last executing test programs: 14m32.98171251s ago: executing program 0 (id=2000): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'virt_wifi0\x00', 0x0}) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000000000)={@remote, r4}, 0x14) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$sw_sync_info(0xffffffffffffff9c, 0x0, 0x80200, 0x0) ioctl$FBIOGET_CON2FBMAP(r5, 0x460f, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000040)={0x3, 0x2}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r6 = syz_open_dev$MSR(&(0x7f0000000200), 0xa, 0x0) read$msr(r6, &(0x7f0000002240)=""/102400, 0x19000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4000000019000000fd010000000008000100ac141400080005000a0101020c00168008000300e0000002060015000600"/64], 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r7, &(0x7f0000000140), 0x4924b68, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x2000, {0x0, 0x0, 0x74, r4, {0xfffd, 0x10}, {0x1, 0xfff1}, {0xfff2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x30004804}, 0x4840) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@GTPA_LINK={0x8, 0x1, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4000054) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)={0x14, 0x7, 0xa, 0x401, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x40480c0}, 0x0) 14m32.193544203s ago: executing program 0 (id=2002): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = dup(r0) r2 = shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) r3 = shmat(r2, &(0x7f0000ff6000/0x4000)=nil, 0x400c) pipe2(&(0x7f0000001040)={0xffffffffffffffff}, 0x0) gettid() timer_settime(0x0, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe2(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) tee(r4, r5, 0xfffffffffffffc01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) shmdt(r3) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 14m30.411398004s ago: executing program 0 (id=2008): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = landlock_create_ruleset(&(0x7f0000000040)={0xc015, 0x3}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r4, 0x2, 0x0, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r4, 0x2, &(0x7f00000000c0)={0x1, 0x2}, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000001009500"/18], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r5}, 0x10) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x4040811}, 0x20042840) r6 = socket(0x10, 0x80002, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8b24, &(0x7f0000000000)={'wlan0\x00'}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r7, 0x10e, 0x2, &(0x7f0000000200)=0x5, 0x4) close_range(r4, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 14m29.104433103s ago: executing program 0 (id=2010): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) (async, rerun: 32) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) r3 = syz_open_dev$video(&(0x7f0000000140), 0xd, 0x0) (async, rerun: 64) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async, rerun: 64) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) (async) r5 = socket(0x2, 0x80805, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000200)={0x4, 0x5, 0x1, 0x0, 0x1}) (async) sendmmsg$inet_sctp(r5, &(0x7f0000000880), 0x0, 0x0) (async) sendmmsg$inet_sctp(r5, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000240)=[{0x0}, {&(0x7f0000000300)="359cb6", 0x3}], 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c000400"/39, @ANYRES32=0x0], 0x30}], 0x1, 0x0) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x78}]}, &(0x7f0000000080)='syzkaller\x00', 0x5}, 0x94) (async, rerun: 64) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0x511e36599023629, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async, rerun: 64) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r8 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0xa0000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r8, 0xc0184800, &(0x7f0000000100)={0x4, r7}) ioctl$DMA_BUF_SET_NAME_A(r9, 0x40046201, &(0x7f0000000040)='/dev/dma_heap/system\x00') (async) ioctl$DMA_BUF_IOCTL_SYNC(r9, 0x40086201, &(0x7f0000000080)=0x2) (async) write$binfmt_script(r6, &(0x7f0000000240), 0x208e24b) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r6, 0x0) (async, rerun: 32) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) 14m28.96959873s ago: executing program 0 (id=2012): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f000001b700)=""/102392, 0x18ff8) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x48) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808200008000000000000000500000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000070000b7020000000000007b9a00fe000000006609000003000000dbaaf0ff50000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffff550000000800000018220000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000005d9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 14m28.922476747s ago: executing program 0 (id=2014): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r5, 0x40a0ae49, &(0x7f0000000100)={0xf4be6908f20cb563, 0x2, 0x10000, 0x2000, &(0x7f0000ff2000/0x2000)=nil, 0x4}) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0x1, 0x5479, 0x103d, 0x200000000006, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x40000000009, 0x8000000000005, 0x800000068], 0x2000, 0xc0cd4}) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x5, 0x2, {0x1}}}]}, 