last executing test programs: 5m31.592341567s ago: executing program 1 (id=852): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) chdir(0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, 0x0, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) r1 = socket(0x840000000002, 0x3, 0x100) connect$inet(r1, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r1, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) 5m30.024811569s ago: executing program 1 (id=855): r0 = syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000000)={0x2, @sdr={0x0, 0xfff}}) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000140)={0x3, 0x2, 0x4, 0x0, 0x12}) r1 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000340)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000002380)={0x80000000, 0x0, 0x3, 0x0, 0x7}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x118) ioctl$MON_IOCX_GETX(0xffffffffffffffff, 0x80089203, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000020601080000000000000000000000000500050079347241050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e6574"], 0x50}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) read$FUSE(0xffffffffffffffff, &(0x7f0000000340)={0x2020}, 0x2020) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000002400)={&(0x7f0000002480)={0x1c, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}}, 0x1c}}, 0x0) 5m28.532160377s ago: executing program 1 (id=859): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x15a) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000180)={0x50, 0x0, r1, {0x7, 0x29, 0x1000, 0xffffffff85000014, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800}}, 0x50) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x4b) syz_fuse_handle_req(r0, &(0x7f00000042c0), 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f00000067c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00", 0x2000, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="780000000000000002000000000000040000000000000000000000000000000004"], 0x0, 0x0, 0x0, 0x0}) getdents(r2, &(0x7f0000000700)=""/90, 0x20000) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000006dc0)=[{{&(0x7f0000000300)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x24008800}}], 0x1, 0x20000888) r3 = syz_open_dev$loop(&(0x7f0000000280), 0x2, 0x4000) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000004000000b703000008000040850000006900000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f00000002c0)='sys_enter\x00', r5}, 0x18) ioctl$LOOP_SET_FD(r3, 0x4c00, r5) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x5}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) keyctl$dh_compute(0x17, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={'blake2b-256\x00'}}) 5m27.268491292s ago: executing program 1 (id=861): inotify_add_watch(0xffffffffffffffff, 0x0, 0x2800047e) openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x181001, 0x0) r0 = syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0x4, 0x10100, 0x0, 0x1}, &(0x7f0000000000)=0x0, &(0x7f0000000240)=0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setns(0xffffffffffffffff, 0x2000000) syz_io_uring_submit(r1, r2, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0}) io_uring_enter(r0, 0x7a98, 0x0, 0x600, 0x0, 0x0) 5m27.174597012s ago: executing program 1 (id=862): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)) pwritev(r0, &(0x7f0000000100)=[{&(0x7f0000000580)="80fd02780040", 0x6}], 0x1, 0x0, 0x0) 5m26.420729982s ago: executing program 1 (id=865): socket$netlink(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="580000001000030400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="4a453f99b7ae672d0f87a2e6ca6ffc580a847bcb99f256f75f3150e290659705de2426581be63a31879c3d6655425f421f27b3e310f500eaa1dc7193ba1719ce159fed07824a4abacb925ead473a9dd7b6ea3007ba487eaf2806398f0f4d56a49a9fdb5185cbf78380eb60782f08de0af9ee72824667bf3feed406d7daa3e67e1250b7a614a7be897f805b35cf4d75a57f7c0621b1db95"], 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) fsopen(&(0x7f0000000000)='hfsplus\x00', 0x1) 5m11.281929589s ago: executing program 32 (id=865): socket$netlink(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="580000001000030400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="4a453f99b7ae672d0f87a2e6ca6ffc580a847bcb99f256f75f3150e290659705de2426581be63a31879c3d6655425f421f27b3e310f500eaa1dc7193ba1719ce159fed07824a4abacb925ead473a9dd7b6ea3007ba487eaf2806398f0f4d56a49a9fdb5185cbf78380eb60782f08de0af9ee72824667bf3feed406d7daa3e67e1250b7a614a7be897f805b35cf4d75a57f7c0621b1db95"], 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) fsopen(&(0x7f0000000000)='hfsplus\x00', 0x1) 2m38.296035483s ago: executing program 5 (id=1427): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$netlink(0x10, 0x3, 0x9) r1 = open(&(0x7f0000000140)='./bus\x00', 0x101c42, 0x6) fsetxattr$security_capability(r1, &(0x7f0000000100), &(0x7f00000000c0)=@v1={0x1000000, [{0x800052d, 0x1b}]}, 0xc, 0x3) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="000002000000", @ANYRES32=r2, @ANYBLOB="4000100014000100000000000000000000000000000000010a000200aaaaaaaaaaaa0000"], 0x3c}}, 0x20024090) socket(0x5, 0x80000, 0x3d) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) sendmsg$key(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000006c0)=ANY=[], 0x33fe0}}, 0x40010) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) pipe(&(0x7f0000000140)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) bind$rds(r6, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000880)=""/4092, 0xffc}], 0x1, 0x0, 0x0, 0x24000880}, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x8000002, 0xfffffffa, @rand_addr, 0x5}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f0000000240)="0c0000000080000007", 0x9, 0x48084, 0x0, 0x0) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) 2m34.084622147s ago: executing program 5 (id=1435): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'veth0_to_bond\x00', 0x400}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x3f, &(0x7f0000000200), 0x4) close(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) r3 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r5, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r6, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r5, 0xc06864ce, &(0x7f0000000440)={r7, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0xb5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000080)={r8}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000080)={r8, 0x80000}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="1e051c003c"], 0xffdd) syz_usb_connect(0x4, 0x36, &(0x7f0000000040)=ANY=[@ANYRES8=0x0, @ANYRES64, @ANYRESDEC=r2], 0x0) 2m33.036544124s ago: executing program 5 (id=1438): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec850000007d000000850000002a00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x14fafd, 0x180) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000540), 0xf, 0x101002) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000040)) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb2361000000010902"], 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x103000) open$dir(&(0x7f0000000080)='./file0\x00', 0x2a281, 0x108) syz_io_uring_setup(0x313c, &(0x7f0000000000)={0x0, 0x4ff, 0x3600, 0x1, 0x372}, 0x0, 0x0) epoll_create(0xc000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYRES8=r2], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000200)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) 2m29.72724579s ago: executing program 5 (id=1447): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000011c0)=0xd) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0xd0f, 0x70bd29, 0xfffffffd, {0x60, 0x0, 0x0, 0x0, {0x0, 0x2}, {0xffff, 0xffff}, {0xfff3}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x10000009}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000050}, 0x20008840) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000500)={{}, 0x0, 0x0}, 0x20) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r1, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001080)=ANY=[@ANYBLOB="3c000000dd7c911e51fe3bbd2698f595a2f9d2aaa4d307a212a3c68ad21eeb04cc2a15756480416b9ade7025f33dddb198e7f18505f0d4abbf0f845b0a52bf665e09d215844626172454f7fe96211a14aaae26ac7d6a035342ae2a56da9a3221ae5efe5938e270745ea665714f4d5263a69a301ab73648a544a30e57f7e90939f8363e859913739d12ac6e6cc2fd5cae2765e0493dcc48fd8dec5a702348ac", @ANYRES16=r3, @ANYBLOB="796100000000000000007e00000005001801390000000800a000fbffffff0800270001000000080022016a0200000800a00008000000"], 0x3c}, 0x1, 0x0, 0x0, 0x8}, 0x4040800) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_tables_matches\x00') read$FUSE(r4, 0x0, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r6 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r6, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000000000)=0xfd9) r7 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r7, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={0x0, 0x12f4}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 2m29.436580315s ago: executing program 5 (id=1449): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x22000) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x8, 0x2, 0x4, 0x5}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r4, 0xffffffffffffffff}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x10) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r7, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r7, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r7, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f0000000040)) 2m28.485335022s ago: executing program 5 (id=1452): mkdir(&(0x7f00000003c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x1, 0x800000c1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) write$P9_RGETLOCK(r1, &(0x7f0000000640)=ANY=[], 0x200002e6) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000540)=""/67, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/231, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000f}, 0x94) mount(0x0, &(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000340)='smb3\x00', 0x10000, &(0x7f0000000380)='nocase') 2m13.409863098s ago: executing program 33 (id=1452): mkdir(&(0x7f00000003c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x1, 0x800000c1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) write$P9_RGETLOCK(r1, &(0x7f0000000640)=ANY=[], 0x200002e6) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000540)=""/67, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/231, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000f}, 0x94) mount(0x0, &(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000340)='smb3\x00', 0x10000, &(0x7f0000000380)='nocase') 16.256585454s ago: executing program 4 (id=1736): sendmsg$SMC_PNETID_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x40040) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000006d85500001e0a05010000000000000000070000000900020073"], 0x565c}}, 0x0) mkdir(0x0, 0xfffffffffffffffe) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x4c, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'ipvlan0\x00'}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7fffffff}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x13}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc000}, 0x800) socketpair$unix(0x1, 0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) write(r1, &(0x7f00000004c0)="d105b806c56c2f7b44a28303afd149c386607d0d4188f5e4317f6f3477631f5780eae9c2594df7f92049870b78b017f3ef026e384556b00e5018d0114afc8b4b2fe305", 0x43) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000200)={'broute\x00', 0x0, 0x0, 0x0, [0x3, 0x0, 0x9bc6, 0x93b, 0x0, 0x7fffffff], 0x1, 0x0, 0x0, [{}]}, 0x88) 14.020487612s ago: executing program 3 (id=1744): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000380)={'syz0\x00', {0xff, 0x6, 0x7fff, 0x8d5}, 0x39, [0x4, 0xeba, 0x7, 0xe6a, 0xdb, 0x1, 0x9, 0x80, 0x54, 0x7fffdfff, 0x2, 0x9, 0x8, 0x9, 0x9, 0x3, 0x7, 0x40000, 0x1a, 0x26, 0x2, 0x0, 0x3ff, 0xfffffff4, 0x1, 0x100, 0x3, 0xa4, 0xeb36, 0x10000002, 0x9, 0x200, 0x200, 0x1, 0x1, 0x1, 0x7, 0x9, 0xb, 0x7, 0x9, 0x80000000, 0x9, 0xb50, 0x0, 0x800, 0x3, 0x0, 0x7, 0xfffffffe, 0x5, 0x8, 0x24, 0x7fff, 0x8, 0x0, 0x1, 0x0, 0x0, 0x7f, 0x964e, 0x2d5, 0x109, 0x1], [0x66ac, 0xfffffff9, 0x4, 0x3, 0x8e, 0x7, 0x80000001, 0x9, 0x4, 0x2, 0x0, 0x7, 0x6, 0x8001, 0x9, 0x8, 0x2, 0x5, 0xb, 0x7ff, 0x7ff, 0x5, 0x9, 0xc00, 0x89, 0x7ff, 0x0, 0xff, 0x9, 0x20009, 0x9, 0x4d26, 0x10000, 0x8, 0x1, 0x6, 0x0, 0x3, 0x4c, 0x9, 0x8, 0x5, 0xe66, 0x8, 0x2, 0x81, 0x4b, 0x7d, 0x6, 0xb, 0x4, 0x9, 0x1, 0x8d1, 0x100008fd, 0xfffffffa, 0xe0, 0x8e, 0x10001, 0x2004, 0x401, 0x80000001, 0x7f, 0x9], [0x8396, 0x7, 0x10000, 0x1, 0x7fff, 0x4, 0x9, 0xe, 0x8, 0x6, 0xfffffffd, 0x400, 0x1000, 0x9, 0x6e, 0x8001, 0x7, 0x3, 0x6, 0x5, 0x3, 0xc7, 0x2, 0x40003, 0x0, 0x2, 0x8001, 0xc, 0x5, 0xb12, 0x4, 0x23, 0x800, 0x80008, 0x9, 0x7, 0x200, 0xfffffff7, 0x4, 0xe, 0x464b, 0x6, 0x2e7, 0x7ff, 0xffffffff, 0x7, 0x87ff, 0x2, 0x7fffffff, 0xffffffff, 0x4, 0xfdff, 0xd5d, 0xa0c787d, 0xffffff4e, 0x9, 0x20006, 0x40, 0x3, 0x0, 0x1fc1, 0x9, 0x1, 0x16], [0x1000000e, 0x7, 0x7, 0x2, 0xa5e, 0xfe, 0xff, 0x8, 0x80000000, 0x0, 0xe, 0x2, 0x4, 0x7, 0x7, 0x0, 0xfffffffe, 0xfffffff8, 0x1, 0x4, 0x3, 0x105, 0x6, 0xcc, 0x6, 0x4000400, 0xffffffff, 0xfffffffa, 0x40, 0x4, 0x4, 0x7, 0xfff, 0x40, 0x9, 0x0, 0x9, 0x1, 0x0, 0x7, 0x6, 0x2, 0x1, 0x80000002, 0x80000002, 0xfd, 0x6, 0x6, 0xfffff801, 0xffefffff, 0x37e, 0xfffffff8, 0xd, 0x7, 0xd, 0x8, 0x0, 0x0, 0x8, 0x5e02, 0x2, 0x3, 0x5, 0x400]}, 0x45c) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000540)={@map, 0x1f, 0x554446120900450d, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0xfffffffc, 0x5, 0x0, 'queue0\x00', 0x10000}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000500), 0x101) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000004c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f00000000c0)={0x28, 0x7, r4, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000d40)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r3, 0x3ba0, &(0x7f0000000300)={0x48, 0x8, r5, 0x0, 0x3fff, 0x1c, &(0x7f0000000040)='\x00'}) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f0000000240)=@gcm_256={{0x303}, "b3b29d620bb61a5e", "db828bf79443408aded1bcd767af25274c45c87e4079d0e891d5cf84be9c890f", "9fb45bf6", "ba42f03132bb519a"}, 0x38) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r8 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r8, &(0x7f0000002000)=ANY=[@ANYBLOB="580400007d03000005170300400000000000000000000800000000000000000078a0090000000000000008000000000000001b00046e6f6465767b65766f6f7e2539c60005000037d93a8b92000000600275aff540c602007dfa673effeb09b5351f5bde054000000000187b8200b500002b595fcb14034354b9fd9ef196a51cd5157adc8103b494e165e12cea48597c664646c9a70f3e49253371c0423877458ce943c5ef03b914651fa3b84f41696b90141623d7c143441930dff256f6e8d4835d9b3ba5a7744b50be209678378326184f4ac3e0c3681bb95075f3847d2b732cd9bd96fb984d84e69ba9922793d2638486d6780e0b852365f038b00c11c5d4590843bc72a59fa4a373129e32382a15cf6c885709fa1a73448d94de89651ec28c3bdcc3d3b959bd7ed071ab5a5be0fa291cf115abf084c7bdfa150cb8e4aae2cebf987b2248806b459b5a5fdd5aa5bb90a57ee1f4e3544bd6d1b4ca137975738080c468674a6b73a3df28256e070033212c277b1dc17581f4c6dddef3aae3ad6dcaedf4f67fdd3794832f894d106c9e8dfcd263cc09c05c15e6c4bfb0df6d5ad607ee0705eacc8a20aafefc22885fb61ef57bc80c3054027460f647d123d48a5ffc6738abe1c940099678452dca5cc176b6b66dca565ee78325b921646ea0d8600f1e2f7dfcd060d4b7fef2e0cdd3745e909a14aa035703e86dd95b3c824f3e7b24fb287fe8b3e3197732f2638aec8d6f320ea7c144b3a1245b2b35210a0e6c3ab21eea23a4de23f2718a08228f12648af5b29f91db227e7afa034df13c5fbf106b97a3002484b4abbf7168c3321833fee63399ad1ebb7dd07bd7748c8387f6d504bfb9882c928b4195baf7b835aa7006e4b3d8b751ece41fc818bc5eeee69732e2129143003c2c8934b2040504f75b790abf355c4167e5d8ed3f4b46b627f0bb803a39000000000000000000000000001400cfc26dd7c500f04cd85f2a70f5e9930e3c5db45a5500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf05000000bc736bf7e38925680eae8e482f950000000047ec21cabff20f9c1cbe36f4fd1a4cc280e8e289da649a37002c016f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae12516105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd1739e1c2d87fff0000000000000000000000000000000000fea263a3c61a6a75abe5c46d1d15126a7cfb736db8f021b0846cedd6c5e23ba123cdd9526f131e9ad71f2cac6b9eafe399a7041f3d48d512c8500e4c92b000df82a684f2520480abd0493010efa76a7ddf2614754dc9a1edf3", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], 0x458) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r9, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) recvfrom$x25(r10, &(0x7f0000001000)=""/4096, 0x1000, 0x10142, 0x0, 0x0) close_range(r0, r1, 0x0) syz_clone3(0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d0b939d60a53067d50000200006241a0000000905810300020000000904010000020d00000904010102020d0000090582020002000000090b"], 0x0) 11.768420596s ago: executing program 0 (id=1752): socket$rxrpc(0x21, 0x2, 0x2) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x48e02, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket(0x15, 0x2, 0x80000000) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) rseq(&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x5, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) getsockopt$inet6_tcp_int(r2, 0x6, 0x15, 0x0, &(0x7f0000000140)) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) sync() sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x100000500) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x24, 0x24, 0xd0f, 0x70bd31, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xe}, {0xffff, 0xffff}, {0x0, 0x10}}}, 0x24}}, 0x44080) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='\x00'/11], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1e, 0x1c, &(0x7f0000001840)=ANY=[@ANYBLOB="1800000000000000000000000300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007b9af8ff00000000b7080000080000007b00020000000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb702000008000000182200", @ANYRES32=r3, @ANYBLOB="0000000000000000b7050000080000006200000076000000bf91000000000000b5020000000000008500000085000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(0xffffffffffffffff, 0x0, 0x0) 11.181139003s ago: executing program 0 (id=1754): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) getrlimit(0x8, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x890c, 0x0) read$msr(r0, &(0x7f0000034000)=""/102400, 0x19000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000040)=ANY=[], 0x118) ioperm(0x4, 0x8, 0x5) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r2, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1a, 0x2, 0x4}) sendmmsg$inet6(r1, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x300) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket(0x2b, 0x1, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) 10.698402811s ago: executing program 4 (id=1756): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0x2d, 0x2, 0x0) connect$qrtr(r0, &(0x7f0000000440)={0x2d, 0x0, 0x1}, 0xc) socket$nl_route(0x10, 0x3, 0x0) bind$xdp(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) syz_clone(0x8a00, 0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000480)) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_setup(0x3eae, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x2) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0xfffffffffffffe05, 0x8, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x5}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x129c81, 0x0) write$binfmt_aout(r5, &(0x7f0000000080)=ANY=[], 0xff2e) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$TCSETS(r5, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x7f, 0x4000006, 0x3, "42341f9b1000007e4f00"}) r6 = syz_open_pts(r5, 0x103100) dup3(r6, r5, 0x0) splice(r5, 0x0, r3, 0x0, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r2, 0xc4c85512, &(0x7f0000000780)={{0x3, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0xfffffffffffffffd, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd451, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x10000, 0x7785, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001]}) 10.582880662s ago: executing program 3 (id=1757): io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newlink={0x94, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x1840}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_AF_SPEC={0x60, 0x1a, 0x0, 0x1, [@AF_INET6={0x50, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x7}, @IFLA_INET6_TOKEN={0x14, 0x7, @remote}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x4}, @IFLA_INET6_TOKEN={0x14, 0x7, @loopback}]}, @AF_MPLS={0x4}, @AF_BRIDGE={0x4}, @AF_BRIDGE={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000000c0)="83", 0x0, 0x5, 0x0, 0x80000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7030000000000008500000026000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="180000000000000000000000000000001802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000340)="c1dfb080cd21d308098ee6889900", 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000240)={0x14, 0x26, 0x1, 0xf0bd29, 0x25dfdbfc, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20048000) 9.840137696s ago: executing program 0 (id=1759): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0e00000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000480)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41000, 0x22}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000ec0)={{r0}, &(0x7f0000000e40), &(0x7f0000000e80)=r1}, 0x20) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_IPV6_RTHDR(r2, 0x29, 0x39, 0x0, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r4 = eventfd(0x40005) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000800)=""/90, 0xeeee8000}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) accept4(0xffffffffffffffff, &(0x7f00000001c0)=@generic, 0x0, 0x800) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000300)=0x1) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0xd, &(0x7f0000000100)=ANY=[@ANYBLOB="180200000000000000000000000000008510000001000000950000000000000018010000202073250000000000202020db1af8ff50000000bfa100000000000007010000f8ffffffb702000008000000b703000000000028850000007600000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0xa}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000640)={{r0}, &(0x7f00000005c0), &(0x7f0000000600)=r6}, 0x20) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x34, 0x0, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x11f}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3800}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7fffffff, 0x5, &(0x7f0000000000)) 9.624388644s ago: executing