last executing test programs: 24.143505707s ago: executing program 2 (id=1527): r0 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x101000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 'queue0\x00', 0x1}) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000000)={0x1, 0x9, 0x4, 0xa, 0x2, 0x7bf}) r2 = fsopen(&(0x7f0000000000)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='fd', &(0x7f00000000c0)='3', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$netrom_NETROM_T2(r1, 0x103, 0x2, &(0x7f0000000080)=0x8b00000, &(0x7f00000001c0)=0x4) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) r5 = msgget(0x0, 0x40) r6 = syz_open_procfs(0x0, &(0x7f0000000680)='cmdline\x00') preadv(r6, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) msgctl$MSG_INFO(r5, 0xc, &(0x7f00000000c0)=""/173) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000100)='.\x00', &(0x7f0000000000)='iso9660\x00', 0x1000080, 0x0) 22.705377605s ago: executing program 2 (id=1532): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0x1, &(0x7f00000001c0)={0x7, 0x400}, 0x0) r0 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r0, &(0x7f00000002c0)={'#! ', '', [{0x20, '\x0f\x10\t'}]}, 0x8) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, &(0x7f00000a2000)={0x0, &(0x7f0000000180)}, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, &(0x7f00000a2000)={0x1, &(0x7f0000f07000)=[{0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000080), 0x1) sendto$inet6(r1, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=ANY=[], 0x84}}, 0x20008040) sendto$inet6(r1, &(0x7f0000000240), 0x0, 0x294c7d32ddcd046d, 0x0, 0x0) shutdown(r1, 0x1) syz_emit_ethernet(0x21f, &(0x7f00000004c0)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaabb86dd6000af0001e93afffe8000000000000000000000000000bbfe8000000000000000000000000000aa880090784000000000000000000000000000000000000000033a2553e1adb2111ada8a500cb7b9d777b11876e37d94067c6caedd576a3e2515e6431045223c6b417c293b43c6c7d12ae6590077c374a2da5f3fed004104294079574b01f8565760efa0c83221b15828e82051783eaac7ac67b44602bab09da943b6f99c777d29418ec4f37add413a9396c584aa940d642c5288c3b87a37c39e7a188d5bd650cbc2aa2680948285cd4d846aaaa9b26bd2dfbbba4b05e3ce09d62c1c52dbc2d92c7c072c00010aa2df1de3fc61c053b4eee3629286369e61fd2d175523680d2ac11fddee37c9977f96440b9f7411569048ab917f9759f55090dd2d1aa05c6c692e773451ed1239964ae034a24822d7651722e16fa195828fe4513d1fdb785e7f3a44cdbeb199390d38a903689e6df55f8d455c2ffebc5bfb03b7cb4cff7be570230308e365d30a7acf9864aaa51e7a23bd034153c3e2312dec1ad102a0ffc222e892f1927b5077ad1aff37f88baa49836213d290cc7c06c3ed7c7ee1b6615281e625182f975bb888194bce3c5934a1f0ccdf7cf7b00b6b4176669d2ed171fe64c909aa85ba48599f3be808bfceac2e9a563f89d46810389d8d4748dcf90b8bc4730eb79a1755d5fd4b3b8921c4f9098e83fc5f91244eb8fb70be5d09ef05591c65f7f32d0a1ce0c4209f"], 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 21.554799946s ago: executing program 2 (id=1535): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@wrmsr={0x1e, 0x20, {0x1b, 0xfffff000}}], 0x20}) ioctl$KVM_RUN(r3, 0xae80, 0x0) sync() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r3, 0x4068aea3, &(0x7f0000000340)={0xa3, 0x0, &(0x7f0000000300)}) prlimit64(0x0, 0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x50) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x80140, 0x0) ioctl$TIOCGISO7816(r5, 0x80285442, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x14c00, 0x0) ioctl$IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS(r7, 0x40096100, &(0x7f0000000280)={{&(0x7f0000000200)={'GENERAL\x00', {&(0x7f0000000100)=@adf_dec={@normal='NumberDcInstances\x00', {0x320}, {&(0x7f0000000040)=@adf_dec={@normal='NumberDcInstances\x00', {0xb}}}}}}}}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, 0x0, 0x20004004) ioctl$TIOCL_GETSHIFTSTATE(0xffffffffffffffff, 0x541c, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) gettid() sync() syz_init_net_socket$x25(0x9, 0x5, 0x0) 18.653555788s ago: executing program 2 (id=1544): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300), 0x106, 0x8}}, 0x20) timer_create(0x3, 0x0, &(0x7f0000000180)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) chdir(0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r5) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x24, r8, 0x1, 0x0, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffffffff}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0x34, r6, 0x1, 0x0, 0x0, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='cubic', 0x4) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000100)='.\x00', &(0x7f0000002280)='vxfs\x00', 0x8000, 0x0) r9 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) syz_usb_connect(0x4, 0x5ac, &(0x7f0000000880)=ANY=[@ANYBLOB="12011003ec976a08ac050a0385cc0102030109029a0502040340080904877f0b0305020609050e104000a40503471049951d88a7a3274c5d28b956e7a8aca201daacb241307a095e7bd62a7a96901e3f218b67ebbb585b690bdf331fa1960507e521dd4bd5bf1db81186a05ddb3b4441970d2ff3d73059bdf4767bde530fb5237878186e91dddff63ae40a1fdc9aec1c42b2ec30d740153dea7d2068ab6a9ca43fdd1d9df48e6e4c6d1036cd2034ff35b0c88ad39be2454c519f3f7c6a8a14301f85c4f080f94fe70014dd65514e7a69940cf0b587fd4899b9de9de469b16b925994044145fb2bc7c6a80db68cac732f1c662de4498473a7ab62b9cdb9ab668601ca686c46c1cfd0e11918076fd372ffef94cd30bde88cb542ee98929db1109343a2cb9f0b7faec2c8e65be1408ad1f0ea20b2c135c170a887d8e6642d98b8be2cf37179722837beea1c1509050710000201080707250180020100090580004000030705a70a78d4cba2a203afaa5da4c0f0015f1f66c66cf6f94433a9c3ebfff6e920fbf7b1e0df9f5b7bf7d8d3d310aee86201e5b9b5596fe5d6489404e0558acdb61151d896730585c59f99dfc1532035759a422e3ba3c20a18932773e13b8b0072ed5b4554b0da4c71f1143995353c582638692e94d5a2b0ea5bb2edba71a78d595e39ed28dffee06ee43e4b667f7695c8f51dbf69fd669c8d897c27cce38fd534bcd0b2bfc5072340090501001000400aa5090504002000f10208072501800f060007250102ff00040905060340000305400905800020000e0308072501000402000725018005f8ff09050b00000408087f09050303ff030fff8e09050601ff036b03034a242f23d8d21143fdaa3f559180964617438d97c8d36c044c511b15f4cf54f871cf844fae1de6db51301fd695df3a9ff4236b64cb22e27d144a8ee4150375fdba83647d3df9e01a6eee7c21260dce179396fabcd47f3ad632950c037eb5b7e3af648e3c42beb1c40aaf58f3a4218c3ff08de32cc06a194c2d459d93605081be048768501566703b4b1a7c4b07257b76ed72503321832b3e62dcf61675591f5c8c3d79a7b22e19f5c1d013f7ebf3b73a9e5c527c0e2090ea9f1f597fab2f93c44cb70d9b785d09050503ff0301b708090453090c8a3f3d0208240600009d49b305240008000d240f010100000001000000001524125480a317a88b045e4f01a607c0ffcb7e392a0724140000ff0005241501004524130a227c8bdf29d688aa66ebc7a61ba3111016d8ebb68a465bed7115dcc0c1c9e81bf83bdb8af7074bfd1f05085af0bc7a51c687bf2e63bb38b4d4862df1dc7d276322152412fcffa317a88b045e4f01a607c0ffcb7e392a5c165631a4da2dac569eba295aaeecb7fee513c14c36925418e060d20f5c911036663cac73a52654fe64fcab117185d9cd3f842dc8bd9d2f94e1de8fef4d003d7e3424437cd17c5ad3c9bcf8f9aa0f6b48886e8b86921f1fe94b487109050000ff030574080725010304f9ff090503040002d34c0909050100ff0540020e09050b005eb009010607250181080100090509000002800e0907250180070000090506000800050707072501023a010109050610480096a703420a6ec9c1ad7657b3cb8e0bc5e7227e7dd5c6413cc58af90accd24a575a93f50c8da17f36db2d09bf7c51dc59e4c1d3f0e222c065346ff4128c3686fbf9643f12b44f0edd596ed33c65f6a1adc03f783c180b62f451e03aabd6ed83b9fbf8378fd410e7b89def83d35a8c375e26cfc3c5974420ff68cfbde36141c0d0a12ad34590b34dbedb6b01c5966b5b59bb8aaa340905020100020a65c509050503400009010301000e0300072501830109000905060c600202030109050f00080003090556303a3770e2575a45c838a9588af736fa5e78e219240b54bdd81ef18dfc81327b268c9e535544825bbccad98161a52470d5db93c804ee48ecb4e9b29a2acf812d1466a6b1694c56dfe4b276404343bb738be9e6e327"], &(0x7f0000002080)={0xa, &(0x7f0000000e40)={0xa, 0x6, 0x200, 0x0, 0x4, 0xf8, 0xff, 0x4}, 0x64, &(0x7f0000000e80)={0x5, 0xf, 0x64, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x1, 0x5, 0xa4b4}, @wireless={0xb, 0x10, 0x1, 0xc, 0x20, 0x8, 0x1, 0x6}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0xb, 0xe, 0x8}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xa, 0x7, 0x6}, @generic={0x3c, 0x10, 0x2, "570d0abf6b03b9a63b58509e01f548197571ccbaf5f9d14403422dafb4d9be4536f90a2d122867375e6b0064397eac0fd4b0bce766eb1a9e2b"}]}, 0x3, [{0xcf, &(0x7f0000000f00)=ANY=[@ANYBLOB="cf03dd8defb9878bafd4d84da65e5c1c291adf5448ea0efa692c7208a5bb2d908abb9ffaf93f3bf3025ffacd9cc4496f6bc491bfe44b10d19d21845e53b3eda2ba107fbd37bb364e242380eed0deeb99478876f1decafb9f67adfb7c32d149335d63ccc8c9479ab352590e65d06db7bcb42ebba751beae4031de33b2f8807769508ec5c36cada8189702d065f20a89f29940a2fe8048974a4e748854cce90b57497a78ccdce9a76e536ba838ae8258192f712e489984aeb00aa4ce2a2f3fafd82a78656a6000"/207]}, {0x4, &(0x7f0000002000)=@lang_id={0x4, 0x3, 0x406}}, {0x4, &(0x7f0000002040)=@lang_id={0x4, 0x3, 0xc07}}]}) 13.933918468s ago: executing program 2 (id=1563): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r3, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) 7.27360118s ago: executing program 3 (id=1583): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000cc0)=ANY=[@ANYBLOB="12010000773604202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x1, 0x40001019, r1, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000040), &(0x7f00000001c0)=0x2) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r5, @ANYBLOB="000024000000000024001200140001006272696467655f736c617665800000000c000500080005"], 0x3}, 0x1, 0x0, 0x0, 0x8001}, 0x0) splice(r2, 0x0, r4, 0x0, 0x10d00, 0x0) r6 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) pidfd_send_signal(r6, 0x0, &(0x7f0000000640)={0x0, 0x0, 0xfffffffa}, 0x2) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000240)={0x14, &(0x7f00000000c0)={0x0, 0x31, 0xcc, {0xcc, 0x10, "89a896a395e00b77d2131b32135d2b6a957233c2fcb76cbe6f20deea5c297851d3bccd31d80e665cd5dcabdf7699ce759927ab4a9c8e41a69d7f9d3622178acec351c8aca46e80473bf3feba72c61dc1098600912d2b3071bd52e51e0d2c824a24ed08c1ebd840ceb71cbec08dda37f5fb1f6289d9c74acfa648c252a02fdd407efa114c37ce697eb3d2d9d21f39d739afe6c3df741fc21947d33ec32d752dbc6747c6683d3f23a4fd263ba7fbf1a0a421c3d8a38f7e8a950ed0e8d84350f424e1cf935514653d44906a"}}, &(0x7f00000001c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000380)={0x1c, &(0x7f0000000700)=ANY=[@ANYBLOB="00165600000032423032f9e48de60862d2a2a5ae24d0f665979b5b8fc8c60be35cc1eea5b8bc45d4b1d0f6595de1ff4700192c0ec25ef22bf6f1e54968f25d75f406758507c5893ec7b7aeccb6cfef6ff8a3925f63cda4ed2965cfca3e22bf79a4c521e945c9aabbf4ed30a701fa7937faff53756b5de5e82a460004af8515cf737fc17c8d0d6fb0f917842e9212d20f8a1f2af229e8c60ff691cc270a8f55a26fa2333934bfa4c2e3280000000000000098a7dbec2bc971ae27f1545a697d044bf278d5df6325f861110e52c46c5e21f87bf477b59bca86db6cd27fc8f567ccb6830a5c333cf236ad6fc1fe708d424bf1ab94cfcb04d3d0728b617970b98bdb32b2ba06684bb6f2af808ea50140b834150f0a288ebaaf371278b07236e4b82c00c6a905234c373f102238a372cbd153bfcdd3dfafd6f8d60e04bc9d2f8fae5ef80579b275fa4316a7837fc331acb031bbbffe67b9a6c4947d14fe2f45d96c422afbff475ce2dfa9d2a4e245cffabe2eaf86170787"], &(0x7f0000000300)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x5}}) socket$nl_route(0x10, 0x3, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000900)={0x34, &(0x7f0000000200)=ANY=[@ANYBLOB="001804"], 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$MRT(0xffffffffffffffff, 0x0, 0xd0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 7.063985191s ago: executing program 4 (id=1585): r0 = syz_open_dev$rtc(&(0x7f0000000180), 0x80000000, 0x8000) rmdir(&(0x7f00000000c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="12010000b1bd2f087d0403508c2f010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000000c0)={0x14, &(0x7f0000000100)=ANY=[@ANYBLOB="0000f50000000341"], 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) ioctl$RTC_PIE_ON(r0, 0x7005) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=ANY=[@ANYBLOB="0500000004000000080000000b"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000480)='kfree\x00', r3, 0x0, 0xae6}, 0x18) r4 = io_uring_setup(0x2efd, &(0x7f0000000500)={0x0, 0x4475, 0x8, 0x80000, 0xe6}) r5 = syz_usb_connect(0x0, 0x24, &(0x7f00000004c0)=ANY=[@ANYBLOB="120100001517ee40f00a057a0000010203010902120001000000000904000000ff"], 0x0) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000580), 0x1, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000005c0)={0x0, 0x5, 0x9646, 0x6}, &(0x7f0000000600)=0x10) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r8, 0x84, 0x75, &(0x7f0000000780)={r9, 0x1}, 0x8) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r7) ioctl$VHOST_VDPA_GET_CONFIG(r6, 0x8008af73, &(0x7f0000000640)={0x0, 0xff, ""/255}) syz_usb_control_io$printer(r5, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="203111"], 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000fc0)={{0x1, 0x1, 0x18, r3}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r10, 0xc018937e, &(0x7f0000000440)={{0x1, 0x1, 0x18, r6}, './file0\x00'}) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x4, 0x5, 0x4, 0x4, 0x7fff}, &(0x7f0000000040)=0x14) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r11, 0x84, 0x9, &(0x7f0000000340)={r12, @in6={{0xa, 0x4e24, 0x2, @private0, 0x6e7}}, 0x1, 0x3, 0xff, 0x7, 0x2a, 0x1c, 0x2}, &(0x7f0000000080)=0x9c) 6.556579216s ago: executing program 3 (id=1586): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000001540)={'tunl0\x00', {0x2, 0x4e23, @local}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a31000000000800044c000000000900010073793a3000000000080003400000000a140000001100010000000000000000000000000a"], 0x64}}, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) r5 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r5, &(0x7f00000032c0), 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000480)={0xb8, 0x0, &(0x7f0000000380)=[@request_death={0x400c630e, 0x1}, @enter_looper, @acquire, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@flat=@binder={0x73622a85, 0x1100}, @fda={0x66646185, 0x5, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/98, 0x62, 0x0, 0x24}}, &(0x7f0000000180)={0x0, 0x18, 0x38}}, 0x400}, @register_looper, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x2, 0x2, 0x18}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/209, 0xd1, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000540)=""/4096, 0x1000, 0x0, 0x28}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}, 0x40}], 0x6, 0x0, &(0x7f0000000440)="553fc696f4b1"}) r6 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$printer(r6, 0x0, &(0x7f0000000780)={0xfc78, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) syz_usb_control_io$cdc_ecm(r6, 0x0, 0x0) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x106) ioctl$EVIOCGMASK(r7, 0x5b03, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c00028008000500010000001400070000000000000000050000000000000001"], 0x74}}, 0x0) 5.576122649s ago: executing program 2 (id=1588): socket$netlink(0x10, 0x3, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r2, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) 5.21463237s ago: executing program 0 (id=1589): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c00000013000100800000000000000000000002", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1400350064756d6d7930"], 0x3c}}, 0x0) 5.059483101s ago: executing program 0 (id=1591): r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r0, 0x4068aea3, &(0x7f0000000080)={0xa3, 0x0, &(0x7f0000000040)}) syz_kvm_setup_cpu$x86(r0, r0, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000100)="0f20e06635000020000f22e0ba6100ed0f01c9baf80c66b892085d8566efbafc0ced65640fc73d36e600670f2136bad004b8f39cefba2100edba2100b0faee", 0x3f}], 0x1, 0x8, &(0x7f0000000180)=[@dstype3={0x7, 0xb}, @dstype0={0x6, 0x4}], 0x2) ioctl$KVM_RUN(r0, 0xae80, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000001780)=[{&(0x7f00000001c0)=""/78, 0x4e}, {&(0x7f0000000240)=""/13, 0xd}, {&(0x7f0000000280)=""/184, 0xb8}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/23, 0x17}, {&(0x7f0000001380)=""/220, 0xdc}, {&(0x7f0000001480)=""/243, 0xf3}, {&(0x7f0000001580)=""/254, 0xfe}, {&(0x7f0000001680)=""/206, 0xce}], 0x9) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(r1, &(0x7f0000001940)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001900)={&(0x7f00000018c0)={0x1c, r2, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @broadcast}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc4885}, 0x10) pread64(r0, &(0x7f0000001980)=""/21, 0x15, 0x6) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000019c0)={0x0, 0x0, 0x0}, &(0x7f0000001a00)=0xc) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001ac0)={'sit0\x00', &(0x7f0000001a40)={'syztnl0\x00', 0x0, 0x6f, 0x20, 0x5, 0x5, {{0xe, 0x4, 0x0, 0x0, 0x38, 0x65, 0x0, 0x81, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, {[@timestamp_prespec={0x44, 0x24, 0xcd, 0x3, 0x8, [{@rand_addr=0x64010101, 0x101}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@loopback, 0xffffffff}, {@multicast1, 0x448}]}]}}}}}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000001b00)={@remote, 0x51, r6}) r7 = bpf$ITER_CREATE(0x21, &(0x7f00000035c0)={r0}, 0x8) statx(r0, &(0x7f0000003a80)='./file0\x00', 0x800, 0x4, &(0x7f0000003ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000003bc0), &(0x7f0000003c00)=0x0, &(0x7f0000003c40)) r10 = open(&(0x7f0000003c80)='.\x00', 0x0, 0x88) r11 = fcntl$getown(r0, 0x9) r12 = accept4$netrom(r0, &(0x7f0000004300)={{0x3, @default}, [@default, @default, @rose, @null, @rose, @null, @rose, @netrom]}, &(0x7f0000004380)=0x48, 0x80800) lstat(&(0x7f0000004600)='./file0\x00', &(0x7f0000004640)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r0, &(0x7f0000004740)=[{{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000001b40)="3d8a4c8c788ab4520a022977e56fcab1e0344a34a11b734e9fd90caaffc5ba22554a1edbcb8d1b288de368d32b1d681d5d07d89dc188f339d8c76bd7ac2f65a0f208638144de9934c1d9f40926fe2b9809a87717d273a7a26c1d636e50085b725b2b1a762fd2bbca64a0c9506044d0a91853ff83730a7de70bd0d0", 0x7b}, {&(0x7f0000001bc0)="e0d5875695abf90a136fde09c7b76c31d33de5c4eeffac0ffe448a12f62f78b83c8bce0d16a7a5088c660f46e92ebc6dcba3ef8d9f", 0x35}, {&(0x7f0000001c00)="fedc426176d84ed0b7697a953fbf8fd8", 