0x38}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TDLS_MGMT(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="a8000000", @ANYRES16, @ANYBLOB="02002bbd7000ffdbdf25520000000c009900001000003d00000076002a0025"], 0xa8}, 0x1, 0x0, 0x0, 0x44080}, 0x48011) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESHEX=r11]) splice(r10, 0x0, r9, 0x0, 0xffffffffffff8000, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="28000000120000022abd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="822e00000200000008000d"], 0x28}, 0x1, 0x0, 0x0, 0x240008c4}, 0x40054) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 14m13.119933056s ago: executing program 32 (id=2014): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r5, 0x40a0ae49, &(0x7f0000000100)={0xf4be6908f20cb563, 0x2, 0x10000, 0x2000, &(0x7f0000ff2000/0x2000)=nil, 0x4}) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0x1, 0x5479, 0x103d, 0x200000000006, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x40000000009, 0x8000000000005, 0x800000068], 0x2000, 0xc0cd4}) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x5, 0x2, {0x1}}}]}, 0x38}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TDLS_MGMT(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="a8000000", @ANYRES16, @ANYBLOB="02002bbd7000ffdbdf25520000000c009900001000003d00000076002a0025"], 0xa8}, 0x1, 0x0, 0x0, 0x44080}, 0x48011) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESHEX=r11]) splice(r10, 0x0, r9, 0x0, 0xffffffffffff8000, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="28000000120000022abd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="822e00000200000008000d"], 0x28}, 0x1, 0x0, 0x0, 0x240008c4}, 0x40054) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 9.61342638s ago: executing program 5 (id=5005): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b000100001000090455070103490200090582030004"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00N\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xfffffffffffffedd, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@remote, @local}, 0x8) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x1c8, &(0x7f0000000640)={[{0xd6, 0x4e00, "d0838cb146f3c85e2065da4f3322059b2ba2b46e31f3e83bdc4a133f73160511139e87e185fb1b7d21b7fe49ee20585aa103968c272f24d5fb72078dc0537710e44d126d8db86a330b5948de8813121737d0c4e7264d18454f3cd77b0401d78a2ecca1497b439ca732f44c96a9936ac29c798114756f31a5d2a53d2052419c69f23f8e9537a22e651ad4f8de12b983c412d50b2cbdf15b7e8c7e7bcf3eddc3d1606e1fde7842bc48eb63ff865e99e50d3f1cf71cb3fe1eab27eac8ca89095ea1e4f8c48657f0caf03e43e353a2a1c7336d024453a6b1"}, {0x3d, 0x4e00, "649f3c8900a4285b1fd6886434c3f1d5ab96d7386bd4c8cd8ac44bc74fdc5805c6ed4bb6a985428a50a4908e6c740b9ac96bf8514c754fc23414632388"}, {0xa4, 0x4e00, "711ca11bd9e667d4fe41aad3dc342e62f1c9af3be188fadfbf83d884bd440daf2bb952571f37d3796d89f485664eea8522ff6e482c8d6f146af9e38beb55feb9a3ab0d41a7d34d3565acd112e73fbd88bf7c4d8c01c8ad276fab58a96be74c626b2e916736449fa477f1bf7dfd96c26698d618fb4821147f2cbe7e9070a0df0f2518b60681912e7fab4ee01a5f80b4a4c746198f74524f8794e3d31f2e26f2a0ee956423"}]}) 7.789681774s ago: executing program 2 (id=5016): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff00000006"], 0x48) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b70300000000000085000000d300000095"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getpriority(0x1, 0x18) syz_usb_connect(0x3, 0x43, &(0x7f0000000300)={{0x12, 0x1, 0x310, 0x3f, 0xda, 0x7f, 0x40, 0x403, 0x9e90, 0x7e4b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x31, 0x1, 0x9, 0x1, 0x80, 0xc1, [{{0x9, 0x4, 0x35, 0x1, 0x0, 0xb0, 0x4a, 0x92, 0x8, [@cdc_ncm={{0x7, 0x24, 0x6, 0x0, 0x1, "98e0"}, {0x5, 0x24, 0x0, 0x3}, {0xd, 0x24, 0xf, 0x1, 0x5, 0x6bf, 0x800, 0xf4}, {0x6, 0x24, 0x1a, 0x6, 0x25}}]}}]}}]}}, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0}) 7.629403477s ago: executing program 4 (id=5018): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) symlink(0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x89e0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(0x0, 0xea) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000240)={0x43, 0x3, 0x3, 0x3}, 0x10) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="7472796c6f630900000034351d5dee63b5c802fe2c21910c21be9d5c8f00"], 0xf) creat(0x0, 0xecf86c37d53048cc) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100112201040ac0501854e9e0102030109021b0001000090000904a000010e010000092505030800000010"], 0x0) read$msr(r2, &(0x7f000001aa40)=""/102400, 0x19000) r4 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r5, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r5, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r4, 0x0, 0x81) fchdir(r6) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) setsockopt(r0, 0x84, 0x81, &(0x7f00000000c0)="1a00000082000000", 0x8) 7.517646116s ago: executing program 1 (id=5020): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000000c0)=0x47ad, 0x4) setsockopt$inet6_int(r2, 0x29, 0x4a, &(0x7f0000000080)=0x1, 0x4) sendmmsg$inet6(r2, &(0x7f00000002c0)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0x0, @loopback, 0x8}, 0x1c, 0x0}}], 0x1, 0x44000) openat$vcs(0xffffffffffffff9c, &(0x7f0000000200), 0x2000, 0x0) ioctl$SIOCRSGL2CALL(0xffffffffffffffff, 0x89e5, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000200)={0x18, 0x0, {0x8, @remote, 'veth0_to_bond\x00'}}, 0x1e) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @broadcast, 'ipvlan1\x00'}}, 0x1e) r5 