last executing test programs: 11.096480733s ago: executing program 4 (id=2403): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100000000060000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) 10.8815994s ago: executing program 3 (id=2405): setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) setsockopt$TIPC_GROUP_LEAVE(0xffffffffffffffff, 0x10f, 0x88) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_open_procfs(0x0, &(0x7f0000000200)='environ\x00') socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x2, 0x80805, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x1, 0x0) bind$netlink(r2, &(0x7f0000000140)={0x10, 0x0, 0x25dfdbfc, 0x4000}, 0xc) r3 = socket$inet6(0xa, 0x4, 0x0) setsockopt$inet_int(r3, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x0, 0x0, @loopback}, @in6={0xa, 0x0, 0xffffffff, @private0}], 0x38) sendto$inet6(r3, &(0x7f00000000c0)="9d", 0x1, 0x20000854, &(0x7f0000000240)={0xa, 0x4e22, 0x65f, @dev={0xfe, 0x80, '\x00', 0x20}, 0x6}, 0x1c) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) syz_open_dev$video4linux(&(0x7f0000000000), 0x3, 0x143b02) ioctl$VIDIOC_SUBDEV_S_FMT(0xffffffffffffffff, 0xc0585605, &(0x7f00000000c0)={0x0, 0x0, {0x0, 0x6, 0x100f, 0x9, 0x3, 0x9, 0x1, 0x2}}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x5, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a80000008500000011000000954cee48acc23e61f4b54ee9aa5b7e141778c5ad0cb44b27c78076a2cba69baa633bd4022c9b7b85f8e60f4db30e964f31ff0ae6a9df83c6b1558499d2d5fa89993278c79f4b258121e8fd9f46ec92dfe316af9e1dc4b32c26f3494e225ca7498c1acdac1e821bfbc154d98ed9d3a6491e4799835005efaf029104c8648d748ab8fecabd109a0f9feb4203955b8442063c1555b07d1519fc7941242c5b54f3931c512a84f89487"], &(0x7f0000000740)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41100, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3a) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000001c0)={0x14, &(0x7f00000004c0)=ANY=[@ANYBLOB="2000a7000000a708422d192f4b7e42b10ff3313c1bb2823e4934daa718738490676aed8500344f870501deb5e0fb1392ca94c9f1296d0329848646f153b38777c8e86e156f9a39f26d5b50f5f5c02ffad433e29e2c320dea8da0dfd6f7b78d552db3d673141fd860b9a7cf4c3bfde279174446f1d6fb5ce2eaefcf7d84f8ebb0ba0302c0d979b43f77e458506134aeae81cc1f1debc46a7f68736cf6804c4d93eda7b603bafed3efa0d8e25c31"], &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000006c0)={0x44, &(0x7f0000000280)={0x20, 0x18, 0x6f, "1afa36fb08d805558fa60d2a5654bad4a913e128748f5b3aa3c2de6b94307115f1ffec66e041852eb9918c86da4a4eba61d283469d8e3a462d3256af85737a33ea082e22763acd08cddc3ec6f3d3f32939f5a4e745852cc8aa4af9bcee9851b81efe94d569f1f3ee01fdea85981f21"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x7a}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000580)={0x20, 0x80, 0x1c, {0x7, 0xa37e, 0x2, 0x9, 0x2, 0x81, 0xa, 0x100, 0x8, 0x8, 0x9, 0x9}}, &(0x7f00000005c0)={0x20, 0x85, 0x4, 0x83fe}, &(0x7f0000000600)={0x20, 0x83, 0x2}, &(0x7f0000000640)={0x20, 0x87, 0x2, 0x1}, &(0x7f0000000680)={0x20, 0x89, 0x2}}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0900000042000000060000000800000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="05000000000000000000000000000000000000000000eb0000000000"], 0x50) syz_open_dev$ndb(0x0, 0x0, 0x101000) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x109301) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000001ac0)=@urb_type_bulk={0x3, {0x1, 0x1}, 0x413a, 0x40, 0x0, 0x0, 0x6, 0x75, 0x6, 0x8, 0x79, 0x0}) 9.163826651s ago: executing program 4 (id=2409): r0 = socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) r1 = socket(0x2, 0x80802, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x20000011}) sched_setaffinity(0x0, 0xfffffffffffffdc5, &(0x7f00000002c0)=0x800002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = gettid() timer_create(0x4, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @thr={&(0x7f0000000300)="2d32f8bbf08e3f44341d587966541d21c7f8c3aff3f227d8d9b870bad729a9890b8968c22e7c53b8a6b56887bcf244a4c6b3bbd941654ec651bfa3d37688d056489e1af397de45cec4", &(0x7f0000000380)="3bb943b8dfbf7a67546770c97cdf547f0e6fe03b9802e304151a4014e2c92e95a5ee7ae48472cdd5fe0a34889dbecadb9a9a62b10c450a9ea440c37f751e84bee4a65b3d6baa9c4eed110ad020d2a77c91ad5238a29b80d8d3fef4857819c2382e1b45786c64071206b53fa62bc0b9143de1d57ba6823e8adfc3d65f2abef487e4d41900eb3cfdad4b592a67"}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x80040) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000ec0)=[{{&(0x7f0000000440)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f00000009c0)=[{&(0x7f00000004c0)="1fae9fd0c76644ae929a101f21675a61b89b3e635846e228237c005e93b1f4ee4b27acf1cf3e2e51f58bd25c9b2957b7c033b3efc16b08c025ebf4c6412f9fb46064e741f9906ad5acd7fdafa12cc3cecbee1d45954e7cadb8267b8eb5a1e7", 0x5f}, {&(0x7f0000000b40)="a168ef4e73abb9b9ad373895a0907e8951785e92800b48943c5c35fbb210cb6379acea42ed71354c3904d4deb113f4cfd3ec09b22d37d2d6b6b132bcd2f723891fb8905e66b8ee25dbd47c3566ed1e031a78553975ea5ecabca45fb223edd224f83b9f0ef1f9a80fa109aa430600d0d775ebf8002a61382c406a96a501381d1a4ededf8ffe65f954a0601fdaae439b13f88f07dc995d3bcddb4fa9101756fc573154a60cadfbadf07d614abc3dcca419bd7ef96560ea1f214641f3ec8adac9b5c53d266bdd6e02b6c32230ba37d5b8c844ab808994cd0b000097e1fc10f0bae8e5a883bf008789c495c030d6f7984d7ac793d2fb20c7f99f3db449b36d7220fd7190187955708d98d0", 0x109}, {&(0x7f0000000640)="fac463aea2497b9220d251f6e83a11a1e5f22b6fdf4fab4df543436d2d954cc17c59279635ecb843ae6448b887cad64dd95457e07411a234536d8e034aa7e68c45a8867aa9559c3afd785c80adc066f7d91da3450f3cd74fd03b16c998ee3e6aef9d2b7a483644b5859182b6e14696edcabfb6fc38a35fcd7227944d931455b800a733c21c0d4e01f3f73fc5f9651e566cf82d8c7665bcba14ad75b78db5fc4616eea34ebee97fbb19d3d2ddc9d992a239418211f018436358a8c19d26aa4c5405c142dfe204e9b74317b56b6f357c87537eec7a5d25201c688a99a1a25313664b271cce919b1e5317560bc526b1ad6454658c25acb0c4", 0xf7}, {&(0x7f0000000740)="fe4316c4de27297f7a28a0930a9d1550277612b98b141c79a403de95b0aab2d7f85b86b4a3edd0d0808aaff56c3d5e5c9afb8bb8f56b701b29effc799a4bdebf84", 0x41}, {&(0x7f00000007c0)="2c8ee817b7b026563ac5b054cb21b43e9532b4f29955b9d7a692c6cfd5f8aa0578272b8d0c65b118fcfd3bc50258f938a39fced7df250bb30bf08c834123e3a41461dbe7044b4bb55017f3eeb649ef7b924a84b110231090b808baa12f785a99f59cdfbe718b1ef771054e5009abb33fc5dbf72ae27222aaf231e950a5a9947a0b4e7531640b30a9a9a1c91197e679fb2781bbf3df46fa5a5a222c2d757f2714952faa4150117398c4af0d6132a842abfe566c4cf8f4447d931e7e798e3805914853668c82a774cf9054575c3a8e4af25e3b63f65ac9d1b1aa61996c827b1c1e6686", 0xe2}, {&(0x7f00000008c0)="054d9ad37c4fcb947755eb158d0cf216c27e9c7f46061422d722f796636d27df4c1fb7b07003a60430eaa976fa7790b53c38af1bd086e12ac2dc7f3690f617a03b9e346ac76417c5bd32bba65d1956fcecb55d65f2407f332fee45f91ff8f66d1512c4f6ba55d53bc8eeb9f1eeb533c7785dedeaa38582f100f1d607d8f30a1bb978adcbb5811721dc38c191ceba830380c8f6464241651aa299f2a9b57923a52aa9666078c36b0786ef2b67d50e2c2e9dae90761cc95e5e2afacfb32729efb6fc53485b4d1a6cf36ee4466a0227d8cec7763053d95c8319bf5e3ff21544109bb6dec338acf25157571198338294e89d73bfb7eee8fd18", 0xf7}], 0x6, &(0x7f0000000c80)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32=r5, @ANYRES32=r0, @ANYRES32=r3, @ANYBLOB="280000000000000001000800000000000000fe5ca7f1ac597f473a675173ae07ddc069fc69e88c72cd341e066dea96a0f2ae294a23296351a194df0c0959922471d082fa53a35942f70be6833822a5a188b366a1b7421b3e05fb3c8d8e71508bc2b6758d484143204d3e948a060f96a21f947cea2f345962370bbfda9118ddd35eee16441ba8b6b8ade0af73a8ed", @ANYRES32=r5, @ANYRES32=r1, @ANYRES32, @ANYRES32=r6, @ANYRES32=r3, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x88, 0x10}}], 0x1, 0x20008041) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r9 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000003c0)=0x2) ioctl$TIOCVHANGUP(r9, 0x5437, 0x2) capset(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xfffffffe, 0x2}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000) sendmmsg$unix(r7, &(0x7f0000000540), 0x0, 0x4040880) socket$inet6_sctp(0xa, 0x5, 0x84) socket$pppoe(0x18, 0x1, 0x0) 8.936228674s ago: executing program 2 (id=2410): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000080)={0x13, 0x10, 0xfa00, {0x0, 0xffffffffffffffff, 0x2}}, 0x18) 7.931386111s ago: executing program 4 (id=2413): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000019280), r0) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) listen(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000156000/0x2000)=nil, 0x2000, 0xb635773f06ebbeea, 0x810, r2, 0xce9a7000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) accept4$x25(r6, &(0x7f0000019200), &(0x7f0000019240)=0x12, 0x800) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') r7 = add_key$keyring(&(0x7f0000000a40), &(0x7f0000000a80)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) getgroups(0x1, &(0x7f0000001080)=[0xffffffffffffffff]) keyctl$chown(0x4, r7, 0xee01, r8) keyctl$KEYCTL_MOVE(0x3, r7, 0x0, 0x0, 0x0) add_key(&(0x7f0000000040)='user\x00', 0x0, 0x0, 0x0, r7) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) socket$nl_route(0x10, 0x3, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000001480)="3b5250dd8df768c581177cc96346a125c5baecd7e46618851e723e8ef1628f8e5c9fff1954ad6617c17fd0658b4c494ab4", 0x31, 0x20000080, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp], 0x6) 7.893110878s ago: executing program 1 (id=2414): add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f00000000c0)='\x00', 0x1, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket(0x15, 0x5, 0x8) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000480)={'\x00', 0x2e9, 0x3, 0x0, 0x3, 0x80000001, 0xffffffffffffffff}) fcntl$lock(r2, 0x6, &(0x7f00000002c0)={0x1, 0x1, 0x8, 0x4, r5}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xffffffff, 0x0, 0xb49, 0x9, 0x8000000000000001, 0x0, 0x3}, 0x0) r6 = socket$inet6(0xa, 0x1, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4, 0x5}}, 0xe8) r8 = syz_open_dev$dri(0x0, 0x7, 0x220042) r9 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r9, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000003c0)=[0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0], 0x0, 0x2}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r8, 0xc01064ab, &(0x7f0000000380)={0x1d52}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r8, 0xc01064ab, &(0x7f0000000440)={0x5}) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, 0x91ffffff}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[], 0x10}}, 0x0) 7.767838201s ago: executing program 3 (id=2415): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f0000001740)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x8, 0x7fffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0xfffffffe, 0x5, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffe, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}, 0x45c) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="240000001800010600000000000000001c140000fe0000010000000004001a"], 0x24}}, 0x0) socket$kcm(0x10, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x8b}, 0x0) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000013002f0a2bbd70000000000007006800", @ANYRES32=r4, @ANYBLOB="400900006522020018001a8009000100766c616e000000000800058004000380"], 0x38}}, 0x8004) ptrace$setregs(0xd, r2, 0x20000000002, &(0x7f0000000700)="f387f3d0d636834c015f24e62c2e7c82d107a6808737c85e69706da9c8440000009c0ebf8e3f0a7efe0ed91d923af04bf049364e1b69237c6258215d8f1e91bd3bd03e7f3876d52ef012264768d6b703075024a5164aebe8ba1203b8512b2258bb6dfa2f55f496386fd12d29590c6eee14a6c7bc9d4c9c26915315ab4f01f3b278e7a837b409f9a8d7") ptrace$ARCH_SHSTK_DISABLE(0x1e, r2, 0x0, 0x5002) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$sndseq(r7, &(0x7f0000000240)=[{0xe, 0x81, 0x0, 0xfd, @time={0x5, 0x5}, {0x10, 0x49}, {0xe}, @raw8={"1f000e0000000100fd00"}}], 0x1c) ioctl$UI_DEV_CREATE(r0, 0x5501) 7.084347614s ago: executing program 2 (id=2418): r0 = socket$inet_udplite(0x2, 0x2, 0x88) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r5 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0xffa1, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r4, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) socket$packet(0x11, 0x3, 0x300) 5.743981732s ago: executing program 4 (id=2419): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000019080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) pread64(0xffffffffffffffff, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$tipc(0x1e, 0x2, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r4, r5, 0x3, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, 0x0, 0xfffffffffffffffd) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000900)={'bridge0\x00', @random="000000000100"}) socketpair$nbd(0x1, 0x1, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), r2) 5.699805707s ago: executing program 2 (id=2420): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002f40)=ANY=[@ANYBLOB="40000000210a0109000000ffffffa6000a0000010900020073797a31000000000900010073797a31"], 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) 5.188921427s ago: executing program 2 (id=2421): socket$kcm(0x10, 0x0, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x4000fc}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000340)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYRES64], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb010018000000002c00002c0000002c00000005000000000000000200000d0000000000000000020000000000000000001800030000000000000e01000000000000000000005f"], 0x0, 0x49, 0x0, 0x1}, 0x28) 5.020642614s ago: executing program 0 (id=2422): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18c3ffffff0000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.375816037s ago: executing program 1 (id=2423): r0 = socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) r1 = socket(0x2, 0x80802, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x20000011}) sched_setaffinity(0x0, 0xfffffffffffffdc5, &(0x7f00000002c0)=0x800002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = gettid() timer_create(0x4, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @thr={&(0x7f0000000300)="2d32f8bbf08e3f44341d587966541d21c7f8c3aff3f227d8d9b870bad729a9890b8968c22e7c53b8a6b56887bcf244a4c6b3bbd941654ec651bfa3d37688d056489e1af397de45cec4", &(0x7f0000000380)="3bb943b8dfbf7a67546770c97cdf547f0e6fe03b9802e304151a4014e2c92e95a5ee7ae48472cdd5fe0a34889dbecadb9a9a62b10c450a9ea440c37f751e84bee4a65b3d6baa9c4eed110ad020d2a77c91ad5238a29b80d8d3fef4857819c2382e1b45786c64071206b53fa62bc0b9143de1d57ba6823e8adfc3d65f2abef487e4d41900eb3cfdad4b592a67"}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x80040) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000ec0)=[{{&(0x7f0000000440)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f00000009c0)=[{&(0x7f00000004c0)="1fae9fd0c76644ae929a101f21675a61b89b3e635846e228237c005e93b1f4ee4b27acf1cf3e2e51f58bd25c9b2957b7c033b3efc16b08c025ebf4c6412f9fb46064e741f9906ad5acd7fdafa12cc3cecbee1d45954e7cadb8267b8eb5a1e7", 0x5f}, {&(0x7f0000000b40)="a168ef4e73abb9b9ad373895a0907e8951785e92800b48943c5c35fbb210cb6379acea42ed71354c3904d4deb113f4cfd3ec09b22d37d2d6b6b132bcd2f723891fb8905e66b8ee25dbd47c3566ed1e031a78553975ea5ecabca45fb223edd224f83b9f0ef1f9a80fa109aa430600d0d775ebf8002a61382c406a96a501381d1a4ededf8ffe65f954a0601fdaae439b13f88f07dc995d3bcddb4fa9101756fc573154a60cadfbadf07d614abc3dcca419bd7ef96560ea1f214641f3ec8adac9b5c53d266bdd6e02b6c32230ba37d5b8c844ab808994cd0b000097e1fc10f0bae8e5a883bf008789c495c030d6f7984d7ac793d2fb20c7f99f3db449b36d7220fd7190187955708d98d0", 0x109}, {&(0x7f0000000640)="fac463aea2497b9220d251f6e83a11a1e5f22b6fdf4fab4df543436d2d954cc17c59279635ecb843ae6448b887cad64dd95457e07411a234536d8e034aa7e68c45a8867aa9559c3afd785c80adc066f7d91da3450f3cd74fd03b16c998ee3e6aef9d2b7a483644b5859182b6e14696edcabfb6fc38a35fcd7227944d931455b800a733c21c0d4e01f3f73fc5f9651e566cf82d8c7665bcba14ad75b78db5fc4616eea34ebee97fbb19d3d2ddc9d992a239418211f018436358a8c19d26aa4c5405c142dfe204e9b74317b56b6f357c87537eec7a5d25201c688a99a1a25313664b271cce919b1e5317560bc526b1ad6454658c25acb0c4", 0xf7}, {&(0x7f0000000740)="fe4316c4de27297f7a28a0930a9d1550277612b98b141c79a403de95b0aab2d7f85b86b4a3edd0d0808aaff56c3d5e5c9afb8bb8f56b701b29effc799a4bdebf84", 0x41}, {&(0x7f00000007c0)="2c8ee817b7b026563ac5b054cb21b43e9532b4f29955b9d7a692c6cfd5f8aa0578272b8d0c65b118fcfd3bc50258f938a39fced7df250bb30bf08c834123e3a41461dbe7044b4bb55017f3eeb649ef7b924a84b110231090b808baa12f785a99f59cdfbe718b1ef771054e5009abb33fc5dbf72ae27222aaf231e950a5a9947a0b4e7531640b30a9a9a1c91197e679fb2781bbf3df46fa5a5a222c2d757f2714952faa4150117398c4af0d6132a842abfe566c4cf8f4447d931e7e798e3805914853668c82a774cf9054575c3a8e4af25e3b63f65ac9d1b1aa61996c827b1c1e6686", 0xe2}, {&(0x7f00000008c0)="054d9ad37c4fcb947755eb158d0cf216c27e9c7f46061422d722f796636d27df4c1fb7b07003a60430eaa976fa7790b53c38af1bd086e12ac2dc7f3690f617a03b9e346ac76417c5bd32bba65d1956fcecb55d65f2407f332fee45f91ff8f66d1512c4f6ba55d53bc8eeb9f1eeb533c7785dedeaa38582f100f1d607d8f30a1bb978adcbb5811721dc38c191ceba830380c8f6464241651aa299f2a9b57923a52aa9666078c36b0786ef2b67d50e2c2e9dae90761cc95e5e2afacfb32729efb6fc53485b4d1a6cf36ee4466a0227d8cec7763053d95c8319bf5e3ff21544109bb6dec338acf25157571198338294e89d73bfb7eee8fd18", 0xf7}], 0x6, &(0x7f0000000c80)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32=r5, @ANYRES32=r0, @ANYRES32=r3, @ANYBLOB="280000000000000001000800000000000000fe5ca7f1ac597f473a675173ae07ddc069fc69e88c72cd341e066dea96a0f2ae294a23296351a194df0c0959922471d082fa53a35942f70be6833822a5a188b366a1b7421b3e05fb3c8d8e71508bc2b6758d484143204d3e948a060f96a21f947cea2f345962370bbfda9118ddd35eee16441ba8b6b8ade0af73a8ed", @ANYRES32=r5, @ANYRES32=r7, @ANYRES32, @ANYRES32=r6, @ANYRES32=r3, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x88, 0x10}}], 0x1, 0x20008041) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r9 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000003c0)=0x2) ioctl$TIOCVHANGUP(r9, 0x5437, 0x2) capset(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xfffffffe, 0x2}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000) sendmmsg$unix(r7, &(0x7f0000000540), 0x0, 0x4040880) socket$inet6_sctp(0xa, 0x5, 0x84) socket$pppoe(0x18, 0x1, 0x0) 4.007431514s ago: executing program 2 (id=2424): syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000041dc3208570b8d2aebe601020301090224000100000000090460030203010200090588"], 0x0) syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0x3f0, 0x4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x1, 0x20, 0x3, [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x7, 0x1, 0x2, 0x2, "", {{{0x9, 0x5, 0x1, 0x2, 0x40, 0x1, 0xa, 0xd0}}, [{{0x9, 0x5, 0x82, 0x2, 0x8, 0xae, 0x5, 0xd}}]}}}]}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x250, 0x3, 0xe, 0x8, 0xf7, 0x8}, 0x5, &(0x7f0000000080)={0x5, 0xf, 0x5}, 0x3, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x1227}}, {0xc0, &(0x7f0000000340)=@string={0xc0, 0x3, "d6f64dcbdeb9d21620fadcbefb89c860ab50cfb2e7eb06fba5a69f168d00ea572278dc32ec499592ba786eea986ddd9b0e86fdf19479555a5ebcb79cdc759a58144c44dabf4ef583c528f35851c92dfe356a3fd09aec651977decad3b8d872d663e22a2770ef2e15d19fed0494a4a35c1d287bf5fd77f31a43fa4f43a414d73f768839f7836bf61fc6af303269123181dd9bc89b60b199a9444f228e3f308896df8569df244159afc5d72590929d0e6b2561cb1d7603c7f55c2f0c60fed1"}}, {0xc6, &(0x7f0000000200)=@string={0xc6, 0x3, "89ee1422d1e2add85759c2a461a95ee6f500e49fbe82733f12837002b8d877d5362a75630c500cb5e9fdc6c9effec326fb15b5b06c2b3be4cc235af9d1823c9a3e73efe9ade251004679a48a88b42106e8b325c0ebee120f0513ca9906382498faa8ecdbcb153eb8227cb0c882363778ad43470985824aa5516d39bd0d5ba75c1c333e93c28396cda5227dc44f4aff943c9101f00395f49b3d267077f56e6b1a42b5ad3ba09a5dff3f3b973f93580c97203e2a0d5707d79f7ba329b79cc07b45a6e69d89"}}]}) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) 3.959403189s ago: executing program 0 (id=2425): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./bus\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) r0 = socket$netlink(0x10, 0x3, 0xa) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000300)={[{@uid={'uid', 0x3d, r1}}]}) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480b0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r3 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) bind$netlink(r6, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r7, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfeff0000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x44}}, 0x0) 3.903376594s ago: executing program 1 (id=2426): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x6, &(0x7f0000000000)=0x9, 0x4) getsockopt$inet6_tcp_int(r1, 0x6, 0x17, 0x0, &(0x7f00000001c0)) sched_setscheduler(0x0, 0x6, &(0x7f00000000c0)=0x2) r2 = syz_clone(0x8000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000a00300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f0b2ad1eb9769d74e4f1feff374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724190000006f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0ed9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab778c50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b28448692686ac80d81a89f9c29e276800"/2574], &(0x7f0000000140)='GPL\x00'}, 0x48) r4 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r4, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) r5 = socket$kcm(0x29, 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001dc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad0e0e2b45d14ee446b840edaa1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c50ce6a8e9f65de13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87915ed063f608dddb03a95b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0fd9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000c3d51d9a161446b4373e06a9e07f8a000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfa"], &(0x7f0000000140)='GPL\x00'}, 0x94) r7 = socket$kcm(0x2, 0x1, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000040)={r7, r6}) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000040)={r4, r3}) close(r5) r8 = syz_pidfd_open(r2, 0x0) pidfd_getfd(r8, r6, 0x0) r9 = fsopen(&(0x7f0000000300)='tracefs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000280)='gid', 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) r10 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r10, &(0x7f0000001fc0)={0x42, 0x3, 0x0, {0x0, 0x21, 0x0, '/proc/sys/net/ipv4/vs/secure_tcp\x00'}}, 0x42) 3.851983699s ago: executing program 3 (id=2427): socket$nl_netfilter(0x10, 0x3, 0xc) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000004d80)=@migrate={0x58, 0x21, 0x10, 0x70bd27, 0x25dfdbfd, {{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6=@remote, 0x4e21, 0x0, 0x4e20, 0x0, 0xa, 0x80, 0x0, 0x5c}, 0x6e6bb0, 0x1}, [@XFRMA_SET_MARK={0x8, 0x1d, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x28880) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0xb, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) recvmmsg(r3, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000000440)=""/128, 0x80}], 0x2, &(0x7f0000000940)=""/199, 0xc7}, 0x7f}, {{&(0x7f00000005c0)=@in, 0x80, &(0x7f0000000700)=[{&(0x7f0000000100)=""/35, 0x23}, {0x0}], 0x2, &(0x7f0000000740)=""/23, 0x17}, 0x3}], 0x2, 0x40012114, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x6}, {0x6, 0x0, 0x0, 0xb}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0xf, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800adf771bf5e55", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf092000000000006609010000000000060000000b0000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000295"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r6}, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8905, &(0x7f0000000000)={'netdevsim0\x00', @random="010000201000"}) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)={0x28, 0x0, 0x1, 0x70bd2b, 0x0, {{0x2}, {@val={0x8}, @val={0xc, 0x99, {0x9, 0x44}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x2400c891}, 0x0) r7 = userfaultfd(0x80801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r7, 0xc028aa03, &(0x7f0000000180)={&(0x7f000046a000/0x2000)=nil, &(0x7f000012a000/0x3000)=nil, 0x2000, 0x2}) r8 = getpid() process_vm_readv(r8, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, 0x0, 0x0, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f000040a000/0x800000)=nil, 0x800000}, 0x1}) 2.737853743s ago: executing program 1 (id=2428): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000080)={0x13, 0x10, 0xfa00, {0x0, 0xffffffffffffffff, 0x2}}, 0x18) 2.426392896s ago: executing program 0 (id=2429): bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000007000002502000020feffff7a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe5d6405000000000075040000000d00000701000000000000b70400001000e5207b0700fe00000010850000008a000000b70000000a00000095000000000000006458c2c62fc206000000f909a63796c113a80c19aab9d60700ffffffff483be3f0d3253730e78000000062c28b22756bedf3cf393d14c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766aeb39439fce41f144631ac262dcae08c3d1a1fbe96dd87235b44174f7c013700e69274f8e9c31975e551558055dc2dc29edc33b375fa325dcf3e91e20f63d7030dbe7ff7f51fe89c3d17cf45a1616ad237682057034dfdc81f5a53cd640212c88e8b687a2446049577c75b76b775c1e301caf2465ed4b2ad56b848d046c52bfc3737127120ab17d82a294d174f240a3cdc725cfe6e839a1f80f59486578e45b008d39ab618f660e3c53ed4409aa92ae4fecd913060ca74ed8a303e22de12087a217d8d7be0ae1117cc791313b1318497dd5ebeef0d7e1795a6ff20f699870ebb137cffa79465da52ab2b3430ba0ba59152496a1ea5dd1e4dee46f6d3688603b5f25a588a31da4e481884074e211dd09a8b8039d0834507656ed7d552a990c1354d7638b2c2215dd9f606b01a92fabc6eb6fa033a86f8920e2168a80d7c86da5ad1d27c8d2a180e56046a49b989128ea736894d3eef8dca16ed63520be4654ddb14bfe4268c487c5a75c044e21021c089608c50adbc4e3f4c6a4ca86c7d2df5bc7c76e413d05e8f57b1e22d4af34f9d4d2e6e4d4f57f47aebdd5f98f67834c656b2fe09df4a1b15116fceaa404a6df278c7c629f584ba8d37c1137c2263ae02ad3718a03a886eb"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x139}, 0x48) 2.355939589s ago: executing program 4 (id=2430): r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000000c0)='sched_switch\x00', r1, 0x0, 0x36}, 0x18) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='cramfs\x00', 0x1002000, &(0x7f0000000380)='\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000500)=@netrom={'nr', 0x0}, 0x10) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f0000000400)=0x1, 0x4) 2.32778202s ago: executing program 0 (id=2431): bpf$MAP_CREATE(0x0, 0x0, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r4, 0x29, 0x41, 0x0, 0x58) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000000000000000000000000000850000e89f0000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.004449861s ago: executing program 3 (id=2432): madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) socket$phonet(0x23, 0x2, 0x1) syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0xc0c00) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0}, 0x18) r1 = socket$inet_tcp(0x2, 0x1, 0x0) accept4(r1, 0x0, &(0x7f0000000040), 0x80000) socket$can_raw(0x1d, 0x3, 0x1) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000140)={0x60, 0x2, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x8, &(0x7f00000004c0)=[{0x800000000, 0x0, 0x1}], 0x1, 0xbff, 0x1e, 0x0, 0xc, 0x1}) socket$inet6(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) bind$inet(r5, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r5, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000015c0)=""/127, 0x7f}}], 0x1, 0x0, 0x0) sendto$inet(r5, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) openat$cgroup_type(r2, 0x0, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/netlink\x00') 1.428527935s ago: executing program 2 (id=2433): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x8) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32], 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x4) r3 = syz_open_dev$evdev(&(0x7f0000000200), 0xff, 0x40080) ioctl$EVIOCSCLOCKID(r3, 0x40084503, &(0x7f0000ffcffc)) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20088814}, 0x0) r4 = syz_open_dev$video(&(0x7f0000000300), 0x81, 0x101040) ioctl$VIDIOC_TRY_FMT(r4, 0xc0d05640, &(0x7f0000000100)={0xd, @vbi={0xfffffffc, 0x0, 0x10, 0x4f565559, [0x0, 0x2], [0x100, 0x9], 0x108}}) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x182000, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'netdevsim0\x00'}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$FBIOPUT_VSCREENINFO(r5, 0x4601, &(0x7f0000000040)={0x80, 0xa0, 0xa0, 0x0, 0x6, 0x0, 0x2, 0x0, {0x10, 0x6}, {0x8, 0x8}, {0x0, 0x7fff}, {0x4, 0xb, 0xfffffffd}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffc, 0x400009, 0x6, 0x0, 0x17, 0x2, 0x1, 0x6}) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$packet(0x11, 0x3, 0x300) r7 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r6, &(0x7f0000003040)={@val={0x8, 0x800}, @val={0x0, 0x3, 0x0, 0x1}, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x89, 0x0, @rand_addr, @multicast2=0xe0000001}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}, 0x36) syz_usb_connect$uac1(0x0, 0x93, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902810003010000000904000000010100000a2401e700b10201020a2408040f0000000000090401000001020000090401010101bea50ba8fab7ff95b802000009240202090000000608240201ff0400fd09050109200009080a0725018009080009040200000102000009040201010102000007240100000500090582093e0000050007250102030400"], 0x0) 1.220051789s ago: executing program 0 (id=2434): r0 = syz_open_dev$ndb(&(0x7f0000000200), 0x0, 0x40200) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x6) 1.194424913s ago: executing program 0 (id=2435): r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r1, &(0x7f0000001040)=[{{&(0x7f0000000200)={0xa, 0x4e21, 0x6, @mcast2, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0ee3af0d338c8f84f85243426414000000e5e356ff280000"], 0x18}}], 0x1, 0x24000000) sched_setscheduler(0x0, 0x2, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) getsockopt$IP_SET_OP_VERSION(0xffffffffffffffff, 0x1, 0x53, 0x0, &(0x7f00000000c0)) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x20044004) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r6 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r6, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r3, r7, 0x25, 0x8, @val=@netfilter={0x2, 0x0, 0x8, 0x1}}, 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r10, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r11}, 0x18) socket$inet6_udp(0xa, 0x2, 0x0) sendfile(r2, r3, 0x0, 0x20000023896) prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00008b", 0x14, 0x2c, 0x0, @remote, @local, {[], {{0x3a00, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 1.171073835s ago: executing program 1 (id=2436): r0 = socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) r1 = socket(0x2, 0x80802, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x20000011}) sched_setaffinity(0x0, 0xfffffffffffffdc5, &(0x7f00000002c0)=0x800002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = gettid() timer_create(0x4, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @thr={&(0x7f0000000300)="2d32f8bbf08e3f44341d587966541d21c7f8c3aff3f227d8d9b870bad729a9890b8968c22e7c53b8a6b56887bcf244a4c6b3bbd941654ec651bfa3d37688d056489e1af397de45cec4", &(0x7f0000000380)="3bb943b8dfbf7a67546770c97cdf547f0e6fe03b9802e304151a4014e2c92e95a5ee7ae48472cdd5fe0a34889dbecadb9a9a62b10c450a9ea440c37f751e84bee4a65b3d6baa9c4eed110ad020d2a77c91ad5238a29b80d8d3fef4857819c2382e1b45786c64071206b53fa62bc0b9143de1d57ba6823e8adfc3d65f2abef487e4d41900eb3cfdad4b592a67"}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x80040) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000ec0)=[{{&(0x7f0000000440)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f00000009c0)=[{&(0x7f00000004c0)="1fae9fd0c76644ae929a101f21675a61b89b3e635846e228237c005e93b1f4ee4b27acf1cf3e2e51f58bd25c9b2957b7c033b3efc16b08c025ebf4c6412f9fb46064e741f9906ad5acd7fdafa12cc3cecbee1d45954e7cadb8267b8eb5a1e7", 0x5f}, {&(0x7f0000000b40)="a168ef4e73abb9b9ad373895a0907e8951785e92800b48943c5c35fbb210cb6379acea42ed71354c3904d4deb113f4cfd3ec09b22d37d2d6b6b132bcd2f723891fb8905e66b8ee25dbd47c3566ed1e031a78553975ea5ecabca45fb223edd224f83b9f0ef1f9a80fa109aa430600d0d775ebf8002a61382c406a96a501381d1a4ededf8ffe65f954a0601fdaae439b13f88f07dc995d3bcddb4fa9101756fc573154a60cadfbadf07d614abc3dcca419bd7ef96560ea1f214641f3ec8adac9b5c53d266bdd6e02b6c32230ba37d5b8c844ab808994cd0b000097e1fc10f0bae8e5a883bf008789c495c030d6f7984d7ac793d2fb20c7f99f3db449b36d7220fd7190187955708d98d0", 0x109}, {&(0x7f0000000640)="fac463aea2497b9220d251f6e83a11a1e5f22b6fdf4fab4df543436d2d954cc17c59279635ecb843ae6448b887cad64dd95457e07411a234536d8e034aa7e68c45a8867aa9559c3afd785c80adc066f7d91da3450f3cd74fd03b16c998ee3e6aef9d2b7a483644b5859182b6e14696edcabfb6fc38a35fcd7227944d931455b800a733c21c0d4e01f3f73fc5f9651e566cf82d8c7665bcba14ad75b78db5fc4616eea34ebee97fbb19d3d2ddc9d992a239418211f018436358a8c19d26aa4c5405c142dfe204e9b74317b56b6f357c87537eec7a5d25201c688a99a1a25313664b271cce919b1e5317560bc526b1ad6454658c25acb0c4", 0xf7}, {&(0x7f0000000740)="fe4316c4de27297f7a28a0930a9d1550277612b98b141c79a403de95b0aab2d7f85b86b4a3edd0d0808aaff56c3d5e5c9afb8bb8f56b701b29effc799a4bdebf84", 0x41}, {&(0x7f00000007c0)="2c8ee817b7b026563ac5b054cb21b43e9532b4f29955b9d7a692c6cfd5f8aa0578272b8d0c65b118fcfd3bc50258f938a39fced7df250bb30bf08c834123e3a41461dbe7044b4bb55017f3eeb649ef7b924a84b110231090b808baa12f785a99f59cdfbe718b1ef771054e5009abb33fc5dbf72ae27222aaf231e950a5a9947a0b4e7531640b30a9a9a1c91197e679fb2781bbf3df46fa5a5a222c2d757f2714952faa4150117398c4af0d6132a842abfe566c4cf8f4447d931e7e798e3805914853668c82a774cf9054575c3a8e4af25e3b63f65ac9d1b1aa61996c827b1c1e6686", 0xe2}, {&(0x7f00000008c0)="054d9ad37c4fcb947755eb158d0cf216c27e9c7f46061422d722f796636d27df4c1fb7b07003a60430eaa976fa7790b53c38af1bd086e12ac2dc7f3690f617a03b9e346ac76417c5bd32bba65d1956fcecb55d65f2407f332fee45f91ff8f66d1512c4f6ba55d53bc8eeb9f1eeb533c7785dedeaa38582f100f1d607d8f30a1bb978adcbb5811721dc38c191ceba830380c8f6464241651aa299f2a9b57923a52aa9666078c36b0786ef2b67d50e2c2e9dae90761cc95e5e2afacfb32729efb6fc53485b4d1a6cf36ee4466a0227d8cec7763053d95c8319bf5e3ff21544109bb6dec338acf25157571198338294e89d73bfb7eee8fd18", 0xf7}], 0x6, &(0x7f0000000c80)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32=r5, @ANYRES32=r0, @ANYRES32=r3, @ANYBLOB="280000000000000001000800000000000000fe5ca7f1ac597f473a675173ae07ddc069fc69e88c72cd341e066dea96a0f2ae294a23296351a194df0c0959922471d082fa53a35942f70be6833822a5a188b366a1b7421b3e05fb3c8d8e71508bc2b6758d484143204d3e948a060f96a21f947cea2f345962370bbfda9118ddd35eee16441ba8b6b8ade0af73a8ed", @ANYRES32=r5, @ANYRES32=r7, @ANYRES32, @ANYRES32=r6, @ANYRES32=r3, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x88, 0x10}}], 0x1, 0x20008041) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r9 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000003c0)=0x2) ioctl$TIOCVHANGUP(r9, 0x5437, 0x2) capset(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xfffffffe, 0x2}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000) sendmmsg$unix(r7, &(0x7f0000000540), 0x0, 0x4040880) socket$inet6_sctp(0xa, 0x5, 0x84) socket$pppoe(0x18, 0x1, 0x0) 1.111921866s ago: executing program 3 (id=2437): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffd000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r1, 0x6, &(0x7f00000000c0)=0x6) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_int(r4, 0x1, 0x2, 0x0, &(0x7f0000000300)) signalfd(r2, &(0x7f00000001c0)={[0x901]}, 0x8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x28011, 0x0, 0x0) syz_emit_ethernet(0x645, &(0x7f0000001500)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd60f9edff060f3a00fe8000000000000000000000000000bbff020000000000000000000000000001800090780ffffff8e169018abf3bba16f1cc4357d84e73a4d6861c12dd0261b74589b7137749d96324657062cf14743c7aaed18f642c71ee65bf55552536196208372f133eae26ff892efe07790d0327cd32895042bac0bce167d9d57f4a79fad9dbc0854af14467cbe187bb1ad85b6a7951070659432a831232249183527dbc1273676d5a8895b20e1e546a77e13f1318eb4c9be48499b018b66bc585e7a8113dc7ed13cc497440b3f09bce6074ac056e7fe968b3c169c5be2a5fd8b6fe5c0b5b52a8493844fe4319acc98940987cd59625d9e272fa7b677f47db3ebd1935be20a177f47047edc705777dae28834748111e1d6a8fe4c5f3f7a588fd5111d46a20e6bb4b3029e313d837a581d4411bed9191d73b89d6efecc419b4db6c3e9c6d299e23569ed4c49b05a7c5f54238e6b6290c0826bdee5057f36963cd0a439dbb38c1152c9ba2b71a9fc9e06a7e38f0e64646510c8f6d5d09317ee7735baf198206b724538b2059b7e7cb3af0986ef3615d991cb74a34903273e9da22972f57c40b77288109d209cc4c4a526c692d87e9a5261ea1de79462d18c4bb1c5b91dcaba8d4adfa68434be9d6d93148c63d002ec26da072258c0aecaa72b189077333a92f67d7c19a767df420ae7891cda232b9ca0d97c4b6b0a200ef78223a4f5e73ae0e34cf0173f6e57fdf7c44037a0265892033f575756d2f72ce32b5a9902239e837727f251d26f21fad7a64702cb9d2d1dc99fccfc4130e597984cbe0baff28c3323e7f354d18a2638ffaebb82b2bcd10dd5c50f80b0fe5e5d4a6fa4c05f1e4e0b15e93d2c1243da6d9c67bf1a23576f5078a682dad3b60535f7471f6e2e7b61450321585b862c33f733309a6af16c50b4f490efca2fec4303d04dd18f2f92539eb15ac94012497b497e44baa370b6bd173dc068cad7bc16f8ca19f77a3838f8f20d4395d4f0578cf5c16cb352a5fb9aadd3125efb529ff2d51afafb1923f37da0982f2eb6469f3d6cd312dcb6162ddacfa376e3004c4fa90264440fce34b5f442d327af14c4c62b01f43e39a1b8f728c9a5bd0b3850ca6fd364a42c9ea2313a3510d46c1bfeaade3626900161d3d27a76721da32e686ebb04a0d531a6f88c52d2385e33413c3562805430d0c7936d5bee80c21f12fc87fc64f6a38a9d260e9eeb25450c140f9d6ea5c525522d04d39f5ffcec822b78718354b61c3cc0276a096dbc2d59956914e388a04f64538fed548a5276e9e5ba84e8758280e76e54b84efa973a0add06799cad803f92050d9af4f45f33b6a82517c8a1efab256edd5c7a3938809a22e649560386d0c1eb0946ad6d572e1c8caac0eaa4d448927e444e2c0610285b0100ee0e7f88ca0472086a09473263a3d20f59c67bfa754c4fbb927e82422b878030e9147da79b1aa296b34056b4cd3596b93797a74db603f2cf83a1a61475539f7d1f67dd767930806eb51d610f2806b4ec9d6585514f2078951e6570f3ee275a9647b0b5fc29e21bda2428f3aba499ae4b5c445a1277d5d6aede5e4f3b80d94e814475e43936db3ab38ea0a21a7cac62e706ba41d12fbe545093570687ef4e549a9a7c5b0afd2ef86d4477c30d8929aac65eac8bc56e5b04460c10886255cbbb6a2afdd8144e039a1b25c614cf96cacbcb64d6e71d24fff1135b960aed9c6fd8fc0f855519aec548b64cace2efbb6b6de8fb8f5d5a963ef0567a8ba09eaf7992a8eec82de57ea383eaa4f310a70fe27aed53f1eecd6a4924046bf8caa20ba3b61b8aa344c0b528cd0678b9ac52baf65f3c47d1de97af1542eb9fb55d9a4a9235ee362d69040108b9fe5a2184b87370a62f7fe472d861825473dc55b5802dde5d5429fa38a82e0546a67fee08e7d6fe63aa4f4a2509fbe826c1de770c2b4ac96e64766e38984c299ecdd797f3fc36b93a08e127da9855c57d7bfdb3b18686889b1db53ce0e1e2819226db19d9142b1da6c3459f1d303ca42784b026a01130ca55d028eef0bca625ee61a1eaab39a8aa10eb69cbaaca593a0aac0c6f41f4c4a2ab92f77fc7d85a7f543b71467efca2bfaa69103950d482dc743f9cbee9beedbaf4ee277895341781544aaeccdd084c29af8a5ab1dce8f48a01721e6f6f56bf095057fe68b3c8ddd43c92ffe614062970b1e22cfcddeca8925b58af598a1e89890"], 0x0) r5 = msgget$private(0x0, 0x193) msgsnd(r5, 0x0, 0x401, 0x0) msgsnd(0x0, &(0x7f0000000180)=ANY=[@ANYRES32=r1], 0x8, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r7 = syz_io_uring_setup(0x837, &(0x7f0000000480)={0x0, 0x2b94, 0x80, 0x7, 0x192}, &(0x7f0000000040)=0x0, &(0x7f00000002c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000100)=@IORING_OP_TIMEOUT={0xb, 0x41, 0x0, 0x0, 0x9, &(0x7f00000000c0), 0x1, 0x4}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4004094) io_uring_enter(r7, 0x3516, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, 0x0, 0x0) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) 414.623038ms ago: executing program 1 (id=2438): openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = gettid() tkill(r0, 0x15) prlimit64(r0, 0xe, &(0x7f00000001c0)={0x8000000000000001, 0xd6c6}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r4 = io_uring_setup(0x6b9b, &(0x7f0000000080)={0x0, 0xceb4, 0x80, 0x0, 0x4000159}) r5 = socket$rds(0x15, 0x5, 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f0000000200)={0x3, 0x200, 0x5, 0x4c80}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bind$rds(r5, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) unshare(0x2040400) r7 = fsopen(&(0x7f0000000040)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) unshare(0x2000400) fsmount(r7, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, 0x0, 0x46, 0x0, 0x6}, 0x28) sendmsg$rds(r5, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) syz_open_dev$vcsn(&(0x7f0000000140), 0x7, 0x620201) socket$alg(0x26, 0x5, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) 406.133172ms ago: executing program 4 (id=2439): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x960, 0x0, 0x1, 0x0, 0x0, {}, {}, {0x9}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x100}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x4000800) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x441c2, 0x0) ftruncate(r3, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) read$msr(r3, &(0x7f00000000c0)=""/218, 0xda) recvmmsg(r5, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000001b80)=""/112, 0x70}], 0x1}}], 0x1, 0x700, 0x0) sendfile(r4, r3, 0x0, 0x578410eb) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x8080, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000340)={'pimreg1\x00', 0x1}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = gettid() r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) read(r6, &(0x7f0000000040)=""/170, 0xaa) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001000010025bd7000f9dbdf2500000004", @ANYRES32=0x0, @ANYBLOB="158804000300070008001b000000000008000d"], 