0x10}, {&(0x7f0000001c40)="dd1df25ea3cda22b80ab7b4c40bf798347523ef960082868fae9e166ab31a0f9e7ae5933f7e5f24b90703c2b83d71a3fa83837a0ff88fe95b29b596fd04b903ca092302adb4b067c554c1569a686a88160008cb7b40be776f5323ab35ed72881b227e9270f1233cc946400bffc04a4b70fba37e42e9b671be0dfd9575b020453751b62028c0859f84f71a9b4063a09a51f3f9c2f413fc3b627b476847d7fdb128a71d5750ac3114c1a3d26ba68b288368653a9cb914f4df9ef96b99c9b06ad9921edeff25c6cd43027a9db4a4f3fbcf4fa728567d3b7789fb51f48897bab7df68dfa4b4632136521b15044bc376a9c6e51eb09560a1c2c360cced1f17a1bf5706e4fcdb753884aeefa9d7d2b5910acf61a6e60d2a3946ef2e14420b9036d10c8bdda2465836009d25a61215f5f20ac4fd4f608463c2e6888961748c260198a7a7eb2cf6a1770fac40302048610eee2b4983cdea1a1842308d3006111879924a8c9f3955e73aebbc94e30a4ed63333408f254dc14192725269a0a699a9eec32104f14269dd5c5e32464ce61c875893dfbcb6bf70d760746e345dbea336858440bcf97240bfaf220f7015b5591f8cc1fb41e34709a302c195b6af608b4d6913f6c9e597ec633afad55d28d584190d4df7404f9991e57fc5edd94a8edb9e4840195e9039983926bc12017cdf1bb311e179a59fc4a53a2a56f913c287f167701ce3d37a14b4d27b3347f359041dc6f6126c6403bdb0398280fa083a697883fc8efb6bed1da92a6e07a33e1e0f02fb747f722bfec53dca10f2f17e901062aecc630f23903b37511e01ef62867e959c03c5cecf15600a02181eb8f03c291dd11d4f5bfd18b9b826f44b0a4b44e4da2d1011c6bfb07edf6679c16b6b32f964f1f032d1bb74c87d4fa0b73b697d635ed71b82cda4986b42626d35a96bfbe3e311305c5dd8dfc95d2597d849b2f5a4590ba10d9a40c5c4fd816e26915293c0fb469204dd1dc085c7fac63f9adbf6bb505b97a494e26d63ead619bcb8d34abe5b3449427558f67fb2526b0f5ad4f3d5df4f3ed2921d58533dac35622e8d58d516f3b0c30a20b2e715416b3f18ace63e2e7c800385591e06cdd9d74ad2416ee2ddce31cfa47b3302e376f6c5937495ff1e7c7fbbde9294338ae4a1e803052296a6cda353d851c0a3385f00631e1672dbd3e95893481dd425abd923d162ac4fa586374b6adca3cbe0e54286b6fe62d81eeeaedbdca0f2e325e3f17de3791e9d4085010e1c9d9461f6c7057706e7017d58ff670cb530212bf92c302629409cddf989506fc33ab8c19f1cc9720985e98c4454f20f5b95d1a6c9e36577d86579c916bcc2adeb9a398a2bbc287d2acb846cd2973e79e294025b81d75a7d28a93b8290554f2eb8b98634d74137245bf2f5c96745a3d818ff3c08775722d6d943b893971c54c38f9f9b8fa902ecde34d23442b1e493b5ac14fd77cc9a1812f0f5c80d718b878086dd6ae0fa7a08c4ac97fb16f30bdb1c391ff404c4e8534cd4aeee03718d66bc991a6edc2c7cb190b3f97fe44e59b8af2cf9781665ed52b5f986d09e644354064c76c2229908171c7bd4cbb06d6c8c59b7dee0617c1a67d380cf38dc4092eb3dc7389e109c5042091111872da04c097070488c699fc0e7f868757711e007cbda0be8d05c534a3a42059bc70b63859d262e824018db9124d82b09b212aa1562315b58be9b6ee0e7b07223ba6e9333dce464ab4ab8598225e9d885fe7dd1d497715bae08cac8c17801a882169ee16770c1ec5d41f18739be6cddc7eee9ac7885f025e1def5559cef0b109c395cfca2cd626dd065507d3a71037f8766054df886a882c9d5733fc76057addcfc736ddd133c15793adecbd093b57d8fe2a96227451d81821663c7275362a7b992b3d2b0cc495ea662b209d8a213cf414254fb320a8ba94dbc6f3bb74891de967d1ecce0d3678b9584d8f062ef61eebd33ae8e3bae4c0e3301e344f3013d66f55527eabd12971c69dcc19b70f22a0c26442dc46dff5d58d2093f91fec15b068ef852f5d9506f1219cd06083c7e1ba4b1db6c919ad107f2d24e210e1e27ebc69dd1c10158e14ed25e3bd47f505ecb2980b10ae39441e982090d418f6ef93cd0da03477d38d14ca17cc9f1e708f7a1423550102841d733fc952ee10e40bbc7e2c744233e9e87e196079898d8cb14c7609a554019bf40b90ca75a811ca5a79bcef3e448ac7c72693c9525675a8a4488f0e95f8cd8acfbcbe59bbe121ff2f4ffb8735949ff160f5e1ccd8a8dcaf9fe2ca6505d29d037844bd8ea260bc4e6b6d6e6038404499ee7b69096c588f953ca49879693ee9a44616a34f6768f52f9378c09d9d426ba5947d76bf247d6cba83fe5ec4508c6a54169abb18b35f93e5d01b6238c0a82778d0d2c56c0f87f1cf4a4bad1e71d5ca659df9cd5e44c560e1f48e9e0707248d91df488d6d343ca4b75f1a8ab0f6a1263ec86b887606ec834b1597fecb0be6146ed04b2221e629d02676751b257fbe34f4912ed3581d92d4c214b0d3d1930c3a5c567f5c64cbe0a822318d6c1a4d9ee38a0cfe33a4492f789b07b86eb2af8e883e6a3a554475fb403329f7011bd71c62d33fdde07455ffe38c28bed0b077830e4497ed829379d354bce6fd2b7975cf5c27506354ffbb2d02aa9f50eb8efad49ccada9f22c3e4aa34635fa266e5c08d1fcc0477a707619f55059ab68167419f1bbbd7086e37fc5425fe6beb51bfc83465dff76d95972660efe1f1ae7af7f08eb87719ab842244d4fc1e060d0f775d105c47208b67a13202426658683414f05da4d89b16b326acd3cc8fd8137a7242f00747769f2bbe8b698bd5cb358ae002754df7683932254320a3926eb659630de82cf464a5d843b4e049bd3c27dd0aabae1ccafa83506f287d169ba3cffcf1875c26e76cd6ad8146dcc28aa1eef749375eb3729efa23166291257d88ba517ac25ec7cc5d025be6198df12fc7f604a1504fefefe80af5ac14746f72073de226b17a072bb8d6b7d48189b85f786529a0bca9b944a56ac4cd8948b9b3f7165991e3fc7091d56a69986bf5748edc1b92a42a4a54e7f29840fa5dd648f94e29c4175f0e29ea77966129181d53554d667386536825c6d4d8396d3f020f8ec4bc1380ca8e9230bcd63a27830023678b756d48b7a1a94ac38a94d3f9c2987e0bf0e29e53d902eaee3f661b8ea103600799b117b5ad969bc4ec5f4f3bf8230fd329fadb6d6dca63912352e584d70574aed0ef190b3560fdc62912e8caa6b09309ea464fe07513bac4c8e19434895f0a2a42d7031515ee052ff943e2bdeb9321a52c9eeeeb5e9c7cde27712a02e6dc3a1487855d60d6cc98187f234210eab468a4e21b84608443811ebb62123fe8368423db0e7532ebd65eab143b83b52aaceaede480773ea033c642d80f0efd01e4c06c65c8091f6b3bdacc2bafdf93ab299e85de376ac18c1e94c4d20c95f9406271b71eda3c9b6e53c0d8fa29dbfd6dda3a5379e0e856b08f762929d7f49a41adafdfb04a0e5467586cd0de9a1ed1b764820af15a2dd5d76eaec26b91f5734ec833358d58233e6f95daf25d77626fb49f6f4b5858794c1b8c8d095a8386b02ada15bd4e20eb6925e5e30f154596ba80f50b81bd474d29687d81882dca45ea0c0c09fc3eff36ac844eafd177ef8d670118381ea4b519f41d5d64a45bb7cf4b49c05e57300da164385504b6104cb54aa6784af16eea93458dcb313ef1c3d72259a7f18f82ecc7327c4f3e046e2a8a905583da541fcc96d258d343345995826077b54dd8e52eb8d6f213d2c166ef729f227f6d7abee08a67e63898dc2711c86d85dbf0948a8087b9b17c069eba7f200969b26aae99458cb6a29a0b9790cfab64b5cd529f7d199c920ff434e1edf7603d54f5a5c538412e0ac5f82ed63a7606134645419e9c9685782abe60460265eecbbb47165cf9a4b832685a0c7054868f80c30aedd6bedfabe172e1616643c7c389c0b99ed2d1ceeb7afb56a1ba493cc896dee88181ee05ffefd3b2400c1d01c307838b18fadedc5210af6f3dee37927e2e6b6120d1cfbc6bc68ab9215003abf3c86f599388510b7a0f2e9ce62808f6d08c501a261be087f5c8a68a915a50d98d7ed3edb0dbd5d2cc3c46371307e5025f13f060ae1c2b23e2abc15e023d773b536df4985a7a77d31916726ff1f93390f2587b5d93f4001b4061347f5018006921b222ed80d3b00ee00cfd329ac100ccbe0940eed645bd0f77778d004520d31484d5109fbb3720f5583dc6d6370df0fbf5622214620a8d41609945a0c45986190ab23de4ca1fd607571196be833252985f2e2e2cff3537363f2685283307992f83fd5afd5d67b6a7355c71e80b8a3d386205366f984e1ddf2352d367268055680e7ffb61f372db1cdad65d8175ab9e137412cfb6c0a552011ac1a589619a65990232cedaad78294808875217c27cd48a5c1ea28517e1a93d749ff412abfc6d9eb151825b9be4632db15e452813bf2495c49a8bdce9eeda0b7f518bf5088bf6736a612c287f52d24417000925025ef547879d2d53ef8b871837516b77260246e8da98d1c64e01de9360cd2c65bd42dbd88c7a5a137d02bf77415d5b3c3609ec8b5d148d1a43f51254e2d04ad0359fb65575fb8a5d78a065d8cb4b5098979dfc629b17e18f8f20eb17a947d2de7deb6a4e87908d2e79559f5ec0088e9c5c3db173a2c8e198db997ac3ede2c090c0c4d6459339caad9dda80533a4450a6c9f9829e75b6fadb34d1904beae84a013e60f65b7c55c43cff900961950595bdc777118cde2f59e513ba490a33821cb2f9b620f51ac53dbcb06c58d52a7b68b47e054397131cd74057e8b094b770f595cdf53936358f3a03dd8ae9621c8411863430c0e89c4725a3d6c7cb2d1b2ec0c8e43f1e75a1d5c24cfa4e0e3d0ba1b92a75060ae80ff6f7c1db4196012766ee529f2ef817752bb3f8e22e89d45b0758bdbf0d1b69565f670bee52d48cb487946f431b0c4c9e4e753b376e18f500a32e4d0dacda0ac26994e5d8ef747fee3dba4192cb2defbb177474838f3b2b78ddc623f67d548b01a97d0d012963806abe3a295e5d0a707ce2b7b7de99a8f13b7ae306b194d85a1aa4d985e4bdcfd891001b88b3baf5770098cb5ce6c213f0e530880f5ac57a010eb93a8f5bd69761732bc319ef1a1070bb0d5c591b4af08930b9ab4fb993e6a4f274c39a2367148d319c63743ebc3da59c4a8c708f74c8d3e68bd71c15225d48b630f02d76b8a7c43979058631d24334fb6cfde54828c9e5efc1b722624ad920a770b070c5239717c45eb97ba749906606b27b0ea3847f0ba11b799a4f0dcdaa69f7864fdc465b3a32a12f6b7ce4a3df03e13c50f9c95e54dd3f7d9cfa3a8f76adcb77f48d0ab330f509c931ac02f462a7efbc84705f08acd159b5e144d9b308878cdec37662239cf9a5428465d255e0065cbcfb10c0a1a4ddc6fa71324be8688509fdfaadf0ed8bc2864b18a567e94e56a50251264a959a24e199b225b01d908ee2285a7cd1d9bc38b70e05fac41401919be7b3e4fb34586a01c82057a18eb2399da638f2950ede6bf14a6c138fd87adebd216074a3bb4ed282422d6dc15ab35c9625c1411fbfb2bb318c167c0c7ed99d7a6cf0bd7f1a3cc9ce36ccfd435f2264555210a09233fd680b73b1d88340f3e6e52c60dc1df9c2922d123781eae1a383def2d2f75318377b97b1468f88430239a3fa63dac6a877be4327639b3dcd402629851218c5f67a829e0861dc18af304c70", 0x1000}, {&(0x7f0000002c40)="9c47bed2ae343f38b6eb04589fb097c607612f12bfac540f3df029333b84c0f100367fa351620292813bac406e67ab4ee54d552c72353e8c3f9787b6fb443469c6e5ed", 0x43}, {&(0x7f0000002cc0)="59c58071abb7eb8bda419aca83d8de232c7e539fd8a70357aceab8fd5299ffdb04824f5015aa0fa9e8dd487b9e16a42a277d61120a95f05484d19b8649584ef7fb00eceaf31eb743061d447c4c4eed0af5e862385b4c27f30c835410a4e24340e6dbf60d8c93d80ac8c654e08d688de826e70db41b30c1ae6d5b901b64b6145a2c44be283367a97f50c8f1aa2a5ef6a251f4bf907dee0f4e8247bf26ffc253b3c668edd1f9332ad1701c818be2f1c3c95936df71c8ac240fce3be2abe53b3ac06aacb53857a1fce0dc95dab30c1c8c2adb89c91d", 0xd4}, {&(0x7f0000002dc0)="ad531c4512024b8c59fb61dde75920ba8a61064d3a6821d3bddfe635603f8e7cbf6174ac392b95a90f30791bb644522df0d23e1cf6dbf7f823805bb9e2199b736ffc3a49469bdd8dc06705315c276585c7cd0e0e55f7f8dc8340d6d8305771670ab9a97fec596511165d7265ca981492eb0275bf2649cfa4679d62e93a419920096951b3dea02de8a02fa605f3c73d748270de5d10495cf0493babeff79f277b8beec3faad4a8f30ad3fc875c0edb8d6f9a002696f875500806ebc1d3806f0890af4f4833f7cada0240f124e73ed1413d08fa2", 0xd3}, {&(0x7f0000002ec0)="304e6a30d3e6c76f74a01a8ff037bd54b12790c79d9602d61dff34af606ee013f1afeb98eeeca81e3cce5dbdf98e9c463a2fc4acc66a6da0d0a9a6a4a7347c8e99fcd2e984a5e020fd1b1e6427afc4f9ac4836591db3758768138ed7266b27bcc99d0beb48284c02b4699f336e86dbc9892b375b3746be3bb84c0a36039b79595b8ae1cfa4f55b8f62e946b8cd448df9495bde16c1128470c5d812589ff7d419cb9b50a29c09ec809359c654c85bad563aa3fd2c1dd495f12c24fa4a031b37b77f50141e8345de9bca94206c29dcb0aa4837f5cc8afc05a2aed16469373f99c3ef", 0xe1}, {&(0x7f0000002fc0)="a1da8055de0d5bcb3b89b2c7d64dfc815ba61056be3390283871d08e69b7950c724aaac014072053e4b3", 0x2a}], 0x9, 0x0, 0x0, 0x10}}, {{&(0x7f00000030c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003240)=[{&(0x7f0000003140)="6d90407cd396274bdb3057161f10c8bc1e25aea4b9fa3cdc80b86c57e75baf1e2bed63cd343fe24dc33bd7559e134ace8c3be5b291b6bd75a26d388e7c22ab78e1cabad15063f68908b7a08180eeff9446340e2293f855b407c0255438740f65a0267b169dc4e5b58543ad8b4f7b4aed4a4c0508adaecc063bc54b225113ec84398705d9226ac2dacbc9be524e3eae842c0571bf36a44e5d2459e600ed30659c2034944ab715453fb7194fdf6d432091622f7a7ed3a887cc78cca5ba53770ab98a0ee82398ffd50517ca8f", 0xcb}], 0x1, &(0x7f0000003280)=[@cred={{0x1c, 0x1, 0x2, {r3, r4, r5}}}, @cred={{0x1c, 0x1, 0x2, {r3, r4, r5}}}, @cred={{0x1c, 0x1, 0x2, {r3, r4, r5}}}, @rights={{0x28, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r3, 0xee00, r5}}}, @rights={{0x14, 0x1, 0x1, [r0]}}, @rights={{0x20, 0x1, 0x1, [r0, r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r3, r4, r5}}}], 0x100, 0x1}}, {{&(0x7f0000003380)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000003580)=[{&(0x7f0000003400)="674a307308781c0366e33ade2a2b19501d122a05bd3d639a25a8b3d47ceb07efad1dd82c37b80d266969083200", 0x2d}, {&(0x7f0000003440)="7212a0fd12ce914f8a276a81f001dc7d5503a1db619f453f393b36dd3bc12f6b3a3ca46b75550b0dafba79f16eea1d77655ba7f9ac77d9769329153f5fe6da4329fae8847a7b891e316d5fddb19f590390d393819f28d5d5c392a57895f90b911c46424d37c9e9db2cc61190b56dfc658f7068be0c310c8dee13790dc3596879db8300e47ca5a5aaa8d2cc2412eea42749a36e148f38878584f2765f87a0f61b23a537248e80becf997098e7f5e455320846163143908c751185669573fa5497ee82c6bc1f45de74d746deafd918", 0xce}, {&(0x7f0000003540)="964e3b6dd188c8246abce75e26b9bd78b4503921b744223e2b2e5c2f3d", 0x1d}], 0x3, &(0x7f0000003600)=[@rights={{0x14, 0x1, 0x1, [r7]}}, @rights={{0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0]}}, @rights={{0x18, 0x1, 0x1, [r0, r0]}}], 0x60}}, {{&(0x7f0000003680)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000003a00)=[{&(0x7f0000003700)}, {&(0x7f0000003740)="d0deff4822d3688b2079b442b3a6cf1e768dd1ff6a18c135c9b5488661092ad3f23b29ee2dee04e34106973bd9ac690e", 0x30}, {&(0x7f0000003780)="189843c4f4c5d4031b1515249a545c799f18db2cd05e0c0bd974d34c8f06355a4a7fb11685a36e970829af3530b7b1e92f457225ec6df8d5a47171a4e236001664f247e0a59340672e534993abbe230feab01b3a7aae478296a4f006ea6494faea9745991330cd037be2735b2563e744b53fdb1f23ac8d24a663f444c5ad5c831377b38ec8c73ae163b322b8be6089b810f88698cb0c8df5f1e40b1c4903e8fa214ee205660f50bad94ec6d06cf27f045f631ec2da554e80692594333bd7d0b48109e9ce28c87cbb6fee6fc7cb182af21d6ae628c2e7", 0xd6}, {&(0x7f0000003880)="810586279c0a1aa3b397287499d0332d342290ec96dce979f816909bab5cde5ec6c0f005171c361273a76a8e017274f7188b4cc212edf86999386b99ca8967a894aa0e2f2b70a2bcec50a515ac8ad21d6a294148f495a6c3098ce2231291811016ed089ea99235ea13c217cb9715caa1c9845f480980a48479817f682b1733de8edaea8ac7e1c8460f3f9bf94948b81a7d9ad55b1c6cda111cdad5258941536910556eb0bd526a0b725e21fd9884d303553c0d8fd1cbf3d1", 0xb8}, {&(0x7f0000003940)="1691eca59d4a1249717cd93e0849193dddee4bb8234e144834e78e8d1225760905a4764021df71816af80d3292f6c6fac945a011d17245c51fecc6775b6cbe11e2f9cf2032b8dda3e939f8ae703e19ef4fd49fad61a9b1b8521093533f6cb60c5385be4a7d12992561d31d12cf83c54574b20c4f7309edc94ea8f8280c1209205c2206dff4", 0x85}], 0x5, &(0x7f0000003cc0)=[@cred={{0x1c, 0x1, 0x2, {r3, r4, r8}}}, @cred={{0x1c, 0x1, 0x2, {r3, r4, r9}}}, @rights={{0x1c, 0x1, 0x1, [r10, r0, r0]}}, @rights={{0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r3, r4, r5}}}], 0xb8, 0x4814}}, {{&(0x7f0000003d80)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000004280)=[{&(0x7f0000003e00)="a01e5d7a31f5e131e8d9dd76cd6384d23e4ba4ace8631adac7805e04ae35f3b476e928ce6c5cb8ca", 0x28}, {&(0x7f0000003e40)="8f02a85426de94be3f8d266b656d08b7b9dea30a47d81810e4f40943a6a7cb4625692f9af5a5ab644a327433d741cea3d7c7f202e2a0b089fd6e30c750bc85d8728c562f111e71373ac0e6a556730a1531616a21e52eb8979095719563e2a4c00ef2cad44128c5336ba9679897b63089d7a9d2d26785e95dd2d22ebf7ddd34dd8b5ff8e9af1a19a3f395002ee3137c2611017703ec5437bc4736d08f14822b2b6d9bb1d345dc3e6f4028d3941118c4c3797ce59fe318ddb1fa53c033b4d34795eddf", 0xc2}, {&(0x7f0000003f40)="e34ac81ed9172b77c191e461770bc54dfd25146a733be810e53ad304e7b9cc5c146695b8e6f006c42bb7f9102fab076e0b36fa14eb025269ae662dc0ae60ed45c5093d683b23680b5034e040a19cceb6f9fca68dc3536be01879582bc3cb6d58efd0401cf6fe299fc9aeaa3ae27055bba63428e13b49540cb58dfbd34454cde1f0cb694e8cc30d8de01e535f35c69fe7e7e40647168ba8512fce22f84ca32b1dbf0139f969ad17ee3611f4635c255d91ae085e6f32e6ddddd4e564d1ca5c47114ec66a3ef40d3dba8332560a7a2822c54092d0fdb5c860a77734c7a42a48fd284ffbb96cc5ce1b1e0aef5470e195cf17d5c46e5459585ead6711", 0xfa}, {&(0x7f0000004040)="5aa3a778a3a0a11ed7541fd94428f30233a461c3c5c4ed7698a1654a698306f7b3a2aba03ae985d8892690674f8048c99ec53fd9834084c7e177dfe107e9cd65a0470be2fd3fa10bc2e74e4678f7bf2c745caa80d0bedf89ad4184af90cc7a8584", 0x61}, {&(0x7f00000040c0)="d0791c7b0af306a24befcc3200f40d774d4b7212d8301178a624789e674293064be1104556241b8c1392aa09380943cb199ad6ab448e8224a3ad55088aec7d7ba524946e81f1155ae787009c56ea0335cfe62e03ac54beb97c375d93f61a033d135390e466bd1fab77bd2cc4cc3ee7c1d8c3d96fbc5efa3f5ca4e261a93a403778cc91e45b1fd3b18d66280e4c2d2be0e68c4ede5a32fd", 0x97}, {&(0x7f0000004180)="473bb6d7f8dc092f17bbf1ef14ddf1e9898e33c22890d57573cfde553153b6d087ebece3bf7a66b859eda47cb5e2717b847efb9ff6e35d821f56689ea8bb92bc1cf99de4a27d48c469585cf290a4a48066b3048360e894f892613f76bb95db66d665e16e3ff548ee97f6b425021693f243854bd2a00cab3aec58641bd841754fd786fe5c08740d053262199c5cc972b65323a6d54eca0060cc1297bfd281bad4410af77dcf4d0881d5f91450deb704e34ff1d640e67a2233e8e8da61098fb2124acc09afdad475ecdd2d2c4c1d6c63b71acee8b1c13865f58fda387273ada74b028191ad2fb22b26509d7c4a3e1892bbdaa9009121253ebfe21c8cac4fa1", 0xfe}], 0x6, &(0x7f00000043c0)=[@rights={{0x10}}, @cred={{0x1c, 0x1, 0x2, {r3, r4, r5}}}, @rights={{0x14, 0x1, 0x1, [r0]}}, @cred={{0x1c, 0x1, 0x2, {r3, r4, r5}}}, @cred={{0x1c, 0x1, 0x2, {r11, r4, r5}}}, @cred={{0x1c, 0x1, 0x2, {r3, r4, r5}}}, @rights={{0x24, 0x1, 0x1, [r0, r12, r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r3, r4, r5}}}], 0xf0, 0x20008080}}, {{0x0, 0x0, &(0x7f00000045c0)=[{&(0x7f00000044c0)="51543a8ad578484c01d1952bfe6ee1c6e8c465967d0cc749d22d640da2073629d42208b63d9ebc1349e3a250b402e54615c151869c859954cb5dc8bcb87b3c", 0x3f}, {&(0x7f0000004500)="8024bd07e9b2d48326e007d835098d22f4ea4ee99b1ddc48c94121fc8150d224f2faa704d57eeba8a11f6f497396573e5489c191c29603590fb1cbe74c8b0dee15837f3cd179fc04f4bfe7b306d046ba55ecc8be98bc132409ac4efce1e81e19e4961ed9d05c14877b1526af16e5deb7b659eebb7e511ee92906699d22e319f32077cb9a4c439c04", 0x88}], 0x2, &(0x7f00000046c0)=[@rights={{0x28, 0x1, 0x1, [r0, r0, 0xffffffffffffffff, r0, r0, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r3, r13, r5}}}], 0x48, 0x4}}], 0x6, 0x48040) ioctl$VIDIOC_G_CTRL(r7, 0xc008561b, &(0x7f00000048c0)={0x1, 0x400}) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000004980)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000004940)={0xffffffffffffffff}, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r7, &(0x7f00000049c0)={0x16, 0x98, 0xfa00, {&(0x7f0000004900), 0x2, r14, 0x10, 0x0, @in6={0xa, 0x4e20, 0x34, @local, 0x9}}}, 0xa0) r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004ac0), r7) sendmsg$NL80211_CMD_GET_COALESCE(r0, &(0x7f0000004b80)={&(0x7f0000004a80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000004b40)={&(0x7f0000004b00)={0x30, r15, 0x500, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x5f}, @val={0x8}, @val={0xc, 0x99, {0x4, 0x17}}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000800}, 0x8080) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r10, 0x84, 0x6e, &(0x7f0000004bc0)=[@in6={0xa, 0x4e24, 0x9, @remote}, @in={0x2, 0x4e20, @remote}, @in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e23, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, @in6={0xa, 0x4e20, 0x10001, @private2, 0x8}, @in6={0xa, 0x4e20, 0x101, @loopback, 0x400}, @in6={0xa, 0x4e23, 0xf, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3ff}, @in={0x2, 0x4e24, @remote}], 0xbc) bind$alg(r10, &(0x7f0000004c80)={0x26, 'hash\x00', 0x0, 0x0, 'sm3-generic\x00'}, 0x58) syz_kvm_setup_cpu$x86(r10, r10, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000004d40)=[@text32={0x20, &(0x7f0000004d00)="0f22460f1b27660f382a8cc30883b273650fe0fa0f00130f01c93ef30f300f789ef651000066baa100ec66baf80cb8535b5382ef66bafc0cec", 0x39}], 0x1, 0x2, 0xfffffffffffffffc, 0x0) getsockname$packet(r10, &(0x7f0000004d80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004dc0)=0x14) sendmsg$rds(0xffffffffffffffff, &(0x7f0000005280)={&(0x7f0000004e00)={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000005040)=[{&(0x7f0000004e40)=""/10, 0xa}, {&(0x7f0000004e80)=""/13, 0xd}, {&(0x7f0000004ec0)=""/71, 0x47}, {&(0x7f0000004f40)=""/250, 0xfa}], 0x4, &(0x7f00000051c0)=[@cswp={0x58, 0x114, 0x7, {{0x3, 0x80}, &(0x7f0000005080)=0x10001, &(0x7f00000050c0)=0x4da, 0x4, 0x64, 0x2, 0x8000000000000000, 0x40, 0x7f}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000005100)=""/103, 0x67}, &(0x7f0000005180), 0x68}}], 0x88, 0x4000}, 0x4008000) 4.804064784s ago: executing program 0 (id=1592): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x201, 0x0, 0x0, {0x3, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x50) 4.565056113s ago: executing program 0 (id=1593): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='maps\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0x3, 0x1}]}) socket(0xa, 0x5, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f00000006c0)={0x84, &(0x7f0000000240)={0x0, 0x0, 0x4, "07b6f3c1"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x40, 0x1c, 0x1, 0x28}, 0x0, 0x0}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/pm_trace', 0x400, 0x80) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f00000002c0)=""/242, &(0x7f00000001c0)=0xf2) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x400) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800}, 0x0, &(0x7f0000000240)={0x1f, 0x3}, 0x0, 0x0) r4 = fsmount(r1, 0x0, 0x0) fchdir(r4) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) lseek(r5, 0xfffffffffffffffa, 0x1) close(0x3) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000040), &(0x7f0000000200), 0x2, 0x4) close(0x3) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0x0, 0x95, 0x9, 0xfffffffb, 0x5, "b6f8bcabdbf5f5748b08e6385b548b9f2da220"}) setsockopt(r7, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) r8 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r8, 0xc0285700, &(0x7f0000000040)={0x0, "d2c4924d08b1e22900000000000000f3f70000000400"}) pselect6(0x40, &(0x7f0000000180)={0x1f, 0x0, 0x3ff, 0x0, 0x9}, 0x0, 0x0, 0x0, 0x0) setsockopt(r6, 0x84, 0x80, &(0x7f0000000000)="1400000009000000", 0x8) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) 4.5241286s ago: executing program 4 (id=1594): r0 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x101000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 'queue0\x00', 0x1}) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000000)={0x1, 0x9, 0x4, 0xa, 0x2, 0x7bf}) r2 = fsopen(&(0x7f0000000000)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='fd', &(0x7f00000000c0)='3', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$netrom_NETROM_T2(r1, 0x103, 0x2, &(0x7f0000000080)=0x8b00000, &(0x7f00000001c0)=0x4) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) r5 = msgget(0x0, 0x40) r6 = syz_open_procfs(0x0, &(0x7f0000000680)='cmdline\x00') preadv(r6, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) msgctl$MSG_INFO(r5, 0xc, &(0x7f00000000c0)=""/173) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000100)='.