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r5, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @empty, 'wg1\x00'}}, 0x1e) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) getrandom(0x0, 0x0, 0x3) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 7.067755798s ago: executing program 5 (id=5021): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000280)={@in6={{0xa, 0x4e21, 0x4, @ipv4={'\x00', '\xff\xff', @loopback}}}, 0x0, 0x0, 0x2a, 0x0, "b25dd300350731437df94f0a338977934d6951cdd6c61e31cc7172c856b141e3f4e87e6ab615ea379a12c5a6f5c6e8b30138f5f3570909f89f3e47f8090000c30a1c48cdff030000fad4624800"}, 0xd8) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) syz_emit_ethernet(0x36, &(0x7f00000014c0)={@local, @random="e462e98700", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x23, 0x28, 0x64, 0x0, 0x3, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x7, 0x0, 0xe7}}}}}}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') fchdir(r2) getsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000180), &(0x7f00000001c0)=0x4) syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000082505a1a44000010203010902"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1b1c, 0xa0c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x1, 0x40, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x21, 0x3, 0x0, 0x0, 0x80, {0x9, 0x21, 0x4, 0x3, 0x1, {0x22, 0x4}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x4, 0x0, 0x3}}}}}]}}]}}, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000200)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @val={@val={0x88a8, 0x0, 0x1, 0x4}, {0x8100, 0x0, 0x0, 0x3}}, {@arp={0x806, @generic={0x304, 0x88b5, 0x6, 0x2, 0x2, @broadcast, "43e9", @local, "1427"}}}}, &(0x7f0000000240)={0x1, 0x1, [0xc18, 0xe15, 0x5db, 0xb42]}) 6.179430881s ago: executing program 1 (id=5023): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x2d) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000400)=ANY=[@ANYRESOCT=0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x3) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000021"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000400"/15], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 6.129344349s ago: executing program 2 (id=5024): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff2c}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x66c3, &(0x7f0000000040)={0x0, 0x3a46, 0x20, 0xe, 0x20002fb}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x10, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) pipe(0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000240)={0x6, 0x101, 0x206, 0x2, 0x754d, 0x6, 0x9, 0xf, r1}, 0x20) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, &(0x7f0000000240)) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000004c00)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r3 = socket(0x8, 0x4, 0x0) setsockopt$MRT_ADD_MFC(r3, 0x0, 0xcc, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) ioperm(0x7f, 0x8, 0x5) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000400)=""/4122, 0x101a}], 0x1) 5.895125833s ago: executing program 1 (id=5025): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x4000, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) bind$xdp(r1, &(0x7f0000000240)={0x2c, 0x1, r3, 0x0, r4}, 0x60) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000003, 0x13, r1, 0x180000000) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f0000fe4000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f00000000c0)="3b76210fb6150f209e440f20c0663503000000440f22c00fa2660fc7b2d42af30fa7d0440f20c066350d000000440f22c06767f2caab12bad004ec", 0x3b}], 0x1, 0xd, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000000)={0x5, r7, 'id0\x00'}) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000140)={0x1, 0x6, 0x6000, 0x2000, &(0x7f0000ffa000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, 0x0}], 0x1, 0x41, &(0x7f0000000100)=[@cr0={0x0, 0x20000005}], 0x1) io_setup(0x1ff, &(0x7f00000001c0)=0x0) io_submit(r10, 0x1, &(0x7f0000000300)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x6, 0x7, r0, &(0x7f0000000240), 0x0, 0x443e, 0x0, 0x2, r9}]) ioctl$KVM_SET_CPUID2(r8, 0x4008ae90, &(0x7f00000002c0)=ANY=[@ANYBLOB="0200"]) ioctl$KVM_RUN(r8, 0xae80, 0x0) 5.36588117s ago: executing program 1 (id=5026): socket$kcm(0x10, 0x0, 0x10) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000001c80)) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap$KVM_VCPU(&(0x7f0000ffa000/0x4000)=nil, 0x930, 0x2000002, 0x4010, 0xffffffffffffffff, 0x0) r4 = userfaultfd(0x80801) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000180)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000}) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)) syz_io_uring_setup(0x763c, &(0x7f0000000640)={0x0, 0xe8ce, 0x800, 0x20, 0x4000030f}, &(0x7f00000006c0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000100)=0xfffffffe, 0x0, 0x4) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000340)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x30, 0x30, 0x0, @in6={0x1b, 0x4000, 0x0, @private1, 0xbff}, @ib={0x1b, 0x38e, 0x0, {'\x00\a\x00'}, 0xfffffffffffffffc, 0x40000000, 0x476}}}, 0x118) write$RDMA_USER_CM_CMD_LISTEN(r7, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x4734}}, 0x10) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, &(0x7f00000003c0)={0x8, 0x120, 0xfa00, {0x4, {0xffffffff, 