0x30}, 0x1, 0x0, 0x0, 0x40800}, 0x4040000) 0s ago: executing program 3 (id=2440): r0 = socket$can_bcm(0x1d, 0x2, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000240)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000280), 0x12) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) connect$can_bcm(r0, &(0x7f0000000140), 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x10c6f7a0b5ef}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x78}}, 0x20050800) sendmsg$can_bcm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYRES16=r0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x501, 0x0) ioctl$PTP_PIN_SETFUNC(r4, 0x40603d07, &(0x7f0000000180)={'\x00', 0x7, 0x1, 0x100}) read(r0, &(0x7f0000001480)=""/4096, 0x38) kernel console output (not intermixed with test programs): ce number 48 using dummy_hcd [ 687.696797][ T977] usb 2-1: Using ep0 maxpacket: 32 [ 687.730049][ T977] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 687.748134][ T977] usb 2-1: config 0 has no interface number 0 [ 687.763168][ T977] usb 2-1: config 0 interface 51 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 687.794402][ T977] usb 2-1: config 0 interface 51 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 687.819515][ T977] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 687.842127][ T977] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 687.869326][ T977] usb 2-1: Product: syz [ 687.873604][ T977] usb 2-1: Manufacturer: syz [ 687.878829][ T977] usb 2-1: SerialNumber: syz [ 687.886569][ T977] usb 2-1: config 0 descriptor?? [ 687.894304][ T977] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 687.974946][T10416] usb 3-1: new full-speed USB device number 64 using dummy_hcd [ 688.052731][T13374] kvm: Disabled LAPIC found during irq injection [ 688.059263][T13374] kvm: apic: phys broadcast and lowest prio [ 688.122676][ T977] usb 2-1: qt2_setup_urbs - submit read urb failed -90 [ 688.146656][ T977] quatech2 2-1:0.51: probe with driver quatech2 failed with error -90 [ 688.147779][T10416] usb 3-1: not running at top speed; connect to a high speed hub [ 688.185988][T10416] usb 3-1: config 240 has an invalid interface number: 13 but max is 3 [ 688.194783][T10416] usb 3-1: config 240 contains an unexpected descriptor of type 0x2, skipping [ 688.204101][T10416] usb 3-1: config 240 contains an unexpected descriptor of type 0x1, skipping [ 688.213894][T10416] usb 3-1: config 240 has an invalid descriptor of length 150, skipping remainder of the config [ 688.224990][T10416] usb 3-1: config 240 has 1 interface, different from the descriptor's value: 4 [ 688.234089][T10416] usb 3-1: config 240 has no interface number 0 [ 688.240365][T10416] usb 3-1: config 240 interface 13 altsetting 0 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 688.252030][T10416] usb 3-1: config 240 interface 13 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 688.272844][T10416] usb 3-1: New USB device found, idVendor=0403, idProduct=e88d, bcdDevice=32.5f [ 688.282537][T10416] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 688.290758][T10416] usb 3-1: Product: í¾í…žê‹¸ãª°é³“䌞í„苀ꉂᑲﰾ㛂㾌潩튟ⴧ鿙ê‘ꥭë„쬚é¼â„”ï–ï©ŸâåŠíŽ é€â‰”趦æ¼è«é¬€å©ºè«¤ìˆ—윀딾躗៪介똼㘅ᇔꆗ䩷áµà«žéž¿í–Ҙ툸槆믬黠뚠㾺ᮗ뮌ⓣ虰ï‡ã‚蟋ࢣ䰜쒢è´ë¥©à²¨éŠî¥æ³‘熉肑脭⋂ᑲ溌 [ 688.319617][T10416] usb 3-1: Manufacturer: Ó¿ [ 688.324701][T10416] usb 3-1: SerialNumber: syz [ 688.477540][ T977] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 688.529159][T13380] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1943'. [ 688.564546][T10416] ftdi_sio 3-1:240.13: FTDI USB Serial Device converter detected [ 688.585410][T10416] ftdi_sio ttyUSB0: unknown device type: 0x325f [ 688.604466][T10416] usb 3-1: USB disconnect, device number 64 [ 688.618767][T10416] ftdi_sio 3-1:240.13: device disconnected [ 688.639841][ T977] usb 5-1: Using ep0 maxpacket: 32 [ 688.649230][ T977] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 688.662648][ T977] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 688.683547][ T977] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 688.709045][ T977] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 688.727033][ T977] usb 5-1: config 0 descriptor?? [ 688.740274][ T977] hub 5-1:0.0: USB hub found [ 688.841071][ C0] hrtimer: interrupt took 40274 ns [ 688.901909][ T30] audit: type=1400 audit(1761653938.952:617): avc: denied { bind } for pid=13383 comm="syz.3.1945" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 688.953114][ T977] hub 5-1:0.0: 1 port detected [ 688.977321][ T5969] usb 1-1: USB disconnect, device number 59 [ 689.429759][ T5969] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 689.492683][ T42] usb 2-1: USB disconnect, device number 48 [ 689.599710][ T977] hub 5-1:0.0: activate --> -90 [ 689.675347][ T5969] usb 1-1: Using ep0 maxpacket: 8 [ 689.803643][ T5969] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 689.816745][ T5969] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 689.829051][ T5969] usb 1-1: Product: syz [ 689.833341][ T5969] usb 1-1: Manufacturer: syz [ 689.839343][ T5969] usb 1-1: SerialNumber: syz [ 689.848310][ T5969] usb 1-1: config 0 descriptor?? [ 689.921356][ T42] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 690.030643][ T977] usb 5-1-port1: config error [ 690.035787][ T9] usb 5-1: USB disconnect, device number 59 [ 690.137136][ T5969] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 690.176098][T13400] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 690.188947][ T42] usb 2-1: Using ep0 maxpacket: 16 [ 690.196433][ T42] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 690.206679][ T42] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 690.216174][ T42] usb 2-1: New USB device found, idVendor=17ef, idProduct=7309, bcdDevice= 0.00 [ 690.232474][ T42] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.250073][ T42] usb 2-1: config 0 descriptor?? [ 690.491492][ T9] usb 2-1: USB disconnect, device number 49 [ 690.719434][T13413] ubi: mtd0 is already attached to ubi31 [ 691.119229][T13420] macsec2: entered promiscuous mode [ 691.124552][T13420] mac80211_hwsim hwsim8 wlan1: entered promiscuous mode [ 691.760501][T13420] mac80211_hwsim hwsim8 wlan1: left promiscuous mode [ 691.857663][ T42] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 692.050859][T13428] netlink: 'syz.3.1957': attribute type 20 has an invalid length. [ 692.058792][T13428] IPv6: NLM_F_CREATE should be specified when creating new route [ 692.066754][ T42] usb 5-1: Using ep0 maxpacket: 32 [ 692.074166][T13428] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 692.081899][T13428] IPv6: NLM_F_CREATE should be set when creating new route [ 692.084761][ T42] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=67.fe [ 692.109370][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.125736][ T42] usb 5-1: Product: syz [ 692.130089][ T42] usb 5-1: Manufacturer: syz [ 692.134678][ T42] usb 5-1: SerialNumber: syz [ 692.164372][T13429] FAULT_INJECTION: forcing a failure. [ 692.164372][T13429] name failslab, interval 1, probability 0, space 0, times 0 [ 692.177148][T13429] CPU: 1 UID: 0 PID: 13429 Comm: syz.1.1958 Not tainted syzkaller #0 PREEMPT(full) [ 692.177175][T13429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 692.177184][T13429] Call Trace: [ 692.177188][T13429] [ 692.177193][T13429] dump_stack_lvl+0x16c/0x1f0 [ 692.177214][T13429] should_fail_ex+0x512/0x640 [ 692.177231][T13429] should_failslab+0xc2/0x120 [ 692.177249][T13429] kmem_cache_alloc_noprof+0x75/0x6e0 [ 692.177280][T13429] ? skb_clone+0x190/0x3f0 [ 692.177311][T13429] ? skb_clone+0x190/0x3f0 [ 692.177330][T13429] skb_clone+0x190/0x3f0 [ 692.177345][T13429] netlink_deliver_tap+0xabd/0xd30 [ 692.177363][T13429] netlink_dump+0xa5f/0xd30 [ 692.177379][T13429] ? __pfx_netlink_dump+0x10/0x10 [ 692.177412][T13429] ? __inet_diag_dump_start+0x541/0x960 [ 692.177451][T13429] __netlink_dump_start+0x6d6/0x990 [ 692.177477][T13429] inet_diag_handler_cmd+0x282/0x2e0 [ 692.177494][T13429] ? __pfx_inet_diag_handler_cmd+0x10/0x10 [ 692.177511][T13429] ? __pfx_inet_diag_dump_start+0x10/0x10 [ 692.177531][T13429] ? __pfx_inet_diag_dump+0x10/0x10 [ 692.177558][T13429] ? __pfx_inet_diag_dump_done+0x10/0x10 [ 692.177590][T13429] ? sock_diag_lock_handler+0x10f/0x2e0 [ 692.177618][T13429] sock_diag_rcv_msg+0x438/0x790 [ 692.177633][T13429] netlink_rcv_skb+0x158/0x420 [ 692.177649][T13429] ? __pfx_sock_diag_rcv_msg+0x10/0x10 [ 692.177662][T13429] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 692.177689][T13429] ? netlink_deliver_tap+0x1ae/0xd30 [ 692.177723][T13429] netlink_unicast+0x5aa/0x870 [ 692.177755][T13429] ? __pfx_netlink_unicast+0x10/0x10 [ 692.177781][T13429] netlink_sendmsg+0x8c8/0xdd0 [ 692.177798][T13429] ? __pfx_netlink_sendmsg+0x10/0x10 [ 692.177819][T13429] sock_write_iter+0x566/0x610 [ 692.177850][T13429] ? __pfx_sock_write_iter+0x10/0x10 [ 692.177897][T13429] ? __pfx_file_has_perm+0x10/0x10 [ 692.177920][T13429] do_iter_readv_writev+0x662/0x9e0 [ 692.177949][T13429] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 692.177976][T13429] ? selinux_file_permission+0x126/0x660 [ 692.178000][T13429] ? bpf_lsm_file_permission+0x9/0x10 [ 692.178021][T13429] ? security_file_permission+0x71/0x210 [ 692.178047][T13429] ? rw_verify_area+0xcf/0x6c0 [ 692.178070][T13429] vfs_writev+0x35f/0xde0 [ 692.178090][T13429] ? __pfx_vfs_writev+0x10/0x10 [ 692.178117][T13429] ? __fget_files+0x20e/0x3c0 [ 692.178128][T13429] ? __fget_files+0x130/0x3c0 [ 692.178143][T13429] ? do_writev+0x28c/0x340 [ 692.178157][T13429] do_writev+0x28c/0x340 [ 692.178173][T13429] ? __pfx_do_writev+0x10/0x10 [ 692.178193][T13429] do_syscall_64+0xcd/0xfa0 [ 692.178211][T13429] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.178222][T13429] RIP: 0033:0x7fa70af8efc9 [ 692.178233][T13429] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 692.178244][T13429] RSP: 002b:00007fa70be40038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 692.178255][T13429] RAX: ffffffffffffffda RBX: 00007fa70b1e6090 RCX: 00007fa70af8efc9 [ 692.178263][T13429] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000009 [ 692.178270][T13429] RBP: 00007fa70be40090 R08: 0000000000000000 R09: 0000000000000000 [ 692.178277][T13429] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 692.178283][T13429] R13: 00007fa70b1e6128 R14: 00007fa70b1e6090 R15: 00007fff5bac3df8 [ 692.178300][T13429] [ 692.612386][ T42] usb 5-1: config 0 descriptor?? [ 692.789761][ T30] audit: type=1400 audit(1761653942.598:618): avc: denied { setopt } for pid=13432 comm="syz.1.1960" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 692.789945][T13433] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1960'. [ 692.920583][ T42] snd-usb-6fire 5-1:0.0: unable to receive device firmware state. [ 692.928503][ T42] snd-usb-6fire 5-1:0.0: probe with driver snd-usb-6fire failed with error -121 [ 692.928575][ T5969] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 693.512462][ T5969] usb 1-1: USB disconnect, device number 60 [ 693.786104][T13446] tipc: Enabled bearer , priority 10 [ 693.934901][T13456] FAULT_INJECTION: forcing a failure. [ 693.934901][T13456] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 693.949753][T13456] CPU: 1 UID: 0 PID: 13456 Comm: syz.0.1966 Not tainted syzkaller #0 PREEMPT(full) [ 693.949781][T13456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 693.949794][T13456] Call Trace: [ 693.949801][T13456] [ 693.949810][T13456] dump_stack_lvl+0x16c/0x1f0 [ 693.949844][T13456] should_fail_ex+0x512/0x640 [ 693.949872][T13456] _copy_from_user+0x2e/0xd0 [ 693.949898][T13456] ctrl_cdev_ioctl+0x143/0x3d0 [ 693.949926][T13456] ? __pfx_ctrl_cdev_ioctl+0x10/0x10 [ 693.949954][T13456] ? selinux_file_ioctl+0x180/0x270 [ 693.949977][T13456] ? selinux_file_ioctl+0xb4/0x270 [ 693.950001][T13456] ? __pfx_ctrl_cdev_ioctl+0x10/0x10 [ 693.950029][T13456] __x64_sys_ioctl+0x18e/0x210 [ 693.950060][T13456] do_syscall_64+0xcd/0xfa0 [ 693.950091][T13456] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.950112][T13456] RIP: 0033:0x7f849a98efc9 [ 693.950129][T13456] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 693.950149][T13456] RSP: 002b:00007f849b827038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 693.950169][T13456] RAX: ffffffffffffffda RBX: 00007f849abe5fa0 RCX: 00007f849a98efc9 [ 693.950183][T13456] RDX: 0000200000000440 RSI: 0000000040186f40 RDI: 0000000000000004 [ 693.950197][T13456] RBP: 00007f849b827090 R08: 0000000000000000 R09: 0000000000000000 [ 693.950210][T13456] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 693.950221][T13456] R13: 00007f849abe6038 R14: 00007f849abe5fa0 R15: 00007ffe10220338 [ 693.950251][T13456] [ 694.178033][ T1189] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 694.252602][ T24] usb 5-1: USB disconnect, device number 60 [ 694.360309][ T1189] usb 3-1: Using ep0 maxpacket: 32 [ 694.367060][ T1189] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 694.378487][ T1189] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 694.390214][ T1189] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 694.390953][T13466] input: syz0 as /devices/virtual/input/input46 [ 694.399524][ T1189] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 694.415426][ T1189] usb 3-1: config 0 descriptor?? [ 694.556276][ T1189] hub 3-1:0.0: USB hub found [ 694.650941][ T1189] hub 3-1:0.0: 1 port detected [ 694.847900][T13474] netlink: 'syz.3.1971': attribute type 13 has an invalid length. [ 694.872552][ T5969] tipc: Node number set to 3173294063 [ 694.873189][ T6584] udevd[6584]: setting owner of /dev/input/event5 to uid=0, gid=104 failed: No such file or directory [ 695.008628][T13476] xt_NFQUEUE: number of total queues is 0 [ 695.302673][ T1189] hub 3-1:0.0: activate --> -90 [ 695.668326][ T24] usb 2-1: new full-speed USB device number 50 using dummy_hcd [ 695.737052][ T42] usb 3-1: USB disconnect, device number 65 [ 695.743080][ T1189] usb 3-1-port1: config error [ 695.869925][ T24] usb 2-1: unable to get BOS descriptor or descriptor too short [ 695.878972][ T24] usb 2-1: not running at top speed; connect to a high speed hub [ 695.888558][ T24] usb 2-1: config 10 has an invalid interface number: 115 but max is 0 [ 695.897118][ T24] usb 2-1: config 10 has no interface number 0 [ 695.932138][ T24] usb 2-1: config 10 interface 115 altsetting 224 endpoint 0x4 has invalid maxpacket 1024, setting to 64 [ 695.954885][ T24] usb 2-1: config 10 interface 115 altsetting 224 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 695.966798][ T24] usb 2-1: config 10 interface 115 altsetting 224 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 695.989018][ T24] usb 2-1: config 10 interface 115 has no altsetting 0 [ 696.025218][ T5969] Process accounting resumed [ 696.031573][ T24] usb 2-1: New USB device found, idVendor=19d2, idProduct=1094, bcdDevice=a9.24 [ 696.036112][ T30] audit: type=1400 audit(1761653945.628:619): avc: denied { ioctl } for pid=13490 comm="syz.3.1976" path="socket:[41263]" dev="sockfs" ino=41263 ioctlcmd=0x8b2c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 696.040995][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 696.261579][ T24] usb 2-1: Product: syz [ 696.267068][ T24] usb 2-1: Manufacturer: syz [ 696.272015][ T24] usb 2-1: SerialNumber: syz [ 696.722467][ T30] audit: type=1400 audit(1761653945.936:620): avc: denied { append } for pid=13494 comm="syz.0.1977" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 696.750750][ T24] option 2-1:10.115: GSM modem (1-port) converter detected [ 696.769145][ T24] usb 2-1: USB disconnect, device number 50 [ 696.787441][ T24] option 2-1:10.115: device disconnected [ 698.211210][ T30] audit: type=1326 audit(1761653947.666:621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13502 comm="syz.0.1979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 698.263990][ T30] audit: type=1326 audit(1761653947.666:622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13502 comm="syz.0.1979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 698.423271][ T30] audit: type=1326 audit(1761653947.703:623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13502 comm="syz.0.1979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 698.724127][ T30] audit: type=1326 audit(1761653947.703:624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13502 comm="syz.0.1979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 698.848001][ T30] audit: type=1326 audit(1761653947.703:625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13502 comm="syz.0.1979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 698.927572][ T30] audit: type=1326 audit(1761653947.703:626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13502 comm="syz.0.1979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=7 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 698.951492][ T30] audit: type=1326 audit(1761653947.713:627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13502 comm="syz.0.1979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 698.975248][ T30] audit: type=1326 audit(1761653947.713:628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13502 comm="syz.0.1979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 701.174520][T13540] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=13540 comm=syz.1.1987 [ 702.878205][T13556] overlay: ./file1 is not a directory [ 702.886527][ T24] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 703.171071][T13568] openvswitch: netlink: Flow key attr not present in new flow. [ 703.190234][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 703.687859][ T24] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 703.698195][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 703.728449][ T24] usb 5-1: config 0 descriptor?? [ 703.736085][ T24] pwc: Askey VC010 type 2 USB webcam detected. [ 704.523526][ T24] pwc: recv_control_msg error -32 req 02 val 2b00 [ 704.533610][ T24] pwc: recv_control_msg error -32 req 02 val 2700 [ 704.545009][ T24] pwc: recv_control_msg error -32 req 02 val 2c00 [ 704.557240][ T24] pwc: recv_control_msg error -32 req 04 val 1000 [ 704.596295][ T24] pwc: recv_control_msg error -32 req 04 val 1300 [ 704.635063][ T24] pwc: recv_control_msg error -32 req 04 val 1400 [ 704.689158][ T24] pwc: recv_control_msg error -32 req 02 val 2000 [ 704.775862][ T24] pwc: recv_control_msg error -32 req 02 val 2100 [ 704.786661][ T24] pwc: recv_control_msg error -32 req 04 val 1500 [ 704.831388][ T24] pwc: recv_control_msg error -32 req 02 val 2500 [ 705.052629][ T24] pwc: recv_control_msg error -71 req 02 val 2600 [ 705.068743][ T24] pwc: recv_control_msg error -71 req 02 val 2900 [ 705.093668][ T24] pwc: recv_control_msg error -71 req 02 val 2800 [ 705.229209][ T24] pwc: recv_control_msg error -71 req 04 val 1100 [ 705.257971][ T24] pwc: recv_control_msg error -71 req 04 val 1200 [ 705.291357][ T24] pwc: Registered as video103. [ 705.311527][ T24] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input47 [ 705.379342][ T24] usb 5-1: USB disconnect, device number 61 [ 705.641296][T13591] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 705.657928][T13591] xt_nfacct: accounting object `syz1' does not exist [ 705.766780][T13594] FAULT_INJECTION: forcing a failure. [ 705.766780][T13594] name failslab, interval 1, probability 0, space 0, times 0 [ 705.994082][T13599] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2005'. [ 706.015706][T13594] CPU: 0 UID: 0 PID: 13594 Comm: syz.0.2003 Not tainted syzkaller #0 PREEMPT(full) [ 706.015736][T13594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 706.015748][T13594] Call Trace: [ 706.015755][T13594] [ 706.015763][T13594] dump_stack_lvl+0x16c/0x1f0 [ 706.015800][T13594] should_fail_ex+0x512/0x640 [ 706.015828][T13594] should_failslab+0xc2/0x120 [ 706.015859][T13594] __kmalloc_noprof+0xdd/0x880 [ 706.015887][T13594] ? trace_kmalloc+0x2b/0xd0 [ 706.015907][T13594] ? bio_kmalloc+0x41/0x70 [ 706.015939][T13594] ? bio_kmalloc+0x41/0x70 [ 706.015965][T13594] bio_kmalloc+0x41/0x70 [ 706.015994][T13594] blk_rq_map_user_iov+0x43c/0x13c0 [ 706.016031][T13594] ? __pfx_blk_rq_map_user_iov+0x10/0x10 [ 706.016060][T13594] ? __pfx___might_resched+0x10/0x10 [ 706.016089][T13594] ? rcu_is_watching+0x12/0xc0 [ 706.016116][T13594] ? trace_contention_end+0xdd/0x130 [ 706.016136][T13594] ? find_held_lock+0x2b/0x80 [ 706.016163][T13594] ? sg_common_write.constprop.0+0xbf9/0x1c90 [ 706.016191][T13594] ? import_ubuf+0x1b6/0x220 [ 706.016218][T13594] blk_rq_map_user_io+0x1ff/0x230 [ 706.016247][T13594] ? __pfx_blk_rq_map_user_io+0x10/0x10 [ 706.016273][T13594] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 706.016318][T13594] sg_common_write.constprop.0+0xd43/0x1c90 [ 706.016360][T13594] ? __pfx_sg_common_write.constprop.0+0x10/0x10 [ 706.016402][T13594] sg_write+0x813/0xe10 [ 706.016433][T13594] ? __pfx_sg_write+0x10/0x10 [ 706.016474][T13594] ? __pfx__kstrtoull+0x10/0x10 [ 706.016534][T13594] ? bpf_lsm_file_permission+0x9/0x10 [ 706.016555][T13594] ? security_file_permission+0x71/0x210 [ 706.016582][T13594] ? rw_verify_area+0xcf/0x6c0 [ 706.016614][T13594] ? __pfx_sg_write+0x10/0x10 [ 706.016638][T13594] vfs_writev+0x5df/0xde0 [ 706.016676][T13594] ? __pfx_vfs_writev+0x10/0x10 [ 706.016737][T13594] ? do_writev+0x132/0x340 [ 706.016763][T13594] do_writev+0x132/0x340 [ 706.016793][T13594] ? __pfx_do_writev+0x10/0x10 [ 706.016822][T13594] ? fput+0x9b/0xd0 [ 706.016854][T13594] do_syscall_64+0xcd/0xfa0 [ 706.016881][T13594] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.016900][T13594] RIP: 0033:0x7f849a98efc9 [ 706.016915][T13594] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 706.016933][T13594] RSP: 002b:00007f849b827038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 706.016952][T13594] RAX: ffffffffffffffda RBX: 00007f849abe5fa0 RCX: 00007f849a98efc9 [ 706.016965][T13594] RDX: 0000000000000002 RSI: 0000200000000400 RDI: 0000000000000003 [ 706.016978][T13594] RBP: 00007f849b827090 R08: 0000000000000000 R09: 0000000000000000 [ 706.016990][T13594] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 706.017003][T13594] R13: 00007f849abe6038 R14: 00007f849abe5fa0 R15: 00007ffe10220338 [ 706.017033][T13594] [ 707.590232][T13598] SELinux: policydb string length 0 does not match expected length 8 [ 707.623576][T13598] SELinux: failed to load policy [ 708.439918][T13623] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2010'. [ 708.521198][T13607] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 709.037822][T13627] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2012'. [ 709.046976][T13627] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2012'. [ 709.162669][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 709.162685][ T30] audit: type=1400 audit(1761653957.904:642): avc: denied { bind } for pid=13626 comm="syz.3.2012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 709.335754][T13633] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2013'. [ 709.473496][T13633] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2013'. [ 709.493051][T13633] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2013'. [ 709.506377][T13633] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2013'. [ 709.523948][T13633] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2013'. [ 709.706894][T13639] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 709.767702][T13631] netlink: 'syz.4.2013': attribute type 3 has an invalid length. [ 709.809186][T13641] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2014'. [ 710.307672][T13655] openvswitch: netlink: Flow key attr not present in new flow. [ 711.347334][T13667] serio: Serial port ttyS3 [ 711.846560][ T5969] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 711.964096][ T9] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 711.986322][T13670] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 712.008175][ T5969] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 712.032488][ T5969] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 712.086568][ T5969] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 712.115895][ T5969] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 712.133040][ T5969] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 712.159019][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 959 [ 712.189762][ T5969] usb 2-1: config 0 descriptor?? [ 712.204256][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 712.217033][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 712.233217][ T9] usb 1-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice=e5.38 [ 712.252171][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 712.266999][ T9] usb 1-1: Product: syz [ 712.271665][ T9] usb 1-1: Manufacturer: syz [ 712.282038][ T9] usb 1-1: SerialNumber: syz [ 712.409351][ T9] usb 1-1: config 0 descriptor?? [ 712.419283][T13667] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 712.563402][ T24] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 712.699718][ T5969] plantronics 0003:047F:FFFF.001C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 712.747035][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 712.756090][ T24] usb 5-1: config 0 has an invalid interface number: 52 but max is 0 [ 712.764450][ T24] usb 5-1: config 0 has an invalid descriptor of length 143, skipping remainder of the config [ 712.784273][ T24] usb 5-1: config 0 has no interface number 0 [ 712.790777][ T24] usb 5-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid maxpacket 30689, setting to 64 [ 712.804162][ T24] usb 5-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 712.818308][ T24] usb 5-1: config 0 interface 52 has no altsetting 0 [ 712.832539][ T24] usb 5-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice= 0.00 [ 712.849071][ T24] usb 5-1: New USB device strings: Mfr=0, Product=234, SerialNumber=34 [ 712.857714][ T24] usb 5-1: Product: syz [ 712.861933][ T24] usb 5-1: SerialNumber: syz [ 712.869501][ T24] usb 5-1: config 0 descriptor?? [ 713.141876][T13691] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 714.119835][T13692] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 714.141765][T13693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 714.231488][ T42] usb 2-1: reset high-speed USB device number 51 using dummy_hcd [ 714.864823][ T5969] usb 1-1: USB disconnect, device number 61 [ 714.893790][T13693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 714.980044][ T9] usb 5-1: USB disconnect, device number 62 [ 715.045482][T13700] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 715.521955][T13711] __nla_validate_parse: 1 callbacks suppressed [ 715.521974][T13711] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2036'. [ 715.548573][T13711] netlink: 'syz.1.2036': attribute type 22 has an invalid length. [ 715.560431][T13711] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2036'. [ 715.578788][ T8428] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 715.588027][T13711] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2036'. [ 715.597388][ T8428] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 715.606686][T13711] netlink: 'syz.1.2036': attribute type 22 has an invalid length. [ 715.616295][ T8428] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 715.626388][ T8428] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 715.635402][T13711] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2036'. [ 715.687971][T13718] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 715.700058][T13718] xt_nfacct: accounting object `syz1' does not exist [ 715.782321][ T9] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 715.821622][T13715] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 715.913838][ T24] usb 2-1: USB disconnect, device number 51 [ 715.951729][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 715.993395][ T9] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 716.004632][ T9] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 716.032067][ T9] usb 5-1: config 0 interface 0 has no altsetting 0 [ 716.047808][ T9] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 716.076197][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 716.153443][ T24] usb 2-1: new full-speed USB device number 52 using dummy_hcd [ 716.381270][ T9] usb 5-1: config 0 descriptor?? [ 716.418633][ T24] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 716.481806][T13726] netlink: 5052 bytes leftover after parsing attributes in process `syz.3.2040'. [ 716.491486][T13726] netlink: 5052 bytes leftover after parsing attributes in process `syz.3.2040'. [ 716.878247][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.018334][ T24] usb 2-1: Product: syz [ 717.022576][ T24] usb 2-1: Manufacturer: syz [ 717.028097][ T24] usb 2-1: SerialNumber: syz [ 717.045984][ T24] usb 2-1: config 0 descriptor?? [ 717.060694][ T9] usbhid 5-1:0.0: can't add hid device: -71 [ 717.067915][ T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 717.677298][ T9] usb 5-1: USB disconnect, device number 63 [ 718.267553][T13739] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 718.289716][T13739] block device autoloading is deprecated and will be removed. [ 718.587723][ T30] audit: type=1400 audit(1761653966.617:643): avc: denied { listen } for pid=13731 comm="syz.3.2041" lport=38516 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 719.074673][ T42] usb 2-1: USB disconnect, device number 52 [ 719.280754][T13750] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2047'. [ 719.434524][T13756] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 719.444291][T13756] block device autoloading is deprecated and will be removed. [ 719.465467][ T30] audit: type=1400 audit(1761653967.487:644): avc: denied { read } for pid=13746 comm="syz.4.2044" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 719.466620][T13753] veth0_macvtap: left allmulticast mode [ 719.512271][T13753] veth0_macvtap: left promiscuous mode [ 719.525710][ T30] audit: type=1400 audit(1761653967.487:645): avc: denied { open } for pid=13746 comm="syz.4.2044" path="/398/file0/file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 719.593220][T13753] macvtap0: refused to change device tx_queue_len [ 719.643402][ T977] usb 3-1: new low-speed USB device number 66 using dummy_hcd [ 719.738271][T13760] fuse: Unknown parameter 'fd0x0000000000000003' [ 720.147123][ T977] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 721.113369][ T977] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 721.137232][ T977] usb 3-1: config 0 descriptor?? [ 721.591922][ T977] asix 3-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 721.813485][T13762] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 722.822696][T13789] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 724.108796][T13802] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 724.120366][T13802] xt_nfacct: accounting object `syz1' does not exist [ 724.893312][ T977] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 725.071771][ T977] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 725.093972][ T977] asix 3-1:0.0: probe with driver asix failed with error -71 [ 725.116120][ T977] usb 3-1: USB disconnect, device number 66 [ 725.494578][T13827] openvswitch: netlink: Flow key attr not present in new flow. [ 725.924603][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 726.656461][T13837] openvswitch: netlink: Flow key attr not present in new flow. [ 728.028358][ T977] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 728.191312][ T977] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 728.228823][ T977] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 728.307806][ T977] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 728.318257][ T977] usb 2-1: config 0 descriptor?? [ 728.340820][ T977] pwc: Askey VC010 type 2 USB webcam detected. [ 728.574280][T13868] input: syz1 as /devices/virtual/input/input49 [ 728.675943][ T30] audit: type=1400 audit(1761653976.107:646): avc: denied { mount } for pid=13866 comm="syz.4.2077" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 728.698215][ C1] vkms_vblank_simulate: vblank timer overrun [ 728.754923][ T30] audit: type=1400 audit(1761653976.117:647): avc: denied { watch } for pid=13866 comm="syz.4.2077" path="/401/file0" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 728.815429][ T977] pwc: recv_control_msg error -32 req 02 val 2b00 [ 728.823935][ T977] pwc: recv_control_msg error -32 req 02 val 2700 [ 728.834145][ T977] pwc: recv_control_msg error -32 req 02 val 2c00 [ 728.843153][ T977] pwc: recv_control_msg error -32 req 04 val 1000 [ 728.855153][ T977] pwc: recv_control_msg error -32 req 04 val 1300 [ 728.879480][ T977] pwc: recv_control_msg error -32 req 04 val 1400 [ 728.890514][ T977] pwc: recv_control_msg error -32 req 02 val 2000 [ 728.897955][ T977] pwc: recv_control_msg error -32 req 02 val 2100 [ 728.905114][ T977] pwc: recv_control_msg error -32 req 04 val 1500 [ 728.913236][ T977] pwc: recv_control_msg error -32 req 02 val 2500 [ 729.144949][ T977] pwc: recv_control_msg error -71 req 02 val 2600 [ 729.153988][ T977] pwc: recv_control_msg error -71 req 02 val 2900 [ 729.164960][T13880] random: crng reseeded on system resumption [ 729.174183][ T977] pwc: recv_control_msg error -71 req 02 val 2800 [ 729.199815][ T977] pwc: recv_control_msg error -71 req 04 val 1100 [ 729.210363][ T977] pwc: recv_control_msg error -71 req 04 val 1200 [ 729.258626][ T977] pwc: Registered as video103. [ 729.304031][ T977] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input50 [ 729.666277][ T977] usb 2-1: USB disconnect, device number 53 [ 730.492628][T13895] ptrace attach of "./syz-executor exec"[13893] was attempted by "./syz-executor exec"[13895] [ 731.398281][ T30] audit: type=1400 audit(1761653978.697:648): avc: denied { unmount } for pid=5810 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 731.493611][T13898] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 731.546977][ T977] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 731.921312][ T977] usb 3-1: Using ep0 maxpacket: 32 [ 731.933124][ T977] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 731.954845][ T977] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 732.081379][ T977] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 732.113854][ T977] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.612266][ T977] usb 3-1: config 0 descriptor?? [ 732.634548][T13915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 732.656109][ T977] hub 3-1:0.0: USB hub found [ 732.663190][T13915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 732.868617][ T977] hub 3-1:0.0: 1 port detected [ 732.954756][ T30] audit: type=1400 audit(1761653980.146:649): avc: denied { transfer } for pid=13927 comm="syz.0.2093" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 733.116846][T13905] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 733.125860][T13905] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 733.137630][T13905] overlayfs: missing 'lowerdir' [ 733.217392][T13905] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2087'. [ 733.759089][T13939] FAULT_INJECTION: forcing a failure. [ 733.759089][T13939] name failslab, interval 1, probability 0, space 0, times 0 [ 733.775438][T13939] CPU: 1 UID: 0 PID: 13939 Comm: syz.3.2096 Not tainted syzkaller #0 PREEMPT(full) [ 733.775467][T13939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 733.775479][T13939] Call Trace: [ 733.775486][T13939] [ 733.775495][T13939] dump_stack_lvl+0x16c/0x1f0 [ 733.775529][T13939] should_fail_ex+0x512/0x640 [ 733.775552][T13939] ? __kmalloc_cache_noprof+0x5f/0x780 [ 733.775585][T13939] should_failslab+0xc2/0x120 [ 733.775609][T13939] __kmalloc_cache_noprof+0x72/0x780 [ 733.775638][T13939] ? tcf_block_get_ext+0x3c6/0x1800 [ 733.775676][T13939] ? tcf_block_get_ext+0x3c6/0x1800 [ 733.775703][T13939] tcf_block_get_ext+0x3c6/0x1800 [ 733.775730][T13939] ? tc_get_qdisc+0x1081/0x10d0 [ 733.775749][T13939] ? tc_modify_qdisc+0x11d8/0x2170 [ 733.775770][T13939] ? netlink_sendmsg+0x8c8/0xdd0 [ 733.775797][T13939] ? ____sys_sendmsg+0xa98/0xc70 [ 733.775830][T13939] tcf_block_get+0xa8/0x100 [ 733.775857][T13939] ? __pfx_tcf_block_get+0x10/0x10 [ 733.775884][T13939] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 733.775913][T13939] ? __pfx_prio_init+0x10/0x10 [ 733.775940][T13939] prio_init+0x3b/0x80 [ 733.775965][T13939] ? __pfx_prio_init+0x10/0x10 [ 733.775991][T13939] qdisc_create+0x457/0xfc0 [ 733.776016][T13939] tc_modify_qdisc+0x11d8/0x2170 [ 733.776039][T13939] ? rcu_is_watching+0x12/0xc0 [ 733.776069][T13939] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 733.776117][T13939] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 733.776139][T13939] rtnetlink_rcv_msg+0x3c9/0xe90 [ 733.776170][T13939] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 733.776207][T13939] ? ref_tracker_free+0x37c/0x830 [ 733.776236][T13939] netlink_rcv_skb+0x158/0x420 [ 733.776264][T13939] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 733.776294][T13939] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 733.776333][T13939] ? netlink_deliver_tap+0x1ae/0xd30 [ 733.776367][T13939] netlink_unicast+0x5aa/0x870 [ 733.776399][T13939] ? __pfx_netlink_unicast+0x10/0x10 [ 733.776439][T13939] netlink_sendmsg+0x8c8/0xdd0 [ 733.776472][T13939] ? __pfx_netlink_sendmsg+0x10/0x10 [ 733.776512][T13939] ____sys_sendmsg+0xa98/0xc70 [ 733.776544][T13939] ? copy_msghdr_from_user+0x10a/0x160 [ 733.776569][T13939] ? __pfx_____sys_sendmsg+0x10/0x10 [ 733.776615][T13939] ___sys_sendmsg+0x134/0x1d0 [ 733.776643][T13939] ? __pfx____sys_sendmsg+0x10/0x10 [ 733.776670][T13939] ? __lock_acquire+0x622/0x1c90 [ 733.776739][T13939] __sys_sendmsg+0x16d/0x220 [ 733.776766][T13939] ? __pfx___sys_sendmsg+0x10/0x10 [ 733.776813][T13939] do_syscall_64+0xcd/0xfa0 [ 733.776844][T13939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.776865][T13939] RIP: 0033:0x7f8648f8efc9 [ 733.776883][T13939] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 733.776902][T13939] RSP: 002b:00007f8649d97038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 733.776921][T13939] RAX: ffffffffffffffda RBX: 00007f86491e5fa0 RCX: 00007f8648f8efc9 [ 733.776935][T13939] RDX: 0000000020004000 RSI: 0000200000000000 RDI: 0000000000000003 [ 733.776948][T13939] RBP: 00007f8649d97090 R08: 0000000000000000 R09: 0000000000000000 [ 733.776961][T13939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 733.776974][T13939] R13: 00007f86491e6038 R14: 00007f86491e5fa0 R15: 00007ffce57c0df8 [ 733.777006][T13939] [ 733.794059][ T977] hub 3-1:0.0: activate --> -90 [ 734.116795][ T5969] hub 3-1:0.0: hub_ext_port_status failed (err = 0) [ 734.496060][ T42] usb 3-1: USB disconnect, device number 67 [ 734.990899][T10416] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 735.049824][T13952] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 735.162222][T10416] usb 2-1: Using ep0 maxpacket: 32 [ 735.182790][T10416] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 735.195675][ T30] audit: type=1400 audit(1761653982.222:650): avc: denied { write } for pid=13958 comm="syz.4.2103" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=socket permissive=1 [ 735.413969][T10416] usb 2-1: config 0 has no interface number 0 [ 735.526810][T10416] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 735.628884][T10416] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.750586][ T30] audit: type=1400 audit(1761653982.222:651): avc: denied { read } for pid=13958 comm="syz.4.2103" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=socket permissive=1 [ 735.804397][T10416] usb 2-1: Product: syz [ 735.808659][T10416] usb 2-1: Manufacturer: syz [ 735.838485][T10416] usb 2-1: SerialNumber: syz [ 735.872172][T10416] usb 2-1: config 0 descriptor?? [ 735.891118][T10416] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 735.998717][ T30] audit: type=1400 audit(1761653982.998:652): avc: denied { ioctl } for pid=13968 comm="syz.2.2105" path="socket:[42879]" dev="sockfs" ino=42879 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 736.057501][T13973] loop2: detected capacity change from 0 to 7 [ 736.084295][ T5826] Dev loop2: unable to read RDB block 7 [ 736.090068][ T5826] loop2: unable to read partition table [ 736.106825][ T5826] loop2: partition table beyond EOD, truncated [ 736.114693][T13973] Dev loop2: unable to read RDB block 7 [ 736.119993][T10416] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 736.126377][T13973] loop2: unable to read partition table [ 736.145433][T13973] loop2: partition table beyond EOD, truncated [ 736.159164][T13973] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 736.159299][T10416] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 736.582136][T13995] netlink: 'syz.2.2113': attribute type 1 has an invalid length. [ 736.631889][T13995] 8021q: adding VLAN 0 to HW filter on device bond1 [ 736.710247][T13995] bond1: (slave veth5): Enslaving as an active interface with a down link [ 736.773037][T13995] vlan2: entered allmulticast mode [ 736.778824][T13995] veth1: entered allmulticast mode [ 736.844913][T13995] veth1: entered promiscuous mode [ 736.853990][T13995] veth1: left promiscuous mode [ 736.864290][T13995] bond1: (slave vlan2): making interface the new active one [ 736.872440][T13995] veth1: entered promiscuous mode [ 736.878798][T13995] vlan2: entered promiscuous mode [ 736.895500][T13995] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 