last executing test programs: 2m36.576724232s ago: executing program 0 (id=633): r0 = gettid() timer_create(0xb, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x2182) setsockopt$MRT_FLUSH(0xffffffffffffffff, 0x0, 0xd1, &(0x7f0000000500)=0xf, 0x4) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, 0x0) socket$packet(0x11, 0x2, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) chdir(0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) r4 = creat(&(0x7f0000000580)='./bus\x00', 0x0) r5 = fanotify_init(0xf00, 0x1) fanotify_mark(r5, 0x105, 0x4000996f, r4, 0x0) fallocate(r3, 0x0, 0x1000000, 0x3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r3, 0xffffd000) ioctl$CEC_RECEIVE(r1, 0xc0386106, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x0, 0x0, 0x9, '&\x00', 0x0, 0x0, 0x4a, 0x0, 0x0, 0x0, 0xe}) 2m33.772591307s ago: executing program 0 (id=644): r0 = socket$inet6(0xa, 0x5, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r1) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x30, r2, 0x101, 0x70bd29, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x80}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x84) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) r3 = syz_usb_connect(0x2, 0x41, &(0x7f0000000200)={{0x12, 0x1, 0x0, 0xd1, 0x25, 0x3c, 0x40, 0x12d1, 0xed56, 0x46dd, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2f, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xcf, 0x0, 0x0, 0xff, 0x1, 0x37, 0x0, [@cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0xc957}, {0xd, 0x24, 0xf, 0x1, 0xe, 0x7, 0x5}, {0x6, 0x24, 0x1a, 0x8001, 0x9}}]}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r3, &(0x7f0000000400)={0x14, &(0x7f0000000380)={0x20, 0x22, 0x2, {0x2, 0xd}}, &(0x7f0000000180)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000000c0)=ANY=[@ANYRESDEC=r0, @ANYRES16=r2, @ANYRESDEC=r2, @ANYRES8=r3], 0x18) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e1f, 0x9, @local, 0x5}, 0x1c) 2m30.682209031s ago: executing program 0 (id=655): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r2, &(0x7f0000000040)=ANY=[@ANYBLOB='target PC'], 0x13) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) r3 = socket(0xa, 0x3, 0x3a) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, 0x0, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000300)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa00000d010004a016008000f8b50d307d74af3707da9707f653e8130f40ace5733a33dc5af03aa1939e28153eb8282b1da382161fd80ff92d02bc041fa11b1dd4586f5daecbaaf8b332233f7aa2c5bc733749dcc206807bc7541a9eadead3d75963e65fdd1684bb7010572ce1cb86f56fe169633c8b36ef8ae8a40981ab4def06973b5e47a3efa726c73fa4622475fa701ee2214552246ad513c9bd95c9a475fa99d56530fb0d86ecfaee0a470b22516b327094453ffea69af5d4d019a4c38915f09a36854762c8b35aeaa8cc9108eb2a44f0443657133bceedb9875e2c827fcea089bf7279a01ad163b375ab5ed8d24b24c8612202000103bcf675bc81842dca0a13a8844dc722"], 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000000) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) read$FUSE(r4, &(0x7f0000000680)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_LSEEK(r5, &(0x7f00000002c0)={0x18, 0x0, r6, {0x8}}, 0x18) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="5c000000020601080000000000000000000000000900020073797a310000000005000400000000001400078008001240000100000800114000000000050001000600000005000500000000000d000300686173683a6d6163000000004cc3a3f0699217b99eae3cdb5ae1978719ef9e62526f551c6024b6632e6b56461b4303d45ca1abc25d7472d09d01ec1a1becd983b219ff"], 0x5c}}, 0x4004804) ioctl$BLKTRACESTART(r4, 0x1274, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x28}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r8, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) 2m29.819560491s ago: executing program 0 (id=659): setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r0, 0x89f1, &(0x7f0000000000)) r1 = socket$alg(0x26, 0x5, 0x0) socket$unix(0x1, 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/147, 0x93}], 0x1, 0x0, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, 0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x24, 0x64, 0xf31, 0xfffffffb, 0x2, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0x0, 0xffff}, {0x0, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x10042008) r8 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c582119ebcf23ad9f5f554c7beef", 0x11) 2m29.589174498s ago: executing program 0 (id=661): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_mptcp(0x2, 0x1, 0x106) openat$comedi(0xffffffffffffff9c, 0x0, 0x101000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$vbi(0x0, 0x3, 0x2) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0x8, &(0x7f00000000c0)={0x26da8e97, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f00000001c0)={0x0, 0x9, 0xb9}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, 0x0, 0x0) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r5 = socket$inet6(0xa, 0x3, 0x6) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@mcast2, 0x0, 0x0, 0x1, 0x4, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xbd1, 0x0, 0x3}, {0x81, 0x2}, 0x1fffffc, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8000, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1, 0x0, 0x0, 0x7, 0x7, 0x0, 0x4}}, 0xe8) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0xffe0) 2m28.719779828s ago: executing program 0 (id=669): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r0, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c) socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1600000000000000040000000700000000000000", @ANYRES32=0x1, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/27], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r3 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x2c, 0x0, &(0x7f0000000180)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x2000000000000081, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000800000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000005580)=""/102392, 0x18ff8) r6 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r6, 0x0, 0x485, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000001e580)=@newtaction={0x14, 0x1e, 0x109}, 0x14}, 0x1, 0x2b1e}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r7, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x7, 0x7ffc0002}]}) r8 = io_uring_setup(0x21b2, &(0x7f00000002c0)={0x0, 0xb7ca, 0x400, 0x3, 0x60}) close_range(r8, 0xffffffffffffffff, 0x200000000000000) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sync() ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, 0x0) 2m13.265964979s ago: executing program 32 (id=669): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r0, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c) socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1600000000000000040000000700000000000000", @ANYRES32=0x1, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/27], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r3 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x2c, 0x0, &(0x7f0000000180)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x2000000000000081, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000800000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000005580)=""/102392, 0x18ff8) r6 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r6, 0x0, 0x485, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000001e580)=@newtaction={0x14, 0x1e, 0x109}, 0x14}, 0x1, 0x2b1e}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r7, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x7, 0x7ffc0002}]}) r8 = io_uring_setup(0x21b2, &(0x7f00000002c0)={0x0, 0xb7ca, 0x400, 0x3, 0x60}) close_range(r8, 0xffffffffffffffff, 0x200000000000000) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sync() ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, 0x0) 11.16706348s ago: executing program 5 (id=1368): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000200)="da467702e2520108dcebc5560e4f93142974b51221138c2cdf5b4d5781b800c423ace69c1eba8d0c505baa2acdddff4bc6e17bd735b3576550a4", 0x3a}], 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r0, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803001d000b0ad25a80648c2594f90124fc60100c050000040009053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1, 0x0, 0x0, 0x4000}, 0x3500000000000000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) sendfile(r0, r0, 0x0, 0x40008) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$inet(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000002c0)="beaa38543627a7a662afe0d83fc3e43fc6c358893ae9cb8787f4659b80c54d51815d240ba45b930936aecd07ff84b35954a5a75c1ba4252e11ab09ebfa468f58829bb24aebceb96a9d4a5a856abe6aed", 0x50}], 0x1}, 0x20048050) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) write$P9_RSTATu(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="930200007d00000005f0000000000000040000000000000000000000000000000000000000000000000000000000000000001f00206e6f6465767b6376666f7892ffffff8102000000000031ffcebc920000003800704a86cec602007dfa673effeb09b5351f5bde05f700000000187b8200b500003b595fcb14034354b9fd9ef196a51cd5157adc8106b494e11200cfc2001000000000000000000000f313f6005500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cc280e8d489da649a37002c016f6465762d6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b17dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae12516105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d79895"], 0x232) sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20040000) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 10.757207358s ago: executing program 5 (id=1370): socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$pptp(0xffffffffffffffff, 0x0, 0x0) r0 = io_uring_setup(0x1fc4, &(0x7f0000000bc0)={0x0, 0x0, 0x12, 0x0, 0x320}) openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2) r1 = memfd_create(&(0x7f0000000940)='y\x105\xfb\xf7u\x83%\b\x00\x00\x00\x00\x00\x00\x00\xea_\xccZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x10\x00\x00\x00\x04\x879\xa24\xa9a\b\x00\xb2\xd3\xcbZJ\x7fa\xc4\x1acB\xaa\xc1\xfb Q\x96\xd9xJ2\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea\b\x00\x00\x00\x00\x00\x00\x00\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9V\x01A\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\a\x00\x01vRk\xaabB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\x80\x81\xa0\xa2-g\b\x99\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecn\x02\xc8\xc4\f\x04\x99\xf6\xfc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8L\xae\x1ff\xcf\xb3\xb65\x12\x89\x02\x82t\x0f\xb0\xe89\x16\fO\x19\x91\xfd\x10\x0e\xa7r\x12\xab\xd4\xd1d\xad\f\x11\xb3\xb3c\xe2\xfe\xcd\x9f7\xa1\x14\xfa\xe2\xdf\x7f\xf4NG\xe3\xeb\x18\xde|\xb3\xf5S\x9a\x04\xb4Lry\xa9\xd6\xfb\xbc\n+N\xf7\xf6\x87\x95\xd9+\xd2sc/\x06\xaa#K3,k\xf3(\xcc\xc7\xb47\xfa\xc3\x1c\x91!\xd3\xd2`-\xa2xrR\x1c\x81i\x87u|29Q\xdf\xed\x10\x9b\x930\xa8v\xa0\x88\xa4t\x17\xb2\xca9\x02\x03\xc9P\xcc\xe0\xb7\x9c\x82\xb4\x03\x83e\xee\x95\xccO\x1b\x83\f\n{\xf3\x12\x90\xcf\x10\xb5>\b3\x80\x8d\xb2%7\x10\xeee\xe4\xc3\xb2^\xad\xb6~\xa2\xbdE\xbf\x91\vqt\x81\xbd\x19\xde\x81\tw\xd4p\xd1\x8aNJ\xb3M\a\xc4\xfa\xb0,$\x81j\xb4Hs\x93>\x16U\xd0t\xe4\xca0T\xb7\xf7\x9d4\b\xd9\xdeps\xec\xa0\nJ\xa5\xfe\xda{(\xee\xb5\x11?\xc3I-\x8bc\xc9\xfb\a\xe5\xab\xf8v1\xdc\xc5\x8c\xebs1\x81\xca\x81l\xa12\xff<\xf5\x12\xcc+\xd4\xab\x84\x16\xa4+\x0e\xd4\x02\xe3\xaa1\xeam\x8ce\xb4r\x0eo&3wff\xe6\x91\x7f\xba\xad\x05\xdd\xc0+\"\xa5\x80\'#\xfd\x9dA&\xee \x18\xe5\x17\x1bd\xd0\xb9\x90\xde\xec\xe4M\xe5\x06\x03r\fc\x8c\x10\x99x\xec`e`\xc3F\xdf\xbc\xa8\xff\x05\xe6\xea\xc3u\xd7\t\x88<\"\xf7!\xd6\x0e\xbbE^\xcd\xb0\x15g\xe6\xf2?y1\x9f\xd3\x95\xc4E\xd0\xb4\x16`r\x14\xad\x02\x17\x9a\x86I]\x02f\xd3\xc9\xe1H\xd7c\xcaQ\x8cE7\xcc\xcf=\xf3\xf7\xb9\xf6s\x88\bZi\b*w\xc5;\x88\r\xab\xa1\t\xf1\x02)5\x00\x84', 0xb) ftruncate(r1, 0xffff) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f00000003c0)={r5, 0x1, 0x1, 0x8, 0xe696, 0x80, 0x1ff, 0x20000000, {0x0, @in6={{0xa, 0x4e23, 0x1, @local, 0x8}}, 0x5, 0xfffffffe, 0x5, 0x544}}, &(0x7f0000000480)=0xb0) setsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_id=r5, 0x4) fcntl$addseals(r1, 0x409, 0x7) close_range(r0, 0xffffffffffffffff, 0x0) 10.544538208s ago: executing program 5 (id=1371): r0 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x100000004) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r1) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB="0000000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, r3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close(r1) 8.901875322s ago: executing program 5 (id=1377): r0 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc04c5349, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010002000000000000000000000a18010000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000002cd40009800800014000000006c80002800c00018008000140000000032400018008000140000000070800014000000008080001400000000908000140000000080c000180080001400000000a24000180080001400000000608000140000000ff080001400000000208000140000000013400018008000140764f15e208000140000000000800014000000007ebfd014000000000080001400000000908000140000000001c000180080001400000002808000140000000cb08000140000000031400018008000140000000050800014000000001"], 0x140}}, 0x0) r4 = socket(0x15, 0x5, 0x0) getsockopt(r4, 0x200000000114, 0x2710, &(0x7f0000000600)=""/102389, &(0x7f0000000000)=0x18ff5) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) socket$kcm(0x10, 0x2, 0x0) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, 0x1, 0x4, 0x5, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x9af33139c2c4eaae}, 0x20004030) r6 = io_uring_setup(0x3c93, &(0x7f0000000900)={0x0, 0x1246, 0x80, 0x1, 0xe0}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) flistxattr(r4, &(0x7f0000019600)=""/4096, 0x1000) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r7, &(0x7f0000000000)=[{0x0}, {0x0}], 0x2) close_range(r6, 0xffffffffffffffff, 0x0) unshare(0x62040200) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0x8001}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000100)={@broadcast, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "f2a400", 0x44, 0x2f, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], {{0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x1, 0x22eb}, {}, {0x0, 0x0, 0x0, 0x0, 0x2a}, {}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0xfffffffd}}}}}}}}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000009c0)=@migrate={0xa0, 0x21, 0x1, 0x0, 0x4, {{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x50, 0x11, [{@in6=@mcast2, @in=@private=0xa010100, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@empty, 0x3c, 0x0, 0x0, 0xfffffffd, 0xa, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4090}, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f00000000c0)=0x8) 7.571534723s ago: executing program 2 (id=1380): socket$inet_mptcp(0x2, 0x1, 0x106) mknod(0x0, 0x8001420, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x101000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x40000000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) syz_open_dev$vbi(&(0x7f0000000b80), 0x0, 0x2) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r2) rmdir(&(0x7f0000000040)='./control\x00') r3 = openat$cgroup_freezer_state(r2, &(0x7f0000000080), 0x2, 0x0) sendfile(r3, r3, 0x0, 0x8000002) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_KEY(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r6, @ANYBLOB="cd462dbd7000fbcbdf250c00000008000300", @ANYRES32=r5, @ANYBLOB="04d9bf22"], 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x40400d4) 6.845266273s ago: executing program 2 (id=1386): syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) ioctl$DRM_IOCTL_SET_VERSION(0xffffffffffffffff, 0xc0106407, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff}, 0x80) r3 = add_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r2, 0x0) keyctl$revoke(0x3, r3) syz_open_procfs(0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000180)={{0xa61e}, 'syz0\x00'}) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r4, 0x1, 0x24, &(0x7f0000000080)=0x80, 0x4) 6.179471158s ago: executing program 4 (id=1389): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'ip6erspan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x5bc, 0x2c, 0xd2b, 0x70bd2b, 0x35dfdbfe, {0x0, 0x0, 0x0, r4, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x590, 0x2, [@TCA_U32_SEL={0x364, 0x5, {0x9, 0x7f, 0x3, 0x200, 0x8, 0x0, 0x3, 0x8, [{0x4, 0x400000, 0x0, 0x2}, {0x4800, 0x1, 0x9, 0x3}, {0x4, 0x0, 0x6, 0x8}, {0x1a8f, 0x9, 0xfffff801, 0x7}, {0x7, 0x6, 0x5, 0x400}, {0x73, 0x1400, 0x57e76c05, 0x7fff}, {0x7, 0x5, 0x0, 0x81}, {0x7f, 0x1, 0x1, 0x4}, {0x7fffffff, 0x0, 0x9, 0x7}, {0x800, 0x9, 0x1, 0x4}, {0x5c4, 0xa, 0x6, 0xc}, {0x2, 0x8, 0x4}, {0x7, 0x8, 0xff, 0x6}, {0x401, 0xffffffff, 0x7, 0x7}, {0x2, 0x0, 0x100, 0x6}, {0x6, 0x8, 0x1, 0x9}, {0x0, 0x4, 0x2, 0x6}, {0x7fff, 0x0, 0x3, 0x101}, {0x4, 0x5b61, 0x0, 0xe37}, {0x21, 0x600000, 0xffff, 0x54}, {0xff, 0x81, 0xd4, 0x6}, {0x3, 0x2, 0x3fa4f833, 0x46a}, {0x1, 0x6, 0xff, 0x3ff}, {0x5, 0x9, 0x1, 0x3}, {0x7, 0x1, 0x401, 0x9}, {0x8, 0x100, 0x7, 0x3}, {0x7, 0x9819, 0x6, 0x6}, {0x3, 0xc, 0x5, 0x6}, {0x81, 0x9, 0xf3b8, 0xffff7fff}, {0x0, 0x1, 0x4, 0x9}, {0x4, 0x6, 0x5, 0x8001}, {0xfffffffb, 0xd, 0x7, 0x7f}, {0x2, 0x81, 0x80000000, 0x8}, {0x4, 0xffff, 0x6, 0x2}, {0x0, 0x9, 0x4, 0xb76}, {0x0, 0x8, 0x4, 0x36c2}, {0x6, 0xc63, 0xb, 0x7}, {0x1, 0x5, 0x5, 0x4}, {0x7, 0x200, 0x5, 0x400}, {0x10, 0x0, 0x6, 0x3}, {0xb, 0x5, 0x5, 0x5}, {0x0, 0x9, 0x8, 0xa}, {0x9, 0xd, 0x7f, 0x8000}, {0x7fffffff, 0x51, 0xd6fa, 0x9}, {0xd, 0x6, 0x2, 0x8}, {0x9, 0x9, 0x7ff, 0x9}, {0x8, 0xffffffff, 0x80, 0x200}, {0x7, 0x3, 0x6, 0x401}, {0xdc, 0x1ff, 0x101, 0x5}, {0x0, 0x7f, 0x60d4, 0x3}, {0x6, 0x8, 0xc, 0x8}, {0x10001, 0xfffffffb, 0xfffffffa, 0x1ad}, {0x2, 0x4, 0x800, 0x5}]}}, @TCA_U32_INDEV={0x14, 0x8, 'vxcan1\x00'}, @TCA_U32_SEL={0x214, 0x5, {0x10, 0x9, 0x6, 0x10da, 0xa760, 0x0, 0x10, 0x100, [{0x1000, 0xe, 0xfffff000, 0x9f6}, {0x5, 0x3ff, 0x3, 0x4}, {0x2, 0xffffffff, 0x69c, 0x4000000}, {0x4009, 0x7, 0x40, 0x7d}, {0x2, 0xd033, 0x57, 0x8000}, {0x1, 0x2, 0x9, 0x8}, {0x6, 0x7fff, 0x9, 0x6}, {0x3, 0xde5, 0x4, 0xbd}, {0x3, 0x80, 0x1, 0x6}, {0x7, 0x7fff, 0x0, 0x40}, {0x9, 0x10, 0x5, 0x5}, {0xac, 0xfffff08a, 0x8, 0x3}, {0x8, 0xfffffff9, 0xfffffffa, 0x51}, {0x49f, 0x7, 0x81, 0xb}, {0x5, 0x9, 0x2}, {0x10001, 0x7, 0xc841, 0x2}, {0x1000, 0x2, 0x264, 0x9}, {0x6, 0x0, 0x8, 0x7}, {0x3ff, 0xb, 0x3, 0xa6d}, {0x7, 0x7ff, 0x5, 0xc7}, {0x6, 0x8, 0x2, 0x1}, {0x7, 0x2, 0x5, 0x2}, {0xaa4, 0x406, 0x2, 0x127c}, {0x2, 0x4f, 0x5a2, 0xa2fa}, {0x3, 0x7, 0x200, 0x1}, {0x4, 0x5d14, 0x7f, 0x72}, {0x7, 0x2, 0x7, 0x7}, {0x5, 0x7fff, 0x3, 0x438}, {0x80, 0x3, 0x2, 0x1e0}, {0xfffffffc, 0x9, 0x40, 0x7}, {0x3, 0xa67, 0x400, 0x80}, {0xc, 0x2, 0xfffffffb}]}}]}}]}, 0x5bc}}, 0x24040084) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) socket$l2tp6(0xa, 0x2, 0x73) clock_adjtime(0x0, &(0x7f0000000100)={0x362, 0x6a, 0x55cd, 0x8000000000000001, 0x48c, 0x5, 0xd, 0x424, 0x2, 0xffffffffffffffff, 0xf423f, 0xfffffffffffffff9, 0x7, 0x2, 0x1000000081, 0x5, 0x0, 0x5, 0x2, 0x9220000000000000, 0x3, 0x0, 0x80000001, 0x0, 0x5, 0x7}) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_mrelease(0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') pread64(r5, &(0x7f0000002180)=""/4101, 0x1005, 0x1) io_uring_setup(0xad5, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') syz_open_dev$tty1(0xc, 0x4, 0x1) openat(0xffffffffffffffff, 0x0, 0x0, 0x1cd) 5.892254242s ago: executing program 2 (id=1390): r0 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r0, 0x541b, &(0x7f0000000000)=0x10000) 5.38098759s ago: executing program 2 (id=1391): r0 = socket(0x2, 0x1, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000040)={'tunl0\x00', &(0x7f0000000300)={'gretap0\x00', 0x0, 0x20, 0x1, 0x4, 0x29, {{0x7, 