0x4, "b3cfb8833fe2f9a66385088842a090d8b23e8094ffff0000df32c368f88d8b28be825024e7b4eee7fad87a1296cb134f4e075af5716f075eb33c877a6222e1dcb8b09ea5b119ebe72135f192fb9b519aa710980fc4bd5191fdeef002ce140d000000000000dbbcaaa7766a8888dff4edf9d105e97b54416bd3c601c30b5adce433972a3f9c680dc7ec2d01a57706a1137ca69c6683cd1f42a5a4296f3505000000527c23a041bf779ff67c19fcb2ea73d4917d00000000000021080000000000000012d2cf50e8fb064ba7b5e4adcdcb76a22d80cb7fdd385b731f3ef68f3aa164ab8aa3049fd9d1121d00", 0x4, 0xf6, 0x6, 0xfe, 0x65, 0x9, 0x12}}}, 0x128) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000300)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x12, "f71139", "4675e6f1f6e1644bae16845a4997188eddf5608a79479554c8374b01c6813417f590f243b02f5ae6065e1bc7ce230f98879b9e5afb8e7b3a912fb65613e62fc9f93625aa3977303f269373edea5f9dfbbb4c75ba63e7e89f7af731688df9ffb5a2e25276e75bd5206a21d27509210a5240b1b9118ac3b22da44705e28eebe71498794dcfd4d3c8d2a9c99354b0a6e7028f5e7aa063a4e18cb02dfe3752c91747bb8e46fcead5f8d96c89ba8dc7c03685fa0edd7935ecd80035c0ae3a0cc7b0fb15d25fd67cce36e479caa3faaf3f241b17a416e8b0db6715db89cbd227121d54d99a0e8d4d04c0984d64cb65d95e9209897935197f6f2965af295214860f1cbc"}}, 0x110) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x6007, @fd=r4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001800)=""/211, 0xd3}], 0x1}) socket$qrtr(0x2a, 0x2, 0x0) syz_io_uring_setup(0x49b, &(0x7f0000000380)={0x0, 0x4661, 0x400, 0x7, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) 5.07732179s ago: executing program 3 (id=5028): socket$inet6_sctp(0xa, 0x1, 0x84) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) ioctl$SYNC_IOC_FILE_INFO(0xffffffffffffffff, 0xc0383e04, &(0x7f00000000c0)={""/32, 0x0, 0x0, 0x61, 0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='contention_begin\x00', r2}, 0x18) syz_open_procfs(0x0, &(0x7f00000000c0)='net/protocols\x00') mount(&(0x7f0000000140)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000180)='bfs\x00', 0x2208004, 0x0) close(0xffffffffffffffff) r3 = syz_open_dev$dri(0x0, 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r4, 0x0, 0xe, 0x0, &(0x7f0000000280)="e0400000000d85ff9782762f88ca", 0x0, 0xadca, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000200)='nilfs2\x00', 0x410, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000880)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x26e1, 0x0) close(r5) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$SIOCSIFHWADDR(r5, 0x8b19, &(0x7f0000000000)={'wlan0\x00', @random="7cf1e97c9e4f"}) 5.043397996s ago: executing program 3 (id=5029): r0 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_request\x00', r2, 0x0, 0x7f}, 0x18) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1400002f2500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r3 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x20000, 0x0) r4 = dup3(0xffffffffffffffff, r3, 0x0) write$UHID_INPUT(r4, 0x0, 0x0) close(0x3) 5.008363276s ago: executing program 3 (id=5030): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000002000)=""/102400, 0x19000) openat$snapshot(0xffffffffffffff9c, 0x0, 0x20080, 0x0) getrlimit(0x6, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000480)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x34014c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) dup2(r2, r0) write$FUSE_STATFS(r0, &(0x7f0000000340)={0x60, 0x0, r1, {{0x0, 0x10001, 0x7f2f, 0x2, 0x9, 0x8000, 0x7, 0x7f}}}, 0x60) 4.983895743s ago: executing program 5 (id=5031): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) getpid() getpid() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f00009d1000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f00002a0000/0x4000)=nil) semget$private(0x0, 0x2, 0x2) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x0) shmctl$SHM_STAT(0x0, 0xd, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096231b06e53f07ff0000002a900683749e"], 0x0}, 0x0) syz_usb_connect(0x5, 0x1b, &(0x7f0000000000)=ANY=[@ANYBLOB="120141015ad46c08d112b61cfc62f7020301090209000000001001"], 0x0) 4.9241979s ago: executing program 2 (id=5032): ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x3, 0x0, 0x717e387b, 0x3d, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000340)='.\x00', 0xa50003d1) readv(r0, &(0x7f0000000140)=[{&(0x7f00000006c0)=""/189, 0xbd}], 0x1) close(0x3) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) mount(&(0x7f0000000900)=@nbd={'/dev/nbd', 0x0}, 0x0, &(0x7f0000000080)='squashfs\x00', 0x1408009, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={0xffffffffffffffff, r3, 0x25, 0x0, @void}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/20, @ANYRES32=r1, @ANYBLOB="1e0000000800"/20, @ANYRES8=r2, @ANYRES32=r1, @ANYBLOB="0400000001000000050000000f00"/28], 0x50) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x20042) ioctl$DRM_IOCTL_WAIT_VBLANK(r5, 0xc018643a, &(0x7f0000000080)={0x4000000, 0x0, 0x3}) recvmsg(r1, &(0x7f0000000480)={&(0x7f00000002c0), 0x80, &(0x7f0000000440)=[{&(0x7f0000000380)=""/156, 0x9c}], 0x1}, 0x2001) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="d9ec94c7768cad56b6c5820fae9d6dcd3292ea54c7beef91", 0x18) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) bind$tipc(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) r6 = syz_io_uring_setup(0x377, &(0x7f0000000380)={0x0, 0x1ffff9, 0x10100, 0x0, 0xd3}, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd, 0x0, 0x0, 0x0, {0x8230}, 0x3}) io_uring_enter(r6, 0x2ded, 0x4000, 0x0, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x5, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0x2, 