737.446334][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 737.497522][T10416] usb 2-1: USB disconnect, device number 54 [ 737.514226][T10416] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 737.633944][T10416] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 737.648662][T10416] quatech2 2-1:0.51: device disconnected [ 737.905813][T14013] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2118'. [ 738.901907][T14023] tmpfs: Bad value for 'mpol' [ 739.547923][T14045] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 739.559474][T14045] netlink: 'syz.4.2127': attribute type 10 has an invalid length. [ 739.567413][T14045] macvlan0: entered promiscuous mode [ 739.591661][T14045] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 740.088799][T14049] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2124'. [ 740.110806][T14049] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2124'. [ 740.969660][T14061] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2133'. [ 741.029975][T14063] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2134'. [ 741.209796][T14068] netlink: 'syz.0.2135': attribute type 13 has an invalid length. [ 741.948660][T14068] netlink: 'syz.0.2135': attribute type 13 has an invalid length. [ 743.111168][T14103] FAULT_INJECTION: forcing a failure. [ 743.111168][T14103] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 743.124386][T14103] CPU: 0 UID: 0 PID: 14103 Comm: syz.1.2141 Not tainted syzkaller #0 PREEMPT(full) [ 743.124414][T14103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 743.124426][T14103] Call Trace: [ 743.124433][T14103] [ 743.124441][T14103] dump_stack_lvl+0x16c/0x1f0 [ 743.124475][T14103] should_fail_ex+0x512/0x640 [ 743.124502][T14103] _copy_to_user+0x32/0xd0 [ 743.124530][T14103] simple_read_from_buffer+0xcb/0x170 [ 743.124565][T14103] proc_fail_nth_read+0x197/0x240 [ 743.124591][T14103] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 743.124618][T14103] ? rw_verify_area+0xcf/0x6c0 [ 743.124647][T14103] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 743.124671][T14103] vfs_read+0x1e4/0xcf0 [ 743.124695][T14103] ? __pfx___mutex_lock+0x10/0x10 [ 743.124715][T14103] ? __pfx_vfs_read+0x10/0x10 [ 743.124743][T14103] ? __fget_files+0x20e/0x3c0 [ 743.124773][T14103] ksys_read+0x12a/0x250 [ 743.124792][T14103] ? __pfx_ksys_read+0x10/0x10 [ 743.124821][T14103] do_syscall_64+0xcd/0xfa0 [ 743.124852][T14103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 743.124874][T14103] RIP: 0033:0x7fa70af8d9dc [ 743.124891][T14103] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 743.124911][T14103] RSP: 002b:00007fa70be1f030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 743.124931][T14103] RAX: ffffffffffffffda RBX: 00007fa70b1e6180 RCX: 00007fa70af8d9dc [ 743.124951][T14103] RDX: 000000000000000f RSI: 00007fa70be1f0a0 RDI: 0000000000000009 [ 743.124964][T14103] RBP: 00007fa70be1f090 R08: 0000000000000000 R09: 0000000000000000 [ 743.124977][T14103] R10: 0000200000000400 R11: 0000000000000246 R12: 0000000000000001 [ 743.124991][T14103] R13: 00007fa70b1e6218 R14: 00007fa70b1e6180 R15: 00007fff5bac3df8 [ 743.125021][T14103] [ 744.679469][T14116] CUSE: unknown device info "" [ 744.684541][T14116] CUSE: unknown device info "`" [ 744.689438][T14116] CUSE: unknown device info "" [ 744.694586][T14116] CUSE: unknown device info "€" [ 744.699523][T14116] CUSE: DEVNAME unspecified [ 745.588162][T14123] erofs (device nbd0): cannot find valid erofs superblock [ 745.712845][T14125] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2149'. [ 747.206404][ T30] audit: type=1400 audit(1761653993.480:653): avc: denied { read } for pid=14138 comm="syz.3.2153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 747.440227][ T42] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 747.719231][ T42] usb 3-1: Using ep0 maxpacket: 8 [ 747.748336][ T42] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 747.838820][ T42] usb 3-1: config 0 has no interface number 0 [ 747.851314][ T42] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 576, setting to 64 [ 747.872865][ T42] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 748.066998][T14156] bridge0: port 2(bridge_slave_1) entered blocking state [ 748.074176][T14156] bridge0: port 2(bridge_slave_1) entered listening state [ 748.081425][T14156] bridge0: port 1(bridge_slave_0) entered blocking state [ 748.088557][T14156] bridge0: port 1(bridge_slave_0) entered listening state [ 748.098466][ T42] usb 3-1: config 0 interface 2 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 748.124893][ T42] usb 3-1: New USB device found, idVendor=17ef, idProduct=3899, bcdDevice=2b.0f [ 748.219665][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 748.261654][T14156] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 748.281936][ T42] usb 3-1: config 0 descriptor?? [ 748.536323][T14140] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2152'. [ 748.849151][ T42] usb 3-1: string descriptor 0 read error: -71 [ 748.876800][ T42] usb-storage 3-1:0.2: USB Mass Storage device detected [ 748.912982][ T42] usb-storage 3-1:0.2: Quirks match for vid 17ef pid 3899: 800000 [ 749.027711][ T42] usb 3-1: USB disconnect, device number 68 [ 749.428587][T14180] ptrace attach of "./syz-executor exec"[14181] was attempted by "./syz-executor exec"[14180] [ 750.374323][T14190] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 750.386749][T14190] xt_nfacct: accounting object `syz1' does not exist [ 752.467154][ T8428] vlan2: left promiscuous mode [ 752.514480][T14225] sp0: Synchronizing with TNC [ 752.534841][T14225] sp0: Found TNC [ 752.540289][T14225] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2172'. [ 754.287302][T14242] lo: Caught tx_queue_len zero misconfig [ 754.798500][ T24] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 754.918698][ T977] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 754.997384][T14248] Bluetooth: MGMT ver 1.23 [ 755.033231][T14248] pim6reg1: entered promiscuous mode [ 755.055053][T14248] pim6reg1: entered allmulticast mode [ 755.091365][ T977] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 755.101474][ T977] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 755.114456][ T977] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 755.119875][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 755.123563][ T977] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 755.138618][ T24] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 755.139697][ T977] usb 1-1: config 0 descriptor?? [ 755.259393][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.267418][ T24] usb 2-1: Product: syz [ 755.322722][ T24] usb 2-1: Manufacturer: syz [ 755.327348][ T24] usb 2-1: SerialNumber: syz [ 755.356451][ T24] usb 2-1: config 0 descriptor?? [ 755.446386][T14246] tmpfs: Bad value for 'mpol' [ 755.585387][T14247] NILFS (nbd1): device size too small [ 755.924665][T14246] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 756.015501][T14246] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 756.043388][ T977] usbhid 1-1:0.0: can't add hid device: -71 [ 756.142710][ T977] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 756.257937][ T977] usb 1-1: USB disconnect, device number 62 [ 756.703023][ T24] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 756.730712][T14267] sit0: left promiscuous mode [ 756.774887][T14267] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 756.887101][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 756.894145][ T24] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 756.902618][ T24] usb 3-1: config 0 has no interface number 0 [ 756.955547][T14275] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 756.968360][T14275] xt_nfacct: accounting object `syz1' does not exist [ 756.979503][ T24] usb 3-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 756.991724][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.999727][ T24] usb 3-1: Product: syz [ 757.004194][ T24] usb 3-1: Manufacturer: syz [ 757.008770][ T24] usb 3-1: SerialNumber: syz [ 757.017464][ T24] usb 3-1: config 0 descriptor?? [ 757.065765][ T24] hub 3-1:0.89: bad descriptor, ignoring hub [ 757.075013][ T24] hub 3-1:0.89: probe with driver hub failed with error -5 [ 757.114146][T14278] netlink: 'syz.3.2188': attribute type 4 has an invalid length. [ 757.148376][ T24] option 3-1:0.89: GSM modem (1-port) converter detected [ 757.154201][T14278] netlink: 'syz.3.2188': attribute type 4 has an invalid length. [ 757.506136][ T24] usb 3-1: GSM modem (1-port) converter now attached to ttyUSB0 [ 757.709769][ T24] usb 3-1: USB disconnect, device number 69 [ 757.720676][ T24] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0 [ 757.832590][ T24] option 3-1:0.89: device disconnected [ 757.838455][ T42] usb 2-1: USB disconnect, device number 55 [ 757.926810][T14280] xt_connbytes: Forcing CT accounting to be enabled [ 758.466327][T14289] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2193'. [ 758.712865][ T5969] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 758.874617][ T5969] usb 3-1: Using ep0 maxpacket: 8 [ 758.881397][ T5969] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 758.883908][ T24] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 758.892166][ T5969] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 758.930703][ T5969] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 758.942481][ T5969] usb 3-1: config 0 descriptor?? [ 758.951038][ T5969] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 759.066040][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 759.075477][ T24] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 759.088837][ T24] usb 4-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 759.098571][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 759.114784][ T24] usb 4-1: Product: syz [ 759.124155][ T24] usb 4-1: Manufacturer: syz [ 759.134662][ T24] usb 4-1: SerialNumber: syz [ 759.144257][ T24] usb 4-1: config 0 descriptor?? [ 759.385044][T14295] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2194'. [ 759.423790][ T24] usb 4-1: USB disconnect, device number 55 [ 759.830806][T14309] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 760.200089][ T5969] gspca_vc032x: reg_w err -110 [ 760.578864][ T5969] vc032x 3-1:0.0: probe with driver vc032x failed with error -110 [ 760.587030][ T30] audit: type=1400 audit(1761654006.572:654): avc: denied { mounton } for pid=14288 comm="syz.2.2192" path="/451/file0" dev="tmpfs" ino=2428 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 763.081376][ T5969] usb 3-1: USB disconnect, device number 70 [ 763.280787][T10416] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 763.697481][ T5969] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 763.829086][T14341] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 763.841281][T14341] xt_nfacct: accounting object `syz1' does not exist [ 763.866946][T14340] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 763.875727][T10416] usb 4-1: Using ep0 maxpacket: 32 [ 763.897569][T10416] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 763.922346][T10416] usb 4-1: config 0 has no interface number 0 [ 763.950065][T10416] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 763.981658][T14344] FAULT_INJECTION: forcing a failure. [ 763.981658][T14344] name failslab, interval 1, probability 0, space 0, times 0 [ 763.987330][T10416] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.995382][T14344] CPU: 0 UID: 0 PID: 14344 Comm: syz.4.2205 Not tainted syzkaller #0 PREEMPT(full) [ 763.995408][T14344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 763.995420][T14344] Call Trace: [ 763.995427][T14344] [ 763.995436][T14344] dump_stack_lvl+0x16c/0x1f0 [ 763.995469][T14344] should_fail_ex+0x512/0x640 [ 763.995491][T14344] ? fs_reclaim_acquire+0xae/0x150 [ 763.995522][T14344] should_failslab+0xc2/0x120 [ 763.995545][T14344] __kmalloc_noprof+0xdd/0x880 [ 763.995572][T14344] ? tomoyo_encode2+0x100/0x3e0 [ 763.995599][T14344] ? tomoyo_encode2+0x100/0x3e0 [ 763.995619][T14344] tomoyo_encode2+0x100/0x3e0 [ 763.995644][T14344] tomoyo_encode+0x29/0x50 [ 763.995665][T14344] tomoyo_realpath_from_path+0x18f/0x6e0 [ 763.995696][T14344] tomoyo_path_number_perm+0x245/0x580 [ 763.995725][T14344] ? tomoyo_path_number_perm+0x237/0x580 [ 763.995757][T14344] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 763.995788][T14344] ? find_held_lock+0x2b/0x80 [ 763.995838][T14344] ? find_held_lock+0x2b/0x80 [ 763.995861][T14344] ? hook_file_ioctl_common+0x145/0x410 [ 763.995893][T14344] ? __fget_files+0x20e/0x3c0 [ 763.995918][T14344] security_file_ioctl+0x9b/0x240 [ 763.995943][T14344] __x64_sys_ioctl+0xb7/0x210 [ 763.995973][T14344] do_syscall_64+0xcd/0xfa0 [ 763.996003][T14344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 763.996024][T14344] RIP: 0033:0x7fea3498efc9 [ 763.996040][T14344] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 763.996059][T14344] RSP: 002b:00007fea358b9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 763.996078][T14344] RAX: ffffffffffffffda RBX: 00007fea34be6180 RCX: 00007fea3498efc9 [ 763.996091][T14344] RDX: 0000200000000180 RSI: 000000004010744d RDI: 0000000000000009 [ 763.996103][T14344] RBP: 00007fea358b9090 R08: 0000000000000000 R09: 0000000000000000 [ 763.996116][T14344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 763.996128][T14344] R13: 00007fea34be6218 R14: 00007fea34be6180 R15: 00007fffd583a458 [ 763.996157][T14344] [ 763.999827][T14344] ERROR: Out of memory at tomoyo_realpath_from_path. [ 764.235559][T14340] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2205'. [ 764.262021][ T5969] usb 1-1: Using ep0 maxpacket: 32 [ 764.262021][T10416] usb 4-1: Product: syz [ 764.265546][ T5969] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 764.280294][ T5969] usb 1-1: config 0 has no interface number 0 [ 764.282985][T10416] usb 4-1: Manufacturer: syz [ 764.744686][ T5969] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 764.775665][ T5969] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.796718][ T5969] usb 1-1: Product: syz [ 764.816314][ T5969] usb 1-1: Manufacturer: syz [ 764.828105][ T5969] usb 1-1: SerialNumber: syz [ 764.877334][ T5969] usb 1-1: config 0 descriptor?? [ 764.974032][T10416] usb 4-1: SerialNumber: syz [ 765.002852][T10416] usb 4-1: config 0 descriptor?? [ 765.003852][ T5969] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 765.010075][T10416] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 765.253003][ T5969] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 765.284751][ T5969] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 765.312238][T10416] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB2 [ 765.451337][ C1] quatech-serial ttyUSB2: qt2_process_read_urb - status message too short [ 765.491086][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - status message too short [ 765.788892][T10416] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB3 [ 766.429725][T14357] FAULT_INJECTION: forcing a failure. [ 766.429725][T14357] name failslab, interval 1, probability 0, space 0, times 0 [ 766.444287][T14357] CPU: 0 UID: 0 PID: 14357 Comm: syz.2.2210 Not tainted syzkaller #0 PREEMPT(full) [ 766.444314][T14357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 766.444331][T14357] Call Trace: [ 766.444338][T14357] [ 766.444345][T14357] dump_stack_lvl+0x16c/0x1f0 [ 766.444378][T14357] should_fail_ex+0x512/0x640 [ 766.444403][T14357] ? fs_reclaim_acquire+0xae/0x150 [ 766.444426][T14357] should_failslab+0xc2/0x120 [ 766.444447][T14357] __kmalloc_noprof+0xdd/0x880 [ 766.444472][T14357] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 766.444501][T14357] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 766.444522][T14357] tomoyo_realpath_from_path+0xc2/0x6e0 [ 766.444547][T14357] ? tomoyo_profile+0x47/0x60 [ 766.444573][T14357] tomoyo_path_number_perm+0x245/0x580 [ 766.444600][T14357] ? tomoyo_path_number_perm+0x237/0x580 [ 766.444631][T14357] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 766.444661][T14357] ? find_held_lock+0x2b/0x80 [ 766.444704][T14357] ? find_held_lock+0x2b/0x80 [ 766.444726][T14357] ? hook_file_ioctl_common+0x145/0x410 [ 766.444757][T14357] ? __fget_files+0x20e/0x3c0 [ 766.444782][T14357] security_file_ioctl+0x9b/0x240 [ 766.444805][T14357] __x64_sys_ioctl+0xb7/0x210 [ 766.444835][T14357] do_syscall_64+0xcd/0xfa0 [ 766.444866][T14357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.444888][T14357] RIP: 0033:0x7f3913d8efc9 [ 766.444905][T14357] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 766.444921][T14357] RSP: 002b:00007f3914cb1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 766.444940][T14357] RAX: ffffffffffffffda RBX: 00007f3913fe5fa0 RCX: 00007f3913d8efc9 [ 766.444952][T14357] RDX: 0000200000000180 RSI: 000000004010744d RDI: 0000000000000003 [ 766.444962][T14357] RBP: 00007f3914cb1090 R08: 0000000000000000 R09: 0000000000000000 [ 766.444973][T14357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 766.444986][T14357] R13: 00007f3913fe6038 R14: 00007f3913fe5fa0 R15: 00007fff83bb6128 [ 766.445017][T14357] [ 766.662018][T14357] ERROR: Out of memory at tomoyo_realpath_from_path. [ 766.737654][T14362] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 766.816464][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 766.825609][ T977] usb 4-1: USB disconnect, device number 56 [ 766.892932][ C0] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 766.940852][ T9] usb 1-1: USB disconnect, device number 63 [ 766.974060][ T9] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 766.987294][ T977] quatech-serial ttyUSB2: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB2 [ 767.029309][T14369] ipt_REJECT: TCP_RESET invalid for non-tcp [ 767.034676][ T9] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 767.041774][T14371] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2213'. [ 767.069978][ T977] quatech-serial ttyUSB3: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB3 [ 767.201453][ T9] quatech2 1-1:0.51: device disconnected [ 767.244056][ T977] quatech2 4-1:0.51: device disconnected [ 767.641414][T14383] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2216'. [ 767.724166][T14383] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2216'. [ 768.092467][ T977] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 768.113821][ T30] audit: type=1400 audit(1761654014.015:655): avc: denied { read } for pid=14387 comm="syz.3.2218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 768.334579][ T977] usb 1-1: Using ep0 maxpacket: 32 [ 768.346276][ T977] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 768.434703][ T977] usb 1-1: config 0 has no interface number 0 [ 768.443923][ T977] usb 1-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 768.461488][ T977] usb 1-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 768.515323][T14395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 768.525995][T14395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 768.541627][ T42] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 768.556169][ T977] usb 1-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 768.638121][ T977] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 768.639923][T14395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 768.646132][ T977] usb 1-1: Product: syz [ 768.661033][ T977] usb 1-1: Manufacturer: syz [ 768.665647][ T977] usb 1-1: SerialNumber: syz [ 768.681376][T14395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 768.691441][ T42] usb 4-1: device descriptor read/64, error -71 [ 768.724707][T14395] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2219'. [ 768.724724][ T977] usb 1-1: config 0 descriptor?? [ 768.798388][ T9] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 768.937420][ T9] usb 2-1: device descriptor read/64, error -71 [ 768.948157][ T42] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 769.837150][ T977] radio-si470x 1-1:0.35: this is not a si470x device. [ 769.967836][ T42] usb 4-1: device descriptor read/64, error -71 [ 769.977233][ T9] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 770.083301][ T42] usb usb4-port1: attempt power cycle [ 770.135210][ T9] usb 2-1: device descriptor read/64, error -71 [ 770.163376][T14419] Unsupported ieee802154 address type: 0 [ 770.253151][ T9] usb usb2-port1: attempt power cycle [ 770.584476][ T42] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 770.938737][ T977] radio-raremono 1-1:0.35: this is not Thanko's Raremono. [ 770.983713][T14426] 9pnet_fd: Insufficient options for proto=fd [ 771.055625][ T42] usb 4-1: device descriptor read/8, error -71 [ 771.227010][ T9] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 