0x4, 0x2, 0x7, 0x1c, 0x64, 0x0, 0x6, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@cipso={0x86, 0x6, 0xa9104a7efd20c988}]}}}}}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, 0x0, &(0x7f0000000040)) 5.23299955s ago: executing program 2 (id=1392): bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="5c00000012", 0x5}], 0x1, 0x0, 0x1f, 0x1f00c00e}, 0x0) r0 = fanotify_init(0x8, 0x1000) writev(r0, &(0x7f0000000480)=[{0x0}, {0x0}], 0x2) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r0}, 0xfffffffffffffd73) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) socket$nl_route(0x10, 0x3, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = syz_clone(0x0, &(0x7f0000000300)="436e122f6d38a01f50bbdd6ae261cb8c52c976ef5878eb978a0b6bc95e02412273a892c52f502a03ae655c88cfe0396274270c277ccd9a081ffafbf6c4322aefd8527e827fef06a9aee344efe3e18adbac492b7d43e609eef2924b9a7d89991c1856ea9885498601a31ef5aea3d9", 0x6e, &(0x7f0000000200), &(0x7f0000000380), &(0x7f00000003c0)="7f8ab171aa5bd6d93fcfa22c38830bb82fb8739d0c4b82cb776f464cfd9e75f11132390be9e3dbf96f947e298ed13013bcf9aa70b8c0589210706656695d99c58816ab5bc937a68a9563f942a5859d57740661edc8bba0f94e1031ac8a43d561f36e336596b76b7bc4ed4b5ebaf10f41307e70ba3ea347337c355c4dfdf6eb336ffa5babaa89e5") r4 = syz_open_procfs(r3, &(0x7f0000000000)='fd/4\x00') lseek(r4, 0x3, 0x0) recvmmsg(r1, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000580)=""/51, 0x33}, {&(0x7f0000000500)=""/88, 0x58}, {&(0x7f0000000600)=""/184, 0xb8}, {&(0x7f0000000580)}, {&(0x7f0000001000)=""/112, 0x70}, {&(0x7f0000000740)=""/93, 0x5d}, {&(0x7f00000007c0)=""/98, 0x62}, {&(0x7f0000000840)=""/39, 0x27}], 0x8, &(0x7f0000000900)=""/108, 0x6c}, 0x4}, {{&(0x7f0000000ac0)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000000bc0)=[{&(0x7f00000006c0)=""/99, 0x63}, {&(0x7f0000000980)=""/55, 0x37}], 0x2, &(0x7f0000000c00)=""/45, 0x2d}, 0x10}, {{&(0x7f0000000c40)=@l2, 0x80, &(0x7f0000000e80)=[{&(0x7f0000000cc0)=""/65, 0x41}, {&(0x7f0000000d40)=""/113, 0x71}, {&(0x7f0000001080)=""/192, 0xc0}, {&(0x7f0000003340)=""/4097, 0x1001}], 0x4, &(0x7f0000000ec0)=""/107, 0x6b}}], 0x3, 0x102, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(r3, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_NMI(r5, 0xae9a) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(0xffffffffffffffff, 0x8008ae9d, &(0x7f0000000240)) sendto$packet(0xffffffffffffffff, &(0x7f00000004c0)="86", 0x1, 0x404c844, &(0x7f00000000c0)={0x11, 0x15}, 0x14) syz_open_procfs(0x0, &(0x7f0000000040)='net/wireless\x00') preadv(r5, &(0x7f0000001b00)=[{&(0x7f00000009c0)=""/235, 0xeb}], 0x1, 0x2, 0x0) syz_usb_connect(0x0, 0x0, 0x0, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = dup(r6) write$UHID_INPUT(r7, &(0x7f0000001300)={0xc, {"a2e3ad214fc752f91b4847f70e06d038e7ff7fc6e5539b3f6d078b089b3b083848090890e0878f0e1ac6e7049b3367959b669a240d5b67f3988f7e0319520100ffe8d178708c523c921b1b5b31300d095da736cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4040d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465f41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a4d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d606495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07840900000000000000f5c8f4ceb360c7e658828163e2d25c4aa348561f097e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f028dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c000003716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff8f2211f1033195563c7f93cd54b9094f22b625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a605fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b611fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db56c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47afed367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadbbf5c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000", 0x1000}}, 0x1006) 5.219296945s ago: executing program 3 (id=1393): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_mptcp(0x2, 0x1, 0x106) openat$comedi(0xffffffffffffff9c, 0x0, 0x101000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0x8, &(0x7f00000000c0)={0x26da8e97, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r5 = socket$inet6(0xa, 0x3, 0x6) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@mcast2, 0x0, 0x0, 0x1, 0x4, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xbd1, 0x0, 0x3}, {0x81, 0x2}, 0x1fffffc, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8000, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1, 0x0, 0x0, 0x7, 0x7, 0x0, 0x4}}, 0xe8) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0xffe0) 5.080584023s ago: executing program 4 (id=1394): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000006dc0)=[{{&(0x7f0000000300)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x24008840}}], 0x1, 0x200040c0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x5}, 0x0) syz_open_dev$vim2m(0x0, 0x2, 0x2) unshare(0x26000400) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x3, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) ioctl$AUTOFS_IOC_FAIL(0xffffffffffffffff, 0x4c80, 0x7000000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x4b, 0x0, 0x0) syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0xbf72, 0x100, 0x4, 0x165}, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1900000004000000040000000c0000", @ANYRES32=0x0, @ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000900000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000007d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffff"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000080)=0x20) r3 = add_key$user(&(0x7f0000000200), &(0x7f0000000440), &(0x7f00000000c0), 0x14b, 0xfffffffffffffffd) r4 = add_key(&(0x7f0000000200)='user\x00', &(0x7f0000000240)={'syz', 0x0}, &(0x7f00000002c0)='4', 0xba, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000480), &(0x7f0000000380)={'syz', 0x2}, &(0x7f0000000580)="ed", 0x1, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000100)={r5, r3, r4}, 0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={'blake2b-256\x00'}}) 4.241384334s ago: executing program 3 (id=1397): r0 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x100000004) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r1) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB="0000000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, r3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close(r1) 4.025687252s ago: executing program 5 (id=1398): bind$l2tp6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000100)={0x2098, 0x5, 0x1000, 0xfffffffd}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=@delchain={0x24, 0x5f, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x5, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20042800}, 0x24040800) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x4e20, 0x3, 'none\x00', 0x30, 0x4, 0x68}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000340)={{0x2f, @broadcast, 0x4e21, 0x3, 'fo\x00', 0x33, 0x3240, 0x4}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x4e23, 0x1, 0xc3, 0x12d5c, 0x2}}, 0x44) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x10031, 0xffffffffffffffff, 0x65be1000) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) r2 = syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x88002) ioctl$IOC_PR_PREEMPT(r2, 0x401870cb, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000140), 0xfffffffffffffff8, 0xc0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x101400) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r5, 0x80045400, 0xfffffffffffffffc) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x10, 0x1c, &(0x7f00000003c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x6}, {}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x95bd}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000240)='syzkaller\x00', 0x5, 0x20, &(0x7f00000002c0)=""/32, 0x41000, 0x10, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0x3, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000600)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x94) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ptrace(0x10, 0x1) mbind(&(0x7f00001fa000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) r6 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$VIDIOC_S_INPUT(r6, 0xc0045627, &(0x7f0000000080)=0x2) ioctl$VIDIOC_S_SELECTION(r6, 0xc040565f, &(0x7f0000000040)={0x9, 0x100, 0x0, {0xffffffff, 0xbde, 0x400, 0x10000}}) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r7, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x0, 0x800, 0x0, 0x3}, 0x20) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 3.78212417s ago: executing program 4 (id=1399): bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xf6576890f7881c93) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000180)={0xffffffffffffffff}, 0x106, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000300)={0x13, 0x10, 0xfa00, {&(0x7f0000000440), r2, 0x2}}, 0x18) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x20040011) r3 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000340)=0x0) syz_open_procfs$pagemap(r4, &(0x7f0000000380)) syz_usb_ep_write$ath9k_ep2(r3, 0x83, 0x12, &(0x7f0000000fc0)=@conn_svc_rsp={0x0, 0x0, 0xa, "17da764a", {0x3, 0x107, 0x0, 0x1c, 0x8000, 0x5, 0xff}}) syz_io_uring_setup(0x10c, 0x0, 0x0, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) syz_open_dev$sndpcmc(&(0x7f0000004240), 0x0, 0x0) openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000100), 0x29002, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRES64, @ANYBLOB=',wfdno=', @ANYRESHEX=r6]) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r5, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick=0x1f4, {0x0, 0x80}, {}, @control={0x7f, 0x1, 0xd}}], 0x1c) 3.221401277s ago: executing program 3 (id=1400): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000007c0)=[{{&(0x7f00000002c0)={0x2, 0x4e22, @local}, 0x10, 0x0}}], 0x400005c, 0x2400c8a0) 3.219220009s ago: executing program 3 (id=1401): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000040)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x20, r3, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x20}}, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x2}}, 0x20) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r4, 0xc0884113, &(0x7f0000000300)={0x1, 0x1, 0x1, 0xfffffffffdfffff5, 0x3ffffffff, 0xfffffffffffffffc, 0x1, 0x0, 0xfffffffffffffffd, 0x0, 0xfffffffe, 0x2}) 3.141210389s ago: executing program 3 (id=1402): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) utimensat(0xffffffffffffffff, 0x0, 0xfffffffffffffffe, 0x2) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000500)) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f00000005c0)={0x14, r2, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x800) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000c80)={0x34, &(0x7f0000000300)=ANY=[@ANYBLOB="8ebee3d9727cdfba027e3e3b724ddf0230c807f825d2bc78774e6f6d5e5d321b078ff7894dad76eac7b3a17e64d127d5e421fc7df7636226a3230c2fe89c385001080b784cddeb0a9525c0b56508b590b75343ae8f34777e790eb0aaa8b960be8787f97493dc7793af07ba524a826afc726c7155efe412eaf9e43f7c89d62ec484661e34ea746513d2e0b2a23083dc03fb8b5d61c591dc998e5898364a9b8a087c7a640dd3c06241bb5a"], 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x40000) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, 0x0, 0x0) socket(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_dev$radio(&(0x7f0000001640), 0x0, 0x2) ioctl$VIDIOC_LOG_STATUS(r4, 0x5646, 0x0) preadv(r4, &(0x7f00000033c0)=[{&(0x7f00000003c0)=""/207, 0xcf}], 0x1, 0x6, 0xfffffffe) ioctl$F2FS_IOC_DECOMPRESS_FILE(r4, 0xf517, 0x0) syz_io_uring_setup(0x16440, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x3}, &(0x7f0000000040)=0x0, &(0x7f0000001700)=0x0) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_POLL_REMOVE={0x7, 0x8}) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socket$kcm(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) 3.111253319s ago: executing program 5 (id=1403): syz_usb_connect(0x3, 0x8c6, &(0x7f0000000100)=ANY=[@ANYRES16], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0}) 2.708295343s ago: executing program 1 (id=1406): setxattr$incfs_metadata(&(0x7f0000000600)='./file1\x00', &(0x7f0000000640), &(0x7f00000006c0)="8301fbbb38308ca34e1f4da5f23463960d00fcf68023f34c543aefa8d92e5605c141c2a0ac7f0c18507c7dccc445c9165f33dc3d89725677c26c23d9206e00952c96972b104e43c4ae47ff38d373edae216a1d6d71d9f89882a4443735dd13a27ee3f7931e8334cfec637aa5d2b89044a76b4ea73dc78a5ee97529027c76421e42a979531ebb93681dcc8b9f75d321376f6a265f8d9a23d36521e28b7897", 0x9e, 0x1) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008000}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020100000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a32000000001400000011001f"], 0x7c}}, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000900)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r0, 0xc0189373, &(0x7f0000000940)={{0x1, 0x1, 0x18, r1, {0x5}}, './file1\x00'}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a5c00deff050a0b04000000000000000002000000300004802c000180080001006c6f762f726e756c6c623000000000080006400000003e0900010073797a30000000000900020073797a3200000000140000001100010000000000000000000500000a00"/132], 0x84}}, 0x40) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000200)="da467702e2520108dcebc5560e4f93142974b51221138c2cdf5b4d5781b800c423ace69c1eba8d0c505baa2acdddff4bc6e17bd735b3576550a4b33160cad82f3df56db53fbf5fbad6125c8b79", 0x4d}], 0x1, 0x0, 0x0, 0x4000}, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000780)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x1, 0x0, 0x6, 0x4}, &(0x7f0000000840)=0x98) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000880)={r2, 0x1, 0x7, [0x4, 0x3c, 0xfff, 0x5, 0x4, 0x7, 0x6]}, &(0x7f00000008c0)=0x16) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$inet(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000002c0)="beaa38543627a7a662afe0d83fc3e43fc6c358893ae9cb8787f4659b80c54d51815d240ba45b930936aecd07ff84b35954a5a75c1ba4252e11ab09ebfa468f58829bb24aebceb96a9d4a5a856abe6aed24f77c513e80ec3b5dd887c2e06e962f824f5b806e51ff73a109", 0x6a}], 0x1}, 0x20048050) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2.662612861s ago: executing program 1 (id=1407): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_mptcp(0x2, 0x1, 0x106) openat$comedi(0xffffffffffffff9c, 0x0, 0x101000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0x8, &(0x7f00000000c0)={0x26da8e97, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r5 = socket$inet6(0xa, 0x3, 0x6) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@mcast2, 0x0, 0x0, 0x1, 0x4, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xbd1, 0x0, 0x3}, {0x81, 0x2}, 0x1fffffc, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8000, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1, 0x0, 0x0, 0x7, 0x7, 0x0, 0x4}}, 0xe8) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0xffe0) 1.890407437s ago: executing program 2 (id=1408): r0 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc04c5349, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010002000000000000000000000a18010000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000002cd40009800800014000000006c80002800c00018008000140000000032400018008000140000000070800014000000008080001400000000908000140000000080c000180080001400000000a24000180080001400000000608000140000000ff080001400000000208000140000000013400018008000140764f15e208000140000000000800014000000007ebfd014000000000080001400000000908000140000000001c000180080001400000002808000140000000cb08000140000000031400018008000140000000050800014000000001"], 0x140}}, 0x0) r4 = socket(0x15, 0x5, 0x0) getsockopt(r4, 0x200000000114, 0x2710, &(0x7f0000000600)=""/102389, &(0x7f0000000000)=0x18ff5) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) socket$kcm(0x10, 0x2, 0x0) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, 0x1, 0x4, 0x5, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x9af33139c2c4eaae}, 0x20004030) r6 = io_uring_setup(0x3c93, &(0x7f0000000900)={0x0, 0x1246, 0x80, 0x1, 0xe0}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) flistxattr(r4, &(0x7f0000019600)=""/4096, 0x1000) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r7, &(0x7f0000000000)=[{0x0}, {0x0}], 0x2) close_range(r6, 0xffffffffffffffff, 0x0) unshare(0x62040200) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0x8001}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000100)={@broadcast, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "f2a400", 0x44, 0x2f, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], {{0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x1, 0x22eb}, {}, {0x0, 0x0, 0x0, 0x0, 0x2a}, {}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0xfffffffd}}}}}}}}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000009c0)=@migrate={0xa0, 0x21, 0x1, 0x0, 0x4, {{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x50, 0x11, [{@in6=@mcast2, @in=@private=0xa010100, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@empty, 0x3c, 0x0, 0x0, 0xfffffffd, 0xa, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4090}, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f00000000c0)=0x8) 1.769599672s ago: executing program 1 (id=1409): socket$inet_mptcp(0x2, 0x1, 0x106) mknod(0x0, 0x8001420, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x101000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x40000000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) syz_open_dev$vbi(&(0x7f0000000b80), 0x0, 0x2) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r4) rmdir(&(0x7f0000000040)='./control\x00') r5 = openat$cgroup_freezer_state(r4, &(0x7f0000000080), 0x2, 0x0) sendfile(r5, r5, 0x0, 0x8000002) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_KEY(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r8, @ANYBLOB="cd462dbd7000fbcbdf250c00000008000300", @ANYRES32=r7, @ANYBLOB="04d9bf22"], 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x40400d4) 1.246190255s ago: executing program 4 (id=1410): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, 0x0, 0x0}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) setsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) socket$inet(0x2, 0x800, 0x1000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) close(0xffffffffffffffff) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{}, &(0x7f0000000000), 0x0}, 0x20) socket$alg(0x26, 0x5, 0x0) socket$phonet(0x23, 0x2, 0x1) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) rt_tgsigqueueinfo(0x0, 0x0, 0x7, &(0x7f00000003c0)={0x0, 0x0, 0x4}) close(0xffffffffffffffff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001480)='./cgroup/syz1\x00', 0x200002, 0x0) mkdirat$cgroup(r3, &(0x7f00000000c0)='syz1\x00', 0x1ff) openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) 967.067921ms ago: executing program 4 (id=1411): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x27) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) setpgid(r1, r2) r3 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, &(0x7f0000000700)="2e3665f2af6766c74424005f0000006766c7442402000000006766c744240600000000670f011c2466b9030100c066b85bd1e45366bad6062a620f3066b9370200000f320f01d1440f20c066350f000000440f22c066660f383b8032500fe99400003e2e660fc7b302000f20e06635200000000f22e0", 0x76}], 0xaaaaaaaaaaaaaae, 0x54, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000040)=ANY=[]) ioctl$KVM_RUN(r3, 0xae80, 0x0) close_range(r3, r3, 0x0) 897.619325ms ago: executing program 4 (id=1412): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000900)={0x41, 0x4}, 0x10) socket$tipc(0x1e, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f00000000c0)={0xa20000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f907, 