0xfffffffb, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x0, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x80, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8000, 0x0, 0x3, 0xd, 0x3, 0xba55, 0x8da8, 0x2, 0x200, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x199d, 0x6, 0x2, 0x9, 0xffffffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x8, 0x7fff, 0x72c, 0x1c32, 0x3, 0x5, 0x10000, 0xfffffe01, 0x7ffd, 0x3, 0x1, 0x297, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x2, 0x1000001, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffffffff, 0x6, 0x8, 0x800, 0xffff, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7, 0x200, 0x3], [0x401, 0x8000c584, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x3, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x1, 0xd9, 0x0, 0x7d, 0x401, 0x5], [0x108e, 0xffff, 0x3, 0x3, 0x88, 0x2, 0x4000000, 0x4, 0x50, 0x2, 0x763, 0xb, 0x402, 0x1, 0x5, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x200, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a5, 0x86, 0x44, 0x409, 0x3, 0x4, 0x4, 0x10, 0x4, 0xffffffff, 0x7fff, 0xffff8a33, 0xfffffff8, 0x401, 0x3, 0x200, 0x7, 0x4edf, 0xfffffffd, 0xa, 0xe, 0x2, 0xf, 0xf, 0x136, 0x6]}, 0x45c) 4.825345442s ago: executing program 3 (id=5033): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000000c0)=0x47ad, 0x4) setsockopt$inet6_int(r2, 0x29, 0x4a, &(0x7f0000000080)=0x1, 0x4) sendmmsg$inet6(r2, &(0x7f00000002c0)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0x0, @loopback, 0x8}, 0x1c, 0x0}}], 0x1, 0x44000) openat$vcs(0xffffffffffffff9c, &(0x7f0000000200), 0x2000, 0x0) ioctl$SIOCRSGL2CALL(0xffffffffffffffff, 0x89e5, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000200)={0x18, 0x0, {0x8, @remote, 'veth0_to_bond\x00'}}, 0x1e) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @broadcast, 'ipvlan1\x00'}}, 0x1e) r5 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r5, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @empty, 'wg1\x00'}}, 0x1e) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) getrandom(0x0, 0x0, 0x3) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 4.730799054s ago: executing program 4 (id=5034): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x1ff) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101081, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000200)={0x15, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r4, 0x3b88, &(0x7f00000002c0)={0xc, r5}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f00000003c0)={0x48, 0x2, r5, 0x0, 0x0, 0x0, 0x0, 0x1}) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x10) stat(&(0x7f0000000ac0)='./file1\x00', &(0x7f0000000b00)) 4.701140101s ago: executing program 2 (id=5035): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x1002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) prlimit64(0x0, 0xe, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x4040094) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYRES64=r1, @ANYBLOB="b7d533343c6dc9dcda39dbd330dae92cc1b7b56358a54328de14ba5603d6cf647bb9365a3679a89c622f5773082aa528375264d8395bac0a5c9f850f9ba30de14bff4038afb3c6fc1b524f507bb83952433ec1ff66449efc2cdc735234002b2a32f5fe12d294559b9e958821f4f41678f7ed45c455c5258e7d8c7c4ea728e8f3b1acbd704229ef0515f2e1f5d660aa7745a9e34ca0f5f4", @ANYRES32=0x0, @ANYRES8=0x0, @ANYBLOB='\x00'/16], 0x50) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r4, &(0x7f0000001680)={0x2020}, 0x2020) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0xe8, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) close(r6) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8b26, &(0x7f0000000080)={'wlan1\x00', @random="000000f900"}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) 3.579175903s ago: executing program 4 (id=5036): syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x103381) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x0, 0x0}) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x0, 0x0) (async, rerun: 64) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 64) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x3}, 0x0) (async, rerun: 64) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x71) (async, rerun: 32) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) (rerun: 32) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000000)={0x6, 0x4, 0xd, 0x1}) (async) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) (async) r5 = dup3(r4, r3, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r3, 0xffffffffff) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) (async) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000280)={@fd={0x66642a85, 0x0, r5}, @flat=@weak_handle={0x77682a85, 0x100b}, @fda={0x66646185, 0x5, 0x1, 0x18}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x40}], 0x0, 0x0, 0x0}) (async, rerun: 32) r6 = fsmount(r2, 0x0, 0x0) (rerun: 32) fchdir(r6) (async) r7 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r7, 0x2007ffb) (async) sendfile(r7, r7, 0x0, 0x1000000201005) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) (async) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) (async) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x2000, 0x0) 3.341494398s ago: executing program 4 (id=5037): socketpair$unix(0x1, 0x1, 0x0, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r0, @ANYBLOB="00000000000000005c001280110001006272696467655f736c617665000000004400058005000500000000000500200001000000050008"], 