771.246041][T10416] usb 1-1: USB disconnect, device number 64 [ 771.271779][ T9] usb 2-1: device descriptor read/8, error -71 [ 771.312681][ T42] usb 4-1: new full-speed USB device number 60 using dummy_hcd [ 771.550309][T14437] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 771.559382][T14437] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 771.571004][T14437] overlayfs: missing 'lowerdir' [ 771.650117][T14438] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2230'. [ 771.686132][ T42] usb 4-1: device not accepting address 60, error -71 [ 771.707795][ T9] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 771.996401][ T9] usb 2-1: device not accepting address 59, error -71 [ 772.113508][ T9] usb usb2-port1: unable to enumerate USB device [ 772.729860][ T42] usb usb4-port1: unable to enumerate USB device [ 772.912323][T14445] ubi31: detaching mtd0 [ 772.933931][T14445] ubi31: mtd0 is detached [ 775.220332][T14464] wg1 speed is unknown, defaulting to 1000 [ 776.024083][ T42] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 776.330467][T14478] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 776.562755][T14481] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2245'. [ 777.586865][T14493] ptrace attach of "./syz-executor exec"[14492] was attempted by "./syz-executor exec"[14493] [ 777.836062][ T5884] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 777.996274][ T5884] usb 3-1: Using ep0 maxpacket: 32 [ 778.003461][ T5884] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 778.027933][ T5884] usb 3-1: config 0 has no interface number 0 [ 778.208280][ T5884] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 778.245168][ T5884] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 778.253978][ T5884] usb 3-1: Product: syz [ 778.258243][ T5884] usb 3-1: Manufacturer: syz [ 778.262868][ T5884] usb 3-1: SerialNumber: syz [ 778.283869][ T5884] usb 3-1: config 0 descriptor?? [ 778.733830][T14511] openvswitch: netlink: Flow key attr not present in new flow. [ 778.914992][ T5884] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 779.117803][ T5884] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 779.142058][ T5884] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 780.296816][ C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 780.307290][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 780.315514][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 780.529474][ T5884] usb 3-1: USB disconnect, device number 71 [ 780.571987][ T5884] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 780.648102][ T5884] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 780.712573][ T5884] quatech2 3-1:0.51: device disconnected [ 781.268218][T14542] ptrace attach of "./syz-executor exec"[14541] was attempted by "./syz-executor exec"[14542] [ 781.625697][ T5884] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 781.953472][ T5884] usb 2-1: Using ep0 maxpacket: 32 [ 782.014808][ T5884] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 782.034249][T14547] loop8: detected capacity change from 0 to 8 [ 782.048344][ T5884] usb 2-1: config 0 has no interface number 0 [ 782.106806][T14547] Dev loop8: unable to read RDB block 8 [ 782.134859][T14547] loop8: unable to read partition table [ 782.142302][ T5884] usb 2-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 782.144209][T14555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 782.152663][ T5884] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 782.171177][T14547] loop8: partition table beyond EOD, truncated [ 782.212456][ T5884] usb 2-1: Product: syz [ 782.215793][T14547] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 782.237401][T14555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 782.245322][ T5884] usb 2-1: Manufacturer: syz [ 782.266223][ T5884] usb 2-1: SerialNumber: syz [ 782.341592][ T5884] usb 2-1: config 0 descriptor?? [ 782.364814][ T5884] hub 2-1:0.89: bad descriptor, ignoring hub [ 782.384219][ T5884] hub 2-1:0.89: probe with driver hub failed with error -5 [ 782.392133][ T24] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 782.393909][ T5884] option 2-1:0.89: GSM modem (1-port) converter detected [ 782.420740][ T5884] usb 2-1: GSM modem (1-port) converter now attached to ttyUSB0 [ 782.783254][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 782.813328][ T5884] usb 2-1: USB disconnect, device number 60 [ 782.828040][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 782.835989][ T5884] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0 [ 782.846865][ T24] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 782.868456][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 782.879460][ T5884] option 2-1:0.89: device disconnected [ 782.943756][ T24] usb 5-1: config 0 descriptor?? [ 783.064883][T14569] CIFS mount error: No usable UNC path provided in device string! [ 783.064883][T14569] [ 783.075733][T14569] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 783.308229][ T30] audit: type=1326 audit(1761654028.161:656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14572 comm="syz.0.2270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 783.340577][ T30] audit: type=1326 audit(1761654028.161:657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14572 comm="syz.0.2270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 783.368434][ T30] audit: type=1326 audit(1761654028.161:658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14572 comm="syz.0.2270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 783.388291][ T24] pyra 0003:1E7D:2CF6.001D: unknown main item tag 0x2 [ 783.412013][ T30] audit: type=1326 audit(1761654028.161:659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14572 comm="syz.0.2270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 783.438371][ T24] pyra 0003:1E7D:2CF6.001D: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.4-1/input0 [ 783.451687][ T30] audit: type=1326 audit(1761654028.161:660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14572 comm="syz.0.2270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 783.475744][ T30] audit: type=1326 audit(1761654028.227:661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14572 comm="syz.0.2270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=7 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 783.499659][ T30] audit: type=1326 audit(1761654028.246:662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14572 comm="syz.0.2270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 783.525419][ T30] audit: type=1326 audit(1761654028.255:663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14572 comm="syz.0.2270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 783.550093][ T30] audit: type=1326 audit(1761654028.255:664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14572 comm="syz.0.2270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 783.578858][ T30] audit: type=1326 audit(1761654028.255:665): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14572 comm="syz.0.2270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f849a98efc9 code=0x7ffc0000 [ 783.816444][ T24] pyra 0003:1E7D:2CF6.001D: couldn't init struct pyra_device [ 783.823999][ T24] pyra 0003:1E7D:2CF6.001D: couldn't install mouse [ 783.832699][ T24] pyra 0003:1E7D:2CF6.001D: probe with driver pyra failed with error -71 [ 783.863519][ T24] usb 5-1: USB disconnect, device number 65 [ 784.210461][T14591] ptrace attach of "./syz-executor exec"[14593] was attempted by "./syz-executor exec"[14591] [ 785.252752][T14602] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 785.272796][T14602] xt_nfacct: accounting object `syz1' does not exist [ 785.515464][T14607] [U]  [ 786.003269][T14620] openvswitch: netlink: Flow key attr not present in new flow. [ 787.586185][T14601] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 787.630245][T14636] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2285'. [ 787.695298][T14636] FAULT_INJECTION: forcing a failure. [ 787.695298][T14636] name failslab, interval 1, probability 0, space 0, times 0 [ 787.717489][T14636] CPU: 1 UID: 0 PID: 14636 Comm: syz.0.2285 Not tainted syzkaller #0 PREEMPT(full) [ 787.717518][T14636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 787.717530][T14636] Call Trace: [ 787.717537][T14636] [ 787.717545][T14636] dump_stack_lvl+0x16c/0x1f0 [ 787.717578][T14636] should_fail_ex+0x512/0x640 [ 787.717601][T14636] ? kmem_cache_alloc_node_noprof+0x65/0x770 [ 787.717636][T14636] should_failslab+0xc2/0x120 [ 787.717659][T14636] kmem_cache_alloc_node_noprof+0x78/0x770 [ 787.717688][T14636] ? __lock_acquire+0x622/0x1c90 [ 787.717716][T14636] ? __alloc_skb+0x2b2/0x380 [ 787.717744][T14636] ? __alloc_skb+0x2b2/0x380 [ 787.717765][T14636] __alloc_skb+0x2b2/0x380 [ 787.717788][T14636] ? __pfx___alloc_skb+0x10/0x10 [ 787.717823][T14636] netlink_ack+0x15d/0xb80 [ 787.717850][T14636] ? avc_has_perm_noaudit+0x149/0x3b0 [ 787.717882][T14636] netlink_rcv_skb+0x332/0x420 [ 787.717908][T14636] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 787.717932][T14636] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 787.717975][T14636] ? ns_capable+0xd7/0x110 [ 787.718001][T14636] nfnetlink_rcv+0x1b3/0x430 [ 787.718020][T14636] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 787.718046][T14636] ? netlink_deliver_tap+0x1ae/0xd30 [ 787.718075][T14636] netlink_unicast+0x5aa/0x870 [ 787.718106][T14636] ? __pfx_netlink_unicast+0x10/0x10 [ 787.718145][T14636] netlink_sendmsg+0x8c8/0xdd0 [ 787.718176][T14636] ? __pfx_netlink_sendmsg+0x10/0x10 [ 787.718217][T14636] ____sys_sendmsg+0xa98/0xc70 [ 787.718248][T14636] ? copy_msghdr_from_user+0x10a/0x160 [ 787.718275][T14636] ? __pfx_____sys_sendmsg+0x10/0x10 [ 787.718319][T14636] ___sys_sendmsg+0x134/0x1d0 [ 787.718346][T14636] ? __pfx____sys_sendmsg+0x10/0x10 [ 787.718369][T14636] ? __lock_acquire+0x622/0x1c90 [ 787.718436][T14636] __sys_sendmsg+0x16d/0x220 [ 787.718463][T14636] ? __pfx___sys_sendmsg+0x10/0x10 [ 787.718508][T14636] do_syscall_64+0xcd/0xfa0 [ 787.718539][T14636] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 787.718561][T14636] RIP: 0033:0x7f849a98efc9 [ 787.718578][T14636] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 787.718598][T14636] RSP: 002b:00007f849b827038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 787.718618][T14636] RAX: ffffffffffffffda RBX: 00007f849abe5fa0 RCX: 00007f849a98efc9 [ 787.718631][T14636] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000003 [ 787.718643][T14636] RBP: 00007f849b827090 R08: 0000000000000000 R09: 0000000000000000 [ 787.718655][T14636] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 787.718666][T14636] R13: 00007f849abe6038 R14: 00007f849abe5fa0 R15: 00007ffe10220338 [ 787.718694][T14636] [ 788.349444][T14649] netlink: 'syz.4.2290': attribute type 29 has an invalid length. [ 788.359178][T14649] netlink: 'syz.4.2290': attribute type 7 has an invalid length. [ 788.367938][T14649] netlink: 76 bytes leftover after parsing attributes in process `syz.4.2290'. [ 789.951577][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 789.951593][ T30] audit: type=1400 audit(1761654034.426:678): avc: denied { connect } for pid=14660 comm="syz.0.2294" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 790.548473][T14670] sg_write: data in/out 62844/1 bytes for SCSI command 0x1c-- guessing data in; [ 790.548473][T14670] program syz.4.2297 not setting count and/or reply_len properly [ 790.734200][ T977] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 790.756469][ T5884] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 790.992024][ T977] usb 2-1: Using ep0 maxpacket: 32 [ 790.997434][ T5884] usb 3-1: Using ep0 maxpacket: 32 [ 790.999561][T14679] FAULT_INJECTION: forcing a failure. [ 790.999561][T14679] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 791.006413][ T977] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 791.006518][ T5884] usb 3-1: config 0 has an invalid interface number: 48 but max is 0 [ 791.018426][T14679] CPU: 1 UID: 0 PID: 14679 Comm: syz.3.2300 Not tainted syzkaller #0 PREEMPT(full) [ 791.018453][T14679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 791.018465][T14679] Call Trace: [ 791.018472][T14679] [ 791.018480][T14679] dump_stack_lvl+0x16c/0x1f0 [ 791.018513][T14679] should_fail_ex+0x512/0x640 [ 791.018541][T14679] _copy_from_user+0x2e/0xd0 [ 791.018567][T14679] sg_write+0x2cc/0xe10 [ 791.018597][T14679] ? __pfx_sg_write+0x10/0x10 [ 791.018622][T14679] ? __pfx__kstrtoull+0x10/0x10 [ 791.018691][T14679] ? bpf_lsm_file_permission+0x9/0x10 [ 791.018712][T14679] ? security_file_permission+0x71/0x210 [ 791.018735][T14679] ? iov_iter_advance+0x1e3/0x6c0 [ 791.018758][T14679] ? rw_verify_area+0xcf/0x6c0 [ 791.018788][T14679] ? __pfx_sg_write+0x10/0x10 [ 791.018812][T14679] vfs_writev+0x5df/0xde0 [ 791.018853][T14679] ? __pfx_vfs_writev+0x10/0x10 [ 791.018901][T14679] ? __fget_files+0x20e/0x3c0 [ 791.018919][T14679] ? __fget_files+0x130/0x3c0 [ 791.018945][T14679] ? do_writev+0x132/0x340 [ 791.018971][T14679] do_writev+0x132/0x340 [ 791.018998][T14679] ? __pfx_do_writev+0x10/0x10 [ 791.019034][T14679] do_syscall_64+0xcd/0xfa0 [ 791.019065][T14679] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.019085][T14679] RIP: 0033:0x7f8648f8efc9 [ 791.019102][T14679] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 791.019121][T14679] RSP: 002b:00007f8649d97038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 791.019140][T14679] RAX: ffffffffffffffda RBX: 00007f86491e5fa0 RCX: 00007f8648f8efc9 [ 791.019154][T14679] RDX: 0000000000000002 RSI: 0000200000000400 RDI: 0000000000000003 [ 791.019166][T14679] RBP: 00007f8649d97090 R08: 0000000000000000 R09: 0000000000000000 [ 791.019178][T14679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 791.019190][T14679] R13: 00007f86491e6038 R14: 00007f86491e5fa0 R15: 00007ffce57c0df8 [ 791.019220][T14679] [ 791.301917][ T977] usb 2-1: config 0 has no interface number 0 [ 791.338842][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 791.359566][ T30] audit: type=1804 audit(1761654035.754:679): pid=14674 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.0.2299" name="/newroot/455/file0" dev="tmpfs" ino=2429 res=1 errno=0 [ 791.429760][ T977] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 791.440284][ T1189] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 791.458363][ T977] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.466547][ T977] usb 2-1: Product: syz [ 791.492451][ T977] usb 2-1: Manufacturer: syz [ 791.504279][ T977] usb 2-1: SerialNumber: syz [ 791.525873][ T977] usb 2-1: config 0 descriptor?? [ 791.533409][ T977] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 791.558421][ T5884] usb 3-1: config 0 has an invalid descriptor of length 102, skipping remainder of the config [ 791.569007][ T5884] usb 3-1: config 0 has no interface number 0 [ 791.575137][ T5884] usb 3-1: too many endpoints for config 0 interface 48 altsetting 120: 102, using maximum allowed: 30 [ 791.612789][ T1189] usb 5-1: Using ep0 maxpacket: 8 [ 791.618335][ T5884] usb 3-1: config 0 interface 48 altsetting 120 has 0 endpoint descriptors, different from the interface descriptor's value: 102 [ 791.650537][ T5884] usb 3-1: config 0 interface 48 has no altsetting 0 [ 791.661319][ T5884] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 791.678268][ T1189] usb 5-1: unable to get BOS descriptor or descriptor too short [ 791.681289][ T5884] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.695631][ T1189] usb 5-1: config 88 has an invalid interface number: 36 but max is 2 [ 791.715115][ T1189] usb 5-1: config 88 contains an unexpected descriptor of type 0x1, skipping [ 791.720616][ T5884] usb 3-1: config 0 descriptor?? [ 791.736726][ T1189] usb 5-1: config 88 contains an unexpected descriptor of type 0x1, skipping [ 791.783752][ T977] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 791.797465][ T977] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 791.820361][ T1189] usb 5-1: config 88 contains an unexpected descriptor of type 0x2, skipping [ 791.905151][ T1189] usb 5-1: config 88 has an invalid interface number: 99 but max is 2 [ 792.156791][ T1189] usb 5-1: config 88 contains an unexpected descriptor of type 0x1, skipping [ 792.157741][ T5884] usb 3-1: string descriptor 0 read error: -71 [ 792.195497][ T1189] usb 5-1: config 88 has an invalid interface number: 185 but max is 2 [ 792.196852][ T5884] hub 3-1:0.48: bad descriptor, ignoring hub [ 792.207042][ T1189] usb 5-1: config 88 contains an unexpected descriptor of type 0x1, skipping [ 792.220021][ T1189] usb 5-1: config 88 has no interface number 0 [ 792.302277][ T1189] usb 5-1: config 88 has no interface number 1 [ 792.308755][ T5884] hub 3-1:0.48: probe with driver hub failed with error -5 [ 792.357664][ T1189] usb 5-1: config 88 has no interface number 2 [ 792.385371][ T1189] usb 5-1: config 88 interface 36 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 792.426282][ T1189] usb 5-1: config 88 interface 36 altsetting 0 endpoint 0x6 has an invalid bInterval 194, changing to 11 [ 792.447230][ T1189] usb 5-1: config 88 interface 36 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 792.458547][ T1189] usb 5-1: config 88 interface 36 altsetting 0 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 792.470766][ T1189] usb 5-1: config 88 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 792.484027][ T1189] usb 5-1: config 88 interface 36 altsetting 0 endpoint 0x8 has an invalid bInterval 192, changing to 11 [ 792.495406][ T1189] usb 5-1: config 88 interface 36 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 792.502817][ T5884] usb 3-1: reset high-speed USB device number 72 using dummy_hcd [ 792.507753][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has a duplicate endpoint with address 0xD, skipping [ 792.547193][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 792.561015][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 792.572124][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 792.584283][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 792.595613][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has a duplicate endpoint with address 0x1, skipping [ 792.606508][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has a duplicate endpoint with address 0xD, skipping [ 792.651138][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 792.686524][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 792.714247][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has a duplicate endpoint with address 0xA, skipping [ 792.734270][ T977] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 792.734373][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has a duplicate endpoint with address 0xD, skipping [ 792.752814][ T1189] usb 5-1: config 88 interface 99 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 792.764225][ T1189] usb 5-1: config 88 interface 185 altsetting 9 has a duplicate endpoint with address 0x5, skipping [ 792.834086][ T1189] usb 5-1: config 88 interface 185 altsetting 9 has a duplicate endpoint with address 0x8, skipping [ 792.857447][ T1189] usb 5-1: config 88 interface 185 altsetting 9 has a duplicate endpoint with address 0x6, skipping [ 792.890171][ T1189] usb 5-1: config 88 interface 185 altsetting 9 has 4 endpoint descriptors, different from the interface descriptor's value: 6 [ 792.903446][ T1189] usb 5-1: config 88 interface 99 has no altsetting 0 [ 792.910316][ T1189] usb 5-1: config 88 interface 185 has no altsetting 0 [ 792.923557][ T1189] usb 5-1: string descriptor 0 read error: -22 [ 792.930173][ T1189] usb 5-1: New USB device found, idVendor=19d2, idProduct=0126, bcdDevice=ca.db [ 792.931795][ T977] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 792.939307][ T1189] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 792.961573][ T977] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 792.973160][ T977] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 792.987633][T14682] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 793.001051][ T977] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 793.010435][ T977] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 793.027236][ T5884] usb 3-1: failed to restore interface 48 altsetting 120 (error=-71) [ 793.033282][ T1189] option 5-1:88.36: GSM modem (1-port) converter detected [ 793.050201][ T977] usb 1-1: config 0 descriptor?? [ 793.067915][ T5884] usb 3-1: USB disconnect, device number 72 [ 793.092214][ T1189] option 5-1:88.99: GSM modem (1-port) converter detected [ 793.328356][ T9] usb 5-1: USB disconnect, device number 66 [ 793.346744][ T9] option 5-1:88.36: device disconnected [ 793.362137][ T9] option 