program 4 (id=1760): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000005c0)={[0x5836, 0x5, 0x7, 0x4000000000000e52, 0x1, 0x5479, 0x1043, 0x200000000003, 0x1c, 0x1, 0xfffffffffffffffe, 0x100000000, 0x9ca6, 0x1, 0x8000000000005, 0x5c], 0x8080000, 0x42590}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000d80)={0x0, 0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r3, 0xc0182101, 0x0) r4 = timerfd_create(0x8, 0x0) ppoll(&(0x7f00000000c0)=[{r4, 0x318a}], 0x1, 0x0, 0x0, 0x0) timerfd_settime(r4, 0x0, &(0x7f0000000140), 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r5}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x881, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8002, 0x0) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f00000014c0)=@nat={'nat\x00', 0x62, 0x5, 0x430, 0x398, 0x2a0, 0xffffffff, 0xe0, 0x188, 0x398, 0x398, 0xffffffff, 0x398, 0x398, 0x5, 0x0, {[{{@ip={@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'veth0_to_bond\x00', 'wg1\x00'}, 0x0, 0xa8, 0xe0, 0x0, {0x22e}, [@common=@unspec=@statistic={{0x38}}]}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @multicast1, @remote, @icmp_id, @icmp_id}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @multicast1, @empty, @gre_key, @icmp_id}}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'veth1_to_hsr\x00', 'ipvlan0\x00'}, 0x0, 0xe0, 0x118, 0x0, {}, [@common=@socket0={{0x20}}, @common=@osf={{0x50}, {'syz0\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @private, @multicast2, @gre_key}}}}, {{@ip={@remote, @empty, 0x0, 0x0, 'veth1_to_batadv\x00', 'pim6reg\x00', {0xff}}, 0x0, 0xc0, 0xf8, 0x0, {}, [@common=@ttl={{0x28}}, @common=@inet=@tcpmss={{0x28}, {0xf}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x16, @remote, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x490) syz_emit_ethernet(0x68, &(0x7f0000005a40)=ANY=[@ANYBLOB="bbbbbbbbbbbb6076b5cad4f686dd6075e50000323a0020010000000000000000000000000000ff02000000000000000000000000000104009078fc00000060a3577f00002b00ff010000000000000000000000000001fe8000000000000000000000000000bb6be2"], 0x0) r10 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r10, 0x40946400, 0x0) 7.697608509s ago: executing program 2 (id=1763): syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000040)={@broadcast, @multicast2}, 0x8) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x44080, &(0x7f0000000380)=ANY=[@ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYRESDEC=0x0]) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$inet_sctp(0x2, 0x5, 0x84) syz_init_net_socket$rose(0xb, 0x5, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) 7.585283845s ago: executing program 4 (id=1764): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x403, 0x6030, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x2}}}}]}}]}}, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0) sendmsg$can_bcm(r1, &(0x7f00000001c0)={&(0x7f0000000000), 0x10, &(0x7f0000000180)={&(0x7f0000000580)={0x7, 0x312, 0xe7, {0x0, 0xea60}, {0x0, 0x2710}, {}, 0x1, @can={{0x0, 0x1, 0x1, 0x1}, 0x5, 0x0, 0x0, 0x0, "b395ac5160fbdac3"}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8001) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x22, 0x2, {[@main=@item_012={0x1, 0x0, 0x7, "a4"}]}}, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.567020477s ago: executing program 2 (id=1765): openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x0, 0x2b8, 0xb0000010, 0x2, 0x5c8f0200, 0x388, 0x3a8, 0x3a8, 0x388, 0x3a8, 0x3, 0x0, {[{{@ipv6={@private1, @local, [], [], 'vlan1\x00', 'veth0_to_team\x00'}, 0x0, 0x248, 0x290, 0x700, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve1\x00', {0xf1, 0x0, 0x33, 0x0, 0xffffff80, 0x1, 0x7fffffff}}}, @common=@unspec=@limit={{0x48}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@CONNSECMARK={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003800000038000000040d0000020000000000001104000000000000000000000000000004000000f2010000000000001202000000020000000000000e030000000000000000005f007b2b6d43dae6820486f257ebb719655af8e8f843d80edcf7c162a88c71ed3278385e530b3e6314376a73ae4ef7b31b"], 0x0, 0x54}, 0x20) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r5, 0x560a, &(0x7f0000000080)={0x0, 0x3d02, 0x1575, 0x9}) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x4e23, 0x7fc0000, @loopback, 0xf}}, 0x100, 0x0, 0x0, 0x6, 0x50, 0x10000}, 0xffffffffffffff2d) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0xf, 0x803, 0x1) bind$netlink(r7, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) chdir(&(0x7f0000000180)='./file0\x00') getsockname$packet(r7, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2800000010000d042abd70000008000000000000", @ANYRES32=r8, @ANYBLOB="010000000000000008001a8004001c00"], 0x28}, 0x1, 0x0, 0x0, 0x40040}, 0x0) 6.376708418s ago: executing program 0 (id=1766): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f000065a000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000339000/0x3000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mmap(&(0x7f0000227000/0x3000)=nil, 0x3000, 0x1000002, 0x13, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_genetlink_get_family_id$wireguard(&(0x7f0000000840), 0xffffffffffffffff) r2 = syz_open_dev$vim2m(&(0x7f0000000300), 0x0, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000340)={0x1, @pix_mp={0x328, 0x1, 0x32314247, 0x7, 0x7, [{0xd, 0x4}, {0xfffffffe, 0x7}, {0x0, 0x6}, {0x8, 0x844}, {0x1, 0x4}, {0x6, 0x5}, {0xfffffff9, 0x40}, {0x3, 0x2ba}], 0x9, 0x7, 0x1, 0x0, 0x1}}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f00000000c0)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000040)={@host}) r4 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000140)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f00000001c0)={{@host}, @host, 0x4, 0xabc, 0x2449, 0x0, 0x0, 0x4}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000080)={{@hyper, 0x10400000}, @hyper, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r3, 0x7a5, &(0x7f0000000140)={{@host, 0x25}, 0x1}) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x7800007, 0x12, 0xffffffffffffffff, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/address_bits', 0x0, 0x0) getdents64(r5, &(0x7f00000028c0)=""/4097, 0x1001) r6 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010"], 0x48}}, 0x0) sendmmsg$alg(r6, &(0x7f00000000c0), 0x492492492492627, 0x300) socket$nl_route(0x10, 0x3, 0x0) 5.590040875s ago: executing program 2 (id=1769): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000480)=@abs={0x0, 0x0, 0x8004e24}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x2, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x800, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x61, 0x0, 0x0, 0xf00}, {}, {0x3, 0xfd}, {0xfffe, 0xd, 0x0, 0x10000000}, {}, {0x6, 0x0, 0xf8}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x8) 5.42457914s ago: executing program 3 (id=1770): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="15000000000000000000000000202100000001006d1e9402000000452952e230e8c7ad5cd0", @ANYRES32, @ANYBLOB='\x00'/19, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/24, @ANYRES32, @ANYBLOB], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1000000004000000040000000200000000000000", @ANYRES32=0x1, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="000000007b03000000000000fa8428ac850000808600000018110000", @ANYRES32=r1, @ANYRESOCT=r0], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r2, 0x2000012, 0x0, 0x0, &(0x7f0000000c40), 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, 0x0, &(0x7f0000000000)='syzkaller\x00'}, 0x94) prlimit64(0x0, 0xe, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) bind$inet(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000004340)=""/102376, 0x18fe8) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmmsg$sock(r5, &(0x7f00000022c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x24004000) recvmmsg(r5, &(0x7f00000047c0)=[{{0x0, 0x0, &(0x7f0000002ac0)=[{&(0x7f0000000340)=""/1, 0x1}], 0x1}, 0xe75}], 0x3aa0, 0x60002000, 0x0) 4.136550907s ago: executing program 0 (id=1772): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/tty/drivers\x00', 0x0, 0x0) setsockopt$sock_void(r0, 0x1, 0x0, 0x0, 0x0) pread64(r0, &(0x7f0000000200)=""/174, 0xae, 0x3b11) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x40080, &(0x7f0000000100)=ANY=[@ANYRESHEX, @ANYRES32=r0, @ANYRESOCT=r1]) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000200)={@hyper, 0x2}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r2}, 0x10) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f00000002c0)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466f6f0fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x3]}}, 0x0, 0x8, &(0x7f0000000500)) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) rt_sigsuspend(&(0x7f0000000080)={[0x5]}, 0x8) fcntl$getownex(r2, 0x10, &(0x7f0000000140)={0x0, 0x0}) sched_setscheduler(r3, 0x2, &(0x7f00000001c0)=0xc) clock_adjtime(0x17, &(0x7f0000000740)={0xd51, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x0, 0x0, 0x1, 0x8, 0x200000000, 0x1, 0x0, 0x0, 0x0, 0x100, 0x5, 0x0, 0xe438, 0x0, 0x0, 0xe0}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='rdma.current\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x88fd537e5e114b6f, 0x12, r5, 0x0) ioctl$KVM_X86_SETUP_MCE(r5, 0x4008ae9c, &(0x7f0000000000)={0x4, 0x89727a31546dcc45, 0x4}) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff}, 0x80) r7 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r6, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = dup(r9) ioctl$KVM_CHECK_EXTENSION(r10, 0xae03, 0x9) keyctl$set_timeout(0xf, r7, 0x7fffffff) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000009980708b5192100c7980000000109021b00012000ac00090400000107000009090585"], 0x0) sendmmsg$inet6(r4, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20048054) keyctl$dh_compute(0x17, &(0x7f0000000340)={r7, r7, r7}, &(0x7f0000000380)=""/8, 0x8, &(0x7f0000000400)={&(0x7f00000003c0)={'tgr160-generic\x00'}}) 4.003724433s ago: executing program 4 (id=1773): syz_usb_connect$hid(0x2, 0x0, 0x0, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0) r1 = fsopen(0x0, 0x0) futex_waitv(&(0x7f0000001b00)=[{0xfff, &(0x7f0000000340)=0xfffffffffffff697, 0x6}], 0x1, 0x0, 0x0, 0x1) syz_open_dev$ttys(0xc, 0x2, 0x1) gettid() fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0x2, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3cd2e7b3d6526bf5}}}, 0x6c}}, 0x0) r3 = socket$kcm(0x2, 0x3, 0x106) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000040)=0x7) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040301, 0x0) r6 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x1000000000000, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_REWIND(r6, 0x40084146, &(0x7f0000000180)=0x1c000000000000) sendmsg$inet(r3, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000080)="fbd2b9ed29d8974a6ce75f08916ac3b4da11bc1a", 0xffeb}], 0x1}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newlink={0x3c, 0x10, 0x403, 0x40000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88adf9a5}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE={0x8, 0x2, @multicast1}]}}}]}, 0x3c}}, 0x8080) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$F2FS_IOC_GET_FEATURES(r0, 0x8004f50c, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000001a40)=""/102392, 0x18ff8) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'dt2814\x00', [0x4f27, 0x1, 0x9, 0x47, 0x6, 0xcc7, 0xfff, 0x2000007, 0x5, 0x3fd, 0x7f, 0x4015fe, 0x1, 0x0, 0x8, 0xe1cb, 0xff7fffc0, 0x0, 0x2f, 0x295, 0x3, 0x10040f2, 0x8, 0x6, 0xffffeadb, 0x3, 0x1003c, 0x5, 0x2004, 0x9e5, 0x5]}) 3.927806174s ago: executing program 3 (id=1774): r0 = bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f00000001c0), 0x10) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000c, 0x2010, r0, 0x77e7f000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r1) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="310700000000fbdbdf2538"], 0x3c}, 0x1, 0x2}, 0x0) r3 = syz_open_dev$loop(&(0x7f00000000c0), 0x8000000000000003, 0x72082) r4 = io_uring_setup(0x5cc4, &(0x7f0000000100)={0x0, 0xcc32, 0x8000, 0x0, 0x1bc, 0x0, r3}) syz_clone(0x401000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BLKIOMIN(r3, 0x1278, &(0x7f0000000180)) io_setup(0x3, &(0x7f0000000200)=0x0) r6 = eventfd2(0x9, 0x800) r7 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r7, &(0x7f0000032680)=""/102392, 0x18ff8) r8 = eventfd(0x96aa) r9 = eventfd2(0x2, 0x800) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000500)={0x8, r4, 0x80000}) r11 = eventfd2(0x100, 0x801) r12 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/timer\x00', 0x0, 0x0) read$FUSE(r12, &(0x7f0000003d40)={0x2020}, 0x2020) io_submit(r5, 0x7, &(0x7f00000008c0)=[&(0x7f0000000300)={0x0, 0x0, 0x0, 0x6, 0xfc99, r1, &(0x7f0000000280)="79a88118a678fa2bc62301f3348a21938b79b4c0c9cf5ab395d85d73bdde8de9055deb5c121262f9bb904daf8ffb77d86f420c5e2f503297d83cec37b410833ae37b7292d10c1fc49bcdea733887f5e7405e1a99b3003e53ec801fbfad3c90f1", 0x60, 0x4, 0x0, 0x1, r6}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x100, r1, &(0x7f0000000340)="e8385fa20ab04017d3fd2aa002f3df478e0c3a27048c4a17d4c66d9aafa8c6a293331b4f580c1d63ce54f3e89a81da9c3f0964b9aff9b7f33a3414277f68b0feaf9abf1a04fad1d5f2c9c1379d706861dcfd", 0x52, 0x4, 0x0, 0x1}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x5, 0x5, r7, &(0x7f0000000400)="cffb4bbf042afa770f41c2b8d03e5d38fb664b78d5a8640b75f7c5522c8734ec576e5a53ae8b3919b1ff137aba5a54224dee2bdfc2d584cdc6145dde1ea337b474c8faeeec3488bcaa74871668930d4d8479347eaa86138b9c717e9296", 0x5d, 0x4b, 0x0, 0x0, r8}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x5, 0x7, r4, 0xfffffffffffffffe, 0x0, 0x3ff, 0x0, 0x1, r9}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x6, 0x7, r10, &(0x7f0000000540)="53c973bfffbca223d1b52f00e53cfd189bf036ccc9988e7ea6a0016e906f51fb4c7a5a273a153af768cb94a562356a0a83ba56376e028e062d609a3c60b94efc1229270141ecb0ea291e8328942111d785d8254b1f333cfe687ae3910cbf10bf349e7ca3121823315148bce8867c1477c89a53c2bbab035f9cd5bf59e06de28490933cc468adb1", 0x87, 0xdb7, 0x0, 0x1, r11}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x4, r1, &(0x7f0000000640)="6eba37e6716d098fbe007bbd185f7ce51898e47da40bd40e3162d07ebf74c9731c118db5d20bfe4a37bbb3435c7738dc34e5f369eb9d768b68aa6283ea4b435302bf1c89a0faefcd16d190f2f87d44646bf8b09ded9befa33c33b7d2a3b8ca73b1a6413d46ca84eba4f7e52c56ba55f3c717af909f2c74d69db13f0f7900ea0115bca09151549f64df20fb9f2fa9aa0511eca92395235554eec498a4d0a0686b85923fa3698e0b0af4a2a79d8a2765f40a18fa46bf787bc3416ffb26c721fb25ee01468dccc451dfe342c8fd815eb049af12988a60cbb4b759c45536c4eb5a2cb4e653e732236eb3fa9e03075d6fd7c621", 0xf1, 0x3, 0x0, 0x2, r12}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x5, 0x3, r1, &(0x7f0000000780)="da633ad654c41a6fbf760a03180ab3c48a3e2b3788cad1532b54f1346007da4d0cbf12a228ab9251807d5d57bcd010106b27acf655cbe6c961133a82010d30b63d8c96e6b93195951cb0a91acce219434c8f2576af4a8197a21db616ffc06ceb29aee9be83b0f9fb2bfa9deb1014efd35594be825148b0813dc5ea7c6c3c66b68a74e3219b66179a2f1353f2bb0e9246cc37fdf587b815ba622713bfd5fe862655588388a96e0e179d26b91f32028df6c55a232c1b83737a4c07d764da79c91ba0f4f06f170e33aec36561e30d0f4f0b9f86", 0xd2, 0x8, 0x0, 0x3, r3}]) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000900)={0x1, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000940)={r13}, 0x4) 3.572084153s ago: executing program 6 (id=1775): openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) pipe(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x3, [@ptr={0x0, 0x0, 0x0, 0x2, 0x2}, @typedef={0x7, 0x0, 0x0, 0x8, 0x3}, @type_tag={0x3, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0]}}, 0x0, 0x3f}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xe, 0x6, &(0x7f00000006c0)=@raw=[@tail_call, @exit], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r3, &(0x7f00000001c0), 0x8) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, &(0x7f0000000440)=0x1, &(0x7f00000007c0)=0x4) setrlimit(0xf, &(0x7f0000000040)={0x2, 0x10000}) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, 0x0, 0x0) 3.132461925s ago: executing program 6 (id=1776): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x1c42}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0xfffffffe}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x50}}, 0x0) (fail_nth: 7) 2.984628872s ago: executing program 3 (id=1777): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0e00000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000480)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41000, 0x22}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000ec0)={{r0}, &(0x7f0000000e40), &(0x7f0000000e80)=r1}, 0x20) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_IPV6_RTHDR(r2, 0x29, 0x39, 0x0, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r4 = eventfd(0x40005) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) accept4(0xffffffffffffffff, &(0x7f00000001c0)=@generic, 0x0, 0x800) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000300)=0x1) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0xd, &(0x7f0000000100)=ANY=[@ANYBLOB="180200000000000000000000000000008510000001000000950000000000000018010000202073250000000000202020db1af8ff50000000bfa100000000000007010000f8ffffffb702000008000000b703000000000028850000007600000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0xa}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000640)={{r0}, &(0x7f00000005c0), &(0x7f0000000600)=r6}, 0x20) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x34, 0x0, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x11f}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3800}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7fffffff, 0x5, &(0x7f0000000000)) 2.921075105s ago: executing program 2 (id=1778): r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x41}}, 0x10, 0x0}, 0x240048c1) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) 2.496630073s ago: executing program 2 (id=1779): r0 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$VIDIOC_S_TUNER(0xffffffffffffffff, 0x4054561e, 0x0) syz_open_procfs(0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r1, &(0x7f0000000180)={0x2a, 0x1, 0x4000}, 0xc) r2 = syz_io_uring_setup(0x497, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r5 = fcntl$getown(0xffffffffffffffff, 0x9) prlimit64(r5, 0x4, 0x0, &(0x7f0000000200)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8b04, &(0x7f0000000000)={'virt_wifi0\x00', @random="020000ff0100"}) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r1, 0x0, 0x0}) io_uring_enter(r2, 0x40f9, 0x34bb, 0xa5, 0x0, 0xfffffffffffffdf8) getpeername$l2tp6(r0, 0x0, 0x0) 2.312668136s ago: executing program 6 (id=1780): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_generic(0x10, 0x3, 0x10) socket(0x840000000002, 0x3, 0xfc) r1 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34b}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r1, 0x47bc, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000100)=0x14) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x3}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0600000004000000080000000800000004"], 0x50) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000840)={r4, @in={{0x2, 0x4e22, @empty}}, 0x75, 0x2, 0x614, 0x1, 0x2d, 0x80000001, 0x4}, 0x9c) 1.679586265s ago: executing program 6 (id=1781): r0 = syz_open_dev$dri(&(0x7f0000000280), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000300)=[0x0]}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r0, 0xc04064aa, &(0x7f00000003c0)={0x0, 0x0, r1, 0x0, '\x00', 0x300}) sendmsg$NFNL_MSG_ACCT_NEW(0xffffffffffffffff, 0x0, 0x4004084) r2 = socket$rds(0x15, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000800007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000000)={0x6, 0x0}, 0x8) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000040)={0x8, r2, 0x80000}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x1faa, &(0x7f0000000080)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)={0x60, 0x12, 0x905, 0x70bd28, 0x25dfdbfc, {0x21, 0x9, 0xb, 0x0, {0x4e22, 0x4e26, [0xfffffffc, 0x923, 0x0, 0x6], [0x401, 0x4, 0x3, 0x2], 0x0, [0x10000, 0x2005]}, 0x31, 0x4}, [@INET_DIAG_REQ_BYTECODE={0x14, 0x1, "0714140002209c9523f92b00402e7ab7"}]}, 0x60}, 0x1, 0x0, 0x0, 0x2000010}, 0x20000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_generate\x00', r5}, 0x10) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) bind$rds(r2, 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) 1.408960592s ago: executing program 3 (id=1782): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) socket$nl_xfrm(0x10, 0x3, 0x6) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x60d}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000100)=0x200, 0xc06620, 0x4) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) 1.276460888s ago: executing program 6 (id=1783): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x3) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0xffffc000) ioctl$VT_SETMODE(r2, 0x5602, &(0x7f0000000040)={0x8, 0xff, 0x94c, 0x8001, 0xb}) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000340)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x0, @local}}, 0x24) bind$rxrpc(r6, &(0x7f0000001280)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e23, @remote}}, 0x24) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000100000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x480d0) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r8, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) 1.246254539s ago: executing program 2 (id=1784): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r7, @ANYBLOB="0000000000000000b707000008000000850000006900000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="81ffffff00000000180012800e0001007769726567756172640000000400028008"], 0x40}}, 0x0) connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000280)={r2, r2, 0x1, 0x0, 0x0, 0x48, 0x1, 0x7, 0x5505, 0x8, 0x2, 0x10, 'syz0\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) ioctl$HIDIOCSUSAGES(r0, 0x501c4814, &(0x7f0000000b40)={{0x2, 0x100, 0x4, 0x6, 0x7}, 0xe, [0x6, 0x81, 0x6, 0x4cf, 0xf2, 0x1, 0x401, 0xffffff81, 0x10001, 0x9, 0x3, 0x8, 0x7, 0x8, 0x31, 0x5, 0x5, 0x10000, 0xdea, 0x7, 0x902d, 0x8, 0x0, 0x1, 0x9, 0x0, 0x6, 0x4, 0x6, 0x6, 0x4, 0x400, 0xffffff16, 0x3, 0x8, 0x6, 0x12b, 0x6, 0x69ad6983, 0x0, 0x9f60, 0x4, 0x6, 0x3, 0x5, 0x9, 0xb26e, 0xe, 0x1, 0x9, 0x1, 0x3, 0x81, 0xc, 0x9, 0xd25e, 0x80, 0x3, 0x2, 0x80, 0x4, 0x2, 0x9, 0xffffff81, 0x7, 0x4, 0x3a0d8914, 0x4576, 0x5, 0x10001, 0x7fff, 0xf25, 0x7, 0x4, 0x17d, 0x1, 0x3, 0x9, 0x7, 0x80000000, 0x7, 0x80000000, 0x1ff, 0x2, 0x7, 0x10, 0x6, 0x1, 0x9, 0x81, 0x3, 0x743, 0x7, 0x6, 0x5, 0x4, 0x3, 0x856, 0x80000000, 0x94c, 0x9, 0x2, 