result={0xffffff60, 0x6}}, {0x1, 0x81, 0x0, 0xf0, @time={0x7b21, 0x3}, {0x8, 0xf4}, {0x9}, @control={0xd1, 0xfffffffb, 0xfffffff7}}, {0x8, 0x5, 0x0, 0x9, @tick=0x7, {0x1, 0x6}, {0x0, 0x5}, @addr={0x6, 0x1}}, {0x7, 0x8, 0x1, 0xb6, @tick=0x8, {0x6, 0x5}, {0xd, 0x62}, @control={0x3, 0x6, 0x8001}}, {0x7, 0x3, 0x2, 0xd8, @tick=0x9, {0x9}, {0x7, 0x81}, @note={0x33, 0x4, 0x9, 0x59, 0x2}}, {0x10, 0x9, 0x0, 0xc, @tick=0x80000000, {0x0, 0x3}, {0x6, 0xfe}, @addr={0x61, 0x6}}, {0x7, 0x8, 0x80, 0x3, @time={0x5, 0x80000001}, {0x9c, 0x6}, {0xa4, 0x8}, @control={0x3, 0x8, 0x3}}, {0xdc, 0x0, 0x8, 0x8, @tick=0x6, {0x4, 0xe}, {0x7, 0x3}, @raw8={"bb87e5ab744713cc6f3614a4"}}, {0xf7, 0x6, 0x9, 0x4, @time={0x0, 0x4}, {0x3, 0x8}, {0x2, 0x3}, @connect={{0x2, 0x7}, {0x4, 0x6}}}, {0xd, 0xc7, 0x6, 0x7, @tick=0xfffffffa, {0x80, 0x91}, {0x7, 0x3}, @raw8={"e584f0cdcac15295e9e7141e"}}], 0x118) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000000)={'icmp6\x00'}, &(0x7f0000000040)=0x1e) syz_usb_control_io(r0, 0x0, 0x0) 6.128122537s ago: executing program 5 (id=760): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) writev(r0, &(0x7f0000000300)=[{&(0x7f0000000140)="2e9b3d0007e03dd65193c6103e75963f86dd", 0x12}, {0x0}], 0x2) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000580)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000000)=0x1, r2, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000480)={0x7, 0x8, 0xfa00, {r2, 0xa}}, 0x10) r3 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x0, 0x0, 0x3631564e, 0x0, 0x0, 0x0, 0x0, 0xfeedcafe, 0x3}}) 6.067180553s ago: executing program 6 (id=761): r0 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x86c42) syz_usb_disconnect(r0) syz_usb_connect$midi(0x4, 0xab, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x4fa, 0x4201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x99, 0x1, 0x1, 0xb5, 0x10, 0x7, "", {{{0x9, 0x4, 0x0, 0x0, 0x6, 0x1, 0x3, 0x30, 0x0, [@midi_in_jack={0x6, 0x24, 0x2, 0x2, 0x20, 0x6}], [{{0x9, 0x5, 0x3, 0x10, 0x3ff, 0x0, 0xc5, 0x7, {0x10, 0x25, 0x1, 0xc, "608614972749cfbc7bd2d957"}}}, {{0x9, 0x5, 0x1, 0x0, 0x8, 0x3, 0xff, 0x7c, {0xe, 0x25, 0x1, 0xa, "dd0fa7f4dc0ce85afdd3"}}}, {{0x9, 0x5, 0x3, 0x8, 0x20, 0x8, 0xa4, 0x3, {0xb, 0x25, 0x1, 0x7, "f1cd797fb392eb"}}}, {{0x9, 0x5, 0xd, 0x0, 0x10, 0x5, 0x3, 0x7, {0xe, 0x25, 0x1, 0xa, "f9e6fb8bf85265486b36"}}}, {{0x9, 0x5, 0xc, 0x10, 0x40, 0x10, 0x8, 0x2, {0xe, 0x25, 0x1, 0xa, "31ea92060764c55801a6"}}}, {{0x9, 0x5, 0xe, 0x0, 0x40, 0x0, 0xb7, 0x77, {0x6, 0x25, 0x1, 0x2, "c19b"}}}]}}}}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x110, 0x2, 0x9, 0x5, 0x10, 0x4}, 0x8, &(0x7f0000000240)={0x5, 0xf, 0x8, 0x1, [@ptm_cap={0x3}]}, 0x7, [{0xae, &(0x7f00000002c0)=@string={0xae, 0x3, "9fc6aff22fa252ef02d98ba1f39d2c8284cc61ee713fd76112dc4e658dbe575b2bd4046a434ceff9cfabf6a5c21b3f407239e2b4c54050b5dad68e494ad1af2a2cdc2be7cb4ba46decc6209abd998c056c7ab4d7aca5c6a969eb4c9e9c223c53f24444abe6b53a96bdbb76dd65625a9a1225318034b6df66b20dce9311a6c5588bb41f81649d890b218444d2fe5d68177affe3db2490a2b78451ac83506d841945d4872e6f72a708355ca927"}}, {0xd0, &(0x7f00000006c0)=@string={0xd0, 0x3, "759989ea8dc7a09cece238814322fc028f76976e9ee0022a1ac7898ebba70dfb70983d2d92dfac8908f844c77f368d212f79cd50ef6ff2f2526f408f5c47c3e87ea408c342eab803e6382a2debe2fc576a0ebbdd970a8670caddf0602b47f128a694f1a0569c7b883e395e1f61d84104799ae7e97e5ff9b5b5216298c95cdb21dc7f853ad4816cdfdb895a8eeff93a731f911b0f92649794f8f44934055ff80ffb0dc374b0e4e7e8db82588665a67fb7ad9a193833b95dd0b2bb081a6ffc94baf89e3ac870982903fb3be7063b1b"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x436}}, {0x93, &(0x7f00000008c0)=@string={0x93, 0x3, "0af3972623c6dfa229aa72a1d1ffde6dba887b9f456e81815f9c1d1616db4bad5b646bc411f3cb0d69b77f9866df30f4d63846d9523ab0ddb588f1139b1aa0b19446b55dca75d5129332cbd1e7250bb500c03404a4ea9d0c30ac9af74add9e5aa2d50a77ce6236ef670346a59e04e6d55d49d135cef4ba1a3e7e8ac450b160b73b3ba6c4f5784a103f4122a31892a2e1a5"}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x280a}}, {0x75, &(0x7f0000000580)=ANY=[@ANYBLOB="7503cae1d9832c2a717dd5461722bc33f247c1af6bb459aeb39ac16884df7292b424ae7730389528898a3a870968ef7e94d14667b3b47bab19de3c5968eeb3216460d12debe75d6dc49f75633242ed4bb0b9ffbebeee3d65c69fe6c1737c76f5b3e72b4b199b"]}, {0x25, &(0x7f0000000600)=@string={0x25, 0x3, "3a1f1849c671ca2768f49d9eb5a6ff6aa7fa1c13d2c208a6e97162d58b72ba2388fe42"}}]}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(0xffffffffffffffff, 0x7b1, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r1, 0xc0305710, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f0000000880)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x48, r3, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_SECLEVEL={0x5, 0x2a, 0x3}, @IEEE802154_ATTR_LLSEC_SECLEVEL={0x5, 0x2a, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x2}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x800) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000000000)) r5 = syz_open_dev$sndctrl(&(0x7f0000000380), 0x3, 0x40) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r5, 0xc1105517, &(0x7f0000000980)={{0x7, 0x5, 0x7f, 0x3, 'syz1\x00', 0xe}, 0x1, 0x200, 0xffffffff, r4, 0x7, 0x1d5, 'syz1\x00', &(0x7f00000003c0)=['/dev/ppp\x00', '+\x00', '802.15.4 MAC\x00', '&+($#{\x00', '\x00', '[-(+\x00', '\x00'], 0x26}) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x3, 0x40483) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) ioctl$VIDIOC_DQEVENT(r6, 0x80885659, 0x0) 5.912162959s ago: executing program 5 (id=762): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = msgget$private(0x0, 0x0) msgrcv(r2, 0x0, 0x0, 0x2, 0x3800) syz_pidfd_open(0x0, 0x0) pipe2(0xffffffffffffffff, 0xc00c0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r5 = socket(0x10, 0x3, 0x0) write(r5, &(0x7f0000000080)="1400000052004f030e789e7ee2ce2fa4ff612d27", 0x14) recvmmsg(r5, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x344, 0x10122, 0x0) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r6, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick=0x1f4, {}, {}, @raw32={[0x2600]}}], 0xffc8) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) write$sndseq(r7, &(0x7f0000000280)=[{0x1e, 0x0, 0x8, 0xfd, @time={0x7ffffffe, 0x4}, {}, {}, @result={0x1f00}}], 0x1c) msgctl$MSG_STAT_ANY(r2, 0xd, &(0x7f00000002c0)=""/99) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000701feffffff00000000017c0000040042800c0001800621060090390000100002"], 0x34}, 0x1, 0x0, 0x0, 0x4000895}, 0xc000) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, &(0x7f0000000140)=0x5, 0x4) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000000206010200000000000000000000000605000100070000000900020073797a3000000000140007800500152a9900000008001344fffff8000500040c000000000500040001000000050005000a00"], 0x54}, 0x1, 0x0, 0x0, 0xc040}, 0x40800) r8 = syz_open_dev$sg(&(0x7f00000000c0), 0x6f5e, 0x2) ioctl$FIBMAP(r8, 0x5381, 0x0) 4.923345954s ago: executing program 5 (id=763): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) r1 = syz_open_dev$vcsa(&(0x7f0000000380), 0x7b95b611, 0x802) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0xc0001, 0x0) read$nci(r1, &(0x7f0000000440)=""/247, 0xf7) io_setup(0x5, &(0x7f0000000e80)=0x0) io_pgetevents(r3, 0x1, 0x8, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0) r4 = openat$random(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) io_submit(r3, 0x1, &(0x7f0000001580)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x7, 0x0, r4, 0x0}]) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r2, 0x40384708, &(0x7f0000000040)={0x8, 0x1, 0xd, 0x3f, 0x6, '\b\x00'}) r5 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, 0x2, 0x6, 0x801, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x4}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x404c884) sendmmsg$inet6(r8, &(0x7f0000000140)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4db, @local, 0x3}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000400)}], 0x1}}], 0x1, 0x4c040) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="540000001200010000000000000000000a00000000004e22fcffffff000000007ecd00"/56, @ANYRES32=0x0, @ANYBLOB="01953b961100000000000001000000004800030006010000"], 0x54}}, 0x20000080) 4.652328063s ago: executing program 7 (id=764): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f00000000c0)=0x33, 0x8) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) recvfrom(r1, &(0x7f0000000240)=""/202, 0xca, 0x40010143, &(0x7f0000000400)=@tipc=@id={0x1e, 0x3, 0x0, {0x4e24, 0x2}}, 0x80) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000ad4000/0x1000)=nil, 0x1000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x1, './file0/../file0/file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) rename(0x0, &(0x7f00000000c0)='./file0/../file0/file0\x00') ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)=ANY=[@ANYRES8=0x0, @ANYRES16=r3, @ANYRES64=r5, @ANYRES8=r2], 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x8890) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000680)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022dbd7000fbdbdf25120000000c009900ff0f000054000000050013010100000006001a01020000000800a400010000001800130001fc6cec045d79610fe8d329a45f01ee82c8019b"], 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004080) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x2, 0x80000, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="18000008700007017c80000400454bc3809c16a41f90fbee92eab16daa97009ddac4a08f3ab0104bd2397d6c0f00d0984090bca53beb75a6c269c5def5e1830000000000000000000000007644415f68ce6a1096df570ce4b6155527d375ccd33f27c822c7ff68e141ad7e78cd19f3ed9fe2019fa3e74f585baf14e61bf4e0582971e306b55935eb34368bf1f0f124422fe6def89c3ecc8cd89e1eb6e0223ad6f7d61e956b5febbfda264ac43d2b209ae758e30f4aea23757651fb7330511b40e14ca7cc6e102c923a789dbbac5f38f3bf394d53413477ba8f61dcd2f48c476f805e27309f8e8a38541efcbedb12d4fdea9102b50f8a91aad6a7dac732d2ddb416b42edccf3917d8ae15fae3fc328b3afe7c3b"], 0x18}, 0x1, 0x0, 0x0, 0xc004}, 0x20008000) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000700)='env\xe2:\xe1\xb0\x90e\x18]$\x91\xd6\x1e\n[\xaa\rr\xcah\xfd\x92\x11\x05A7\x8b\xbe4\xe0\xda\x95\xd4l\x8b\xe2\xf0lb\x15I]\xdb\xf0\xc0\xbe\xc2w\x938\xa0L\xbe\xa1\xcak\x7f\xf3Fx\xab\xe0\f\v\xaf\x01\x1dq\x15\xde\xc5\x189\xd8\x9aa\rU\xb2cwq\x93\"\xff\xd9Ee}t\xc3\xa9\x823\xd9\xa2\xe4\xd2|+E\x89\xb5T\x8f:ecY\x83\xe2~a\xd0t\xf4\xfeo\xbcW\xf0\xc9\x99\xb2%\xb2\xfb\xc9\x05\x8e\x82\xb3\v{\xf5\xb4W\xb8i\xe1\xa1\x88\x04j\x95\x12\xc9\xc9\xfd\"\x82\xf1\x82\x18(+\xe7\xb6\xfd\x9e\xd5\x1e\x18r\xc6WT\x02/\xe9S\x1e\x18z\xbe\xd8\xd6U\xc4\x8c\tQ\xfe\xd5\b2\xf1\xff\x92%\x9e\x84\x8e\xb7\x91\xf3)\xb5H\x03\xfc[QJ\xc1\xbbp)YZL%4\xa0\xb5\'%\x9d\xa6\x85\xb8\xf6\xda\x9b09$\xb5\x95\x82\x01\xb0\xdc,\xd1\xffXhQ\x8bw\xdb\xb1\x85\xddb\x9b*\x1a\xb4\xf9\xe1\xa8\xab/~\xd4Rc\x9e\x13\xfb\xdf\xf7\ag\xa4E\x92r%-.\x8b', 0x0, 0x0) r7 = syz_open_procfs(r2, &(0x7f0000000280)='oom_adj\x00') preadv(r7, &(0x7f0000002380)=[{0x0}], 0x1, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) 4.397778259s ago: executing program 7 (id=765): socket$packet(0x11, 0x3, 0x300) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) r2 = socket(0x2, 0x80805, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600"], 0x50) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000001080)=0x8) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000380)) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) dup(r0) unshare(0x22020600) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x401}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x18c6}, 0x0, 0x0) 4.242378031s ago: executing program 2 (id=766): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f00000001c0)=0x40) ioctl$SNDCTL_DSP_SETTRIGGER(r5, 0x40045010, &(0x7f00000000c0)=0x3) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, 0x0, 0x0) r6 = socket(0x40000000015, 0x5, 0x0) connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r6, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) recvmmsg(r6, &(0x7f0000001740)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r6, 0x1, 0x1d, &(0x7f00000000c0)=0x101, 0x4) sendmsg$NFT_BATCH(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 3.510949371s ago: executing program 2 (id=767): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) r6 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r6, 0x29, 0xd1, &(0x7f0000000000)=0x9, 0x4) setsockopt$MRT6_ADD_MIF(r6, 0x29, 0xca, &(0x7f0000000340)={0x1, 0x1, 0x4, 0x0, 0x8545}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x0, &(0x7f0000000380)) chdir(&(0x7f00000000c0)='./bus\x00') creat(0x0, 0xf2) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@gettfilter={0x24, 0x2e, 0x205, 0x70bf2c, 0x25dfdaf9, {0x0, 0x0, 0x0, r5, {0x0, 0xc}, {0xffff, 0xfff1}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x40000) process_vm_writev(0x0, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1}], 0x1, &(0x7f0000c22fa0), 0x0, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000840)={0x2, @pix_mp={0x2, 0x0, 0x0, 0x3, 0xc, [{0x8, 0x5}, {0xe, 0x8000}, {0x8, 0x8000}, {0x2, 0x4}, {0x7, 0xfffffc01}, {0x400, 0xf1}, {0x1, 0x6}, {0x9b7, 0x7}], 0xfb, 0x0, 0x8}}) 3.433567931s ago: executing program 7 (id=768): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000100)) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) socket$netlink(0x10, 0x3, 0xe) listen(r1, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) read$FUSE(r7, &(0x7f0000000540)={0x2020}, 0x2020) read$FUSE(0xffffffffffffffff, &(0x7f0000000540)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r7, &(0x7f0000002580)={0x50, 0x0, r8, {0x7, 0x2d, 0x7fff, 0x1100000, 0xb, 0x0, 0x8, 0x5, 0x0, 0x0, 0x10, 0x40}}, 0x50) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00001778290679f7cd967f88aeca0010004b04000000000000a80da2fced2db500007a000000", @ANYRES32=r5, @ANYBLOB="00f0ffff000000001c0012800b00010062726964676500000c0002800800080088a8ffff"], 0x3c}}, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r9 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYRES64, @ANYRESDEC=r9, @ANYRES32, @ANYRESOCT=r0], 0xfffffdef}, 0x1, 0x0, 0x0, 0x8004}, 0x808d) sendto$packet(r9, &(0x7f0000000400)="f47145b1", 0x4, 0x0, 0x0, 0x0) 3.432792789s ago: executing program 5 (id=769): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x200, 0x80, 0x20000, 0x0, 0x0, 0x8}, 0x1c) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000671000/0x3000)=nil) ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f00000000c0)) ioctl$BTRFS_IOC_QGROUP_CREATE(r0, 0x4010942a, &(0x7f0000000000)={0x1, 0x7}) r1 = userfaultfd(0x180000) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000568000/0x4000)=nil, 0x4000}}) syz_clone3(&(0x7f0000000140)={0x120006200, 0x0, 0x0, 0x0, {0x28}, 0x0, 0x0, 0x0, 0x0}, 0x58) 3.3164918s ago: executing program 4 (id=770): mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000003380)='system.posix_acl_access\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="02000000010000000000000000100005036e8b30dce55e635ef46859b4"], 0x24, 0x0) (async) lchown(&(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={r1, r0, 0x0, r0}, 0x10) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) syz_open_dev$video(0x0, 0xc, 0x200) (async) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) (async) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@file={0x0, './bus\x00'}, 0x6e) (async) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_drvinfo={0x3, "7339099042a557a8850e56fbf75bc095f998cb3ef37b7f039b4ec027363efa54", "9aa6c4b80a4ed65890ec802b70a5ea39fc53864809df7e77b156b1b640f1777c", "a59a57c7318bfed4ac17a10b39ad26b068644d7b7c9c8e03bb61b6147c12ae59", "3b9379f5952f6e17183155f8a98a3af781746628c6e400", "c5b433a31c2aa404b51099f9d8ddbb8b4f70c2683b24b5f08be8fe769a73865b", "39bc601815fefa6141b60866", 0x1, 0x51, 0x7, 0x6, 0x9}}) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) (async) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x7, 0x7fc00100}]}) prlimit64(0x0, 0xe, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r7, 0xc0502100, &(0x7f0000000680)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r7, 0xc0182101, &(0x7f0000000200)={r8}) (async) close(0x3) clock_nanosleep(0x8, 0x1, &(0x7f0000000080), 0x0) (async) syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x9840) 3.074712901s ago: executing program 4 (id=771): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x2b) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000001140)='hugetlbfs\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0500000004000000020000000400000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000900000000000000cb4568d72ddf6803de86173c178719cd829886e1135229d7f1e8d0f6a45fd6305a706320b129399c2761f3b7cbca62ab648fb10a7932d02c9a7ae3b566cc96b1548c9166801282ee0016bc4029e83067e5c5f8d4808d2a11b91d1fe431f9c088d29914cb244aff548e8eb451814ac80f2fd8610bb255ba2deeb831623eb1182d8e9d59e44b5d05e26dc5e4aefd449c9dc9eaaa4981522d70d3eba554004be334e8efcd4aaf83f3689b992a0cf9b827550e6c8edc617a41e6c31c07b913a3c141c65a1d4824ff3db9d5ea0306a00c4ea757a65b5e3306e2bf69f9639de77b1412ca2da35b3bd45919de4b0a8ef7143fc89d30f9c73475458e2f022040e9ce36b715210e91507b8b7a17a347d1efe8ea5343974ca71537957bf8462b9796476ed33264c59be998", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x8, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="4c0000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="100a0500231201002c0012800b00010062726964675800001c0002800c00210001040000000000000c0022008400000000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) r2 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'erspan0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40001d4}, 0x8840) connect$l2tp6(r0, 0x0, 0x0) r3 = syz_clone3(&(0x7f0000000300)={0x1080000, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0), {0x29}, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=""/78, &(0x7f00000002c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x4}, 0x58) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x0, &(0x7f0000000380)) getsockname$l2tp6(r2, 0x0, &(0x7f00000000c0)) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x40040, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40040) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x3, 0x0) getsockname$packet(r0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) 2.958758175s ago: executing program 4 (id=772): socket$igmp(0x2, 0x3, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6_sctp(0xa, 0x5, 0x84) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x6, &(0x7f0000000000)=[{&(0x7f0000000140)="d80000001c0081044e81f782db44b904021d080201000000400000a118000a000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x20000000) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) unshare(0x2a020480) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000180)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_RANGEINFO(r4, 0x80106408, &(0x7f0000000280)={0x7, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xd01, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000003740)={r5, 0x0, 0x40, 0x1000, &(0x7f00000000c0)="7dd53cbd3194ca5fdf819f26407baee211bc663e897588e401f0e4a0fb45b71d7774162147dbec7f16b9ad3ac658833ca3a65d0cce88271044d28f364b55ad3b", &(0x7f0000002600)=""/4096, 0x5, 0x0, 0x1b, 0xde, &(0x7f0000003600)="16c66ad813ddc0658a773fd590c0c56a9103da2dff52ac06df05d1", &(0x7f0000003640)="229659ccd6f855f1bd40fd739fde0cf1ea3f2f73819162675a1ad240b49256c8b5ad664c93136c96f3edc592119ca3df9a80f378d8a74b6a002cad87c687c57201c01f48a4b96bc64e86aafbe22b123676a913d47292c8b81cb7f354a8bbe56b6801d91ea0f5a62faf0660d63f0f204da7c2eb0ff4276ef0f673fc3e0daa8a633c74a34e82949b401a6f5649f683612afb19668bedd2eec7ed2766b9f69557646f981aeb9342e4fbd9ee239c7e20caa8beb6b9a56f39c059b4723325cfee09e5c09269845ea686525461429559d4b3dcbb51aeda91ac9e4287b6403281f3", 0x4, 0x0, 0x3}, 0x50) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r6, &(0x7f0000000240)={0x23, 0x30, 0x0, 0x36}, 0x10) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000100)={0x23, 0x30}, 0x10) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 2.171970527s ago: executing program 7 (id=773): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() r1 = fsopen(&(0x7f0000000100)='bdev\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x5) fchdir(r2) openat(r2, &(0x7f00000000c0)='.