\x00', &(0x7f0000000000)='iso9660\x00', 0x1000080, 0x0) 3.086974564s ago: executing program 3 (id=1596): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000380)='nv', 0x2) r1 = getpgid(0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x18, 0x0, @tid=r1}, &(0x7f00000000c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000580)=ANY=[@ANYBLOB="780000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0305000000000000500012800e00010069703665727370616e0000003c0002800600030005cc0000060003000900000008000d0007000000060003000000000008000d0008000000060002"], 0x78}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='huge=always,mpol=interleave']) chdir(&(0x7f0000000240)='./file0\x00') r5 = open(&(0x7f0000000040)='./bus\x00', 0x80242, 0x0) ftruncate(r5, 0x2007ffc) sendfile(r5, r5, 0x0, 0x800000009) sendto$inet(r0, 0x0, 0x0, 0x20000f3c, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 3.027904341s ago: executing program 1 (id=1597): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x4370, 0x6}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xa) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0), 0xd4ba0ff) unlink(&(0x7f0000000100)='./file0/file1\x00') link(0x0, 0x0) 2.923966675s ago: executing program 1 (id=1598): socket$alg(0x26, 0x5, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) sched_setaffinity(r0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) io_uring_setup(0x1345, &(0x7f0000000580)={0x0, 0xa7c6, 0x2, 0x2, 0x379}) openat$full(0xffffffffffffff9c, 0x0, 0x900, 0x0) syz_open_dev$vim2m(0x0, 0x5, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r2) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="05a300000000000000000d00000008000300", @ANYRES32=r3, @ANYBLOB='\x00\x00'], 0x1c}}, 0x0) 2.501757626s ago: executing program 1 (id=1599): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000e0ff0000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x26}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8b26, &(0x7f0000000000)={'wlan1\x00', @random="0a0a0e050800"}) 2.460533604s ago: executing program 1 (id=1600): syz_emit_vhci(0x0, 0x0) 2.383984013s ago: executing program 1 (id=1601): socket$netlink(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) socket$kcm(0x2d, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x40000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r2}, 0x38) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, &(0x7f0000000840)=""/121, &(0x7f0000000680), &(0x7f0000000540), 0x6c, r2}, 0x38) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0xe0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xfff3, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x842}]}}]}, 0x3c}}, 0x4044080) bind$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(0xffffffffffffffff, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 2.365067542s ago: executing program 4 (id=1602): syz_socket_connect_nvme_tcp() socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresgid(0x0, 0xee01, 0xffffffffffffffff) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, 0x0, 0x0) sendmsg$rds(r4, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) r5 = fsopen(&(0x7f00000001c0)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r6 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) readv(r5, 0x0, 0x0) tkill(r6, 0xb) 2.148379506s ago: executing program 3 (id=1603): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x201, 0x0, 0x0, {0x3, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x50) 2.037108344s ago: executing program 3 (id=1604): r0 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x101000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 'queue0\x00', 0x1}) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000000)={0x1, 0x9, 0x4, 0xa, 0x2, 0x7bf}) r2 = fsopen(&(0x7f0000000000)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='fd', &(0x7f00000000c0)='3', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$netrom_NETROM_T2(r1, 0x103, 0x2, &(0x7f0000000080)=0x8b00000, &(0x7f00000001c0)=0x4) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) msgget(0x0, 0x40) prlimit64(0x0, 0xe, 0x0, 0x0) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000100)='.\x00', &(0x7f0000000000)='iso9660\x00', 0x1000080, 0x0) 1.934108108s ago: executing program 3 (id=1605): openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x124) fanotify_init(0x1a, 0x800) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0xa8) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') mmap$IORING_OFF_SQ_RING(&(0x7f000071c000/0xe000)=nil, 0xe000, 0x0, 0x810, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x309201, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@metacopy_on}]}) r3 = open(&(0x7f0000000480)='./file0\x00', 0x0, 0x718bb647156ec3b7) mknodat$loop(r3, &(0x7f0000001600)='./file1\x00', 0x200, 0x0) chdir(&(0x7f0000000140)='./bus\x00') linkat(r3, &(0x7f0000000040)='./file1\x00', r3, &(0x7f0000000180)='./bus\x00', 0x0) link(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0)='./file0\x00') open(&(0x7f0000000440)='./file0\x00', 0xe8142, 0x0) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4020aeb2, &(0x7f0000000080)={0x0, 0x2000000, @ioapic={0x0, 0x1, 0x8000, 0x0, 0x0, [{0x6, 0x7, 0xa, '\x00', 0xab}, {0x2, 0x0, 0x4, '\x00', 0x5b}, {0x1d, 0x4, 0x8, '\x00', 0xb}, {0x5, 0xe, 0x7, '\x00', 0xf1}, {0x1c, 0xc, 0xd, '\x00', 0x43}, {0x4, 0x78, 0xc5, '\x00', 0x9}, {0x94, 0x5, 0x9, '\x00', 0xbe}, {0xf, 0x0, 0x6, '\x00', 0xfc}, {0x1, 0x4, 0x5, '\x00', 0x33}, {0x9, 0xf, 0x57, '\x00', 0x9}, {0x2, 0x4, 0x1}, {0x81, 0x6, 0x6, '\x00', 0x48}, {0x3, 0x1, 0x8, '\x00', 0x8}, {0x6, 0x3, 0x2, '\x00', 0x2}, {0x8, 0x5, 0x3, '\x00', 0x50}, {0xd, 0x2, 0xd}, {0x8, 0x81, 0x81, '\x00', 0xb}, {0x3, 0x89, 0x81, '\x00', 0xf}, {0x7b, 0x7, 0x2, '\x00', 0x5}, {0x3, 0x7, 0x4, '\x00', 0x7}, {0x6, 0x26, 0x5, '\x00', 0x9}, {0x7, 0x9, 0xe4, '\x00', 0x4}, {0xc1, 0xd, 0x3, '\x00', 0x10}, {0xfd, 0x3, 0x80, '\x00', 0x6}]}}) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) chown(&(0x7f0000000580)='./file0\x00', 0x0, 0x0) listen(r5, 0x80) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f00000002c0)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) 1.057307204s ago: executing program 0 (id=1606): r0 = socket(0x2a, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x44fc2, 0x1) close(r1) r2 = getpid() creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) r3 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x1) r4 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r5 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r5, 0x0) write$qrtrtun(r4, &(0x7f0000000300)="ca0e808bb35bdabb", 0x8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x7], &(0x7f0000000240)=[0x2], 0x0, 0x1}}, 0x40) mmap$xdp(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1f, 0x12, r3, 0x0) r6 = syz_pidfd_open(r2, 0x0) mount$9p_fd(0x0, &(0x7f0000000440)='./file1\x00', &(0x7f0000000480), 0x84, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c4066646e213dd507edad72e7f14340d074d79e4ba32e2bb65f4badb018f93e01dfddd2d9f43126de0e0bf02c9f278572142b83cfc4befc6e236bbe3bbe95cc704f4c654bf83692a91df614c0a85ac500ae835f8f6276d190dfc6777e181c2a1c1445c4052b1a849cc03ba097524116f0e11fa5f54ad480f267939499c592eba03c3ad2f5a468906a7c7bdcd89637eadb9626d8680374307a9bf0f755265f5b07703e9d5f082011428a0ab7cca90387030f844c401c7187e794bf", @ANYRESHEX=r6, @ANYBLOB=',@']) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000000)={0x21, 0x6}, 0x4) setsockopt$sock_int(r7, 0x1, 0x2c, &(0x7f00000000c0)=0xbfe, 0x4) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000240)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r8}, 0x18) r9 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r9, &(0x7f0000000140)={0x28, 0x0, 0x0, @my=0x1}, 0x10) setsockopt$packet_fanout_data(r7, 0x107, 0x16, 0x0, 0x0) mknodat$null(r1, &(0x7f0000000000)='./file0\x00', 0x8000, 0x103) bind$unix(r0, &(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e) 1.052069484s ago: executing program 4 (id=1607): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) wait4(0x0, 0x0, 0x8, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020692500000000000020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000f900ffff850000002d000000850000005000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1, 0x0, 0x800}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0x8, &(0x7f0000000a40)=ANY=[@ANYBLOB="620af8ff0c011021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf9943134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2eed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff90326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583584acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7c48de61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e4000000000d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb8434503680300383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd574d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d0104361c37c61a43b5afd865b60d4cae891b73220f17d25979a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e9611d2e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e64701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4faa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a2689217380400a9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000020bd79e41c682139c58ac1deb039a691ad640e12c12fe11d70fe495906f2d5d71778acbd4eee53a3996cb0de84bd2b059d60c0f96a53ea44e0b293865aa68df494f87db976e36ad6c06912244d4c883c4aaa60b4a1392ce0b2f2c519663b4652ff871e0f6dfff9f7d34ecf04be0a58c3d53174b67d1886e34b81ad8c60da56acc64739c3acab24aa8d0ac92d465074f915608b1b60a948bad401b1a7fb3627bbe6c45123ed44bfdf8cc143bd1b7a663dc3d0476b8e39becffc429e41f66b1e37ae52aacaff0f1dc8ea70b68c25072e20586b19127d75fa71577f265c5100000000000000000000000000000000000000000000000054371e0e813db47d3cb1cbcd162c6103ebc77dc9beb0070e216e0124883e187514104a9352b26ad7e3a0524145d7c42d2a26ae0344eef9482e6781d43326b8a090600bcbfe1e3230ba95f738239d88a3b9fbc7f79a333414ab3fc69761aca15cbe1b3e1e23dc7774f9caf14f0103e97c31be313b964569b1f44beaebe42dd6620357325e96caab5fddd92ff12cd86c05d7235f459c68cec48e5cb46679e03c75c20a49d541fade58bf4e6bd29b4168810e2e09b044ab3daf55d1bce03daf577a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x49) 618.101627ms ago: executing program 1 (id=1608): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000040)={0x14, 0x2, 0x0, "11010000001400000100b64c0000005c4b7c1500", 0x30314442}) socket(0x1d, 0x2, 0x6) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000100)) syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f00000000c0)={'#! ', './file0'}, 0xb) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3300000010001fff0000000001000000000000d7", @ANYRESOCT, @ANYRESHEX=r3], 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x81) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x1, 0x803, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="400000001000030425bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0005000000000000180012800b0001006772657461700000080002800400120008000a00", @ANYRES32], 0x40}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) r10 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r11}, @IFLA_MASTER={0x8, 0xa, r11}]}, 0x4c}}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x10012, r5, 0x0) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) 279.979903ms ago: executing program 4 (id=1609): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000100)={@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x3, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) socket(0x1d, 0x2, 0x6) prctl$PR_SET_SECCOMP(0x16, 0x3, &(0x7f00000001c0)={0x5, &(0x7f0000000180)=[{0xfa80, 0x9, 0x4, 0x7f}, {0x0, 0xe, 0x12, 0x10001}, {0x2, 0x3, 0x7, 0x80}, {0xb, 0x0, 0xfb, 0x5}, {0x7f, 0x4, 0x89, 0x4}]}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xa}, 0x18) socket(0xa, 0x3, 0x3a) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x2000003c, &(0x7f0000000280)}) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r2, &(0x7f0000000040)=ANY=[], 0x6) sendmsg$NFC_CMD_SE_IO(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)={0x1c, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4048aecb, &(0x7f0000000080)=ANY=[@ANYRES16]) 79.820469ms ago: executing program 0 (id=1610): syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text16={0x10, &(0x7f0000000000)="ea001059000f320f20d86635200000000f22d8660fd8a300a065660fc7b40040c1c198ee0f01cf0f00940000", 0x2c}], 0x1, 0x3c, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x103182, 0x0) socket(0x1, 0x1, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, &(0x7f0000000200)={@multicast1, @empty}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r5 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f0000000200)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000560602000f0200006706000020000000620a00fe0ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffcd35010000000000ce040000000000001c000000000000009500000000000000db13d5d8b741f2cdaabc8383c8f56bb5df3083d20f8c2bf304000000815dcf0066d7ded3c5c49a08a503ea6d54f7f3125a8200578ac0836d6454745e70a27444003c5b20451b624db6f5320e9befc1e00b8b32917c4d30d16b7edb732bc3ac330b16c442aff70d27659bc58e296b16750c5577c848754b4894b07f15bab1c640a5c0c4fd62f9db829b301ef67fd2b2736f3af0c54af2412313b17c4c8081c4ed0572261960e227d34cfbfdb247bc2351c9d8363a8cb18b7330604da78b0aba47545f9a25a80dd7d28a5ae41824f611dd2de6dd581c52698f9542a444a8a3969946faded5275c00"/420], &(0x7f0000000100)='GPL\x00'}, 0x48) setpgid(r5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) setpgid(0x0, r5) bind$can_j1939(0xffffffffffffffff, 0x0, 0x0) epoll_create(0x2) syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') 0s ago: executing program 4 (id=1611): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0x1, &(0x7f00000001c0)={0x7, 0x400}, 0x0) r0 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r0, &(0x7f00000002c0)={'#! ', '', [{0x20, '\x0f\x10\t'}]}, 0x8) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, &(0x7f00000a2000)={0x0, &(0x7f0000000180)}, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, &(0x7f00000a2000)={0x1, &(0x7f0000f07000)=[{0x6}]}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000080), 0x1) sendto$inet6(r1, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=ANY=[], 0x84}}, 0x20008040) sendto$inet6(r1, &(0x7f0000000240)="f2", 0x1, 0x294c7d32ddcd046d, 0x0, 0x0) shutdown(r1, 0x1) syz_emit_ethernet(0x21f, &(0x7f00000004c0)=ANY=[], 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) kernel console output (not intermixed with test programs): ssive=1 [ 421.905312][ T24] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 422.102548][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 422.113658][ T24] usb 1-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 422.143454][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.223670][ T24] usb 1-1: config 0 descriptor?? [ 422.951360][T10078] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 424.156152][T10102] netlink: 'syz.1.1038': attribute type 4 has an invalid length. [ 424.164028][T10102] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1038'. [ 424.622617][ T24] elan 0003:04F3:0755.0014: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.0-1/input0 [ 424.899167][ T92] usb 1-1: USB disconnect, device number 23 [ 424.997508][T10111] fido_id[10111]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 425.724089][T10128] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1045'. [ 425.841049][T10124] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 425.958322][T10128] netlink: 'syz.2.1045': attribute type 16 has an invalid length. [ 425.985779][T10128] netlink: 'syz.2.1045': attribute type 17 has an invalid length. [ 426.015982][T10135] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1047'. [ 426.140756][T10128] syz_tun: left promiscuous mode [ 426.207156][T10139] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1046'. [ 427.168248][T10128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 428.175204][ T5847] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 428.235117][ T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 428.263782][T10161] netlink: 'syz.1.1052': attribute type 1 has an invalid length. [ 428.361949][T10161] 8021q: adding VLAN 0 to HW filter on device bond1 [ 428.368725][ T9] usb 3-1: device descriptor read/64, error -71 [ 428.375176][ T5847] usb 1-1: Using ep0 maxpacket: 32 [ 428.386439][ T5847] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 428.394519][ T5847] usb 1-1: config 0 has no interface number 0 [ 428.408624][ T5847] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 428.411277][T10163] vlan2: entered promiscuous mode [ 428.423319][ T5847] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.424639][T10163] bond1: entered promiscuous mode [ 428.434032][ T5847] usb 1-1: Product: syz [ 428.439555][T10163] vlan2: entered allmulticast mode [ 428.440699][ T5847] usb 1-1: Manufacturer: syz [ 428.450511][ T5847] usb 1-1: SerialNumber: syz [ 428.456485][T10163] bond1: entered allmulticast mode [ 428.484869][ T5847] usb 1-1: config 0 descriptor?? [ 428.505414][ T5847] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 428.525891][ T30] audit: type=1400 audit(1758590343.483:463): avc: denied { create } for pid=10160 comm="syz.1.1052" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 428.550298][T10161] bond1: (slave gretap1): making interface the new active one [ 428.572539][ T30] audit: type=1400 audit(1758590343.483:464): avc: denied { write } for pid=10160 comm="syz.1.1052" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 428.595212][T10161] gretap1: entered promiscuous mode [ 428.605231][T10161] gretap1: entered allmulticast mode [ 428.616595][T10161] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 428.703592][T10171] netlink: 'syz.3.1053': attribute type 4 has an invalid length. [ 428.711474][T10171] netlink: 17 bytes leftover after parsing attributes in process `syz.3.1053'. [ 429.132831][ T9] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 429.142726][ T30] audit: type=1400 audit(1758590344.111:465): avc: denied { bind } for pid=10164 comm="syz.4.1054" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 429.376102][ T9] usb 3-1: device descriptor read/64, error -71 [ 429.489672][ T9] usb usb3-port1: attempt power cycle [ 429.775518][ T5847] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 429.818420][ T5847] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 429.885137][ T9] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 430.036284][ T9] usb 3-1: device descriptor read/8, error -71 [ 430.305516][ T9] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 430.346961][ T9] usb 3-1: device descriptor read/8, error -71 [ 430.437411][ T30] audit: type=1400 audit(1758590345.421:466): avc: denied { create } for pid=10194 comm="syz.3.1058" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 430.468578][ T9] usb usb3-port1: unable to enumerate USB device [ 430.507993][ T30] audit: type=1400 audit(1758590345.481:467): avc: denied { sys_admin } for pid=10194 comm="syz.3.1058" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 430.843642][T10211] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1061'. [ 430.992149][T10213] netlink: 'syz.2.1061': attribute type 16 has an invalid length. [ 431.040730][T10213] netlink: 'syz.2.1061': attribute type 17 has an invalid length. [ 431.063680][ C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 431.108261][ T5847] usb 1-1: USB disconnect, device number 24 [ 431.136740][ T5847] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 431.168781][ T5847] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 431.186451][T10213] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 431.250713][ T5847] quatech2 1-1:0.51: device disconnected [ 432.196873][T10233] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1064'. [ 432.599999][ T5847] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 432.805463][ T5847] usb 1-1: Using ep0 maxpacket: 16 [ 433.140395][ T5847] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 433.162649][T10249] FAULT_INJECTION: forcing a failure. [ 433.162649][T10249] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 433.176950][T10249] CPU: 0 UID: 0 PID: 10249 Comm: syz.1.1066 Not tainted syzkaller #0 PREEMPT(full) [ 433.176975][T10249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 433.176986][T10249] Call Trace: [ 433.176992][T10249] [ 433.176999][T10249] dump_stack_lvl+0x16c/0x1f0 [ 433.177026][T10249] should_fail_ex+0x512/0x640 [ 433.177051][T10249] _copy_from_user+0x2e/0xd0 [ 433.177077][T10249] copy_msghdr_from_user+0x98/0x160 [ 433.177099][T10249] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 433.177139][T10249] ___sys_sendmsg+0xfe/0x1d0 [ 433.177160][T10249] ? __pfx____sys_sendmsg+0x10/0x10 [ 433.177213][T10249] __sys_sendmsg+0x16d/0x220 [ 433.177234][T10249] ? __pfx___sys_sendmsg+0x10/0x10 [ 433.177273][T10249] do_syscall_64+0xcd/0x4e0 [ 433.177298][T10249] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.177315][T10249] RIP: 0033:0x7f71ee38eec9 [ 433.177329][T10249] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 433.177345][T10249] RSP: 002b:00007f71ef20e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 433.177362][T10249] RAX: ffffffffffffffda RBX: 00007f71ee5e5fa0 RCX: 00007f71ee38eec9 [ 433.177373][T10249] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 433.177384][T10249] RBP: 00007f71ef20e090 R08: 0000000000000000 R09: 0000000000000000 [ 433.177394][T10249] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 433.177404][T10249] R13: 00007f71ee5e6038 R14: 00007f71ee5e5fa0 R15: 00007ffd69bb2ec8 [ 433.177428][T10249] [ 433.235299][ T5847] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 433.235436][ C0] vkms_vblank_simulate: vblank timer overrun [ 433.239925][ T5847] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 433.513860][ T5847] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 433.522972][ T5847] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.573816][ T5847] usb 1-1: config 0 descriptor?? [ 433.787619][T10263] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1071'. [ 