0x2, 0xffff8001, 0x7, 0x1, 0x519, 0x101, 0x10000, 0x80, 0x3, 0x7, 0xb, 0x798, 0x5e38, 0x800, 0x7, 0x1b7, 0x80000001, 0x8, 0x81, 0x9, 0xfffffffb, 0xffffffc0, 0xb, 0x6, 0x7fffffff, 0x5, 0x9, 0x7fff, 0xe, 0x7ff, 0xd9, 0x2, 0x4b4, 0x2, 0x9, 0xfffffe23, 0x4, 0x5032c374, 0x9, 0x3, 0x8, 0x930, 0x8, 0x10001, 0x6, 0x6, 0x4, 0x1, 0x7, 0x6, 0x0, 0x4, 0x2, 0x4, 0x1, 0x81, 0x2, 0x5, 0xc, 0x4, 0xd, 0x1, 0xc, 0xc3ad, 0x100, 0x9, 0xd3, 0x2, 0x7ff, 0xfe, 0x2, 0xe, 0x6, 0x9, 0xe, 0x1, 0x2, 0x80000000, 0x80000, 0xfffffffa, 0x1, 0x3, 0x200, 0x36, 0x8, 0x7, 0x2, 0x9, 0x8, 0x6, 0x40, 0x7f, 0x8, 0x8, 0xffffffff, 0x3, 0x9, 0x3, 0x2, 0x0, 0x100, 0x3, 0xfffffffd, 0x100, 0xffffffff, 0x3, 0x5, 0xe701, 0xb2, 0x2, 0x8, 0x94033700, 0x2e, 0x0, 0x6, 0x8, 0x3, 0x9, 0x20, 0x80, 0xa8, 0x7, 0x7, 0x4, 0x7, 0x3, 0x3, 0x4, 0x100, 0x200, 0x1d7366fc, 0x2000000, 0x3, 0x8, 0x65, 0x10, 0xfff, 0x7fff, 0xfff, 0x8000, 0x3, 0xe7e7, 0xf4, 0x970, 0x56, 0xfffffff3, 0x97b, 0x1, 0x5f, 0xaf3e, 0xf17, 0x4, 0xe92e, 0x8, 0x4, 0x7, 0xfff, 0x7, 0x0, 0x2, 0xe, 0x80000000, 0x8001, 0x2, 0x30, 0x80000000, 0x7, 0x0, 0x81, 0x0, 0x401, 0x5, 0x2, 0x6, 0x5af, 0x9, 0x6, 0x100, 0x7db9, 0x9, 0x6, 0x8, 0x9, 0x1, 0x7, 0x0, 0x2be, 0xd, 0x1, 0x0, 0xa, 0x9, 0x1, 0x0, 0x5, 0x5, 0x3, 0x9ba, 0xd, 0xa, 0x548, 0x401, 0x1, 0x0, 0x9, 0x8, 0xb15, 0x4, 0x366eced0, 0x4, 0x0, 0xfffffd95, 0x8001, 0x3, 0x8, 0x6, 0x2, 0x7, 0x1, 0x40, 0x7, 0x5, 0xed, 0xc, 0x1, 0x2, 0x98ed, 0x3, 0x1, 0x2, 0x5c01, 0x6, 0x3, 0x1000000, 0xfffffffa, 0x7, 0x8000, 0x9ccc7f33, 0x4, 0x2, 0x7, 0x9, 0x97f4, 0x0, 0x1, 0x7, 0x4, 0x603880, 0x5, 0x8, 0xefc1, 0x2, 0x8, 0x5, 0x8050, 0x7, 0x4, 0x9, 0xffff8001, 0x4, 0xa7, 0x9, 0xfff, 0x4, 0x9, 0xe, 0x800, 0x5, 0x8, 0x0, 0x5, 0x1, 0x3, 0x2, 0x2, 0x9, 0x5, 0x4, 0x6, 0xd, 0x7, 0xffffffff, 0xce0, 0x81, 0x8001, 0x3c97, 0x7, 0x8a1, 0x1, 0x3, 0x7fff, 0x52eb, 0x101, 0xad2, 0x2, 0x2, 0xf0, 0x7, 0xfff, 0x100, 0x9, 0xcd52, 0x112, 0x7, 0x6, 0x6, 0x7, 0x1, 0x4, 0x6, 0x5, 0x6, 0x101, 0x81, 0x10, 0x69, 0xffff352e, 0x10001, 0x3, 0x6ed3, 0x0, 0x6, 0x0, 0x2, 0x4, 0xffff, 0x1, 0x0, 0x5cefa349, 0xb33d, 0x7f, 0x2, 0xa05, 0x5ca, 0x0, 0x10001, 0x7, 0x8, 0x10000, 0xfe1, 0x0, 0x3, 0x6c, 0xd, 0x9, 0x3ff, 0xfffffff7, 0x1, 0xfff, 0x5, 0x2b, 0xfffffff9, 0xd6f, 0x0, 0x6, 0x8, 0x80000000, 0x1, 0x7fff, 0x2, 0xd, 0x4, 0x9, 0x2, 0x3, 0x8, 0x80, 0x7fffffff, 0x8, 0xffffff81, 0x8, 0x57e, 0x0, 0x5f, 0xfffffff9, 0x10000, 0x8, 0xa00, 0x5, 0x8, 0x1ff, 0xd, 0x1ff, 0x6, 0x8, 0xa, 0xc7, 0x7, 0x7, 0x7, 0x8, 0x4000000a, 0x5, 0x5, 0xffffff5c, 0x3, 0x5, 0xfffffbff, 0x9, 0x0, 0x0, 0x7, 0x8, 0x5, 0x2, 0x57f, 0x5, 0xd, 0x80000001, 0x9, 0xc4, 0x6, 0xe, 0x80000000, 0x400, 0x1, 0x2, 0x0, 0x1, 0x5, 0x5, 0x3, 0x6, 0x8, 0x141a, 0xfffffffd, 0x5, 0x80000001, 0x8, 0xfffffff8, 0x9, 0x7, 0xfffffffd, 0x4, 0x7f, 0xa, 0x8001, 0xe, 0x4, 0x10000, 0x4, 0x8, 0x3, 0x3, 0x9e6165c, 0x4, 0x4, 0x29f, 0x81, 0x100, 0x25, 0x98, 0x7, 0x8, 0x7, 0x6, 0x200, 0x1, 0x0, 0x8, 0xe, 0x9, 0x10, 0x1, 0x5, 0x4, 0x1, 0x1, 0xfffffffa, 0xffff, 0x32, 0x0, 0xbe5, 0x0, 0x7, 0x100, 0x6d, 0xffff7fff, 0x10000, 0x10, 0x2, 0x400, 0x7, 0x6, 0x6, 0x9, 0xfffffe00, 0x4, 0x0, 0xeddf, 0x4, 0x6, 0x3, 0xfffffffb, 0x1, 0x7, 0x4, 0x5, 0x401, 0x796ee162, 0x9, 0xe, 0x10000, 0xd1ee, 0x708, 0x4, 0x800, 0x0, 0x6, 0x68, 0x8, 0x6, 0xfffffff0, 0x9, 0xc2, 0x6258, 0x900, 0x8000, 0x7, 0x3, 0x9, 0x6, 0xf, 0x4, 0xffffff81, 0x6, 0x1, 0x1, 0x2, 0x3, 0x2, 0xffff26ea, 0xf, 0x8, 0x4, 0x3, 0x0, 0x8, 0xffffff81, 0x308b4bb9, 0x4, 0x7, 0x6, 0x5, 0xfffffff7, 0xfffffffe, 0x0, 0xc02, 0xfff, 0x81, 0xf, 0x2, 0x4, 0x7f, 0x4, 0x446173d9, 0x5, 0xe, 0x9, 0x3, 0x9, 0x3, 0x0, 0x2, 0x6, 0x800, 0x0, 0x200, 0x4, 0x7, 0xc7, 0x80000000, 0x800, 0x80000000, 0x3ff, 0x1, 0x8, 0x4, 0x7f, 0x1, 0x7, 0x9, 0x3, 0x8, 0x2, 0x1, 0x0, 0x8, 0xfffffff8, 0x5, 0x3, 0xe5ce, 0x7, 0xe, 0x9, 0x9, 0xcda, 0x9, 0x1, 0x5, 0xe8c, 0x3, 0xfffffc01, 0x8, 0x3, 0x6, 0xb, 0x5, 0x3, 0x6c, 0x7ff, 0xfd81, 0x10, 0x9, 0x7fffffff, 0x6, 0x80000007, 0x8, 0x5, 0x0, 0xfffff800, 0x5, 0x0, 0x4e, 0x0, 0x3, 0x9, 0x2, 0xb, 0x3, 0x10, 0x8000, 0x7f, 0xcae0, 0x100, 0x6, 0xfff, 0x3, 0x94d, 0xc, 0x81, 0x9, 0x2, 0xe1a, 0x7f, 0x1, 0x1, 0x2, 0x4, 0xe5, 0x80, 0xd11b, 0x8, 0x8, 0x2, 0x7, 0x7, 0x5, 0x8, 0x0, 0x7, 0x9, 0xff, 0x7, 0x2, 0x8, 0x3, 0x1, 0x8, 0x5d7f, 0x1ff, 0x5, 0x8, 0x8, 0x9, 0x100, 0x5, 0x3, 0x1, 0x3, 0x6, 0x4, 0x8000, 0x5, 0x0, 0x7, 0x5, 0x6e, 0x2, 0x7963ac0a, 0x3, 0x6, 0x8, 0x35b7, 0xa8, 0x3, 0x6, 0xfffffffd, 0x9, 0x7, 0x3ff, 0xfffffffb, 0x1, 0x9, 0x46fba294, 0xfffffffc, 0xe, 0x9, 0x80000001, 0x1, 0x7, 0xf, 0x0, 0x6, 0x10000, 0x6c, 0x9, 0x0, 0x3, 0x4, 0x0, 0xf7d0, 0x7, 0x7, 0x1, 0xc, 0x5, 0x2, 0x0, 0x9, 0x3, 0xb3, 0x6, 0x92, 0x8000, 0x3, 0x7, 0x7, 0x0, 0x3, 0x469a, 0x8, 0x4, 0x4, 0x1ff, 0x6, 0x2, 0x2, 0x3, 0xb101, 0x10, 0x0, 0x5, 0x50, 0x6, 0x8, 0x4, 0x4, 0xd0, 0x3ff, 0x3, 0x1, 0x8, 0x8, 0x4, 0x2, 0x1, 0x3, 0x1ff, 0x6, 0x6, 0x1, 0x2, 0x1f1, 0x8644, 0x40000000, 0x88c, 0x3, 0x7, 0x8, 0x8, 0x7f, 0x9, 0x7f, 0x5, 0x6, 0x800, 0x6, 0x7, 0x6, 0x7, 0x9, 0x6, 0x9, 0x5, 0xda90, 0x1, 0x9, 0x5, 0xe, 0x4, 0x7f, 0xb2, 0x6, 0x8e3a, 0xa, 0x80000001, 0x3, 0x3, 0x10a, 0x6, 0x6, 0xf, 0x6, 0x80, 0x8, 0x7f, 0x0, 0x0, 0x7, 0x1, 0x4, 0x8, 0x4, 0x7, 0x0, 0x8, 0x2, 0x9, 0xe16, 0x0, 0xfff, 0x0, 0x5, 0x27ce, 0x4e, 0x800, 0x4, 0x0, 0x3, 0x40, 0x5, 0x36, 0x4, 0x9, 0x9, 0x0, 0x3000000, 0x1, 0x0, 0x0, 0x1, 0xa, 0x5, 0x35143531, 0x5, 0x7, 0x280, 0x2, 0x2, 0x14de4ece, 0x6a5a, 0x1ff, 0xfffffff1, 0x2, 0x3, 0xffffffff, 0x7, 0x0, 0x0, 0xfffffff8, 0x5, 0xc, 0xfffffbff, 0x40, 0x9c, 0x7, 0xfffffffa, 0x200, 0x16, 0xfffffe16, 0xfff, 0xc, 0xb, 0xb, 0xd4, 0x7, 0x5, 0xb, 0x6, 0x3, 0xc086, 0x80000001, 0xe9, 0xf05f, 0x9, 0x2, 0x1ff, 0xb, 0x1724, 0x1, 0x3, 0x8, 0x80, 0x0, 0x28, 0x1, 0xffffffff, 0x7, 0x7, 0x4, 0x0, 0x6, 0x8, 0x3, 0x9e00, 0x25a5, 0x0, 0x8, 0xf, 0x7, 0x2]}) 636.4606ms ago: executing program 0 (id=1785): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) r1 = accept$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000100)=0x1c) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f0000000140)={0x100, {{0xa, 0x4e21, 0x101, @empty, 0x7}}, {{0xa, 0x4e23, 0x6, @private1, 0x5}}}, 0x108) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001b700)=""/102392, 0x18ff8) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r3 = socket$isdn(0x22, 0x2, 0x10) r4 = socket$isdn(0x22, 0x2, 0x2) r5 = dup3(r4, r3, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x300060c1) ioctl$KVM_SET_TSS_ADDR(r5, 0xae47, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x840, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r5) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f0000000400)={'ip_vti0\x00', &(0x7f0000000340)={'syztnl2\x00', 0x0, 0x700, 0x7800, 0x6, 0xbacf, {{0x19, 0x4, 0x3, 0x1d, 0x64, 0x67, 0x0, 0x2, 0x4, 0x0, @remote, @loopback, {[@rr={0x7, 0x13, 0xb1, [@remote, @broadcast, @loopback, @multicast2]}, @rr={0x7, 0x7, 0x20, [@private=0xa010101]}, @cipso={0x86, 0x17, 0x1, [{0x7, 0x11, "1c046282e1e72d4af2879ba7679907"}]}, @timestamp_prespec={0x44, 0x14, 0x5a, 0x3, 0x2, [{@local, 0xdb}, {@multicast1, 0x9}]}, @noop, @lsrr={0x83, 0x7, 0x25, [@loopback]}]}}}}}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r5, &(0x7f00000004c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r7, 0x300, 0x70bd25, 0x25dfdbfb, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x40) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000180)=0x7d) ioctl$KVM_CAP_DIRTY_LOG_RING(r0, 0x4068aea3, &(0x7f0000000080)={0xc0, 0x0, 0x8000}) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) 94.258808ms ago: executing program 4 (id=1786): openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) pipe(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x3, [@ptr={0x0, 0x0, 0x0, 0x2, 0x2}, @typedef={0x7, 0x0, 0x0, 0x8, 0x3}, @type_tag={0x3, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0]}}, 0x0, 0x3f}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xe, 0x6, &(0x7f00000006c0)=@raw=[@tail_call, @exit], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r3, &(0x7f00000001c0), 0x8) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, &(0x7f0000000440)=0x1, &(0x7f00000007c0)=0x4) setrlimit(0xf, &(0x7f0000000040)={0x2, 0x10000}) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, 0x0, 0x0) 0s ago: executing program 6 (id=1787): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000007000)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000940)=@newtaction={0x1a8, 0x30, 0x400, 0x70bd1e, 0x25dfdbfe, {}, [{0x190, 0x1, [@m_skbedit={0x18c, 0x9, 0x0, 0x0, {{0xc}, {0x74, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x7, 0x5, 0x2, 0x5, 0x6}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x4}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x10001}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x1}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xd, 0xb}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x2, 0x7, 0x0, 0xa, 0x62c3}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x8, 0x7, 0xffffffffffffffff, 0x735a, 0x3}}]}, {0xed, 0x6, "e102a39421966b5bf46d0aed3238a3bc226240d3214b815fe9d5fbe13835c0714be665067abc27180c773c62000c37ea1780e5997abb77770c3ab16bf747eac53bbf9720f513002b0be04379b1d108152188862c961673b28473028ce261dca9801b37cbd2d4402f2ea857d503aad81f997f0347e2650c0288087911f28bfe3ac23ed74f716c3083a852f58c3e2f2ffa478eb61498b21f4411c7d5eb90b4febdc5197f6b5b30927a5dba17d67e0dc441f7c14070b8fcbdbc22fa02700763386cad93da484af80d14ec258d880cc4a456713e3de4453e41b919f5b5fc8e9f9a01e311d591a7e7f67d87"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0xcdd3476e31e89ba2}}}}]}, {0x4}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x800}, 0x20008100) r2 = getpid() mkdirat(0xffffffffffffff9c, 0x0, 0x88) chdir(&(0x7f0000000080)='./file1\x00') r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="160000000000000004000000ffff000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000e6ade58ebf6b87e57655148ea63a000000000000000000000000110000000000000000baf51a7f5e2f68002a200d5751a3173f28126f86492ce238f12646ea4e15eb5d37a40a51aea0f41d441e0c8482a739c2ed4bcea8f3ac49bf53d0a7acaf6cbf069eb9bea68f65cee32d2d82deaa96a4", @ANYRESHEX, @ANYRES64=r2], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001280)=[r3]}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0d00000004000000040000000700000000000000", @ANYRES32=r3, @ANYBLOB="00000008000000000000ba000000000000000000", @ANYRES32, @ANYRES32, @ANYBLOB="00010000000000000000000000020000000000000000000200000000"], 0x50) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$inet6(0xa, 0x80002, 0x3a) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f00000004c0)={0x4, r4, 0x2}) gettid() ioctl$TIOCVHANGUP(r0, 0x5437, 0x2) kernel console output (not intermixed with test programs): mmy_hcd [ 484.627999][ T5936] usb 5-1: config 0 interface 0 has no altsetting 0 [ 484.636035][ T5936] usb 5-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 484.659761][ T5936] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.682398][ T5936] usb 5-1: config 0 descriptor?? [ 485.093139][ T10] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 485.653056][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 485.659975][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 102, changing to 10 [ 485.681243][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24624, setting to 1024 [ 485.711215][ T10] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 485.766698][ T10] usb 4-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 485.770706][T10726] wg2 speed is unknown, defaulting to 1000 [ 485.808897][ T10] usb 4-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 485.883246][ T976] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 485.908258][ T10] usb 4-1: Product: syz [ 485.924960][ T10] usb 4-1: Manufacturer: syz [ 485.935442][ T10] usb 4-1: SerialNumber: syz [ 486.007103][ T10] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input30 [ 486.092194][ T976] usb 6-1: config 0 has no interfaces? [ 486.117760][ T976] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 486.128054][ T976] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.137916][ T976] usb 6-1: Product: syz [ 486.142200][ T976] usb 6-1: Manufacturer: syz [ 486.151595][ T976] usb 6-1: SerialNumber: syz [ 486.158609][T10726] lo speed is unknown, defaulting to 1000 [ 486.166721][ T976] usb 6-1: config 0 descriptor?? [ 486.189431][ T24] usb 4-1: USB disconnect, device number 44 [ 486.195420][ C1] appletouch 4-1:1.0: atp_complete: usb_submit_urb failed with result -19 [ 486.281352][ T24] appletouch 4-1:1.0: input: appletouch disconnected [ 486.578304][T10726] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.659631][ T976] usb 6-1: USB disconnect, device number 7 [ 486.919682][ T976] kernel write not supported for file /cpu/0/msr (pid: 976 comm: kworker/0:2) [ 487.188253][T10745] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1265'. [ 488.120518][ T24] usb 5-1: USB disconnect, device number 48 [ 490.030189][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 490.030204][ T30] audit: type=1326 audit(1762949979.959:785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10774 comm="syz.4.1275" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7e84d8f6c9 code=0x0 [ 490.826502][ T24] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 491.150797][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 491.352021][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 491.363091][ T976] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 491.421384][ T24] usb 5-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 491.441459][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.465143][ T24] usb 5-1: config 0 descriptor?? [ 491.533858][ T24] usbhid 5-1:0.0: can't add hid device: -22 [ 491.539880][ T24] usbhid 5-1:0.0: probe with driver usbhid failed with error -22 [ 491.633734][ T976] usb 6-1: Using ep0 maxpacket: 32 [ 491.644067][ T976] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 491.652276][ T976] usb 6-1: config 0 has no interface number 0 [ 491.671202][ T976] usb 6-1: config 0 interface 12 has no altsetting 0 [ 491.690347][ T976] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 491.723004][ T976] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.805935][ T976] usb 6-1: Product: syz [ 491.939567][ T976] usb 6-1: Manufacturer: syz [ 491.959495][ T976] usb 6-1: SerialNumber: syz [ 491.978085][ T976] usb 6-1: config 0 descriptor?? [ 491.983925][T10812] comedi comedi4: bad chanlist[0]=0x00000020 chan=32 range length=2 [ 492.226379][T10795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 492.239459][T10795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.053750][ T9] usb 5-1: USB disconnect, device number 49 [ 493.709636][ T976] f81534 6-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 493.719870][ T976] f81534 6-1:0.12: f81534_find_config_idx: read failed: -71 [ 493.735447][ T976] f81534 6-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 493.750898][ T976] f81534 6-1:0.12: probe with driver f81534 failed with error -71 [ 493.770855][ T976] usb 6-1: USB disconnect, device number 8 [ 493.883347][ T24] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 493.943290][ T5922] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 493.973078][ T5861] usb 5-1: new full-speed USB device number 50 using dummy_hcd [ 494.034477][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 494.045510][ T24] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 494.054620][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.065259][ T24] usb 4-1: config 0 descriptor?? [ 494.072712][ T24] pwc: Askey VC010 type 2 USB webcam detected. [ 494.096510][ T5922] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 494.105911][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.115290][ T5922] usb 3-1: Product: syz [ 494.119477][ T5922] usb 3-1: Manufacturer: syz [ 494.124124][ T5922] usb 3-1: SerialNumber: syz [ 494.137714][ T5861] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 494.147854][ T5861] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 494.156913][ T5861] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 494.166167][ T5861] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.176407][ T5861] usb 5-1: config 0 descriptor?? [ 494.189783][ T5861] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 494.196590][ T5861] dvb-usb: bulk message failed: -22 (3/0) [ 494.204332][ T5861] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 494.214867][ T5861] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 494.221909][ T5861] usb 5-1: media controller created [ 494.238535][ T5861] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 494.252332][ T5861] dvb-usb: bulk message failed: -22 (6/0) [ 494.264976][ T5861] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 494.288081][ T5861] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input31 [ 494.301031][ T5861] dvb-usb: schedule remote query interval to 150 msecs. [ 494.308273][ T5861] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 494.612651][ T5861] dvb-usb: bulk message failed: -22 (1/0) [ 494.618498][ T5861] dvb-usb: error while querying for an remote control event. [ 494.627664][ T24] pwc: recv_control_msg error -32 req 02 val 2b00 [ 494.636361][ T24] pwc: recv_control_msg error -32 req 02 val 2700 [ 494.644054][ T24] pwc: recv_control_msg error -32 req 02 val 2c00 [ 494.644361][ T9] usb 5-1: USB disconnect, device number 50 [ 494.656995][ T24] pwc: recv_control_msg error -32 req 04 val 1000 [ 495.093983][ T24] pwc: recv_control_msg error -32 req 04 val 1300 [ 495.101810][ T24] pwc: recv_control_msg error -32 req 04 val 1400 [ 495.173104][ T9] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 495.185032][ T24] pwc: recv_control_msg error -32 req 02 val 2000 [ 495.201786][ T24] pwc: recv_control_msg error -32 req 02 val 2100 [ 495.226724][ T24] pwc: recv_control_msg error -32 req 04 val 1500 [ 495.241028][ T24] pwc: recv_control_msg error -32 req 02 val 2500 [ 495.248969][ T24] pwc: recv_control_msg error -32 req 02 val 2400 [ 495.263820][ T24] pwc: recv_control_msg error -32 req 02 val 2600 [ 495.273384][ T24] pwc: recv_control_msg error -32 req 02 val 2900 [ 495.285271][ T24] pwc: recv_control_msg error -71 req 02 val 2800 [ 495.292737][ T24] pwc: recv_control_msg error -71 req 04 val 1100 [ 495.309371][ T24] pwc: recv_control_msg error -71 req 04 val 1200 [ 495.327914][ T24] pwc: Registered as video103. [ 495.345776][ T24] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input32 [ 495.360042][ T24] usb 4-1: USB disconnect, device number 45 [ 495.591109][T10865] FAULT_INJECTION: forcing a failure. [ 495.591109][T10865] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 495.604217][T10865] CPU: 0 UID: 0 PID: 10865 Comm: syz.5.1295 Not tainted syzkaller #0 PREEMPT(full) [ 495.604232][T10865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 495.604240][T10865] Call Trace: [ 495.604249][T10865] [ 495.604257][T10865] dump_stack_lvl+0x16c/0x1f0 [ 495.604287][T10865] should_fail_ex+0x512/0x640 [ 495.604309][T10865] _copy_from_user+0x2e/0xd0 [ 495.604326][T10865] get_timespec64+0x8b/0x240 [ 495.604342][T10865] ? __pfx_get_timespec64+0x10/0x10 [ 495.604356][T10865] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 495.604370][T10865] get_itimerspec64+0x1e/0x60 [ 495.604388][T10865] __x64_sys_timer_settime+0x17d/0x2c0 [ 495.604409][T10865] ? __pfx___x64_sys_timer_settime+0x10/0x10 [ 495.604430][T10865] ? ksys_write+0x1ac/0x250 [ 495.604454][T10865] do_syscall_64+0xcd/0xfa0 [ 495.604471][T10865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.604488][T10865] RIP: 0033:0x7f98cbf8f6c9 [ 495.604502][T10865] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 495.604516][T10865] RSP: 002b:00007f98cce63038 EFLAGS: 00000246 ORIG_RAX: 00000000000000df [ 495.604532][T10865] RAX: ffffffffffffffda RBX: 00007f98cc1e6090 RCX: 00007f98cbf8f6c9 [ 495.604542][T10865] RDX: 0000200000000340 RSI: 0000000000000001 RDI: 0000000000000000 [ 495.604551][T10865] RBP: 00007f98cce63090 R08: 0000000000000000 R09: 0000000000000000 [ 495.604559][T10865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 495.604568][T10865] R13: 00007f98cc1e6128 R14: 00007f98cc1e6090 R15: 00007fffdcce74e8 [ 495.604590][T10865] [ 495.605730][ T5922] cdc_ncm 3-1:1.0: failed to get mac address [ 495.788301][ T5922] cdc_ncm 3-1:1.0: bind() failure [ 495.809767][ T5922] cdc_ncm 3-1:1.1: probe with driver cdc_ncm failed with error -71 [ 495.872935][ T5922] cdc_mbim 3-1:1.1: probe with driver cdc_mbim failed with error -71 [ 495.910505][ T5922] usbtest 3-1:1.1: probe with driver usbtest failed with error -71 [ 495.924328][ T5922] usb 3-1: USB disconnect, device number 33 [ 496.303333][ T24] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 496.493166][ T24] usb 5-1: device descriptor read/64, error -71 [ 496.979275][ T24] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 497.308267][ T24] usb 5-1: device descriptor read/64, error -71 [ 497.437117][ T24] usb usb5-port1: attempt power cycle [ 497.603082][ T5861] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 497.783420][ T5861] usb 4-1: Using ep0 maxpacket: 32 [ 497.893270][ T24] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 497.954124][ T5861] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 497.962340][ T5861] usb 4-1: config 0 has no interface number 0 [ 497.964090][ T5827] Bluetooth: hci4: command 0x0405 tx timeout [ 497.969098][ T24] usb 5-1: device descriptor read/8, error -71 [ 498.048103][ T5861] usb 4-1: config 0 interface 12 has no altsetting 0 [ 498.067198][ T5861] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 498.085179][ T5861] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.093739][ T5861] usb 4-1: Product: syz [ 498.103995][ T5861] usb 4-1: Manufacturer: syz [ 498.144153][ T5861] usb 4-1: SerialNumber: syz [ 498.326815][ T30] audit: type=1400 audit(1762949988.229:786): avc: denied { write } for pid=10902 comm="syz.2.1307" lport=44663 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 498.356371][ T5861] usb 4-1: config 0 descriptor?? [ 498.362255][ T30] audit: type=1400 audit(1762949988.239:787): avc: denied { getopt } for pid=10902 comm="syz.2.1307" lport=44663 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 498.393261][ T24] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 498.402742][ T30] audit: type=1400 audit(1762949988.249:788): avc: denied { setopt } for pid=10902 comm="syz.2.1307" lport=44663 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 498.436857][ T24] usb 5-1: device descriptor read/8, error -71 [ 498.593772][T10887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.613503][T10887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.633595][ T24] usb usb5-port1: unable to enumerate USB device [ 499.473048][ T976] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 499.544645][ T5861] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 499.552168][ T5861] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 499.563296][ T5861] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 499.571236][ T5861] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 499.599408][ T5861] usb 4-1: USB disconnect, device number 46 [ 499.755076][ T976] usb 6-1: config 0 has an invalid interface number: 133 but max is 0 [ 499.763423][ T976] usb 6-1: config 0 has no interface number 0 [ 499.769624][ T976] usb 6-1: config 0 interface 133 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 499.782419][ T976] usb 6-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 499.797041][ T976] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.831314][ T976] usb 6-1: Product: syz [ 499.835733][ T976] usb 6-1: Manufacturer: syz [ 499.840322][ T976] usb 6-1: SerialNumber: syz [ 499.911684][ T976] usb 6-1: config 0 descriptor?? [ 500.341247][T10909] tipc: Started in network mode [ 500.346221][T10909] tipc: Node identity 0ac83325a787, cluster identity 4711 [ 500.364660][T10909] tipc: Enabled bearer , priority 0 [ 500.400345][T10922] syzkaller0: entered promiscuous mode [ 500.416251][T10922] syzkaller0: entered allmulticast mode [ 500.454058][T10909] tipc: Resetting bearer [ 500.503356][ C0] syzkaller0: tun_net_xmit 90 [ 500.528303][T10909] syzkaller0: tun_net_xmit 90 [ 500.663206][ C1] syzkaller0: tun_net_xmit 90 [ 500.703938][T10908] tipc: Resetting bearer [ 500.785780][T10934] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1314'. [ 500.938698][T10908] tipc: Disabling bearer [ 500.996726][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.005783][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.114225][ T976] keyspan 6-1:0.133: Keyspan 1 port adapter converter detected [ 501.126735][ T976] keyspan 6-1:0.133: found no endpoint descriptor for endpoint 81 [ 501.134653][ T976] keyspan 6-1:0.133: found no endpoint descriptor for endpoint 1 [ 501.145181][ T976] keyspan 6-1:0.133: found no endpoint descriptor for endpoint 2 [ 501.154294][ T976] usb 6-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 501.245321][ T5936] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 501.375408][ T976] usb 6-1: USB disconnect, device number 9 [ 501.439791][ T976] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 501.521172][ T976] keyspan 6-1:0.133: device disconnected [ 501.595283][ T5936] usb 4-1: Using ep0 maxpacket: 8 [ 501.618624][ T5936] usb 4-1: config 0 has no interfaces? [ 501.625563][ T5936] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 501.636673][ T5936] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.661073][ T5936] usb 4-1: config 0 descriptor?? [ 501.696656][T10941] fuse: Bad value for 'fd' [ 502.034406][ T24] usb 4-1: USB disconnect, device number 47 [ 502.633098][ T5936] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 502.837808][ T5936] usb 6-1: config index 0 descriptor too short (expected 45, got 36) [ 502.845999][ T5936] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 502.857801][ T5936] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 502.868739][ T5936] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 502.879934][ T5936] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 502.883286][ T24] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 502.893455][ T5936] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 502.909852][ T5936] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.921064][ T5936] usb 6-1: config 0 descriptor?? [ 502.927097][T10953] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 503.044214][ T24] usb 4-1: config index 0 descriptor too short (expected 45, got 36) [ 503.052307][ T24] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 503.064520][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 503.077545][ T24] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 503.086622][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.086670][ T976] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 503.105203][ T24] usb 4-1: config 0 descriptor?? [ 503.253031][ T976] usb 5-1: Using ep0 maxpacket: 8 [ 503.259486][ T976] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 503.270757][ T976] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 503.280908][ T976] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 503.290904][ T976] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 503.303929][ T976] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 503.313037][ T976] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.341414][ T5936] plantronics 0003:047F:FFFF.0015: unknown main item tag 0x0 [ 503.348956][ T5936] plantronics 0003:047F:FFFF.0015: unknown main item tag 0x0 [ 503.357116][ T5936] plantronics 0003:047F:FFFF.0015: unknown main item tag 0x0 [ 503.365060][ T5936] plantronics 0003:047F:FFFF.0015: unknown main item tag 0x0 [ 503.372460][ T5936] plantronics 0003:047F:FFFF.0015: unknown main item tag 0x0 [ 503.379885][ T5936] plantronics 0003:047F:FFFF.0015: unknown main item tag 0x0 [ 503.387437][ T5936] plantronics 0003:047F:FFFF.0015: unknown main item tag 0x0 [ 503.394862][ T5936] plantronics 0003:047F:FFFF.0015: unknown main item tag 0x0 [ 503.402259][ T5936] plantronics 0003:047F:FFFF.0015: unknown main item tag 0x0 [ 503.409725][ T5936] plantronics 0003:047F:FFFF.0015: unknown main item tag 0x0 [ 503.422585][ T5936] plantronics 0003:047F:FFFF.0015: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 503.527381][ T976] usb 5-1: GET_CAPABILITIES returned 0 [ 503.533674][ T976] usbtmc 5-1:16.0: can't read capabilities [ 503.836264][ T5861] usb 5-1: USB disconnect, device number 55 [ 503.882551][T10847] usb 6-1: USB disconnect, device number 10 [ 504.344699][T10976] wireguard2: entered promiscuous mode [ 504.346349][T10979] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input33 [ 504.360487][T10976] wireguard2: entered allmulticast mode [ 506.303593][ T24] usb 4-1: string descriptor 0 read error: -71 [ 506.810886][ T24] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 506.823064][ T24] usb 4-1: USB disconnect, device number 48 [ 507.436525][ T30] audit: type=1400 audit(1762949997.369:789): avc: denied { write } for pid=11013 comm="syz.3.1343" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 508.118966][T11036] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 508.126301][T11036] overlayfs: failed to set xattr on upper [ 508.132136][T11036] overlayfs: ...falling back to redirect_dir=nofollow. [ 508.139178][T11036] overlayfs: ...falling back to index=off. [ 508.149371][T11036] overlayfs: ...falling back to uuid=null. [ 508.155287][T11036] overlayfs: maximum fs stacking depth exceeded [ 508.358163][ T976] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 510.223410][ T976] usb 5-1: Using ep0 maxpacket: 16 [ 510.230143][ T976] usb 5-1: config 0 has no interfaces? [ 510.237796][ T976] usb 5-1: New USB device found, idVendor=05ac, idProduct=c704, bcdDevice=62.77 [ 510.247027][ T976] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.261854][ T976] usb 5-1: Product: syz [ 510.280566][ T976] usb 5-1: Manufacturer: syz [ 510.291815][ T976] usb 5-1: SerialNumber: syz [ 510.302926][ T976] usb 5-1: config 0 descriptor?? [ 510.386813][ T5861] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 510.952110][ T50] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 511.034643][ T5861] usb 6-1: config index 0 descriptor too short (expected 45, got 36) [ 511.085041][ T5861] usb 6-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 511.130544][ T5861] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 511.267689][ T5861] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 511.361183][ T5861] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.462741][T11063] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1354'. [ 512.147929][ T5861] usb 6-1: config 0 descriptor?? [ 512.228145][T11067] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1357'. [ 513.241554][ T24] usb 5-1: USB disconnect, device number 56 [ 513.356439][T11069] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 513.640754][T11041] wireguard0: entered promiscuous mode [ 513.646671][T11041] wireguard0: entered allmulticast mode [ 513.753452][ T48] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 513.913126][ T48] usb 4-1: Using ep0 maxpacket: 8 [ 513.920993][ T48] usb 4-1: config 0 has no interfaces? [ 513.927336][ T48] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 513.936842][ T48] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 513.949875][ T48] usb 4-1: config 0 descriptor?? [ 514.309580][ T48] usb 4-1: USB disconnect, device number 49 [ 514.443038][ T976] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 514.603066][ T976] usb 3-1: Using ep0 maxpacket: 16 [ 514.610062][ T976] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 514.621133][ T976] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 514.630935][ T976] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 514.643866][ T976] usb 3-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 514.652933][ T976] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 514.662918][ T976] usb 3-1: config 0 descriptor?? [ 514.781098][ T5861] usb 6-1: string descriptor 0 read error: -71 [ 514.814146][ T5861] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 514.831588][ T5861] usb 6-1: USB disconnect, device number 11 [ 515.283061][ T9] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 515.327643][T11109] binder: 11092:11109 unknown command 0 [ 515.333345][T11109] binder: 11092:11109 ioctl c0306201 200000000540 returned -22 [ 515.509737][ T9] usb 5-1: config index 0 descriptor too short (expected 45, got 36) [ 515.544966][ T9] usb 5-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 515.615644][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 515.762086][ T9] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 515.798776][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.840293][ T9] usb 5-1: config 0 descriptor?? [ 516.051859][T11122] netlink: 196 bytes leftover after parsing attributes in process `syz.3.1375'. [ 516.182182][T11122] netlink: 'syz.3.1375': attribute type 1 has an invalid length. [ 516.620059][T11127] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input34 [ 517.065943][T11125] wireguard2: entered promiscuous mode [ 517.071559][T11125] wireguard2: entered allmulticast mode [ 517.308599][ T976] usbhid 3-1:0.0: can't add hid device: -71 [ 517.332121][ T976] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 517.369864][ T976] usb 3-1: USB disconnect, device number 34 [ 517.578445][T11141] ./cgroup: Can't lookup blockdev [ 518.334145][ T9] usb 5-1: string descriptor 0 read error: -71 [ 518.342732][ T9] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 518.394853][ T9] usb 5-1: USB disconnect, device number 57 [ 518.514145][T11158] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 518.521358][T11158] overlayfs: failed to set xattr on upper [ 518.527392][T11158] overlayfs: ...falling back to redirect_dir=nofollow. [ 518.534439][T11158] overlayfs: ...falling back to index=off. [ 518.540349][T11158] overlayfs: ...falling back to uuid=null. [ 518.547316][T11158] overlayfs: maximum fs stacking depth exceeded [ 519.953238][T11166] comedi comedi3: 8255: I/O port conflict (0x40404f26,4) [ 519.960557][T11166] comedi comedi3: 8255: I/O port conflict (0x5,4) [ 519.967196][T11166] comedi comedi3: 8255: I/O port conflict (0x2,4) [ 519.973990][T11166] comedi comedi3: 8255: I/O port conflict (0xc,4) [ 519.980683][T11166] comedi comedi3: 8255: I/O port conflict (0x9,4) [ 519.987557][T11166] comedi comedi3: 8255: I/O port conflict (0x5c95238c,4) [ 519.994769][T11166] comedi comedi3: 8255: I/O port conflict (0xa,4) [ 520.002609][T11166] comedi comedi3: 8255: I/O port conflict (0x3bf,4) [ 520.009391][T11166] comedi comedi3: 8255: I/O port conflict (0x6,4) [ 520.016290][T11166] comedi comedi3: 8255: I/O port conflict (0x3,4) [ 520.023717][T11166] comedi comedi3: 8255: I/O port conflict (0x20000001,4) [ 520.031095][T11166] comedi comedi3: 8255: I/O port conflict (0x400e1c8,4) [ 520.038340][T11166] comedi comedi3: 8255: I/O port conflict (0x6,4) [ 520.045000][T11166] comedi comedi3: 8255: I/O port conflict (0x7,4) [ 520.051587][T11166] comedi comedi3: 8255: I/O port conflict (0x6,4) [ 520.058397][T11166] comedi comedi3: 8255: I/O port conflict (0x6,4) [ 520.065062][T11166] comedi comedi3: 8255: I/O port conflict (0x4,4) [ 520.071738][T11166] comedi comedi3: 8255: I/O port conflict (0xb,4) [ 520.079042][T11166] comedi comedi3: 8255: I/O port conflict (0x10,4) [ 520.085857][T11166] comedi comedi3: 8255: I/O port conflict (0x3,4) [ 520.092503][T11166] comedi comedi3: 8255: I/O port conflict (0xef,4) [ 520.385007][T11169] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 521.443756][T11180] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1394'. [ 521.590239][ T30] audit: type=1400 audit(1762950011.369:790): avc: denied { ioctl } for pid=11179 comm="syz.4.1394" path="socket:[30595]" dev="sockfs" ino=30595 ioctlcmd=0x6612 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 522.529831][T11200] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 522.703026][ T9] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 522.795913][ T48] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 522.873526][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 522.883561][ T9] usb 4-1: config 0 has no interfaces? [ 522.897247][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=c704, bcdDevice=62.77 [ 523.362476][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.370936][ T9] usb 4-1: Product: syz [ 523.375332][ T9] usb 4-1: Manufacturer: syz [ 523.379966][ T9] usb 4-1: SerialNumber: syz [ 523.387545][ T9] usb 4-1: config 0 descriptor?? [ 523.412275][ T48] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 523.420857][ T48] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 523.440748][ T48] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 523.458229][ T48] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 523.468134][ T48] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.478949][ T48] usb 3-1: config 0 descriptor?? [ 524.339729][T11215] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 524.720429][T11220] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input35 [ 524.769879][T11218] wireguard2: entered promiscuous mode [ 524.775467][T11218] wireguard2: entered allmulticast mode [ 525.859711][ T10] usb 4-1: USB disconnect, device number 50 [ 526.455454][ T48] usb 3-1: string descriptor 0 read error: -71 [ 526.463489][ T48] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 526.476065][ T48] usb 3-1: USB disconnect, device number 35 [ 526.522013][T11232] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 526.801141][ T30] audit: type=1400 audit(1762950016.719:791): avc: denied { setattr } for pid=11235 comm="syz.5.1409" name="ptmx" dev="devtmpfs" ino=615 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ptmx_t tclass=chr_file permissive=1 [ 527.596379][T11252] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1414'. [ 527.652847][T11252] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1414'. [ 527.663755][T11252] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1414'. [ 527.673298][T11252] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1414'. [ 527.728167][T11252] netlink: 'syz.5.1414': attribute type 3 has an invalid length. [ 528.625494][T10847] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 528.873329][T10847] usb 5-1: Using ep0 maxpacket: 16 [ 529.019000][T10847] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 529.096721][T10847] usb 5-1: config 0 has no interfaces? [ 529.171338][T10847] usb 5-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 529.232510][T10847] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.263840][T10847] usb 5-1: Product: syz [ 529.293061][T10847] usb 5-1: Manufacturer: syz [ 529.300688][T10847] usb 5-1: SerialNumber: syz [ 529.314285][T10847] usb 5-1: config 0 descriptor?? [ 530.988808][T11289] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1421'. [ 531.076990][ T9] usb 5-1: USB disconnect, device number 58 [ 531.474603][ T24] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 531.718611][ T24] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 531.736668][ T24] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 531.752027][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 531.766750][ T24] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 531.807309][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.921392][ T24] usb 3-1: config 0 descriptor?? [ 533.615701][T11306] wireguard3: entered promiscuous mode [ 533.615829][T11294] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input36 [ 533.621190][T11306] wireguard3: entered allmulticast mode [ 533.733423][T11317] x_tables: duplicate underflow at hook 2 [ 534.916655][ T24] usb 3-1: string descriptor 0 read error: -71 [ 534.985428][ T24] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 535.058266][T11331] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1432'. [ 535.066407][ T24] usb 3-1: USB disconnect, device number 36 [ 535.233907][ T30] audit: type=1326 audit(1762950025.149:792): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11330 comm="syz.2.1432" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f26e7d8f6c9 code=0x7fdf0000 [ 536.803796][T11347] FAULT_INJECTION: forcing a failure. [ 536.803796][T11347] name failslab, interval 1, probability 0, space 0, times 0 [ 536.816765][T11347] CPU: 0 UID: 0 PID: 11347 Comm: syz.3.1436 Not tainted syzkaller #0 PREEMPT(full) [ 536.816788][T11347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 536.816798][T11347] Call Trace: [ 536.816804][T11347] [ 536.816810][T11347] dump_stack_lvl+0x16c/0x1f0 [ 536.816843][T11347] should_fail_ex+0x512/0x640 [ 536.816862][T11347] ? fs_reclaim_acquire+0xae/0x150 [ 536.816884][T11347] should_failslab+0xc2/0x120 [ 536.816904][T11347] __kmalloc_noprof+0xdd/0x880 [ 536.816928][T11347] ? tomoyo_encode2+0x100/0x3e0 [ 536.816952][T11347] ? tomoyo_encode2+0x100/0x3e0 [ 536.816969][T11347] tomoyo_encode2+0x100/0x3e0 [ 536.816991][T11347] tomoyo_encode+0x29/0x50 [ 536.817009][T11347] tomoyo_realpath_from_path+0x18f/0x6e0 [ 536.817037][T11347] tomoyo_path_number_perm+0x245/0x580 [ 536.817052][T11347] ? tomoyo_path_number_perm+0x237/0x580 [ 536.817071][T11347] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 536.817089][T11347] ? find_held_lock+0x2b/0x80 [ 536.817135][T11347] ? find_held_lock+0x2b/0x80 [ 536.817155][T11347] ? hook_file_ioctl_common+0x145/0x410 [ 536.817184][T11347] ? __fget_files+0x20e/0x3c0 [ 536.817206][T11347] security_file_ioctl+0x9b/0x240 [ 536.817227][T11347] __x64_sys_ioctl+0xb7/0x210 [ 536.817253][T11347] do_syscall_64+0xcd/0xfa0 [ 536.817272][T11347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.817289][T11347] RIP: 0033:0x7fa9a4d8f6c9 [ 536.817303][T11347] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 536.817318][T11347] RSP: 002b:00007fa9a5ca1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 536.817335][T11347] RAX: ffffffffffffffda RBX: 00007fa9a4fe6180 RCX: 00007fa9a4d8f6c9 [ 536.817345][T11347] RDX: 00002000000001c0 RSI: 0000000080284504 RDI: 0000000000000006 [ 536.817354][T11347] RBP: 00007fa9a5ca1090 R08: 0000000000000000 R09: 0000000000000000 [ 536.817364][T11347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 536.817374][T11347] R13: 00007fa9a4fe6218 R14: 00007fa9a4fe6180 R15: 00007ffe6d88cdc8 [ 536.817400][T11347] [ 536.817416][T11347] ERROR: Out of memory at tomoyo_realpath_from_path. [ 537.703066][ T9] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 538.293111][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 538.381874][ T9] usb 6-1: config 0 has no interfaces? [ 538.437930][ T9] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 538.533034][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 538.594098][ T9] usb 6-1: config 0 descriptor?? [ 539.875837][ T9] usb 6-1: USB disconnect, device number 12 [ 539.933093][ T30] audit: type=1400 audit(1762950029.859:793): avc: denied { ioctl } for pid=11370 comm="syz.0.1443" path="socket:[31090]" dev="sockfs" ino=31090 ioctlcmd=0x581f scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 540.086878][ T30] audit: type=1400 audit(1762950029.859:794): avc: denied { connect } for pid=11370 comm="syz.0.1443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 540.485427][ T30] audit: type=1400 audit(1762950029.929:795): avc: denied { write } for pid=11370 comm="syz.0.1443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 540.529054][ T30] audit: type=1400 audit(1762950030.439:796): avc: denied { ioctl } for pid=11376 comm="syz.2.1446" path="socket:[32084]" dev="sockfs" ino=32084 ioctlcmd=0x894b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 540.823040][ T10] usb 4-1: new full-speed USB device number 51 using dummy_hcd [ 541.027032][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 541.122724][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 541.609708][ T10] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice=be.00 [ 541.654669][ T10] usb 4-1: New USB device strings: Mfr=10, Product=0, SerialNumber=0 [ 541.664580][ T10] usb 4-1: Manufacturer: syz [ 541.696533][T11385] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 541.705281][T11385] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 541.721131][ T10] usb 4-1: config 0 descriptor?? [ 541.773765][T11385] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 541.781092][T11385] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 541.987558][T11385] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 542.025679][T11385] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 542.028148][T11401] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 542.172898][T11401] CIFS mount error: No usable UNC path provided in device string! [ 542.172898][T11401] [ 542.182562][ T10] isku 0003:1E7D:319C.0016: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 542.376415][T11401] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 542.410319][ T10] isku 0003:1E7D:319C.0016: couldn't init struct isku_device [ 542.436794][ T10] isku 0003:1E7D:319C.0016: couldn't install keyboard [ 542.482878][T11385] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 542.485414][ T10] isku 0003:1E7D:319C.0016: probe with driver isku failed with error -32 [ 542.546513][T11385] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 542.576334][ T10] usb 4-1: USB disconnect, device number 51 [ 542.927263][T11412] fido_id[11412]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 543.387724][T11420] fuse: Unknown parameter '0x0000000000000004' [ 544.083525][T11420] orangefs_mount: mount request failed with -4 [ 544.677067][ T30] audit: type=1400 audit(1762950034.559:797): avc: denied { validate_trans } for pid=11439 comm="syz.2.1458" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 544.799128][T11441] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 546.553679][T11479] binder: BINDER_SET_CONTEXT_MGR already set [ 546.559701][T11479] binder: 11470:11479 ioctl 4018620d 200000000040 returned -16 [ 546.923205][T10635] usb 5-1: new full-speed USB device number 59 using dummy_hcd [ 547.108158][T10635] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 547.151331][T10635] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 547.205347][T10635] usb 5-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice=be.00 [ 547.224440][T11494] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1465'. [ 547.234290][T11492] x_tables: duplicate underflow at hook 2 [ 547.489366][T10635] usb 5-1: New USB device strings: Mfr=10, Product=0, SerialNumber=0 [ 547.497668][T10635] usb 5-1: Manufacturer: syz [ 547.510060][T10635] usb 5-1: config 0 descriptor?? [ 547.813019][ T976] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 547.833703][ T10] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 547.975456][T10635] isku 0003:1E7D:319C.0017: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 547.993031][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 547.998953][ T976] usb 4-1: Using ep0 maxpacket: 32 [ 548.013324][ T10] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 548.023086][ T976] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 548.031209][ T976] usb 4-1: config 0 has no interface number 0 [ 548.043025][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 548.053300][ T976] usb 4-1: config 0 interface 12 has no altsetting 0 [ 548.113106][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 548.338989][ T976] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 548.348477][T10635] isku 0003:1E7D:319C.0017: couldn't init struct isku_device [ 548.356195][ T976] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.364434][T10635] isku 0003:1E7D:319C.0017: couldn't install keyboard [ 548.373143][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 548.383349][ T976] usb 4-1: Product: syz [ 548.399874][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.411250][ T976] usb 4-1: Manufacturer: syz [ 548.423479][T10635] isku 0003:1E7D:319C.0017: probe with driver isku failed with error -32 [ 548.432462][ T976] usb 4-1: SerialNumber: syz [ 548.439293][ T10] usb 3-1: Product: syz [ 548.453048][ T10] usb 3-1: Manufacturer: syz [ 548.457660][ T10] usb 3-1: SerialNumber: syz [ 548.463227][ T976] usb 4-1: config 0 descriptor?? [ 548.476103][T10635] usb 5-1: USB disconnect, device number 59 [ 548.758373][T11497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 548.768856][T11497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.835228][T11507] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 548.842314][T11507] overlayfs: failed to set xattr on upper [ 548.848234][T11507] overlayfs: ...falling back to redirect_dir=nofollow. [ 548.855156][T11507] overlayfs: ...falling back to index=off. [ 548.861023][T11507] overlayfs: ...falling back to uuid=null. [ 548.866934][T11507] overlayfs: maximum fs stacking depth exceeded [ 550.292297][ T10] usb 3-1: 0:2 : does not exist [ 550.408828][T11510] fido_id[11510]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 551.033500][ T976] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 551.055601][ T976] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 551.065986][ T976] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 551.132442][ T10] usb 3-1: USB disconnect, device number 37 [ 551.138641][ T976] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 551.170319][ T976] usb 4-1: USB disconnect, device number 52 [ 551.322041][ T5814] udevd[5814]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 552.232581][T11529] FAULT_INJECTION: forcing a failure. [ 552.232581][T11529] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 552.282296][T11529] CPU: 0 UID: 0 PID: 11529 Comm: syz.4.1474 Not tainted syzkaller #0 PREEMPT(full) [ 552.282321][T11529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 552.282331][T11529] Call Trace: [ 552.282337][T11529] [ 552.282343][T11529] dump_stack_lvl+0x16c/0x1f0 [ 552.282374][T11529] should_fail_ex+0x512/0x640 [ 552.282396][T11529] _copy_to_user+0x32/0xd0 [ 552.282418][T11529] simple_read_from_buffer+0xcb/0x170 [ 552.282446][T11529] proc_fail_nth_read+0x197/0x240 [ 552.282465][T11529] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 552.282485][T11529] ? rw_verify_area+0xcf/0x6c0 [ 552.282506][T11529] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 552.282522][T11529] vfs_read+0x1e4/0xcf0 [ 552.282538][T11529] ? __pfx___mutex_lock+0x10/0x10 [ 552.282555][T11529] ? __pfx_vfs_read+0x10/0x10 [ 552.282574][T11529] ? __fget_files+0x20e/0x3c0 [ 552.282596][T11529] ksys_read+0x12a/0x250 [ 552.282610][T11529] ? __pfx_ksys_read+0x10/0x10 [ 552.282631][T11529] do_syscall_64+0xcd/0xfa0 [ 552.282646][T11529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.282662][T11529] RIP: 0033:0x7f7e84d8e0dc [ 552.282676][T11529] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 552.282692][T11529] RSP: 002b:00007f7e85bc6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 552.282708][T11529] RAX: ffffffffffffffda RBX: 00007f7e84fe5fa0 RCX: 00007f7e84d8e0dc [ 552.282718][T11529] RDX: 000000000000000f RSI: 00007f7e85bc60a0 RDI: 0000000000000005 [ 552.282727][T11529] RBP: 00007f7e85bc6090 R08: 0000000000000000 R09: 0000000000000000 [ 552.282736][T11529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 552.282745][T11529] R13: 00007f7e84fe6038 R14: 00007f7e84fe5fa0 R15: 00007ffd131e88f8 [ 552.282770][T11529] [ 552.966827][ T48] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 553.204066][ T48] usb 3-1: Using ep0 maxpacket: 32 [ 553.295872][ T48] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 553.355477][ T48] usb 3-1: config 0 has no interface number 0 [ 553.363816][ T48] usb 3-1: config 0 interface 12 has no altsetting 0 [ 553.374605][ T48] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 553.391741][ T48] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.543025][ T48] usb 3-1: Product: syz [ 553.549565][ T48] usb 3-1: Manufacturer: syz [ 553.574387][ T48] usb 3-1: SerialNumber: syz [ 553.623024][ T48] usb 3-1: config 0 descriptor?? [ 553.897746][T11533] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 553.978893][T11533] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.472770][ T50] bridge_slave_1: left allmulticast mode [ 554.520093][ T50] bridge_slave_1: left promiscuous mode [ 554.554226][ T50] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.667273][ T50] bridge_slave_0: left allmulticast mode [ 554.673302][ T50] bridge_slave_0: left promiscuous mode [ 554.679117][ T50] bridge0: port 1(bridge_slave_0) entered disabled state [ 554.692410][ T48] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 554.702037][ T48] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 554.709673][ T48] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 554.774251][ T48] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 554.928319][ T48] usb 3-1: USB disconnect, device number 38 [ 556.025266][ T50] bond1 (unregistering): (slave bridge1): Releasing active interface [ 556.112816][T11572] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 556.507067][ T50] bond0 (unregistering): left promiscuous mode [ 556.513632][ T50] bond_slave_0: left promiscuous mode [ 556.520287][ T50] bond_slave_1: left promiscuous mode [ 556.533813][ T50] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 556.548074][ T50] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 556.563460][ T50] bond0 (unregistering): Released all slaves [ 556.596683][ T50] bond1 (unregistering): Released all slaves [ 556.633027][T10635] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 556.813808][T10635] usb 3-1: Using ep0 maxpacket: 16 [ 556.824310][T10635] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 556.855326][T10635] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 556.878304][T10635] usb 3-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 556.887894][T10635] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.907968][T10635] usb 3-1: Product: syz [ 556.958344][T10635] usb 3-1: Manufacturer: syz [ 556.989631][T10635] usb 3-1: SerialNumber: syz [ 557.054642][T10635] usb 3-1: config 0 descriptor?? [ 557.611955][ T5827] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 557.620840][ T5827] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 557.631236][ T5827] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 557.645528][ T5827] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 558.970592][ T5827] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 559.051973][ T5813] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 559.066751][ T5813] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 559.074175][ T5813] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 559.106647][ T5813] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 559.117579][ T5813] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 559.485368][T10635] usb 3-1: USB disconnect, device number 39 [ 559.833024][ T5861] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 560.096809][T10847] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 560.197570][ T5861] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 560.212056][ T5861] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.230022][ T5861] usb 5-1: Product: syz [ 560.234686][ T5861] usb 5-1: Manufacturer: syz [ 560.255402][ T5861] usb 5-1: SerialNumber: syz [ 560.346014][T10847] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 560.389479][T10847] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 560.421000][T10847] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 560.522161][ T50] batadv0: left promiscuous mode [ 560.542507][T10847] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 560.607297][ T50] hsr_slave_0: left promiscuous mode [ 560.624323][T10847] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.656006][ T50] hsr_slave_1: left promiscuous mode [ 560.656640][T10847] usb 3-1: config 0 descriptor?? [ 560.663697][ T50] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 560.700754][ T5861] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 560.724202][ T50] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 560.740029][ T5861] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 560.754396][ T50] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 560.773044][ T50] batman_adv: batadv0: Removing interface: ipvlan2 [ 560.821409][ T50] veth0_macvtap: left allmulticast mode [ 561.148370][ T5827] Bluetooth: hci5: command tx timeout [ 561.520953][T11635] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input37 [ 562.259758][ T5861] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 562.289575][ T5861] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPIPE [ 562.334453][ T50] team0 (unregistering): Port device team_slave_1 removed [ 562.396792][ T50] team0 (unregistering): Port device team_slave_0 removed [ 562.437864][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.445317][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.712162][ T5861] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000404. ret = -EPROTO [ 562.733708][ T5861] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 562.756712][ T5861] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 562.778851][ T5861] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 562.839274][ T5861] usb 5-1: USB disconnect, device number 60 [ 563.386878][ T5827] Bluetooth: hci5: command tx timeout [ 563.510220][T11595] wg2 speed is unknown, defaulting to 1000 [ 563.538134][T11634] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 563.595488][T10847] usb 3-1: string descriptor 0 read error: -71 [ 563.720300][T10847] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 563.763961][T10847] usb 3-1: USB disconnect, device number 40 [ 564.277655][T11654] netlink: 'syz.3.1502': attribute type 27 has an invalid length. [ 564.303602][T10847] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 564.436622][T11595] lo speed is unknown, defaulting to 1000 [ 564.457460][ T1006] smc: removing ib device syz2 [ 564.606254][T10847] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 564.783264][T10847] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 564.935698][T10847] usb 3-1: config 0 descriptor?? [ 564.952207][T10847] cp210x 3-1:0.0: cp210x converter detected [ 565.366463][T10847] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 565.464071][ T5827] Bluetooth: hci5: command tx timeout [ 565.694985][T10847] cp210x 3-1:0.0: failed to get vendor val 0x370c size 15: -121 [ 565.702757][T10847] cp210x 3-1:0.0: GPIO initialisation failed: -121 [ 565.739302][T10847] usb 3-1: cp210x converter now attached to ttyUSB0 [ 565.847075][T11595] chnl_net:caif_netlink_parms(): no params data found [ 565.970128][ T30] audit: type=1400 audit(1762950055.899:798): avc: denied { write } for pid=11648 comm="syz.2.1501" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 566.017563][ T48] usb 3-1: USB disconnect, device number 41 [ 566.192261][ T48] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 566.253033][ T48] cp210x 3-1:0.0: device disconnected [ 566.989808][T11595] bridge0: port 1(bridge_slave_0) entered blocking state [ 567.007339][T11595] bridge0: port 1(bridge_slave_0) entered disabled state [ 567.023361][T11595] bridge_slave_0: entered allmulticast mode [ 567.040684][T11595] bridge_slave_0: entered promiscuous mode [ 567.070991][T11595] bridge0: port 2(bridge_slave_1) entered blocking state [ 567.090641][T11595] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.107520][T11595] bridge_slave_1: entered allmulticast mode [ 567.134833][T11595] bridge_slave_1: entered promiscuous mode [ 567.541995][T11595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 567.573200][ T5827] Bluetooth: hci5: command tx timeout [ 567.644402][T11595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 568.013122][ T976] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 569.128673][T11595] team0: Port device team_slave_0 added [ 569.268946][T11595] team0: Port device team_slave_1 added [ 570.171701][T11595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 570.183254][T11595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 570.209188][ C0] vkms_vblank_simulate: vblank timer overrun [ 570.388607][T11595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 570.464104][T11595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 570.512982][T11595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 570.583117][T11595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 570.783603][T11733] binder: BINDER_SET_CONTEXT_MGR already set [ 570.789850][T11733] binder: 11728:11733 ioctl 4018620d 200000000040 returned -16 [ 571.024830][T11595] hsr_slave_0: entered promiscuous mode [ 571.043308][T11595] hsr_slave_1: entered promiscuous mode [ 571.070091][T11595] debugfs: 'hsr0' already exists in 'hsr' [ 571.083108][T11595] Cannot create hsr debugfs directory [ 573.001695][T11595] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 573.013942][T11755] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 573.021074][T11755] overlayfs: failed to set xattr on upper [ 573.028185][T11755] overlayfs: ...falling back to redirect_dir=nofollow. [ 573.035435][T11755] overlayfs: ...falling back to index=off. [ 573.041383][T11755] overlayfs: ...falling back to uuid=null. [ 573.047469][T11755] overlayfs: maximum fs stacking depth exceeded [ 573.317594][T11595] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 573.547444][T11595] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 573.735919][T11595] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 573.967887][ T30] audit: type=1400 audit(1762950063.899:799): avc: denied { bind } for pid=11758 comm="syz.4.1521" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 574.847151][T11595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 574.926444][T11595] 8021q: adding VLAN 0 to HW filter on device team0 [ 574.965443][ T6182] bridge0: port 1(bridge_slave_0) entered blocking state [ 574.972574][ T6182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 575.029447][ T6182] bridge0: port 2(bridge_slave_1) entered blocking state [ 575.036626][ T6182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 575.141201][T11595] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 575.192797][T11595] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 576.629159][T11782] block device autoloading is deprecated and will be removed. [ 576.711486][T11782] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1523'. [ 577.746661][T11595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 577.825053][T11802] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 577.832120][T11802] overlayfs: failed to set xattr on upper [ 577.838208][T11802] overlayfs: ...falling back to redirect_dir=nofollow. [ 577.853077][T11802] overlayfs: ...falling back to index=off. [ 577.858945][T11802] overlayfs: ...falling back to uuid=null. [ 577.865207][T11802] overlayfs: maximum fs stacking depth exceeded [ 578.908137][T11806] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 579.413475][T11817] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1528'. [ 579.429593][T11817] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1528'. [ 579.467323][T11817] veth1_to_hsr: entered promiscuous mode [ 579.473662][T11817] macvlan2: entered allmulticast mode [ 579.479060][T11817] veth1_to_hsr: entered allmulticast mode [ 579.818121][T11595] veth0_vlan: entered promiscuous mode [ 579.886402][T11595] veth1_vlan: entered promiscuous mode [ 580.281146][T11595] veth0_macvtap: entered promiscuous mode [ 580.351642][T11595] veth1_macvtap: entered promiscuous mode [ 581.300718][T11595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 581.665500][T11595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 581.848838][ T6182] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.129464][T11845] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1534'. [ 582.836594][ T6182] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 583.742996][ T6182] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 584.365030][ T6182] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 584.661898][T11856] orangefs_mount: mount request failed with -4 [ 584.710274][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 584.814409][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 585.024463][ T1152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 585.117459][T11871] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 585.124732][T11871] overlayfs: failed to set xattr on upper [ 585.130806][T11871] overlayfs: ...falling back to redirect_dir=nofollow. [ 585.137741][T11871] overlayfs: ...falling back to index=off. [ 585.143619][T11871] overlayfs: ...falling back to uuid=null. [ 585.149495][T11871] overlayfs: maximum fs stacking depth exceeded [ 586.136417][ T1152] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 588.756817][ T30] audit: type=1400 audit(1762950078.689:800): avc: denied { mount } for pid=11595 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 589.473699][T11891] FAULT_INJECTION: forcing a failure. [ 589.473699][T11891] name failslab, interval 1, probability 0, space 0, times 0 [ 589.491061][ T30] audit: type=1326 audit(1762950079.389:801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11885 comm="syz.4.1542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e84d8f6c9 code=0x7ffc0000 [ 589.522727][T11891] CPU: 1 UID: 0 PID: 11891 Comm: syz.4.1542 Not tainted syzkaller #0 PREEMPT(full) [ 589.522751][T11891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 589.522757][T11891] Call Trace: [ 589.522761][T11891] [ 589.522766][T11891] dump_stack_lvl+0x16c/0x1f0 [ 589.522786][T11891] should_fail_ex+0x512/0x640 [ 589.522799][T11891] ? kmem_cache_alloc_noprof+0x62/0x6e0 [ 589.522816][T11891] should_failslab+0xc2/0x120 [ 589.522828][T11891] kmem_cache_alloc_noprof+0x75/0x6e0 [ 589.522843][T11891] ? audit_log_start+0x29b/0x950 [ 589.522857][T11891] ? audit_log_start+0x29b/0x950 [ 589.522866][T11891] audit_log_start+0x29b/0x950 [ 589.522878][T11891] ? __pfx_audit_log_start+0x10/0x10 [ 589.522888][T11891] ? irqentry_exit+0x3b/0x90 [ 589.522898][T11891] ? lockdep_hardirqs_on+0x7c/0x110 [ 589.522908][T11891] ? preempt_schedule_thunk+0x16/0x30 [ 589.522930][T11891] ? preempt_schedule_common+0x44/0xc0 [ 589.522955][T11891] audit_seccomp+0x60/0x290 [ 589.522972][T11891] __seccomp_filter+0xa74/0x11c0 [ 589.522992][T11891] ? __pfx___seccomp_filter+0x10/0x10 [ 589.523013][T11891] ? fput+0x9b/0xd0 [ 589.523033][T11891] ? ksys_write+0x1ac/0x250 [ 589.523049][T11891] __secure_computing+0x287/0x3b0 [ 589.523065][T11891] syscall_trace_enter+0x89/0x240 [ 589.523084][T11891] do_syscall_64+0x3cd/0xfa0 [ 589.523101][T11891] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.523117][T11891] RIP: 0033:0x7f7e84d8f6c9 [ 589.523131][T11891] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 589.523146][T11891] RSP: 002b:00007f7e85b84038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 589.523167][T11891] RAX: ffffffffffffffda RBX: 00007f7e84fe6180 RCX: 00007f7e84d8f6c9 [ 589.523177][T11891] RDX: 0000000000000001 RSI: 0000200000003300 RDI: 0000000000000005 [ 589.523187][T11891] RBP: 00007f7e85b84090 R08: 0000000000007fff R09: 0000000000000000 [ 589.523196][T11891] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 589.523204][T11891] R13: 00007f7e84fe6218 R14: 00007f7e84fe6180 R15: 00007ffd131e88f8 [ 589.523225][T11891] [ 589.776618][ T30] audit: type=1326 audit(1762950079.389:802): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11885 comm="syz.4.1542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f7e84d8f6c9 code=0x7ffc0000 [ 589.800342][ T30] audit: type=1326 audit(1762950079.389:803): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11885 comm="syz.4.1542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e84d8f6c9 code=0x7ffc0000 [ 589.824321][ T30] audit: type=1326 audit(1762950079.389:804): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11885 comm="syz.4.1542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7e84d8f6c9 code=0x7ffc0000 [ 589.847869][ T30] audit: type=1326 audit(1762950079.389:805): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11885 comm="syz.4.1542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e84d8f6c9 