\x00', 0x0, 0x88) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) lseek(r3, 0x200, 0x1) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x149800, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000000)={0x2}) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x85) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) preadv(0xffffffffffffffff, &(0x7f00000008c0), 0x0, 0x4, 0x0) connect$unix(r6, &(0x7f00000008c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, 0x0) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r9 = dup(r8) setsockopt$inet_IP_IPSEC_POLICY(r9, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@mcast1, @in6=@loopback, 0x4e23, 0x5, 0x4e21, 0x8, 0x2, 0xa0, 0xa0, 0xc}, {0x0, 0x1b, 0x0, 0x4, 0xfffffffffffffffc, 0x9, 0x7, 0xe19}, {0x80, 0x4, 0x6, 0x7}, 0x6e2b, 0x6e6bc2, 0x0, 0x0, 0x1, 0x1}, {{@in=@multicast2, 0x4d4, 0x32}, 0x2, @in6=@mcast1, 0x3503, 0x3, 0x0, 0xd, 0xc, 0xffffffcf, 0x5}}, 0xe8) ioctl$I2C_SMBUS(r9, 0x720, &(0x7f0000000080)={0x0, 0x9, 0x6, &(0x7f0000000040)={0x1, "37bde6ec63c9180755d3386398f571d369fd7b11c53da8ec6b06fcb71a8100701f"}}) socket$nl_route(0x10, 0x3, 0x0) 2.092223181s ago: executing program 6 (id=774): r0 = socket$inet6(0xa, 0x3, 0x4) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x8, 0x3, 0x448, 0x0, 0xffffffff, 0xffffffff, 0x128, 0xffffffff, 0x378, 0xffffffff, 0xffffffff, 0x378, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x4, 0x8, 0x2, 0x1}}, @inet=@rpfilter={{0x28}, {0x5}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x2, 0x1000}}}, {{@ipv6={@mcast1, @ipv4={'\x00', '\xff\xff', @loopback}, [0x0, 0x0, 0x1fe0000ff], [0xff, 0x0, 0x0, 0xff000000], 'erspan0\x00', 'veth0_vlan\x00', {}, {0xff}, 0x0, 0x0, 0x3}, 0x0, 0x230, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'lo\x00', {0x2, 0x0, 0x3, 0xb, 0x18000000, 0x200, 0x5, 0x9, 0x38, 0x40}, {0x30}}}, @common=@ah={{0x30}, {[0x4d4, 0x4d4], 0x84, 0x8, 0x1}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4a8) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='fd\x00') fchdir(r1) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) getpid() r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) r6 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r8, 0x7a5, &(0x7f00000000c0)={{}, 0x0, 0x0, 0x10001}) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f00000001c0)='sysfs\x00', 0x10, 0x0) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000400020000fbdbdf2514000000080003004ce9c72553b7c82a196a0ddd662ba3c27880ac44458ebbf6332b139a25b3ad60aa57a098705cd236147edd21cc43a0f353878e4f908d05ff5fce69", @ANYRES32=r3, @ANYBLOB="06001201080000000600140100100000060010005a0500000c0043003300000000000000060036000e0000000500c200f60000000600120008000000"], 0x58}}, 0x4c885) 2.039625381s ago: executing program 5 (id=775): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) syz_open_dev$vcsa(&(0x7f0000000380), 0x7b95b611, 0x802) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r4, &(0x7f0000000140)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4db, @local, 0x3}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000400)}], 0x1}}], 0x1, 0x4c040) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x54, 0x12, 0x1, 0x0, 0x3000000, {0xa, 0x0, 0x0, 0x0, {0x0, 0x4e22, [0xfffffffc, 0x0, 0xcd7e], [], 0x0, [0x1]}, 0x0, 0x2000}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x3, "06010000"}]}, 0x54}}, 0x20000080) 347.915298ms ago: executing program 5 (id=776): sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a5c0), 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000600)=@newtaction={0x48, 0x76, 0x1, 0x70bd26, 0x3, {}, [{0x34, 0x1, [@m_simple={0x30, 0xf, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4090}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400000010000100001233eb02bdc58d82de0e4204d6f9000000000000000500000a400000000c0a01000800000000000006090002023510086ce2efb8000920010073797a9fede60971a0889f92cea0fa310000000014000380101e00800c0001800600"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="40000000210a018800000000000000000a0000010900020073797a31000000000900010073797a310000000014000380100000800c000180060001"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000040000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000332508396474fa751768c1672cc2487d40d222608835d1c8ccfc4db02b97ee422514a73442704735973f156531b9"], 0xfc}}, 0x4008040) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r5, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=r6, 0x4) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000e00)={0x18, 0x16, &(0x7f0000000b00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8}, [@call={0x85, 0x0, 0x0, 0xc3}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}]}, &(0x7f0000000bc0)='syzkaller\x00', 0x9, 0xb2, &(0x7f0000000c00)=""/178, 0x40f00, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000cc0)={0xa, 0x1}, 0x8, 0x10, &(0x7f0000000d00)={0x3, 0x8, 0x81, 0x1}, 0x10, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000440)=[{0x2, 0x2, 0x6, 0x1}, {0x4, 0x1, 0x7, 0x8}], 0x10, 0xecf}, 0x94) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000ec0)={0x1b, 0x0, 0x0, 0x2, 0x0, 0x1, 0x37bd, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000fc0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000f40), &(0x7f0000000f80)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x9, 0x6, &(0x7f0000000780)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0xffffffffffffffff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}, @alu={0x3, 0x0, 0x0, 0x7, 0x1, 0xfffffffffffffffc}, @map_val={0x18, 0x5, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}], &(0x7f00000007c0)='syzkaller\x00', 0x10001, 0xbc, &(0x7f0000000800)=""/188, 0x41000, 0x2, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x8, &(0x7f0000000a80)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000ac0)={0x3, 0x0, 0x1, 0x689}, 0x10, r6, r7, 0x5, &(0x7f0000001000)=[r8, r9], &(0x7f0000001040)=[{0x1, 0x4, 0xf, 0x4}, {0x1, 0x2, 0x8, 0x8}, {0x2, 0x1, 0x8, 0xb}, {0x5, 0x3, 0x5, 0x6}, {0x2, 0x4, 0x1}], 0x10, 0x1}, 0x94) r10 = socket$inet6(0xa, 0x800, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x8, 0x7, 0x0, 0xffffffffffffffff, 0x3}, 0x50) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xc, 0xd, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xaa99}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r11}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7fffffff}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x15}}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r12, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$inet6(r10, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @rand_addr, 0x8000}, 0x1c) r13 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r13, 0x4b52, &(0x7f0000000140)={0x0, 0x1, 0x6, 0x2, 0x200, 0x0}) prctl$PR_GET_TIMERSLACK(0x1e) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000002) sendmmsg(r10, &(0x7f00000092c0), 0x4ff, 0xfdff) 332.602151ms ago: executing program 7 (id=777): mount$cgroup(0x0, &(0x7f0000002980)='.\x00', &(0x7f00000029c0), 0x84, &(0x7f0000000040)={[{@none}, {@clone_children}]}) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x2}) 181.955775ms ago: executing program 2 (id=778): socket$packet(0x11, 0x2, 0x300) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000001b40)={'syz0\x00', {0x0, 0x0, 0x0, 0x2}, 0x0, [0x39, 0x3, 0x4000401, 0x8, 0xe, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x9, 0x2, 0x0, 0x0, 0x3, 0x0, 0x2a, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xfffffffd, 0x10000000, 0x99, 0x20000000, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x5, 0xfffffff6, 0x0, 0x8, 0x800000, 0x2, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x1], [0x3, 0xfffff41a, 0x0, 0x0, 0x4, 0x20000, 0x2000000, 0xedc0, 0x0, 0x5ee, 0x5, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, 0x0, 0xfffffff8, 0x2, 0x0, 0x2, 0x400, 0x0, 0x1, 0x8, 0x40000, 0x0, 0xc0800000, 0x100, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, 0xfffffffe, 0xfffff986], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x2, 0xfffffffc, 0x0, 0x0, 0xfffffffd, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x200, 0x2, 0x6, 0x80000000, 0x2, 0x47fff, 0x0, 0x0, 0x0, 0x3, 0x0, 0xf, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4, 0xf88], [0xfffffffe, 0x0, 0x4, 0x0, 0xfffefffe, 0x0, 0xfffffffe, 0x4, 0xfffffffc, 0x0, 0x0, 0x3, 0xfffffffc, 0x4, 0x803, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x10, 0x5, 0xfffffffe, 0x1, 0x0, 0x4, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xea, 0x0, 0x0, 0x0, 0x8000000, 0x4, 0xffffffff, 0x0, 0x0, 0xffffe]}, 0x45c) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000080)=0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000003c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xd, &(0x7f0000000340)=ANY=[@ANYRESOCT=r1, @ANYRES32=r4, @ANYBLOB="00000000000049b2b7080000000000007b8af8ff00000000bfa200000000000007020000e8a7c52655b6ffffffb703000000000000b70400000000000085000000030000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r5, r4}, 0xc) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0xfe, 0x7fff0006}]}) r8 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa8203, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r8, 0xc0184800, &(0x7f0000000080)={0x20004, r7, 0x2}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x59, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r6, 0xc01c64a3, &(0x7f0000000280)={0x1, r9, 0xff, 0x100007, 0xa, 0x1ff, 0x1}) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) 73.336894ms ago: executing program 4 (id=779): pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x401}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x18c6}, 0x0, 0x0) 1.330665ms ago: executing program 7 (id=780): ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="3800000001"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101701) ioctl$USBDEVFS_CLEAR_HALT(r1, 0xc0105502, &(0x7f0000000300)={0x1, 0x1}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x2000400, &(0x7f0000000140)={[{@nfs_export_off}, {@redirect_dir_on}, {@redirect_dir_on}, {@index_on}, {@verity_on}, {@verity_on}, {@index_off}], [{@hash}]}) 0s ago: executing program 2 (id=781): modify_ldt$write2(0x11, 0x0, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b0000000000"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wlan0\x00'}) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(0xffffffffffffffff, 0x0, 0x2000c891) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x6b, &(0x7f0000000040)=0xffffffffffffffff) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000100)={0x2b, 0x22, 0x4000000, 0x2, 0x8, 0xa9, 0x5, 0x2, 0x1}) kernel console output (not intermixed with test programs): 621] Bluetooth: hci3: command 0x0c1a tx timeout [ 174.928635][ T5626] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 174.932771][ T7036] netlink: 'syz.1.331': attribute type 1 has an invalid length. [ 174.946670][ T7036] netlink: 60 bytes leftover after parsing attributes in process `syz.1.331'. [ 174.956915][ T5626] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 174.957282][ T7036] netlink: 8 bytes leftover after parsing attributes in process `syz.1.331'. [ 174.976447][ T5626] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 174.989540][ T30] audit: type=1400 audit(1780047514.980:549): avc: denied { bind } for pid=7035 comm="syz.1.331" lport=6 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 175.029282][ T5626] usb 1-1: Manufacturer: syz [ 175.052421][ T5626] usb 1-1: config 0 descriptor?? [ 175.061953][ T30] audit: type=1400 audit(1780047514.980:550): avc: denied { name_bind } for pid=7035 comm="syz.1.331" src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 175.085747][ T30] audit: type=1400 audit(1780047514.980:551): avc: denied { create } for pid=7039 comm="syz.4.332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 175.171790][ T30] audit: type=1400 audit(1780047515.010:552): avc: denied { ioctl } for pid=7039 comm="syz.4.332" path="socket:[13946]" dev="sockfs" ino=13946 ioctlcmd=0x89eb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 175.199042][ T30] audit: type=1400 audit(1780047515.020:553): avc: denied { ioctl } for pid=7039 comm="syz.4.332" path="socket:[13946]" dev="sockfs" ino=13946 ioctlcmd=0x89eb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 175.313422][ T30] audit: type=1400 audit(1780047515.160:554): avc: denied { module_request } for pid=7037 comm="syz.2.330" kmod="netdev-syzkaller1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 177.066890][ T5814] usb 1-1: USB disconnect, device number 9 [ 177.141779][ T7077] cgroup: Invalid name [ 177.385220][ T30] audit: type=1400 audit(1780047517.370:555): avc: denied { read write } for pid=7076 comm="syz.0.341" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 177.623638][ T30] audit: type=1400 audit(1780047517.380:556): avc: denied { open } for pid=7076 comm="syz.0.341" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 178.340026][ T7086] wg1 speed is unknown, defaulting to 1000 [ 178.674938][ T5619] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 178.690493][ T5619] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 178.698989][ T5619] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 178.712588][ T5619] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 178.729096][ T5619] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 178.982141][ T30] audit: type=1400 audit(1780047518.970:557): avc: denied { getopt } for pid=7085 comm="syz.2.343" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 179.272176][ T7100] netlink: 36 bytes leftover after parsing attributes in process `syz.1.347'. [ 179.361467][ T7100] bridge1: entered promiscuous mode [ 179.399302][ T7100] bridge1: entered allmulticast mode [ 180.102797][ T7097] wg1 speed is unknown, defaulting to 1000 [ 180.834372][ T5619] Bluetooth: hci5: command tx timeout [ 181.639039][ T5814] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 182.223145][ T5814] usb 2-1: Using ep0 maxpacket: 16 [ 182.224201][ T7097] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.235900][ T7097] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.243744][ T5814] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 182.243778][ T7097] bridge_slave_0: entered allmulticast mode [ 182.259991][ T5814] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 182.261285][ T7097] bridge_slave_0: entered promiscuous mode [ 182.277005][ T5814] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 182.277921][ T7097] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.293681][ T5814] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 182.306392][ T5814] usb 2-1: Manufacturer: syz [ 182.325129][ T5814] usb 2-1: config 0 descriptor?? [ 182.416377][ T7097] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.431794][ T7097] bridge_slave_1: entered allmulticast mode [ 182.439400][ T7097] bridge_slave_1: entered promiscuous mode [ 182.899130][ T7097] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 182.914577][ T5619] Bluetooth: hci5: command tx timeout [ 182.987814][ T7097] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 183.070332][ T7097] team0: Port device team_slave_0 added [ 183.099671][ T30] audit: type=1400 audit(1780047523.060:558): avc: denied { mount } for pid=7152 comm="syz.0.357" name="/" dev="ramfs" ino=14162 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 183.174040][ T7097] team0: Port device team_slave_1 added [ 183.574572][ T7097] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 183.592268][ T7097] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 183.675437][ T7097] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 183.699543][ T7097] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 183.713107][ T7097] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 183.787034][ T7097] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 183.915291][ T7097] hsr_slave_0: entered promiscuous mode [ 183.929005][ T7097] hsr_slave_1: entered promiscuous mode [ 183.942002][ T7097] debugfs: 'hsr0' already exists in 'hsr' [ 183.956729][ T7097] Cannot create hsr debugfs directory [ 184.047032][ T5814] usb 2-1: USB disconnect, device number 14 [ 184.983279][ T5619] Bluetooth: hci5: command tx timeout [ 185.048973][ T7097] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 185.102266][ T7097] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 185.148040][ T7182] FAULT_INJECTION: forcing a failure. [ 185.148040][ T7182] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 185.161541][ T7097] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 