0x0, '\x00', @value=0x6}}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x8010, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x300) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000007c0)=[{{&(0x7f00000002c0)={0x2, 0x4e22, @local}, 0x10, 0x0}}], 0x400005c, 0x2400c8a0) 384.884706ms ago: executing program 1 (id=1413): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0xfff5, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1f0}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x6c}}, 0x20050800) 321.269766ms ago: executing program 1 (id=1414): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket(0x10, 0x803, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000400}, 0x0) (async, rerun: 64) socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000000c0)=0x8b, 0x100000500) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) (async, rerun: 32) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async, rerun: 32) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x400000000000000, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=@newlink={0x4c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv_slave_0\x00'}, @IFLA_ADDRESS={0xa, 0x1, @dev}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x6}]}]}, 0x4c}}, 0x0) 320.002561ms ago: executing program 1 (id=1415): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SOUND_MIXER_READ_RECSRC(r1, 0x80044dff, 0x0) (fail_nth: 1) 0s ago: executing program 3 (id=1416): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="ce2e14d7956b0e2be76969e83219611d8000000000010104000000000000000002000000240001801400018008000100e000000108000200000000000c0002800500010000000000240002800c00028005000100000000001400018008000100e000000108000200ac1e000108000740000000001c001080080003400000013208000240000000cd08000140000005ffb0c1b332543755e928a7998c6034fdf053b90825abec78142fe42170c5edd35c04798aa566ab1fd8a30b95a12593675b28ffdfee52a0695a9f927f6192bd8012"], 0x80}}, 0x0) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r1, &(0x7f0000000400)={0x0, 0xa7, &(0x7f00000003c0)={&(0x7f0000000300)={0x4c, r0, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x8, 0x8e, 0x1}}]}, 0x4c}}, 0x0) kernel console output (not intermixed with test programs): 0 [ 251.088131][ T30] audit: type=1400 audit(1755668435.610:530): avc: denied { open } for pid=5844 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 251.113631][ T30] audit: type=1400 audit(1755668435.610:531): avc: denied { ioctl } for pid=5844 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 251.219923][ T30] audit: type=1400 audit(1755668435.620:532): avc: denied { egress } for pid=5891 comm="kworker/0:3" saddr=fe80::1c daddr=ff02::16 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:netif_t tclass=netif permissive=1 [ 251.304137][ T30] audit: type=1400 audit(1755668435.620:533): avc: denied { sendto } for pid=5891 comm="kworker/0:3" saddr=fe80::1c daddr=ff02::16 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:node_t tclass=node permissive=1 [ 251.328078][ T30] audit: type=1400 audit(1755668435.620:534): avc: denied { prog_load } for pid=12428 comm="syz.2.952" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 251.349514][ T30] audit: type=1400 audit(1755668435.620:535): avc: denied { bpf } for pid=12428 comm="syz.2.952" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 251.369954][ C1] vkms_vblank_simulate: vblank timer overrun [ 251.409117][ T30] audit: type=1400 audit(1755668435.730:536): avc: denied { read } for pid=12443 comm="syz.1.957" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 251.432348][ T30] audit: type=1400 audit(1755668435.730:537): avc: denied { open } for pid=12443 comm="syz.1.957" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 251.455844][ C1] vkms_vblank_simulate: vblank timer overrun [ 252.409005][T12464] netlink: 164796 bytes leftover after parsing attributes in process `syz.2.963'. [ 252.644973][ T5919] usb 6-1: USB disconnect, device number 5 [ 252.694484][ T5919] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 252.963671][T12488] netlink: 12 bytes leftover after parsing attributes in process `syz.5.970'. [ 253.067496][T12489] netlink: 4 bytes leftover after parsing attributes in process `syz.1.969'. [ 253.435862][T12495] input: syz0 as /devices/virtual/input/input49 [ 253.925504][ T5891] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 254.285697][ T5891] usb 6-1: Using ep0 maxpacket: 8 [ 254.318411][ T5891] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 254.428355][ T5891] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.488559][ T5891] pvrusb2: Hardware description: Terratec Grabster AV400 [ 254.501768][ T5891] pvrusb2: ********** [ 254.509406][ T5891] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 254.525518][ T5891] pvrusb2: Important functionality might not be entirely working. [ 254.533448][ T5891] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 254.546562][ T5891] pvrusb2: ********** [ 254.720844][T12512] comedi: No check for data length of config insn id 8 is implemented [ 254.733141][ T2336] pvrusb2: Invalid write control endpoint [ 254.805244][T12512] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 254.865539][T12512] comedi: Assuming n=886 is correct [ 254.892359][ T2336] pvrusb2: Invalid write control endpoint [ 254.942501][ T2336] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 255.110559][ T5919] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 255.122668][ T2336] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 255.148524][ T2336] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 255.165761][ T2336] pvrusb2: Device being rendered inoperable [ 255.175620][ T2336] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 255.185504][ T2336] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 255.210989][ T2336] pvrusb2: Attached sub-driver cx25840 [ 255.229028][ T2336] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 255.273824][ T2336] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 255.284495][ T5919] usb 2-1: device descriptor read/64, error -71 [ 255.291160][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.297691][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.298298][T12532] FAULT_INJECTION: forcing a failure. [ 255.298298][T12532] name failslab, interval 1, probability 0, space 0, times 0 [ 255.356501][T12532] CPU: 1 UID: 0 PID: 12532 Comm: syz.2.984 Not tainted syzkaller #0 PREEMPT(full) [ 255.356527][T12532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 255.356537][T12532] Call Trace: [ 255.356543][T12532] [ 255.356549][T12532] dump_stack_lvl+0x16c/0x1f0 [ 255.356573][T12532] should_fail_ex+0x512/0x640 [ 255.356594][T12532] ? bpf_test_init.isra.0+0x9e/0x140 [ 255.356620][T12532] should_failslab+0xc2/0x120 [ 255.356639][T12532] __kmalloc_noprof+0xd2/0x510 [ 255.356659][T12532] bpf_test_init.isra.0+0x9e/0x140 [ 255.356685][T12532] bpf_prog_test_run_skb+0x245/0x2280 [ 255.356706][T12532] ? __fget_files+0x20e/0x3c0 [ 255.356725][T12532] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 255.356743][T12532] ? fput+0x9b/0xd0 [ 255.356766][T12532] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 255.356784][T12532] __sys_bpf+0x104d/0x4de0 [ 255.356805][T12532] ? lock_release+0x201/0x2f0 [ 255.356831][T12532] ? __pfx___sys_bpf+0x10/0x10 [ 255.356852][T12532] ? ksys_write+0x190/0x250 [ 255.356868][T12532] ? rcu_is_watching+0x12/0xc0 [ 255.356894][T12532] ? lock_release+0x201/0x2f0 [ 255.356920][T12532] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 255.356944][T12532] ? fput+0x9b/0xd0 [ 255.356965][T12532] ? ksys_write+0x1ac/0x250 [ 255.356980][T12532] ? __pfx_ksys_write+0x10/0x10 [ 255.356999][T12532] __x64_sys_bpf+0x78/0xc0 [ 255.357021][T12532] ? trace_irq_enable.constprop.0+0xd4/0x120 [ 255.357042][T12532] do_syscall_64+0xcd/0x4c0 [ 255.357062][T12532] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.357079][T12532] RIP: 0033:0x7f78f7f8ebe9 [ 255.357093][T12532] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 255.357109][T12532] RSP: 002b:00007f78f8e4d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 255.357126][T12532] RAX: ffffffffffffffda RBX: 00007f78f81b5fa0 RCX: 00007f78f7f8ebe9 [ 255.357137][T12532] RDX: 0000000000000048 RSI: 00002000000002c0 RDI: 000000000000000a [ 255.357147][T12532] RBP: 00007f78f8e4d090 R08: 0000000000000000 R09: 0000000000000000 [ 255.357158][T12532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 255.357167][T12532] R13: 00007f78f81b6038 R14: 00007f78f81b5fa0 R15: 00007ffc909bab38 [ 255.357184][T12532] [ 255.578880][ C1] vkms_vblank_simulate: vblank timer overrun [ 255.598592][ T30] kauditd_printk_skb: 66 callbacks suppressed [ 255.598608][ T30] audit: type=1400 audit(1755668441.220:604): avc: denied { create } for pid=12531 comm="syz.4.985" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 255.623964][ C1] vkms_vblank_simulate: vblank timer overrun [ 255.636673][ T30] audit: type=1400 audit(1755668441.260:605): avc: denied { connect } for pid=12531 comm="syz.4.985" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 255.713033][ T30] audit: type=1400 audit(1755668441.310:606): avc: denied { write } for pid=12531 comm="syz.4.985" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 255.732293][ T5919] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 255.855602][ T5919] usb 2-1: device descriptor read/64, error -71 [ 255.966433][ T5919] usb usb2-port1: attempt power cycle [ 256.066843][ T30] audit: type=1400 audit(1755668441.680:607): avc: denied { ioctl } for pid=12531 comm="syz.4.985" path="socket:[24806]" dev="sockfs" ino=24806 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 256.091647][ C1] vkms_vblank_simulate: vblank timer overrun [ 256.230442][ T5891] usb 6-1: USB disconnect, device number 6 [ 256.238721][ T30] audit: type=1400 audit(1755668441.860:608): avc: denied { unmount } for pid=11643 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 256.258631][ C1] vkms_vblank_simulate: vblank timer overrun [ 256.301535][ T30] audit: type=1400 audit(1755668441.900:609): avc: denied { unmount } for pid=11643 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 256.395570][ T5919] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 256.428852][ T5919] usb 2-1: device descriptor read/8, error -71 [ 256.449913][ T30] audit: type=1400 audit(1755668442.060:610): avc: denied { ioctl } for pid=12544 comm="syz.5.989" path="socket:[23801]" dev="sockfs" ino=23801 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 256.474680][ C1] vkms_vblank_simulate: vblank timer overrun [ 256.504380][T12550] netlink: 202232 bytes leftover after parsing attributes in process `syz.5.989'. [ 256.545583][T12550] netlink: zone id is out of range [ 256.552949][T12550] netlink: zone id is out of range [ 256.560882][T12550] netlink: zone id is out of range [ 256.572225][T12550] netlink: zone id is out of range [ 256.599736][ T30] audit: type=1400 audit(1755668442.110:611): avc: denied { ioctl } for pid=12548 comm="syz.2.990" path="socket:[24820]" dev="sockfs" ino=24820 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 256.624363][ C1] vkms_vblank_simulate: vblank timer overrun [ 256.645225][T12550] netlink: zone id is out of range [ 256.692705][T12550] netlink: zone id is out of range [ 256.722504][T12550] netlink: zone id is out of range [ 256.737118][ T5919] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 256.788925][T12550] netlink: zone id is out of range [ 256.814372][ T5919] usb 2-1: device descriptor read/8, error -71 [ 256.841298][ T30] audit: type=1400 audit(1755668442.380:612): avc: denied { mounton } for pid=12558 comm="syz.4.993" path="/174/file0" dev="tmpfs" ino=945 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 256.875081][T12550] netlink: zone id is out of range [ 256.911231][T12550] netlink: zone id is out of range [ 256.965757][ T5919] usb usb2-port1: unable to enumerate USB device [ 257.005904][ T30] audit: type=1400 audit(1755668442.430:613): avc: denied { write } for pid=12558 comm="syz.4.993" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 257.431451][T12562] input: syz0 as /devices/virtual/input/input50 [ 257.533999][T12573] overlayfs: failed to clone lowerpath [ 257.771173][T12577] netlink: 'syz.4.998': attribute type 6 has an invalid length. [ 257.984341][T12582] comedi: No check for data length of config insn id 8 is implemented [ 257.993949][T12582] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 258.016099][T12582] comedi: Assuming n=885 is correct [ 258.032394][T12577] netlink: 28 bytes leftover after parsing attributes in process `syz.4.998'. [ 258.186788][T12577] netem: change failed [ 258.335708][T12596] IPv6: sit1: Disabled Multicast RS [ 258.361163][T12596] sit1: entered allmulticast mode [ 258.535660][T12596] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1004'. [ 258.621890][T12596] input: syz1 as /devices/virtual/input/input51 [ 258.774409][T12610] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1007'. [ 258.791385][T12610] geneve2: entered allmulticast mode [ 259.293910][T12623] netlink: 1204 bytes leftover after parsing attributes in process `syz.1.1012'. [ 259.792497][T12642] overlayfs: failed to clone upperpath [ 259.905623][ T5891] usb 5-1: new full-speed USB device number 39 using dummy_hcd [ 260.107892][ T5891] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 260.116710][ T5891] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 260.143629][T12651] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1017'. [ 260.153751][T12651] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1017'. [ 260.165518][T12651] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1017'. [ 260.195548][ T5891] usb 5-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 260.274726][ T5891] usb 5-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 255, setting to 64 [ 260.320060][ T5891] usb 5-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 260.370810][ T5891] usb 5-1: config 0 interface 0 has no altsetting 0 [ 260.396210][ T5891] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 260.412014][ T5891] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 260.420607][ T5891] usb 5-1: Product: syz [ 260.430779][ T5891] usb 5-1: Manufacturer: syz [ 260.477995][ T5891] usb 5-1: SerialNumber: syz [ 260.641860][ T5891] usb 5-1: config 0 descriptor?? [ 260.655988][T12635] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 260.666515][ T5891] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 260.706626][ T5891] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 260.895012][ T24] usb 5-1: USB disconnect, device number 39 [ 260.901710][ T24] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 261.290661][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 261.290679][ T30] audit: type=1400 audit(1755668446.910:648): avc: denied { nlmsg_read } for pid=12659 comm="syz.3.1020" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 261.784997][T12670] netlink: 'syz.4.1024': attribute type 10 has an invalid length. [ 261.794363][ T30] audit: type=1400 audit(1755668447.420:649): avc: denied { read } for pid=12668 comm="syz.5.1022" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 261.795814][T12670] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 261.913689][T12671] binder: 12668:12671 ioctl 40286608 200000000000 returned -22 [ 261.923555][T12670] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 261.940922][T12670] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 262.020505][T12679] netlink: 202232 bytes leftover after parsing attributes in process `syz.5.1026'. [ 262.049574][ T30] audit: type=1400 audit(1755668447.420:650): avc: denied { open } for pid=12668 comm="syz.5.1022" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 262.108227][T12670] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 262.136438][T12680] overlayfs: failed to resolve './file1': -2 [ 262.355024][ T30] audit: type=1400 audit(1755668447.530:651): avc: denied { ioctl } for pid=12668 comm="syz.5.1022" path="/dev/binderfs/binder0" dev="binder" ino=10 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 262.380502][ T30] audit: type=1400 audit(1755668447.530:652): avc: denied { set_context_mgr } for pid=12668 comm="syz.5.1022" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 262.390251][T12679] net_ratelimit: 489 callbacks suppressed [ 262.390265][T12679] netlink: zone id is out of range [ 262.414858][T12679] netlink: zone id is out of range [ 262.427789][T12679] netlink: zone id is out of range [ 262.439742][T12679] netlink: zone id is out of range [ 262.467621][T12679] netlink: zone id is out of range [ 262.482028][T12679] netlink: zone id is out of range [ 262.489990][ T30] audit: type=1400 audit(1755668447.550:653): avc: denied { bind } for pid=12668 comm="syz.5.1022" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 262.520357][T12679] netlink: zone id is out of range [ 262.535071][T12679] netlink: zone id is out of range [ 262.543632][T12679] netlink: zone id is out of range [ 262.549229][T12679] netlink: zone id is out of range [ 262.665422][ T30] audit: type=1400 audit(1755668448.280:654): avc: denied { create } for pid=12688 comm="syz.2.1031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 263.079808][ T9] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 263.126233][ T30] audit: type=1400 audit(1755668448.280:655): avc: denied { setopt } for pid=12688 comm="syz.2.1031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 263.166226][ T30] audit: type=1400 audit(1755668448.330:656): avc: denied { mount } for pid=12692 comm="syz.5.1032" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 263.526895][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 263.548516][ T9] usb 6-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 263.564947][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.620930][ T9] usb 6-1: config 0 descriptor?? [ 263.629155][ T30] audit: type=1400 audit(1755668448.510:657): avc: denied { getopt } for pid=12688 comm="syz.2.1031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 263.856339][ T9] asix 6-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 264.089576][T12709] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1035'. [ 264.657707][T12722] netlink: 202232 bytes leftover after parsing attributes in process `syz.4.1040'. [ 264.679423][T12720] block nbd1: NBD_DISCONNECT [ 264.684421][T12720] block nbd1: Disconnected due to user request. [ 264.691933][T12720] block nbd1: shutting down sockets [ 264.881151][T12729] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1042'. [ 265.272509][T12738] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.1045'. [ 265.418719][T12740] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 265.426180][T12740] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 265.445863][T12740] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 265.453360][T12740] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 265.489404][T12742] netlink: 63503 bytes leftover after parsing attributes in process `syz.3.1047'. [ 265.977136][ T9] asix 6-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 266.008983][ T9] asix 6-1:0.0: probe with driver asix failed with error -71 [ 266.021414][ T9] usb 6-1: USB disconnect, device number 7 [ 266.344843][T12753] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1049'. [ 266.353916][T12753] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1049'. [ 266.363024][T12753] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1049'. [ 266.808749][T12761] input: syz0 as /devices/virtual/input/input52 [ 267.005472][T12763] input: syz0 as /devices/virtual/input/input53 [ 267.310135][T12766] netlink: 202232 bytes leftover after parsing attributes in process `syz.3.1052'. [ 267.794673][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 267.794689][ T30] audit: type=1400 