434.320933][T10269] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1073'. [ 435.864552][ T5847] usbhid 1-1:0.0: can't add hid device: -71 [ 435.885655][ T5847] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 435.902437][ T5847] usb 1-1: USB disconnect, device number 25 [ 435.909924][T10276] netlink: 'syz.1.1073': attribute type 16 has an invalid length. [ 435.920672][T10276] netlink: 'syz.1.1073': attribute type 17 has an invalid length. [ 435.973013][T10279] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1074'. [ 436.035148][T10276] 8021q: adding VLAN 0 to HW filter on device bond0 [ 436.044259][T10276] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 436.323232][ T24] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 436.398030][T10296] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1079'. [ 436.410514][T10296] netlink: 'syz.4.1079': attribute type 16 has an invalid length. [ 436.418368][T10296] netlink: 'syz.4.1079': attribute type 17 has an invalid length. [ 436.468248][T10296] 8021q: adding VLAN 0 to HW filter on device bond0 [ 436.481518][ T5847] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 436.493860][T10296] 8021q: adding VLAN 0 to HW filter on device team0 [ 436.503039][T10296] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 436.761566][ T24] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 436.772223][ T24] usb 3-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 436.815110][ T5847] usb 1-1: Using ep0 maxpacket: 8 [ 436.837901][ T5847] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 19, changing to 8 [ 436.849255][ T24] usb 3-1: config 220 interface 0 has no altsetting 0 [ 436.858277][ T5847] usb 1-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 437.188457][ T5847] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.214542][ T24] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 437.223980][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.239649][ T5847] usb 1-1: config 0 descriptor?? [ 437.249225][ T24] usb 3-1: Product: syz [ 437.253414][ T24] usb 3-1: Manufacturer: syz [ 437.279579][ T24] usb 3-1: SerialNumber: syz [ 437.527092][ T24] usb 3-1: Found UVC 0.00 device syz (8086:0b07) [ 437.533513][ T24] usb 3-1: No valid video chain found. [ 437.550689][ T24] usb 3-1: USB disconnect, device number 32 [ 437.937459][ T12] Bluetooth: hci5: Frame reassembly failed (-84) [ 438.805812][T10321] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1084'. [ 439.684762][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.986151][ T5858] Bluetooth: hci5: command 0x1003 tx timeout [ 440.001286][ T5848] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 440.573436][ T5847] usbhid 1-1:0.0: can't add hid device: -71 [ 440.590817][ T5847] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 440.623670][ T5847] usb 1-1: USB disconnect, device number 26 [ 441.870934][T10346] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1091'. [ 442.120669][T10346] netlink: 'syz.1.1091': attribute type 16 has an invalid length. [ 442.138558][T10346] netlink: 'syz.1.1091': attribute type 17 has an invalid length. [ 442.327475][T10353] ubi: mtd0 is already attached to ubi31 [ 443.121106][ T30] audit: type=1400 audit(1758590357.301:468): avc: denied { connect } for pid=10342 comm="syz.4.1089" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 443.614781][T10346] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 443.662100][T10352] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1089'. [ 443.674675][T10352] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1089'. [ 443.888612][T10364] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1094'. [ 443.899295][T10364] bridge_slave_1: left allmulticast mode [ 443.905330][T10364] bridge_slave_1: left promiscuous mode [ 443.911313][T10364] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.923374][T10364] bridge_slave_0: left allmulticast mode [ 444.365307][ T5920] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 444.373243][T10364] bridge_slave_0: left promiscuous mode [ 444.380784][T10364] bridge0: port 1(bridge_slave_0) entered disabled state [ 444.516996][ T5920] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 444.528187][ T5920] usb 1-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 444.539863][ T5920] usb 1-1: config 220 interface 0 has no altsetting 0 [ 444.587433][ T5920] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 444.596866][ T5920] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.606721][ T5920] usb 1-1: Product: syz [ 444.615284][ T5920] usb 1-1: Manufacturer: syz [ 444.679797][ T5920] usb 1-1: SerialNumber: syz [ 445.275976][ T5920] usb 1-1: Found UVC 0.00 device syz (8086:0b07) [ 445.302012][ T5920] usb 1-1: No valid video chain found. [ 445.416606][ T5920] usb 1-1: USB disconnect, device number 27 [ 445.693238][ T30] audit: type=1400 audit(1758590360.681:469): avc: denied { mount } for pid=10379 comm="syz.4.1099" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 447.238604][T10412] netlink: 'syz.3.1106': attribute type 4 has an invalid length. [ 447.246405][T10412] netlink: 17 bytes leftover after parsing attributes in process `syz.3.1106'. [ 448.820502][T10429] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1110'. [ 449.126566][T10433] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1112'. [ 449.278102][T10434] netlink: 'syz.3.1112': attribute type 16 has an invalid length. [ 449.362909][T10434] netlink: 'syz.3.1112': attribute type 17 has an invalid length. [ 449.388898][T10434] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 449.571191][T10439] syzkaller0: entered promiscuous mode [ 449.594697][T10439] syzkaller0: entered allmulticast mode [ 450.765141][ T5920] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 451.164137][ T5920] usb 5-1: Using ep0 maxpacket: 16 [ 451.176649][ T5920] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 451.187120][ T5920] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 451.203265][ T5920] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 451.212587][ T5920] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.225568][ T5920] usb 5-1: Product: syz [ 451.237655][ T5920] usb 5-1: Manufacturer: syz [ 451.249912][ T5920] usb 5-1: SerialNumber: syz [ 451.921759][T10463] netlink: 'syz.1.1119': attribute type 4 has an invalid length. [ 451.929658][T10463] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1119'. [ 452.791417][T10468] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1121'. [ 453.204158][ T5920] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 453.279396][ T5920] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 453.293854][ T5920] usb 5-1: USB disconnect, device number 17 [ 453.296722][ T9755] udevd[9755]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 454.095103][ T5920] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 454.367910][ T5920] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 454.415343][ T5920] usb 2-1: config 0 has no interface number 0 [ 454.454332][ T5920] usb 2-1: New USB device found, idVendor=0b48, idProduct=1009, bcdDevice=87.f7 [ 454.463588][ T5920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.474237][ T5920] usb 2-1: Product: syz [ 454.515315][ T5920] usb 2-1: Manufacturer: syz [ 454.535132][ T5920] usb 2-1: SerialNumber: syz [ 454.555756][ T5920] usb 2-1: config 0 descriptor?? [ 454.606779][ T5920] ttusb_dec_send_command: command bulk message failed: error -22 [ 454.646764][ T5920] ttusb-dec 2-1:0.50: probe with driver ttusb-dec failed with error -22 [ 456.065304][ T9] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 456.277245][ T9] usb 5-1: config 0 has an invalid interface number: 69 but max is 0 [ 456.286884][ T9] usb 5-1: config 0 has no interface number 0 [ 456.572523][ T9] usb 5-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 456.603062][ T9] usb 5-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 456.646390][ T9] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 456.657934][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.666455][ T9] usb 5-1: Product: syz [ 456.674978][ T9] usb 5-1: Manufacturer: syz [ 456.694839][ T9] usb 5-1: SerialNumber: syz [ 456.863337][ T9] usb 5-1: config 0 descriptor?? [ 456.873660][T10497] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 457.388434][ T43] usb 2-1: USB disconnect, device number 16 [ 457.417273][ T9] cyberjack 5-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 457.436450][ T9] usb 5-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 457.802945][T10497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.832821][T10508] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1131'. [ 457.896264][T10497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.935403][ C0] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22 [ 458.026707][T10517] tmpfs: Unknown parameter 'indo64' [ 458.137255][ T24] usb 5-1: USB disconnect, device number 18 [ 458.152151][ T24] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 458.179764][ T24] cyberjack 5-1:0.69: device disconnected [ 458.235548][ T43] usb 3-1: new full-speed USB device number 33 using dummy_hcd [ 458.416583][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 458.442807][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 458.479615][ T43] usb 3-1: New USB device found, idVendor=0461, idProduct=4e72, bcdDevice= 0.00 [ 458.501305][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.521342][ T43] usb 3-1: config 0 descriptor?? [ 458.539708][T10515] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 459.253031][ T30] audit: type=1400 audit(1758590374.241:470): avc: denied { map } for pid=10525 comm="syz.3.1137" path="socket:[26615]" dev="sockfs" ino=26615 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 459.394865][ T43] hid-rmi 0003:0461:4E72.0015: global environment stack underflow [ 459.420929][ T43] hid-rmi 0003:0461:4E72.0015: item 0 0 1 11 parsing failed [ 460.025796][ T43] hid-rmi 0003:0461:4E72.0015: parse failed [ 460.032259][ T43] hid-rmi 0003:0461:4E72.0015: probe with driver hid-rmi failed with error -22 [ 460.045405][T10515] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 460.064417][T10515] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 460.164794][ T30] audit: type=1400 audit(1758590375.081:471): avc: denied { map } for pid=10523 comm="syz.4.1136" path="socket:[27092]" dev="sockfs" ino=27092 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 460.188722][ C0] vkms_vblank_simulate: vblank timer overrun [ 460.213363][T10539] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1139'. [ 460.496898][ T43] usb 3-1: USB disconnect, device number 33 [ 460.521931][ T30] audit: type=1400 audit(1758590375.081:472): avc: denied { accept } for pid=10523 comm="syz.4.1136" path="socket:[27092]" dev="sockfs" ino=27092 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 460.550086][ T30] audit: type=1400 audit(1758590375.201:473): avc: denied { create } for pid=10531 comm="syz.3.1139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 460.570253][ C0] vkms_vblank_simulate: vblank timer overrun [ 460.576472][ T30] audit: type=1400 audit(1758590375.201:474): avc: denied { write } for pid=10531 comm="syz.3.1139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 460.596944][ T30] audit: type=1400 audit(1758590375.201:475): avc: denied { nlmsg_write } for pid=10531 comm="syz.3.1139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 460.617883][ T30] audit: type=1400 audit(1758590375.521:476): avc: denied { mount } for pid=10543 comm="syz.1.1141" name="/" dev="autofs" ino=27107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 460.640286][ C0] vkms_vblank_simulate: vblank timer overrun [ 461.137816][T10560] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10560 comm=syz.3.1143 [ 461.817894][ T30] audit: type=1400 audit(1758590376.791:477): avc: denied { unmount } for pid=5843 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 461.837803][ C0] vkms_vblank_simulate: vblank timer overrun [ 462.100302][ T30] audit: type=1400 audit(1758590377.091:478): avc: denied { mounton } for pid=10568 comm="syz.2.1144" path="/213/file0" dev="tmpfs" ino=1129 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 462.123605][ C0] vkms_vblank_simulate: vblank timer overrun [ 462.243399][ T43] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 462.354227][T10583] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1146'. [ 462.822845][T10585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1147'. [ 462.910512][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 462.920373][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 463.473852][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 463.485148][ T43] usb 2-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 463.494683][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 463.507110][ T43] usb 2-1: config 0 descriptor?? [ 463.745621][ T9] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 463.972116][ T9] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 464.087211][ T9] usb 1-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 464.315785][ T9] usb 1-1: config 220 interface 0 has no altsetting 0 [ 464.351292][ T9] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 464.527060][T10567] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 464.544350][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.573318][T10567] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 464.586608][ T9] usb 1-1: Product: syz [ 464.596434][ T9] usb 1-1: Manufacturer: syz [ 464.601069][ T9] usb 1-1: SerialNumber: syz [ 464.637474][T10567] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 464.657713][T10567] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 464.678578][T10567] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 464.688895][T10567] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 464.706703][ T43] hid-multitouch 0003:1FD2:6007.0016: unknown main item tag 0x2 [ 464.714819][ T43] hid-multitouch 0003:1FD2:6007.0016: unknown main item tag 0x1 [ 464.749320][ T43] hid-multitouch 0003:1FD2:6007.0016: hidraw0: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.1-1/input0 [ 464.931783][ T9] usb 1-1: Found UVC 0.00 device syz (8086:0b07) [ 464.942769][ T43] usb 2-1: USB disconnect, device number 17 [ 464.965477][ T9] usb 1-1: No valid video chain found. [ 464.978665][T10621] fido_id[10621]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 465.006228][ T9] usb 1-1: USB disconnect, device number 28 [ 467.286486][T10649] kAFS: No cell specified [ 468.534776][T10673] ISOFS: Unable to identify CD-ROM format. [ 468.855306][ T30] audit: type=1400 audit(1758590383.721:479): avc: denied { ioctl } for pid=10657 comm="syz.4.1168" path="socket:[27915]" dev="sockfs" ino=27915 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 469.175280][ T30] audit: type=1326 audit(1758590383.721:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10657 comm="syz.4.1168" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f160c38eec9 code=0x7ffc0000 [ 469.420547][T10685] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1172'. [ 469.661498][ T30] audit: type=1326 audit(1758590383.721:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10657 comm="syz.4.1168" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f160c38eec9 code=0x7ffc0000 [ 469.828087][ T30] audit: type=1326 audit(1758590383.721:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10657 comm="syz.4.1168" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f160c38eec9 code=0x7ffc0000 [ 469.932096][T10691] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1174'. [ 470.415142][ T30] audit: type=1326 audit(1758590383.731:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10657 comm="syz.4.1168" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f160c38eec9 code=0x7ffc0000 [ 470.635738][ T30] audit: type=1326 audit(1758590383.731:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10657 comm="syz.4.1168" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f160c38eec9 code=0x7ffc0000 [ 472.980752][T10728] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1185'. [ 472.991075][T10728] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1185'. [ 473.763401][T10728] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 474.207309][T10747] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1187'. [ 475.374261][T10760] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1192'. [ 475.745443][ T10] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 475.895085][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 475.901580][ T10] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 475.910399][ T10] usb 1-1: config 179 has no interface number 0 [ 475.948022][ T10] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 475.974330][ T10] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 476.001574][ T10] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 476.030568][ T10] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 476.058094][ T10] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 476.187043][ T10] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 476.866909][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.882010][T10764] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 476.966836][ T30] audit: type=1400 audit(1758590391.961:485): avc: denied { getopt } for pid=10774 comm="syz.1.1197" lport=47279 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 477.025658][T10776] capability: warning: `syz.1.1197' uses 32-bit capabilities (legacy support in use) [ 477.122760][ T30] audit: type=1400 audit(1758590392.111:486): avc: denied { read append } for pid=10774 comm="syz.1.1197" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 477.153170][ T30] audit: type=1400 audit(1758590392.111:487): avc: denied { open } for pid=10774 comm="syz.1.1197" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 477.224974][ T10] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input18 [ 478.461106][T10764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 478.511462][T10764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 479.433143][T10805] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1202'. [ 479.674494][ T30] audit: type=1400 audit(1758590394.661:488): avc: denied { read } for pid=10807 comm="syz.3.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 480.115159][ T9] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 480.405228][ T9] usb 2-1: device descriptor read/64, error -71 [ 481.215274][ T9] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 481.234038][ T10] usb 1-1: USB disconnect, device number 29 [ 481.240007][ C0] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 481.240033][ C0] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 481.355216][ T9] usb 2-1: device descriptor read/64, error -71 [ 481.494357][ T9] usb usb2-port1: attempt power cycle [ 481.600820][T10838] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1208'. [ 482.315134][ T9] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 482.335533][ T9] usb 2-1: device descriptor read/8, error -71 [ 482.566434][T10851] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1211'. [ 483.066272][ T9] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 483.465267][ T9] usb 2-1: device descriptor read/8, error -71 [ 483.585579][ T9] usb usb2-port1: unable to enumerate USB device [ 484.156436][T10861] genirq: Flags mismatch irq 31. 