0x7c}}, 0x0) (async) read$msr(0xffffffffffffffff, 0x0, 0x0) (async) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x28bd, 0x905, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x815, 0xfe, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r2 = syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r2, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) (async) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, &(0x7f0000000780)={0x14, &(0x7f0000000640)={0x0, 0x3, 0xdd, {0xdd, 0x22, "375fa313d0acc4abb00dd7b558d1bf236326fc65e360f0d15265dddb90de40c280b51284a83d6030ddf89f2a4ce4a76691a8a4f7f81b5d5396b0d80af4d7bfa82e3f0753e29f7157cb6aa884f30fbeb0bc6c350d4bb559df84cb59df4547e8accd01a300dc2f55576b8e28ec0417c42714314414c7e309aa1791e4a912570c172788a0f5d50dee3d36faa1dff68c3af7d83b00ff327e8367e610e252e69de62a59b041308e99a6ce6454eea73b86fb2adee40c9e5f8686811cfedb5afd335a4f53f7348ec937911c28efdbb2f2313ddc1db1b93c8823c8b1057669"}}, &(0x7f0000000740)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x441}}}, &(0x7f00000009c0)={0x34, &(0x7f00000007c0)={0x40, 0xf, 0x7d, "3763b623847f68c45d3e2a0473283c27f245efd709ffd450009edbe6dd421531634f1e9c24c6a3c00e46401d0afc9ad2db998cb03eaf5c502879e6ebb1215bab78f0530403c4d6fbccbc3656a2cf4ed0ecc7edcda1c6b5f7218edc545cabb2eec0e792a6216c19e1592fd5a0aba8939bd600deb8398c46a03d3f3b64cd"}, &(0x7f0000000880)={0x0, 0xa, 0x1, 0x3}, &(0x7f00000008c0)={0x0, 0x8, 0x1, 0x80}, &(0x7f0000000900)={0xc0, 0xa1, 0x4, 0xeed7}, &(0x7f0000000940)={0x40, 0xa0, 0x4, 0x5}, &(0x7f0000000980)={0xc0, 0xa2, 0x2f, "733f1fe28f11e3e7eb4156f52b50fd1a9cb361e67c23a57fedcc66f9543e56bada59e73eaabe864eca72593a27a398"}}) (async) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) (async) syz_usb_control_io$uac1(r2, 0x0, 0x0) (async) syz_usb_control_io(r2, 0x0, 0x0) (async) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r2, &(0x7f0000000340)={0x14, &(0x7f00000001c0)={0x0, 0x10, 0xd3, {0xd3, 0xa, "0a3fb4b24dd496afcad3afe538f71e984f72570f362d198418d78359ed118ca8b6fc6f7d4fddb2f70df5d12a844edfc4fc22be0db6dbf0032be0ec65c52290ef6281956dfc25e5790ad9684d17b3f66cc88914984c447f1a99b091834eb252528f5b0679aa2f23840720873bf821bdff053189bdacd3a8fae827ea78e165c6ffb9be7dd441ff0fa7c6412dfccc57385488e55cdf0256ed57f35d7766e79b8a976a9531c48c0433b184713b4f91bfc2008dd27c5bad3a387db9d6cfc3b8b50056420fdc66b8c00686976b88149065fa21bf"}}, &(0x7f00000002c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000580)={0x44, &(0x7f0000000380)={0x20, 0x13, 0x12, "7de65184a0aeb4de3f72400097a1bffb8298"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000400)={0x0, 0x8, 0x1}, &(0x7f0000000440)={0x20, 0x80, 0x1c, {0x400, 0x1000, 0x66, 0x8000, 0x7, 0x5, 0x1857, 0x5, 0x2, 0x1, 0x2, 0x5}}, &(0x7f0000000480)={0x20, 0x85, 0x4, 0x5}, &(0x7f00000004c0)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000500)={0x20, 0x87, 0x2, 0xf000}, &(0x7f0000000540)={0x20, 0x89, 0x2}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f0000000a00)=ANY=[@ANYBLOB="34fc01458204b54ae442840dff0000000000", @ANYRES16=r4, @ANYBLOB="010300000000000000004e0000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x34}}, 0x0) (async) syz_usb_control_io$hid(r1, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x7, {[@main=@item_012={0x1, 0x0, 0xa, "18"}, @global=@item_4={0x3, 0x1, 0x2}]}}, 0x0}, 0x0) 3.340849997s ago: executing program 1 (id=5038): write$sndseq(0xffffffffffffffff, &(0x7f00000003c0)=[{0x0, 0x0, 0x0, 0x0, @tick=0xb, {0xfe, 0x4}, {0x4, 0x6}, @time=@tick=0xcd}, {0x0, 0x0, 0x0, 0x4, @time={0x10001, 0x3ff}, {0x6, 0x4}, {0x0, 0xfe}, @result={0xd, 0x4}}], 0x38) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r2, &(0x7f00000004c0)={0x18}, 0x18) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000200)={0x50, 0x0, r4, {0x7, 0x29, 0x20200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_fscache}]}}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) 3.303568557s ago: executing program 2 (id=5039): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r4 = io_uring_setup(0x3465, &(0x7f0000000000)={0x0, 0x75f, 0x10, 0x3, 0x1da}) r5 = landlock_create_ruleset(&(0x7f0000000040)={0xc015, 0x2}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r5, 0x2, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) r8 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f00000000c0)=0x0) connect$nfc_llcp(r8, &(0x7f00000001c0)={0x27, r9, 0x0, 0x5, 0x8, 0x0, "ac2c4309a2729e4c671c5e52c25feb02da5a8a4c3b375361ac673147ac632e48bcfd6dcc03eac7ba13283d407a363d2a12b6a133d478a3333c283085a8fb32", 0x1f}, 0x60) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000180)=0x5) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000140)=0xff) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000100), 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xa) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) quotactl_fd$Q_QUOTAON(r0, 0xffffffff80000202, 0x0, 0x0) munlockall() madvise(&(0x7f0000597000/0x1000)=nil, 0x1000, 0x13) openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0), 0x42782, 0x0) 3.138220265s ago: executing program 1 (id=5040): r0 = socket(0x10, 0x80002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000480)=@abs={0x1, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0x11, 0x3, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000040)=@generic={0x0, 0x0, 0x6}) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYRESDEC, @ANYBLOB, @ANYRESDEC=0x0, @ANYRESDEC=0x0]) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r4 