audit(1755668453.410:678): avc: denied { name_bind } for pid=12775 comm="syz.1.1057" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 267.851662][ T30] audit: type=1400 audit(1755668453.450:679): avc: denied { bind } for pid=12774 comm="syz.3.1056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 267.870853][ C0] vkms_vblank_simulate: vblank timer overrun [ 267.983374][ T30] audit: type=1400 audit(1755668453.460:680): avc: denied { read } for pid=12775 comm="syz.1.1057" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 268.355682][ T3091] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 268.466522][T12806] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1064'. [ 268.497572][ T3091] usb 2-1: device descriptor read/64, error -71 [ 268.589627][ T5918] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 268.735530][ T3091] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 268.807143][ T5918] usb 3-1: not running at top speed; connect to a high speed hub [ 268.816023][ T5918] usb 3-1: config 1 has an invalid interface number: 78 but max is 0 [ 268.827941][ T5918] usb 3-1: config 1 has no interface number 0 [ 268.834057][ T5918] usb 3-1: config 1 interface 78 has no altsetting 0 [ 268.885710][ T3091] usb 2-1: device descriptor read/64, error -71 [ 268.893401][T12816] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12816 comm=syz.3.1068 [ 268.907547][ T5918] usb 3-1: New USB device found, idVendor=11ba, idProduct=1001, bcdDevice=ec.57 [ 268.919092][ T5918] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.928541][ T5918] usb 3-1: Product: syz [ 268.934794][ T5918] usb 3-1: Manufacturer: syz [ 268.952275][ T5918] usb 3-1: SerialNumber: syz [ 268.966765][T12817] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1067'. [ 268.976809][T12817] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1067'. [ 268.987238][T12817] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1067'. [ 269.088831][ T3091] usb usb2-port1: attempt power cycle [ 269.445596][ T3091] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 269.464975][T12804] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.474984][ T3091] usb 2-1: device descriptor read/8, error -71 [ 269.481978][T12804] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.522619][ T5918] pvrusb2: Hardware description: OnAir USB2 Hybrid USB tuner [ 269.538923][ T5918] usb 3-1: selecting invalid altsetting 0 [ 269.554598][ T2336] pvrusb2: control-write URB failure, status=-71 [ 269.564683][ T2336] pvrusb2: Device being rendered inoperable [ 269.573074][ T5918] usb 3-1: USB disconnect, device number 27 [ 269.594657][ T2336] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 269.814016][ T2336] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 269.855758][ T3091] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 269.876476][ T3091] usb 2-1: device descriptor read/8, error -71 [ 269.926076][T12829] /dev/nullb0: Can't open blockdev [ 269.948525][ T30] audit: type=1400 audit(1755668455.550:681): avc: denied { mounton } for pid=12821 comm="syz.5.1070" path="/syzcgroup/unified/syz5" dev="cgroup2" ino=430 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 269.972334][ C0] vkms_vblank_simulate: vblank timer overrun [ 269.985654][ T30] audit: type=1400 audit(1755668455.550:682): avc: denied { write } for pid=12821 comm="syz.5.1070" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 270.004952][ C0] vkms_vblank_simulate: vblank timer overrun [ 270.034721][T12833] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1070'. [ 270.066259][ T3091] usb usb2-port1: unable to enumerate USB device [ 270.088414][T12835] block nbd4: NBD_DISCONNECT [ 270.093450][T12835] block nbd4: Disconnected due to user request. [ 270.115021][T12835] block nbd4: shutting down sockets [ 270.249771][ T30] audit: type=1400 audit(1755668455.730:683): avc: denied { name_connect } for pid=12821 comm="syz.5.1070" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 270.310558][ T30] audit: type=1400 audit(1755668455.770:684): avc: denied { getopt } for pid=12825 comm="syz.3.1071" lport=53400 faddr=172.30.0.4 fport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 270.372108][ T30] audit: type=1400 audit(1755668455.900:685): avc: denied { create } for pid=12839 comm="syz.2.1073" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 270.408853][T12846] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1073'. [ 270.445979][ T30] audit: type=1400 audit(1755668455.930:686): avc: denied { bind } for pid=12841 comm="syz.4.1074" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 270.517251][ T30] audit: type=1400 audit(1755668455.930:687): avc: denied { read write } for pid=12841 comm="syz.4.1074" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 270.924025][T12850] SELinux: security_context_str_to_sid (Eá…) failed with errno=-22 [ 271.180937][T12863] comedi: No check for data length of config insn id 8 is implemented [ 271.191007][T12863] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 271.200552][T12863] comedi: Assuming n=880 is correct [ 271.233813][T12867] FAULT_INJECTION: forcing a failure. [ 271.233813][T12867] name failslab, interval 1, probability 0, space 0, times 0 [ 271.246942][T12867] CPU: 0 UID: 0 PID: 12867 Comm: syz.2.1084 Not tainted syzkaller #0 PREEMPT(full) [ 271.246967][T12867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 271.246978][T12867] Call Trace: [ 271.246983][T12867] [ 271.246989][T12867] dump_stack_lvl+0x16c/0x1f0 [ 271.247014][T12867] should_fail_ex+0x512/0x640 [ 271.247035][T12867] should_failslab+0xc2/0x120 [ 271.247054][T12867] __kmalloc_cache_noprof+0x6a/0x3e0 [ 271.247080][T12867] ? audit_log_d_path+0xe7/0x200 [ 271.247095][T12867] ? get_mm_exe_file+0x6f/0x1a0 [ 271.247118][T12867] audit_log_d_path+0xe7/0x200 [ 271.247132][T12867] audit_log_d_path_exe+0x46/0x70 [ 271.247148][T12867] audit_log_task+0x31d/0x3f0 [ 271.247165][T12867] ? __pfx_audit_log_task+0x10/0x10 [ 271.247184][T12867] ? __pfx_migrate_enable+0x10/0x10 [ 271.247203][T12867] ? lock_release+0x201/0x2f0 [ 271.247228][T12867] audit_seccomp+0x79/0x290 [ 271.247251][T12867] __seccomp_filter+0x7b6/0xea0 [ 271.247277][T12867] ? __pfx___seccomp_filter+0x10/0x10 [ 271.247304][T12867] ? fput+0x9b/0xd0 [ 271.247326][T12867] ? ksys_write+0x1ac/0x250 [ 271.247343][T12867] __secure_computing+0x287/0x3b0 [ 271.247369][T12867] syscall_trace_enter+0x89/0x240 [ 271.247388][T12867] do_syscall_64+0x347/0x4c0 [ 271.247407][T12867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.247424][T12867] RIP: 0033:0x7f78f7f8ebe9 [ 271.247437][T12867] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 271.247452][T12867] RSP: 002b:00007f78f8e4d038 EFLAGS: 00000246 ORIG_RAX: 00000000000001cb [ 271.247469][T12867] RAX: ffffffffffffffda RBX: 00007f78f81b5fa0 RCX: 00007f78f7f8ebe9 [ 271.247479][T12867] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000065 [ 271.247489][T12867] RBP: 00007f78f8e4d090 R08: 0000000000000000 R09: 0000000000000000 [ 271.247499][T12867] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 271.247509][T12867] R13: 00007f78f81b6038 R14: 00007f78f81b5fa0 R15: 00007ffc909bab38 [ 271.247524][T12867] [ 271.457594][ C0] vkms_vblank_simulate: vblank timer overrun [ 271.571713][T12873] CIFS: VFS: Malformed UNC in devname [ 271.676990][T12876] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1087'. [ 271.705516][ T9] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 271.907968][ T9] usb 2-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 271.917465][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.925575][ T5847] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 271.933817][ T9] usb 2-1: config 0 descriptor?? [ 271.940857][ T9] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 271.961456][T12879] input: syz0 as /devices/virtual/input/input54 [ 272.087782][ T5847] usb 5-1: Using ep0 maxpacket: 8 [ 272.108639][ T5847] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 272.122972][ T5847] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.166748][ T5847] pvrusb2: Hardware description: Terratec Grabster AV400 [ 272.184162][T12882] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1088'. [ 272.197204][ T5847] pvrusb2: ********** [ 272.203707][T12882] netem: change failed [ 272.208145][ T5847] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 272.258132][ T5847] pvrusb2: Important functionality might not be entirely working. [ 272.293672][ T5847] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 272.313222][ T5847] pvrusb2: ********** [ 272.347267][ T9] gspca_cpia1: usb_control_msg 03, error -32 [ 272.355621][ T9] gspca_cpia1: usb_control_msg 03, error -71 [ 272.402332][ T9] gspca_cpia1: usb_control_msg 01, error -71 [ 272.412140][ T9] cpia1 2-1:0.0: only firmware version 1 is supported (got: 0) [ 272.439128][ T9] usb 2-1: USB disconnect, device number 46 [ 272.545508][ T5918] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 272.980003][ T5918] usb 6-1: device descriptor read/64, error -71 [ 273.135499][ T30] kauditd_printk_skb: 37 callbacks suppressed [ 273.135516][ T30] audit: type=1400 audit(1755668458.750:725): avc: denied { write } for pid=12891 comm="syz.1.1092" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 273.245534][ T5918] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 273.664010][ T30] audit: type=1326 audit(1755668459.280:726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12894 comm="syz.1.1093" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f322078ebe9 code=0x0 [ 273.676956][T12898] syzkaller1: entered promiscuous mode [ 273.686910][ C0] vkms_vblank_simulate: vblank timer overrun [ 273.701042][T12898] syzkaller1: entered allmulticast mode [ 273.708663][T12898] FAULT_INJECTION: forcing a failure. [ 273.708663][T12898] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 273.724128][T12898] CPU: 1 UID: 0 PID: 12898 Comm: syz.2.1094 Not tainted syzkaller #0 PREEMPT(full) [ 273.724152][T12898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 273.724162][T12898] Call Trace: [ 273.724168][T12898] [ 273.724174][T12898] dump_stack_lvl+0x16c/0x1f0 [ 273.724196][T12898] should_fail_ex+0x512/0x640 [ 273.724218][T12898] _copy_from_iter+0x29f/0x16f0 [ 273.724245][T12898] ? _copy_from_iter+0x15d/0x16f0 [ 273.724265][T12898] ? __pfx__copy_from_iter+0x10/0x10 [ 273.724287][T12898] ? __pfx__copy_from_iter+0x10/0x10 [ 273.724309][T12898] ? _copy_from_iter+0x15d/0x16f0 [ 273.724331][T12898] copy_page_from_iter+0xde/0x180 [ 273.724354][T12898] skb_copy_datagram_from_iter+0x2a0/0x740 [ 273.724385][T12898] tun_get_user+0x185c/0x3ce0 [ 273.724413][T12898] ? __pfx_tun_get_user+0x10/0x10 [ 273.724437][T12898] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 273.724462][T12898] ? tun_get+0x191/0x370 [ 273.724481][T12898] ? rcu_is_watching+0x12/0xc0 [ 273.724501][T12898] ? lock_release+0x201/0x2f0 [ 273.724529][T12898] tun_chr_write_iter+0xdc/0x210 [ 273.724553][T12898] vfs_write+0x7d3/0x11d0 [ 273.724571][T12898] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 273.724595][T12898] ? __pfx_vfs_write+0x10/0x10 [ 273.724612][T12898] ? lock_release+0x201/0x2f0 [ 273.724643][T12898] ksys_write+0x12a/0x250 [ 273.724659][T12898] ? __pfx_ksys_write+0x10/0x10 [ 273.724679][T12898] do_syscall_64+0xcd/0x4c0 [ 273.724698][T12898] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.724716][T12898] RIP: 0033:0x7f78f7f8ebe9 [ 273.724735][T12898] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 273.724752][T12898] RSP: 002b:00007f78f8e4d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 273.724770][T12898] RAX: ffffffffffffffda RBX: 00007f78f81b5fa0 RCX: 00007f78f7f8ebe9 [ 273.724781][T12898] RDX: 000000000000fdef RSI: 0000200000000100 RDI: 0000000000000003 [ 273.724791][T12898] RBP: 00007f78f8e4d090 R08: 0000000000000000 R09: 0000000000000000 [ 273.724802][T12898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 273.724812][T12898] R13: 00007f78f81b6038 R14: 00007f78f81b5fa0 R15: 00007ffc909bab38 [ 273.724829][T12898] [ 273.775790][ T5918] usb 6-1: device descriptor read/64, error -71 [ 273.963339][T12903] syz_tun: entered allmulticast mode [ 273.970273][T12902] SELinux: failure in sel_netif_sid_slow(), invalid network interface (0) [ 273.978890][T12902] net_ratelimit: 1492 callbacks suppressed [ 273.978904][T12902] mroute: pending queue full, dropping entries [ 273.994669][T12902] SELinux: failure in sel_netif_sid_slow(), invalid network interface (0) [ 274.003298][T12902] mroute: pending queue full, dropping entries [ 274.010601][T12902] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1095'. [ 274.021678][T12901] syz_tun: left allmulticast mode [ 274.077902][ T5918] usb usb6-port1: attempt power cycle [ 274.085986][ T5168] Bluetooth: hci3: unexpected event for opcode 0x2024 [ 274.492346][T12918] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1099'. [ 274.908177][ T5918] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 274.928087][ T2336] pvrusb2: Invalid write control endpoint [ 274.936618][ T5847] usb 5-1: USB disconnect, device number 40 [ 274.939089][ T5918] usb 6-1: device descriptor read/8, error -71 [ 274.978431][ T2336] pvrusb2: Invalid write control endpoint [ 274.988472][ T2336] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 275.002010][ T2336] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 275.010126][ T2336] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 275.022756][ T2336] pvrusb2: Device being rendered inoperable [ 275.030728][ T2336] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 275.041155][ T2336] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 275.049488][ T2336] pvrusb2: Attached sub-driver cx25840 [ 275.069481][ T2336] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 275.135477][ T2336] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 275.205273][ T30] audit: type=1400 audit(1755668460.820:727): avc: denied { connect } for pid=12933 comm="syz.3.1105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 275.255527][ T5918] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 275.285891][ T5918] usb 6-1: device descriptor read/8, error -71 [ 275.384390][ T30] audit: type=1400 audit(1755668460.920:728): avc: denied { ioctl } for pid=12927 comm="syz.2.1103" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 275.423617][ T5918] usb usb6-port1: unable to enumerate USB device [ 275.447311][ T30] audit: type=1400 audit(1755668460.920:729): avc: denied { mount } for pid=12927 comm="syz.2.1103" name="/" dev="hugetlbfs" ino=25560 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 275.575581][ T5847] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 275.782937][ T30] audit: type=1400 audit(1755668461.220:730): avc: denied { append } for pid=12939 comm="syz.1.1107" name="comedi3" dev="devtmpfs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 275.807475][ T5847] usb 5-1: Using ep0 maxpacket: 8 [ 275.814577][ T30] audit: type=1400 audit(1755668461.230:731): avc: denied { connect } for pid=12939 comm="syz.1.1107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 276.192337][ T30] audit: type=1400 audit(1755668461.230:732): avc: denied { setopt } for pid=12939 comm="syz.1.1107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 276.211962][ T5847] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 276.220194][ T5847] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 276.230048][ T5847] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 276.309941][ T5847] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 276.320284][ T5847] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 276.333959][ T5847] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 276.344063][ T5847] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.646981][ T5847] usb 5-1: GET_CAPABILITIES returned 0 [ 276.660066][ T5847] usbtmc 5-1:16.0: can't read capabilities [ 276.838124][T12958] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12958 comm=syz.1.1111 [ 277.114431][ T30] audit: type=1400 audit(1755668462.730:733): avc: denied { write } for pid=12922 comm="syz.4.1101" name="usbtmc0" dev="devtmpfs" ino=3288 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 277.220284][T12923] usbtmc 5-1:16.0: usb_control_msg returned -71 [ 277.227473][T12965] usbtmc 5-1:16.0: send_request_dev_dep_msg_in returned -90 [ 277.228980][ T9] usb 5-1: USB disconnect, device number 41 [ 277.276280][T12971] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1114'. [ 277.349895][T12977] (unnamed net_device) (uninitialized): option downdelay: invalid value (18446744073709551609) [ 277.361363][ T30] audit: type=1326 audit(1755668462.970:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12975 comm="syz.5.1117" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f13ea98ebe9 code=0x7ffc0000 [ 277.457132][T12983] PKCS7: Unknown OID: [5] (bad) [ 277.462171][T12983] PKCS7: Only support pkcs7_signedData type [ 277.508520][T12977] (unnamed net_device) (uninitialized): option downdelay: allowed values 0 - 2147483647 [ 277.728293][T12988] overlayfs: failed to resolve './file0': -2 [ 277.745495][ T5847] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 277.946681][T12977] nbd1: detected capacity change from 0 to 127 [ 277.968234][ T5168] block nbd1: Receive control failed (result -104) [ 278.013327][T12991] netlink: 202232 bytes leftover after parsing attributes in process `syz.5.1119'. [ 278.037339][T12991] netlink: zone id is out of range [ 278.052887][T12991] netlink: zone id is out of range [ 278.095552][ T5847] usb 2-1: Using ep0 maxpacket: 32 [ 278.105648][ T5847] usb 2-1: config 0 has no interfaces? [ 278.133853][ T5847] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 278.185876][ T5847] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 278.288624][ T5847] usb 2-1: Product: syz [ 278.329497][ T123] block nbd0: Possible stuck request ffff888027237000: control (read@0,1024B). Runtime 90 seconds [ 278.340244][ T123] block nbd0: Possible stuck request ffff8880272371c0: control (read@1024,1024B). Runtime 90 seconds [ 278.351135][ T123] block nbd0: Possible stuck request ffff888027237380: control (read@2048,1024B). Runtime 90 seconds [ 278.361972][ T123] block nbd0: Possible stuck request ffff888027237540: control (read@3072,1024B). Runtime 90 seconds [ 278.452490][ T5847] usb 2-1: Manufacturer: syz [ 278.463091][ T5847] usb 2-1: SerialNumber: syz [ 278.568442][ T5847] usb 2-1: config 0 descriptor?? [ 278.625721][ T9] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 278.814972][T13008] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13008 comm=syz.4.1124 [ 279.137646][ T30] kauditd_printk_skb: 54 callbacks suppressed [ 279.137663][ T30] audit: type=1400 audit(1755668464.760:789): avc: denied { getopt } for pid=13011 comm="syz.4.1126" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 279.165697][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 279.240060][T13015] fuse: Bad value for 'fd' [ 279.276999][ T9] usb 6-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 279.291263][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.380246][ T9] usb 6-1: Product: syz [ 279.391721][ T9] usb 6-1: Manufacturer: syz [ 279.420965][ T9] usb 6-1: SerialNumber: syz [ 279.427442][ T30] audit: type=1400 audit(1755668465.030:790): avc: denied { setopt } for pid=13018 comm="syz.4.1127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 279.448624][ T9] usb 6-1: config 0 descriptor?? [ 279.479178][ T30] audit: type=1400 audit(1755668465.090:791): avc: denied { create } for pid=13018 comm="syz.4.1127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 279.501778][ T9] gspca_main: se401-2.14.0 probing 047d:5003 [ 279.582343][ T30] audit: type=1400 audit(1755668465.090:792): avc: denied { read } for pid=13018 comm="syz.4.1127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 279.914336][ T9] gspca_se401: Wrong descriptor type [ 280.166588][T13047] input: syz0 as /devices/virtual/input/input55 [ 280.200752][T12996] netlink: 4400 bytes leftover after parsing attributes in process `syz.5.1120'. [ 280.228478][T12996] workqueue: name exceeds WQ_NAME_LEN. Truncating to: Ç`]Š •Iöq¯!