00200000 (pcmmio) vs. 00200000 (virtio1-input.0) [ 484.193074][T10861] 9pnet_fd: Insufficient options for proto=fd [ 484.202478][T10861] batman_adv: batadv0: Adding interface: dummy0 [ 484.210087][T10861] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 484.236376][T10861] batman_adv: batadv0: Interface activated: dummy0 [ 484.253210][T10861] batadv0: mtu less than device minimum [ 484.260642][T10861] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 484.272092][T10861] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 484.283461][T10861] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 484.294830][T10861] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 484.306215][T10861] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 484.317576][T10861] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 484.328435][T10861] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 484.339245][T10861] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 484.350063][T10861] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 484.426500][T10862] netlink: 'syz.1.1214': attribute type 10 has an invalid length. [ 484.759373][T10862] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 484.815393][T10862] batadv0: entered promiscuous mode [ 484.881888][T10862] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 484.893847][ T30] audit: type=1400 audit(1758590399.821:489): avc: denied { read } for pid=10864 comm="syz.0.1215" name="file0" dev="fuse" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 484.915849][ C1] vkms_vblank_simulate: vblank timer overrun [ 485.817225][ T30] audit: type=1400 audit(1758590399.821:490): avc: denied { open } for pid=10864 comm="syz.0.1215" path="/204/file0/file0" dev="fuse" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 485.911522][T10874] nvme_fabrics: missing parameter 'transport=%s' [ 485.943003][T10875] input: syz1 as /devices/virtual/input/input19 [ 485.959951][T10880] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1217'. [ 485.968958][ T30] audit: type=1400 audit(1758590399.831:491): avc: denied { remount } for pid=10864 comm="syz.0.1215" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 486.012447][T10874] nvme_fabrics: missing parameter 'nqn=%s' [ 486.211285][T10884] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1216'. [ 487.539040][T10906] 9pnet_fd: Insufficient options for proto=fd [ 487.560805][T10903] netlink: 'syz.3.1223': attribute type 5 has an invalid length. [ 487.718566][ T30] audit: type=1400 audit(1758590402.711:492): avc: denied { getopt } for pid=10905 comm="syz.0.1224" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 487.782003][T10911] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1224'. [ 487.798740][ T30] audit: type=1400 audit(1758590402.791:493): avc: denied { setopt } for pid=10905 comm="syz.0.1224" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 487.919655][T10918] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1226'. [ 487.995108][ T9] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 488.147585][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 488.154062][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 488.176374][ T9] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 488.193896][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.210469][ T9] usb 3-1: Product: syz [ 488.323279][ T9] usb 3-1: Manufacturer: syz [ 488.328890][ T9] usb 3-1: SerialNumber: syz [ 488.377521][ T9] usb 3-1: config 0 descriptor?? [ 488.488061][ T30] audit: type=1326 audit(1758590403.431:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10921 comm="syz.4.1228" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f160c38eec9 code=0x7ffc0000 [ 488.861393][T10913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.917305][T10913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.928308][ T30] audit: type=1326 audit(1758590403.431:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10921 comm="syz.4.1228" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f160c38eec9 code=0x7ffc0000 [ 488.953394][ T24] usb 3-1: USB disconnect, device number 34 [ 488.989366][ T30] audit: type=1326 audit(1758590403.441:496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10921 comm="syz.4.1228" exe="/root/syz-executor" sig=0 arch=c000003e syscall=100 compat=0 ip=0x7f160c38eec9 code=0x7ffc0000 [ 489.016417][ T30] audit: type=1326 audit(1758590403.441:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10921 comm="syz.4.1228" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f160c38eec9 code=0x7ffc0000 [ 489.089691][T10934] overlayfs: failed to clone upperpath [ 489.170284][ T30] audit: type=1326 audit(1758590403.441:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10921 comm="syz.4.1228" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f160c38eec9 code=0x7ffc0000 [ 489.547252][T10941] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1231'. [ 489.958057][ T1314] net_ratelimit: 21 callbacks suppressed [ 489.958076][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 490.485352][ T6094] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 490.653475][T10954] nvme_fabrics: missing parameter 'transport=%s' [ 490.660847][T10954] nvme_fabrics: missing parameter 'nqn=%s' [ 490.741792][T10957] input: syz1 as /devices/virtual/input/input20 [ 490.993387][T10957] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1235'. [ 491.348005][T10967] comedi comedi0: comedi_bond: 3:2 3:3 attached, 48 channels from 2 devices [ 491.358635][T10967] random: crng reseeded on system resumption [ 491.402976][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 491.667878][T10970] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1237'. [ 492.413012][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 492.788139][ T24] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 493.026406][T10993] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1245'. [ 493.420355][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 493.435259][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 493.442029][ T24] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 493.450717][ T24] usb 3-1: config 0 has no interface number 0 [ 493.463852][ T24] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 493.488663][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.502619][ T24] usb 3-1: Product: syz [ 493.508318][ T24] usb 3-1: Manufacturer: syz [ 493.514094][ T24] usb 3-1: SerialNumber: syz [ 493.521676][ T24] usb 3-1: config 0 descriptor?? [ 493.533851][ T30] kauditd_printk_skb: 62 callbacks suppressed [ 493.533861][ T30] audit: type=1400 audit(1758590408.521:561): avc: denied { mount } for pid=10985 comm="syz.3.1244" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 493.564882][ T24] smsc95xx v2.0.0 [ 493.982428][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 494.198332][T11017] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1250'. [ 494.287378][T11023] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1251'. [ 494.296319][ T30] audit: type=1400 audit(1758590409.271:562): avc: denied { map } for pid=10979 comm="syz.2.1240" path="/dev/video3" dev="devtmpfs" ino=934 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 494.492657][ T24] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 494.503551][ T24] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 494.512742][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 494.585316][ T10] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 494.635195][ T9] usb 1-1: new full-speed USB device number 30 using dummy_hcd [ 494.737128][ T24] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 494.759575][ T24] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 494.787416][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 494.793817][ T10] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 494.802276][ T10] usb 2-1: config 179 has no interface number 0 [ 494.810696][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 494.822187][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 494.842962][ T9] usb 1-1: config 0 has an invalid interface number: 50 but max is 0 [ 494.851814][ T9] usb 1-1: config 0 has no interface number 0 [ 494.862329][ T9] usb 1-1: New USB device found, idVendor=0b48, idProduct=1009, bcdDevice=87.f7 [ 494.873265][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.882699][ T9] usb 1-1: Product: syz [ 494.887579][ T9] usb 1-1: Manufacturer: syz [ 494.892207][ T9] usb 1-1: SerialNumber: syz [ 494.909100][ T9] usb 1-1: config 0 descriptor?? [ 494.914129][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 494.916906][ T24] usb 3-1: USB disconnect, device number 35 [ 494.946106][ T9] ttusb_dec_send_command: command bulk message failed: error -22 [ 494.959879][ T9] ttusb-dec 1-1:0.50: probe with driver ttusb-dec failed with error -22 [ 494.971938][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 494.993682][ T10] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 495.016875][ T10] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 495.028045][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.045298][T11022] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 495.052686][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 495.294610][T11033] 9pnet_fd: Insufficient options for proto=fd [ 495.296844][ T10] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input21 [ 495.422556][T11035] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1256'. [ 495.547344][T11022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.570325][T11022] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.589028][ T9] IPVS: starting estimator thread 0... [ 495.595243][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 495.595340][T11036] netlink: 'syz.3.1255': attribute type 4 has an invalid length. [ 495.999933][T11036] netlink: 17 bytes leftover after parsing attributes in process `syz.3.1255'. [ 496.009406][T11038] IPVS: using max 41 ests per chain, 98400 per kthread [ 496.478529][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 496.802619][T11045] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1257'. [ 497.282282][ T43] usb 1-1: USB disconnect, device number 30 [ 497.416979][ T24] usb 2-1: USB disconnect, device number 22 [ 497.417009][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 497.432063][ C0] dummy_hcd dummy_hcd.1: timer fired with no URBs pending? [ 497.703167][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 497.881320][T11066] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1263'. [ 497.903084][T11066] netlink: 7 bytes leftover after parsing attributes in process `syz.3.1263'. [ 497.913007][ T24] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 497.938233][T11066] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1263'. [ 497.967910][ T30] audit: type=1400 audit(1758590412.961:563): avc: denied { ioctl } for pid=11064 comm="syz.3.1263" path="socket:[28532]" dev="sockfs" ino=28532 ioctlcmd=0x64b2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 498.279527][T11071] delete_channel: no stack [ 498.403388][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 498.408477][T11074] overlayfs: failed to resolve './file1': -2 [ 498.468515][ T24] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 498.479782][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 498.498119][ T24] usb 2-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 498.500803][T11079] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1265'. [ 498.536654][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.612548][ T24] usb 2-1: config 0 descriptor?? [ 498.647567][T11082] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1266'. [ 498.687004][T11082] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1266'. [ 498.774564][T11087] 9pnet_fd: Insufficient options for proto=fd [ 498.847172][ T43] IPVS: starting estimator thread 0... [ 498.868197][ T30] audit: type=1400 audit(1758590413.861:564): avc: denied { mount } for pid=11089 comm="syz.3.1269" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 498.983591][T11088] IPVS: using max 74 ests per chain, 177600 per kthread [ 499.008905][ T12] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 499.036168][T11094] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1268'. [ 499.055528][ T24] samsung 0003:0419:0001.0017: hidraw0: USB HID v0.01 Device [HID 0419:0001] on usb-dummy_hcd.1-1/input0 [ 499.092371][T11092] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1270'. [ 499.219668][ T24] IPVS: starting estimator thread 0... [ 500.205145][ T24] usb 2-1: USB disconnect, device number 23 [ 500.222585][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 500.275178][T11099] IPVS: using max 41 ests per chain, 98400 per kthread [ 500.746175][T11111] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1273'. [ 501.185452][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.204144][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 501.595485][T11115] ISOFS: Unable to identify CD-ROM format. [ 501.883098][T11126] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 501.955590][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 502.060202][T11127] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1277'. [ 502.189822][T11131] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1278'. [ 502.756600][ T12] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 503.047522][T11142] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1281'. [ 503.075543][T11142] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1281'. [ 503.135081][ T92] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 503.427209][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 503.445590][ T92] usb 5-1: Using ep0 maxpacket: 32 [ 503.464215][ T92] usb 5-1: config index 0 descriptor too short (expected 1060, got 36) [ 503.529549][ T92] usb 5-1: config 0 has an invalid interface number: 54 but max is 0 [ 503.590487][ T92] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 503.655500][ T92] usb 5-1: config 0 has no interface number 0 [ 503.692564][ T92] usb 5-1: config 0 interface 54 has no altsetting 0 [ 503.731861][T11146] netlink: 'syz.3.1283': attribute type 5 has an invalid length. [ 503.736711][ T92] usb 5-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice=46.42 [ 503.812846][ T92] usb 5-1: New USB device strings: Mfr=1, Product=66, SerialNumber=3 [ 503.882500][ T92] usb 5-1: Product: syz [ 503.919839][ T92] usb 5-1: Manufacturer: syz [ 503.960155][ T92] usb 5-1: SerialNumber: syz [ 504.052895][ T92] usb 5-1: config 0 descriptor?? [ 504.265802][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 504.415904][ T92] ums_eneub6250 5-1:0.54: USB Mass Storage device detected [ 505.313149][ T92] usb 5-1: USB disconnect, device number 19 [ 505.384229][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 505.474289][T11154] ISOFS: Unable to identify CD-ROM format. [ 505.642260][T11176] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1289'. [ 506.711466][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 507.971899][T11185] tmpfs: Bad value for 'mpol' [ 507.978033][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 508.281866][T11192] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1291'. [ 508.290992][T11192] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1291'. [ 508.503765][T11195] ======================================================= [ 508.503765][T11195] WARNING: The mand mount option has been deprecated and [ 508.503765][T11195] and is ignored by this kernel. Remove the mand [ 508.503765][T11195] option from the mount to silence this warning. [ 508.503765][T11195] ======================================================= [ 508.538679][ C0] vkms_vblank_simulate: vblank timer overrun [ 508.546554][T11195] new mount options do not match the existing superblock, will be ignored [ 508.658005][T11199] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1293'. [ 508.679757][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 508.786674][T11185] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 508.842195][T11200] ISOFS: Unable to identify CD-ROM format. [ 509.022426][T11199] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1293'. [ 509.693274][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 509.771631][ T30] audit: type=1400 audit(1758590424.761:565): avc: denied { create } for pid=11206 comm="syz.2.1297" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 509.955394][ T30] audit: type=1400 audit(1758590424.771:566): avc: denied { unmount } for pid=5843 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 510.820478][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 511.171970][T11228] netlink: 'syz.1.1301': attribute type 4 has an invalid length. [ 511.179811][T11228] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1301'. [ 511.532996][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 511.562115][T11231] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1303'. [ 511.672238][T11235] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1304'. [ 511.718842][T11226] nvme_fabrics: missing parameter 'transport=%s' [ 511.782377][T11226] nvme_fabrics: missing parameter 'nqn=%s' [ 511.784322][T11237] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1300'. [ 512.025668][T11232] input: syz1 as /devices/virtual/input/input22 [ 512.365724][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 513.227818][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 513.338372][ T30] audit: type=1400 audit(1758590428.331:567): avc: denied { read open } for pid=11256 comm="syz.2.1309" path="/" dev="configfs" ino=1141 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 513.778831][ T30] audit: type=1400 audit(1758590428.741:568): avc: denied { add_name } for pid=11256 comm="syz.2.1309" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 513.780429][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 513.832875][ T30] audit: type=1400 audit(1758590428.741:569): avc: denied { create } for pid=11256 comm="syz.2.1309" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=file permissive=1 [ 514.691647][T11280] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1312'. [ 514.771182][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 515.663401][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 515.745291][ C0] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 8a:a2:25:2a:92:75 [ 515.869086][ T5847] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 516.187510][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 516.215278][ T5847] usb 1-1: Using ep0 maxpacket: 32 [ 516.226095][ T5847] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 516.245098][ T5847] usb 1-1: config 0 has no interface number 0 [ 516.355349][ T5847] usb 1-1: config 0 interface 184 has no altsetting 0 [ 516.432038][ T5847] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 516.487674][ T5847] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.505206][ T5847] usb 1-1: Product: syz [ 516.520565][ T5847] usb 1-1: Manufacturer: syz [ 516.537026][ T5847] usb 1-1: SerialNumber: syz [ 516.562476][ T5847] usb 1-1: config 0 descriptor?? [ 516.675194][ T5847] smsc75xx v1.0.0 [ 516.775161][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 517.149280][ T5847] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 517.205213][ T5847] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 517.315701][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 517.330586][ T5847] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 517.367499][ T5847] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -61 [ 518.086719][T11313] dlm: no locking on control device [ 518.163992][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 518.258427][ T5909] usb 1-1: USB disconnect, device number 31 [ 518.736747][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 519.496904][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 519.638312][T11333] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1327'. [ 520.406448][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 520.782153][T11338] ISOFS: Unable to identify CD-ROM format. [ 521.116606][T11343] ubi: mtd0 is already attached to ubi31 [ 521.155149][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 521.643073][T11350] ISOFS: Unable to identify CD-ROM format. [ 521.655408][ T24] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 521.869568][ T30] audit: type=1400 audit(1758590436.861:570): avc: denied { map } for pid=11349 comm="syz.3.1333" path="socket:[30012]" dev="sockfs" ino=30012 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 521.893693][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 521.901441][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 521.926650][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 521.934441][T11356] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1334'. [ 521.949606][ T24] usb 5-1: New USB device found, idVendor=0789, idProduct=0160, bcdDevice=82.fe [ 521.962539][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.980532][ T24] usb 5-1: Product: syz [ 521.986373][ T24] usb 5-1: Manufacturer: syz [ 521.991018][ T24] usb 5-1: SerialNumber: syz [ 522.301535][T11364] vivid-002: ================= START STATUS ================= [ 522.310901][T11364] vivid-002: Radio HW Seek Mode: Bounded [ 522.319339][T11364] vivid-002: Radio Programmable HW Seek: false [ 522.328288][T11364] vivid-002: RDS Rx I/O Mode: Block I/O [ 522.341572][T11364] vivid-002: Generate RBDS Instead of RDS: false [ 522.348353][T11364] vivid-002: RDS Reception: true [ 522.356583][T11364] vivid-002: RDS Program Type: 0 inactive [ 522.362439][T11364] vivid-002: RDS PS Name: inactive [ 522.367838][T11364] vivid-002: RDS Radio Text: inactive [ 522.373430][T11364] vivid-002: RDS Traffic Announcement: false inactive [ 522.380543][T11364] vivid-002: RDS Traffic Program: false inactive [ 522.387349][T11364] vivid-002: RDS Music: false inactive [ 522.393001][T11364] vivid-002: ================== END STATUS ================== [ 522.456915][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 522.492541][T11346] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 522.532817][T11346] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 522.594813][ T24] asix 5-1:7.