185.166066][ T7182] CPU: 0 UID: 0 PID: 7182 Comm: syz.0.366 Tainted: G L syzkaller #0 PREEMPT(full) [ 185.166093][ T7182] Tainted: [L]=SOFTLOCKUP [ 185.166099][ T7182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 185.166107][ T7182] Call Trace: [ 185.166113][ T7182] [ 185.166119][ T7182] dump_stack_lvl+0x100/0x190 [ 185.166142][ T7182] should_fail_ex.cold+0x5/0xa [ 185.166163][ T7182] _copy_from_iter+0x1f4/0x1690 [ 185.166185][ T7182] ? __asan_memset+0x23/0x50 [ 185.166207][ T7182] ? __pfx__copy_from_iter+0x10/0x10 [ 185.166225][ T7182] ? __pfx___alloc_skb+0x10/0x10 [ 185.166246][ T7182] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 185.166282][ T7182] netlink_sendmsg+0x808/0xda0 [ 185.166305][ T7182] ? __pfx_netlink_sendmsg+0x10/0x10 [ 185.166323][ T7182] ? __might_fault+0xa0/0x140 [ 185.166351][ T7182] ____sys_sendmsg+0x9e1/0xb70 [ 185.166368][ T7182] ? __pfx_netlink_sendmsg+0x10/0x10 [ 185.166388][ T7182] ? __pfx_____sys_sendmsg+0x10/0x10 [ 185.166415][ T7182] ___sys_sendmsg+0x190/0x1e0 [ 185.166435][ T7182] ? __pfx____sys_sendmsg+0x10/0x10 [ 185.166482][ T7182] __sys_sendmsg+0x170/0x220 [ 185.166505][ T7182] ? __pfx___sys_sendmsg+0x10/0x10 [ 185.166536][ T7182] ? rcu_is_watching+0x12/0xc0 [ 185.166561][ T7182] do_syscall_64+0x115/0x870 [ 185.166581][ T7182] ? clear_bhb_loop+0x40/0x90 [ 185.166599][ T7182] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.166615][ T7182] RIP: 0033:0x7f1a6259ce59 [ 185.166628][ T7182] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 185.166643][ T7182] RSP: 002b:00007f1a634e9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 185.166659][ T7182] RAX: ffffffffffffffda RBX: 00007f1a62815fa0 RCX: 00007f1a6259ce59 [ 185.166668][ T7182] RDX: 0000000024000840 RSI: 0000200000009b40 RDI: 0000000000000003 [ 185.166678][ T7182] RBP: 00007f1a634e9090 R08: 0000000000000000 R09: 0000000000000000 [ 185.166686][ T7182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 185.166695][ T7182] R13: 00007f1a62816038 R14: 00007f1a62815fa0 R15: 00007fff543c89c8 [ 185.166715][ T7182] [ 185.436650][ T7097] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 185.444695][ T7097] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 185.534176][ T7183] ubi: mtd0 is already attached to ubi16 [ 185.605142][ T7188] netlink: 'syz.1.364': attribute type 10 has an invalid length. [ 185.613017][ T7188] netlink: 40 bytes leftover after parsing attributes in process `syz.1.364'. [ 186.022826][ T7097] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 186.059608][ T7097] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 186.087893][ T7097] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 186.102190][ T7188] bridge0: port 3(veth1_macvtap) entered blocking state [ 186.113282][ T7188] bridge0: port 3(veth1_macvtap) entered disabled state [ 186.603319][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 187.059922][ T7188] veth1_macvtap: entered allmulticast mode [ 187.074561][ T5619] Bluetooth: hci5: command tx timeout [ 187.082014][ T7188] veth1_macvtap: left allmulticast mode [ 187.096551][ T7188] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check. [ 187.333726][ T5714] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 187.694112][ T7211] netlink: 28 bytes leftover after parsing attributes in process `syz.0.371'. [ 187.724570][ T5714] usb 3-1: Using ep0 maxpacket: 16 [ 187.738759][ T5714] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 187.749475][ T5714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 187.776656][ T5714] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 187.783604][ T7097] 8021q: adding VLAN 0 to HW filter on device bond0 [ 187.816031][ T5714] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 187.819788][ T7097] 8021q: adding VLAN 0 to HW filter on device team0 [ 187.834514][ T5714] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 187.845084][ T139] bridge0: port 1(bridge_slave_0) entered blocking state [ 187.852194][ T139] bridge0: port 1(bridge_slave_0) entered forwarding state [ 187.869648][ T5714] usb 3-1: Manufacturer: syz [ 187.881361][ T139] bridge0: port 2(bridge_slave_1) entered blocking state [ 187.888524][ T139] bridge0: port 2(bridge_slave_1) entered forwarding state [ 187.900129][ T5714] usb 3-1: config 0 descriptor?? [ 188.004505][ T7097] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 188.727758][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.739972][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 191.150366][ T5814] usb 3-1: USB disconnect, device number 16 [ 191.243125][ T30] audit: type=1400 audit(1780047531.230:559): avc: denied { ioctl } for pid=7243 comm="syz.1.377" path="socket:[15125]" dev="sockfs" ino=15125 ioctlcmd=0x8982 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 191.761243][ T7097] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 191.783900][ T30] audit: type=1400 audit(1780047531.740:560): avc: denied { bind } for pid=7243 comm="syz.1.377" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 192.074551][ T30] audit: type=1400 audit(1780047531.740:561): avc: denied { ioctl } for pid=7243 comm="syz.1.377" path="time:[4026531834]" dev="nsfs" ino=4026531834 ioctlcmd=0xb701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 192.174097][ T30] audit: type=1400 audit(1780047532.170:562): avc: denied { getopt } for pid=7253 comm="syz.2.379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 193.873430][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 194.349684][ T30] audit: type=1400 audit(1780047534.340:563): avc: denied { setopt } for pid=7275 comm="syz.4.383" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 194.350043][ T7276] netlink: 16 bytes leftover after parsing attributes in process `syz.4.383'. [ 194.411150][ T7097] veth0_vlan: entered promiscuous mode [ 194.453699][ T7276] bond0: entered promiscuous mode [ 194.465572][ T7276] bond_slave_0: entered promiscuous mode [ 194.477830][ T7276] bond_slave_1: entered promiscuous mode [ 194.500118][ T7276] gretap0: entered promiscuous mode [ 194.529115][ T7276] hsr1: entered promiscuous mode [ 194.540771][ T7097] veth1_vlan: entered promiscuous mode [ 194.697949][ T7097] veth0_macvtap: entered promiscuous mode [ 194.709057][ T7097] veth1_macvtap: entered promiscuous mode [ 195.844156][ T7097] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 196.507425][ T7097] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 196.528240][ T1172] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.581078][ T1172] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.610477][ T1172] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.644392][ T1172] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.759360][ T1052] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 196.776508][ T1052] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 196.819685][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 196.828648][ T5742] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 196.848705][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 196.879598][ T30] audit: type=1400 audit(1780047536.870:564): avc: denied { mounton } for pid=7097 comm="syz-executor" path="/root/syzkaller.fUG1xi/syz-tmp" dev="sda1" ino=2048 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 196.918097][ T30] audit: type=1400 audit(1780047536.900:565): avc: denied { mounton } for pid=7097 comm="syz-executor" path="/root/syzkaller.fUG1xi/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 197.073301][ T5742] usb 1-1: Using ep0 maxpacket: 16 [ 197.112541][ T5742] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 197.190506][ T5742] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 197.306717][ T5742] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 197.337670][ T30] audit: type=1400 audit(1780047536.900:566): avc: denied { mounton } for pid=7097 comm="syz-executor" path="/root/syzkaller.fUG1xi/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=15270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 197.361035][ T5742] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 197.370193][ T30] audit: type=1400 audit(1780047536.900:567): avc: denied { mounton } for pid=7097 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2786 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 197.405534][ T5742] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 197.432889][ T5742] usb 1-1: Manufacturer: syz [ 197.454261][ T5742] usb 1-1: config 0 descriptor?? [ 197.624862][ T5932] block nbd0: Possible stuck request ffff888027fb5080: control (read@0,1024B). Runtime 90 seconds [ 197.647019][ T5932] block nbd0: Possible stuck request ffff888027fb5240: control (read@1024,1024B). Runtime 90 seconds [ 197.658620][ T5932] block nbd0: Possible stuck request ffff888027fb5400: control (read@2048,1024B). Runtime 90 seconds [ 197.670184][ T5932] block nbd0: Possible stuck request ffff888027fb55c0: control (read@3072,1024B). Runtime 90 seconds [ 198.819598][ T30] audit: type=1400 audit(1780047538.730:568): avc: denied { setopt } for pid=7304 comm="syz.1.391" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 199.467183][ T7310] wg1 speed is unknown, defaulting to 1000 [ 199.861313][ T5810] usb 1-1: USB disconnect, device number 10 [ 201.069628][ T30] audit: type=1400 audit(1780047541.060:569): avc: denied { load_policy } for pid=7339 comm="syz.5.399" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 201.122172][ T7340] SELinux: failed to load policy [ 201.491723][ T7382] FAULT_INJECTION: forcing a failure. [ 201.491723][ T7382] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 201.507477][ T7382] CPU: 0 UID: 0 PID: 7382 Comm: syz.0.402 Tainted: G L syzkaller #0 PREEMPT(full) [ 201.507505][ T7382] Tainted: [L]=SOFTLOCKUP [ 201.507512][ T7382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 201.507522][ T7382] Call Trace: [ 201.507528][ T7382] [ 201.507535][ T7382] dump_stack_lvl+0x100/0x190 [ 201.507561][ T7382] should_fail_ex.cold+0x5/0xa [ 201.507585][ T7382] _copy_from_user+0x2e/0xd0 [ 201.507607][ T7382] drm_ioctl+0x520/0xc60 [ 201.507630][ T7382] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 201.507653][ T7382] ? __pfx_drm_ioctl+0x10/0x10 [ 201.507679][ T7382] ? selinux_file_ioctl+0x13b/0x290 [ 201.507705][ T7382] ? selinux_file_ioctl+0xb6/0x290 [ 201.507731][ T7382] ? __pfx_drm_ioctl+0x10/0x10 [ 201.507750][ T7382] __x64_sys_ioctl+0x18e/0x210 [ 201.507770][ T7382] do_syscall_64+0x115/0x870 [ 201.507798][ T7382] ? clear_bhb_loop+0x40/0x90 [ 201.507819][ T7382] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.507837][ T7382] RIP: 0033:0x7f1a6259ce59 [ 201.507852][ T7382] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 201.507869][ T7382] RSP: 002b:00007f1a634e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 201.507885][ T7382] RAX: ffffffffffffffda RBX: 00007f1a62815fa0 RCX: 00007f1a6259ce59 [ 201.507897][ T7382] RDX: 0000200000000580 RSI: 00000000c03864bc RDI: 0000000000000003 [ 201.507907][ T7382] RBP: 00007f1a634e9090 R08: 0000000000000000 R09: 0000000000000000 [ 201.507917][ T7382] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 201.507927][ T7382] R13: 00007f1a62816038 R14: 00007f1a62815fa0 R15: 00007fff543c89c8 [ 201.507950][ T7382] [ 201.973245][ T805] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 202.204350][ T805] usb 5-1: Using ep0 maxpacket: 16 [ 202.220985][ T805] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 202.246299][ T7401] netlink: 132 bytes leftover after parsing attributes in process `syz.5.409'. [ 202.276278][ T805] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 202.308722][ T805] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 202.360914][ T805] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 202.533942][ T805] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 202.541994][ T805] usb 5-1: Manufacturer: syz [ 202.554719][ T805] usb 5-1: config 0 descriptor?? [ 202.593153][ T7404] netlink: 4 bytes leftover after parsing attributes in process `syz.0.410'. [ 203.027486][ T30] audit: type=1400 audit(1780047543.020:570): avc: denied { mounton } for pid=7416 comm="syz.5.414" path="/8/file0" dev="tmpfs" ino=59 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 204.888790][ T805] usb 5-1: USB disconnect, device number 15 [ 205.213193][ T5814] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 206.189370][ T5814] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 206.206018][ T5814] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 206.229542][ T5814] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 206.266124][ T5814] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.401971][ T7468] FAULT_INJECTION: forcing a failure. [ 206.401971][ T7468] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 206.456226][ T7468] CPU: 1 UID: 0 PID: 7468 Comm: syz.2.427 Tainted: G L syzkaller #0 PREEMPT(full) [ 206.456256][ T7468] Tainted: [L]=SOFTLOCKUP [ 206.456262][ T7468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 206.456271][ T7468] Call Trace: [ 206.456276][ T7468] [ 206.456283][ T7468] dump_stack_lvl+0x100/0x190 [ 206.456306][ T7468] should_fail_ex.cold+0x5/0xa [ 206.456328][ T7468] _copy_from_user+0x2e/0xd0 [ 206.456348][ T7468] copy_msghdr_from_user+0x9f/0x4f0 [ 206.456371][ T7468] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 206.456395][ T7468] ? __pfx__kstrtoull+0x10/0x10 [ 206.456422][ T7468] ___sys_sendmsg+0x106/0x1e0 [ 206.456445][ T7468] ? __pfx____sys_sendmsg+0x10/0x10 [ 206.456478][ T7468] ? find_held_lock+0x2b/0x80 [ 206.456511][ T7468] __sys_sendmmsg+0x205/0x430 [ 206.456545][ T7468] ? __pfx___sys_sendmmsg+0x10/0x10 [ 206.456580][ T7468] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 206.456615][ T7468] ? fput+0x79/0x100 [ 206.456641][ T7468] ? ksys_write+0x1ac/0x250 [ 206.456659][ T7468] ? __pfx_ksys_write+0x10/0x10 [ 206.456682][ T7468] __x64_sys_sendmmsg+0x9c/0x100 [ 206.456709][ T7468] ? lockdep_hardirqs_on+0x78/0x100 [ 206.456732][ T7468] do_syscall_64+0x115/0x870 [ 206.456755][ T7468] ? clear_bhb_loop+0x40/0x90 [ 206.456777][ T7468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.456794][ T7468] RIP: 0033:0x7f2a4f39ce59 [ 206.456809][ T7468] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 206.456826][ T7468] RSP: 002b:00007f2a502ef028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 206.456844][ T7468] RAX: ffffffffffffffda RBX: 00007f2a4f615fa0 RCX: 00007f2a4f39ce59 [ 206.456856][ T7468] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 206.456867][ T7468] RBP: 00007f2a502ef090 R08: 0000000000000000 R09: 0000000000000000 [ 206.456877][ T7468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 206.456887][ T7468] R13: 00007f2a4f616038 R14: 00007f2a4f615fa0 R15: 00007ffc2d432a98 [ 206.456911][ T7468] [ 206.535573][ T5814] usb 1-1: usb_control_msg returned -32 [ 206.680159][ T5814] usbtmc 1-1:16.0: can't read capabilities [ 206.741187][ T7443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 206.753115][ T7443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 206.803177][ T30] audit: type=1400 audit(1780047546.780:571): avc: denied { create } for pid=7442 comm="syz.0.420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 206.834708][ T30] audit: type=1400 audit(1780047546.820:572): avc: denied { setopt } for pid=7442 comm="syz.0.420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 206.944248][ T805] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 206.983751][ T5814] usb 1-1: USB disconnect, device number 11 [ 207.105059][ T805] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 207.117898][ T805] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 207.137858][ T805] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 207.148717][ T805] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 207.157085][ T805] usb 3-1: Product: syz [ 207.163460][ T805] usb 3-1: Manufacturer: syz [ 207.169903][ T805] usb 3-1: SerialNumber: syz [ 207.259067][ T7482] ======================================================= [ 207.259067][ T7482] WARNING: The mand mount option has been deprecated and [ 207.259067][ T7482] and is ignored by this kernel. Remove the mand [ 207.259067][ T7482] option from the mount to silence this warning. [ 207.259067][ T7482] ======================================================= [ 207.301760][ T5810] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 207.315772][ T30] audit: type=1400 audit(1780047547.310:573): avc: denied { mounton } for pid=7481 comm="syz.4.432" path="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 207.384223][ T7485] syzkaller0: entered promiscuous mode [ 207.385377][ T805] usb 3-1: USB disconnect, device number 17 [ 207.390791][ T7485] syzkaller0: entered allmulticast mode [ 207.416729][ T30] audit: type=1400 audit(1780047547.410:574): avc: denied { accept } for pid=7484 comm="syz.5.433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 207.460446][ T5810] usb 2-1: unable to get BOS descriptor or descriptor too short [ 207.471064][ T5810] usb 2-1: config 63 has an invalid interface number: 66 but max is 0 [ 207.483962][ T5810] usb 2-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 207.529527][ T5810] usb 2-1: config 63 has no interface number 0 [ 207.566070][ T5810] usb 2-1: config 63 interface 66 has no altsetting 0 [ 207.648849][ T5810] usb 2-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 207.684054][ T5810] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.711349][ T5810] usb 2-1: Product: syz [ 207.717139][ T5810] usb 2-1: Manufacturer: syz [ 207.723776][ T5810] usb 2-1: SerialNumber: syz [ 208.016233][ T5810] uvcvideo 2-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 208.038914][ T5810] uvcvideo 2-1:63.66: No valid video chain found. [ 208.063943][ T5810] usb 2-1: USB disconnect, device number 15 [ 209.296118][ T7528] ubi: mtd0 is already attached to ubi16 [ 209.382435][ T7533] netlink: 'syz.0.441': attribute type 10 has an invalid length. [ 209.390509][ T7533] netlink: 40 bytes leftover after parsing attributes in process `syz.0.441'. [ 209.896435][ T30] audit: type=1400 audit(1780047549.880:575): avc: denied { read } for pid=7535 comm="syz.1.444" path="socket:[16877]" dev="sockfs" ino=16877 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 210.223192][ T5810] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 210.374419][ T5810] usb 2-1: config index 0 descriptor too short (expected 39, got 27) [ 