¾>Ýsó³Îú*Š®!)\Ç+` [ 280.415661][ T5891] usb 2-1: USB disconnect, device number 47 [ 280.517409][T13052] input: syz0 as /devices/virtual/input/input56 [ 281.396017][ T9] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 281.478546][ T5847] usb 6-1: USB disconnect, device number 12 [ 281.510248][ T30] audit: type=1400 audit(1755668467.120:793): avc: denied { bind } for pid=13071 comm="syz.2.1140" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 281.558052][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 281.620730][ T30] audit: type=1400 audit(1755668467.120:794): avc: denied { name_bind } for pid=13071 comm="syz.2.1140" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 281.650595][ T30] audit: type=1400 audit(1755668467.120:795): avc: denied { node_bind } for pid=13071 comm="syz.2.1140" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 281.675290][ T9] usb 2-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 282.226449][ T30] audit: type=1400 audit(1755668467.820:796): avc: denied { create } for pid=13078 comm="syz.2.1142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 282.286467][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.295788][ T9] usb 2-1: config 0 descriptor?? [ 282.308068][ T30] audit: type=1400 audit(1755668467.830:797): avc: denied { read } for pid=13078 comm="syz.2.1142" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 282.919153][ T30] audit: type=1400 audit(1755668467.830:798): avc: denied { open } for pid=13078 comm="syz.2.1142" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 283.171822][ T9] lenovo 0003:17EF:6047.0016: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.1-1/input0 [ 283.462447][T13113] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1150'. [ 283.586249][ T9] lenovo 0003:17EF:6047.0016: Failed to switch middle button: -71 [ 283.595107][ T9] lenovo 0003:17EF:6047.0016: Fn-lock setting failed: -71 [ 283.619848][T13117] syzkaller1: entered promiscuous mode [ 283.625383][T13117] syzkaller1: entered allmulticast mode [ 283.633901][ T9] lenovo 0003:17EF:6047.0016: Sensitivity setting failed: -71 [ 283.647056][ T9] usb 2-1: USB disconnect, device number 48 [ 283.865642][ T5918] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 284.178594][ T5918] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 284.193222][ T5918] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 284.208005][ T5918] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 284.221332][ T5918] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 284.234183][ T5918] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 284.246964][ T5918] usb 5-1: config 0 descriptor?? [ 284.279876][T13137] netlink: 80 bytes leftover after parsing attributes in process `syz.3.1155'. [ 284.643154][T13139] tmpfs: Unknown parameter '3ã<Œù ¾' [ 284.706975][T13149] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1158'. [ 284.776802][T13149] netem: change failed [ 284.853688][T13156] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1162'. [ 284.877053][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 284.877068][ T30] audit: type=1400 audit(1755668470.500:807): avc: denied { listen } for pid=13157 comm="syz.3.1161" lport=56279 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 284.915555][ T30] audit: type=1400 audit(1755668470.530:808): avc: denied { accept } for pid=13157 comm="syz.3.1161" lport=56279 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 284.938800][ T30] audit: type=1400 audit(1755668470.530:809): avc: denied { setopt } for pid=13157 comm="syz.3.1161" lport=56279 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 285.762546][T13176] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1166'. [ 285.771878][T13176] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1166'. [ 285.787017][T13176] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1166'. [ 286.843478][ T5918] usbhid 5-1:0.0: can't add hid device: -71 [ 286.848249][T13190] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1172'. [ 286.865633][ T5918] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 286.871014][T13190] netem: change failed [ 286.878471][ T5918] usb 5-1: USB disconnect, device number 42 [ 287.517119][T13205] netlink: 202232 bytes leftover after parsing attributes in process `syz.5.1176'. [ 287.546008][T13205] netlink: zone id is out of range [ 287.551154][T13205] netlink: zone id is out of range [ 287.562855][T13205] netlink: zone id is out of range [ 287.569321][T13205] netlink: zone id is out of range [ 287.574985][T13205] netlink: zone id is out of range [ 287.581774][T13205] netlink: zone id is out of range [ 287.587227][T13205] netlink: zone id is out of range [ 287.592485][T13205] netlink: zone id is out of range [ 287.598537][T13205] netlink: zone id is out of range [ 287.604469][T13205] netlink: zone id is out of range [ 287.765561][ T5918] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 288.096913][T13220] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1183'. [ 288.106218][ T5918] usb 2-1: Using ep0 maxpacket: 32 [ 288.106906][T13220] netem: change failed [ 288.112703][ T5918] usb 2-1: config 4 has an invalid interface number: 8 but max is 0 [ 288.124529][ T5918] usb 2-1: config 4 has no interface number 0 [ 288.131808][ T5918] usb 2-1: config 4 interface 8 altsetting 1 endpoint 0x8A has invalid wMaxPacketSize 0 [ 288.142673][ T5918] usb 2-1: config 4 interface 8 altsetting 1 bulk endpoint 0x8A has invalid maxpacket 0 [ 288.487260][ T5918] usb 2-1: config 4 interface 8 has no altsetting 0 [ 288.509473][ T5918] usb 2-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice=60.65 [ 288.518918][ T5918] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.531556][ T5918] usb 2-1: Product: syz [ 288.547251][ T5918] usb 2-1: Manufacturer: syz [ 288.553301][ T5918] usb 2-1: SerialNumber: syz [ 288.562464][T13231] overlayfs: failed to clone upperpath [ 288.710330][T13233] overlayfs: failed to clone upperpath [ 288.807454][ T5918] opticon 2-1:4.8: opticon converter detected [ 288.875880][T13242] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1188'. [ 288.887539][T13242] geneve2: entered allmulticast mode [ 289.345711][ T5918] usb 2-1: opticon converter now attached to ttyUSB0 [ 289.374884][ T5918] usb 2-1: USB disconnect, device number 49 [ 289.383891][ T5918] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 289.399777][ T5918] opticon 2-1:4.8: device disconnected [ 289.409741][T13248] overlayfs: failed to clone upperpath [ 289.913922][T13256] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1194'. [ 289.923474][T13256] netem: change failed [ 289.946888][T13254] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13254 comm=syz.3.1193 [ 289.962614][T13254] netlink: 'syz.3.1193': attribute type 1 has an invalid length. [ 290.029741][T13259] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1193'. [ 290.119836][ T30] audit: type=1400 audit(1755668475.740:810): avc: denied { create } for pid=13264 comm="syz.3.1197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 290.164767][T13267] block nbd1: NBD_DISCONNECT [ 290.172788][T13267] block nbd1: Send disconnect failed -32 [ 290.184592][T13267] block nbd1: shutting down sockets [ 290.214061][ C1] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 290.223131][ C1] Buffer I/O error on dev nbd1, logical block 0, async page read [ 290.230916][ C1] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 290.239958][ C1] Buffer I/O error on dev nbd1, logical block 1, async page read [ 290.247716][ C1] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 290.256761][ C1] Buffer I/O error on dev nbd1, logical block 2, async page read [ 290.264498][ C1] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 290.273534][ C1] Buffer I/O error on dev nbd1, logical block 3, async page read [ 290.338354][ T6074] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 290.347499][ T30] audit: type=1400 audit(1755668475.820:811): avc: denied { write } for pid=13264 comm="syz.3.1197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 290.376240][ T6074] Buffer I/O error on dev nbd1, logical block 0, async page read [ 290.412048][ T6074] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 290.423807][ T6074] Buffer I/O error on dev nbd1, logical block 1, async page read [ 290.435557][ T30] audit: type=1400 audit(1755668476.060:812): avc: denied { read } for pid=13271 comm="syz.3.1198" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 290.515899][ T6074] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 290.529470][ T30] audit: type=1400 audit(1755668476.110:813): avc: denied { write } for pid=13271 comm="syz.3.1198" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 290.554453][ T6074] Buffer I/O error on dev nbd1, logical block 2, async page read [ 290.647320][ T5847] usb 3-1: new low-speed USB device number 28 using dummy_hcd [ 290.655823][T13275] overlayfs: failed to clone upperpath [ 290.780831][ T30] audit: type=1400 audit(1755668476.120:814): avc: denied { getopt } for pid=13271 comm="syz.3.1198" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 290.846394][ T6074] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 291.273933][ T6074] Buffer I/O error on dev nbd1, logical block 3, async page read [ 291.282957][ T6074] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 291.294091][ T6074] Buffer I/O error on dev nbd1, logical block 0, async page read [ 291.315474][ T6074] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 291.325511][ T6074] Buffer I/O error on dev nbd1, logical block 1, async page read [ 291.355898][ T6074] ldm_validate_partition_table(): Disk read failed. [ 291.395992][ T6074] Dev nbd1: unable to read RDB block 0 [ 291.435920][ T6074] nbd1: unable to read partition table [ 291.450533][ T6074] ldm_validate_partition_table(): Disk read failed. [ 291.458194][ T6074] Dev nbd1: unable to read RDB block 0 [ 291.476222][ T6074] nbd1: unable to read partition table [ 291.629557][ T5847] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 291.640641][ T5847] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 291.653928][ T5847] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.735619][T13291] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 sclass=netlink_tcpdiag_socket pid=13291 comm=syz.1.1204 [ 291.814190][ T5847] usb 3-1: config 0 descriptor?? [ 292.229569][T13303] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1208'. [ 292.315554][ T30] audit: type=1400 audit(1755668477.890:815): avc: denied { mount } for pid=13295 comm="syz.3.1207" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 292.536304][T13303] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1208'. [ 292.546619][T13303] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1208'. [ 293.392324][ T30] audit: type=1400 audit(1755668479.000:816): avc: denied { execute } for pid=13312 comm="syz.5.1211" path="/95/cpu.stat" dev="tmpfs" ino=547 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 293.495560][ T5847] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 293.506139][ T5918] usb 3-1: USB disconnect, device number 28 [ 293.665770][T13321] input: syz0 as /devices/virtual/input/input57 [ 293.739697][ T30] audit: type=1800 audit(1755668479.330:817): pid=13325 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.1214" name="file1" dev="tmpfs" ino=1732 res=0 errno=0 [ 293.762397][ T5847] usb 5-1: Using ep0 maxpacket: 32 [ 293.779762][ T5847] usb 5-1: config 0 has an invalid interface number: 125 but max is 0 [ 293.861815][ T5847] usb 5-1: config 0 has no interface number 0 [ 293.869423][T13330] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1213'. [ 293.884110][ T5847] usb 5-1: config 0 interface 125 has no altsetting 0 [ 293.893951][ T5847] usb 5-1: New USB device found, idVendor=1039, idProduct=2120, bcdDevice= 2.a7 [ 293.903679][ T5847] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.911973][ T5847] usb 5-1: Product: syz [ 293.918127][ T5847] usb 5-1: Manufacturer: syz [ 293.922781][ T5847] usb 5-1: SerialNumber: syz [ 293.929516][ T5847] usb 5-1: config 0 descriptor?? [ 294.005519][ T3091] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 294.139586][ T5847] usb 5-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2120) Rev (0X2A7): Eagle II [ 294.192678][ T3091] usb 2-1: Using ep0 maxpacket: 32 [ 294.236392][ T3091] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 294.249264][ T3091] usb 2-1: New USB device found, idVendor=1630, idProduct=0042, bcdDevice=5b.13 [ 294.258434][ T3091] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.267117][ T3091] usb 2-1: Product: syz [ 294.271349][ T3091] usb 2-1: Manufacturer: syz [ 294.275983][ T3091] usb 2-1: SerialNumber: syz [ 294.288217][ T3091] usb 2-1: config 0 descriptor?? [ 294.376617][ T3091] rndis_host 2-1:0.0: skipping garbage [ 294.382231][ T3091] usb 2-1: bad CDC descriptors [ 294.413772][T13341] sctp: [Deprecated]: syz.3.1219 (pid 13341) Use of struct sctp_assoc_value in delayed_ack socket option. [ 294.413772][T13341] Use struct sctp_sack_info instead [ 294.645810][ T30] audit: type=1400 audit(1755668480.260:818): avc: denied { ioctl } for pid=13326 comm="syz.1.1215" path="socket:[27242]" dev="sockfs" ino=27242 ioctlcmd=0x89ef scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 294.696040][ T5847] usb 5-1: reset high-speed USB device number 43 using dummy_hcd [ 294.754562][ T5847] usb 5-1: device reset changed ep0 maxpacket size! [ 294.765010][ T5847] ueagle-atm 5-1:0.125: usbatm_usb_probe: bind failed: -19! [ 294.774864][T13327] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 294.782093][T13327] IPv6: NLM_F_CREATE should be set when creating new route [ 294.789314][T13327] IPv6: NLM_F_CREATE should be set when creating new route [ 294.796520][T13327] IPv6: NLM_F_CREATE should be set when creating new route [ 294.975535][ T5898] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 294.978690][ T5847] usb 5-1: USB disconnect, device number 43 [ 295.162523][ T3091] libceph: connect (1)[c::]:6789 error -101 [ 295.168694][ T3091] libceph: mon0 (1)[c::]:6789 connect error [ 295.186413][ T3091] usb 2-1: USB disconnect, device number 50 [ 295.213511][ T30] audit: type=1400 audit(1755668480.660:819): avc: denied { read } for pid=13345 comm="syz.2.1221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 295.285730][ T5847] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 295.296173][ T5898] usb 6-1: Using ep0 maxpacket: 32 [ 295.303925][ T5898] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 295.312322][ T5898] usb 6-1: config 0 has no interface number 0 [ 295.318614][ T5898] usb 6-1: config 0 interface 12 has no altsetting 0 [ 295.327383][ T5898] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 295.337062][ T5898] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.345609][ T5898] usb 6-1: Product: syz [ 295.349808][ T5898] usb 6-1: Manufacturer: syz [ 295.354882][ T5898] usb 6-1: SerialNumber: syz [ 295.355599][ T24] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 295.368974][ T5898] usb 6-1: config 0 descriptor?? [ 295.425968][ T3091] libceph: connect (1)[c::]:6789 error -101 [ 295.432059][ T3091] libceph: mon0 (1)[c::]:6789 connect error [ 295.462429][ T5847] usb 5-1: unable to get BOS descriptor or descriptor too short [ 295.471651][ T5847] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 295.480196][ T5847] usb 5-1: can't read configurations, error -71 [ 295.537607][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 295.548737][ T24] usb 3-1: not running at top speed; connect to a high speed hub [ 295.561086][ T24] usb 3-1: config 5 has an invalid interface number: 246 but max is 0 [ 295.569406][ T24] usb 3-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 295.585882][ T24] usb 3-1: config 5 has no interface number 0 [ 295.592087][ T24] usb 3-1: config 5 interface 246 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 295.609331][ T24] usb 3-1: config 5 interface 246 has no altsetting 0 [ 295.618371][ T24] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=f5.e4 [ 295.627825][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.636072][ T24] usb 3-1: Product: syz [ 295.640298][ T24] usb 3-1: Manufacturer: syz [ 295.644909][ T24] usb 3-1: SerialNumber: syz [ 295.945885][ T3091] libceph: connect (1)[c::]:6789 error -101 [ 295.953962][ T3091] libceph: mon0 (1)[c::]:6789 connect error [ 296.079895][T13359] vivid-000: ================= START STATUS ================= [ 296.088252][T13359] vivid-000: Radio HW Seek Mode: Bounded [ 296.094163][T13359] vivid-000: Radio Programmable HW Seek: false [ 296.100607][T13359] vivid-000: RDS Rx I/O Mode: Block I/O [ 296.106500][T13359] vivid-000: Generate RBDS Instead of RDS: false [ 296.113577][T13359] vivid-000: RDS Reception: true [ 296.119305][T13359] vivid-000: RDS Program Type: 0 inactive [ 296.125332][T13359] vivid-000: RDS PS Name: inactive [ 296.187138][T13360] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1223'. [ 296.425338][T13359] vivid-000: RDS Radio Text: inactive [ 296.431200][T13359] vivid-000: RDS Traffic Announcement: false inactive [ 296.439310][T13359] vivid-000: RDS Traffic Program: false inactive [ 296.445934][T13359] vivid-000: RDS Music: false inactive [ 296.451550][T13359] vivid-000: ================== END STATUS ================== [ 296.814402][T13368] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1224'. [ 297.680397][ T5847] libceph: connect (1)[c::]:6789 error -101 [ 297.762461][ T5847] libceph: mon0 (1)[c::]:6789 connect error [ 297.779386][T13349] ceph: No mds server is up or the cluster is laggy [ 297.841043][ T5898] f81534 6-1:0.12: f81534_get_register: reg: 1003 failed: -32 [ 297.892023][ T5898] f81534 6-1:0.12: f81534_find_config_idx: read failed: -32 [ 297.900714][ T24] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 297.904581][ T5898] f81534 6-1:0.12: f81534_calc_num_ports: find idx failed: -32 [ 297.915745][ T51] usb 3-1: Failed to submit usb control message: -71 [ 297.919046][ T5898] f81534 6-1:0.12: probe with driver f81534 failed with error -32 [ 297.924745][ T51] usb 3-1: unable to send the bmi data to the device: -71 [ 297.971373][ T51] usb 3-1: unable to get target info from device [ 297.978421][ T51] usb 3-1: could not get target info (-71) [ 297.984434][ T51] usb 3-1: could not probe fw (-71) [ 298.021958][ T5847] usb 6-1: USB disconnect, device number 13 [ 298.062928][ T24] usb 3-1: USB disconnect, device number 29 [ 298.185615][ T5898] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 298.345510][ T5898] usb 2-1: Using ep0 maxpacket: 32 [ 298.351761][ T5898] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 298.361971][ T5898] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 298.371542][ T5898] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 298.380666][ T5898] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.385539][ T5847] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 298.397171][ T5898] usb 2-1: config 0 descriptor?? [ 298.405516][ T24] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 298.547806][ T5847] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 298.558802][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 298.564034][ T5847] usb 6-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 298.574076][ T5847] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.583378][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 298.591846][ T5847] usb 6-1: config 0 descriptor?? [ 298.597093][ T24] usb 3-1: config 2 has an