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000002c0)="ae", 0x1, 0xfffffffffffffffd) keyctl$invalidate(0x15, r4) keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55) r5 = socket$nl_generic(0x10, 0x3, 0x10) msgctl$MSG_STAT(0x0, 0xb, &(0x7f0000000280)=""/254) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x18, 0x2d, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x18, 0x0, 0x0, @binary}]}, 0x18}}, 0x48000) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x5}, 0x2) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x20000, {0x0, 0x0, 0x0, 0x0, 0x14080, 0x10000}, [@IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x9, 0x0, 0x0, 0x1}]}}]}, @IFLA_GROUP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) r8 = syz_usb_connect(0x0, 0x24, &(0x7f0000001040)={{0x12, 0x1, 0x0, 0x40, 0x15, 0x42, 0x20, 0x5a9, 0x1550, 0xe4bb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x8e, 0xc4, 0x6f}}]}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r8, 0x0, 0x0) syz_usb_control_io(r8, 0x0, 0x0) syz_usb_control_io$uac1(r8, 0x0, 0x0) syz_usb_control_io$uac1(r8, 0x0, 0x0) 2.143295303s ago: executing program 3 (id=5041): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000006000000000000b5caaa083e674d5b593f0449ed"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x1}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000005400010001000000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="010002006401010000000000000000000000000086dd"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(0xffffffffffffffff, 0xc0045006, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$usbmon(0x0, 0xba, 0x280802) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x2) r3 = socket(0x23, 0x5, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x0, 0x0) read$hidraw(0xffffffffffffffff, &(0x7f0000000040)=""/62, 0x3e) read$qrtrtun(0xffffffffffffffff, &(0x7f00000004c0)=""/57, 0x39) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$can_j1939(r3, &(0x7f0000000400)={&(0x7f0000000180)={0x1d, r4, 0x0, {0x2}}, 0x18, &(0x7f0000000340)={&(0x7f0000000500)}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$can_j1939(0xffffffffffffffff, 0x0, 0x20000840) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='contention_end\x00', r0}, 0x18) socket$rds(0x15, 0x5, 0x0) r5 = syz_open_dev$video(&(0x7f00000001c0), 0x3, 0x2500) ioctl$VIDIOC_DQEVENT(r5, 0x80885659, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r5, 0x4020565a, &(0x7f0000000040)={0x3, 0x980914, 0x3}) 1.389275922s ago: executing program 3 (id=5042): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12110000000000202f173200000000000001090224000100000000090400ff0103000000092100000001220200090581030800000000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r1, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000980)={0x28, 0x1, 0x7, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xfff}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x57}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x801}, 0x40000) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x22, 0x2, {[@main=@item_012={0x1, 0x0, 0x7, "a4"}]}}, 0x0}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000009c0)=@bridge_getlink={0x34, 0x12, 0x1, 0x70bd25, 0x25dfdbfc, {0x7, 0x0, 0x0, 0x0, 0x24, 0x800}, [@IFLA_IFNAME={0x14, 0x3, 'bond_slave_0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x2400d814) r6 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r6, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x600}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[@ANYBLOB="40001000", @ANYRES16=r3, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r8, @ANYRESOCT=r4], 0x40}}, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="000000000000f3ff22000000000000", @ANYRES8=r0, @ANYRESOCT=0x0], 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000400)={r9, 0x0, 0x0, 0x4}, 0x20) r10 = syz_open_dev$evdev(&(0x7f00000000c0), 0x401, 0x90002) ioctl$EVIOCRMFF(r10, 0x40044581, &(0x7f0000000140)=0x5) 1.225958453s ago: executing program 5 (id=5043): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000002000)=""/102400, 0x19000) openat$snapshot(0xffffffffffffff9c, 0x0, 0x20080, 0x0) getrlimit(0x6, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000480)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x34014c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) dup2(r2, r0) write$FUSE_STATFS(r0, &(0x7f0000000340)={0x60, 0x0, r1, {{0x0, 0x10001, 0x7f2f, 0x2, 0x9, 0x8000, 0x7, 0x7f}}}, 0x60) 1.133884712s ago: executing program 2 (id=5044): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) openat(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x169142, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) 1.081437212s ago: executing program 5 (id=5045): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) socket$inet6(0xa, 0x3, 0x4) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0xfffc, @broadcast}, 0x2}}, 0x2e) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$evdev(0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$nl_generic(0x10, 0x3, 0x10) getpgid(0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, r2, 0x9c3fa077fa966179, 0x2000000, 0x0, {{0x7e}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x4040800) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r3}, 0x10) pipe(&(0x7f0000000000)) 381.396222ms ago: executing program 5 (id=5046): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) userfaultfd(0x80001) socket$inet6_tcp(0xa, 