210.384439][ T5810] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 210.394803][ T5810] usb 2-1: config 0 interface 0 has no altsetting 0 [ 210.405789][ T5810] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 210.415717][ T5810] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 210.426742][ T5810] usb 2-1: Product: syz [ 210.430958][ T5810] usb 2-1: Manufacturer: syz [ 210.436119][ T5810] usb 2-1: SerialNumber: syz [ 210.448069][ T5810] usb 2-1: config 0 descriptor?? [ 210.460710][ T5810] hub 2-1:0.0: bad descriptor, ignoring hub [ 210.478545][ T5810] hub 2-1:0.0: probe with driver hub failed with error -5 [ 210.492292][ T30] audit: type=1400 audit(1780047550.480:576): avc: denied { read } for pid=7539 comm="syz.2.445" name="sg0" dev="devtmpfs" ino=768 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 210.528830][ T5810] usb 2-1: selecting invalid altsetting 0 [ 210.554365][ T30] audit: type=1400 audit(1780047550.480:577): avc: denied { open } for pid=7539 comm="syz.2.445" path="/dev/sg0" dev="devtmpfs" ino=768 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 210.600579][ T30] audit: type=1400 audit(1780047550.530:578): avc: denied { ioctl } for pid=7539 comm="syz.2.445" path="/dev/sg0" dev="devtmpfs" ino=768 ioctlcmd=0x2284 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 210.625001][ T7542] binder: 7541:7542 ioctl 40786e88 2000000002c0 returned -22 [ 210.635793][ T7543] binder: 7541:7543 ioctl c0385869 200000000440 returned -22 [ 210.759345][ T30] audit: type=1400 audit(1780047550.750:579): avc: denied { name_bind } for pid=7546 comm="syz.2.447" src=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 210.978882][ T7533] bridge0: port 3(veth1_macvtap) entered blocking state [ 210.987527][ T7533] bridge0: port 3(veth1_macvtap) entered disabled state [ 210.995687][ T7533] veth1_macvtap: entered allmulticast mode [ 211.002660][ T7533] veth1_macvtap: left allmulticast mode [ 211.017648][ T7533] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check. [ 211.090826][ T7547] wg1 speed is unknown, defaulting to 1000 [ 212.339405][ T5714] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 213.143788][ T5810] usb 2-1: USB disconnect, device number 16 [ 213.404043][ T5714] usb 1-1: Using ep0 maxpacket: 16 [ 213.520803][ T5714] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 213.642479][ T5714] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 214.095183][ T5714] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 214.112071][ T5714] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 214.122153][ T5714] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 214.164193][ T5714] usb 1-1: Manufacturer: syz [ 214.190971][ T5714] usb 1-1: config 0 descriptor?? [ 214.279868][ T30] audit: type=1400 audit(1780047554.270:580): avc: denied { setopt } for pid=7585 comm="syz.4.460" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 214.888763][ T7595] FAULT_INJECTION: forcing a failure. [ 214.888763][ T7595] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 214.902161][ T7595] CPU: 0 UID: 0 PID: 7595 Comm: syz.2.459 Tainted: G L syzkaller #0 PREEMPT(full) [ 214.902188][ T7595] Tainted: [L]=SOFTLOCKUP [ 214.902192][ T7595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 214.902198][ T7595] Call Trace: [ 214.902203][ T7595] [ 214.902208][ T7595] dump_stack_lvl+0x100/0x190 [ 214.902223][ T7595] should_fail_ex.cold+0x5/0xa [ 214.902237][ T7595] ? prepare_alloc_pages+0x16d/0x5f0 [ 214.902252][ T7595] should_fail_alloc_page+0xeb/0x140 [ 214.902265][ T7595] prepare_alloc_pages+0x1f0/0x5f0 [ 214.902280][ T7595] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 214.902296][ T7595] ? sched_clock+0x38/0x60 [ 214.902307][ T7595] ? sched_clock_cpu+0x6c/0x570 [ 214.902324][ T7595] ? find_held_lock+0x2b/0x80 [ 214.902333][ T7595] ? __schedule+0x325e/0x67a0 [ 214.902346][ T7595] ? __schedule+0x325e/0x67a0 [ 214.902357][ T7595] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 214.902373][ T7595] ? rcu_is_watching+0x12/0xc0 [ 214.902388][ T7595] ? trace_sched_exit_tp+0x11c/0x160 [ 214.902401][ T7595] ? __schedule+0x12a7/0x67a0 [ 214.902411][ T7595] ? mark_lock+0x402/0xa20 [ 214.902429][ T7595] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 214.902443][ T7595] ? policy_nodemask+0xed/0x4f0 [ 214.902455][ T7595] alloc_pages_mpol+0x1fb/0x540 [ 214.902468][ T7595] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 214.902485][ T7595] ? preempt_schedule_thunk+0x16/0x30 [ 214.902503][ T7595] alloc_pages_noprof+0x1a/0x160 [ 214.902516][ T7595] ? rds_page_remainder_alloc+0x466/0x13e0 [ 214.902531][ T7595] rds_page_remainder_alloc+0x486/0x13e0 [ 214.902548][ T7595] rds_message_copy_from_user+0x1ca/0xcf0 [ 214.902562][ T7595] ? rcu_is_watching+0x12/0xc0 [ 214.902577][ T7595] ? trace_kmalloc+0xe3/0x110 [ 214.902589][ T7595] ? __pfx_rds_message_copy_from_user+0x10/0x10 [ 214.902600][ T7595] ? __asan_memset+0x23/0x50 [ 214.902615][ T7595] ? sg_init_table+0x20/0x60 [ 214.902633][ T7595] rds_sendmsg+0x2273/0x3480 [ 214.902643][ T7595] ? __pfx_avc_has_perm+0x10/0x10 [ 214.902661][ T7595] ? __pfx_rds_sendmsg+0x10/0x10 [ 214.902674][ T7595] ? __pfx_tomoyo_socket_sendmsg_permission+0x10/0x10 [ 214.902691][ T7595] ? import_ubuf+0x1b6/0x220 [ 214.902704][ T7595] ? __might_fault+0xa0/0x140 [ 214.902723][ T7595] ? ____sys_sendmsg+0x9e1/0xb70 [ 214.902735][ T7595] ____sys_sendmsg+0x9e1/0xb70 [ 214.902746][ T7595] ? __pfx_rds_sendmsg+0x10/0x10 [ 214.902758][ T7595] ? __pfx_____sys_sendmsg+0x10/0x10 [ 214.902776][ T7595] ___sys_sendmsg+0x190/0x1e0 [ 214.902791][ T7595] ? __pfx____sys_sendmsg+0x10/0x10 [ 214.902809][ T7595] ? lockdep_hardirqs_on+0x78/0x100 [ 214.902823][ T7595] ? irqentry_exit+0x24d/0x970 [ 214.902845][ T7595] __sys_sendmsg+0x170/0x220 [ 214.902861][ T7595] ? __pfx___sys_sendmsg+0x10/0x10 [ 214.902883][ T7595] ? rcu_is_watching+0x12/0xc0 [ 214.902899][ T7595] do_syscall_64+0x115/0x870 [ 214.902912][ T7595] ? clear_bhb_loop+0x40/0x90 [ 214.902925][ T7595] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.902936][ T7595] RIP: 0033:0x7f2a4f39ce59 [ 214.902945][ T7595] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 214.902956][ T7595] RSP: 002b:00007f2a502ad028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 214.902966][ T7595] RAX: ffffffffffffffda RBX: 00007f2a4f616180 RCX: 00007f2a4f39ce59 [ 214.902973][ T7595] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000004 [ 214.902981][ T7595] RBP: 00007f2a502ad090 R08: 0000000000000000 R09: 0000000000000000 [ 214.902987][ T7595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 214.902993][ T7595] R13: 00007f2a4f616218 R14: 00007f2a4f616180 R15: 00007ffc2d432a98 [ 214.903006][ T7595] [ 215.573515][ T30] audit: type=1400 audit(1780047554.820:581): avc: denied { connect } for pid=7591 comm="syz.2.459" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 215.668756][ T5840] usb 1-1: USB disconnect, device number 12 [ 215.775741][ T30] audit: type=1400 audit(1780047554.820:582): avc: denied { read } for pid=7591 comm="syz.2.459" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 216.678437][ T7582] block device autoloading is deprecated and will be removed. [ 216.712988][ T30] audit: type=1400 audit(1780047556.700:583): avc: denied { write } for pid=7621 comm="syz.1.467" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 218.583755][ T5619] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 218.592797][ T5621] Bluetooth: hci6: command 0x1003 tx timeout [ 219.777008][ T7648] ipt_REJECT: TCP_RESET invalid for non-tcp [ 219.785932][ T30] audit: type=1400 audit(1780047559.780:584): avc: denied { wake_alarm } for pid=7647 comm="syz.5.473" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 219.856694][ T7653] overlay: ./file0 is not a directory [ 219.870113][ T30] audit: type=1400 audit(1780047559.860:585): avc: denied { create } for pid=7652 comm="syz.1.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 219.913436][ T30] audit: type=1400 audit(1780047559.880:586): avc: denied { ioctl } for pid=7652 comm="syz.1.475" path="socket:[17100]" dev="sockfs" ino=17100 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 220.053689][ T5840] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 220.173112][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 220.303103][ T5840] usb 5-1: Using ep0 maxpacket: 16 [ 220.319812][ T5742] IPVS: starting estimator thread 0... [ 220.335769][ T9] usb 6-1: device descriptor read/64, error -71 [ 220.336290][ T7657] FAULT_INJECTION: forcing a failure. [ 220.336290][ T7657] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 220.358998][ T7657] CPU: 1 UID: 0 PID: 7657 Comm: syz.0.476 Tainted: G L syzkaller #0 PREEMPT(full) [ 220.359028][ T7657] Tainted: [L]=SOFTLOCKUP [ 220.359034][ T7657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 220.359045][ T7657] Call Trace: [ 220.359051][ T7657] [ 220.359057][ T7657] dump_stack_lvl+0x100/0x190 [ 220.359082][ T7657] should_fail_ex.cold+0x5/0xa [ 220.359105][ T7657] _copy_from_user+0x2e/0xd0 [ 220.359126][ T7657] move_addr_to_kernel+0x65/0x170 [ 220.359149][ T7657] copy_msghdr_from_user+0x417/0x4f0 [ 220.359171][ T7657] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 220.359203][ T7657] ___sys_sendmsg+0x106/0x1e0 [ 220.359225][ T7657] ? __pfx____sys_sendmsg+0x10/0x10 [ 220.359279][ T7657] __sys_sendmsg+0x170/0x220 [ 220.359305][ T7657] ? __pfx___sys_sendmsg+0x10/0x10 [ 220.359341][ T7657] ? rcu_is_watching+0x12/0xc0 [ 220.359379][ T7657] do_syscall_64+0x115/0x870 [ 220.359400][ T7657] ? clear_bhb_loop+0x40/0x90 [ 220.359420][ T7657] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.359437][ T7657] RIP: 0033:0x7f1a6259ce59 [ 220.359451][ T7657] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 220.359467][ T7657] RSP: 002b:00007f1a634e9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 220.359483][ T7657] RAX: ffffffffffffffda RBX: 00007f1a62815fa0 RCX: 00007f1a6259ce59 [ 220.359494][ T7657] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000005 [ 220.359504][ T7657] RBP: 00007f1a634e9090 R08: 0000000000000000 R09: 0000000000000000 [ 220.359514][ T7657] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 220.359523][ T7657] R13: 00007f1a62816038 R14: 00007f1a62815fa0 R15: 00007fff543c89c8 [ 220.359545][ T7657] [ 220.359836][ T5840] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 220.423156][ T7658] IPVS: using max 45 ests per chain, 108000 per kthread [ 220.607142][ T5840] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 220.649494][ T5840] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 220.666920][ T5840] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 220.685320][ T5840] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 220.693631][ T9] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 220.704596][ T5840] usb 5-1: Manufacturer: syz [ 220.713121][ T5840] usb 5-1: config 0 descriptor?? [ 220.740725][ T30] audit: type=1326 audit(1780047560.730:587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7665 comm="syz.2.479" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2a4f39ce59 code=0x0 [ 220.837001][ T9] usb 6-1: device descriptor read/64, error -71 [ 220.973278][ T9] usb usb6-port1: attempt power cycle [ 221.453171][ T9] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 221.494972][ T9] usb 6-1: device descriptor read/8, error -71 [ 222.133133][ T9] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 222.173669][ T9] usb 6-1: device descriptor read/8, error -71 [ 222.284319][ T9] usb usb6-port1: unable to enumerate USB device [ 222.872650][ T9] usb 5-1: USB disconnect, device number 16 [ 223.013747][ T5810] libceph: connect (1)[c::]:6789 error -101 [ 223.994582][ T5810] libceph: mon0 (1)[c::]:6789 connect error [ 224.021305][ T7706] ceph: No mds server is up or the cluster is laggy [ 224.022102][ T9] libceph: connect (1)[c::]:6789 error -101 [ 224.525488][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 224.776791][ T7728] netlink: 8 bytes leftover after parsing attributes in process `syz.2.495'. [ 224.786032][ T7728] netlink: 8 bytes leftover after parsing attributes in process `syz.2.495'. [ 225.232067][ T30] audit: type=1400 audit(1780047565.220:588): avc: denied { bind } for pid=7737 comm="syz.1.498" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 225.696054][ T9] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 225.953406][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 225.973446][ T9] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 226.005747][ T9] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 226.057763][ T9] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 226.070505][ T9] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 226.089078][ T9] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 226.143646][ T5714] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 226.370710][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.385941][ T5714] usb 5-1: unable to get BOS descriptor or descriptor too short [ 226.428140][ T5714] usb 5-1: config 63 has an invalid interface number: 66 but max is 0 [ 226.446567][ T5714] usb 5-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 226.474560][ T5714] usb 5-1: config 63 has no interface number 0 [ 226.505840][ T5714] usb 5-1: config 63 interface 66 has no altsetting 0 [ 226.762711][ T9] usb 2-1: GET_CAPABILITIES returned 0 [ 226.769661][ T5714] usb 5-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 226.781008][ T9] usbtmc 2-1:16.0: can't read capabilities [ 226.786941][ T5714] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.831367][ T5714] usb 5-1: Product: syz [ 226.858924][ T5714] usb 5-1: Manufacturer: syz [ 226.872487][ T5714] usb 5-1: SerialNumber: syz [ 226.962511][ T7782] TCP: TCP_TX_DELAY enabled [ 226.977077][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 227.001253][ T7738] usbtmc 2-1:16.0: Unable to send data, error -71 [ 227.060034][ T7797] loop7: detected capacity change from 0 to 16384 [ 227.142774][ T5714] uvcvideo 5-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 227.156313][ T5714] uvcvideo 5-1:63.66: No valid video chain found. [ 227.185567][ T5714] usb 5-1: USB disconnect, device number 17 [ 227.619516][ T30] audit: type=1400 audit(1780047567.610:589): avc: denied { ioctl } for pid=7799 comm="syz.0.506" path="socket:[18013]" dev="sockfs" ino=18013 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 227.660147][ T30] audit: type=1400 audit(1780047567.640:590): avc: denied { read } for pid=7799 comm="syz.0.506" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 227.708423][ T5932] block nbd0: Possible stuck request ffff888027fb5080: control (read@0,1024B). Runtime 120 seconds [ 227.719286][ T5932] block nbd0: Possible stuck request ffff888027fb5240: control (read@1024,1024B). Runtime 120 seconds [ 227.730828][ T5932] block nbd0: Possible stuck request ffff888027fb5400: control (read@2048,1024B). Runtime 120 seconds [ 227.742272][ T5932] block nbd0: Possible stuck request ffff888027fb55c0: control (read@3072,1024B). Runtime 120 seconds [ 227.744646][ T7805] fuse: fd is not a fuse device [ 227.860461][ C1] I/O error, dev loop7, sector 4352 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 2 [ 227.863793][ T7797] loop7: detected capacity change from 16384 to 0 [ 228.069688][ T5814] usb 2-1: USB disconnect, device number 17 [ 228.421268][ T30] audit: type=1400 audit(1780047568.410:591): avc: denied { mount } for pid=7822 comm="syz.4.511" name="/" dev="autofs" ino=18034 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 229.393267][ T7838] veth5: entered promiscuous mode [ 229.890267][ T30] audit: type=1400 audit(1780047569.880:592): avc: denied { read } for pid=7847 comm="syz.2.518" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 230.003189][ T5810] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 230.019305][ T5714] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 230.183125][ T5714] usb 5-1: Using ep0 maxpacket: 16 [ 230.405482][ T5714] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.413968][ T5810] usb 6-1: not running at top speed; connect to a high speed hub [ 230.416236][ T5714] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 230.424771][ T5810] usb 6-1: config 1 interface 0 has no altsetting 0 [ 230.437991][ T5714] usb 5-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 230.455985][ T5810] usb 6-1: language id specifier not provided by device, defaulting to English [ 230.466706][ T5810] usb 6-1: New USB device found, idVendor=1241, idProduct=f767, bcdDevice= 0.40 [ 230.476150][ T5810] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.484419][ T5810] usb 6-1: Product: syz [ 230.488700][ T5810] usb 6-1: Manufacturer: 馚퀋怘̓⸩ㅻ髿୬è±ïµëŠ™äžŸæ¯¤ìŽ²è•¼æ¶å«¬ì哖鳘놆젖蚢å¹Å®Íœížâ•ƒè´°áƒ»éŒïš—ê⃧뤓åºíœ»ì³¡æŽà¥•ä¼¼ç­° [ 230.505955][ T5810] usb 6-1: SerialNumber: syz [ 230.520209][ T5714] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 230.552119][ T5714] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 230.561570][ T5714] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 230.572725][ T5714] usb 5-1: Manufacturer: syz [ 230.580121][ T5714] usb 5-1: config 0 descriptor?? [ 230.742224][ T7845] tipc: Started in network mode [ 230.747562][ T7845] tipc: Node identity be5367a18bcb, cluster identity 4711 [ 230.755037][ T7845] tipc: Enabled bearer , priority 0 [ 230.829597][ T7856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.862131][ T7845] syzkaller0: entered promiscuous mode [ 230.871175][ T30] audit: type=1400 audit(1780047570.860:593): avc: denied { watch } for pid=7857 comm="syz.2.521" path="/115/file1" dev="tmpfs" ino=642 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 230.894324][ T7856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.906760][ T7845] syzkaller0: entered allmulticast mode [ 230.913720][ T7845] tipc: Resetting bearer [ 230.919529][ T30] audit: type=1400 audit(1780047570.860:594): avc: denied { watch_sb watch_reads } for pid=7857 comm="syz.2.521" path="/115/file1" dev="tmpfs" ino=642 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 230.963176][ T5714] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 230.982203][ T7844] tipc: Resetting bearer [ 231.126378][ T5714] usb 2-1: unable to get BOS descriptor or descriptor too short [ 231.156277][ T5714] usb 2-1: config 63 has an invalid interface number: 66 but max is 0 [ 231.176063][ T5714] usb 2-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 231.203127][ T5714] usb 2-1: config 63 has no interface number 0 [ 231.211708][ T5714] usb 2-1: config 63 interface 66 has no altsetting 0 [ 231.221832][ T5714] usb 2-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 231.231151][ T5714] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.246112][ T5714] usb 2-1: Product: syz [ 231.262515][ T5714] usb 2-1: Manufacturer: syz [ 231.267264][ T5714] usb 2-1: SerialNumber: syz [ 231.524984][ T5714] uvcvideo 2-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 231.532607][ T5714] uvcvideo 2-1:63.66: No valid video chain found. [ 231.548108][ T5714] usb 2-1: USB disconnect, device number 18 [ 231.592697][ T30] audit: type=1400 audit(1780047571.580:595): avc: denied { ioctl } for pid=7862 comm="syz.2.522" path="socket:[18116]" dev="sockfs" ino=18116 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 231.625088][ T30] audit: type=1400 audit(1780047571.620:596): avc: denied { write } for pid=7862 comm="syz.2.522" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 232.101183][ T30] audit: type=1400 audit(1780047572.090:597): avc: denied { create } for pid=7877 comm="syz.1.