invalid interface number: 215 but max is 0 [ 298.605355][ T24] usb 3-1: config 2 has no interface number 0 [ 298.611579][ T24] usb 3-1: config 2 interface 215 has no altsetting 0 [ 298.612096][T13387] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 298.619934][ T24] usb 3-1: New USB device found, idVendor=2639, idProduct=0017, bcdDevice=31.66 [ 298.634796][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.644130][ T24] usb 3-1: Product: syz [ 298.648398][ T24] usb 3-1: Manufacturer: syz [ 298.652998][ T24] usb 3-1: SerialNumber: syz [ 298.866076][T13385] fuse: Unknown parameter '000000000000000000000030x0000000000000004' [ 298.888422][T13399] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1232'. [ 298.897618][T13399] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1232'. [ 298.906916][T13399] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1232'. [ 298.972165][T13402] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 298.983722][T13402] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 299.060041][ T5847] elan 0003:04F3:0755.0017: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.5-1/input0 [ 299.585820][ T3091] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 299.759102][ T3091] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 299.776265][ T3091] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 299.788063][ T3091] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 299.801285][ T3091] usb 5-1: config 0 interface 0 has no altsetting 0 [ 299.828134][ T3091] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 299.837418][ T3091] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 299.851661][ T3091] usb 5-1: config 0 interface 0 has no altsetting 0 [ 299.939071][ T3091] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 299.948486][ T3091] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 299.959648][ T3091] usb 5-1: config 0 interface 0 has no altsetting 0 [ 299.967116][ T3091] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 299.976677][ T3091] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 299.987904][ T3091] usb 5-1: config 0 interface 0 has no altsetting 0 [ 300.026285][ T3091] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 300.037669][ T3091] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 300.050697][ T3091] usb 5-1: config 0 interface 0 has no altsetting 0 [ 300.050876][ T30] audit: type=1400 audit(1755668485.670:820): avc: denied { create } for pid=13414 comm="syz.3.1235" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 300.082418][ T30] audit: type=1400 audit(1755668485.700:821): avc: denied { mounton } for pid=13414 comm="syz.3.1235" path="/324/file0" dev="tmpfs" ino=1787 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 300.106223][ T3091] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 300.115638][ T3091] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 300.127019][ T3091] usb 5-1: config 0 interface 0 has no altsetting 0 [ 300.136922][ T3091] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 300.145924][ T3091] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 300.159093][ T3091] usb 5-1: config 0 interface 0 has no altsetting 0 [ 300.173721][ T3091] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 300.184051][ T3091] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 300.196550][ T3091] usb 5-1: config 0 interface 0 has no altsetting 0 [ 300.204759][ T3091] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 300.214923][ T3091] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 300.223539][ T3091] usb 5-1: Product: syz [ 300.228539][ T3091] usb 5-1: Manufacturer: syz [ 300.233289][ T3091] usb 5-1: SerialNumber: syz [ 300.239440][ T3091] usb 5-1: config 0 descriptor?? [ 300.380842][ T3091] yurex 5-1:0.0: USB YUREX device now attached to Yurex #0 [ 300.811985][ T3091] usb 5-1: USB disconnect, device number 46 [ 300.827057][ T3091] yurex 5-1:0.0: USB YUREX #0 now disconnected [ 300.962933][ T5847] usb 2-1: USB disconnect, device number 51 [ 301.007365][ T5898] usb 6-1: USB disconnect, device number 14 [ 301.046619][T13435] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1242'. [ 301.062121][T13435] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1242'. [ 301.071761][T13435] netem: change failed [ 301.079968][ T24] usb 3-1: USB disconnect, device number 30 [ 301.346512][T13448] input: syz0 as /devices/virtual/input/input58 [ 301.571935][T13454] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1246'. [ 301.581062][T13454] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1246'. [ 301.590357][T13454] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1246'. [ 302.054690][ T30] audit: type=1400 audit(1755668487.670:822): avc: denied { create } for pid=13456 comm="syz.4.1247" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 302.771996][T13467] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1249'. [ 302.866486][ T30] audit: type=1400 audit(1755668488.480:823): avc: denied { mount } for pid=13466 comm="syz.5.1249" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 302.913215][T13470] nvme_fabrics: unknown parameter or missing value '€ðÛA' in ctrl creation request [ 302.938753][T13461] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1247'. [ 303.013508][ T30] audit: type=1400 audit(1755668488.630:824): avc: denied { write } for pid=13466 comm="syz.5.1249" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 303.066761][T13474] input: syz1 as /devices/virtual/input/input59 [ 303.088847][T13461] bridge0: port 3(batadv1) entered blocking state [ 303.100003][T13461] bridge0: port 3(batadv1) entered disabled state [ 303.118122][T13461] batadv1: entered allmulticast mode [ 303.129923][ T30] audit: type=1400 audit(1755668488.750:825): avc: denied { unmount } for pid=11643 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 303.153548][T13461] batadv1: entered promiscuous mode [ 303.167380][T13475] tipc: Enabling of bearer rejected, failed to enable media [ 303.249496][ T30] audit: type=1400 audit(1755668488.780:826): avc: denied { ioctl } for pid=13473 comm="syz.1.1251" path="/dev/usbmon0" dev="devtmpfs" ino=716 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 303.279926][T13483] netem: change failed [ 303.301905][ T5168] Bluetooth: hci2: Malformed Event: 0x02 [ 303.370469][ T30] audit: type=1400 audit(1755668488.800:827): avc: denied { create } for pid=13473 comm="syz.1.1251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 303.395471][ T30] audit: type=1400 audit(1755668488.900:828): avc: denied { map } for pid=13476 comm="syz.3.1252" path="socket:[26334]" dev="sockfs" ino=26334 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 303.867382][ T59] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 303.876633][ T59] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 303.905451][T13502] __nla_validate_parse: 2 callbacks suppressed [ 303.905485][T13502] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1258'. [ 303.920701][T13502] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1258'. [ 303.941105][T13502] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1258'. [ 303.969081][T13503] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1257'. [ 304.557020][T13512] gretap0: entered promiscuous mode [ 304.562468][T13512] vlan2: entered promiscuous mode [ 304.768689][T13517] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1259'. [ 304.786631][T13517] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1259'. [ 304.804434][T13517] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1259'. [ 305.075554][ T5847] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 305.145501][ T5891] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 305.227563][ T5847] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 305.238364][ T5847] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 7 [ 305.285523][ T5847] usb 5-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 305.307263][ T5891] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 305.319633][ T5891] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 305.319843][ T5847] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.342905][ T5847] usb 5-1: config 0 descriptor?? [ 305.390822][T13522] FAULT_INJECTION: forcing a failure. [ 305.390822][T13522] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 305.404331][T13522] CPU: 1 UID: 0 PID: 13522 Comm: syz.5.1263 Not tainted syzkaller #0 PREEMPT(full) [ 305.404357][T13522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 305.404367][T13522] Call Trace: [ 305.404373][T13522] [ 305.404380][T13522] dump_stack_lvl+0x16c/0x1f0 [ 305.404403][T13522] should_fail_ex+0x512/0x640 [ 305.404424][T13522] _copy_from_user+0x2e/0xd0 [ 305.404446][T13522] copy_msghdr_from_user+0x98/0x160 [ 305.404463][T13522] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 305.404480][T13522] ? rcu_is_watching+0x12/0xc0 [ 305.404501][T13522] ? lock_release+0x201/0x2f0 [ 305.404529][T13522] ___sys_recvmsg+0xdb/0x1a0 [ 305.404546][T13522] ? __pfx____sys_recvmsg+0x10/0x10 [ 305.404562][T13522] ? ksys_write+0x12a/0x250 [ 305.404580][T13522] ? rcu_is_watching+0x12/0xc0 [ 305.404609][T13522] __sys_recvmsg+0x16a/0x220 [ 305.404627][T13522] ? __pfx___sys_recvmsg+0x10/0x10 [ 305.404651][T13522] do_syscall_64+0xcd/0x4c0 [ 305.404672][T13522] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.404689][T13522] RIP: 0033:0x7f13ea98ebe9 [ 305.404702][T13522] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 305.404720][T13522] RSP: 002b:00007f13eb8bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 305.404737][T13522] RAX: ffffffffffffffda RBX: 00007f13eabb5fa0 RCX: 00007f13ea98ebe9 [ 305.404749][T13522] RDX: 0000000000012060 RSI: 0000200000000180 RDI: 0000000000000004 [ 305.404760][T13522] RBP: 00007f13eb8bb090 R08: 0000000000000000 R09: 0000000000000000 [ 305.404770][T13522] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 305.404780][T13522] R13: 00007f13eabb6038 R14: 00007f13eabb5fa0 R15: 00007ffd37383778 [ 305.404796][T13522] [ 305.578923][ C1] vkms_vblank_simulate: vblank timer overrun [ 305.585466][ T5891] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 305.641317][ T5891] usb 3-1: config 0 interface 0 has no altsetting 0 [ 305.796217][T13523] netlink: 202232 bytes leftover after parsing attributes in process `syz.1.1262'. [ 305.807176][T13523] net_ratelimit: 488 callbacks suppressed [ 305.807194][T13523] netlink: zone id is out of range [ 305.821344][ T5891] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 305.830698][ T5891] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 305.853765][ T5891] usb 3-1: config 0 interface 0 has no altsetting 0 [ 306.001322][ T30] audit: type=1400 audit(1755668491.610:829): avc: denied { read } for pid=13505 comm="syz.4.1260" name="sg0" dev="devtmpfs" ino=717 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 306.362566][ T5891] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 306.382745][ T30] audit: type=1400 audit(1755668491.610:830): avc: denied { open } for pid=13505 comm="syz.4.1260" path="/dev/sg0" dev="devtmpfs" ino=717 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 306.414156][ T30] audit: type=1400 audit(1755668491.610:831): avc: denied { map } for pid=13505 comm="syz.4.1260" path="/dev/sg0" dev="devtmpfs" ino=717 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 306.529263][T13537] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1268'. [ 306.538481][ T5891] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 306.540319][T13537] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1268'. [ 306.561761][T13537] netem: change failed [ 306.565520][ T5891] usb 3-1: config 0 interface 0 has no altsetting 0 [ 306.602956][ T5891] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 306.622288][ T5891] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 306.639539][ T5891] usb 3-1: config 0 interface 0 has no altsetting 0 [ 306.714010][ T5891] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 306.741408][ T5891] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 306.752790][ T5891] usb 3-1: config 0 interface 0 has no altsetting 0 [ 307.042235][ T5891] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 307.061581][ T5891] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 307.083616][ T5891] usb 3-1: config 0 interface 0 has no altsetting 0 [ 307.095639][ T48] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 307.150394][ T24] usb 5-1: USB disconnect, device number 47 [ 307.233223][ T5891] usb 3-1: unable to read config index 6 descriptor/all [ 307.250622][ T5891] usb 3-1: can't read configurations, error -71 [ 307.911200][ T48] usb 6-1: no configurations [ 307.938042][ T48] usb 6-1: can't read configurations, error -22 [ 308.005939][ T24] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 308.075919][ T48] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 308.227079][ T24] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 308.238467][ T24] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 308.278384][ T24] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 308.296624][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.311583][T13553] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 308.319324][ T48] usb 6-1: no configurations [ 308.323919][ T48] usb 6-1: can't read configurations, error -22 [ 308.353843][ T48] usb usb6-port1: attempt power cycle [ 308.376046][ T24] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 308.398610][ T123] block nbd0: Possible stuck request ffff888027237000: control (read@0,1024B). Runtime 120 seconds [ 308.409416][ T123] block nbd0: Possible stuck request ffff8880272371c0: control (read@1024,1024B). Runtime 120 seconds [ 308.420377][ T123] block nbd0: Possible stuck request ffff888027237380: control (read@2048,1024B). Runtime 120 seconds [ 308.431332][ T123] block nbd0: Possible stuck request ffff888027237540: control (read@3072,1024B). Runtime 120 seconds [ 308.680628][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 308.680642][ T30] audit: type=1400 audit(1755668494.300:833): avc: denied { write } for pid=13552 comm="syz.4.1272" name="ip6_flowlabel" dev="proc" ino=4026533279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 308.725525][ T48] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 308.759635][ T5891] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 308.858518][ T48] usb 6-1: no configurations [ 308.863260][ T48] usb 6-1: can't read configurations, error -22 [ 308.951794][ T5891] usb 3-1: Using ep0 maxpacket: 16 [ 308.997240][ T5891] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 309.009338][ T5891] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=7b.55 [ 309.023820][ T5891] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.036854][ T5891] usb 3-1: Product: syz [ 309.046439][ T5891] usb 3-1: Manufacturer: syz [ 309.052839][ T5891] usb 3-1: SerialNumber: syz [ 309.068397][ T5891] usb 3-1: config 0 descriptor?? [ 309.093998][ T5891] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 309.175568][ T48] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 309.207053][ T48] usb 6-1: no configurations [ 309.211801][ T48] usb 6-1: can't read configurations, error -22 [ 309.211963][T13581] fuse: Bad value for 'fd' [ 309.237140][ T48] usb usb6-port1: unable to enumerate USB device [ 309.294489][ T13] usb 3-1: Failed to submit usb control message: -71 [ 309.294650][ T5891] usb 3-1: USB disconnect, device number 32 [ 309.301681][ T13] usb 3-1: unable to send the bmi data to the device: -71 [ 309.314417][ T30] audit: type=1400 audit(1755668494.930:834): avc: denied { mount } for pid=13580 comm="syz.1.1277" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 309.365918][ T13] usb 3-1: unable to get target info from device [ 309.372821][ T30] audit: type=1400 audit(1755668494.930:835): avc: denied { ioctl } for pid=13580 comm="syz.1.1277" path="socket:[27588]" dev="sockfs" ino=27588 ioctlcmd=0x8910 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 309.398263][ T13] usb 3-1: could not get target info (-71) [ 309.417825][ T13] usb 3-1: could not probe fw (-71) [ 309.588189][T13584] overlayfs: failed to clone upperpath [ 309.596962][ T30] audit: type=1400 audit(1755668495.220:836): avc: denied { write } for pid=13585 comm="syz.1.1279" name="sg0" dev="devtmpfs" ino=717 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 309.649475][T13588] __nla_validate_parse: 3 callbacks suppressed [ 309.649493][T13588] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1280'. [ 309.668086][T13588] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1280'. [ 309.680144][T13588] netem: change failed [ 309.732399][T13593] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1282'. [ 309.741549][T13593] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1282'. [ 309.752529][T13593] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1282'. [ 309.821338][T13596] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 309.862195][T13593] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1282'. [ 309.875522][T13596] FAULT_INJECTION: forcing a failure. [ 309.875522][T13596] name failslab, interval 1, probability 0, space 0, times 0 [ 309.888270][T13596] CPU: 1 UID: 0 PID: 13596 Comm: syz.1.1279 Not tainted syzkaller #0 PREEMPT(full) [ 309.888293][T13596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 309.888303][T13596] Call Trace: [ 309.888309][T13596] [ 309.888315][T13596] dump_stack_lvl+0x16c/0x1f0 [ 309.888337][T13596] should_fail_ex+0x512/0x640 [ 309.888358][T13596] should_failslab+0xc2/0x120 [ 309.888378][T13596] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 309.888396][T13596] ? fib_trie_unmerge+0x281/0xcb0 [ 309.888418][T13596] fib_trie_unmerge+0x281/0xcb0 [ 309.888435][T13596] ? __mutex_lock+0x1c5/0x1060 [ 309.888455][T13596] ? __pfx_fib_trie_unmerge+0x10/0x10 [ 309.888474][T13596] ? __pfx___mutex_lock+0x10/0x10 [ 309.888493][T13596] ? trace_irq_enable.constprop.0+0xd4/0x120 [ 309.888516][T13596] fib_unmerge+0xf8/0x520 [ 309.888538][T13596] fib4_rule_configure+0x383/0x10c0 [ 309.888564][T13596] fib_newrule+0x35c/0x1e60 [ 309.888585][T13596] ? rcu_is_watching+0x12/0xc0 [ 309.888607][T13596] ? lock_release+0x201/0x2f0 [ 309.888633][T13596] ? __pfx_fib_newrule+0x10/0x10 [ 309.888651][T13596] ? avc_has_perm_noaudit+0xd0/0x3b0 [ 309.888678][T13596] ? rcu_is_watching+0x12/0xc0 [ 309.888698][T13596] ? __pfx_fib_nl_newrule+0x10/0x10 [ 309.888716][T13596] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 309.888735][T13596] ? rcu_is_watching+0x12/0xc0 [ 309.888755][T13596] ? __pfx_fib_nl_newrule+0x10/0x10 [ 309.888773][T13596] ? lock_release+0x201/0x2f0 [ 309.888798][T13596] ? __pfx_fib_nl_newrule+0x10/0x10 [ 309.888817][T13596] rtnetlink_rcv_msg+0x95b/0xe90 [ 309.888835][T13596] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 309.888852][T13596] ? rcu_is_watching+0x12/0xc0 [ 309.888872][T13596] ? trace_irq_enable.constprop.0+0xd4/0x120 [ 309.888894][T13596] ? ref_tracker_free+0x37c/0x830 [ 309.888915][T13596] netlink_rcv_skb+0x155/0x420 [ 309.888934][T13596] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 309.888954][T13596] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 309.888971][T13596] ? rcu_is_watching+0x12/0xc0 [ 309.888998][T13596] netlink_unicast+0x5aa/0x870 [ 309.889018][T13596] ? __pfx_netlink_unicast+0x10/0x10 [ 309.889040][T13596] netlink_sendmsg+0x8d1/0xdd0 [ 309.889060][T13596] ? __pfx_netlink_sendmsg+0x10/0x10 [ 309.889083][T13596] ____sys_sendmsg+0xa95/0xc70 [ 309.889104][T13596] ? trace_irq_enable.constprop.0+0xd4/0x120 [ 309.889123][T13596] ? __pfx_____sys_sendmsg+0x10/0x10 [ 309.889156][T13596] ___sys_sendmsg+0x134/0x1d0 [ 309.889174][T13596] ? __pfx____sys_sendmsg+0x10/0x10 [ 309.889190][T13596] ? rcu_is_watching+0x12/0xc0 [ 309.889214][T13596] ? rcu_is_watching+0x12/0xc0 [ 309.889241][T13596] __sys_sendmsg+0x16d/0x220 [ 309.889258][T13596] ? __pfx___sys_sendmsg+0x10/0x10 [ 309.889283][T13596] do_syscall_64+0xcd/0x4c0 [ 309.889302][T13596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 309.889319][T13596] RIP: 0033:0x7f322078ebe9 [ 309.889333][T13596] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 309.889350][T13596] RSP: 002b:00007f3221684038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 309.889367][T13596] RAX: ffffffffffffffda RBX: 00007f32209b6180 RCX: 00007f322078ebe9 [ 309.889378][T13596] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000007 [ 309.889388][T13596] RBP: 00007f3221684090 R08: 0000000000000000 R09: 0000000000000000 [ 309.889397][T13596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 309.889408][T13596] R13: 00007f32209b6218 R14: 00007f32209b6180 R15: 00007ffc63085ef8 [ 309.889425][T13596] [ 309.973000][ T30] audit: type=1400 audit(1755668495.430:837): avc: denied { append } for pid=13585 comm="syz.1.1279" name="001" dev="devtmpfs" ino=726 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 310.320353][ T3091] usb 5-1: USB disconnect, device number 48 [ 310.826657][T13608] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13608 comm=syz.5.1284 [ 311.032154][ T30] audit: type=1400 audit(1755668496.640:838): avc: denied { read } for pid=13602 comm="syz.2.1286" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 311.081637][T13619] sctp: [Deprecated]: syz.2.1286 (pid 13619) Use of struct sctp_assoc_value in delayed_ack socket option. [ 311.081637][T13619] Use struct sctp_sack_info instead [ 311.296537][T13615] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 311.304050][T13615] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 311.383591][ T30] audit: type=1400 audit(1755668496.640:839): avc: denied { open } for pid=13602 comm="syz.2.1286" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 311.406356][T13622] netlink: 'syz.5.1289': attribute type 8 has an invalid length. [ 311.409697][ T30] audit: type=1400 audit(1755668496.690:840): avc: denied { listen } for pid=13610 comm="syz.1.1287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 311.436313][ T30] audit: type=1400 audit(1755668496.690:841): avc: denied { setopt } for pid=13610 comm="syz.1.1287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 311.458894][ T30] audit: type=1400 audit(1755668496.690:842): avc: denied { accept } for pid=13610 comm="syz.1.1287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 311.482314][T13615] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 311.488936][T13615] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 311.514310][T13615] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 311.521578][T13615] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 311.529142][T13615] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 311.540891][T13622] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1289'. [ 311.551347][T13615] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 311.558018][T13615] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 311.573265][T13615] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 311.732728][T13630] comedi: No check for data length of config insn id 8 is implemented [ 311.742072][T13630] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 311.757203][T13630] comedi: Assuming n=870 is correct [ 311.869247][ T5891] usb 5-1: new full-speed USB device number 49 using dummy_hcd [ 312.241888][T13635] IPVS: stopping master sync thread 13639 ... [ 312.248631][T13639] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 312.546738][ T5891] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 312.561429][ T5891] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 312.572015][T13644] block nbd5: NBD_DISCONNECT [ 312.579432][T13644] block nbd5: Disconnected due to user request. [ 312.580051][ T5891] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 312.598779][ T5891] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 312.609750][ T5891] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 312.700485][T13644] block nbd5: shutting down sockets [ 312.719467][ T5891] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 312.731871][ T5891] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 312.741501][ T5891] usb 5-1: Product: syz [ 312.746650][ T5891] usb 5-1: Manufacturer: syz [ 312.751425][ T5891] usb 5-1: SerialNumber: syz [ 312.757884][ T5891] usb 5-1: config 0 descriptor?? [ 312.966514][ T5891] radio-si470x 5-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 312.973317][ T5891] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 312.985916][T13648] block nbd1: NBD_DISCONNECT [ 312.990550][T13648] block nbd1: Disconnected due to user request. [ 313.006795][T13648] block nbd1: shutting down sockets [ 313.223092][ T5891] radio-si470x 5-1:0.0: software version 0, hardware version 0 [ 313.231211][ T5891] radio-si470x 5-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 313.244144][ T5891] radio-si470x 5-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 313.275782][ T5168] Bluetooth: hci2: command 0x0406 tx timeout [ 313.556430][ T5168] Bluetooth: hci3: command 0x0406 tx timeout [ 313.640557][ T5891] radio-si470x 5-1:0.0: submitting int urb failed (-90) [ 313.646443][ T5168] Bluetooth: hci1: command 0x0405 tx timeout [ 313.653669][ T5852] Bluetooth: hci4: command 0x0c1a tx timeout [ 314.075475][ T3091] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 314.208572][T13667] netlink: 124 bytes leftover after parsing attributes in process `syz.5.1300'. [ 314.235696][ T5891] radio-si470x 5-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 314.248550][ T3091] usb 3-1: Using ep0 maxpacket: 32 [ 314.254383][ T5891] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -22 [ 314.278097][ T3091] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 314.456641][ T3091] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 314.472927][ T5891] usb 5-1: USB disconnect, device number 49 [ 314.497000][ T3091] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 314.519309][ T3091] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.557634][ T3091] usb 3-1: config 0 descriptor?? [ 314.570447][ T3091] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 314.985514][ T5891] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 315.055680][ T5898] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 315.128797][T13691] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 315.137389][T13691] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 315.145623][ T5891] usb 2-1: Using ep0 maxpacket: 32 [ 315.152175][ T5891] usb 2-1: unable to get BOS descriptor or descriptor too short [ 315.161681][ T5891] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 315.172220][ T5891] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 315.183249][ T5891] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 315.192713][ T5891] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.200978][ T5891] usb 2-1: Product: syz [ 315.205188][ T5891] usb 2-1: Manufacturer: syz [ 315.210027][ T5891] usb 2-1: SerialNumber: syz [ 315.216635][ T5898] usb 6-1: Using ep0 maxpacket: 16 [ 315.222971][ T5898] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 315.232220][ T5898] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 315.241568][ T5898] usb 6-1: can't read configurations, error -61 [ 315.355591][ T5852] Bluetooth: hci2: command 0x0406 tx timeout [ 315.375515][ T5898] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 315.553201][ T5898] usb 6-1: Using ep0 maxpacket: 16 [ 315.582005][ T5898] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 315.595476][ T5852] Bluetooth: hci3: command 0x0406 tx timeout [ 315.604829][ T5898] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 315.614750][ T5898] usb 6-1: can't read configurations, error -61 [ 315.622173][ T5898] usb usb6-port1: attempt power cycle [ 315.675759][ T5852] Bluetooth: hci4: command 0x0c1a tx timeout [ 315.675836][ T5168] Bluetooth: hci1: command 0x0405 tx timeout [ 315.861859][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 315.861873][ T30] audit: type=1400 audit(1755668501.480:846): avc: denied { setattr } for pid=13710 comm="syz.4.1310" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 315.890658][ T30] audit: type=1400 audit(1755668501.490:847): avc: denied { write } for pid=13710 comm="syz.4.1310" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 315.913601][ T30] audit: type=1400 audit(1755668501.490:848): avc: denied { open } for pid=13710 comm="syz.4.1310" path="/222/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 315.940187][ T30] audit: type=1400 audit(1755668501.560:849): avc: denied { unmount } for pid=5849 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 315.995558][ T5898] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 316.070308][ T5898] usb 6-1: Using ep0 maxpacket: 16 [ 316.076420][ T5898] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 316.087702][ T5898] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 316.095341][ T5898] usb 6-1: can't read configurations, error -61 [ 316.509669][T13719] 9pnet_fd: Insufficient options for proto=fd [ 316.542173][T13721] 9pnet_fd: Insufficient options for proto=fd [ 316.548375][ T5898] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 316.586938][ T5898] usb 6-1: Using ep0 maxpacket: 16 [ 316.595356][ T5898] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 316.606637][ T5898] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 316.614799][ T5898] usb 6-1: can't read configurations, error -61 [ 316.621502][ T5898] usb usb6-port1: unable to enumerate USB device [ 316.718960][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.725323][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.823954][ T48] usb 3-1: USB disconnect, device number 33 [ 317.442070][ T30] audit: type=1400 audit(1755668503.060:850): avc: denied { create } for pid=13732 comm="syz.3.1316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 317.469673][ T30] audit: type=1400 audit(1755668503.090:851): avc: denied { write } for pid=13732 comm="syz.3.1316" path="socket:[27957]" dev="sockfs" ino=27957 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 317.755581][ T5168] Bluetooth: hci4: command 0x0c1a tx timeout [ 317.755661][ T5852] Bluetooth: hci1: command 0x0405 tx timeout [ 317.784755][ T30] audit: type=1400 audit(1755668503.400:852): avc: denied { write } for pid=13735 comm="syz.2.1317" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 317.815121][ T5891] usb 2-1: 0:2 : does not exist [ 317.829066][ T5891] usb 2-1: USB disconnect, device number 52 [ 317.878083][ T30] audit: type=1400 audit(1755668503.430:853): avc: denied { ioctl } for pid=13735 comm="syz.2.1317" path="/dev/rtc0" dev="devtmpfs" ino=921 ioctlcmd=0x7003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 317.955189][ T6074] udevd[6074]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 318.109050][ T3091] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 318.275533][ T3091] usb 3-1: Using ep0 maxpacket: 16 [ 318.305442][ T3091] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 318.363797][ T3091] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 318.470178][ T3091] usb 3-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 318.483206][ T3091] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.502199][T13755] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1318'. [ 318.511330][T13755] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1318'. [ 318.527542][T13755] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1318'. [ 318.567560][T13756] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1324'. [ 318.577896][T13756] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1324'. [ 318.591041][T13756] netem: change failed [ 318.600208][ T3091] usb 3-1: Product: syz [ 318.622016][ T3091] usb 3-1: Manufacturer: syz [ 318.626794][ T3091] usb 3-1: SerialNumber: syz [ 318.632546][ T3091] usb 3-1: config 0 descriptor?? [ 318.673069][T13761] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13761 comm=syz.5.1325 [ 319.062811][ T3091] appledisplay 3-1:0.0: Error while getting initial brightness: -110 [ 319.082441][T13736] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 319.097009][ T3091] appledisplay 3-1:0.0: probe with driver appledisplay failed with error -110 [ 319.208754][ T3091] usb 3-1: USB disconnect, device number 34 [ 319.362543][ T30] audit: type=1400 audit(1755668504.980:854): avc: denied { write } for pid=48 comm="kworker/1:1" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=28093 scontext=system_u:system_r:kernel_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 319.387990][T13782] netlink: 596 bytes leftover after parsing attributes in process `syz.4.1333'. [ 319.770123][T13792] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1337'. [ 319.816379][T13792] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1337'. [ 319.859627][ T5852] Bluetooth: hci1: command 0x0405 tx timeout [ 319.873748][ T30] audit: type=1326 audit(1755668505.440:855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13789 comm="syz.1.1336" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f322078ebe9 code=0x7ffc0000 [ 319.972878][T13792] netem: change failed [ 320.409677][ T59] Bluetooth: hci5: Frame reassembly failed (-84) [ 320.952591][T13823] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1343'. [ 322.295595][T13844] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1350'. [ 322.475531][ T5168] Bluetooth: hci5: command 0x1003 tx timeout [ 322.481647][ T5852] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 323.045917][ T24] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 323.417902][ T24] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 323.434202][ T24] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 323.485612][ T24] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 323.601535][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 323.622346][ T24] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 323.634856][ T24] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 323.985309][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 324.004784][ T24] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 324.013970][ T24] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 324.025624][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 324.035516][ T24] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 324.044554][ T24] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 324.206204][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 324.231908][ T24] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 324.245362][ T24] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 324.314791][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 324.350654][ T24] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 324.359730][ T24] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 324.599769][T13875] FAULT_INJECTION: forcing a failure. [ 324.599769][T13875] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 324.745759][T13875] CPU: 1 UID: 0 PID: 13875 Comm: syz.4.1359 Not tainted syzkaller #0 PREEMPT(full) [ 324.745788][T13875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 324.745799][T13875] Call Trace: [ 324.745806][T13875] [ 324.745813][T13875] dump_stack_lvl+0x16c/0x1f0 [ 324.745837][T13875] should_fail_ex+0x512/0x640 [ 324.745858][T13875] _copy_from_user+0x2e/0xd0 [ 324.745880][T13875] __keyctl_dh_compute+0x1b6/0x10e0 [ 324.745897][T13875] ? get_pid_task+0xfc/0x250 [ 324.745912][T13875] ? rcu_is_watching+0x12/0xc0 [ 324.745933][T13875] ? lock_release+0x201/0x2f0 [ 324.745961][T13875] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 324.745976][T13875] ? get_pid_task+0x106/0x250 [ 324.745991][T13875] ? proc_fail_nth_write+0x9f/0x220 [ 324.746013][T13875] ? lock_release+0x201/0x2f0 [ 324.746040][T13875] ? rcu_is_watching+0x12/0xc0 [ 324.746067][T13875] keyctl_dh_compute+0xd2/0x140 [ 324.746083][T13875] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 324.746100][T13875] ? ksys_write+0x1ac/0x250 [ 324.746117][T13875] ? __pfx_ksys_write+0x10/0x10 [ 324.746136][T13875] __do_sys_keyctl+0x4df/0x590 [ 324.746158][T13875] do_syscall_64+0xcd/0x4c0 [ 324.746176][T13875] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 324.746195][T13875] RIP: 0033:0x7fe13058ebe9 [ 324.746208][T13875] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 324.746230][T13875] RSP: 002b:00007fe131427038 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 324.746248][T13875] RAX: ffffffffffffffda RBX: 00007fe1307b5fa0 RCX: 00007fe13058ebe9 [ 324.746259][T13875] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000017 [ 324.746270][T13875] RBP: 00007fe131427090 R08: 0000200000000000 R09: 0000000000000000 [ 324.746280][T13875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 324.746290][T13875] R13: 00007fe1307b6038 R14: 00007fe1307b5fa0 R15: 00007fff0d800108 [ 324.746306][T13875] [ 324.955179][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 324.969561][ T24] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 324.978650][ T24] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 324.990254][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 325.126033][T13886] 9pnet_virtio: no channels available for device 127.0.0.1 [ 325.233596][ T24] usb 2-1: unable to read config index 7 descriptor/start: -71 [ 325.243894][ T24] usb 2-1: can't read configurations, error -71 [ 325.296027][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 325.296043][ T30] audit: type=1400 audit(1755668510.920:913): avc: denied { setattr } for pid=13890 comm="syz.2.1364" name="/" dev="9p" ino=18230837186159307689 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 [ 325.333029][T13892] team_slave_0: entered promiscuous mode [ 325.338740][T13892] team_slave_1: entered promiscuous mode [ 325.361347][ T30] audit: type=1400 audit(1755668510.970:914): avc: denied { mounton } for pid=13890 comm="syz.2.1364" path="/243/file0" dev="9p" ino=18230837186159307689 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 [ 325.399688][T13899] __nla_validate_parse: 2 callbacks suppressed [ 325.399704][T13899] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1367'. [ 325.439373][ T30] audit: type=1400 audit(1755668511.060:915): avc: denied { write } for pid=13901 comm="syz.5.1368" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 325.482493][T13902] netlink: 'syz.5.1368': attribute type 5 has an invalid length. [ 325.495487][T13902] netlink: 199836 bytes leftover after parsing attributes in process `syz.5.1368'. [ 325.625695][ T30] audit: type=1400 audit(1755668511.100:916): avc: denied { map } for pid=13901 comm="syz.5.1368" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 325.718029][ T30] audit: type=1400 audit(1755668511.100:917): avc: denied { execute } for pid=13901 comm="syz.5.1368" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 325.859822][T13911] input: syz0 as /devices/virtual/input/input61 [ 325.928358][T13909] sctp: [Deprecated]: syz.5.1370 (pid 13909) Use of int in maxseg socket option. [ 325.928358][T13909] Use struct sctp_assoc_value instead [ 326.032806][ T30] audit: type=1400 audit(1755668511.540:918): avc: denied { sqpoll } for pid=13908 comm="syz.5.1370" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 327.652325][T13936] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1374'. [ 328.280637][T13949] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1377'. [ 328.295319][T13949] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1377'. [ 328.307524][T13949] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1377'. [ 328.322064][T13951] FAULT_INJECTION: forcing a failure. [ 