5-1:88.99: device disconnected [ 793.399079][ C0] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 793.460750][ T5884] usb 2-1: USB disconnect, device number 61 [ 793.476960][ T5884] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 793.500694][ T5884] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 793.529210][ T5884] quatech2 2-1:0.51: device disconnected [ 793.547761][ T977] plantronics 0003:047F:FFFF.001E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 793.829997][T14694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 793.861022][T14694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 793.889958][T14705] netlink: 'syz.3.2308': attribute type 4 has an invalid length. [ 793.911767][ T5884] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 793.956897][ T977] usb 1-1: USB disconnect, device number 65 [ 794.081389][T14712] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2310'. [ 794.259632][ T5884] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 794.289742][T14713] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2312'. [ 794.300619][ T5884] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 794.319719][ T5884] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 794.330407][ T5884] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 794.345588][ T5884] usb 2-1: config 0 descriptor?? [ 794.730078][T14721] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2314'. [ 794.739658][T14721] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 795.156984][ T5884] cm6533_jd 0003:0D8C:0022.001F: unknown main item tag 0x0 [ 795.324958][ T5884] cm6533_jd 0003:0D8C:0022.001F: unknown main item tag 0x0 [ 795.344868][ T5884] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0D8C:0022.001F/input/input53 [ 795.410345][ T5884] cm6533_jd 0003:0D8C:0022.001F: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 795.460529][ T5884] usb 2-1: USB disconnect, device number 62 [ 795.493956][ T42] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 795.691330][T14736] netlink: 'syz.2.2317': attribute type 21 has an invalid length. [ 795.699446][T14736] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2317'. [ 795.708777][ T42] usb 1-1: device descriptor read/64, error -71 [ 795.715340][T14736] netlink: 'syz.2.2317': attribute type 4 has an invalid length. [ 795.750277][T14736] netlink: 3 bytes leftover after parsing attributes in process `syz.2.2317'. [ 795.861041][T14736] batadv1: entered promiscuous mode [ 795.870172][T14736] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 795.975107][ T42] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 796.048758][T14732] fido_id[14732]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 796.147635][ T42] usb 1-1: device descriptor read/64, error -71 [ 796.286239][ T42] usb usb1-port1: attempt power cycle [ 796.452929][T14750] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 796.463935][T14750] xt_nfacct: accounting object `syz1' does not exist [ 796.713633][ T42] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 796.744423][ T42] usb 1-1: device descriptor read/8, error -71 [ 796.904878][T14757] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 796.917113][T14757] xt_nfacct: accounting object `syz1' does not exist [ 797.065871][ T42] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 797.408633][ T42] usb 1-1: device descriptor read/8, error -71 [ 797.539032][ T42] usb usb1-port1: unable to enumerate USB device [ 798.624380][ T30] audit: type=1326 audit(1761654042.532:680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14772 comm="syz.3.2326" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8648f8efc9 code=0x7ffc0000 [ 798.744946][ T30] audit: type=1326 audit(1761654042.532:681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14772 comm="syz.3.2326" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8648f8efc9 code=0x7ffc0000 [ 798.980585][ T30] audit: type=1326 audit(1761654042.579:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14772 comm="syz.3.2326" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f8648f8efc9 code=0x7ffc0000 [ 799.045252][ T30] audit: type=1326 audit(1761654042.579:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14772 comm="syz.3.2326" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8648f8efc9 code=0x7ffc0000 [ 799.328179][T14783] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 799.337108][T14783] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 799.348750][T14783] overlayfs: missing 'lowerdir' [ 799.411293][T14784] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2328'. [ 799.653569][ T30] audit: type=1326 audit(1761654042.579:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14772 comm="syz.3.2326" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8648f8efc9 code=0x7ffc0000 [ 799.677128][ T30] audit: type=1326 audit(1761654042.579:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14772 comm="syz.3.2326" exe="/root/syz-executor" sig=0 arch=c000003e syscall=7 compat=0 ip=0x7f8648f8efc9 code=0x7ffc0000 [ 799.797748][ T30] audit: type=1326 audit(1761654042.607:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14772 comm="syz.3.2326" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8648f8efc9 code=0x7ffc0000 [ 800.479048][ T30] audit: type=1326 audit(1761654042.607:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14772 comm="syz.3.2326" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f8648f8efc9 code=0x7ffc0000 [ 800.502574][ T30] audit: type=1326 audit(1761654042.607:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14772 comm="syz.3.2326" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8648f8efc9 code=0x7ffc0000 [ 800.526113][ T30] audit: type=1326 audit(1761654042.607:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14772 comm="syz.3.2326" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f8648f8efc9 code=0x7ffc0000 [ 801.557736][ T1189] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 801.719887][ T1189] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 801.741878][ T1189] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 801.761048][ T1189] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 801.782742][ T1189] usb 4-1: config 0 descriptor?? [ 801.815048][ T1189] pwc: Askey VC010 type 2 USB webcam detected. [ 801.890644][T14831] ip6t_srh: unknown srh invflags 4000 [ 802.859282][ T1189] pwc: recv_control_msg error -32 req 02 val 2b00 [ 802.907245][ T1189] pwc: recv_control_msg error -32 req 02 val 2700 [ 802.917068][ T1189] pwc: recv_control_msg error -32 req 02 val 2c00 [ 802.924053][ T1189] pwc: recv_control_msg error -32 req 04 val 1000 [ 802.970402][ T1189] pwc: recv_control_msg error -32 req 04 val 1300 [ 802.981732][ T1189] pwc: recv_control_msg error -32 req 04 val 1400 [ 802.988737][ T1189] pwc: recv_control_msg error -32 req 02 val 2000 [ 802.997125][ T1189] pwc: recv_control_msg error -32 req 02 val 2100 [ 803.005113][ T1189] pwc: recv_control_msg error -32 req 04 val 1500 [ 803.028452][ T1189] pwc: recv_control_msg error -32 req 02 val 2500 [ 803.077557][T14844] fuse: Unknown parameter 'fd0x0000000000000003' [ 803.269184][ T1189] pwc: recv_control_msg error -71 req 02 val 2600 [ 803.304631][ T1189] pwc: recv_control_msg error -71 req 02 val 2900 [ 803.377313][ T1189] pwc: recv_control_msg error -71 req 02 val 2800 [ 803.403401][ T1189] pwc: recv_control_msg error -71 req 04 val 1100 [ 803.558138][ T1189] pwc: recv_control_msg error -71 req 04 val 1200 [ 803.569067][ T1189] pwc: Registered as video103. [ 803.585050][ T1189] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input54 [ 803.851610][T14849] ptrace attach of "./syz-executor exec"[14855] was attempted by "./syz-executor exec"[14849] [ 803.972991][T14856] ptrace attach of "./syz-executor exec"[14854] was attempted by "./syz-executor exec"[14856] [ 804.612029][ T1189] usb 4-1: USB disconnect, device number 61 [ 804.967315][T14866] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2352'. [ 805.412770][T14871] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2350'. [ 805.519023][T14871] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2350'. [ 805.551240][T14871] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2350'. [ 805.715998][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 805.716016][ T30] audit: type=1400 audit(1761654049.171:748): avc: denied { unmount } for pid=5809 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 805.783816][T14886] netlink: 'syz.2.2354': attribute type 1 has an invalid length. [ 806.144148][T14886] 8021q: adding VLAN 0 to HW filter on device bond2 [ 806.158612][ T30] audit: type=1400 audit(1761654049.236:749): avc: denied { map } for pid=14877 comm="syz.3.2356" path="socket:[46723]" dev="sockfs" ino=46723 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 806.182910][ T30] audit: type=1400 audit(1761654049.236:750): avc: denied { read accept } for pid=14877 comm="syz.3.2356" path="socket:[46723]" dev="sockfs" ino=46723 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 806.424325][T14898] binder: 14877:14898 ioctl c018620c 2000000002c0 returned -1 [ 807.073771][T14889] bond2: (slave veth7): Enslaving as an active interface with a down link [ 807.107030][T14908] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 807.126629][T14897] binder: 14882:14897 ioctl c0306201 2000000003c0 returned -14 [ 807.163770][T14907] xt_nfacct: accounting object `syz1' does not exist [ 807.183090][T14883] SELinux: failed to load policy [ 807.207421][ T5884] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 807.245729][T14911] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 807.410566][ T5884] usb 5-1: Using ep0 maxpacket: 32 [ 807.424925][ T5884] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 807.433253][ T5884] usb 5-1: config 0 has no interface number 0 [ 807.441764][ T5884] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 807.561835][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 807.569367][ T1189] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 807.612589][ T5884] usb 5-1: Product: syz [ 807.616853][ T5884] usb 5-1: Manufacturer: syz [ 807.621546][ T5884] usb 5-1: SerialNumber: syz [ 807.686727][ T5884] usb 5-1: config 0 descriptor?? [ 807.718925][ T5884] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 807.739594][ T1189] usb 2-1: Using ep0 maxpacket: 16 [ 807.745540][ T1189] usb 2-1: too many configurations: 112, using maximum allowed: 8 [ 807.851988][ T1189] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 807.864354][ T1189] usb 2-1: can't read configurations, error -61 [ 807.980681][ T5884] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 808.044400][ T1189] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 808.220900][ T1189] usb 2-1: Using ep0 maxpacket: 16 [ 808.232275][ T1189] usb 2-1: too many configurations: 112, using maximum allowed: 8 [ 808.257210][ T1189] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 808.268455][ T1189] usb 2-1: can't read configurations, error -61 [ 808.422165][ T1189] usb usb2-port1: attempt power cycle [ 808.422911][ T5884] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 809.236570][ T1189] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 809.321051][ T1189] usb 2-1: Using ep0 maxpacket: 16 [ 809.335392][ T1189] usb 2-1: too many configurations: 112, using maximum allowed: 8 [ 809.347256][ T1189] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 809.363358][ T1189] usb 2-1: can't read configurations, error -61 [ 809.502437][ C0] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 809.504461][ T24] usb 5-1: USB disconnect, device number 67 [ 809.559700][ T1189] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 809.575086][ T24] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 809.603094][ T1189] usb 2-1: Using ep0 maxpacket: 16 [ 809.608867][ T1189] usb 2-1: too many configurations: 112, using maximum allowed: 8 [ 809.619569][ T24] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 809.631378][ T1189] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 809.639026][ T1189] usb 2-1: can't read configurations, error -61 [ 809.701400][ T24] quatech2 5-1:0.51: device disconnected [ 809.710429][ T1189] usb usb2-port1: unable to enumerate USB device [ 809.951868][T14934] netlink: 'syz.0.2368': attribute type 2 has an invalid length. [ 810.395066][T14941] bond0: Caught tx_queue_len zero misconfig [ 810.519843][T14940] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2371'. [ 811.028959][T14953] fuse: Bad value for 'fd' [ 811.036577][T14953] 9pnet_fd: Insufficient options for proto=fd [ 811.042776][ T5884] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 811.215426][ T5884] usb 4-1: Using ep0 maxpacket: 32 [ 811.353353][ T5884] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 811.406808][ T5884] usb 4-1: config 0 has no interface number 0 [ 811.468548][ T5884] usb 4-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 811.515104][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.554348][ T5884] usb 4-1: Product: syz [ 811.573333][ T5884] usb 4-1: Manufacturer: syz [ 811.578032][ T5884] usb 4-1: SerialNumber: syz [ 811.587456][ T5884] usb 4-1: config 0 descriptor?? [ 811.599487][ T5884] hub 4-1:0.89: bad descriptor, ignoring hub [ 811.605951][ T5884] hub 4-1:0.89: probe with driver hub failed with error -5 [ 811.617983][ T5884] option 4-1:0.89: GSM modem (1-port) converter detected [ 811.737646][ T5884] usb 4-1: GSM modem (1-port) converter now attached to ttyUSB0 [ 811.926336][T14969] overlayfs: failed to resolve './bus': -2 [ 811.986160][T14970] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14970 comm=syz.2.2377 [ 812.396817][ T24] usb 4-1: USB disconnect, device number 62 [ 812.412216][T14973] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2378'. [ 812.420241][ T24] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0 [ 812.432231][ T24] option 4-1:0.89: device disconnected [ 812.478919][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 812.486143][ C0] bridge0: topology change detected, propagating [ 812.492794][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 812.500007][ C0] bridge0: topology change detected, propagating [ 812.700501][ T30] audit: type=1400 audit(1761654055.707:751): avc: denied { setopt } for pid=14975 comm="syz.2.2379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 812.731239][T14976] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2379'. [ 814.210075][ T5884] usb 4-1: new full-speed USB device number 63 using dummy_hcd [ 814.498173][ T5884] usb 4-1: device descriptor read/64, error -71 [ 814.548440][T15001] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 814.556510][T15001] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 814.565053][T15001] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 814.572756][T15001] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 814.585149][ T30] audit: type=1400 audit(1761654057.436:752): avc: denied { create } for pid=15000 comm="syz.2.2387" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 814.955369][T15007] dvmrp0: entered allmulticast mode [ 815.362131][ T5884] usb 4-1: new full-speed USB device number 64 using dummy_hcd [ 815.375944][ T30] audit: type=1400 audit(1761654058.203:753): avc: denied { unlink } for pid=5812 comm="syz-executor" name="file0" dev="tmpfs" ino=2633 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 815.500698][ T1189] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 815.547065][ T5884] usb 4-1: device descriptor read/64, error -71 [ 815.646059][T15011] netlink: 'syz.2.2390': attribute type 8 has an invalid length. [ 815.838058][ T5884] usb usb4-port1: attempt power cycle [ 815.877659][ T1189] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 816.015377][ T1189] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 816.056992][ T1189] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 816.111615][ T1189] usb 1-1: config 0 descriptor?? [ 816.132219][ T1189] pwc: Askey VC010 type 2 USB webcam detected. [ 816.231745][ T5884] usb 4-1: new full-speed USB device number 65 using dummy_hcd [ 816.298160][ T5884] usb 4-1: device descriptor read/8, error -71 [ 816.613326][ T977] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 816.659254][ T9] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 816.661051][T15020] FAULT_INJECTION: forcing a failure. [ 816.661051][T15020] name failslab, interval 1, probability 0, space 0, times 0 [ 816.684079][T15020] CPU: 0 UID: 0 PID: 15020 Comm: syz.3.2395 Not tainted syzkaller #0 PREEMPT(full) [ 816.684108][T15020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 816.684118][T15020] Call Trace: [ 816.684125][T15020] [ 816.684133][T15020] dump_stack_lvl+0x16c/0x1f0 [ 816.684165][T15020] should_fail_ex+0x512/0x640 [ 816.684189][T15020] ? __kmalloc_cache_noprof+0x5f/0x780 [ 816.684221][T15020] should_failslab+0xc2/0x120 [ 816.684244][T15020] __kmalloc_cache_noprof+0x72/0x780 [ 816.684273][T15020] ? flow_indr_dev_setup_offload+0x27f/0x8d0 [ 816.684299][T15020] ? __lock_acquire+0xb8a/0x1c90 [ 816.684330][T15020] ? __pfx_tc_block_indr_cleanup+0x10/0x10 [ 816.684358][T15020] ? flow_indr_dev_setup_offload+0x27f/0x8d0 [ 816.684380][T15020] flow_indr_dev_setup_offload+0x27f/0x8d0 [ 816.684409][T15020] tcf_block_offload_cmd.isra.0+0x2c6/0x310 [ 816.684437][T15020] ? __pfx_tcf_block_offload_cmd.isra.0+0x10/0x10 [ 816.684475][T15020] ? __pfx_down_write+0x10/0x10 [ 816.684502][T15020] tcf_block_get_ext+0x7d9/0x1800 [ 816.684535][T15020] tcf_block_get+0xa8/0x100 [ 816.684559][T15020] ? __pfx_tcf_block_get+0x10/0x10 [ 816.684586][T15020] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 816.684615][T15020] ? __pfx_prio_init+0x10/0x10 [ 816.684642][T15020] prio_init+0x3b/0x80 [ 816.684666][T15020] ? __pfx_prio_init+0x10/0x10 [ 816.684692][T15020] qdisc_create+0x457/0xfc0 [ 816.684717][T15020] tc_modify_qdisc+0x11d8/0x2170 [ 816.684740][T15020] ? rcu_is_watching+0x12/0xc0 [ 816.684778][T15020] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 816.684827][T15020] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 816.684849][T15020] rtnetlink_rcv_msg+0x3c9/0xe90 [ 816.684881][T15020] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 816.684907][T15020] ? __lock_acquire+0xb8a/0x1c90 [ 816.684952][T15020] netlink_rcv_skb+0x158/0x420 [ 816.684980][T15020] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 816.685009][T15020] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 816.685035][T15020] ? rcu_is_watching+0x12/0xc0 [ 816.685082][T15020] netlink_unicast+0x5aa/0x870 [ 816.685115][T15020] ? __pfx_netlink_unicast+0x10/0x10 [ 816.685156][T15020] netlink_sendmsg+0x8c8/0xdd0 [ 816.685189][T15020] ? __pfx_netlink_sendmsg+0x10/0x10 [ 816.685231][T15020] ____sys_sendmsg+0xa98/0xc70 [ 816.685263][T15020] ? copy_msghdr_from_user+0x10a/0x160 [ 816.685289][T15020] ? __pfx_____sys_sendmsg+0x10/0x10 [ 816.685335][T15020] ___sys_sendmsg+0x134/0x1d0 [ 816.685363][T15020] ? __pfx____sys_sendmsg+0x10/0x10 [ 816.685386][T15020] ? __lock_acquire+0x622/0x1c90 [ 816.685455][T15020] __sys_sendmsg+0x16d/0x220 [ 816.685480][T15020] ? __pfx___sys_sendmsg+0x10/0x10 [ 816.685518][T15020] ? __pfx_handle_softirqs+0x10/0x10 [ 816.685551][T15020] do_syscall_64+0xcd/0xfa0 [ 816.685583][T15020] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 816.685605][T15020] RIP: 0033:0x7f8648f8efc9 [ 816.685622][T15020] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 816.685641][T15020] RSP: 002b:00007f8649d97038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 816.685661][T15020] RAX: ffffffffffffffda RBX: 00007f86491e5fa0 RCX: 00007f8648f8efc9 [ 816.685674][T15020] RDX: 0000000020004000 RSI: 0000200000000000 RDI: 0000000000000003 [ 816.685686][T15020] RBP: 00007f8649d97090 R08: 0000000000000000 R09: 0000000000000000 [ 816.685697][T15020] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 816.685709][T15020] R13: 00007f86491e6038 R14: 00007f86491e5fa0 R15: 00007ffce57c0df8 [ 816.685741][T15020] [ 816.688596][ T1189] pwc: recv_control_msg error -32 req 02 val 2b00 [ 816.819720][ T977] usb 3-1: Using ep0 maxpacket: 32 [ 816.885194][ T1189] pwc: recv_control_msg error -32 req 02 val 2700 [ 816.887070][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 816.895474][T15026] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2397'. [ 816.898195][ T9] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 816.950355][ T1189] pwc: recv_control_msg error -32 req 02 val 2c00 [ 816.954498][ T977] usb 3-1: config 0 interface 0 has no altsetting 0 [ 816.988657][ T1189] pwc: recv_control_msg error -32 req 04 val 1000 [ 817.000214][ T9] usb 5-1: config 0 has no interface number 0 [ 817.017261][ T1189] pwc: recv_control_msg error -32 req 04 val 1300 [ 817.023796][ T977] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 817.054479][ T1189] pwc: recv_control_msg error -32 req 04 val 1400 [ 817.057703][ T977] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 817.065261][ T1189] pwc: recv_control_msg error -32 req 02 val 2000 [ 817.072089][ T9] usb 5-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 817.140604][ T24] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 817.142402][ T977] usb 3-1: Product: syz [ 817.162611][ T977] usb 3-1: Manufacturer: syz [ 817.163119][ T1189] pwc: recv_control_msg error -32 req 02 val 2100 [ 817.167202][ T977] usb 3-1: SerialNumber: syz [ 817.168466][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 817.187127][ T977] usb 3-1: config 0 descriptor?? [ 817.187419][ T1189] pwc: recv_control_msg error -32 req 04 val 1500 [ 817.192667][ T9] usb 5-1: Product: syz [ 817.203464][ T9] usb 5-1: Manufacturer: syz [ 817.205486][ T1189] pwc: recv_control_msg error -32 req 02 val 2500 [ 817.209295][ T9] usb 5-1: SerialNumber: syz [ 817.222245][ T1189] pwc: recv_control_msg error -32 req 02 val 2400 [ 817.223101][ T9] usb 5-1: config 0 descriptor?? [ 817.391474][ T9] hub 5-1:0.89: bad descriptor, ignoring hub [ 817.397717][ T9] hub 5-1:0.89: probe with driver hub failed with error -5 [ 817.399023][ T24] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 817.406715][ T9] option 5-1:0.89: GSM modem (1-port) converter detected [ 817.413721][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 817.424325][ T9] usb 5-1: GSM modem (1-port) converter now attached to ttyUSB0 [ 817.435837][ T24] usb 2-1: config 0 has no interface number 0 [ 817.926157][ T24] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 817.936102][ T24] usb 2-1: config 0 interface 117 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 817.952419][ T1189] pwc: recv_control_msg error -71 req 02 val 2900 [ 817.960178][ T977] gs_usb 3-1:0.0: Configuring for 1 interfaces [ 817.962022][ T24] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 817.976141][ T1189] pwc: recv_control_msg error -71 req 02 val 2800 [ 817.983656][ T1189] pwc: recv_control_msg error -71 req 04 val 1100 [ 817.993260][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 818.001497][ T1189] pwc: recv_control_msg error -71 req 04 val 1200 [ 818.071683][ T24] usb 2-1: Product: syz [ 818.075877][ T24] usb 2-1: Manufacturer: syz [ 818.093662][ T1189] pwc: Registered as video103. [ 818.099882][ T24] usb 2-1: SerialNumber: syz [ 818.111283][ T1189] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input55 [ 818.130503][ T24] usb 2-1: config 0 descriptor?? [ 818.188845][ T42] usb 5-1: USB disconnect, device number 68 [ 818.289718][ T1189] usb 1-1: USB disconnect, device number 70 [ 818.301651][ T42] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0 [ 818.801236][ T42] option 5-1:0.89: device disconnected [ 818.829467][ T977] usb 3-1: USB disconnect, device number 73 [ 819.288988][T15044] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2401'. [ 820.124496][ T1189] usb 2-1: USB disconnect, device number 67 [ 820.150065][T15054] bridge_slave_0: left allmulticast mode [ 820.155740][T15054] bridge_slave_0: left promiscuous mode [ 820.198657][T15054] bridge0: port 1(bridge_slave_0) entered disabled state [ 820.291869][T15054] bridge_slave_1: left allmulticast mode [ 820.401402][T15054] bridge_slave_1: left promiscuous mode [ 820.473475][T15065] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 820.482257][T15065] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 820.493866][T15065] overlayfs: missing 'lowerdir' [ 820.731153][T15054] bridge0: port 2(bridge_slave_1) entered disabled state [ 820.846880][ T30] audit: type=1326 audit(1761654063.289:754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15052 comm="syz.2.2404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f3913d85e67 code=0x7ffc0000 [ 821.070970][T15054] bond0: (slave bond_slave_0): Releasing backup interface [ 821.084038][ T30] audit: type=1326 audit(1761654063.289:755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15052 comm="syz.2.2404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f3913d2b099 code=0x7ffc0000 [ 821.112935][T15070] usb usb8: usbfs: process 15070 (syz.3.2405) did not claim interface 0 before use [ 821.149709][T15054] bond_slave_0: left promiscuous mode [ 821.156574][T15070] usb usb8: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 821.191213][ T30] audit: type=1326 audit(1761654063.289:756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15052 comm="syz.2.2404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3913d8efc9 code=0x7ffc0000 [ 821.220306][ T30] audit: type=1326 audit(1761654063.289:757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15052 comm="syz.2.2404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f3913d85e67 code=0x7ffc0000 [ 821.222838][T15054] team0: Port device team_slave_0 removed [ 821.247564][ T30] audit: type=1326 audit(1761654063.289:758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15052 comm="syz.2.2404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f3913d2b099 code=0x7ffc0000 [ 821.339149][ T30] audit: type=1326 audit(1761654063.289:759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15052 comm="syz.2.2404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=50 compat=0 ip=0x7f3913d8efc9 code=0x7ffc0000 [ 821.380445][T15054] team0: Port device team_slave_1 removed [ 821.392893][T15054] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 821.402195][ T30] audit: type=1326 audit(1761654063.289:760): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15052 comm="syz.2.2404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f3913d85e67 code=0x7ffc0000 [ 821.426049][T15054] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 821.437651][T15054] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 821.445551][ T30] audit: type=1326 audit(1761654063.289:761): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15052 comm="syz.2.2404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f3913d2b099 code=0x7ffc0000 [ 821.461497][T15054] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 821.471494][ T30] audit: type=1326 audit(1761654063.289:762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15052 comm="syz.2.2404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3913d8efc9 code=0x7ffc0000 [ 821.506671][T15054] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 821.506735][ T30] audit: type=1326 audit(1761654063.289:763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15052 comm="syz.2.2404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f3913d85e67 code=0x7ffc0000 [ 821.673720][T15067] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2406'. [ 822.290601][T15083] syz_tun: entered allmulticast mode [ 822.346316][T15075] syz_tun: left allmulticast mode [ 823.220946][T15099] netlink: 'syz.3.2415': attribute type 26 has an invalid length. [ 823.389250][T15104] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2416'. [ 823.398850][T15104] netlink: 'syz.0.2416': attribute type 20 has an invalid length. [ 823.406784][T15104] netlink: 'syz.0.2416': attribute type 21 has an invalid length. [ 823.581574][T15107] input: syz1 as /devices/virtual/input/input57 [ 823.882778][T15111] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 823.891543][T15111] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 823.903122][T15111] overlayfs: missing 'lowerdir' [ 823.916937][T15111] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2417'. [ 825.453642][T15121] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2420'. [ 827.088851][T15137] netlink: 'syz.0.2425': attribute type 10 has an invalid length. [ 827.134727][T15137] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 827.247531][ T977] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 827.385846][T15142] ptrace attach of "./syz-executor exec"[15146] was attempted by "./syz-executor exec"[15142] [ 827.429312][ T977] usb 3-1: Using ep0 maxpacket: 8 [ 828.050198][ T977] usb 3-1: config 0 has an invalid interface number: 96 but max is 0 [ 828.058343][ T977] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 828.070659][ T977] usb 3-1: config 0 has no interface number 0 [ 828.079244][ T977] usb 3-1: config 0 interface 96 altsetting 3 endpoint 0x88 has invalid wMaxPacketSize 0 [ 828.091756][ T977] usb 3-1: config 0 interface 96 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 828.115074][ T977] usb 3-1: config 0 interface 96 has no altsetting 0 [ 828.126550][ T977] usb 3-1: New USB device found, idVendor=0b57, idProduct=2a8d, bcdDevice=e6.eb [ 828.135814][ T977] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 828.143781][ T977] usb 3-1: Product: syz [ 828.148348][ T977] usb 3-1: Manufacturer: syz [ 828.154920][ T977] usb 3-1: SerialNumber: syz [ 828.166053][ T977] usb 3-1: config 0 descriptor?? [ 828.176037][T15137] 8021q: adding VLAN 0 to HW filter on device bond4 [ 828.176191][ T977] usbhid 3-1:0.96: couldn't find an input interrupt endpoint [ 828.245779][T15148] bond_slave_0: entered promiscuous mode [ 828.251450][T15148] bond_slave_1: entered promiscuous mode [ 828.257188][T15148] syz_tun: entered promiscuous mode [ 828.292165][T15148] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 828.372352][T15148] bond4: (slave macvlan2): unknown ethtool speed (30000) for port 1 (set it to 0) [ 828.402729][T15148] bond4: (slave macvlan2): speed changed to 0 on port 1 [ 828.403447][T15135] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 828.446801][T15135] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 828.461865][T15148] bond4: (slave macvlan2): Enslaving as a backup interface with an up link [ 828.490456][ T977] usb 3-1: USB disconnect, device number 74 [ 829.593988][T15166] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2433'. [ 829.721447][T15168] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 829.855184][T15171] xt_hashlimit: size too large, truncated to 1048576 [ 829.921304][ T42] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 830.381917][ T42] usb 3-1: device descriptor read/64, error -71 [ 830.651270][ T42] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 830.852476][ T42] usb 3-1: device descriptor read/64, error -71 [ 830.979434][ T42] usb usb3-port1: attempt power cycle [ 831.062588][T15194] overlayfs: conflicting lowerdir path [ 831.097071][T15193] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 831.127947][ T977] ================================================================== [ 831.136013][ T977] BUG: KASAN: slab-use-after-free in br_switchdev_fdb_populate+0x390/0x3a0 [ 831.144577][ T977] Read of size 8 at addr ffff888025122808 by task kworker/0:2/977 [ 831.152348][ T977] [ 831.154648][ T977] CPU: 0 UID: 0 PID: 977 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 831.154663][ T977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 831.154672][ T977] Workqueue: events_long br_fdb_cleanup [ 831.154689][ T977] Call Trace: [ 831.154694][ T977] [ 831.154700][ T977] dump_stack_lvl+0x116/0x1f0 [ 831.154717][ T977] print_report+0xcd/0x630 [ 831.154730][ T977] ? __virt_addr_valid+0x81/0x610 [ 831.154746][ T977] ? __phys_addr+0xe8/0x180 [ 831.154760][ T977] ? br_switchdev_fdb_populate+0x390/0x3a0 [ 831.154771][ T977] kasan_report+0xe0/0x110 [ 831.154783][ T977] ? br_switchdev_fdb_populate+0x390/0x3a0 [ 831.154800][ T977] br_switchdev_fdb_populate+0x390/0x3a0 [ 831.154813][ T977] br_switchdev_fdb_notify+0x1df/0x2c0 [ 831.154826][ T977] ? __pfx_br_switchdev_fdb_notify+0x10/0x10 [ 831.154839][ T977] ? kasan_save_stack+0x33/0x60 [ 831.154850][ T977] ? find_held_lock+0x2b/0x80 [ 831.154865][ T977] fdb_notify+0x16c/0x1a0 [ 831.154877][ T977] fdb_delete+0x76e/0x12a0 [ 831.154892][ T977] br_fdb_cleanup+0x43e/0x600 [ 831.154906][ T977] process_one_work+0x9cf/0x1b70 [ 831.154921][ T977] ? __pfx_process_one_work+0x10/0x10 [ 831.154935][ T977] ? assign_work+0x1a0/0x250 [ 831.154946][ T977] worker_thread+0x6c8/0xf10 [ 831.154960][ T977] ? __kthread_parkme+0x19e/0x250 [ 831.154975][ T977] ? __pfx_worker_thread+0x10/0x10 [ 831.154987][ T977] kthread+0x3c5/0x780 [ 831.154998][ T977] ? __pfx_kthread+0x10/0x10 [ 831.155008][ T977] ? rcu_is_watching+0x12/0xc0 [ 831.155022][ T977] ? __pfx_kthread+0x10/0x10 [ 831.155033][ T977] ret_from_fork+0x675/0x7d0 [ 831.155043][ T977] ? __pfx_kthread+0x10/0x10 [ 831.155053][ T977] ret_from_fork_asm+0x1a/0x30 [ 831.155073][ T977] [ 831.155077][ T977] [ 831.326306][ T977] Allocated by task 5810: [ 831.330603][ T977] kasan_save_stack+0x33/0x60 [ 831.335253][ T977] kasan_save_track+0x14/0x30 [ 831.339903][ T977] __kasan_kmalloc+0xaa/0xb0 [ 831.344462][ T977] br_add_if+0x41d/0x1b70 [ 831.348771][ T977] do_set_master+0x40f/0x730 [ 831.353336][ T977] do_setlink.constprop.0+0xbd8/0x4380 [ 831.358767][ T977] rtnl_newlink+0x1446/0x2000 [ 831.363419][ T977] rtnetlink_rcv_msg+0x95e/0xe90 [ 831.368327][ T977] netlink_rcv_skb+0x158/0x420 [ 831.373064][ T977] netlink_unicast+0x5aa/0x870 [ 831.377801][ T977] netlink_sendmsg+0x8c8/0xdd0 [ 831.382535][ T977] __sys_sendto+0x4a3/0x520 [ 831.387006][ T977] __x64_sys_sendto+0xe0/0x1c0 [ 831.391740][ T977] do_syscall_64+0xcd/0xfa0 [ 831.396219][ T977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.397415][ T42] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 831.402083][ T977] [ 831.402090][ T977] Freed by task 15061: [ 831.415927][ T977] kasan_save_stack+0x33/0x60 [ 831.420575][ T977] kasan_save_track+0x14/0x30 [ 831.425219][ T977] __kasan_save_free_info+0x3b/0x60 [ 831.430389][ T977] __kasan_slab_free+0x5f/0x80 [ 831.435120][ T977] kfree+0x2b8/0x6d0 [ 831.438984][ T977] kobject_put+0x1e7/0x5a0 [ 831.443367][ T977] rcu_core+0x79c/0x1530 [ 831.447579][ T977] handle_softirqs+0x219/0x8e0 [ 831.452323][ T977] __irq_exit_rcu+0x109/0x170 [ 831.456973][ T977] irq_exit_rcu+0x9/0x30 [ 831.461187][ T977] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 831.466801][ T977] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 831.472775][ T977] [ 831.475070][ T977] Last potentially related work creation: [ 831.480753][ T977] kasan_save_stack+0x33/0x60 [ 831.485404][ T977] kasan_record_aux_stack+0xa7/0xc0 [ 831.490575][ T977] __call_rcu_common.constprop.0+0xa5/0xa10 [ 831.496437][ T977] br_del_if+0xe0/0x270 [ 831.500568][ T977] do_set_master+0x172/0x730 [ 831.505130][ T977] do_setlink.constprop.0+0xbd8/0x4380 [ 831.510562][ T977] rtnl_newlink+0x18e0/0x2000 [ 831.515210][ T977] rtnetlink_rcv_msg+0x95e/0xe90 [ 831.520119][ T977] netlink_rcv_skb+0x158/0x420 [ 831.524855][ T977] netlink_unicast+0x5aa/0x870 [ 831.529590][ T977] netlink_sendmsg+0x8c8/0xdd0 [ 831.534326][ T977] ____sys_sendmsg+0xa98/0xc70 [ 831.539065][ T977] ___sys_sendmsg+0x134/0x1d0 [ 831.543714][ T977] __sys_sendmsg+0x16d/0x220 [ 831.548272][ T977] do_syscall_64+0xcd/0xfa0 [ 831.552751][ T977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.558617][ T977] [ 831.560915][ T977] The buggy address belongs to the object at ffff888025122800 [ 831.560915][ T977] which belongs to the cache kmalloc-1k of size 1024 [ 831.574934][ T977] The buggy address is located 8 bytes inside of [ 831.574934][ T977] freed 1024-byte region [ffff888025122800, ffff888025122c00) [ 831.588613][ T977] [ 831.590910][ T977] The buggy address belongs to the physical page: [ 831.597295][ T977] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888025125800 pfn:0x25120 [ 831.607324][ T977] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 831.615789][ T977] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 831.624258][ T977] page_type: f5(slab) [ 831.628207][ T977] raw: 00fff00000000240 ffff88813ffa6dc0 ffffea0001ee1810 ffffea0000c8c210 [ 831.636762][ T977] raw: ffff888025125800 000000000010000e 00000000f5000000 0000000000000000 [ 831.645315][ T977] head: 00fff00000000240 ffff88813ffa6dc0 ffffea0001ee1810 ffffea0000c8c210 [ 831.653952][ T977] head: ffff888025125800 000000000010000e 00000000f5000000 0000000000000000 [ 831.662593][ T977] head: 00fff00000000003 ffffea0000944801 00000000ffffffff 00000000ffffffff [ 831.671235][ T977] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 831.679879][ T977] page dumped because: kasan: bad access detected [ 831.686263][ T977] page_owner tracks the page as allocated [ 831.691945][ T977] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5807, tgid 5807 (syz-executor), ts 72613372336, free_ts 72596370994 [ 831.713290][ T977] post_alloc_hook+0x1c0/0x230 [ 831.718038][ T977] get_page_from_freelist+0x10a3/0x3a30 [ 831.723571][ T977] __alloc_frozen_pages_noprof+0x25f/0x2470 [ 831.729438][ T977] alloc_pages_mpol+0x1fb/0x550 [ 831.734259][ T977] new_slab+0x24a/0x360 [ 831.738388][ T977] ___slab_alloc+0xdae/0x1a60 [ 831.743037][ T977] __slab_alloc.constprop.0+0x63/0x110 [ 831.748468][ T977] __kmalloc_noprof+0x501/0x880 [ 831.753291][ T977] __alloc_workqueue+0x112/0x1810 [ 831.758292][ T977] alloc_workqueue_noprof+0xd2/0x200 [ 831.763549][ T977] wg_newlink+0x24d/0x780 [ 831.767849][ T977] rtnl_newlink+0xc45/0x2000 [ 831.772414][ T977] rtnetlink_rcv_msg+0x95e/0xe90 [ 831.777326][ T977] netlink_rcv_skb+0x158/0x420 [ 831.782063][ T977] netlink_unicast+0x5aa/0x870 [ 831.786800][ T977] netlink_sendmsg+0x8c8/0xdd0 [ 831.791534][ T977] page last free pid 5809 tgid 5809 stack trace: [ 831.797828][ T977] __free_frozen_pages+0x7df/0x1160 [ 831.803000][ T977] qlist_free_all+0x4d/0x120 [ 831.807558][ T977] kasan_quarantine_reduce+0x195/0x1e0 [ 831.812984][ T977] __kasan_slab_alloc+0x69/0x90 [ 831.817804][ T977] __kmalloc_cache_noprof+0x274/0x780 [ 831.823147][ T977] kset_create_and_add+0x4d/0x190 [ 831.828140][ T977] netdev_register_kobject+0x1ef/0x3d0 [ 831.833573][ T977] register_netdevice+0x13dc/0x2270 [ 831.838748][ T977] ipcaif_newlink+0x73/0x2c0 [ 831.843313][ T977] rtnl_newlink+0xc45/0x2000 [ 831.847874][ T977] rtnetlink_rcv_msg+0x95e/0xe90 [ 831.852785][ T977] netlink_rcv_skb+0x158/0x420 [ 831.857523][ T977] netlink_unicast+0x5aa/0x870 [ 831.862266][ T977] netlink_sendmsg+0x8c8/0xdd0 [ 831.867000][ T977] __sys_sendto+0x4a3/0x520 [ 831.871472][ T977] __x64_sys_sendto+0xe0/0x1c0 [ 831.876206][ T977] [ 831.878502][ T977] Memory state around the buggy address: [ 831.884107][ T977] ffff888025122700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 831.892137][ T977] ffff888025122780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 831.900165][ T977] >ffff888025122800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 831.908190][ T977] ^ [ 831.912485][ T977] ffff888025122880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 831.920517][ T977] ffff888025122900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 831.928548][ T977] ================================================================== [ 831.936649][ T977] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 831.943814][ T977] CPU: 0 UID: 0 PID: 977 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 831.953064][ T977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 831.963090][ T977] Workqueue: events_long br_fdb_cleanup [ 831.968615][ T977] Call Trace: [ 831.971867][ T977] [ 831.974771][ T977] dump_stack_lvl+0x3d/0x1f0 [ 831.979342][ T977] vpanic+0x640/0x6f0 [ 831.983301][ T977] panic+0xca/0xd0 [ 831.987000][ T977] ? __pfx_panic+0x10/0x10 [ 831.991396][ T977] ? check_panic_on_warn+0x1f/0xb0 [ 831.996481][ T977] check_panic_on_warn+0xab/0xb0 [ 832.001396][ T977] end_report+0x107/0x170 [ 832.005696][ T977] kasan_report+0xee/0x110 [ 832.010084][ T977] ? br_switchdev_fdb_populate+0x390/0x3a0 [ 832.015864][ T977] br_switchdev_fdb_populate+0x390/0x3a0 [ 832.021469][ T977] br_switchdev_fdb_notify+0x1df/0x2c0 [ 832.026898][ T977] ? __pfx_br_switchdev_fdb_notify+0x10/0x10 [ 832.032851][ T977] ? kasan_save_stack+0x33/0x60 [ 832.037673][ T977] ? find_held_lock+0x2b/0x80 [ 832.042325][ T977] fdb_notify+0x16c/0x1a0 [ 832.046629][ T977] fdb_delete+0x76e/0x12a0 [ 832.051017][ T977] br_fdb_cleanup+0x43e/0x600 [ 832.055666][ T977] process_one_work+0x9cf/0x1b70 [ 832.060579][ T977] ? __pfx_process_one_work+0x10/0x10 [ 832.065924][ T977] ? assign_work+0x1a0/0x250 [ 832.070484][ T977] worker_thread+0x6c8/0xf10 [ 832.075045][ T977] ? __kthread_parkme+0x19e/0x250 [ 832.080065][ T977] ? __pfx_worker_thread+0x10/0x10 [ 832.085146][ T977] kthread+0x3c5/0x780 [ 832.089186][ T977] ? __pfx_kthread+0x10/0x10 [ 832.093748][ T977] ? rcu_is_watching+0x12/0xc0 [ 832.098487][ T977] ? __pfx_kthread+0x10/0x10 [ 832.103051][ T977] ret_from_fork+0x675/0x7d0 [ 832.107612][ T977] ? __pfx_kthread+0x10/0x10 [ 832.112170][ T977] ret_from_fork_asm+0x1a/0x30 [ 832.116926][ T977] [ 832.120146][ T977] Kernel Offset: disabled [ 832.124442][ T977] Rebooting in 86400 seconds..