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 232.161860][ T30] audit: type=1400 audit(1780047572.150:598): avc: denied { write } for pid=7877 comm="syz.1.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 232.439038][ T5626] usb 5-1: USB disconnect, device number 18 [ 232.913702][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 232.913721][ T30] audit: type=1400 audit(1780047572.630:600): avc: denied { bind } for pid=7892 comm="syz.4.528" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 232.975559][ T30] audit: type=1400 audit(1780047572.630:601): avc: denied { name_bind } for pid=7892 comm="syz.4.528" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 232.996953][ T30] audit: type=1400 audit(1780047572.630:602): avc: denied { node_bind } for pid=7892 comm="syz.4.528" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 233.104841][ T7844] tipc: Disabling bearer [ 233.116216][ T5714] tipc: Node number set to 899180449 [ 233.146783][ T7863] wg1 speed is unknown, defaulting to 1000 [ 233.155681][ T7888] wg1 speed is unknown, defaulting to 1000 [ 233.186450][ T5810] usbhid 6-1:1.0: can't add hid device: -71 [ 233.200694][ T5810] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 233.228260][ T5810] usb 6-1: USB disconnect, device number 6 [ 233.418212][ T7901] geneve2: entered promiscuous mode [ 233.423705][ T7901] geneve2: entered allmulticast mode [ 233.676597][ T5810] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 233.907759][ T9] wg1 speed is unknown, defaulting to 1000 [ 233.983884][ T5810] usb 6-1: Using ep0 maxpacket: 8 [ 233.991439][ T5810] usb 6-1: unable to get BOS descriptor or descriptor too short [ 234.009116][ T5810] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 234.049622][ T5810] usb 6-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice=44.07 [ 234.071049][ T5810] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.493691][ T5810] usb 6-1: Product: syz [ 234.497909][ T5810] usb 6-1: Manufacturer: syz [ 234.502517][ T5810] usb 6-1: SerialNumber: syz [ 235.854358][ T7899] wg1 speed is unknown, defaulting to 1000 [ 236.119866][ T5810] cxacru 6-1:1.0: usbatm_usb_probe: bind failed: -19! [ 236.127662][ T7923] netlink: 132 bytes leftover after parsing attributes in process `syz.4.537'. [ 236.162786][ T5810] usb 6-1: USB disconnect, device number 7 [ 236.208488][ T7922] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 236.239519][ T7922] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 236.267931][ T7922] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 236.723125][ T5810] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 236.886416][ T5810] usb 2-1: unable to get BOS descriptor or descriptor too short [ 236.902576][ T5810] usb 2-1: config 63 has an invalid interface number: 66 but max is 0 [ 236.918514][ T5810] usb 2-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 236.938199][ T5810] usb 2-1: config 63 has no interface number 0 [ 236.950950][ T5810] usb 2-1: config 63 interface 66 has no altsetting 0 [ 236.982971][ T5810] usb 2-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 236.997932][ T5810] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.009647][ T5810] usb 2-1: Product: syz [ 237.063109][ T9] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 237.118315][ T7937] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.174228][ T7937] bridge_slave_0 (unregistering): left allmulticast mode [ 237.181413][ T7937] bridge_slave_0 (unregistering): left promiscuous mode [ 237.189956][ T7937] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.697747][ T5810] usb 2-1: Manufacturer: syz [ 237.894514][ T7943] trusted_key: encrypted_key: insufficient parameters specified [ 238.013494][ T5810] usb 2-1: SerialNumber: syz [ 238.049473][ T7943] could not allocate digest TFM handle poly1305-simd [ 238.160725][ T30] audit: type=1400 audit(1780047578.150:603): avc: denied { setopt } for pid=7950 comm="syz.2.545" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 238.192960][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 238.223188][ T9] usb 6-1: config 0 has no interfaces? [ 238.229756][ T9] usb 6-1: New USB device found, idVendor=1b80, idProduct=e396, bcdDevice=a7.b1 [ 238.240200][ T9] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 238.248388][ T9] usb 6-1: Manufacturer: syz [ 238.265892][ T9] usb 6-1: config 0 descriptor?? [ 238.277783][ T5810] uvcvideo 2-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 238.286683][ T5810] uvcvideo 2-1:63.66: No valid video chain found. [ 238.298142][ T5810] usb 2-1: USB disconnect, device number 19 [ 238.980335][ T30] audit: type=1400 audit(1780047578.970:604): avc: denied { write } for pid=7933 comm="syz.5.540" name="sg0" dev="devtmpfs" ino=768 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 239.004646][ T7934] netlink: 'syz.5.540': attribute type 1 has an invalid length. [ 239.012280][ T7934] netlink: 224 bytes leftover after parsing attributes in process `syz.5.540'. [ 239.049920][ T30] audit: type=1400 audit(1780047579.040:605): avc: denied { read } for pid=5280 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 239.056484][ T7957] xt_l2tp: invalid flags combination: 0 [ 239.349983][ T30] audit: type=1400 audit(1780047579.330:606): avc: denied { create } for pid=7958 comm="syz.2.547" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 239.369759][ T30] audit: type=1400 audit(1780047579.330:607): avc: denied { ioctl } for pid=7958 comm="syz.2.547" path="socket:[18367]" dev="sockfs" ino=18367 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 239.714349][ T5742] usb 6-1: USB disconnect, device number 8 [ 239.796059][ T7965] 9p: Bad value for 'rfdno' [ 240.127767][ T7975] netlink: 132 bytes leftover after parsing attributes in process `syz.2.551'. [ 240.138104][ T7975] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 240.146487][ T7975] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 240.155131][ T7975] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 240.513202][ T5810] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 240.647605][ T7969] syz_tun (unregistering): left allmulticast mode [ 240.673266][ T5810] usb 6-1: Using ep0 maxpacket: 16 [ 240.780383][ T5810] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 240.791380][ T5810] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 240.802408][ T5810] usb 6-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 240.813121][ T5810] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 240.827354][ T5810] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 240.838053][ T5810] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 240.847305][ T5810] usb 6-1: Manufacturer: syz [ 240.869323][ T5810] usb 6-1: config 0 descriptor?? [ 241.366748][ T1119] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.526861][ T1119] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.708988][ T1119] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.928066][ T5621] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 242.947984][ T5621] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 242.956261][ T5621] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 242.965018][ T5621] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 242.973414][ T5621] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 243.048647][ T1119] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.293214][ T8002] ubi: mtd0 is already attached to ubi16 [ 243.328837][ T8002] netlink: 'syz.4.561': attribute type 10 has an invalid length. [ 243.338089][ T8002] netlink: 40 bytes leftover after parsing attributes in process `syz.4.561'. [ 243.351907][ T8002] bridge0: port 1(veth1_macvtap) entered blocking state [ 243.360387][ T8002] bridge0: port 1(veth1_macvtap) entered disabled state [ 243.370201][ T8002] veth1_macvtap: entered allmulticast mode [ 243.389968][ T8002] veth1_macvtap: left allmulticast mode [ 243.397403][ T8002] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check. [ 243.564138][ T5619] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 243.577028][ T5619] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 243.588834][ T5619] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 243.596738][ T5619] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 243.605654][ T5619] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 243.771419][ T30] audit: type=1400 audit(1780047583.750:608): avc: denied { search } for pid=5280 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 243.897354][ T30] audit: type=1400 audit(1780047583.750:609): avc: denied { search } for pid=5280 comm="dhcpcd" name="udev" dev="tmpfs" ino=9 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 243.993904][ T30] audit: type=1400 audit(1780047583.750:610): avc: denied { search } for pid=5280 comm="dhcpcd" name="data" dev="tmpfs" ino=14 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 244.088522][ T30] audit: type=1400 audit(1780047583.750:611): avc: denied { read } for pid=5280 comm="dhcpcd" name="n31" dev="tmpfs" ino=3761 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 244.156681][ T805] usb 6-1: USB disconnect, device number 9 [ 244.188510][ T1119] bridge_slave_1: left allmulticast mode [ 244.197309][ T30] audit: type=1400 audit(1780047583.760:612): avc: denied { open } for pid=5280 comm="dhcpcd" path="/run/udev/data/n31" dev="tmpfs" ino=3761 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 244.220232][ T1119] bridge_slave_1: left promiscuous mode [ 244.225546][ T1119] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.276094][ T30] audit: type=1400 audit(1780047583.760:613): avc: denied { getattr } for pid=5280 comm="dhcpcd" path="/run/udev/data/n31" dev="tmpfs" ino=3761 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 244.353202][ T30] audit: type=1400 audit(1780047584.110:614): avc: denied { read } for pid=8028 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1778 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 244.402094][ T1119] bridge_slave_0: left allmulticast mode [ 244.409179][ T1119] bridge_slave_0: left promiscuous mode [ 244.419291][ T1119] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.433662][ T30] audit: type=1400 audit(1780047584.110:615): avc: denied { read open } for pid=8028 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1778 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 244.513289][ T8038] xt_nfacct: accounting object `syz1' does not exist [ 244.620154][ T30] audit: type=1400 audit(1780047584.110:616): avc: denied { getattr } for pid=8028 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1778 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 246.010520][ T5621] Bluetooth: hci6: command tx timeout [ 246.016871][ T5619] Bluetooth: hci2: command tx timeout [ 246.025869][ T30] audit: type=1400 audit(1780047585.640:617): avc: denied { write } for pid=8024 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 246.100382][ T1119] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 246.115162][ T1119] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 246.124886][ T1119] bond0 (unregistering): Released all slaves [ 246.143276][ T5280] 8021q: adding VLAN 0 to HW filter on device eth1 [ 246.150912][ T7996] wg1 speed is unknown, defaulting to 1000 [ 246.167333][ T8043] wg1 speed is unknown, defaulting to 1000 [ 246.823741][ T8007] wg1 speed is unknown, defaulting to 1000 [ 247.624373][ T5742] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 247.856319][ T5742] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 247.914478][ T5742] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 247.971468][ T5742] usb 6-1: config 0 has no interface number 0 [ 247.990914][ T5742] usb 6-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 248.010263][ T5742] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.023737][ T5619] Bluetooth: hci6: command tx timeout [ 248.045246][ T5742] usb 6-1: Product: syz [ 248.062734][ T5742] usb 6-1: Manufacturer: syz [ 248.082596][ T5742] usb 6-1: SerialNumber: syz [ 248.103298][ T5619] Bluetooth: hci2: command tx timeout [ 248.108325][ T5742] usb 6-1: config 0 descriptor?? [ 248.131268][ T5280] 8021q: adding VLAN 0 to HW filter on device eth2 [ 248.166754][ T7996] bridge0: port 1(bridge_slave_0) entered blocking state [ 248.176186][ T7996] bridge0: port 1(bridge_slave_0) entered disabled state [ 248.183853][ T7996] bridge_slave_0: entered allmulticast mode [ 248.191206][ T7996] bridge_slave_0: entered promiscuous mode [ 248.216390][ T7996] bridge0: port 2(bridge_slave_1) entered blocking state [ 248.224433][ T7996] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.243556][ T7996] bridge_slave_1: entered allmulticast mode [ 248.261315][ T7996] bridge_slave_1: entered promiscuous mode [ 248.392620][ T7996] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 248.443768][ T805] usb 6-1: USB disconnect, device number 10 [ 248.465935][ T7996] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 248.551235][ T1119] hsr_slave_0: left promiscuous mode [ 248.567449][ T1119] hsr_slave_1: left promiscuous mode [ 248.600315][ T1119] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 248.604820][ T8104] ubi: mtd0 is already attached to ubi16 [ 248.613136][ T1119] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 248.690238][ T8104] netlink: 'syz.4.570': attribute type 10 has an invalid length. [ 248.699819][ T8104] netlink: 40 bytes leftover after parsing attributes in process `syz.4.570'. [ 248.782111][ T1119] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 248.814815][ T1119] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 248.966664][ T1119] veth0_macvtap: left promiscuous mode [ 248.987192][ T1119] veth1_vlan: left promiscuous mode [ 249.003991][ T1119] veth0_vlan: left promiscuous mode [ 249.009955][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 249.009969][ T30] audit: type=1400 audit(1780047589.000:630): avc: denied { write } for pid=8103 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 249.159228][ T30] audit: type=1400 audit(1780047589.150:631): avc: denied { write } for pid=8121 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 249.287585][ T1119] team0 (unregistering): Port device team_slave_1 removed [ 249.300586][ T1119] team0 (unregistering): Port device team_slave_0 removed [ 249.374861][ T5742] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 249.410143][ T8104] bridge0: port 1(veth1_macvtap) entered blocking state [ 249.425536][ T8104] bridge0: port 1(veth1_macvtap) entered disabled state [ 249.433421][ T8104] veth1_macvtap: entered allmulticast mode [ 249.440542][ T8104] veth1_macvtap: left allmulticast mode [ 249.446715][ T8104] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check. [ 249.511913][ T5280] 8021q: adding VLAN 0 to HW filter on device eth3 [ 249.543217][ T5742] usb 6-1: Using ep0 maxpacket: 16 [ 249.550966][ T7996] team0: Port device team_slave_0 added [ 249.561694][ T5742] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 249.575916][ T7996] team0: Port device team_slave_1 added [ 249.590003][ T5742] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 249.610660][ T5742] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 249.652906][ T5742] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 249.685288][ T5742] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 249.735693][ T5742] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 249.760002][ T5742] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 249.780148][ T7996] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 249.789174][ T5742] usb 6-1: Manufacturer: syz [ 249.798853][ T7996] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 249.830462][ T5742] usb 6-1: config 0 descriptor?? [ 249.855621][ T7996] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 249.875310][ T8007] bridge0: port 1(bridge_slave_0) entered blocking state [ 249.885090][ T8007] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.908228][ T8007] bridge_slave_0: entered allmulticast mode [ 249.949342][ T8007] bridge_slave_0: entered promiscuous mode [ 249.972787][ T7996] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 249.987224][ T7996] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 250.025345][ T7996] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 250.060745][ T8007] bridge0: port 2(bridge_slave_1) entered blocking state [ 250.089627][ T8007] bridge0: port 2(bridge_slave_1) entered disabled state [ 250.105767][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 250.108231][ T5621] Bluetooth: hci6: command tx timeout [ 250.141495][ T8007] bridge_slave_1: entered allmulticast mode [ 250.165294][ T5742] rc_core: IR keymap rc-hauppauge not found [ 250.173017][ T5742] Registered IR keymap rc-empty [ 250.183177][ T5621] Bluetooth: hci2: command tx timeout [ 250.192767][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.204680][ T8007] bridge_slave_1: entered promiscuous mode [ 250.233798][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.306612][ T5742] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 250.344669][ T8007] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 250.361173][ T5742] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input7 [ 250.388595][ T8007] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 