code=0x7ffc0000 [ 589.894872][T11891] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 589.928124][T11891] audit: out of memory in audit_log_start [ 589.969550][T11897] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 589.979459][ T30] audit: type=1326 audit(1762950079.389:806): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11885 comm="syz.4.1542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7e84d8f6c9 code=0x7ffc0000 [ 590.873474][ T30] audit: type=1326 audit(1762950079.389:807): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11885 comm="syz.4.1542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e84d8f6c9 code=0x7ffc0000 [ 591.413389][T11909] binder: 11904:11909 ioctl 400c620e 200000000100 returned -22 [ 591.426558][T11909] binder: 11904:11909 ioctl 540f 200000000000 returned -22 [ 591.866027][T11909] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1545'. [ 592.081508][T11918] QAT: failed to copy from user cfg_data. [ 593.573330][ T5861] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 593.904632][ T5861] usb 7-1: config index 0 descriptor too short (expected 45, got 36) [ 593.935412][ T5861] usb 7-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 594.095558][ T5861] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 594.155229][ T5861] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 594.188096][ T5861] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 594.203483][ T48] usb 5-1: new full-speed USB device number 61 using dummy_hcd [ 594.264369][ T5861] usb 7-1: config 0 descriptor?? [ 594.385030][ T48] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 594.473226][ T48] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 594.493848][ T48] usb 5-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice=be.00 [ 594.508774][ T48] usb 5-1: New USB device strings: Mfr=10, Product=0, SerialNumber=0 [ 594.517294][ T48] usb 5-1: Manufacturer: syz [ 594.551631][ T48] usb 5-1: config 0 descriptor?? [ 595.113909][T11949] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input38 [ 595.367081][T11948] wireguard0: entered promiscuous mode [ 595.372675][T11948] wireguard0: entered allmulticast mode [ 595.440142][ T48] isku 0003:1E7D:319C.0018: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 595.932495][ T48] isku 0003:1E7D:319C.0018: couldn't init struct isku_device [ 595.956571][ T48] isku 0003:1E7D:319C.0018: couldn't install keyboard [ 595.989325][ T48] isku 0003:1E7D:319C.0018: probe with driver isku failed with error -32 [ 596.349918][ T48] usb 5-1: USB disconnect, device number 61 [ 596.462673][ T5861] usb 7-1: string descriptor 0 read error: -71 [ 596.512277][ T5861] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 596.544730][T11959] fido_id[11959]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 596.589199][ T5861] usb 7-1: USB disconnect, device number 2 [ 598.035770][T11986] orangefs_mount: mount request failed with -4 [ 598.764531][T12009] QAT: failed to copy from user cfg_data. [ 600.165529][T12027] xt_connbytes: Forcing CT accounting to be enabled [ 600.172446][T12027] Cannot find set identified by id 0 to match [ 601.028198][T12041] tipc: Enabling of bearer rejected, failed to enable media [ 601.743080][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 601.743096][ T30] audit: type=1400 audit(1762950091.669:825): avc: denied { read write } for pid=12039 comm="syz.0.1569" name="file0" dev="fuse" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 601.885329][ T30] audit: type=1400 audit(1762950091.669:826): avc: denied { open } for pid=12039 comm="syz.0.1569" path="/315/file0/file0" dev="fuse" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 604.167922][T12064] orangefs_mount: mount request failed with -4 [ 604.312209][T12068] QAT: failed to copy from user cfg_data. [ 604.491976][ T30] audit: type=1400 audit(1762950094.419:827): avc: denied { ioctl } for pid=12070 comm="syz.3.1576" path="socket:[35038]" dev="sockfs" ino=35038 ioctlcmd=0x89e7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 605.044542][T12073] can: request_module (can-proto-0) failed. [ 605.423474][T12084] netlink: 'syz.6.1579': attribute type 7 has an invalid length. [ 606.774195][T12095] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 606.780732][T12095] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 606.863510][T12095] vhci_hcd vhci_hcd.0: Device attached [ 607.023010][ T5936] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 607.230555][ T976] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 607.322987][ T5936] usb 4-1: Using ep0 maxpacket: 16 [ 607.340261][ T5936] usb 4-1: config 0 has no interfaces? [ 607.345824][ T5936] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 607.397611][ T5936] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.449051][ T5922] usb 3-1: new full-speed USB device number 42 using dummy_hcd [ 607.455337][ T5936] usb 4-1: config 0 descriptor?? [ 607.814100][T12096] usb 39-1: recv xbuf, 0 [ 607.844378][T12095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 607.943212][ T976] usb 39-1: device descriptor read/64, error -71 [ 607.980304][ T5922] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 608.075732][ T30] audit: type=1400 audit(1762950097.879:828): avc: denied { listen } for pid=12107 comm="syz.4.1585" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 608.136465][T12095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 608.145042][ T6409] vhci_hcd: stop threads [ 608.149281][ T6409] vhci_hcd: release socket [ 608.155560][T12108] bond2: option mode: invalid value (48) [ 608.161346][ T5922] usb 3-1: config 0 interface 0 has no altsetting 0 [ 608.180355][T12108] bond2 (unregistering): Released all slaves [ 608.188094][ T6409] vhci_hcd: disconnect device [ 608.203644][ T976] usb 39-1: new low-speed USB device number 3 using vhci_hcd [ 608.223597][ T5922] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 608.232991][ T976] usb 39-1: enqueue for inactive port 0 [ 608.266968][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 608.277818][ T5922] usb 3-1: Product: syz [ 608.317816][ T5922] usb 3-1: Manufacturer: syz [ 608.318380][ T976] vhci_hcd: vhci_device speed not set [ 608.323407][T12095] Invalid logical block size (1792) [ 608.353343][ T5922] usb 3-1: SerialNumber: syz [ 608.381184][ T5861] usb 4-1: USB disconnect, device number 54 [ 608.390539][ T5922] usb 3-1: config 0 descriptor?? [ 608.404581][ T5922] usb 3-1: selecting invalid altsetting 0 [ 608.607091][T12103] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 608.679343][T10635] usb 3-1: USB disconnect, device number 42 [ 608.884424][T12118] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1586'. [ 609.624037][ T30] audit: type=1326 audit(1762950099.549:829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12121 comm="syz.0.1587" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcdfaf8f6c9 code=0x7ffc0000 [ 610.035990][ T30] audit: type=1326 audit(1762950099.549:830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12121 comm="syz.0.1587" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcdfaf8f6c9 code=0x7ffc0000 [ 610.059761][ T30] audit: type=1326 audit(1762950099.549:831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12121 comm="syz.0.1587" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7fcdfaf8f6c9 code=0x7ffc0000 [ 610.083405][ T30] audit: type=1326 audit(1762950099.549:832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12121 comm="syz.0.1587" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcdfaf8f6c9 code=0x7ffc0000 [ 610.444553][T12125] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1588'. [ 610.838421][T12128] bridge0: port 3(team0) entered blocking state [ 610.844798][T12128] bridge0: port 3(team0) entered listening state [ 610.852149][T12128] bridge0: port 2(bridge_slave_1) entered blocking state [ 610.859258][T12128] bridge0: port 2(bridge_slave_1) entered listening state [ 610.866455][T12128] bridge0: port 1(bridge_slave_0) entered blocking state [ 610.873511][T12128] bridge0: port 1(bridge_slave_0) entered listening state [ 611.051931][ T30] audit: type=1326 audit(1762950099.549:833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12121 comm="syz.0.1587" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcdfaf8f6c9 code=0x7ffc0000 [ 611.076092][ T30] audit: type=1326 audit(1762950099.549:834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12121 comm="syz.0.1587" exe="/root/syz-executor" sig=0 arch=c000003e syscall=7 compat=0 ip=0x7fcdfaf8f6c9 code=0x7ffc0000 [ 611.105640][T12128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 611.173047][T10635] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 611.214544][ T976] lo speed is unknown, defaulting to 1000 [ 611.220375][ T976] syz1: Port: 1 Link ACTIVE [ 611.236336][ T30] audit: type=1326 audit(1762950099.579:835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12121 comm="syz.0.1587" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcdfaf8f6c9 code=0x7ffc0000 [ 611.264553][ T30] audit: type=1326 audit(1762950099.579:836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12121 comm="syz.0.1587" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcdfaf8f6c9 code=0x7ffc0000 [ 611.423457][ T30] audit: type=1326 audit(1762950099.579:837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12121 comm="syz.0.1587" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fcdfaf8f6c9 code=0x7ffc0000 [ 611.474647][T10635] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 611.506812][T10635] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 611.805626][T10635] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.829537][T10635] usb 5-1: config 0 descriptor?? [ 611.894500][T10635] pwc: Askey VC010 type 2 USB webcam detected. [ 612.478369][T10635] pwc: recv_control_msg error -32 req 02 val 2b00 [ 612.586399][T10635] pwc: recv_control_msg error -32 req 02 val 2700 [ 612.600111][T10635] pwc: recv_control_msg error -32 req 02 val 2c00 [ 612.848508][T10635] pwc: recv_control_msg error -71 req 04 val 1300 [ 612.860927][T10635] pwc: recv_control_msg error -71 req 04 val 1400 [ 612.869005][T10635] pwc: recv_control_msg error -71 req 02 val 2000 [ 612.875866][T10635] pwc: recv_control_msg error -71 req 02 val 2100 [ 612.882638][T10635] pwc: recv_control_msg error -71 req 04 val 1500 [ 612.889550][T10635] pwc: recv_control_msg error -71 req 02 val 2500 [ 612.896656][T10635] pwc: recv_control_msg error -71 req 02 val 2400 [ 612.905401][T10635] pwc: recv_control_msg error -71 req 02 val 2600 [ 612.912168][T10635] pwc: recv_control_msg error -71 req 02 val 2900 [ 612.919311][T10635] pwc: recv_control_msg error -71 req 02 val 2800 [ 612.926276][T10635] pwc: recv_control_msg error -71 req 04 val 1100 [ 612.940636][T10635] pwc: recv_control_msg error -71 req 04 val 1200 [ 612.989026][T10635] pwc: Registered as video103. [ 613.053751][T10635] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input39 [ 613.497160][T12154] wg2 speed is unknown, defaulting to 1000 [ 613.497807][T10635] usb 5-1: USB disconnect, device number 62 [ 613.682571][T12154] lo speed is unknown, defaulting to 1000 [ 614.297161][T12160] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1598'. [ 615.866083][T12172] FAULT_INJECTION: forcing a failure. [ 615.866083][T12172] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 615.903030][T12172] CPU: 0 UID: 0 PID: 12172 Comm: syz.0.1600 Not tainted syzkaller #0 PREEMPT(full) [ 615.903053][T12172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 615.903062][T12172] Call Trace: [ 615.903070][T12172] [ 615.903077][T12172] dump_stack_lvl+0x16c/0x1f0 [ 615.903106][T12172] should_fail_ex+0x512/0x640 [ 615.903129][T12172] copy_fpstate_to_sigframe+0x854/0xaf0 [ 615.903155][T12172] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 615.903182][T12172] ? collect_signal+0x263/0x540 [ 615.903195][T12172] ? x86_task_fpu+0x5f/0x90 [ 615.903217][T12172] get_sigframe+0x4a8/0x9c0 [ 615.903240][T12172] ? __pfx_get_sigframe+0x10/0x10 [ 615.903261][T12172] ? _raw_spin_unlock_irq+0x23/0x50 [ 615.903282][T12172] ? siginfo_layout+0x1d2/0x290 [ 615.903302][T12172] x64_setup_rt_frame+0x12e/0xcf0 [ 615.903327][T12172] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 615.903354][T12172] arch_do_signal_or_restart+0x5e4/0x7c0 [ 615.903375][T12172] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 615.903399][T12172] ? ksys_write+0x1ac/0x250 [ 615.903412][T12172] ? __pfx_ksys_write+0x10/0x10 [ 615.903431][T12172] exit_to_user_mode_loop+0x85/0x130 [ 615.903450][T12172] do_syscall_64+0x426/0xfa0 [ 615.903467][T12172] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 615.903483][T12172] RIP: 0033:0x7fcdfaf8f6c9 [ 615.903497][T12172] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 615.903512][T12172] RSP: 002b:00007fcdfbe6a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 615.903527][T12172] RAX: ffffffffffffffe0 RBX: 00007fcdfb1e5fa0 RCX: 00007fcdfaf8f6c9 [ 615.903537][T12172] RDX: 0000000000000001 RSI: 0000200000003c00 RDI: 0000000000000005 [ 615.903547][T12172] RBP: 00007fcdfbe6a090 R08: 0000000000000000 R09: 0000000000000000 [ 615.903556][T12172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 615.903564][T12172] R13: 00007fcdfb1e6038 R14: 00007fcdfb1e5fa0 R15: 00007ffdfaecdaf8 [ 615.903587][T12172] [ 616.284879][T12182] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1599'. [ 616.833593][T12177] loop6: detected capacity change from 0 to 524288000 [ 617.113504][ T5861] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 617.163209][T12184] loop6: detected capacity change from 524288000 to 524287951 [ 617.273499][ T5861] usb 4-1: Using ep0 maxpacket: 16 [ 617.299440][ T5861] usb 4-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 617.319228][ T5861] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 617.337970][ T5861] usb 4-1: Product: syz [ 617.351707][ T5861] usb 4-1: Manufacturer: syz [ 617.628867][ T5861] usb 4-1: SerialNumber: syz [ 617.668696][ T5861] usb 4-1: config 0 descriptor?? [ 617.923516][T12198] SELinux: ebitmap start bit (1048640) is beyond the end of the bitmap (1472) [ 617.995611][T12198] SELinux: failed to load policy [ 618.057928][T12195] input: syz1 as /devices/virtual/input/input40 [ 618.099850][ T5861] visor 4-1:0.0: Sony Clie 3.5 converter detected [ 618.541499][ T5861] usb 4-1: clie_3_5_startup: get config number failed: -32 [ 618.556966][ T5861] visor 4-1:0.0: probe with driver visor failed with error -32 [ 618.614327][ T5861] usb 4-1: USB disconnect, device number 55 [ 619.161132][T12208] QAT: failed to copy from user cfg_data. [ 620.886817][T12223] QAT: failed to copy from user cfg_data. [ 621.310481][ T976] page_pool_release_retry() stalled pool shutdown: id 44, 1 inflight 60 sec [ 623.738489][T12231] loop9: detected capacity change from 0 to 7 [ 623.747737][T12231] Dev loop9: unable to read RDB block 7 [ 623.763315][T12231] loop9: unable to read partition table [ 623.784418][T12231] loop9: partition table beyond EOD, truncated [ 623.823345][T12231] loop_reread_partitions: partition scan of loop9 (þ被xü—ŸÑà– ) failed (rc=-5) [ 623.833155][ T976] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 623.883649][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 623.890036][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.283641][ T976] usb 5-1: Using ep0 maxpacket: 32 [ 624.291608][ T976] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 624.299897][ T976] usb 5-1: config 0 has no interface number 0 [ 624.315663][ T976] usb 5-1: config 0 interface 12 has no altsetting 0 [ 624.344917][ T976] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 624.388297][ T976] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.416570][ T976] usb 5-1: Product: syz [ 624.430492][T12257] binder: BINDER_SET_CONTEXT_MGR already set [ 624.436643][T12257] binder: 12251:12257 ioctl 4018620d 200000000040 returned -16 [ 624.530056][ T976] usb 5-1: Manufacturer: syz [ 624.534412][T12256] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1622'. [ 624.669465][T12256] syz_tun: entered allmulticast mode [ 624.690823][T12256] dvmrp8: entered allmulticast mode [ 624.798592][ T976] usb 5-1: SerialNumber: syz [ 624.838588][ T976] usb 5-1: config 0 descriptor?? [ 625.083467][T12255] syz_tun: left allmulticast mode [ 625.143236][T12247] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 625.198696][T12247] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.547042][ T976] f81534 5-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 626.556413][ T976] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 626.566866][ T976] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 626.576626][ T976] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 626.645121][ T976] usb 5-1: USB disconnect, device number 63 [ 626.706065][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 626.706179][ T30] audit: type=1400 audit(1762950116.639:853): avc: denied { ioctl } for pid=12266 comm="syz.2.1624" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 ioctlcmd=0x5412 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 629.203222][T10635] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 629.383557][T10635] usb 5-1: Using ep0 maxpacket: 8 [ 629.485888][T10635] usb 5-1: config 0 has an invalid interface number: 178 but max is 0 [ 629.574947][T12286] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1629'. [ 630.096706][T10635] usb 5-1: config 0 has no interface number 0 [ 630.350653][T10635] usb 5-1: config 0 interface 178 has no altsetting 0 [ 630.375365][T10635] usb 5-1: New USB device found, idVendor=0499, idProduct=49ee, bcdDevice=d3.b5 [ 630.386239][T10635] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.418398][T10635] usb 5-1: Product: syz [ 630.422866][T10635] usb 5-1: Manufacturer: syz [ 630.433036][T10635] usb 5-1: SerialNumber: syz [ 630.453292][T10635] usb 5-1: config 0 descriptor?? [ 630.666752][ T30] audit: type=1400 audit(1762950120.600:854): avc: denied { setopt } for pid=12275 comm="syz.4.1628" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 630.869727][T10635] usb 5-1: USB disconnect, device number 64 [ 630.950342][T12302] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1633'. [ 631.015986][T12302] lo speed is unknown, defaulting to 1000 [ 631.042674][T11616] udevd[11616]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.178/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 631.129115][T12302] lo speed is unknown, defaulting to 1000 [ 631.176280][T12310] QAT: failed to copy from user cfg_data. [ 631.278889][T12302] lo speed is unknown, defaulting to 1000 [ 631.621526][T12302] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 632.219821][T12302] lo speed is unknown, defaulting to 1000 [ 632.294318][T12302] lo speed is unknown, defaulting to 1000 [ 632.302606][T12302] lo speed is unknown, defaulting to 1000 [ 632.309961][T12302] lo speed is unknown, defaulting to 1000 [ 632.317268][T12302] lo speed is unknown, defaulting to 1000 [ 632.324680][T12302] lo speed is unknown, defaulting to 1000 [ 633.304100][T10635] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 633.548755][T12335] QAT: Invalid ioctl 1076910120 [ 633.933007][T10635] usb 5-1: Using ep0 maxpacket: 16 [ 633.939985][T10635] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 633.984664][T10635] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 633.995663][T10635] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 634.010271][T10635] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 634.022452][T10635] usb 5-1: config 0 descriptor?? [ 635.266171][T12339] can0: slcan on ptm0. [ 635.843291][T12357] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1644'. [ 636.011684][T12360] netlink: 'syz.6.1645': attribute type 10 has an invalid length. [ 636.032162][T12360] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1645'. [ 637.261778][T12373] No control pipe specified [ 637.767134][T10635] usb 3-1: new full-speed USB device number 43 using dummy_hcd [ 637.913921][T12338] can0 (unregistered): slcan off ptm0. [ 638.011131][ T5940] usb 5-1: USB disconnect, device number 65 [ 638.343166][ T10] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 638.437391][T10635] usb 3-1: config 0 has an invalid interface number: 20 but max is 0 [ 638.512955][T10635] usb 3-1: config 0 has no interface number 0 [ 638.559473][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 638.577201][T10635] usb 3-1: config 0 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 638.593025][ T10] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 638.602138][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 638.615411][T10635] usb 3-1: config 0 interface 20 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 638.653572][T10635] usb 3-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 638.673138][T10635] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.694679][ T10] usb 4-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5 [ 638.732944][T10635] usb 3-1: Product: syz [ 638.819662][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.829030][T10635] usb 3-1: Manufacturer: syz [ 638.920559][T10635] usb 3-1: SerialNumber: syz [ 638.936384][ T10] usb 4-1: Product: syz [ 639.283408][ T10] usb 4-1: Manufacturer: syz [ 639.288032][ T10] usb 4-1: SerialNumber: syz [ 639.297137][T10635] usb 3-1: config 0 descriptor?? [ 639.306757][T12373] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 639.333758][ T10] usb 4-1: config 0 descriptor?? [ 639.461622][T10635] usb-storage 3-1:0.20: USB Mass Storage device detected [ 639.725067][ T10] uvcvideo 4-1:0.0: probe with driver uvcvideo failed with error -22 [ 639.744420][T12373] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 639.787486][T12373] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 639.787785][T10635] usb-storage 3-1:0.20: Quirks match for vid 04e6 pid 000b: 4 [ 639.855055][T10635] scsi host1: usb-storage 3-1:0.20 [ 639.899873][T10635] usb 3-1: USB disconnect, device number 43 [ 639.982697][ T10] usb 4-1: USB disconnect, device number 56 [ 641.094921][ T30] audit: type=1400 audit(1762950131.020:855): avc: denied { read } for pid=12423 comm="syz.3.1657" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 641.154673][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 641.163109][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 641.170331][ C0] bridge0: port 3(team0) entered learning state [ 641.533051][ T10] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 641.619566][ T30] audit: type=1400 audit(1762950131.550:856): avc: denied { read } for pid=12431 comm="syz.4.1660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 641.850826][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 