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 522.642375][ T24] asix 5-1:7.0: probe with driver asix failed with error -71 [ 522.675768][ T24] usb 5-1: USB disconnect, device number 20 [ 523.006476][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 524.396231][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 524.960580][T11391] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 525.231660][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 525.460554][T11400] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1345'. [ 525.487426][T11400] netlink: 'syz.0.1345': attribute type 16 has an invalid length. [ 525.495696][T11400] netlink: 'syz.0.1345': attribute type 17 has an invalid length. [ 525.555205][ T9] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 525.572372][T11400] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 525.720015][ T9] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 525.767493][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 525.780093][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 525.876477][T11410] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1346'. [ 525.975084][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 57250, setting to 1024 [ 526.005958][ T9] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 1024 [ 526.483164][ T9] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 526.498547][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.520517][ T9] usb 5-1: Product: syz [ 526.540071][ T9] usb 5-1: Manufacturer: syz [ 526.557335][ T9] usb 5-1: SerialNumber: syz [ 526.583388][ T9] usb 5-1: config 0 descriptor?? [ 526.613738][T11396] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 526.621320][T11396] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 526.669799][ T9] usb 5-1: ucan: probing device on interface #0 [ 527.010189][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 527.595267][ T5909] usb 3-1: new full-speed USB device number 36 using dummy_hcd [ 527.821611][ T9] usb 5-1: ucan: could not read protocol version, ret=-110 [ 527.839475][ T9] usb 5-1: ucan: probe failed; try to update the device firmware [ 527.913064][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 528.121444][T11433] ISOFS: Unable to identify CD-ROM format. [ 528.338254][ T5909] usb 3-1: config 0 has an invalid interface number: 50 but max is 0 [ 528.346488][ T5909] usb 3-1: config 0 has no interface number 0 [ 528.365966][ T5909] usb 3-1: New USB device found, idVendor=0b48, idProduct=1009, bcdDevice=87.f7 [ 528.375148][ T5909] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.392535][ T5909] usb 3-1: Product: syz [ 528.437282][ T5909] usb 3-1: Manufacturer: syz [ 528.457502][ T5909] usb 3-1: SerialNumber: syz [ 528.469721][ T5847] usb 5-1: USB disconnect, device number 21 [ 528.490721][ T5909] usb 3-1: config 0 descriptor?? [ 528.523638][ T5909] ttusb_dec_send_command: command bulk message failed: error -22 [ 528.536661][ T5909] ttusb-dec 3-1:0.50: probe with driver ttusb-dec failed with error -22 [ 528.818923][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 528.912725][T11448] macvlan0: entered promiscuous mode [ 528.919200][T11448] macvlan0: entered allmulticast mode [ 528.924602][T11448] veth1_vlan: entered allmulticast mode [ 529.556016][T11457] binder: 11456:11457 ioctl c0046209 9999999999999999 returned -22 [ 530.432498][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 531.206727][T11477] 9pnet_fd: Insufficient options for proto=fd [ 531.222771][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 531.340748][T11484] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1363'. [ 531.572204][ T9] usb 3-1: USB disconnect, device number 36 [ 532.176202][ T1314] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 532.491855][T11504] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1370'. [ 532.626774][T11512] overlayfs: failed to clone upperpath [ 532.661104][T11512] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1371'. [ 532.675121][ T9] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 532.827573][ T5909] usb 2-1: new full-speed USB device number 24 using dummy_hcd [ 532.847789][ T9] usb 5-1: config 0 interface 0 altsetting 185 endpoint 0x81 has invalid wMaxPacketSize 0 [ 533.592606][ T9] usb 5-1: config 0 interface 0 has no altsetting 0 [ 533.599406][ T9] usb 5-1: New USB device found, idVendor=1e7d, idProduct=3138, bcdDevice= 0.00 [ 533.609169][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.620633][ T9] usb 5-1: config 0 descriptor?? [ 533.654147][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 533.776710][ T5909] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 534.063200][ T5909] usb 2-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 534.396184][T11526] ALSA: mixer_oss: invalid OSS volume 'PHONEXÛ0ØIN' [ 534.543720][ T30] audit: type=1400 audit(1758590449.411:571): avc: denied { accept } for pid=11498 comm="syz.4.1369" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 534.678006][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 534.692678][ T5909] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 534.708123][ T5909] usb 2-1: config 0 descriptor?? [ 534.722206][T11509] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 535.215724][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 535.408587][ T5909] elan 0003:04F3:0755.0018: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.1-1/input0 [ 535.539713][T11540] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1372'. [ 535.780303][ T9] usbhid 5-1:0.0: can't add hid device: -71 [ 535.809544][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 535.875467][ T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 535.888353][T11541] input: syz1 as /devices/virtual/input/input23 [ 535.905977][T11541] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1378'. [ 535.995262][T11538] nvme_fabrics: missing parameter 'transport=%s' [ 536.006118][T11538] nvme_fabrics: missing parameter 'nqn=%s' [ 536.036798][ T9] usb 5-1: USB disconnect, device number 22 [ 536.072157][ T5920] usb 2-1: USB disconnect, device number 24 [ 536.475759][ T30] audit: type=1400 audit(1758590451.281:572): avc: denied { setopt } for pid=11550 comm="syz.4.1379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 536.548287][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 536.578591][T11551] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1379'. [ 537.390312][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 537.429153][T11562] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1383'. [ 537.991351][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 538.385217][ T9] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 538.776851][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 538.906336][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 33437, setting to 1024 [ 538.910202][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 539.066697][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0xF has invalid maxpacket 1024 [ 539.158485][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 539.373471][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 539.410355][ T9] usb 2-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 539.473819][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 539.503040][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 539.532031][ T9] usb 2-1: Product: syz [ 539.544109][ T9] usb 2-1: Manufacturer: syz [ 539.558853][ T9] usb 2-1: SerialNumber: syz [ 539.639543][ T9] usb 2-1: config 0 descriptor?? [ 539.722170][T11613] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1395'. [ 539.775371][T11582] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 539.798146][ C0] port100 2-1:0.0: NFC: Urb failure (status -71) [ 539.813469][T11615] ISOFS: Unable to identify CD-ROM format. [ 539.822261][ T9] port100 2-1:0.0: NFC: Could not get supported command types [ 539.936893][T11617] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1397'. [ 540.939180][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 541.090704][ T5920] usb 2-1: USB disconnect, device number 25 [ 541.278038][T11633] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1399'. [ 541.698618][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 543.260143][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 543.306827][ T9] usb 1-1: new full-speed USB device number 32 using dummy_hcd [ 543.591481][ T9] usb 1-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 543.908873][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.973920][ T9] usb 1-1: config 0 descriptor?? [ 543.993400][ T9] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 544.255651][ T9] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 544.301305][ T30] audit: type=1400 audit(1758590459.291:573): avc: denied { rename } for pid=11661 comm="syz.4.1408" name="file0" dev="tmpfs" ino=1490 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 544.330634][ T9] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 544.410484][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 544.464686][ T43] usb 1-1: USB disconnect, device number 32 [ 544.666814][T11668] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1409'. [ 544.971805][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 545.093669][T11671] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1410'. [ 545.208824][T11673] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1411'. [ 545.288944][T11675] ISOFS: Unable to identify CD-ROM format. [ 545.412049][T11679] 9pnet_fd: Insufficient options for proto=fd [ 545.535250][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 545.970718][T11687] ceph: No mds server is up or the cluster is laggy [ 546.187212][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 546.190681][T11691] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1414'. [ 546.847446][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 547.663225][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 548.005999][T11719] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1422'. [ 548.076022][T11718] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1423'. [ 548.138703][ T30] audit: type=1400 audit(1758590463.131:574): avc: denied { ioctl } for pid=11720 comm="syz.4.1424" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 548.245962][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 548.395156][ C0] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 8a:a2:25:2a:92:75 [ 548.494065][T11730] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1425'. [ 548.956436][T11728] FAULT_INJECTION: forcing a failure. [ 548.956436][T11728] name failslab, interval 1, probability 0, space 0, times 0 [ 548.975484][T11728] CPU: 1 UID: 0 PID: 11728 Comm: syz.0.1426 Not tainted syzkaller #0 PREEMPT(full) [ 548.975492][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 548.975515][T11728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 548.975525][T11728] Call Trace: [ 548.975530][T11728] [ 548.975537][T11728] dump_stack_lvl+0x16c/0x1f0 [ 548.975561][T11728] should_fail_ex+0x512/0x640 [ 548.975581][T11728] ? fs_reclaim_acquire+0xae/0x150 [ 548.975604][T11728] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 548.975628][T11728] should_failslab+0xc2/0x120 [ 548.975647][T11728] __kmalloc_noprof+0xd2/0x510 [ 548.975668][T11728] tomoyo_realpath_from_path+0xc2/0x6e0 [ 548.975693][T11728] ? tomoyo_profile+0x47/0x60 [ 548.975710][T11728] tomoyo_path_number_perm+0x245/0x580 [ 548.975729][T11728] ? tomoyo_path_number_perm+0x237/0x580 [ 548.975751][T11728] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 548.975772][T11728] ? find_held_lock+0x2b/0x80 [ 548.975811][T11728] ? find_held_lock+0x2b/0x80 [ 548.975829][T11728] ? hook_file_ioctl_common+0x145/0x410 [ 548.975850][T11728] ? __fget_files+0x20e/0x3c0 [ 548.975872][T11728] security_file_ioctl+0x9b/0x240 [ 548.975895][T11728] __x64_sys_ioctl+0xb7/0x210 [ 548.975922][T11728] do_syscall_64+0xcd/0x4e0 [ 548.975944][T11728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.975959][T11728] RIP: 0033:0x7fc55c98eec9 [ 548.975973][T11728] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 548.975988][T11728] RSP: 002b:00007fc55d78a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 548.976003][T11728] RAX: ffffffffffffffda RBX: 00007fc55cbe5fa0 RCX: 00007fc55c98eec9 [ 548.976013][T11728] RDX: 0000200000000280 RSI: 00000000c0306201 RDI: 0000000000000003 [ 548.976022][T11728] RBP: 00007fc55d78a090 R08: 0000000000000000 R09: 0000000000000000 [ 548.976031][T11728] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 548.976040][T11728] R13: 00007fc55cbe6038 R14: 00007fc55cbe5fa0 R15: 00007fff4db93e38 [ 548.976061][T11728] [ 548.976068][T11728] ERROR: Out of memory at tomoyo_realpath_from_path. [ 549.917905][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 553.221027][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 554.103221][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 554.225627][T11767] futex_wake_op: syz.1.1435 tries to shift op by -1; fix this program [ 554.414538][T11773] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1437'. [ 554.627862][ T5920] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 554.646796][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 555.207569][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 555.225087][ T5920] usb 2-1: Using ep0 maxpacket: 16 [ 555.241721][ T5920] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 555.270533][ T5920] usb 2-1: config 0 has no interface number 0 [ 555.285666][ T5920] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 555.308075][ T5920] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 555.333125][ T5920] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 555.342574][ T5920] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 555.351799][ T5920] usb 2-1: Product: syz [ 555.356916][ T5920] usb 2-1: SerialNumber: syz [ 555.385795][ T5920] usb 2-1: config 0 descriptor?? [ 555.398415][ T5920] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 555.653345][ T30] audit: type=1400 audit(1758590470.641:575): avc: denied { create } for pid=11764 comm="syz.1.1435" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 555.685850][ T5920] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input24 [ 555.714678][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 555.725332][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 555.732482][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 555.739588][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 555.746708][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 555.754743][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 555.761905][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 555.768999][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 555.776084][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 555.783159][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 555.888472][ T5920] usb 2-1: USB disconnect, device number 26 [ 555.894468][ C0] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 555.895726][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 555.936524][T11806] FAULT_INJECTION: forcing a failure. [ 555.936524][T11806] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 555.950921][T11806] CPU: 1 UID: 0 PID: 11806 Comm: syz.0.1443 Not tainted syzkaller #0 PREEMPT(full) [ 555.950942][T11806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 555.950950][T11806] Call Trace: [ 555.950955][T11806] [ 555.950960][T11806] dump_stack_lvl+0x16c/0x1f0 [ 555.950983][T11806] should_fail_ex+0x512/0x640 [ 555.951004][T11806] _copy_from_iter+0x29f/0x1720 [ 555.951027][T11806] ? __alloc_skb+0x200/0x380 [ 555.951044][T11806] ? __pfx__copy_from_iter+0x10/0x10 [ 555.951065][T11806] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 555.951090][T11806] netlink_sendmsg+0x829/0xdd0 [ 555.951111][T11806] ? __pfx_netlink_sendmsg+0x10/0x10 [ 555.951138][T11806] ____sys_sendmsg+0xa98/0xc70 [ 555.951162][T11806] ? copy_msghdr_from_user+0x10a/0x160 [ 555.951181][T11806] ? __pfx_____sys_sendmsg+0x10/0x10 [ 555.951213][T11806] ___sys_sendmsg+0x134/0x1d0 [ 555.951230][T11806] ? __pfx____sys_sendmsg+0x10/0x10 [ 555.951273][T11806] __sys_sendmsg+0x16d/0x220 [ 555.951293][T11806] ? __pfx___sys_sendmsg+0x10/0x10 [ 555.951328][T11806] do_syscall_64+0xcd/0x4e0 [ 555.951352][T11806] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.951368][T11806] RIP: 0033:0x7fc55c98eec9 [ 555.951381][T11806] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 555.951396][T11806] RSP: 002b:00007fc55d748038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 555.951412][T11806] RAX: ffffffffffffffda RBX: 00007fc55cbe6180 RCX: 00007fc55c98eec9 [ 555.951423][T11806] RDX: 0000000000000040 RSI: 0000200000000000 RDI: 000000000000000d [ 555.951433][T11806] RBP: 00007fc55d748090 R08: 0000000000000000 R09: 0000000000000000 [ 555.951443][T11806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 555.951452][T11806] R13: 00007fc55cbe6218 R14: 00007fc55cbe6180 R15: 00007fff4db93e38 [ 555.951475][T11806] [ 555.958000][ T5920] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 556.444281][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 557.480510][T11815] ISOFS: Unable to identify CD-ROM format. [ 557.616021][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 558.277161][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 558.995164][T11840] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1452'. [ 559.035618][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 559.067113][T11843] nvme_fabrics: missing parameter 'transport=%s' [ 559.074109][T11843] nvme_fabrics: missing parameter 'nqn=%s' [ 559.430693][ T30] audit: type=1400 audit(1758590474.421:576): avc: denied { create } for pid=11847 comm="syz.3.1448" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 559.456472][ T30] audit: type=1400 audit(1758590474.451:577): avc: denied { bind } for pid=11847 comm="syz.3.1448" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 559.498752][T11803] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 559.510802][T11803] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 559.571367][T11830] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1449'. [ 559.595043][ T4591] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.621961][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 559.656985][ T4591] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.712108][ T4591] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.736675][ T4591] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 560.512767][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 560.820405][T11874] netlink: 'syz.3.1458': attribute type 5 has an invalid length. [ 560.859670][T11877] netlink: 'syz.1.1459': attribute type 4 has an invalid length. [ 561.013665][T11881] netlink: 'syz.1.1459': attribute type 4 has an invalid length. [ 561.276780][T11884] ISOFS: Unable to identify CD-ROM format. [ 561.389210][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 561.479843][T11886] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1463'. [ 561.611467][T11890] macvlan3: entered promiscuous mode [ 561.619179][T11890] macvlan3: entered allmulticast mode [ 561.633609][T11890] bond2: (slave macvlan3): Opening slave failed [ 561.716340][ T5920] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 561.922769][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 561.939320][ T5920] usb 3-1: Using ep0 maxpacket: 32 [ 561.947054][ T5920] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 561.957964][ T5920] usb 3-1: config 0 has no interface number 0 [ 562.393070][ T5920] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 562.403658][ T5920] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.412506][ T5920] usb 3-1: Product: syz [ 562.417316][ T5920] usb 3-1: Manufacturer: syz [ 562.422092][ T5920] usb 3-1: SerialNumber: syz [ 562.441803][ T5920] usb 3-1: config 0 descriptor?? [ 562.456091][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 562.477193][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.498100][ T5920] smsc95xx v2.0.0 [ 562.922984][ T30] audit: type=1400 audit(1758590477.901:578): avc: denied { mounton } for pid=11909 comm="syz.4.1468" path="/294/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 562.950019][ T30] audit: type=1400 audit(1758590477.911:579): avc: denied { read write } for pid=11909 comm="syz.4.1468" dev="9p" ino=65538 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 562.998967][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 563.401583][T11921] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1469'. [ 563.475124][ T30] audit: type=1400 audit(1758590477.911:580): avc: denied { open } for pid=11909 comm="syz.4.1468" path="/294/file0" dev="9p" ino=65538 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 563.501658][ T30] audit: type=1400 audit(1758590478.431:581): avc: denied { unmount } for pid=5844 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 563.598207][ T5920] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000030: -71 [ 563.775059][ T5920] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 563.795476][ T5920] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 563.806822][ T5920] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 563.825579][ T5920] usb 3-1: USB disconnect, device number 37 [ 563.939616][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 564.546936][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 564.772346][ T30] audit: type=1400 audit(1758590479.671:582): avc: denied { map } for pid=11934 comm="syz.2.1474" path="socket:[31994]" dev="sockfs" ino=31994 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 564.828854][ T30] audit: type=1400 audit(1758590479.671:583): avc: denied { read } for pid=11934 comm="syz.2.1474" path="socket:[31994]" dev="sockfs" ino=31994 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 565.087148][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 565.559179][T11946] netlink: 'syz.3.1476': attribute type 2 has an invalid length. [ 565.567097][T11946] netlink: 119 bytes leftover after parsing attributes in process `syz.3.1476'. [ 565.625790][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 566.277891][ T43] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 566.305369][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 566.340865][T11953] 9pnet_fd: Insufficient options for proto=fd [ 566.435096][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 566.444765][ T43] usb 2-1: unable to get BOS descriptor or descriptor too short [ 566.456503][ T43] usb 2-1: config 15 has an invalid interface number: 174 but max is 0 [ 566.464789][ T43] usb 2-1: config 15 has no interface number 0 [ 566.871550][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 566.886044][ T43] usb 2-1: config 15 interface 174 altsetting 1 bulk endpoint 0x8 has invalid maxpacket 32 [ 566.915099][ T43] usb 2-1: config 15 interface 174 altsetting 1 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 566.923276][ T30] audit: type=1400 audit(1758590481.901:584): avc: denied { append } for pid=11955 comm="syz.4.1480" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 566.977338][ T43] usb 2-1: config 15 interface 174 altsetting 1 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 566.997482][T11954] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1479'. [ 567.010177][ T43] usb 2-1: config 15 interface 174 has no altsetting 0 [ 567.027903][ T30] audit: type=1400 audit(1758590481.951:585): avc: denied { ioctl } for pid=11955 comm="syz.4.1480" path="/dev/input/mice" dev="devtmpfs" ino=916 ioctlcmd=0xf50a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 567.059128][ T43] usb 2-1: language id specifier not provided by device, defaulting to English [ 567.070756][ T43] usb 2-1: New USB device found, idVendor=1199, idProduct=6859, bcdDevice=fd.7d [ 567.100907][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.115748][ T43] usb 2-1: Product: syz [ 567.120014][ T43] usb 2-1: Manufacturer: syz [ 567.127723][ T43] usb 2-1: SerialNumber: syz [ 567.261555][T11966] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 568.082689][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 568.095375][T11947] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 568.429696][ T43] sierra 2-1:15.174: Sierra USB modem converter detected [ 568.558684][ T43] usb 2-1: Sierra USB modem converter now attached to ttyUSB0 [ 568.668711][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 568.670593][ T43] usb 2-1: USB disconnect, device number 27 [ 568.692237][T11977] dvmrp8: left allmulticast mode [ 568.706207][T11979] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1485'. [ 568.764145][ T43] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 568.808514][ T43] sierra 2-1:15.174: device disconnected [ 568.847252][T11975] syz_tun: left allmulticast mode [ 568.974568][T11983] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1486'. [ 569.291355][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 569.411332][T11996] 9pnet_fd: Insufficient options for proto=fd [ 570.382009][T12005] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1490'. [ 570.407975][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 570.562108][T12010] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1493'. [ 570.581375][ T24] IPVS: starting estimator thread 0... [ 570.585515][ T5920] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 570.718431][T12013] IPVS: using max 44 ests per chain, 105600 per kthread [ 570.769904][ T30] audit: type=1400 audit(1758590485.761:586): avc: denied { write } for pid=12014 comm="syz.4.1494" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 570.805262][ T43] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 570.872982][ T5920] usb 2-1: Using ep0 maxpacket: 32 [ 570.990530][ T30] audit: type=1400 audit(1758590485.851:587): avc: denied { ioctl } for pid=12014 comm="syz.4.1494" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x127f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 571.065855][ T5920] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 571.067258][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 571.074768][ T5920] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 571.095782][ T5920] usb 2-1: config 0 has no interface number 0 [ 571.128628][ T5920] usb 2-1: config 0 interface 8 altsetting 248 endpoint 0xC has an invalid bInterval 0, changing to 7 [ 571.142223][ T5920] usb 2-1: config 0 interface 8 altsetting 248 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 571.159200][ T5920] usb 2-1: config 0 interface 8 has no altsetting 0 [ 571.167804][ T5920] usb 2-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=2d.bb [ 571.171055][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 571.191389][ T43] usb 3-1: New USB device found, idVendor=0c12, idProduct=0005, bcdDevice= 0.00 [ 571.212799][ T5920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.225131][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.226355][ T5920] usb 2-1: Product: syz [ 571.245081][ T5920] usb 2-1: Manufacturer: syz [ 571.257669][ T5920] usb 2-1: SerialNumber: syz [ 571.259806][ T43] usb 3-1: config 0 descriptor?? [ 571.299493][ T5920] usb 2-1: config 0 descriptor?? [ 571.601110][ T5920] ath6kl: Failed to submit usb control message: -71 [ 571.615341][ T5920] ath6kl: unable to send the bmi data to the device: -71 [ 571.635304][ T5920] ath6kl: Unable to send get target info: -71 [ 571.652959][ T5920] ath6kl: Failed to init ath6kl core: -71 [ 571.659180][ T5920] ath6kl_usb 2-1:0.8: probe with driver ath6kl_usb failed with error -71 [ 571.691730][ T5920] usb 2-1: USB disconnect, device number 28 [ 571.790057][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 571.980283][T12011] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=12011 comm=syz.2.1488 [ 571.993039][ T92] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 572.185178][ T92] usb 1-1: Using ep0 maxpacket: 32 [ 572.202818][ T92] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 572.340027][T12037] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1501'. [ 572.349696][ T92] usb 1-1: config 0 has no interface number 0 [ 572.355158][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 572.358335][ T92] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 573.329636][ T92] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 573.368554][ T43] usbhid 3-1:0.0: can't add hid device: -71 [ 573.380443][ T43] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 573.807604][ T92] usb 1-1: Product: syz [ 573.811947][ T92] usb 1-1: Manufacturer: syz [ 573.827242][ T92] usb 1-1: SerialNumber: syz [ 573.841017][ T43] usb 3-1: USB disconnect, device number 38 [ 573.865535][ T92] usb 1-1: config 0 descriptor?? [ 574.259586][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 574.693660][ T92] smsc95xx v2.0.0 [ 575.005631][T12043] netlink: 'syz.0.1496': attribute type 5 has an invalid length. [ 575.124481][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 575.230624][T12055] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1504'. [ 575.699761][ T92] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 575.771599][ T92] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 575.787490][ T92] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 575.807741][ T92] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 575.831135][ T92] usb 1-1: USB disconnect, device number 33 [ 575.873674][T12060] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1507'. [ 575.976943][ T30] audit: type=1326 audit(1758590490.971:588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12048 comm="syz.2.1505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda8eb8eec9 code=0x7ffc0000 [ 576.011817][T12064] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1508'. [ 576.016309][ T30] audit: type=1326 audit(1758590490.991:589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12048 comm="syz.2.1505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda8eb8eec9 code=0x7ffc0000 [ 576.089700][ T30] audit: type=1326 audit(1758590490.991:590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12048 comm="syz.2.1505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=117 compat=0 ip=0x7fda8eb8eec9 code=0x7ffc0000 [ 576.126492][ T30] audit: type=1326 audit(1758590490.991:591): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12048 comm="syz.2.1505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda8eb8eec9 code=0x7ffc0000 [ 576.178781][ T30] audit: type=1326 audit(1758590490.991:592): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12048 comm="syz.2.1505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda8eb8eec9 code=0x7ffc0000 [ 576.208528][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 576.223068][ T30] audit: type=1326 audit(1758590490.991:593): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12048 comm="syz.2.1505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7fda8eb8eec9 code=0x7ffc0000 [ 576.250780][ T30] audit: type=1326 audit(1758590490.991:594): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12048 comm="syz.2.1505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda8eb8eec9 code=0x7ffc0000 [ 576.283074][ T30] audit: type=1326 audit(1758590490.991:595): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12048 comm="syz.2.1505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda8eb8eec9 code=0x7ffc0000 [ 576.309929][T12064] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1508'. [ 576.311615][ T30] audit: type=1326 audit(1758590490.991:596): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12048 comm="syz.2.1505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fda8eb8d710 code=0x7ffc0000 [ 576.345114][ T30] audit: type=1326 audit(1758590490.991:597): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12048 comm="syz.2.1505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda8eb8eec9 code=0x7ffc0000 [ 576.345351][ T5847] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 576.494154][T12077] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1513'. [ 576.606883][ T5847] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 576.619620][ T5847] usb 5-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 576.639333][ T5847] usb 5-1: config 220 interface 0 has no altsetting 0 [ 576.665118][ T5847] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 576.674319][ T5847] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.694982][ T5847] usb 5-1: Product: syz [ 576.724844][ T5847] usb 5-1: Manufacturer: syz [ 576.729549][ T5847] usb 5-1: SerialNumber: syz [ 576.761768][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 577.612833][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 578.177733][ T5909] libceph: connect (1)[c::]:6789 error -101 [ 578.463643][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 578.468204][ T5909] libceph: mon0 (1)[c::]:6789 connect error [ 578.682417][T12097] ceph: No mds server is up or the cluster is laggy [ 579.020371][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 579.900604][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 579.916325][T12129] /dev/nullb0: Can't open blockdev [ 579.955138][ T92] usb 2-1: new full-speed USB device number 29 using dummy_hcd [ 579.992751][ T5847] usb 5-1: Found UVC 0.00 device syz (8086:0b07) [ 580.033975][ T5847] usb 5-1: No valid video chain found. [ 580.075907][ T5847] usb 5-1: USB disconnect, device number 23 [ 580.241476][ T92] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 580.252310][ T92] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 580.265914][ T92] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 580.275561][ T92] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 580.518289][ T92] usb 2-1: usb_control_msg returned -32 [ 580.593414][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 580.644102][ T92] usbtmc 2-1:16.0: can't read capabilities [ 580.749225][T12150] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1528'. [ 580.773275][T12147] ISOFS: Unable to identify CD-ROM format. [ 580.906244][T12151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 580.994221][T12151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 581.366741][T12159] netlink: 'syz.0.1529': attribute type 2 has an invalid length. [ 581.374602][T12159] netlink: 119 bytes leftover after parsing attributes in process `syz.0.1529'. [ 581.435249][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 582.597416][T12170] workqueue: Failed to create a rescuer kthread for wq "ceph-watch-notify": -EINTR [ 582.801248][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 582.802087][ T43] usb 2-1: USB disconnect, device number 29 [ 583.299904][T12182] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1536'. [ 583.736759][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 584.094760][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 584.094781][ T30] audit: type=1400 audit(1758590499.061:612): avc: denied { create } for pid=12176 comm="syz.2.1535" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 584.333896][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 584.955339][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 585.669301][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 585.978759][T12222] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1545'. [ 587.018394][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 587.063844][ T30] audit: type=1400 audit(1758590502.051:613): avc: denied { append } for pid=12231 comm="syz.4.1548" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 587.225895][T12233] FAULT_INJECTION: forcing a failure. [ 587.225895][T12233] name failslab, interval 1, probability 0, space 0, times 0 [ 587.238541][T12233] CPU: 1 UID: 0 PID: 12233 Comm: syz.4.1548 Not tainted syzkaller #0 PREEMPT(full) [ 587.238557][T12233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 587.238563][T12233] Call Trace: [ 587.238567][T12233] [ 587.238571][T12233] dump_stack_lvl+0x16c/0x1f0 [ 587.238592][T12233] should_fail_ex+0x512/0x640 [ 587.238607][T12233] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 587.238622][T12233] should_failslab+0xc2/0x120 [ 587.238635][T12233] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 587.238647][T12233] ? getname_flags.part.0+0x4c/0x550 [ 587.238666][T12233] getname_flags.part.0+0x4c/0x550 [ 587.238689][T12233] getname_flags+0x93/0xf0 [ 587.238701][T12233] __x64_sys_execve+0x74/0xb0 [ 587.238714][T12233] do_syscall_64+0xcd/0x4e0 [ 587.238730][T12233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.238741][T12233] RIP: 0033:0x7f160c38eec9 [ 587.238751][T12233] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 587.238762][T12233] RSP: 002b:00007f160d191038 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 587.238773][T12233] RAX: ffffffffffffffda RBX: 00007f160c5e6090 RCX: 00007f160c38eec9 [ 587.238779][T12233] RDX: 0000200000000180 RSI: 0000000000000000 RDI: 0000200000000000 [ 587.238786][T12233] RBP: 00007f160d191090 R08: 0000000000000000 R09: 0000000000000000 [ 587.238792][T12233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 587.238799][T12233] R13: 00007f160c5e6128 R14: 00007f160c5e6090 R15: 00007ffeeab5df78 [ 587.238813][T12233] [ 587.442378][T12234] tipc: Enabled bearer , priority 0 [ 587.606819][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 587.802910][T12244] sp0: Synchronizing with TNC [ 587.885164][ T43] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 588.174351][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 588.175100][ T43] usb 3-1: Using ep0 maxpacket: 32 [ 588.475190][ T10] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 588.511701][ T43] usb 3-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 588.521015][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.557200][ T5909] tipc: Node number set to 1222448390 [ 588.577463][ T43] usb 3-1: config 0 descriptor?? [ 588.606534][ T43] gspca_main: sunplus-2.14.0 probing 041e:400b [ 588.636993][ T10] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 588.651341][ T10] usb 1-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 588.695135][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 588.773647][ T10] usb 1-1: config 220 interface 0 has no altsetting 0 [ 588.836696][ T10] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 588.846133][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.854111][ T10] usb 1-1: Product: syz [ 588.885084][ T10] usb 1-1: Manufacturer: syz [ 588.907676][ T10] usb 1-1: SerialNumber: syz [ 589.315320][ T43] gspca_sunplus: reg_w_riv err -110 [ 589.321067][ T43] sunplus 3-1:0.0: probe with driver sunplus failed with error -110 [ 589.386930][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 589.623484][ T10] usb 1-1: Found UVC 0.00 device syz (8086:0b07) [ 589.642584][ T10] usb 1-1: No valid video chain found. [ 589.660074][ T10] usb 1-1: USB disconnect, device number 34 [ 589.829440][T12272] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1559'. [ 590.128640][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 590.253771][ T43] usb 3-1: USB disconnect, device number 39 [ 591.108264][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 591.126327][T12284] ceph: No mds server is up or the cluster is laggy [ 591.134293][ T5847] libceph: connect (1)[c::]:6789 error -101 [ 591.142440][ T5847] libceph: mon0 (1)[c::]:6789 connect error [ 591.616404][T12297] I/O error, dev loop4, sector 16 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 591.635194][ T36] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 591.691190][ T30] audit: type=1400 audit(1758590506.591:614): avc: denied { mount } for pid=12292 comm="syz.4.1565" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 592.065204][ T30] audit: type=1400 audit(1758590506.731:615): avc: denied { mounton } for pid=12292 comm="syz.4.1565" path="/314/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 592.337694][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 592.945205][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 593.173729][T12316] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1568'. [ 593.625720][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 