250.412886][ T30] audit: type=1400 audit(1780047590.400:632): avc: denied { read } for pid=4970 comm="acpid" name="event4" dev="devtmpfs" ino=2953 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 250.437599][ T7996] hsr_slave_0: entered promiscuous mode [ 250.443510][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.455650][ T7996] hsr_slave_1: entered promiscuous mode [ 250.470246][ T7996] debugfs: 'hsr0' already exists in 'hsr' [ 250.476184][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.493404][ T30] audit: type=1400 audit(1780047590.400:633): avc: denied { open } for pid=4970 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2953 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 250.517619][ T7996] Cannot create hsr debugfs directory [ 250.533177][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.563618][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.577195][ T30] audit: type=1400 audit(1780047590.400:634): avc: denied { ioctl } for pid=4970 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2953 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 250.623441][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.642303][ T8007] team0: Port device team_slave_0 added [ 250.648459][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.693214][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.713329][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.726426][ T8007] team0: Port device team_slave_1 added [ 250.744726][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.915566][ T5742] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 250.924993][ T30] audit: type=1400 audit(1780047590.920:635): avc: denied { append } for pid=8150 comm="syz.4.576" name="001" dev="devtmpfs" ino=743 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 250.934726][ T5742] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 250.956962][ T8151] usb usb8: usbfs: process 8151 (syz.4.576) did not claim interface 0 before use [ 250.974431][ T5742] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 251.317726][ T8007] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 251.343645][ T30] audit: type=1400 audit(1780047591.310:636): avc: denied { write } for pid=8140 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 251.444401][ T8007] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 251.499394][ T5742] usb 6-1: USB disconnect, device number 11 [ 251.509741][ T8007] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 251.594790][ T8007] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 251.610334][ T8007] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 251.673131][ T30] audit: type=1400 audit(1780047591.640:637): avc: denied { write } for pid=8161 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 251.706908][ T8007] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 251.836910][ T8007] hsr_slave_0: entered promiscuous mode [ 251.854517][ T8007] hsr_slave_1: entered promiscuous mode [ 251.864796][ T8007] debugfs: 'hsr0' already exists in 'hsr' [ 251.874481][ T8007] Cannot create hsr debugfs directory [ 251.894377][ T5280] 8021q: adding VLAN 0 to HW filter on device eth4 [ 252.183193][ T5621] Bluetooth: hci6: command tx timeout [ 252.273300][ T5621] Bluetooth: hci2: command tx timeout [ 252.899229][ T7996] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 252.974403][ T7996] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 252.989859][ T7996] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 253.016550][ T7996] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 253.093788][ T7996] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 253.125791][ T7996] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 253.159058][ T7996] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 253.175008][ T30] audit: type=1326 audit(1780047593.160:638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8177 comm="syz.4.581" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff99d19ce59 code=0x7ffc0000 [ 253.217177][ T7996] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 253.234146][ T30] audit: type=1326 audit(1780047593.160:639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8177 comm="syz.4.581" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff99d15d68e code=0x7ffc0000 [ 253.296996][ T8191] IPVS: sync thread started: state = BACKUP, mcast_ifn = bond_slave_1, syncid = 4, id = 0 [ 253.509406][ T8184] ubi: mtd0 is already attached to ubi16 [ 253.520819][ T8184] netlink: 'syz.5.582': attribute type 10 has an invalid length. [ 253.528847][ T8184] netlink: 40 bytes leftover after parsing attributes in process `syz.5.582'. [ 253.731996][ T8184] bridge0: port 3(veth1_macvtap) entered blocking state [ 253.751029][ T8184] bridge0: port 3(veth1_macvtap) entered disabled state [ 253.758482][ T8184] veth1_macvtap: entered allmulticast mode [ 253.768853][ T8184] veth1_macvtap: left allmulticast mode [ 253.782795][ T8184] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check. [ 253.800139][ T8007] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 253.814468][ T8007] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 253.839903][ T8007] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 253.894070][ T8195] binder: 8193:8195 ioctl c0285840 0 returned -22 [ 253.924424][ T8007] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 253.966075][ T8007] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 254.229548][ T8007] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 254.330837][ T8007] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 254.533676][ T8007] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 254.748661][ T7996] 8021q: adding VLAN 0 to HW filter on device bond0 [ 254.798528][ T7996] 8021q: adding VLAN 0 to HW filter on device team0 [ 255.776080][ T7768] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.783235][ T7768] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.664157][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.671302][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 256.742724][ T7996] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 256.775940][ T7996] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 257.132096][ T8219] netlink: 132 bytes leftover after parsing attributes in process `syz.4.587'. [ 257.153705][ T8220] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 257.163212][ T8220] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 257.171830][ T8220] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 258.178908][ T2094] block nbd0: Possible stuck request ffff888027fb5080: control (read@0,1024B). Runtime 150 seconds [ 258.190641][ T2094] block nbd0: Possible stuck request ffff888027fb5240: control (read@1024,1024B). Runtime 150 seconds [ 258.193078][ T8007] 8021q: adding VLAN 0 to HW filter on device bond0 [ 258.218032][ T2094] block nbd0: Possible stuck request ffff888027fb5400: control (read@2048,1024B). Runtime 150 seconds [ 258.252374][ T2094] block nbd0: Possible stuck request ffff888027fb55c0: control (read@3072,1024B). Runtime 150 seconds [ 258.973651][ T8007] 8021q: adding VLAN 0 to HW filter on device team0 [ 259.383132][ T7772] bridge0: port 1(bridge_slave_0) entered blocking state [ 259.390296][ T7772] bridge0: port 1(bridge_slave_0) entered forwarding state [ 259.438492][ T7772] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.445642][ T7772] bridge0: port 2(bridge_slave_1) entered forwarding state [ 259.796492][ T8007] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 259.958069][ T8241] netlink: 'syz.2.592': attribute type 10 has an invalid length. [ 259.965885][ T8241] netlink: 40 bytes leftover after parsing attributes in process `syz.2.592'. [ 259.974937][ T8241] bridge0: port 3(veth1_macvtap) entered blocking state [ 259.981910][ T8241] bridge0: port 3(veth1_macvtap) entered disabled state [ 259.988997][ T8241] veth1_macvtap: entered allmulticast mode [ 259.995776][ T8241] veth1_macvtap: left allmulticast mode [ 260.001593][ T8241] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check. [ 260.574090][ T7996] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 260.705257][ T8007] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 261.358997][ T7996] veth0_vlan: entered promiscuous mode [ 261.391650][ T7996] veth1_vlan: entered promiscuous mode [ 261.473109][ T5840] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 261.831419][ T5840] usb 6-1: unable to get BOS descriptor or descriptor too short [ 261.849442][ T7996] veth0_macvtap: entered promiscuous mode [ 261.856844][ T5840] usb 6-1: config 63 has an invalid interface number: 66 but max is 0 [ 261.877543][ T7996] veth1_macvtap: entered promiscuous mode [ 261.886110][ T5840] usb 6-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 261.906230][ T5840] usb 6-1: config 63 has no interface number 0 [ 261.921437][ T7996] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 261.930578][ T5840] usb 6-1: config 63 interface 66 has no altsetting 0 [ 261.959601][ T5840] usb 6-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 261.977928][ T7996] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 261.986939][ T5840] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.008241][ T5840] usb 6-1: Product: syz [ 262.015490][ T5840] usb 6-1: Manufacturer: syz [ 262.026967][ T5840] usb 6-1: SerialNumber: syz [ 262.049031][ T7370] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.071208][ T7370] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.093787][ T8007] veth0_vlan: entered promiscuous mode [ 262.106464][ T7370] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.134386][ T7370] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.191333][ T8007] veth1_vlan: entered promiscuous mode [ 262.283475][ T5840] uvcvideo 6-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 262.319246][ T8007] veth0_macvtap: entered promiscuous mode [ 262.333899][ T5840] uvcvideo 6-1:63.66: No valid video chain found. [ 262.362043][ T5840] usb 6-1: USB disconnect, device number 12 [ 262.409158][ T7370] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 262.417947][ T8007] veth1_macvtap: entered promiscuous mode [ 262.438403][ T7370] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 262.482238][ T7794] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 262.492051][ T8007] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 262.504068][ T7794] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 262.527536][ T8007] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 262.545776][ T7794] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.557279][ T7794] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.585491][ T7794] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.620689][ T7794] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.864955][ T58] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 262.887161][ T58] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 264.299621][ T7370] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 264.311453][ T7370] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 264.580051][ T8320] netlink: 52 bytes leftover after parsing attributes in process `syz.2.601'. [ 264.669940][ T8325] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8325 comm=syz.2.601 [ 265.121272][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 265.121290][ T30] audit: type=1400 audit(1780047605.070:659): avc: denied { getopt } for pid=8323 comm="syz.7.559" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 265.181852][ T8325] netlink: 52 bytes leftover after parsing attributes in process `syz.2.601'. [ 265.285766][ T30] audit: type=1400 audit(1780047605.280:660): avc: denied { map } for pid=8319 comm="syz.2.601" path="socket:[21020]" dev="sockfs" ino=21020 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 265.599237][ T30] audit: type=1400 audit(1780047605.590:661): avc: denied { write } for pid=8307 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 265.747517][ T30] audit: type=1400 audit(1780047605.730:662): avc: denied { create } for pid=8342 comm="syz.2.604" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 265.872077][ T30] audit: type=1400 audit(1780047605.810:663): avc: denied { write } for pid=8348 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 266.776228][ T30] audit: type=1400 audit(1780047605.870:664): avc: denied { open } for pid=8355 comm="syz.7.606" path="/dev/ptyr3" dev="devtmpfs" ino=138 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 267.145561][ T30] audit: type=1400 audit(1780047607.140:665): avc: denied { map } for pid=8372 comm="syz.6.610" path="/dev/zero" dev="devtmpfs" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 267.269186][ T8379] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 267.333113][ T5626] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 267.375165][ T8375] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 267.454465][ T8375] kvm: pic: non byte read [ 267.470191][ T8375] kvm: pic: level sensitive irq not supported [ 267.473878][ T8375] kvm: pic: non byte read [ 267.483099][ T5626] usb 5-1: Using ep0 maxpacket: 32 [ 267.491125][ T5626] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 267.533999][ T5626] usb 5-1: config 0 has no interface number 0 [ 267.566616][ T8375] kvm: pic: level sensitive irq not supported [ 267.566715][ T8375] kvm: pic: non byte read [ 267.591963][ T5626] usb 5-1: config 0 interface 184 has no altsetting 0 [ 267.665223][ T5626] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 267.729179][ T5626] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.758710][ T8375] kvm: pic: level sensitive irq not supported [ 267.759421][ T8375] kvm: pic: non byte read [ 267.840307][ T5626] usb 5-1: Product: syz [ 267.858024][ T5626] usb 5-1: Manufacturer: syz [ 267.899943][ T5626] usb 5-1: SerialNumber: syz [ 267.974276][ T30] audit: type=1400 audit(1780047607.900:666): avc: denied { name_connect } for pid=8393 comm="syz.2.614" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 268.166585][ T5626] usb 5-1: config 0 descriptor?? [ 268.868430][ T30] audit: type=1400 audit(1780047608.770:667): avc: denied { write } for pid=8368 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 269.471318][ T5626] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 270.467090][ T5626] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 270.542639][ T5626] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 270.606049][ T5626] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 270.652645][ T30] audit: type=1400 audit(1780047610.640:668): avc: denied { write } for pid=8402 comm="syz.2.616" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 270.654731][ T5626] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 270.696673][ T30] audit: type=1400 audit(1780047610.680:669): avc: denied { write } for pid=8404 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.719464][ T5626] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 270.753210][ T5626] usb 5-1: USB disconnect, device number 19 [ 271.224199][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 271.909031][ T30] audit: type=1400 audit(1780047611.900:670): avc: denied { remount } for pid=8437 comm="syz.5.621" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 271.961066][ T30] audit: type=1400 audit(1780047611.900:671): avc: denied { write } for pid=8414 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 271.987641][ T8439] option changes via remount are deprecated (pid=8437 comm=syz.5.621) [ 272.356480][ T30] audit: type=1400 audit(1780047612.170:672): avc: denied { firmware_load } for pid=8447 comm="syz.6.623" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 272.621907][ T30] audit: type=1400 audit(1780047612.230:673): avc: denied { write } for pid=8447 comm="syz.6.623" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 272.712433][ T30] audit: type=1400 audit(1780047612.700:674): avc: denied { map } for pid=8457 comm="syz.4.625" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 272.815996][ T30] audit: type=1400 audit(1780047612.700:675): avc: denied { execute } for pid=8457 comm="syz.4.625" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 272.849948][ T30] audit: type=1400 audit(1780047612.720:676): avc: denied { write } for pid=8454 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 272.907859][ T8451] syz.6.623 (8451) used greatest stack depth: 19416 bytes left [ 272.929061][ T30] audit: type=1400 audit(1780047612.910:677): avc: denied { watch } for pid=8461 comm="syz.5.626" path="/43/file1" dev="tmpfs" ino=245 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 273.199669][ T8481] netlink: 16 bytes leftover after parsing attributes in process `syz.7.630'. [ 275.398342][ T8517] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 275.440906][ T8517] netlink: 8 bytes leftover after parsing attributes in process `syz.4.638'. [ 275.607593][ T8525] netlink: 'syz.6.639': attribute type 1 has an invalid length. [ 275.615474][ T8525] netlink: 224 bytes leftover after parsing attributes in process `syz.6.639'. [ 275.627663][ T805] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 275.877042][ T805] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 275.970980][ T805] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.061900][ T805] usb 8-1: Product: syz [ 276.091065][ T805] usb 8-1: Manufacturer: syz [ 276.125259][ T805] usb 8-1: SerialNumber: syz [ 276.741965][ T805] cdc_ncm 8-1:1.0: bind() failure [ 276.860050][ T805] cdc_ncm 8-1:1.1: probe with driver cdc_ncm failed with error -71 [ 276.898717][ T805] cdc_mbim 8-1:1.1: probe with driver cdc_mbim failed with error -71 [ 276.957387][ T805] usbtest 8-1:1.1: probe with driver usbtest failed with error -71 [ 277.029210][ T805] usb 8-1: USB disconnect, device number 2 [ 278.147765][ T5840] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 278.354504][ T5840] usb 7-1: Using ep0 maxpacket: 8 [ 278.364881][ T5840] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 278.378739][ T5840] usb 7-1: config 179 has no interface number 0 [ 278.389469][ T5840] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 278.410262][ T5840] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 278.430502][ T5840] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 278.850559][ T5840] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 278.864151][ T5840] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 