328.322064][T13951] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 328.625531][T13951] CPU: 1 UID: 0 PID: 13951 Comm: syz.1.1379 Not tainted syzkaller #0 PREEMPT(full) [ 328.625557][T13951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 328.625567][T13951] Call Trace: [ 328.625573][T13951] [ 328.625580][T13951] dump_stack_lvl+0x16c/0x1f0 [ 328.625604][T13951] should_fail_ex+0x512/0x640 [ 328.625624][T13951] _copy_from_user+0x2e/0xd0 [ 328.625646][T13951] kstrtouint_from_user+0xd6/0x1d0 [ 328.625662][T13951] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 328.625682][T13951] ? __mutex_trylock_common+0xe9/0x250 [ 328.625709][T13951] proc_fail_nth_write+0x83/0x220 [ 328.625729][T13951] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 328.625747][T13951] ? __pfx___might_resched+0x10/0x10 [ 328.625769][T13951] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 328.625788][T13951] vfs_write+0x29d/0x11d0 [ 328.625807][T13951] ? __pfx___mutex_lock+0x10/0x10 [ 328.625824][T13951] ? __pfx_vfs_write+0x10/0x10 [ 328.625839][T13951] ? __fget_files+0x204/0x3c0 [ 328.625855][T13951] ? rcu_is_watching+0x12/0xc0 [ 328.625876][T13951] ? __fget_files+0x20e/0x3c0 [ 328.625896][T13951] ksys_write+0x12a/0x250 [ 328.625911][T13951] ? __pfx_ksys_write+0x10/0x10 [ 328.625929][T13951] do_syscall_64+0xcd/0x4c0 [ 328.625946][T13951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.625964][T13951] RIP: 0033:0x7f322078d69f [ 328.625976][T13951] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 328.625993][T13951] RSP: 002b:00007f32216c6030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 328.626011][T13951] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f322078d69f [ 328.626022][T13951] RDX: 0000000000000001 RSI: 00007f32216c60a0 RDI: 0000000000000004 [ 328.626032][T13951] RBP: 00007f32216c6090 R08: 0000000000000000 R09: 0000000000000000 [ 328.626041][T13951] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 328.626051][T13951] R13: 00007f32209b6038 R14: 00007f32209b5fa0 R15: 00007ffc63085ef8 [ 328.626069][T13951] [ 329.137701][T13957] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1380'. [ 329.145501][ T5918] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 329.247447][T13961] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1382'. [ 329.365657][ T5918] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 329.560571][ T5918] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 329.569658][ T5918] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 329.580939][ T5918] usb 6-1: config 0 interface 0 has no altsetting 0 [ 329.597421][ T5918] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 329.606389][ T5918] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 329.618009][ T5918] usb 6-1: config 0 interface 0 has no altsetting 0 [ 329.627797][ T5918] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 329.652724][ T5918] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 329.718076][T13969] netlink: 88 bytes leftover after parsing attributes in process `syz.4.1384'. [ 329.735668][ T5918] usb 6-1: config 0 interface 0 has no altsetting 0 [ 329.744815][ T5918] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 329.759962][ T5918] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 329.777733][ T5918] usb 6-1: config 0 interface 0 has no altsetting 0 [ 329.792630][ T5918] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.059114][ T5918] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.103206][ T5918] usb 6-1: config 0 interface 0 has no altsetting 0 [ 330.236059][ T5918] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.245014][ T5918] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.261566][ T5918] usb 6-1: config 0 interface 0 has no altsetting 0 [ 330.277467][ T5918] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.286907][ T5918] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.327631][ T5918] usb 6-1: config 0 interface 0 has no altsetting 0 [ 330.361906][ T5918] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 330.380247][ T5918] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 330.412991][T13987] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=51728 sclass=netlink_route_socket pid=13987 comm=syz.1.1388 [ 330.432623][ T5918] usb 6-1: config 0 interface 0 has no altsetting 0 [ 330.462730][ T5918] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 330.472612][ T5918] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 330.491760][ T5918] usb 6-1: Product: syz [ 330.501514][ T5918] usb 6-1: Manufacturer: syz [ 330.510700][ T5918] usb 6-1: SerialNumber: syz [ 330.526822][ T5918] usb 6-1: config 0 descriptor?? [ 330.539544][ T5918] yurex 6-1:0.0: USB YUREX device now attached to Yurex #0 [ 330.615538][ T30] audit: type=1400 audit(1755668516.170:919): avc: denied { kexec_image_load } for pid=13986 comm="syz.1.1388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 330.718220][T13989] ptrace attach of "./syz-executor exec"[5844] was attempted by "./syz-executor exec"[13989] [ 331.093965][ T5918] usb 6-1: USB disconnect, device number 23 [ 331.101064][ T5918] yurex 6-1:0.0: USB YUREX #0 now disconnected [ 332.395500][ T30] audit: type=1326 audit(1755668517.985:920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14008 comm="syz.1.1396" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f322078ebe9 code=0x0 [ 332.597101][T14019] IPVS: set_ctl: invalid protocol: 47 255.255.255.255:20001 [ 332.655726][ T5891] IPVS: starting estimator thread 0... [ 332.755951][T14020] IPVS: using max 120 ests per chain, 288000 per kthread [ 332.834052][T14021] ptrace attach of "./syz-executor exec"[11643] was attempted by "./syz-executor exec"[14021] [ 333.497263][ T48] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 333.570799][ T30] audit: type=1400 audit(1755668519.195:921): avc: denied { getopt } for pid=14037 comm="syz.1.1404" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 333.600536][ T30] audit: type=1400 audit(1755668519.225:922): avc: denied { map } for pid=14037 comm="syz.1.1404" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 333.626195][ T30] audit: type=1400 audit(1755668519.255:923): avc: denied { ioctl } for pid=14037 comm="syz.1.1404" path="socket:[29573]" dev="sockfs" ino=29573 ioctlcmd=0x943b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 333.677830][ T30] audit: type=1400 audit(1755668519.275:924): avc: denied { call } for pid=14037 comm="syz.1.1404" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 333.700342][ T30] audit: type=1400 audit(1755668519.275:925): avc: denied { transfer } for pid=14037 comm="syz.1.1404" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 333.721749][ T5891] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 333.742133][ T48] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 333.754615][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.767198][ T48] usb 5-1: Product: syz [ 333.771361][ T48] usb 5-1: Manufacturer: syz [ 333.783532][ T48] usb 5-1: SerialNumber: syz [ 333.795126][ T48] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 333.805780][ T30] audit: type=1400 audit(1755668519.425:926): avc: denied { firmware_load } for pid=24 comm="kworker/1:0" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 333.817431][ T24] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 333.856238][ T5891] usb 6-1: device descriptor read/64, error -71 [ 334.345559][ T5891] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 334.485959][ T5891] usb 6-1: device descriptor read/64, error -71 [ 334.595999][ T5891] usb usb6-port1: attempt power cycle [ 334.665175][ T5898] usb 5-1: USB disconnect, device number 50 [ 334.720070][T14051] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1408'. [ 334.730019][T14051] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1408'. [ 334.739900][T14051] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1408'. [ 334.935520][ T5891] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 334.952278][T14056] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1409'. [ 334.986981][ T24] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 335.005974][ T5891] usb 6-1: device descriptor read/8, error -71 [ 335.006326][ T24] ath9k_htc: Failed to initialize the device [ 335.023217][ T5898] usb 5-1: ath9k_htc: USB layer deinitialized [ 335.136158][ T5963] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 335.245473][ T5891] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 335.265966][ T5891] usb 6-1: device descriptor read/8, error -71 [ 335.307926][ T5963] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 335.317190][ T5963] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 335.327563][ T5963] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 335.552941][ T5891] usb usb6-port1: unable to enumerate USB device [ 335.567657][ T5963] usb 3-1: config 0 interface 0 has no altsetting 0 [ 335.591886][ T5963] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 335.612698][ T5963] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 335.641028][ T5963] usb 3-1: config 0 interface 0 has no altsetting 0 [ 335.652082][ T5963] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 335.661442][ T5963] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 335.674625][ T5963] usb 3-1: config 0 interface 0 has no altsetting 0 [ 335.682294][ T5963] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 335.691441][ T5963] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 335.702852][ T5963] usb 3-1: config 0 interface 0 has no altsetting 0 [ 335.789644][ T5963] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 335.803926][ T5963] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 335.821948][ T5963] usb 3-1: config 0 interface 0 has no altsetting 0 [ 335.829969][ T5963] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 335.839839][ T5963] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 335.852108][ T5963] usb 3-1: config 0 interface 0 has no altsetting 0 [ 335.861858][ T5963] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 335.902916][ T5963] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 335.915530][ T5963] usb 3-1: config 0 interface 0 has no altsetting 0 [ 335.923037][ T5963] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 335.932223][ T5963] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 335.944424][ T5963] usb 3-1: config 0 interface 0 has no altsetting 0 [ 335.953277][ T5963] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 335.995115][ T5963] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 336.011472][ T5963] usb 3-1: Product: syz [ 336.018862][ T5963] usb 3-1: Manufacturer: syz [ 336.025379][ T5963] usb 3-1: SerialNumber: syz [ 336.034632][ T5963] usb 3-1: config 0 descriptor?? [ 336.048518][ T5963] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 336.223858][T14075] FAULT_INJECTION: forcing a failure. [ 336.223858][T14075] name failslab, interval 1, probability 0, space 0, times 0 [ 336.245048][T14075] CPU: 1 UID: 0 PID: 14075 Comm: syz.1.1415 Not tainted syzkaller #0 PREEMPT(full) [ 336.245074][T14075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 336.245084][T14075] Call Trace: [ 336.245090][T14075] [ 336.245097][T14075] dump_stack_lvl+0x16c/0x1f0 [ 336.245114][T14075] should_fail_ex+0x512/0x640 [ 336.245131][T14075] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 336.245149][T14075] should_failslab+0xc2/0x120 [ 336.245169][T14075] __kmalloc_noprof+0xd2/0x510 [ 336.245181][T14075] tomoyo_realpath_from_path+0xc2/0x6e0 [ 336.245201][T14075] ? tomoyo_profile+0x47/0x60 [ 336.245218][T14075] tomoyo_path_number_perm+0x245/0x580 [ 336.245239][T14075] ? tomoyo_path_number_perm+0x237/0x580 [ 336.245259][T14075] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 336.245282][T14075] ? preempt_count_add+0x76/0x150 [ 336.245303][T14075] ? rcu_is_watching+0x12/0xc0 [ 336.245323][T14075] ? __fget_files+0x204/0x3c0 [ 336.245340][T14075] ? hook_file_ioctl_common+0x145/0x410 [ 336.245356][T14075] ? lock_release+0x201/0x2f0 [ 336.245382][T14075] ? __fget_files+0x20e/0x3c0 [ 336.245398][T14075] security_file_ioctl+0x9b/0x240 [ 336.245421][T14075] __x64_sys_ioctl+0xb7/0x210 [ 336.245445][T14075] do_syscall_64+0xcd/0x4c0 [ 336.245462][T14075] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.245479][T14075] RIP: 0033:0x7f322078ebe9 [ 336.245491][T14075] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 336.245507][T14075] RSP: 002b:00007f32216c6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 336.245525][T14075] RAX: ffffffffffffffda RBX: 00007f32209b5fa0 RCX: 00007f322078ebe9 [ 336.245536][T14075] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000005 [ 336.245546][T14075] RBP: 00007f32216c6090 R08: 0000000000000000 R09: 0000000000000000 [ 336.245555][T14075] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 336.245565][T14075] R13: 00007f32209b6038 R14: 00007f32209b5fa0 R15: 00007ffc63085ef8 [ 336.245583][T14075] [ 336.472394][ T9] usb 3-1: USB disconnect, device number 35 [ 336.478903][ T9] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 336.520132][T14075] ERROR: Out of memory at tomoyo_realpath_from_path. [ 336.560527][ T31] INFO: task syz.0.669:11403 blocked for more than 143 seconds. [ 336.568241][ T31] Not tainted syzkaller #0 [ 336.573158][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 336.582006][ T31] task:syz.0.669 state:D stack:26776 pid:11403 tgid:11402 ppid:5843 task_flags:0x400140 flags:0x00024004 [ 336.593931][ T31] Call Trace: [ 336.597209][ T31] [ 336.600114][ T31] __schedule+0x1190/0x5de0 [ 336.604592][ T31] ? __flush_work+0x7f1/0xcc0 [ 336.609287][ T31] ? __pfx___schedule+0x10/0x10 [ 336.614117][ T31] ? inode_to_bdi+0x9e/0x160 [ 336.618703][ T31] ? filemap_fdatawrite_wbc+0x81/0x160 [ 336.624156][ T31] ? schedule+0x2d7/0x3a0 [ 336.628475][ T31] ? rcu_is_watching+0x12/0xc0 [ 336.633214][ T31] ? lock_release+0x201/0x2f0 [ 336.638254][ T31] ? sync_bdevs+0xfd/0x360 [ 336.642660][ T31] schedule+0xe7/0x3a0 [ 336.646720][ T31] schedule_preempt_disabled+0x13/0x30 [ 336.652151][ T31] __mutex_lock+0x81b/0x1060 [ 336.656744][ T31] ? sync_bdevs+0x1a9/0x360 [ 336.661522][ T31] ? rcu_is_watching+0x12/0xc0 [ 336.666323][ T31] ? sync_bdevs+0xfd/0x360 [ 336.670730][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 336.675818][ T31] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 336.681789][ T31] ? _atomic_dec_and_lock+0xa2/0x120 [ 336.687122][ T31] ? iput+0xd3/0x880 [ 336.691019][ T31] ? sync_bdevs+0xfd/0x360 [ 336.695470][ T31] sync_bdevs+0xfd/0x360 [ 336.706142][ T31] ksys_sync+0xb2/0x150 [ 336.710445][ T31] ? __pfx_ksys_sync+0x10/0x10 [ 336.715709][ T31] ? syscall_trace_enter+0x89/0x240 [ 336.721044][ T31] __do_sys_sync+0xe/0x20 [ 336.726641][ T31] do_syscall_64+0xcd/0x4c0 [ 336.731172][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.737106][ T31] RIP: 0033:0x7f4bf4b8ebe9 [ 336.741526][ T31] RSP: 002b:00007f4bf59eb038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 336.749983][ T31] RAX: ffffffffffffffda RBX: 00007f4bf4db5fa0 RCX: 00007f4bf4b8ebe9 [ 336.758114][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 336.766676][ T31] RBP: 00007f4bf4db5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 336.774653][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 336.783097][ T31] R13: 00007f4bf4db6038 R14: 00007f4bf4db5fa0 R15: 00007ffe0e23e218 [ 336.791128][ T31] [ 336.794153][ T31] INFO: lockdep is turned off. [ 336.799147][ T31] NMI backtrace for cpu 1 [ 336.799165][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 336.799184][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 336.799193][ T31] Call Trace: [ 336.799198][ T31] [ 336.799203][ T31] dump_stack_lvl+0x116/0x1f0 [ 336.799225][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 336.799246][ T31] ? watchdog+0xd17/0x1260 [ 336.799265][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 336.799289][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 336.799312][ T31] watchdog+0xf0e/0x1260 [ 336.799330][ T31] ? __pfx_watchdog+0x10/0x10 [ 336.799346][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 336.799362][ T31] ? __kthread_parkme+0x19e/0x250 [ 336.799386][ T31] ? __pfx_watchdog+0x10/0x10 [ 336.799402][ T31] kthread+0x3c2/0x780 [ 336.799416][ T31] ? __pfx_kthread+0x10/0x10 [ 336.799431][ T31] ? rcu_is_watching+0x12/0xc0 [ 336.799450][ T31] ? __pfx_kthread+0x10/0x10 [ 336.799465][ T31] ret_from_fork+0x5d7/0x6f0 [ 336.799480][ T31] ? __pfx_kthread+0x10/0x10 [ 336.799495][ T31] ret_from_fork_asm+0x1a/0x30 [ 336.799519][ T31] [ 336.799525][ T31] Sending NMI from CPU 1 to CPUs 0: [ 336.919337][ C0] NMI backtrace for cpu 0 [ 336.919353][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 336.919368][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 336.919375][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 336.919392][ C0] Code: 5c 62 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 72 16 00 fb f4 4c 09 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 336.919404][ C0] RSP: 0018:ffffffff8e207e08 EFLAGS: 000002c2 [ 336.919416][ C0] RAX: 00000000013520ec RBX: 0000000000000000 RCX: ffffffff8b939c29 [ 336.919425][ C0] RDX: ffffed1017086656 RSI: ffffffff8c162880 RDI: ffffffff81913321 [ 336.919433][ C0] RBP: fffffbfff1c52ef8 R08: 0000000000000000 R09: ffffed1017086655 [ 336.919441][ C0] R10: ffff8880b84332ab R11: 0000000000000001 R12: 0000000000000000 [ 336.919449][ C0] R13: ffffffff8e2977c0 R14: ffffffff90ab4090 R15: 0000000000000000 [ 336.919457][ C0] FS: 0000000000000000(0000) GS:ffff8881246bc000(0000) knlGS:0000000000000000 [ 336.919470][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 336.919479][ C0] CR2: 0000001b33a63fff CR3: 000000007c46b000 CR4: 00000000003526f0 [ 336.919488][ C0] Call Trace: [ 336.919492][ C0] [ 336.919497][ C0] default_idle+0x13/0x20 [ 336.919512][ C0] default_idle_call+0x6d/0xb0 [ 336.919525][ C0] do_idle+0x391/0x510 [ 336.919543][ C0] ? __pfx_do_idle+0x10/0x10 [ 336.919557][ C0] ? trace_sched_exit_tp+0x2f/0x120 [ 336.919572][ C0] cpu_startup_entry+0x4f/0x60 [ 336.919586][ C0] rest_init+0x16b/0x2b0 [ 336.919600][ C0] ? acpi_subsystem_init+0x133/0x180 [ 336.919619][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 336.919632][ C0] start_kernel+0x3ee/0x4d0 [ 336.919652][ C0] x86_64_start_reservations+0x18/0x30 [ 336.919674][ C0] x86_64_start_kernel+0x130/0x190 [ 336.919692][ C0] common_startup_64+0x13e/0x148 [ 336.919710][ C0] [ 337.132614][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 337.139498][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 337.148609][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 337.158641][ T31] Call Trace: [ 337.161898][ T31] [ 337.164809][ T31] dump_stack_lvl+0x3d/0x1f0 [ 337.169384][ T31] vpanic+0x6e8/0x7a0 [ 337.173354][ T31] ? __pfx_vpanic+0x10/0x10 [ 337.177847][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 337.183819][ T31] panic+0xca/0xd0 [ 337.187530][ T31] ? __pfx_panic+0x10/0x10 [ 337.191930][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 337.197300][ T31] ? nmi_trigger_cpumask_backtrace+0x1b1/0x300 [ 337.203440][ T31] ? watchdog+0xd78/0x1260 [ 337.207840][ T31] ? watchdog+0xd6b/0x1260 [ 337.212235][ T31] watchdog+0xd89/0x1260 [ 337.216475][ T31] ? __pfx_watchdog+0x10/0x10 [ 337.221133][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 337.226311][ T31] ? __kthread_parkme+0x19e/0x250 [ 337.231336][ T31] ? __pfx_watchdog+0x10/0x10 [ 337.236005][ T31] kthread+0x3c2/0x780 [ 337.240061][ T31] ? __pfx_kthread+0x10/0x10 [ 337.244631][ T31] ? rcu_is_watching+0x12/0xc0 [ 337.249378][ T31] ? __pfx_kthread+0x10/0x10 [ 337.254383][ T31] ret_from_fork+0x5d7/0x6f0 [ 337.258952][ T31] ? __pfx_kthread+0x10/0x10 [ 337.263519][ T31] ret_from_fork_asm+0x1a/0x30 [ 337.268268][ T31] [ 337.271478][ T31] Kernel Offset: disabled [ 337.275775][ T31] Rebooting in 86400 seconds..