594.050905][T12325] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1571'. [ 594.553031][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 594.569457][ T30] audit: type=1400 audit(1758590509.511:616): avc: denied { unmount } for pid=5844 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 594.817535][ T30] audit: type=1400 audit(1758590509.811:617): avc: denied { write } for pid=12329 comm="syz.4.1574" path="socket:[32892]" dev="sockfs" ino=32892 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 594.836181][T12334] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1574'. [ 594.859713][T12334] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1574'. [ 595.076975][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 595.105490][ T5847] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 595.235090][ T5847] usb 2-1: device descriptor read/64, error -71 [ 595.470368][ T30] audit: type=1326 audit(1758590510.461:618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12340 comm="syz.3.1576" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d34f8eec9 code=0x7ffc0000 [ 595.496437][ T30] audit: type=1326 audit(1758590510.461:619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12340 comm="syz.3.1576" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d34f8eec9 code=0x7ffc0000 [ 595.562764][ T5847] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 595.624420][ T8163] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 595.641430][ T30] audit: type=1326 audit(1758590510.461:620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12340 comm="syz.3.1576" exe="/root/syz-executor" sig=0 arch=c000003e syscall=437 compat=0 ip=0x7f4d34f8eec9 code=0x7ffc0000 [ 595.725081][ T5847] usb 2-1: device descriptor read/64, error -71 [ 595.853349][ T5847] usb usb2-port1: attempt power cycle [ 596.021963][ T30] audit: type=1326 audit(1758590510.461:621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12340 comm="syz.3.1576" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d34f8eec9 code=0x7ffc0000 [ 596.045390][ C0] vkms_vblank_simulate: vblank timer overrun [ 596.054097][ T30] audit: type=1326 audit(1758590510.461:622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12340 comm="syz.3.1576" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d34f8eec9 code=0x7ffc0000 [ 596.077846][ C0] vkms_vblank_simulate: vblank timer overrun [ 596.114713][ T30] audit: type=1326 audit(1758590510.461:623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12340 comm="syz.3.1576" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4d34f8d710 code=0x7ffc0000 [ 596.205540][ T5847] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 596.272090][ T5847] usb 2-1: device descriptor read/8, error -71 [ 596.295399][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 596.644801][T12361] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1581'. [ 597.059961][ T5847] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 597.062906][ T12] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 597.085745][ T5847] usb 2-1: device descriptor read/8, error -71 [ 597.195422][ T5847] usb usb2-port1: unable to enumerate USB device [ 597.241222][T12365] netlink: 'syz.3.1583': attribute type 5 has an invalid length. [ 597.607886][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 597.675062][ T10] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 597.875146][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 597.886963][ T10] usb 5-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 597.897880][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.262757][ T10] usb 5-1: Product: syz [ 598.267057][ T10] usb 5-1: Manufacturer: syz [ 598.271646][ T10] usb 5-1: SerialNumber: syz [ 598.287115][ T10] usb 5-1: config 0 descriptor?? [ 598.310556][ T12] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 598.310998][ T10] gspca_main: se401-2.14.0 probing 047d:5003 [ 598.575601][T12383] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1586'. [ 598.584651][T12383] netlink: 'syz.3.1586': attribute type 5 has an invalid length. [ 598.592586][T12383] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1586'. [ 598.622729][T12383] geneve2: entered promiscuous mode [ 598.628425][T12383] geneve2: entered allmulticast mode [ 598.812874][ T44] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 598.823447][ T44] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 598.843441][ T44] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 598.853963][ T44] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 598.935173][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 598.990802][ T10] gspca_se401: ExtraFeatures: 97 [ 598.995899][ T10] gspca_se401: Too many frame sizes [ 599.259894][T12372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 599.274699][T12372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 599.325766][ T5847] usb 5-1: USB disconnect, device number 24 [ 599.461339][T12396] dlm: non-version read from control device 21 [ 599.462016][T12394] ISOFS: Unable to identify CD-ROM format. [ 599.475637][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 600.019520][T12401] ISOFS: Unable to identify CD-ROM format. [ 600.028481][ T12] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 600.057812][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 600.057826][ T30] audit: type=1326 audit(1758590515.051:651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12402 comm="syz.0.1593" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc55c98eec9 code=0x0 [ 600.355666][ T92] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 600.505709][ T92] usb 1-1: Using ep0 maxpacket: 32 [ 600.519965][ T92] usb 1-1: config 0 has an invalid interface number: 132 but max is 0 [ 600.538678][ T92] usb 1-1: config 0 has no interface number 0 [ 600.545846][ T92] usb 1-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 600.557354][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 600.577122][ T92] usb 1-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 600.586987][ T92] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.595405][ T92] usb 1-1: Product: syz [ 600.600563][ T92] usb 1-1: Manufacturer: syz [ 600.608580][ T92] usb 1-1: SerialNumber: syz [ 600.616426][ T92] usb 1-1: config 0 descriptor?? [ 600.624786][ T92] em28xx 1-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 600.636977][ T92] em28xx 1-1:0.132: Video interface 132 found: [ 601.187983][ T92] em28xx 1-1:0.132: chip ID is em2800 [ 601.189652][ T12] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 601.307786][T12409] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1596'. [ 601.327383][T12409] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1596'. [ 601.808333][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 602.165316][T12427] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1601'. [ 602.289095][ T92] em28xx 1-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 602.301421][ T92] em28xx 1-1:0.132: board has no eeprom [ 602.365365][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 602.379831][ T92] em28xx 1-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 602.389631][ T92] em28xx 1-1:0.132: analog set to bulk mode. [ 602.398864][ T5920] em28xx 1-1:0.132: Registering V4L2 extension [ 602.483400][ T5920] em28xx 1-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 602.808342][ T5920] em28xx 1-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 603.106996][T12438] ceph: No mds server is up or the cluster is laggy [ 603.113932][ T5847] libceph: connect (1)[c::]:6789 error -101 [ 603.122311][ T5847] libceph: mon0 (1)[c::]:6789 connect error [ 603.136902][ T5920] em28xx 1-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 603.155655][ T44] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 603.255551][ T5847] usb 1-1: USB disconnect, device number 35 [ 603.261924][ T5920] em28xx 1-1:0.132: failed to trigger read from i2c address 0x40 (error=-19) [ 603.318798][ T5847] em28xx 1-1:0.132: Disconnecting em28xx [ 603.404063][T12445] overlayfs: failed to clone upperpath [ 603.696515][ T30] audit: type=1804 audit(1758590518.661:652): pid=12448 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.0.1606" name="/newroot/288/file0" dev="tmpfs" ino=1540 res=1 errno=0 [ 603.862606][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 603.919116][ T5920] em28xx 1-1:0.132: Config register raw data: 0xffffffed [ 604.071815][ T30] audit: type=1400 audit(1758590519.061:653): avc: denied { bind } for pid=12447 comm="syz.0.1606" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 604.095130][ T5920] em28xx 1-1:0.132: AC97 chip type couldn't be determined [ 604.133173][ T5920] em28xx 1-1:0.132: No AC97 audio processor [ 604.193455][T12459] netlink: 'syz.1.1608': attribute type 1 has an invalid length. [ 604.214419][T12459] gretap2: entered promiscuous mode [ 604.429814][ T5920] usb 1-1: Decoder not found [ 604.510764][ T5920] em28xx 1-1:0.132: failed to create media graph [ 604.750583][ T13] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 604.945446][ T5920] em28xx 1-1:0.132: V4L2 device video103 deregistered [ 604.959612][ T5920] em28xx 1-1:0.132: Remote control support is not available for this card. [ 604.987573][ T5847] em28xx 1-1:0.132: Closing input extension [ 604.993918][ T5847] ================================================================== [ 605.001966][ T5847] BUG: KASAN: slab-use-after-free in media_device_unregister+0x598/0x5c0 [ 605.010384][ T5847] Read of size 8 at addr ffff888077a68210 by task kworker/1:3/5847 [ 605.018255][ T5847] [ 605.020583][ T5847] CPU: 1 UID: 0 PID: 5847 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full) [ 605.020607][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 605.020620][ T5847] Workqueue: usb_hub_wq hub_event [ 605.020650][ T5847] Call Trace: [ 605.020658][ T5847] [ 605.020666][ T5847] dump_stack_lvl+0x116/0x1f0 [ 605.020694][ T5847] print_report+0xcd/0x630 [ 605.020716][ T5847] ? __virt_addr_valid+0x81/0x610 [ 605.020741][ T5847] ? __phys_addr+0xe8/0x180 [ 605.020767][ T5847] ? media_device_unregister+0x598/0x5c0 [ 605.020788][ T5847] kasan_report+0xe0/0x110 [ 605.020810][ T5847] ? media_device_unregister+0x598/0x5c0 [ 605.020836][ T5847] media_device_unregister+0x598/0x5c0 [ 605.020861][ T5847] em28xx_release_resources+0xb2/0x2d0 [ 605.020882][ T5847] em28xx_usb_disconnect+0x1de/0x610 [ 605.020902][ T5847] usb_unbind_interface+0x1dd/0x9e0 [ 605.020932][ T5847] ? kernfs_remove_by_name_ns+0xbe/0x110 [ 605.020951][ T5847] ? __pfx_usb_unbind_interface+0x10/0x10 [ 605.020980][ T5847] device_remove+0x125/0x170 [ 605.021001][ T5847] device_release_driver_internal+0x44b/0x620 [ 605.021029][ T5847] bus_remove_device+0x22f/0x420 [ 605.021049][ T5847] device_del+0x396/0x9f0 [ 605.021072][ T5847] ? __pfx_device_del+0x10/0x10 [ 605.021092][ T5847] ? kobject_put+0x210/0x5a0 [ 605.021119][ T5847] usb_disable_device+0x355/0x7d0 [ 605.021146][ T5847] usb_disconnect+0x2e1/0x9c0 [ 605.021173][ T5847] hub_event+0x1c81/0x4fe0 [ 605.021206][ T5847] ? __lock_acquire+0xb97/0x1ce0 [ 605.021236][ T5847] ? __pfx_hub_event+0x10/0x10 [ 605.021260][ T5847] ? assoc_array_insert+0x1520/0x3970 [ 605.021293][ T5847] ? rcu_is_watching+0x12/0xc0 [ 605.021318][ T5847] process_one_work+0x9cc/0x1b70 [ 605.021340][ T5847] ? __pfx_process_one_work+0x10/0x10 [ 605.021364][ T5847] ? assign_work+0x1a0/0x250 [ 605.021383][ T5847] worker_thread+0x6c8/0xf10 [ 605.021406][ T5847] ? __kthread_parkme+0x19e/0x250 [ 605.021432][ T5847] ? __pfx_worker_thread+0x10/0x10 [ 605.021452][ T5847] kthread+0x3c2/0x780 [ 605.021470][ T5847] ? __pfx_kthread+0x10/0x10 [ 605.021488][ T5847] ? rcu_is_watching+0x12/0xc0 [ 605.021510][ T5847] ? __pfx_kthread+0x10/0x10 [ 605.021527][ T5847] ret_from_fork+0x56a/0x730 [ 605.021545][ T5847] ? __pfx_kthread+0x10/0x10 [ 605.021563][ T5847] ret_from_fork_asm+0x1a/0x30 [ 605.021597][ T5847] [ 605.021604][ T5847] [ 605.248460][ T5847] Allocated by task 5920: [ 605.252763][ T5847] kasan_save_stack+0x33/0x60 [ 605.257420][ T5847] kasan_save_track+0x14/0x30 [ 605.262074][ T5847] __kasan_kmalloc+0xaa/0xb0 [ 605.266639][ T5847] em28xx_v4l2_init+0x114/0x4080 [ 605.271557][ T5847] em28xx_init_extension+0x13a/0x200 [ 605.276838][ T5847] request_module_async+0x61/0x70 [ 605.281837][ T5847] process_one_work+0x9cc/0x1b70 [ 605.286761][ T5847] worker_thread+0x6c8/0xf10 [ 605.291326][ T5847] kthread+0x3c2/0x780 [ 605.295461][ T5847] ret_from_fork+0x56a/0x730 [ 605.300025][ T5847] ret_from_fork_asm+0x1a/0x30 [ 605.304768][ T5847] [ 605.307067][ T5847] Freed by task 5920: [ 605.311022][ T5847] kasan_save_stack+0x33/0x60 [ 605.315675][ T5847] kasan_save_track+0x14/0x30 [ 605.320329][ T5847] kasan_save_free_info+0x3b/0x60 [ 605.325853][ T5847] __kasan_slab_free+0x60/0x70 [ 605.330592][ T5847] kfree+0x2b4/0x4d0 [ 605.334487][ T5847] em28xx_v4l2_init+0x22b5/0x4080 [ 605.339496][ T5847] em28xx_init_extension+0x13a/0x200 [ 605.344772][ T5847] request_module_async+0x61/0x70 [ 605.349779][ T5847] process_one_work+0x9cc/0x1b70 [ 605.354704][ T5847] worker_thread+0x6c8/0xf10 [ 605.359270][ T5847] kthread+0x3c2/0x780 [ 605.363314][ T5847] ret_from_fork+0x56a/0x730 [ 605.367881][ T5847] ret_from_fork_asm+0x1a/0x30 [ 605.372625][ T5847] [ 605.374923][ T5847] The buggy address belongs to the object at ffff888077a68000 [ 605.374923][ T5847] which belongs to the cache kmalloc-8k of size 8192 [ 605.389054][ T5847] The buggy address is located 528 bytes inside of [ 605.389054][ T5847] freed 8192-byte region [ffff888077a68000, ffff888077a6a000) [ 605.402914][ T5847] [ 605.405217][ T5847] The buggy address belongs to the physical page: [ 605.411604][ T5847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77a68 [ 605.420338][ T5847] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 605.428819][ T5847] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 605.436354][ T5847] page_type: f5(slab) [ 605.440330][ T5847] raw: 00fff00000000040 ffff88801b842280 ffffea0000a34c00 dead000000000004 [ 605.448890][ T5847] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 605.457452][ T5847] head: 00fff00000000040 ffff88801b842280 ffffea0000a34c00 dead000000000004 [ 605.466096][ T5847] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 605.474741][ T5847] head: 00fff00000000003 ffffea0001de9a01 00000000ffffffff 00000000ffffffff [ 605.483388][ T5847] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 605.492028][ T5847] page dumped because: kasan: bad access detected [ 605.498587][ T5847] page_owner tracks the page as allocated [ 605.504275][ T5847] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5503, tgid 5503 (S40network), ts 37101231654, free_ts 37047984048 [ 605.524654][ T5847] post_alloc_hook+0x1c0/0x230 [ 605.529413][ T5847] get_page_from_freelist+0x132b/0x38e0 [ 605.534935][ T5847] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 605.540805][ T5847] alloc_pages_mpol+0x1fb/0x550 [ 605.545635][ T5847] new_slab+0x247/0x330 [ 605.549772][ T5847] ___slab_alloc+0xcf2/0x1750 [ 605.554430][ T5847] __slab_alloc.constprop.0+0x56/0xb0 [ 605.559788][ T5847] __kmalloc_cache_noprof+0xfb/0x3e0 [ 605.565141][ T5847] tomoyo_init_log+0xc8a/0x2140 [ 605.569974][ T5847] tomoyo_supervisor+0x302/0x13b0 [ 605.574975][ T5847] tomoyo_execute_permission+0x38e/0x4b0 [ 605.580594][ T5847] tomoyo_find_next_domain+0x38d/0x20b0 [ 605.586120][ T5847] tomoyo_bprm_check_security+0x12e/0x1d0 [ 605.591815][ T5847] security_bprm_check+0x1b9/0x1e0 [ 605.596909][ T5847] bprm_execve+0x81a/0x1640 [ 605.601390][ T5847] do_execveat_common.isra.0+0x4a5/0x610 [ 605.607001][ T5847] page last free pid 5502 tgid 5502 stack trace: [ 605.613299][ T5847] __free_frozen_pages+0x7d5/0x10f0 [ 605.618483][ T5847] qlist_free_all+0x4d/0x120 [ 605.623047][ T5847] kasan_quarantine_reduce+0x195/0x1e0 [ 605.628488][ T5847] __kasan_slab_alloc+0x69/0x90 [ 605.633319][ T5847] __kmalloc_cache_noprof+0x1f1/0x3e0 [ 605.638673][ T5847] tomoyo_init_log+0xc8a/0x2140 [ 605.643506][ T5847] tomoyo_supervisor+0x302/0x13b0 [ 605.648504][ T5847] tomoyo_env_perm+0x191/0x200 [ 605.653247][ T5847] tomoyo_find_next_domain+0xec2/0x20b0 [ 605.658857][ T5847] tomoyo_bprm_check_security+0x12e/0x1d0 [ 605.664552][ T5847] security_bprm_check+0x1b9/0x1e0 [ 605.669640][ T5847] bprm_execve+0x81a/0x1640 [ 605.674120][ T5847] do_execveat_common.isra.0+0x4a5/0x610 [ 605.679734][ T5847] __x64_sys_execve+0x8e/0xb0 [ 605.684387][ T5847] do_syscall_64+0xcd/0x4e0 [ 605.688871][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 605.694738][ T5847] [ 605.697038][ T5847] Memory state around the buggy address: [ 605.702639][ T5847] ffff888077a68100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 605.710674][ T5847] ffff888077a68180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 605.718708][ T5847] >ffff888077a68200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 605.726741][ T5847] ^ [ 605.731300][ T5847] ffff888077a68280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 605.739376][ T5847] ffff888077a68300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 605.747409][ T5847] ================================================================== [ 605.855579][ T30] audit: type=1400 audit(1758590520.821:654): avc: denied { read } for pid=5200 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 605.899650][ T4591] batman_adv: batadv0: Local translation table size (84) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 605.924731][ T30] audit: type=1400 audit(1758590520.821:655): avc: denied { search } for pid=5200 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 606.018457][ T30] audit: type=1400 audit(1758590520.821:656): avc: denied { search } for pid=5200 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 606.095372][ T5847] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 606.102599][ T5847] CPU: 1 UID: 0 PID: 5847 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full) [ 606.111946][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 606.121998][ T5847] Workqueue: usb_hub_wq hub_event [ 606.127018][ T5847] Call Trace: [ 606.130275][ T5847] [ 606.133184][ T5847] dump_stack_lvl+0x3d/0x1f0 [ 606.137759][ T5847] vpanic+0x6e8/0x7a0 [ 606.141727][ T5847] ? __pfx_vpanic+0x10/0x10 [ 606.146213][ T5847] ? __pfx_vprintk_emit+0x10/0x10 [ 606.151221][ T5847] ? media_device_unregister+0x598/0x5c0 [ 606.156836][ T5847] panic+0xca/0xd0 [ 606.160531][ T5847] ? __pfx_panic+0x10/0x10 [ 606.165021][ T5847] ? media_device_unregister+0x598/0x5c0 [ 606.170641][ T5847] ? preempt_schedule_common+0x44/0xc0 [ 606.176084][ T5847] ? preempt_schedule_thunk+0x16/0x30 [ 606.181441][ T5847] check_panic_on_warn+0xab/0xb0 [ 606.186354][ T5847] end_report+0x107/0x170 [ 606.190664][ T5847] kasan_report+0xee/0x110 [ 606.195060][ T5847] ? media_device_unregister+0x598/0x5c0 [ 606.200684][ T5847] media_device_unregister+0x598/0x5c0 [ 606.206233][ T5847] em28xx_release_resources+0xb2/0x2d0 [ 606.211686][ T5847] em28xx_usb_disconnect+0x1de/0x610 [ 606.216952][ T5847] usb_unbind_interface+0x1dd/0x9e0 [ 606.222137][ T5847] ? kernfs_remove_by_name_ns+0xbe/0x110 [ 606.227747][ T5847] ? __pfx_usb_unbind_interface+0x10/0x10 [ 606.233451][ T5847] device_remove+0x125/0x170 [ 606.238020][ T5847] device_release_driver_internal+0x44b/0x620 [ 606.244071][ T5847] bus_remove_device+0x22f/0x420 [ 606.248986][ T5847] device_del+0x396/0x9f0 [ 606.253300][ T5847] ? __pfx_device_del+0x10/0x10 [ 606.258153][ T5847] ? kobject_put+0x210/0x5a0 [ 606.262731][ T5847] usb_disable_device+0x355/0x7d0 [ 606.267740][ T5847] usb_disconnect+0x2e1/0x9c0 [ 606.272402][ T5847] hub_event+0x1c81/0x4fe0 [ 606.276809][ T5847] ? __lock_acquire+0xb97/0x1ce0 [ 606.281733][ T5847] ? __pfx_hub_event+0x10/0x10 [ 606.286481][ T5847] ? assoc_array_insert+0x1520/0x3970 [ 606.291846][ T5847] ? rcu_is_watching+0x12/0xc0 [ 606.296592][ T5847] process_one_work+0x9cc/0x1b70 [ 606.301513][ T5847] ? __pfx_process_one_work+0x10/0x10 [ 606.306867][ T5847] ? assign_work+0x1a0/0x250 [ 606.311437][ T5847] worker_thread+0x6c8/0xf10 [ 606.316012][ T5847] ? __kthread_parkme+0x19e/0x250 [ 606.321035][ T5847] ? __pfx_worker_thread+0x10/0x10 [ 606.326126][ T5847] kthread+0x3c2/0x780 [ 606.330174][ T5847] ? __pfx_kthread+0x10/0x10 [ 606.334740][ T5847] ? rcu_is_watching+0x12/0xc0 [ 606.339484][ T5847] ? __pfx_kthread+0x10/0x10 [ 606.344052][ T5847] ret_from_fork+0x56a/0x730 [ 606.348617][ T5847] ? __pfx_kthread+0x10/0x10 [ 606.353183][ T5847] ret_from_fork_asm+0x1a/0x30 [ 606.357935][ T5847] [ 606.361127][ T5847] Kernel Offset: disabled [ 606.365422][ T5847] Rebooting in 86400 seconds..