278.874370][ T5840] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.886491][ T8550] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 279.025980][ T8558] wg1 speed is unknown, defaulting to 1000 [ 279.106362][ T5840] usb 7-1: USB disconnect, device number 2 [ 279.660944][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 279.660962][ T30] audit: type=1400 audit(1780047619.650:685): avc: denied { nlmsg_read } for pid=8538 comm="syz.4.642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 281.154270][ T30] audit: type=1400 audit(1780047621.150:686): avc: denied { getopt } for pid=8583 comm="syz.5.653" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 281.213373][ T30] audit: type=1400 audit(1780047621.170:687): avc: denied { setopt } for pid=8583 comm="syz.5.653" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 281.525303][ T8597] netlink: 'syz.5.657': attribute type 10 has an invalid length. [ 281.536131][ T8597] 8021q: adding VLAN 0 to HW filter on device team0 [ 281.564019][ T8597] bond0: (slave team0): Enslaving as an active interface with an up link [ 281.593961][ T8601] process 'syz.7.656' launched './file0' with NULL argv: empty string added [ 281.674582][ T30] audit: type=1400 audit(1780047621.600:688): avc: denied { execute_no_trans } for pid=8598 comm="syz.7.656" path="/16/file0" dev="tmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 281.923138][ T5840] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 282.061367][ T8605] tipc: Enabling of bearer rejected, media not registered [ 282.077020][ T5840] usb 5-1: Using ep0 maxpacket: 32 [ 282.091654][ T5840] usb 5-1: unable to get BOS descriptor or descriptor too short [ 282.111125][ T5840] usb 5-1: config 2 has an invalid interface number: 107 but max is 2 [ 282.122930][ T5840] usb 5-1: config 2 has an invalid interface number: 109 but max is 2 [ 282.147046][ T5840] usb 5-1: config 2 has no interface number 1 [ 282.160465][ T5840] usb 5-1: config 2 has no interface number 2 [ 282.175500][ T5840] usb 5-1: config 2 interface 0 has no altsetting 0 [ 282.364956][ T5840] usb 5-1: config 2 interface 107 has no altsetting 0 [ 282.371887][ T5840] usb 5-1: config 2 interface 109 has no altsetting 0 [ 282.380871][ T5840] usb 5-1: New USB device found, idVendor=1199, idProduct=901b, bcdDevice=7c.5a [ 282.390390][ T5840] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.398698][ T5840] usb 5-1: Product: syz [ 282.404868][ T5840] usb 5-1: Manufacturer: syz [ 283.379794][ T5840] usb 5-1: SerialNumber: syz [ 283.760789][ T5840] usb 5-1: selecting invalid altsetting 0 [ 283.776499][ T5840] usb 5-1: Could not set interface, error -22 [ 283.803344][ T5840] usb 5-1: USB disconnect, device number 20 [ 286.166040][ T30] audit: type=1400 audit(1780047626.160:689): avc: denied { bind } for pid=8650 comm="syz.4.669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 286.186365][ T8652] netlink: 4 bytes leftover after parsing attributes in process `syz.4.669'. [ 286.200298][ T8652] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 286.247920][ T8652] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 286.482238][ T8659] ceph: No mds server is up or the cluster is laggy [ 286.513505][ T805] libceph: connect (1)[c::]:6789 error -101 [ 286.587653][ T805] libceph: mon0 (1)[c::]:6789 connect error [ 287.059147][ T8659] netlink: 16186 bytes leftover after parsing attributes in process `syz.6.672'. [ 287.086326][ T30] audit: type=1400 audit(1780047627.080:690): avc: denied { ioctl } for pid=8658 comm="syz.6.672" path="/dev/ptyr0" dev="devtmpfs" ino=135 ioctlcmd=0x5423 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 287.173135][ T30] audit: type=1400 audit(1780047627.080:691): avc: denied { write } for pid=8658 comm="syz.6.672" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 287.196741][ T30] audit: type=1400 audit(1780047627.080:692): avc: denied { open } for pid=8658 comm="syz.6.672" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 287.446790][ T30] audit: type=1400 audit(1780047627.440:693): avc: denied { ioctl } for pid=8676 comm="syz.4.675" path="/dev/rtc0" dev="devtmpfs" ino=922 ioctlcmd=0x7014 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 287.735340][ T30] audit: type=1400 audit(1780047627.730:694): avc: denied { bind } for pid=8680 comm="syz.6.676" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 287.849898][ T8689] netlink: 4 bytes leftover after parsing attributes in process `syz.4.677'. [ 287.986245][ T30] audit: type=1400 audit(1780047627.980:695): avc: denied { view } for pid=8687 comm="syz.5.678" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 288.653286][ T5932] block nbd0: Possible stuck request ffff888027fb5080: control (read@0,1024B). Runtime 180 seconds [ 288.664565][ T5932] block nbd0: Possible stuck request ffff888027fb5240: control (read@1024,1024B). Runtime 180 seconds [ 288.675654][ T5932] block nbd0: Possible stuck request ffff888027fb5400: control (read@2048,1024B). Runtime 180 seconds [ 288.689215][ T5932] block nbd0: Possible stuck request ffff888027fb55c0: control (read@3072,1024B). Runtime 180 seconds [ 288.706189][ T30] audit: type=1400 audit(1780047628.640:696): avc: denied { write } for pid=8691 comm="syz.2.679" path="socket:[22602]" dev="sockfs" ino=22602 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 288.915020][ T30] audit: type=1400 audit(1780047628.910:697): avc: denied { getopt } for pid=8707 comm="syz.4.684" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 289.010682][ T8710] netlink: 'syz.4.684': attribute type 1 has an invalid length. [ 289.071116][ T8710] mac80211_hwsim hwsim10 wlan0: entered allmulticast mode [ 289.144161][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 289.215965][ T8716] ipt_REJECT: TCP_RESET invalid for non-tcp [ 289.368164][ T30] audit: type=1400 audit(1780047629.360:698): avc: denied { setattr } for pid=8719 comm="syz.4.688" name="vcsa" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 289.369632][ T8720] netlink: 176 bytes leftover after parsing attributes in process `syz.4.688'. [ 289.973286][ T5749] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 290.618256][ T5749] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 290.631082][ T5749] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 290.644636][ T5749] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 290.653988][ T5749] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.665109][ T8729] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 290.706227][ T5749] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 290.888299][ T8740] netlink: 8 bytes leftover after parsing attributes in process `syz.5.693'. [ 291.022096][ T5840] usb 5-1: USB disconnect, device number 21 [ 291.205116][ T5749] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 291.443550][ T5735] usb 8-1: new full-speed USB device number 3 using dummy_hcd [ 291.813109][ T5749] usb 6-1: Using ep0 maxpacket: 16 [ 291.819772][ T5749] usb 6-1: config 128 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 291.831325][ T5749] usb 6-1: config 128 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 291.841590][ T5749] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 291.873488][ T5749] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.940810][ T8754] binder: 8753:8754 ioctl c0306201 200000000040 returned -11 [ 293.097080][ T5735] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 293.161428][ T5735] usb 8-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 293.318486][ T5735] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 293.349319][ T5735] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 293.378584][ T5735] usb 8-1: SerialNumber: syz [ 293.416754][ T5735] usb 8-1: No union descriptors [ 293.438048][ T5735] usb-storage 8-1:1.0: USB Mass Storage device detected [ 293.475968][ T5735] usb-storage 8-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 293.585876][ T30] audit: type=1400 audit(1780047633.570:699): avc: denied { ioctl } for pid=8770 comm="syz.2.701" path="socket:[22807]" dev="sockfs" ino=22807 ioctlcmd=0x8940 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 293.732132][ T30] audit: type=1400 audit(1780047633.610:700): avc: denied { create } for pid=8770 comm="syz.2.701" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 293.870641][ T8746] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 293.976501][ T8746] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 294.311325][ T8780] random: crng reseeded on system resumption [ 294.744147][ T30] audit: type=1400 audit(1780047634.340:701): avc: denied { ioctl } for pid=8745 comm="syz.7.695" path="/dev/snapshot" dev="devtmpfs" ino=92 ioctlcmd=0x3302 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 294.938918][ T5749] usbhid 6-1:128.0: can't add hid device: -71 [ 294.965482][ T30] audit: type=1326 audit(1780047634.960:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8786 comm="syz.6.698" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efd78d9ce59 code=0x0 [ 295.021273][ T5749] usbhid 6-1:128.0: probe with driver usbhid failed with error -71 [ 295.034379][ T9] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 295.070125][ T5749] usb 6-1: USB disconnect, device number 13 [ 295.160271][ T30] audit: type=1400 audit(1780047635.150:703): avc: denied { append } for pid=8791 comm="syz.5.706" name="loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 295.161498][ T8792] loop0: detected capacity change from 0 to 2640 [ 295.229217][ T9] usb 5-1: config 0 has an invalid interface number: 148 but max is 0 [ 295.250459][ T9] usb 5-1: config 0 has no interface number 0 [ 295.272655][ T9] usb 5-1: config 0 interface 148 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 10 [ 295.294780][ T8792] buffer_io_error: 6 callbacks suppressed [ 295.294792][ T8792] Buffer I/O error on dev loop0, logical block 0, async page read [ 295.309804][ T9] usb 5-1: config 0 interface 148 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 295.332289][ T9] usb 5-1: New USB device found, idVendor=0d46, idProduct=2012, bcdDevice=4d.ec [ 295.349329][ T8792] Buffer I/O error on dev loop0, logical block 0, async page read [ 295.358753][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.373300][ T9] usb 5-1: Product: syz [ 295.380592][ T9] usb 5-1: Manufacturer: syz [ 295.385478][ T8792] Buffer I/O error on dev loop0, logical block 0, async page read [ 295.396069][ T9] usb 5-1: SerialNumber: syz [ 295.406278][ T9] usb 5-1: config 0 descriptor?? [ 295.414479][ T8792] Buffer I/O error on dev loop0, logical block 0, async page read [ 295.428103][ T9] kobil_sct 5-1:0.148: KOBIL USB smart card terminal converter detected [ 295.449627][ T8792] Buffer I/O error on dev loop0, logical block 0, async page read [ 295.475203][ T8792] Buffer I/O error on dev loop0, logical block 0, async page read [ 295.483688][ T9] usb 5-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 295.517479][ T8792] Buffer I/O error on dev loop0, logical block 0, async page read [ 295.534158][ T8792] Buffer I/O error on dev loop0, logical block 0, async page read [ 295.564513][ T8792] ldm_validate_partition_table(): Disk read failed. [ 295.591488][ T8792] Buffer I/O error on dev loop0, logical block 0, async page read [ 295.620798][ T8792] Buffer I/O error on dev loop0, logical block 0, async page read [ 295.746274][ T8792] Dev loop0: unable to read RDB block 0 [ 295.776110][ T8792] loop0: unable to read partition table [ 295.784833][ T8792] loop_reread_partitions: partition scan of loop0 (3„ ¾‚³˜) failed (rc=-5) [ 296.293477][ T5735] usb 8-1: USB disconnect, device number 3 [ 296.327193][ T8793] ldm_validate_partition_table(): Disk read failed. [ 296.343671][ T8793] Dev loop0: unable to read RDB block 0 [ 296.371595][ T8793] loop0: unable to read partition table [ 296.385015][ T8793] loop_reread_partitions: partition scan of loop0 (3„ ¾‚³˜) failed (rc=-5) [ 296.408545][ T8800] netlink: 8 bytes leftover after parsing attributes in process `syz.2.707'. [ 296.418942][ T8800] netlink: 8 bytes leftover after parsing attributes in process `syz.2.707'. [ 296.427976][ T8800] netlink: 8 bytes leftover after parsing attributes in process `syz.2.707'. [ 296.437470][ T8800] netlink: 8 bytes leftover after parsing attributes in process `syz.2.707'. [ 297.622851][ T8813] netlink: 16402 bytes leftover after parsing attributes in process `syz.5.711'. [ 298.695536][ T9] usb 5-1: USB disconnect, device number 22 [ 298.742328][ T9] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 298.761087][ T8817] netlink: 276 bytes leftover after parsing attributes in process `syz.5.711'. [ 298.902605][ T8817] netlink: 276 bytes leftover after parsing attributes in process `syz.5.711'. [ 298.917946][ T9] kobil_sct 5-1:0.148: device disconnected [ 298.931105][ T8822] netlink: 348 bytes leftover after parsing attributes in process `syz.2.713'. [ 299.957856][ T8830] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2563 sclass=netlink_route_socket pid=8830 comm=syz.2.713 [ 300.720058][ T30] audit: type=1400 audit(1780047640.710:704): avc: denied { write } for pid=8834 comm="syz.5.717" path="socket:[22962]" dev="sockfs" ino=22962 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 300.932751][ T30] audit: type=1400 audit(1780047640.920:705): avc: denied { create } for pid=8843 comm="syz.5.720" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 301.689234][ T8853] netlink: 132 bytes leftover after parsing attributes in process `syz.6.723'. [ 301.716640][ T8853] netdevsim netdevsim6: loading /lib/firmware/. failed with error -22 [ 301.725238][ T8853] netdevsim netdevsim6: Direct firmware load for . failed with error -22 [ 301.737843][ T8853] netdevsim netdevsim6: Falling back to sysfs fallback for: . [ 302.730019][ T30] audit: type=1400 audit(1780047641.730:706): avc: denied { firmware_load } for pid=8849 comm="syz.6.723" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 303.463248][ T5621] Bluetooth: hci5: command 0x0406 tx timeout [ 303.557240][ T8861] netlink: 24 bytes leftover after parsing attributes in process `syz.2.725'. [ 303.595771][ T8861] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 303.604664][ T8861] IPv6: NLM_F_CREATE should be set when creating new route [ 304.270924][ T5735] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 304.860728][ T30] audit: type=1400 audit(1780047643.870:707): avc: denied { setopt } for pid=8867 comm="syz.2.728" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 305.073255][ T30] audit: type=1400 audit(1780047643.870:708): avc: denied { lock } for pid=8867 comm="syz.2.728" path="socket:[22406]" dev="sockfs" ino=22406 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 305.707184][ T30] audit: type=1400 audit(1780047645.060:709): avc: denied { read } for pid=8863 comm="syz.4.726" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 306.192485][ T30] audit: type=1326 audit(1780047646.180:710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.732" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a4f39ce59 code=0x7ffc0000 [ 306.519696][ T30] audit: type=1326 audit(1780047646.180:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.732" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a4f39ce59 code=0x7ffc0000 [ 306.728568][ T30] audit: type=1326 audit(1780047646.250:712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.732" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f2a4f39ce59 code=0x7ffc0000 [ 306.829372][ T5810] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 306.847706][ T5735] usb 5-1: unable to get BOS descriptor or descriptor too short [ 306.855594][ T5735] usb 5-1: no configurations [ 306.860796][ T5735] usb 5-1: can't read configurations, error -22 [ 306.918906][ T30] audit: type=1326 audit(1780047646.350:713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.732" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a4f39ce59 code=0x7ffc0000 [ 307.012391][ T8884] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.020194][ T8884] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.044720][ T5810] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 307.077220][ T30] audit: type=1326 audit(1780047646.350:714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.732" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a4f39ce59 code=0x7ffc0000 [ 307.250364][ T30] audit: type=1326 audit(1780047646.350:715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.732" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f2a4f39ce59 code=0x7ffc0000 [ 307.357742][ T8903] netlink: 'syz.7.736': attribute type 4 has an invalid length. [ 307.431607][ T8905] netlink: 32 bytes leftover after parsing attributes in process `syz.7.736'. [ 307.513352][ T5735] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 307.740768][ T30] audit: type=1326 audit(1780047646.390:716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.732" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a4f39ce59 code=0x7ffc0000 [ 307.832795][ T30] audit: type=1326 audit(1780047646.390:717): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.732" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a4f39ce59 code=0x7ffc0000 [ 307.849672][ T8884] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 307.900091][ T5735] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 307.916326][ T8884] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 307.924356][ T30] audit: type=1326 audit(1780047646.470:718): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.732" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f2a4f39ce59 code=0x7ffc0000 [ 307.925762][ T5735] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 307.974352][ T5735] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 307.989142][ T5735] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 307.998862][ T5735] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.012464][ T5735] usb 5-1: config 0 descriptor?? [ 308.046184][ T30] audit: type=1326 audit(1780047646.480:719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.732" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a4f39ce59 code=0x7ffc0000 [ 308.239179][ T1119] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.258351][ T1119] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.284136][ T1119] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.310453][ T1119] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.428477][ T5735] plantronics 0003:047F:FFFF.0004: reserved main item tag 0xd [ 308.852253][ T5735] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 308.928790][ T5735] usb 5-1: USB disconnect, device number 24 [ 308.958629][ T8917] fido_id[8917]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 310.382109][ T8932] netlink: 'syz.5.745': attribute type 4 has an invalid length. [ 310.451321][ T8932] netlink: 17 bytes leftover after parsing attributes in process `syz.5.745'. [ 310.451447][ T8933] netlink: 8 bytes leftover after parsing attributes in process `syz.5.745'. [ 310.462262][ T9] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 310.723072][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 311.593647][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.710971][ T9] usb 5-1: New USB device found, idVendor=154e, idProduct=500e, bcdDevice= 0.40 [ 312.144046][ T5810] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 312.447975][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 312.466778][ T9] usb 5-1: Product: syz [ 312.477698][ T9] usb 5-1: Manufacturer: syz [ 312.488756][ T9] usb 5-1: SerialNumber: syz [ 312.588610][ T58] Bluetooth: hci7: Frame reassembly failed (-84) [ 312.679344][ T5810] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 312.827791][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 312.827837][ T30] audit: type=1400 audit(1780047652.820:751): avc: denied { ioctl } for pid=8926 comm="syz.4.743" path="socket:[23080]" dev="sockfs" ino=23080 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 312.828036][ T5810] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 313.026602][ T5810] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.161664][ T5810] usb 7-1: config 0 descriptor?? [ 313.777859][ T9] usb 5-1: USB disconnect, device number 25 [ 313.830833][ T8960] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=8960 comm=syz.2.751 [ 313.893619][ T5810] ath6kl: Failed to submit usb control message: -71 [ 313.973541][ T5626] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 313.990905][ T5810] ath6kl: unable to send the bmi data to the device: -71 [ 314.026128][ T5810] ath6kl: Unable to send get target info: -71 [ 314.069449][ T5810] ath6kl: Failed to init ath6kl core: -71 [ 314.107882][ T5810] ath6kl_usb 7-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 314.155008][ T30] audit: type=1400 audit(1780047654.140:752): avc: denied { read write } for pid=8963 comm="syz.6.752" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 314.202699][ T30] audit: type=1400 audit(1780047654.140:753): avc: denied { open } for pid=8963 comm="syz.6.752" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 314.303242][ T30] audit: type=1400 audit(1780047654.140:754): avc: denied { ioctl } for pid=8963 comm="syz.6.752" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9371 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 315.193130][ T8973] netlink: 'syz.4.754': attribute type 4 has an invalid length. [ 315.196312][ T5621] Bluetooth: hci7: command 0x1003 tx timeout [ 315.202169][ T5619] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 315.227123][ T5626] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 315.271193][ T5810] usb 7-1: USB disconnect, device number 3 [ 315.439873][ T5626] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 315.703216][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 317.134190][ T5840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 317.146822][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 317.186870][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 317.749460][ T30] audit: type=1400 audit(1780047657.670:755): avc: denied { cmd } for pid=8982 comm="syz.6.758" path="/dev/ublk-control" dev="devtmpfs" ino=697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 318.004075][ T8987] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.756'. [ 318.057066][ T8991] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 318.173206][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 318.216786][ T29] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 318.302290][ T5626] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 318.445149][ T29] usb 5-1: Using ep0 maxpacket: 16 [ 318.461407][ T29] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 318.477866][ T29] usb 5-1: config 0 has no interface number 0 [ 318.500845][ T29] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 318.519717][ T30] audit: type=1400 audit(1780047658.510:756): avc: denied { accept } for pid=8979 comm="syz.7.757" lport=35870 faddr=10.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 318.542803][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.552526][ T29] usb 5-1: Product: syz [ 318.557039][ T29] usb 5-1: Manufacturer: syz [ 318.561791][ T29] usb 5-1: SerialNumber: syz [ 318.566666][ T5735] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 318.582016][ T29] usb 5-1: config 0 descriptor?? [ 318.595554][ T29] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 318.608684][ T8993] netlink: 64 bytes leftover after parsing attributes in process `syz.7.757'. [ 318.665889][ T8993] netlink: 64 bytes leftover after parsing attributes in process `syz.7.757'. [ 318.823286][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 318.872237][ T9003] netlink: 'syz.5.762': attribute type 2 has an invalid length. [ 319.207475][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 319.233489][ T29] gspca_spca1528: reg_w err -110 [ 319.245831][ T5735] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 319.269134][ T5735] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 319.275465][ T5932] block nbd0: Possible stuck request ffff888027fb5080: control (read@0,1024B). Runtime 210 seconds [ 319.279208][ T5735] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 319.279233][ T5735] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 319.283125][ T29] spca1528 5-1:0.1: probe with driver spca1528 failed with error -110 [ 319.293200][ T5932] block nbd0: Possible stuck request ffff888027fb5240: control (read@1024,1024B). Runtime 210 seconds [ 319.321872][ T8995] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 319.329372][ T5932] block nbd0: Possible stuck request ffff888027fb5400: control (read@2048,1024B). Runtime 210 seconds [ 319.399560][ T5932] block nbd0: Possible stuck request ffff888027fb55c0: control (read@3072,1024B). Runtime 210 seconds [ 319.432263][ T8992] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 319.459700][ T8904] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 319.484947][ T8992] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 319.497188][ T5735] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 319.715519][ T30] audit: type=1400 audit(1780047659.710:757): avc: denied { setopt } for pid=9006 comm="syz.7.764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 319.754635][ T30] audit: type=1400 audit(1780047659.730:758): avc: denied { read } for pid=9006 comm="syz.7.764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 319.788943][ T5735] usb 7-1: USB disconnect, device number 4 [ 320.733737][ T5810] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 320.741862][ T805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 320.975221][ T5810] usb 5-1: USB disconnect, device number 26 [ 321.027815][ T30] audit: type=1400 audit(1780047661.010:759): avc: denied { map } for pid=9019 comm="syz.5.769" path="socket:[23201]" dev="sockfs" ino=23201 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 321.084279][ T30] audit: type=1400 audit(1780047661.010:760): avc: denied { read } for pid=9019 comm="syz.5.769" path="socket:[23201]" dev="sockfs" ino=23201 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 321.294238][ T30] audit: type=1400 audit(1780047661.280:761): avc: denied { mount } for pid=9031 comm="syz.4.771" name="/" dev="hugetlbfs" ino=23213 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 321.380871][ T30] audit: type=1400 audit(1780047661.370:762): avc: denied { unmount } for pid=5623 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 321.493803][ T9037] netlink: 132 bytes leftover after parsing attributes in process `syz.4.772'. [ 321.525002][ T9037] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 321.533381][ T9037] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 321.543648][ T9037] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 321.783462][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.792729][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.809215][ T805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.943243][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 322.075763][ T5735] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 322.307403][ T1119] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 322.633212][ T30] audit: type=1400 audit(1780047662.530:763): avc: denied { mount } for pid=9041 comm="syz.7.773" name="/" dev="bdev" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bdev_t tclass=filesystem permissive=1 [ 324.014501][ T9051] xt_hashlimit: max too large, truncated to 1048576 [ 324.062192][ T9055] netlink: 68 bytes leftover after parsing attributes in process `syz.5.776'. [ 324.080172][ T9051] xt_hashlimit: overflow, try lower: 2/0 [ 324.109297][ T30] audit: type=1400 audit(1780047664.090:764): avc: denied { create } for pid=9047 comm="syz.6.774" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 324.156759][ T30] audit: type=1400 audit(1780047664.130:765): avc: denied { sys_admin } for pid=9047 comm="syz.6.774" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 324.212381][ T9062] cgroup: Need name or subsystem set [ 324.252591][ T9062] binder: 9059:9062 ioctl c018620c 200000000080 returned -1 [ 324.345676][ T31] INFO: task syz.3.291:6902 blocked for more than 142 seconds. [ 324.385839][ T31] Tainted: G L syzkaller #0 [ 324.412873][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 324.430367][ T31] task:syz.3.291 state:D stack:27832 pid:6902 tgid:6897 ppid:5625 task_flags:0x400140 flags:0x00080002 [ 324.450621][ T31] Call Trace: [ 324.454898][ T31] [ 324.457838][ T31] __schedule+0x1295/0x67a0 [ 324.462334][ T31] ? __pfx___schedule+0x10/0x10 [ 324.467925][ T31] ? find_held_lock+0x2b/0x80 [ 324.472634][ T31] ? schedule+0x2bf/0x390 [ 324.479375][ T31] schedule+0xdd/0x390 [ 324.483799][ T31] schedule_preempt_disabled+0x13/0x30 [ 324.507130][ T31] __mutex_lock+0xced/0x1b10 [ 324.514824][ T31] ? sync_bdevs+0x153/0x480 [ 324.519403][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 324.523600][ T9072] usb usb8: usbfs: process 9072 (syz.7.780) did not claim interface 0 before use [ 324.525050][ T31] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 324.622721][ T31] ? iput.part.0+0x1a0/0xf50 [ 324.629119][ T31] ? sync_bdevs+0x153/0x480 [ 324.634038][ T31] sync_bdevs+0x153/0x480 [ 324.639115][ T31] ksys_sync+0xb0/0xf0 [ 324.644306][ T31] ? __pfx_ksys_sync+0x10/0x10 [ 324.650214][ T31] ? __secure_computing+0x201/0x2e0 [ 324.657453][ T31] __do_sys_sync+0xe/0x20 [ 324.672359][ T31] do_syscall_64+0x115/0x870 [ 324.681882][ T31] ? clear_bhb_loop+0x40/0x90 [ 324.693211][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 324.702534][ T31] RIP: 0033:0x7fd4e899ce59 [ 324.711323][ T31] RSP: 002b:00007fd4e9814028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 324.737149][ T31] RAX: ffffffffffffffda RBX: 00007fd4e8c16180 RCX: 00007fd4e899ce59 [ 324.757175][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 324.770570][ T31] RBP: 00007fd4e8c16180 R08: 0000000000000000 R09: 0000000000000000 [ 324.785931][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 324.799087][ T31] R13: 00007fd4e8c16218 R14: 00007fd4e8c16180 R15: 00007ffffcc9cb58 [ 324.814838][ T31] [ 324.820716][ T31] [ 324.820716][ T31] Showing all locks held in the system: [ 324.834871][ T31] 1 lock held by khungtaskd/31: [ 324.851856][ T31] #0: ffffffff8e7e5620 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 324.871369][ T31] 3 locks held by kworker/u8:8/1119: [ 324.880943][ T31] #0: ffff88813fe94140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 [ 324.901810][ T31] #1: ffffc900052efd08 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 [ 324.933787][ T31] #2: ffffffff8e7f1168 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 [ 324.956316][ T31] 2 locks held by getty/5377: [ 324.965793][ T31] #0: ffff888037c800a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 324.987442][ T8904] net_ratelimit: 6 callbacks suppressed [ 324.987460][ T8904] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 324.988664][ T31] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14f0 [ 325.066071][ T31] 1 lock held by udevd/5959: [ 325.097822][ T31] #0: ffff888027f5b350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 325.133130][ T31] 1 lock held by syz.3.291/6902: [ 325.150451][ T31] #0: ffff888027f5b350 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x153/0x480 [ 325.174199][ T31] 4 locks held by kworker/u8:16/7370: [ 325.191007][ T31] #0: ffff8880b843b2e0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 [ 325.216727][ T31] #1: ffff8880b8524648 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2f15/0x67a0 [ 325.244820][ T31] #2: ffffffff8e7e5620 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 [ 325.273086][ T31] #3: ffffffff9b40f6b8 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x144/0x490 [ 325.303622][ T31] 1 lock held by syz.0.506/7800: [ 325.321616][ T31] #0: ffff888027f5b350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 325.345753][ T31] 2 locks held by syz.4.772/9040: [ 325.359577][ T31] 5 locks held by syz.6.774/9060: [ 325.373874][ T31] [ 325.378966][ T31] ============================================= [ 325.378966][ T31] [ 325.387643][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 325.425391][ T31] NMI backtrace for cpu 0 [ 325.425413][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 325.425438][ T31] Tainted: [L]=SOFTLOCKUP [ 325.425444][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 325.425455][ T31] Call Trace: [ 325.425461][ T31] [ 325.425468][ T31] dump_stack_lvl+0x100/0x190 [ 325.425494][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 325.425515][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 325.425537][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 325.425559][ T31] sys_info+0x141/0x190 [ 325.425584][ T31] watchdog+0xcb1/0x1030 [ 325.425609][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 325.425632][ T31] ? __pfx_watchdog+0x10/0x10 [ 325.425653][ T31] ? __kthread_parkme+0x18c/0x230 [ 325.425685][ T31] ? kthread+0x13a/0x450 [ 325.425703][ T31] ? __pfx_watchdog+0x10/0x10 [ 325.425721][ T31] kthread+0x370/0x450 [ 325.425749][ T31] ? __pfx_kthread+0x10/0x10 [ 325.425771][ T31] ret_from_fork+0x72b/0xd50 [ 325.425794][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 325.425817][ T31] ? __switch_to+0x800/0x1100 [ 325.425844][ T31] ? __pfx_kthread+0x10/0x10 [ 325.425865][ T31] ret_from_fork_asm+0x1a/0x30 [ 325.425901][ T31] [ 325.425909][ T31] Sending NMI from CPU 0 to CPUs 1: [ 325.557432][ C1] NMI backtrace for cpu 1 [ 325.557448][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 325.557468][ C1] Tainted: [L]=SOFTLOCKUP [ 325.557473][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 325.557481][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 325.557503][ C1] Code: f5 92 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 51 22 00 fb f4 fc 43 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 325.557516][ C1] RSP: 0018:ffffc90000197df0 EFLAGS: 00000242 [ 325.557528][ C1] RAX: 00000000012868e5 RBX: ffff88801e2b2540 RCX: ffffffff8b894285 [ 325.557538][ C1] RDX: 0000000000000000 RSI: ffffffff8df0eee6 RDI: ffffffff8c1c4480 [ 325.557547][ C1] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed10170a67b5 [ 325.557556][ C1] R10: ffff8880b8533dab R11: 0000000000000000 R12: 0000000000000001 [ 325.557564][ C1] R13: ffffed1003c564a8 R14: 0000000000000001 R15: ffffffff90d70550 [ 325.557573][ C1] FS: 0000000000000000(0000) GS:ffff888124486000(0000) knlGS:0000000000000000 [ 325.557587][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 325.557596][ C1] CR2: 00007efd78fea2f8 CR3: 000000003473e000 CR4: 00000000003526f0 [ 325.557605][ C1] Call Trace: [ 325.557610][ C1] [ 325.557615][ C1] default_idle+0x9/0x10 [ 325.557634][ C1] default_idle_call+0x6c/0xb0 [ 325.557652][ C1] do_idle+0x464/0x590 [ 325.557675][ C1] ? __pfx_do_idle+0x10/0x10 [ 325.557693][ C1] ? finish_task_switch.isra.0+0x152/0x1010 [ 325.557716][ C1] cpu_startup_entry+0x4f/0x60 [ 325.557728][ C1] start_secondary+0x21d/0x2d0 [ 325.557744][ C1] ? __pfx_start_secondary+0x10/0x10 [ 325.557760][ C1] common_startup_64+0x13e/0x148 [ 325.557785][ C1] [ 325.735810][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 325.742675][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 325.753338][ T31] Tainted: [L]=SOFTLOCKUP [ 325.757645][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 325.767689][ T31] Call Trace: [ 325.770957][ T31] [ 325.773875][ T31] dump_stack_lvl+0x100/0x190 [ 325.778539][ T31] vpanic+0x552/0x970 [ 325.782504][ T31] ? __pfx_vpanic+0x10/0x10 [ 325.787073][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 325.793433][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 325.799572][ T31] panic+0xd1/0xe0 [ 325.803280][ T31] ? __pfx_panic+0x10/0x10 [ 325.807688][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 325.813833][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 325.819969][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 325.826111][ T31] ? watchdog.cold+0x1ec/0x234 [ 325.830861][ T31] ? watchdog+0xcc1/0x1030 [ 325.835275][ T31] watchdog.cold+0x1fd/0x234 [ 325.839858][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 325.845650][ T31] ? __pfx_watchdog+0x10/0x10 [ 325.850310][ T31] ? __kthread_parkme+0x18c/0x230 [ 325.855326][ T31] ? kthread+0x13a/0x450 [ 325.859549][ T31] ? __pfx_watchdog+0x10/0x10 [ 325.864206][ T31] kthread+0x370/0x450 [ 325.868261][ T31] ? __pfx_kthread+0x10/0x10 [ 325.872852][ T31] ret_from_fork+0x72b/0xd50 [ 325.877438][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 325.882530][ T31] ? __switch_to+0x800/0x1100 [ 325.887194][ T31] ? __pfx_kthread+0x10/0x10 [ 325.891778][ T31] ret_from_fork_asm+0x1a/0x30 [ 325.896550][ T31] [ 325.899948][ T31] Kernel Offset: disabled [ 325.904266][ T31] Rebooting in 86400 seconds..