641.914936][ T10] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 641.953567][ T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 641.976088][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 642.019738][ T10] usb 4-1: Product: syz [ 642.037180][ T10] usb 4-1: Manufacturer: syz [ 642.060577][ T10] usb 4-1: SerialNumber: syz [ 642.930796][ T10] cdc_ncm 4-1:1.0: skipping garbage [ 642.965091][ T10] cdc_ncm 4-1:1.0: NCM or ECM functional descriptors missing [ 642.986056][ T10] cdc_ncm 4-1:1.0: bind() failure [ 643.005007][ T10] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 643.011895][ T10] cdc_ncm 4-1:1.1: bind() failure [ 644.151355][ T10] usb 4-1: USB disconnect, device number 57 [ 644.543637][T12468] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1669'. [ 644.623812][T12468] tmpfs: Unknown parameter 'nr_b' [ 645.063033][ T5922] usb 3-1: new full-speed USB device number 44 using dummy_hcd [ 645.343215][ T5940] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 645.445227][ T5922] usb 3-1: config 0 interface 0 altsetting 252 endpoint 0x81 has invalid wMaxPacketSize 0 [ 645.470221][ T5922] usb 3-1: config 0 interface 0 has no altsetting 0 [ 645.479935][ T5922] usb 3-1: New USB device found, idVendor=11ff, idProduct=3331, bcdDevice= 0.00 [ 645.503185][ T5922] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.562249][ T5922] usb 3-1: config 0 descriptor?? [ 645.603022][ T5940] usb 4-1: Using ep0 maxpacket: 32 [ 645.862058][ T5940] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 645.909730][ T5940] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 645.933422][ T5940] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 646.583848][ T5940] usb 4-1: Product: syz [ 646.588320][ T5940] usb 4-1: Manufacturer: syz [ 646.593540][ T5940] usb 4-1: SerialNumber: syz [ 646.601401][ T5940] usb 4-1: config 0 descriptor?? [ 646.942082][ T5922] gembird 0003:11FF:3331.0019: item fetching failed at offset 6/7 [ 647.001291][ T5922] gembird 0003:11FF:3331.0019: probe with driver gembird failed with error -22 [ 647.158710][ T10] usb 4-1: USB disconnect, device number 58 [ 647.600805][ T30] audit: type=1400 audit(1762950137.530:857): avc: denied { write } for pid=12471 comm="syz.3.1670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 647.661667][ T30] audit: type=1400 audit(1762950137.570:858): avc: denied { setopt } for pid=12471 comm="syz.3.1670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 648.960226][ T48] usb 3-1: USB disconnect, device number 44 [ 650.405001][T12511] cgroup2: Unknown parameter 'fd' [ 651.630791][T12522] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 651.637833][ T30] audit: type=1400 audit(1762950141.560:859): avc: denied { shutdown } for pid=12519 comm="syz.6.1682" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 651.707790][ T30] audit: type=1400 audit(1762950141.560:860): avc: denied { setopt } for pid=12519 comm="syz.6.1682" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 652.058405][T12530] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 654.980405][T12549] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input41 [ 655.462222][T12547] wireguard2: entered promiscuous mode [ 655.470754][T12547] wireguard2: entered allmulticast mode [ 655.752366][ T30] audit: type=1400 audit(1762950145.680:861): avc: denied { read } for pid=12553 comm="syz.4.1689" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 656.131552][ T976] libceph: connect (1)[c::]:6789 error -101 [ 656.140615][ T976] libceph: mon0 (1)[c::]:6789 connect error [ 656.404739][ T976] libceph: connect (1)[c::]:6789 error -101 [ 656.496211][ T976] libceph: mon0 (1)[c::]:6789 connect error [ 656.624377][ T30] audit: type=1400 audit(1762950146.520:862): avc: denied { bind } for pid=12566 comm="syz.0.1693" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 656.960837][T12558] ceph: No mds server is up or the cluster is laggy [ 656.973201][ T30] audit: type=1400 audit(1762950146.550:863): avc: granted { setsecparam } for pid=12566 comm="syz.0.1693" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 657.008063][ T976] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 657.163625][ T5936] libceph: connect (1)[c::]:6789 error -101 [ 657.188242][ T5936] libceph: mon0 (1)[c::]:6789 connect error [ 657.293045][ T976] usb 4-1: Using ep0 maxpacket: 32 [ 657.314408][ T976] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 657.322533][ T976] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 657.734308][ T976] usb 4-1: config 0 has no interface number 0 [ 657.787515][ T976] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 657.802957][ T976] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.831248][ T976] usb 4-1: Product: syz [ 657.836356][ T976] usb 4-1: Manufacturer: syz [ 657.840954][ T976] usb 4-1: SerialNumber: syz [ 658.016155][ T976] usb 4-1: config 0 descriptor?? [ 658.043701][ T976] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 658.396796][T12585] input: syz1 as /devices/virtual/input/input42 [ 658.680838][T12584] SELinux: failed to load policy [ 659.656336][T12592] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1691'. [ 661.305636][ T976] usb 4-1: qt2_attach - failed to power on unit: -71 [ 661.390512][ T976] quatech2 4-1:0.51: probe with driver quatech2 failed with error -71 [ 661.430541][T12610] program syz.2.1702 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 661.473980][ T976] usb 4-1: USB disconnect, device number 59 [ 661.751279][T12616] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 661.758393][T12616] overlayfs: failed to set xattr on upper [ 661.764188][T12616] overlayfs: ...falling back to redirect_dir=nofollow. [ 661.771037][T12616] overlayfs: ...falling back to index=off. [ 661.776911][T12616] overlayfs: ...falling back to uuid=null. [ 661.782782][T12616] overlayfs: maximum fs stacking depth exceeded [ 663.343959][T12629] FAULT_INJECTION: forcing a failure. [ 663.343959][T12629] name failslab, interval 1, probability 0, space 0, times 0 [ 663.356692][T12629] CPU: 1 UID: 0 PID: 12629 Comm: syz.0.1707 Not tainted syzkaller #0 PREEMPT(full) [ 663.356707][T12629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 663.356713][T12629] Call Trace: [ 663.356717][T12629] [ 663.356720][T12629] dump_stack_lvl+0x16c/0x1f0 [ 663.356741][T12629] should_fail_ex+0x512/0x640 [ 663.356753][T12629] ? fs_reclaim_acquire+0xae/0x150 [ 663.356767][T12629] should_failslab+0xc2/0x120 [ 663.356779][T12629] __kmalloc_noprof+0xdd/0x880 [ 663.356794][T12629] ? tomoyo_encode2+0x100/0x3e0 [ 663.356808][T12629] ? tomoyo_encode2+0x100/0x3e0 [ 663.356818][T12629] tomoyo_encode2+0x100/0x3e0 [ 663.356831][T12629] tomoyo_encode+0x29/0x50 [ 663.356842][T12629] tomoyo_realpath_from_path+0x18f/0x6e0 [ 663.356858][T12629] tomoyo_mount_acl+0x664/0x850 [ 663.356868][T12629] ? bpf_ksym_find+0x127/0x1c0 [ 663.356886][T12629] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 663.356896][T12629] ? unwind_get_return_address+0x59/0xa0 [ 663.356923][T12629] ? tomoyo_domain+0xbb/0x150 [ 663.356936][T12629] ? tomoyo_profile+0x47/0x60 [ 663.356950][T12629] tomoyo_mount_permission+0x16d/0x420 [ 663.356960][T12629] ? tomoyo_mount_permission+0x14f/0x420 [ 663.356971][T12629] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 663.356990][T12629] security_sb_mount+0x9b/0x260 [ 663.357002][T12629] path_mount+0x158/0x23a0 [ 663.357016][T12629] ? __pfx_path_mount+0x10/0x10 [ 663.357029][T12629] ? kmem_cache_free+0x2d4/0x6c0 [ 663.357037][T12629] ? putname+0x154/0x1a0 [ 663.357051][T12629] ? putname+0x154/0x1a0 [ 663.357062][T12629] ? putname+0x154/0x1a0 [ 663.357075][T12629] ? __x64_sys_mount+0x293/0x310 [ 663.357086][T12629] __x64_sys_mount+0x293/0x310 [ 663.357098][T12629] ? __pfx___x64_sys_mount+0x10/0x10 [ 663.357114][T12629] do_syscall_64+0xcd/0xfa0 [ 663.357125][T12629] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 663.357135][T12629] RIP: 0033:0x7fcdfaf8f6c9 [ 663.357144][T12629] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 663.357154][T12629] RSP: 002b:00007fcdfbe6a038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 663.357164][T12629] RAX: ffffffffffffffda RBX: 00007fcdfb1e5fa0 RCX: 00007fcdfaf8f6c9 [ 663.357171][T12629] RDX: 00002000000002c0 RSI: 00002000000000c0 RDI: 0000200000000040 [ 663.357177][T12629] RBP: 00007fcdfbe6a090 R08: 0000000000000000 R09: 0000000000000000 [ 663.357182][T12629] R10: 0000000000000400 R11: 0000000000000246 R12: 0000000000000002 [ 663.357188][T12629] R13: 00007fcdfb1e6038 R14: 00007fcdfb1e5fa0 R15: 00007ffdfaecdaf8 [ 663.357202][T12629] [ 663.357212][T12629] ERROR: Out of memory at tomoyo_realpath_from_path. [ 663.412997][ T976] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 664.793080][ T976] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 664.955269][ T976] usb 4-1: New USB device found, idVendor=1477, idProduct=1006, bcdDevice= 0.00 [ 665.227981][ T976] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 665.265089][ T976] usb 4-1: config 0 descriptor?? [ 665.490035][T12625] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 665.631428][T12625] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 665.751510][T12625] program syz.3.1706 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 665.875488][T12654] program syz.3.1706 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 665.914598][T12654] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 665.975312][ T30] audit: type=1400 audit(1762950155.896:864): avc: denied { append } for pid=12624 comm="syz.3.1706" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 666.000001][ C0] vkms_vblank_simulate: vblank timer overrun [ 666.063518][ T30] audit: type=1400 audit(1762950155.956:865): avc: denied { setopt } for pid=12656 comm="syz.2.1716" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 666.470279][ T976] usbhid 4-1:0.0: can't add hid device: -71 [ 666.557830][ T976] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 666.583359][ T976] usb 4-1: USB disconnect, device number 60 [ 666.708018][ T30] audit: type=1400 audit(1762950156.636:866): avc: denied { read write } for pid=5819 comm="syz-executor" name="loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 666.732069][ C0] vkms_vblank_simulate: vblank timer overrun [ 666.796570][ T30] audit: type=1400 audit(1762950156.676:867): avc: denied { open } for pid=5819 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 666.963156][ T30] audit: type=1400 audit(1762950156.676:868): avc: denied { ioctl } for pid=5819 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 666.990965][T12673] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input43 [ 667.040489][T12670] wireguard3: entered promiscuous mode [ 667.046619][T12670] wireguard3: entered allmulticast mode [ 667.263148][ T30] audit: type=1400 audit(1762950156.716:869): avc: denied { map_create } for pid=12660 comm="syz.2.1718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 667.862352][T12684] xt_l2tp: v2 doesn't support IP mode [ 667.870195][ T30] audit: type=1400 audit(1762950156.716:870): avc: denied { bpf } for pid=12660 comm="syz.2.1718" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 668.463013][ T30] audit: type=1400 audit(1762950156.716:871): avc: denied { map_read } for pid=12660 comm="syz.2.1718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 668.493529][ T30] audit: type=1400 audit(1762950156.716:872): avc: denied { prog_load } for pid=12660 comm="syz.2.1718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 668.513325][ T30] audit: type=1400 audit(1762950156.716:873): avc: denied { perfmon } for pid=12660 comm="syz.2.1718" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 669.317749][T12695] loop6: detected capacity change from 0 to 524288000 [ 671.008520][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 671.008536][ T30] audit: type=1400 audit(1762950160.936:931): avc: denied { connect } for pid=12707 comm="syz.4.1729" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 671.106150][ T30] audit: type=1400 audit(1762950161.026:932): avc: denied { write } for pid=12707 comm="syz.4.1729" path="socket:[37255]" dev="sockfs" ino=37255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 671.222992][ C0] bridge0: port 3(team0) entered forwarding state [ 671.229470][ C0] bridge0: topology change detected, propagating [ 671.238432][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 671.245803][ C0] bridge0: topology change detected, propagating [ 671.253068][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 671.260441][ C0] bridge0: topology change detected, propagating [ 671.423056][ T30] audit: type=1400 audit(1762950161.346:933): avc: denied { bind } for pid=12707 comm="syz.4.1729" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 671.555325][ T30] audit: type=1400 audit(1762950161.346:934): avc: denied { name_bind } for pid=12707 comm="syz.4.1729" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 671.636114][ T30] audit: type=1400 audit(1762950161.346:935): avc: denied { node_bind } for pid=12707 comm="syz.4.1729" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 671.720559][ T30] audit: type=1400 audit(1762950161.646:936): avc: denied { setopt } for pid=12713 comm="syz.3.1730" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 671.950644][ T30] audit: type=1400 audit(1762950161.876:937): avc: denied { write } for pid=12715 comm="syz.3.1731" path="/dev/vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 672.062969][ T30] audit: type=1400 audit(1762950161.876:938): avc: denied { create } for pid=12715 comm="syz.3.1731" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 672.205649][ T30] audit: type=1400 audit(1762950161.876:939): avc: denied { setopt } for pid=12715 comm="syz.3.1731" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 672.264980][ T30] audit: type=1400 audit(1762950162.016:940): avc: denied { ioctl } for pid=12715 comm="syz.3.1731" path="socket:[38380]" dev="sockfs" ino=38380 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 674.180948][T12736] binder: 12734:12736 ioctl 4018620d 0 returned -22 [ 674.479107][T12741] netlink: 21944 bytes leftover after parsing attributes in process `syz.4.1736'. [ 674.602156][T12743] FAULT_INJECTION: forcing a failure. [ 674.602156][T12743] name failslab, interval 1, probability 0, space 0, times 0 [ 674.729853][T12747] wg2 speed is unknown, defaulting to 1000 [ 674.879341][T12743] CPU: 1 UID: 0 PID: 12743 Comm: syz.6.1738 Not tainted syzkaller #0 PREEMPT(full) [ 674.879365][T12743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 674.879374][T12743] Call Trace: [ 674.879379][T12743] [ 674.879386][T12743] dump_stack_lvl+0x16c/0x1f0 [ 674.879415][T12743] should_fail_ex+0x512/0x640 [ 674.879438][T12743] should_failslab+0xc2/0x120 [ 674.879457][T12743] __kmalloc_noprof+0xdd/0x880 [ 674.879481][T12743] ? tomoyo_encode2+0x100/0x3e0 [ 674.879504][T12743] ? tomoyo_encode2+0x100/0x3e0 [ 674.879521][T12743] tomoyo_encode2+0x100/0x3e0 [ 674.879542][T12743] tomoyo_encode+0x29/0x50 [ 674.879567][T12743] tomoyo_realpath_from_path+0x18f/0x6e0 [ 674.879593][T12743] tomoyo_path_number_perm+0x245/0x580 [ 674.879607][T12743] ? tomoyo_path_number_perm+0x237/0x580 [ 674.879625][T12743] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 674.879665][T12743] ? find_held_lock+0x2b/0x80 [ 674.879685][T12743] ? hook_file_ioctl_common+0x145/0x410 [ 674.879712][T12743] ? __fget_files+0x20e/0x3c0 [ 674.879727][T12743] ? fdget+0x70/0x210 [ 674.879745][T12743] security_file_ioctl+0x9b/0x240 [ 674.879765][T12743] __x64_sys_ioctl+0xb7/0x210 [ 674.879790][T12743] do_syscall_64+0xcd/0xfa0 [ 674.879806][T12743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.879822][T12743] RIP: 0033:0x7fe38898f6c9 [ 674.879835][T12743] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 674.879850][T12743] RSP: 002b:00007fe3898ec038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 674.879865][T12743] RAX: ffffffffffffffda RBX: 00007fe388be5fa0 RCX: 00007fe38898f6c9 [ 674.879876][T12743] RDX: 0000200000000040 RSI: 00000000c0845657 RDI: 0000000000000003 [ 674.879885][T12743] RBP: 00007fe3898ec090 R08: 0000000000000000 R09: 0000000000000000 [ 674.879894][T12743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 674.879903][T12743] R13: 00007fe388be6038 R14: 00007fe388be5fa0 R15: 00007ffeaae6af58 [ 674.879927][T12743] [ 674.880993][T12743] ERROR: Out of memory at tomoyo_realpath_from_path. [ 675.258494][T12753] binder: BINDER_SET_CONTEXT_MGR already set [ 675.278966][T12753] binder: 12751:12753 ioctl 4018620d 200000000040 returned -16 [ 676.209755][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 676.209771][ T30] audit: type=1400 audit(1762950166.136:971): avc: denied { mounton } for pid=12754 comm="syz.6.1741" path="/bus" dev="hugetlbfs" ino=38464 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=dir permissive=1 [ 676.294625][T12765] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 676.301810][T12765] overlayfs: failed to set xattr on upper [ 676.307893][T12765] overlayfs: ...falling back to redirect_dir=nofollow. [ 676.315161][T12765] overlayfs: ...falling back to index=off. [ 676.321095][T12765] overlayfs: ...falling back to uuid=null. [ 676.416969][T12765] overlayfs: maximum fs stacking depth exceeded [ 677.741234][T12779] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 677.824770][T12747] lo speed is unknown, defaulting to 1000 [ 677.832312][ T30] audit: type=1400 audit(1762950167.756:972): avc: denied { create } for pid=12781 comm="syz.6.1748" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 677.982980][ T976] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 678.214405][T12747] lo speed is unknown, defaulting to 1000 [ 678.239048][ T30] audit: type=1400 audit(1762950167.756:973): avc: denied { connect } for pid=12781 comm="syz.6.1748" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 678.294933][ T30] audit: type=1400 audit(1762950167.756:974): avc: denied { ioctl } for pid=12781 comm="syz.6.1748" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 678.413517][ T976] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 678.592973][ T976] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 678.684114][ T976] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 678.713010][ T976] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 678.722951][ T30] audit: type=1400 audit(1762950168.646:975): avc: denied { create } for pid=12791 comm="syz.0.1752" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 678.742732][ T976] usb 4-1: Product: syz [ 678.747089][ T976] usb 4-1: Manufacturer: syz [ 678.751724][ T976] usb 4-1: SerialNumber: syz [ 678.813832][T12788] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 678.814587][ T976] cdc_ncm 4-1:1.0: skipping garbage [ 678.976871][ T30] audit: type=1400 audit(1762950168.836:976): avc: denied { create } for pid=12791 comm="syz.0.1752" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 679.003375][ T5861] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 679.041871][ T976] cdc_ncm 4-1:1.0: NCM or ECM functional descriptors missing [ 679.207710][ T976] cdc_ncm 4-1:1.0: bind() failure [ 679.211077][ T5861] usb 7-1: config index 0 descriptor too short (expected 292, got 36) [ 679.231867][ T5861] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 208, using maximum allowed: 30 [ 679.243879][ T30] audit: type=1400 audit(1762950169.176:977): avc: denied { ioctl } for pid=12796 comm="syz.2.1753" path="socket:[37492]" dev="sockfs" ino=37492 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 679.256561][ T976] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 679.270259][ T5861] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 679.288159][ T5861] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 679.299893][ T5861] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 208 [ 679.314055][ T5861] usb 7-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 679.341739][ T5861] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 679.381366][ T976] cdc_ncm 4-1:1.1: bind() failure [ 679.498747][ T30] audit: type=1400 audit(1762950169.416:978): avc: denied { create } for pid=12801 comm="syz.0.1754" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 679.548432][ T976] usb 4-1: USB disconnect, device number 61 [ 679.575470][T12806] binder: BINDER_SET_CONTEXT_MGR already set [ 679.581462][T12806] binder: 12803:12806 ioctl 4018620d 200000000040 returned -16 [ 679.617891][ T5861] usb 7-1: config 0 descriptor?? [ 679.849865][ T30] audit: type=1400 audit(1762950169.776:979): avc: denied { create } for pid=12789 comm="syz.6.1751" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 680.198867][ T30] audit: type=1400 audit(1762950169.776:980): avc: denied { ioctl } for pid=12789 comm="syz.6.1751" path="socket:[37504]" dev="sockfs" ino=37504 ioctlcmd=0x89ef scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 681.227496][T12831] x_tables: ip_tables: osf match: only valid for protocol 6 [ 681.305826][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 681.305859][ T30] audit: type=1400 audit(1762950171.166:986): avc: denied { append } for pid=12825 comm="syz.4.1760" name="comedi0" dev="devtmpfs" ino=1276 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.851186][ T5861] usb 7-1: USB disconnect, device number 3 [ 681.923922][ T30] audit: type=1400 audit(1762950171.846:987): avc: denied { read } for pid=12822 comm="syz.0.1759" name="vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 682.202691][ T30] audit: type=1400 audit(1762950171.846:988): avc: denied { open } for pid=12822 comm="syz.0.1759" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 682.619675][ T30] audit: type=1400 audit(1762950171.846:989): avc: denied { ioctl } for pid=12822 comm="syz.0.1759" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 682.829907][ T30] audit: type=1400 audit(1762950172.756:990): avc: denied { read write } for pid=12844 comm="syz.2.1763" name="event0" dev="devtmpfs" ino=918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 683.463059][ T30] audit: type=1400 audit(1762950172.756:991): avc: denied { open } for pid=12844 comm="syz.2.1763" path="/dev/input/event0" dev="devtmpfs" ino=918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 683.604666][ T30] audit: type=1400 audit(1762950172.986:992): avc: denied { create } for pid=12844 comm="syz.2.1763" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 683.919453][T12852] xt_hashlimit: max too large, truncated to 1048576 [ 683.926700][T12852] xt_limit: Overflow, try lower: 0/0 [ 684.025774][ T976] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 684.191860][ T30] audit: type=1400 audit(1762950174.066:993): avc: denied { bind } for pid=12851 comm="syz.2.1765" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 684.528279][ T30] audit: type=1400 audit(1762950174.066:994): avc: denied { name_bind } for pid=12851 comm="syz.2.1765" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 684.554161][ T30] audit: type=1400 audit(1762950174.076:995): avc: denied { node_bind } for pid=12851 comm="syz.2.1765" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 684.594491][T12861] Failed to get privilege flags for destination (handle=0x2:0x25) [ 684.636784][ T6182] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.642962][ T976] usb 5-1: Using ep0 maxpacket: 32 [ 684.658724][ T976] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 684.675691][ T6182] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.687006][ T976] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 684.701502][ T6182] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.829238][ T6182] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.838483][ T976] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 684.838510][ T976] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 684.846736][ T976] usb 5-1: config 0 descriptor?? [ 684.955519][T12866] binder: BINDER_SET_CONTEXT_MGR already set [ 684.961524][T12866] binder: 12863:12866 ioctl 4018620d 200000000040 returned -16 [ 685.302775][ T976] hid_parser_main: 5 callbacks suppressed [ 685.302786][ T976] ft260 0003:0403:6030.001A: unknown main item tag 0x7 [ 685.314543][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.327776][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.501724][ T976] ft260 0003:0403:6030.001A: failed to retrieve chip version [ 685.514109][ T976] ft260 0003:0403:6030.001A: probe with driver ft260 failed with error -5 [ 685.742552][ T48] usb 5-1: USB disconnect, device number 66 [ 686.507894][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 686.507908][ T30] audit: type=1400 audit(1762950176.436:1007): avc: denied { open } for pid=12878 comm="syz.4.1773" path="/dev/ptyqd" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 686.545241][T12881] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1774'. [ 687.110428][ T30] audit: type=1400 audit(1762950177.036:1008): avc: denied { getopt } for pid=12885 comm="syz.6.1775" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 687.454159][T12890] FAULT_INJECTION: forcing a failure. [ 687.454159][T12890] name failslab, interval 1, probability 0, space 0, times 0 [ 687.487043][T12890] CPU: 1 UID: 0 PID: 12890 Comm: syz.6.1776 Not tainted syzkaller #0 PREEMPT(full) [ 687.487066][T12890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 687.487075][T12890] Call Trace: [ 687.487080][T12890] [ 687.487087][T12890] dump_stack_lvl+0x16c/0x1f0 [ 687.487116][T12890] should_fail_ex+0x512/0x640 [ 687.487134][T12890] ? kmem_cache_alloc_node_noprof+0x65/0x770 [ 687.487167][T12890] should_failslab+0xc2/0x120 [ 687.487185][T12890] kmem_cache_alloc_node_noprof+0x78/0x770 [ 687.487207][T12890] ? __alloc_skb+0x2b2/0x380 [ 687.487231][T12890] ? __alloc_skb+0x2b2/0x380 [ 687.487246][T12890] __alloc_skb+0x2b2/0x380 [ 687.487264][T12890] ? __pfx___alloc_skb+0x10/0x10 [ 687.487286][T12890] ? if_nlmsg_size+0x475/0xaf0 [ 687.487311][T12890] rtmsg_ifinfo_build_skb+0x81/0x280 [ 687.487339][T12890] rtmsg_ifinfo+0x9f/0x1a0 [ 687.487366][T12890] netif_state_change+0x17f/0x3b0 [ 687.487380][T12890] ? __pfx_netif_state_change+0x10/0x10 [ 687.487403][T12890] netdev_state_change+0xaa/0x240 [ 687.487427][T12890] xfrmi_changelink+0x264/0x3c0 [ 687.487448][T12890] ? __pfx_xfrmi_changelink+0x10/0x10 [ 687.487466][T12890] ? full_name_hash+0xbc/0x110 [ 687.487488][T12890] ? netdev_name_node_lookup+0x127/0x180 [ 687.487505][T12890] ? __pfx_xfrmi_changelink+0x10/0x10 [ 687.487528][T12890] rtnl_newlink+0x129e/0x2000 [ 687.487557][T12890] ? __pfx_rtnl_newlink+0x10/0x10 [ 687.487576][T12890] ? find_held_lock+0x2b/0x80 [ 687.487597][T12890] ? avc_has_perm_noaudit+0x117/0x3b0 [ 687.487623][T12890] ? avc_has_perm_noaudit+0x149/0x3b0 [ 687.487667][T12890] ? __pfx_rtnl_newlink+0x10/0x10 [ 687.487687][T12890] ? __pfx_rtnl_newlink+0x10/0x10 [ 687.487706][T12890] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 687.487728][T12890] ? __pfx_rtnl_newlink+0x10/0x10 [ 687.487750][T12890] rtnetlink_rcv_msg+0x95e/0xe90 [ 687.487773][T12890] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 687.487802][T12890] ? ref_tracker_free+0x37c/0x830 [ 687.487825][T12890] netlink_rcv_skb+0x158/0x420 [ 687.487847][T12890] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 687.487870][T12890] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 687.487902][T12890] ? netlink_deliver_tap+0x1ae/0xd30 [ 687.487928][T12890] netlink_unicast+0x5aa/0x870 [ 687.487954][T12890] ? __pfx_netlink_unicast+0x10/0x10 [ 687.487985][T12890] netlink_sendmsg+0x8c8/0xdd0 [ 687.488011][T12890] ? __pfx_netlink_sendmsg+0x10/0x10 [ 687.488044][T12890] ____sys_sendmsg+0xa98/0xc70 [ 687.488062][T12890] ? copy_msghdr_from_user+0x10a/0x160 [ 687.488084][T12890] ? __pfx_____sys_sendmsg+0x10/0x10 [ 687.488117][T12890] ___sys_sendmsg+0x134/0x1d0 [ 687.488147][T12890] ? __pfx____sys_sendmsg+0x10/0x10 [ 687.488168][T12890] ? __lock_acquire+0x622/0x1c90 [ 687.488210][T12890] __sys_sendmsg+0x16d/0x220 [ 687.488228][T12890] ? __pfx___sys_sendmsg+0x10/0x10 [ 687.488245][T12890] ? __pfx_bpf_trace_run2+0x10/0x10 [ 687.488268][T12890] ? syscall_trace_enter+0x1cb/0x240 [ 687.488285][T12890] ? rcu_is_watching+0x12/0xc0 [ 687.488305][T12890] do_syscall_64+0xcd/0xfa0 [ 687.488320][T12890] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 687.488333][T12890] RIP: 0033:0x7fe38898f6c9 [ 687.488345][T12890] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 687.488358][T12890] RSP: 002b:00007fe3898ec038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 687.488372][T12890] RAX: ffffffffffffffda RBX: 00007fe388be5fa0 RCX: 00007fe38898f6c9 [ 687.488381][T12890] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 687.488389][T12890] RBP: 00007fe3898ec090 R08: 0000000000000000 R09: 0000000000000000 [ 687.488398][T12890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 687.488405][T12890] R13: 00007fe388be6038 R14: 00007fe388be5fa0 R15: 00007ffeaae6af58 [ 687.488426][T12890] [ 687.933686][ T30] audit: type=1400 audit(1762950177.866:1009): avc: denied { create } for pid=12895 comm="syz.2.1779" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 687.959497][ T30] audit: type=1400 audit(1762950177.886:1010): avc: denied { connect } for pid=12895 comm="syz.2.1779" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 687.983811][ T30] audit: type=1400 audit(1762950177.916:1011): avc: denied { map } for pid=12895 comm="syz.2.1779" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=38791 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 688.008412][T12884] comedi comedi0: reset error (fatal) [ 688.009762][ T30] audit: type=1400 audit(1762950177.946:1012): avc: denied { read write } for pid=12895 comm="syz.2.1779" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=38791 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 688.184518][ T30] audit: type=1400 audit(1762950178.106:1013): avc: denied { cmd } for pid=12899 comm="syz.6.1780" path="socket:[37611]" dev="sockfs" ino=37611 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 688.403122][ T30] audit: type=1400 audit(1762950178.216:1014): avc: denied { getopt } for pid=12899 comm="syz.6.1780" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 688.958786][ T30] audit: type=1400 audit(1762950178.866:1015): avc: denied { read } for pid=12903 comm="syz.6.1781" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 689.041640][ T30] audit: type=1400 audit(1762950178.876:1016): avc: denied { open } for pid=12903 comm="syz.6.1781" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 689.863153][T12915] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1783'. [ 690.424163][ T31] INFO: task syz.5.1452:11401 blocked for more than 143 seconds. [ 690.592104][ T31] Not tainted syzkaller #0 [ 690.715647][T12919] delete_channel: no stack [ 690.742991][ T31] Blocked by coredump. [ 690.747607][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 690.877038][ T31] task:syz.5.1452 state:D stack:26920 pid:11401 tgid:11400 ppid:9380 task_flags:0x400548 flags:0x00080001 [ 690.937091][ T31] Call Trace: [ 690.947057][ T31] [ 690.953174][ T31] __schedule+0x1190/0x5de0 [ 690.969247][ T31] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 690.977488][T12924] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input44 [ 691.097691][ T31] ? is_bpf_text_address+0x94/0x1a0 [ 691.103846][ T31] ? __lock_acquire+0x622/0x1c90 [ 691.110001][ T31] ? __pfx___schedule+0x10/0x10 [ 691.115125][ T31] ? find_held_lock+0x2b/0x80 [ 691.120041][ T31] ? schedule+0x2d7/0x3a0 [ 691.127516][ T31] schedule+0xe7/0x3a0 [ 691.132087][ T31] schedule_timeout+0x257/0x290 [ 691.140186][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 691.148121][ T31] ? rcu_is_watching+0x12/0xc0 [ 691.154364][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 691.160063][ T31] __wait_for_common+0x2fc/0x4e0 [ 691.167442][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 691.174665][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 691.180334][ T31] ? find_held_lock+0x2b/0x80 [ 691.546805][ T31] ? io_wq_put_and_exit+0x22a/0x8a0 [ 691.555515][ T31] io_wq_put_and_exit+0x271/0x8a0 [ 691.561836][ T31] ? __pfx_xa_find_after+0x10/0x10 [ 691.571960][ T31] ? __pfx_io_wq_put_and_exit+0x10/0x10 [ 691.578000][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 691.578014][ T30] audit: type=1400 audit(1762950181.516:1022): avc: denied { write } for pid=12916 comm="syz.0.1785" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 691.578318][ T31] ? __pfx___might_resched+0x10/0x10 [ 691.610299][ T31] ? io_uring_del_tctx_node+0x279/0x350 [ 691.616204][ T31] io_uring_clean_tctx+0x10d/0x190 [ 691.621480][ T31] ? __pfx_io_uring_clean_tctx+0x10/0x10 [ 691.628186][ T31] ? percpu_counter_add_batch+0x180/0x200 [ 691.634082][ T31] io_uring_cancel_generic+0x69c/0x9a0 [ 691.639667][ T31] ? __lock_acquire+0xb8a/0x1c90 [ 691.645375][ T31] ? __pfx_io_uring_cancel_generic+0x10/0x10 [ 691.651484][ T31] ? __pfx___file_ref_put+0x10/0x10 [ 691.656810][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 691.663198][ T31] ? fput+0xb8/0xd0 [ 691.672824][ T31] ? io_uring_unreg_ringfd+0xbc/0x130 [ 691.680594][ T31] do_exit+0x2ce/0x2bf0 [ 691.685001][ T31] ? __pfx_do_exit+0x10/0x10 [ 691.689730][ T31] ? do_raw_spin_lock+0x12c/0x2b0 [ 691.707967][ T31] ? find_held_lock+0x2b/0x80 [ 691.718466][ T31] do_group_exit+0xd3/0x2a0 [ 691.728249][ T31] get_signal+0x2671/0x26d0 [ 691.740626][ T31] ? __pfx_get_signal+0x10/0x10 [ 691.751378][ T31] ? do_futex+0x122/0x350 [ 691.762510][ T31] ? __pfx_do_futex+0x10/0x10 [ 691.772293][ T31] arch_do_signal_or_restart+0x8f/0x7c0 [ 691.785530][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 691.801955][ T31] ? xfd_validate_state+0x61/0x180 [ 691.814931][ T31] ? __pfx___x64_sys_mount+0x10/0x10 [ 691.826899][ T31] exit_to_user_mode_loop+0x85/0x130 [ 691.838926][ T31] do_syscall_64+0x426/0xfa0 [ 691.853448][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.867155][ T31] RIP: 0033:0x7f98cbf8f6c9 [ 691.878060][ T31] RSP: 002b:00007f98cce840e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 691.894323][ T31] RAX: fffffffffffffe00 RBX: 00007f98cc1e5fa8 RCX: 00007f98cbf8f6c9 [ 691.915835][ T31] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f98cc1e5fa8 [ 691.936194][ T31] RBP: 00007f98cc1e5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 691.957079][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 692.004957][ T31] R13: 00007f98cc1e6038 R14: 00007fffdcce7400 R15: 00007fffdcce74e8 [ 692.016827][ T31] [ 692.021790][ T31] [ 692.021790][ T31] Showing all locks held in the system: [ 692.107078][ T31] 1 lock held by khungtaskd/31: [ 692.111962][ T31] #0: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 692.137179][ T31] 2 locks held by getty/5575: [ 692.150146][ T31] #0: ffff88814da600a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 692.165033][ T31] #1: ffffc9000332e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 692.221219][ T31] 1 lock held by syz-executor/5797: [ 692.226510][ T31] #0: ffff8880b843a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 692.251160][ T31] 4 locks held by udevd/5811: [ 692.262735][ T31] #0: ffff8880b843a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 692.309155][ T31] #1: ffff8880b8524088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 692.332116][ T31] #2: ffff88807a11b558 (&ep->lock){....}-{3:3}, at: ep_poll_callback+0x80/0xbc0 [ 692.361736][ T31] #3: ffff88807a11b4a8 (&ep->wq){....}-{3:3}, at: __wake_up_sync+0x17/0x50 [ 692.387682][ T31] 4 locks held by syz.2.1784/12918: [ 692.401157][ T31] 4 locks held by syz.2.1784/12921: [ 692.414072][ T31] #0: ffffffff90824880 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x113/0x2c0 [ 692.442143][ T31] #1: ffffffff900e7408 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x600/0x2000 [ 692.451601][ T31] #2: ffff88802876d4e8 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_open+0x1fa/0x4d0 [ 692.464131][ T31] #3: ffffffff8e3cfcb8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x284/0x3c0 [ 692.474810][ T31] 1 lock held by syz.0.1785/12917: [ 692.480109][ T31] #0: ffffffff900e7408 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x1a1/0x10e0 [ 692.489754][ T31] [ 692.492349][ T31] ============================================= [ 692.492349][ T31] [ 692.492467][T12921] wireguard4: entered promiscuous mode [ 692.506781][ T31] NMI backtrace for cpu 0 [ 692.506796][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 692.506815][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 692.506825][ T31] Call Trace: [ 692.506831][ T31] [ 692.506838][ T31] dump_stack_lvl+0x116/0x1f0 [ 692.506870][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 692.506889][ T31] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 692.506915][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 692.506940][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 692.506964][ T31] watchdog+0xf3f/0x1170 [ 692.506988][ T31] ? rcu_is_watching+0x12/0xc0 [ 692.507008][ T31] ? __pfx_watchdog+0x10/0x10 [ 692.507025][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 692.507040][ T31] ? __kthread_parkme+0x19e/0x250 [ 692.507063][ T31] ? __pfx_watchdog+0x10/0x10 [ 692.507080][ T31] kthread+0x3c5/0x780 [ 692.507095][ T31] ? __pfx_kthread+0x10/0x10 [ 692.507111][ T31] ? rcu_is_watching+0x12/0xc0 [ 692.507130][ T31] ? __pfx_kthread+0x10/0x10 [ 692.507146][ T31] ret_from_fork+0x675/0x7d0 [ 692.507159][ T31] ? __pfx_kthread+0x10/0x10 [ 692.507174][ T31] ret_from_fork_asm+0x1a/0x30 [ 692.507204][ T31] [ 692.507211][ T31] Sending NMI from CPU 0 to CPUs 1: [ 692.536987][T12921] wireguard4: entered allmulticast mode [ 692.642959][ C1] NMI backtrace for cpu 1 [ 692.642974][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 692.642992][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 692.643000][ C1] RIP: 0010:lock_release+0x8f/0x2f0 [ 692.643019][ C1] Code: 01 00 00 65 4c 8b 35 f8 bc 08 12 41 8b b6 2c 0b 00 00 85 f6 0f 85 ff 00 00 00 48 81 3b 40 45 a8 93 0f 84 f2 00 00 00 9c 41 5d 48 c7 c7 2d b1 b1 8d e8 04 e8 c7 09 65 ff 05 75 fe 08 12 8b 0d [ 692.643033][ C1] RSP: 0018:ffffc90000a08788 EFLAGS: 00000006 [ 692.643045][ C1] RAX: 0000000000000000 RBX: ffffffff8e3c4720 RCX: ffffc90000a09001 [ 692.643055][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 692.643063][ C1] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001 [ 692.643072][ C1] R10: 0000000000000000 R11: 0000000000008402 R12: ffffffff816bf704 [ 692.643081][ C1] R13: 0000000000000006 R14: ffff88801d6e2480 R15: ffffc90000a08874 [ 692.643090][ C1] FS: 0000000000000000(0000) GS:ffff888124b08000(0000) knlGS:0000000000000000 [ 692.643105][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 692.643115][ C1] CR2: 0000200000f6b000 CR3: 00000000298f6000 CR4: 00000000003526f0 [ 692.643124][ C1] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 692.643133][ C1] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 692.643142][ C1] Call Trace: [ 692.643147][ C1] [ 692.643155][ C1] unwind_next_frame+0x3f9/0x20a0 [ 692.643172][ C1] ? __queue_work+0x97e/0x1160 [ 692.643188][ C1] ? rcu_is_watching+0x12/0xc0 [ 692.643215][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 692.643235][ C1] arch_stack_walk+0x94/0x100 [ 692.643253][ C1] ? call_timer_fn+0x19a/0x620 [ 692.643268][ C1] stack_trace_save+0x8e/0xc0 [ 692.643286][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 692.643306][ C1] ? __lock_acquire+0xb8a/0x1c90 [ 692.643318][ C1] kasan_save_stack+0x33/0x60 [ 692.643333][ C1] ? kasan_save_stack+0x33/0x60 [ 692.643345][ C1] ? kasan_record_aux_stack+0xa7/0xc0 [ 692.643363][ C1] ? insert_work+0x36/0x230 [ 692.643376][ C1] ? __queue_work+0x97e/0x1160 [ 692.643406][ C1] kasan_record_aux_stack+0xa7/0xc0 [ 692.643424][ C1] insert_work+0x36/0x230 [ 692.643440][ C1] __queue_work+0x97e/0x1160 [ 692.643457][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 692.643473][ C1] call_timer_fn+0x19a/0x620 [ 692.643485][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 692.643500][ C1] ? __run_timers+0x559/0x960 [ 692.643513][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 692.643529][ C1] __run_timers+0x569/0x960 [ 692.643545][ C1] ? __pfx___run_timers+0x10/0x10 [ 692.643565][ C1] run_timer_base+0x114/0x190 [ 692.643577][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 692.643590][ C1] ? rcu_is_watching+0x12/0xc0 [ 692.643607][ C1] run_timer_softirq+0x1a/0x40 [ 692.643619][ C1] handle_softirqs+0x219/0x8e0 [ 692.643638][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 692.643657][ C1] __irq_exit_rcu+0x109/0x170 [ 692.643673][ C1] irq_exit_rcu+0x9/0x30 [ 692.643688][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 692.643709][ C1] [ 692.643714][ C1] [ 692.643719][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 692.643734][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 692.643753][ C1] Code: d7 6c 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 84 29 00 fb f4 3c 0a 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 692.643766][ C1] RSP: 0018:ffffc90000197de8 EFLAGS: 000002c6 [ 692.643777][ C1] RAX: 00000000030e65fd RBX: 0000000000000001 RCX: ffffffff8b60a2a9 [ 692.643786][ C1] RDX: 0000000000000000 RSI: ffffffff8da2b882 RDI: ffffffff8bf07040 [ 692.643795][ C1] RBP: ffffed1003adc490 R08: 0000000000000001 R09: ffffed10170a6655 [ 692.643804][ C1] R10: ffff8880b85332ab R11: 0000000000000001 R12: 0000000000000001 [ 692.643812][ C1] R13: ffff88801d6e2480 R14: ffffffff90820dd0 R15: 0000000000000000 [ 692.643824][ C1] ? ct_kernel_exit+0x139/0x190 [ 692.643840][ C1] default_idle+0x13/0x20 [ 692.643855][ C1] default_idle_call+0x6c/0xb0 [ 692.643869][ C1] do_idle+0x38d/0x500 [ 692.643896][ C1] ? __pfx_do_idle+0x10/0x10 [ 692.643919][ C1] ? trace_sched_exit_tp+0x2f/0x120 [ 692.643948][ C1] cpu_startup_entry+0x4f/0x60 [ 692.643965][ C1] start_secondary+0x21d/0x2b0 [ 692.643985][ C1] ? __pfx_start_secondary+0x10/0x10 [ 692.644006][ C1] common_startup_64+0x13e/0x148 [ 692.644026][ C1] [ 693.086517][ C0] vkms_vblank_simulate: vblank timer overrun [ 694.928142][ T6409] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 695.007702][ T6409] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 695.065473][ T6409] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 695.148889][ T30] audit: type=1400 audit(1762950185.076:1023): avc: denied { read } for pid=5479 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 695.172639][ T30] audit: type=1400 audit(1762950185.096:1024): avc: denied { search } for pid=12933 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 695.196237][ T30] audit: type=1400 audit(1762950185.096:1025): avc: denied { search } for pid=12933 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=1831 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 695.222544][ T30] audit: type=1400 audit(1762950185.096:1026): avc: denied { search } for pid=12933 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1835 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 695.247339][ T30] audit: type=1400 audit(1762950185.096:1027): avc: denied { search } for pid=12933 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1836 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 695.271030][ T30] audit: type=1400 audit(1762950185.106:1028): avc: denied { read open } for pid=12934 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1836 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 695.297884][ T30] audit: type=1400 audit(1762950185.106:1029): avc: denied { getattr } for pid=12934 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1836 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 695.323647][ T30] audit: type=1400 audit(1762950185.106:1030): avc: denied { getattr } for pid=12934 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=1875 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 695.360057][ T30] audit: type=1400 audit(1762950185.146:1031): avc: denied { read } for pid=12936 comm="sed" name="eth0.dhcp" dev="tmpfs" ino=1875 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 695.395966][ T6409] bridge_slave_1: left allmulticast mode [ 695.403765][ T6409] bridge_slave_1: left promiscuous mode [ 695.409562][ T6409] bridge0: port 2(bridge_slave_1) entered disabled state [ 695.421445][ T6409] bridge_slave_0: left allmulticast mode [ 695.427258][ T6409] bridge_slave_0: left promiscuous mode [ 695.434278][ T6409] bridge0: port 1(bridge_slave_0) entered disabled state [ 695.701893][ T6409] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 695.712359][ T6409] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 695.721971][ T6409] bond0 (unregistering): Released all slaves [ 695.788521][ T6409] tipc: Left network mode [ 696.149152][ T6409] hsr_slave_0: left promiscuous mode [ 696.189805][ T6409] hsr_slave_1: left promiscuous mode [ 696.199422][ T6409] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 696.206907][ T6409] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 696.215042][ T6409] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 696.222991][ T6409] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 696.247961][ T6409] veth1_macvtap: left promiscuous mode [ 696.254688][ T6409] veth0_macvtap: left promiscuous mode [ 696.260338][ T6409] veth1_vlan: left promiscuous mode [ 696.269087][ T6409] veth0_vlan: left promiscuous mode [ 696.381771][ T6409] pim6reg (unregistering): left allmulticast mode [ 696.680535][ T6409] team0 (unregistering): Port device team_slave_1 removed [ 696.709980][ T6409] team0 (unregistering): Port device team_slave_0 removed