0x1, 0x0) eventfd2(0x400000, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) syz_open_dev$tty1(0xc, 0x4, 0x4) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) unshare(0x20000400) pselect6(0x40, &(0x7f00000001c0)={0xc4, 0x0, 0x3, 0xfffffffffffffff9, 0x3, 0x0, 0x0, 0x10}, 0x0, &(0x7f0000000300)={0x800003ff, 0x7e7, 0x9, 0x9, 0x0, 0x0, 0x7ffffffc, 0x3f8}, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000100)={0x0, 0x7, 0x0, 0x9, 0x83, "db8f2d2b3b7596240c6981acf8805944823a7f"}) write$binfmt_aout(r0, &(0x7f0000000400)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x8, 0xfffffffe, 0x4000, 0x10, "0000000000000040000000000000f4ffffff00"}) r1 = syz_open_pts(r0, 0x4e8661) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000003f80)={0x2020}, 0x2020) prlimit64(0x0, 0x3, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x82, 0x0) ioctl$TCXONC(r4, 0x540a, 0x1) pwritev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000a00)="e3abcc5ac18952e0fc1be852dfadebbe645c81c87738122394bec85c72d6ba9fcd718a3241cb5ed8b43c947a6b239324b5f0f795b06892496de4b53e18c0ca925460f2fe46e6073b4e2b631684cca5e67cc277ec8d7f924adc4117569ad9800f6362799edb1a51450ccb8401df0ffe40554a27ddd18b572de82376d102681df9acb1d0a4a92ecc50910851dd951f8ece07a9061ba5f6ff6439a1d9097922be3b2df44a5c470b5f777a8ae025194cbe2849686647ccb2827b4e7deae682cc92f2cb31c74df8df032d6090ceefc358fc5c2114aca183fcc26b84928e11da9e1ce2450a41a69f86d77a7deb3af9e818a51d998a950e7d92b539bb0c256e6eb70899a80c650eb4e5bf726dac3dfe06c9fe9fde8cb163254f40a92ae7c83c2a480e04180983e4103811bff87e7c97188a98b79d3dd7cc126b9abe22d4c11c049940780921c9122aae4aacab1cddf5b5ac6bd00c9ef383b109141a9d941184b41150622cd6428066a6ae2cb8fa605498dbec686cac0ae32206adac46e57e782a524d8e8e58e189611f24195ae6454d948f6bfb6a6bf77a260f4f9b381d8174b14ac022a4a74e4ea5a6d5f1dbaec05f32a54276761eada8ebb2bb02ac3ffb8c134e69bf0eb503c121581f5d8c0640cd3031c25eb6f9b5073414045e1ac94679c09fda88dafa1423494b69d1066583e72f4087643084939845923066686b3fcfd216f387a3a44967699b8dc97152d81dbfaa3d4df6b86b072b5cbcd60754b13f4e80d8d78ab75bf8b0a9f2dc37f2e7d75d2850d7b16e85b24d4b1fdc34920beb4b0cfb25aa4d10627be6cf7b3e3ddc28e0d9935aaecc719ffc750a50060a85758a48e44e7bd8f8b40d03ea113586e6f1319fd0b5bfad9ebab879c943ea8056d22a537abad9f6de4cae80df62e9db60ea9cbe77037e86ee91f2f36992fe0f255d0d5f21c05c5d6a3e602e4a9ec69c33064056303de41b93dccd38f1b133f3055b38b2b5a5d8f0bd89c33cf7c7cd3141da9b128ebe093593d54d7885088003d742364d2b6f0f869d5e35006495666ca7db994e6de231e115ba1948b0a373df6ffc09ee7bb5587be1daa3a40aaaf04890591c913e3def09ec1519ec17db475b385ae9519d087fbd0564e62f891d66d64374984bdcf9ec3659def47215776fc604c276790b96e2f315243824c69cc76f8bf303f12a94af405b8df5311f8a8764ab4adfe9723b6613da2685bbe878fc44088c3f88e7c3db2d3c1d044ead15f8fec3103940a4e9be4292aff3ca39c2c167176e5cc30a17f7b1c2f1b8493f0136aaf76483dd368125489818403c9f14aedc04db0a782f2d5e4fe11b487548e833d820e71791b85d13279cfa837c64a9ab93489d36251b2151e3d3df8f70e93ead4caa6b2de9a11d17eabff4f47192dfefc5506cd1a24995db0600c36e859b9db2e8e058265a7012898030bb60ef3a8b52343fa2a14b65f1d30624cc8c5ea6b7e9ebd5a4a785504df2f3cb0d6d3949a3e28729698cacb0540234c53a78eb8da4e6ad50031472d3b7f4005aa2295e441bddf2ad3302fdde3c1a768b5ab7688b2f08063e5e0af678cd39f9a8c52882fa90dd60816bf51d3668f4d21b06834192efccad83570c1860717a3626ecc7f62ae408e0d520398a17555743f4dffb12a66e54cd53637b57e8b56508133ed787c47d3f12d2d83d1737e44d96e8948e4a8ca61e33518f23eec7aa065704ee1f32867e6f19c95287e846780bb2e154734dbf4f2a026572f1b0dff5183030825f6ed2d2190d374729a4ec20a3057cb1e75e0390ef15235dcbf262a5f3454461f1b924623ae5ee21af5797542e1d5cfef352a16d7f578f775557f13de2918fe709842674e92ac670b735435a8285c81886f341caa6bac960b7b81bbfda9f93fb3bdd80f4108e88e9528254059909ba73ebda01b7fb4ceeb6227eb337b7fb502fffc2127b78995f5bef493468d7250ec2b23f5e41ec16bb6bbd9226b626fa3702350c5ef9c510221ba2e8124ca8d3151a5fdc6e99aa0ca24b9a4520fa496c682c04c1af6edde0c15655a5ec98f6c095086ff6124ce2ea5cb2c1af529ef828bd6d5076c289ea27bf91170bb2a3d84275083ccc487f7d322a02922bd105ba9d61d41fad0f81b64270c235fcc8d7a6db21e8cb9e70087c1071bb245f2512683c1ebcee8772b26cf4f02dd6fb20c0f5d4608dd73aa2573a5bcc06b268b4ab7cca18df7a58fb4d01c7f5c69d70784221b5701e58f2c2d4c19396f35a58535a45417abd8a18d2308ff7269a02004df6c6db630280d77b32dcf1e7ae43c394de85c9c51b63266553ec3aef90028770873ddbc8dd8ea679fc674d3e07e04096265ba3337cfbfbe341c9167f47176de728ebeb34afedc3b145a61514368e759f064c02763f79a3f84b8c5740a44979813a70d5c71f958ff1b7741c3ecb4dce7325919f86be8b6a87f0ac635652cff8184770132e40aee3668f376d7ecca9777d2ddafe2f3cfe67b0505f5353648caa812949af7c5ce7c51b644f09a5eb1a1eb22ddfba19f870901caf1b4ee8afd25b4472a850d0ac067b2d91e6be83141c9ea62618f9c280bf5db9127103ae54eef8e0bf5d5d1f8c2c3aa7254f6739e6767c6690735137d08d2ac5dbe2f8dabf974778f660c1f3611b8da9c145b355f28d64a6413b0a3d54bba539b518cb129706db18c2fce2c8b96d0494e5ab7cb244e7f3c55218cdc2d161b41a62272dbef53d249a19ac23bbb9703dc58afb927636ff332cc2c87fe66f8d6db8c2d42fff67b8e37a390f067662197a5bf3987a0e6222fcb03936c104c6e1a80b6951d4782e1481364a4ba06138fee9ac740667cf13e5f5ae3e41a815644d0ddc2ba05a8920b4bbc32501ef188e196c015a5c019feea9aca5ca96b1dc811e9634f9441060fa9106b6a8ee75c389ef83dcfe9a7800a95f24f93c9b66bd2123c90417b8a64f9b1fcf417e698d01ff4c07dd36449c06417fc0fe9b5cbf323e393cbc5e67c02a6fe23f540c6b943a036ffd3341ec54b3ff1fbc59e1327e7de1e88e4015b536e02bedad259b159c97148f5dfd7411e5d1c4ffba86948c14c14211685295aca0424fb55f36e60788ec1ac42489dcf5bd21184d907fdf5a26e145d2426d5582212d79374d29f29d2b81674608a094b3bbde432a4dc10003d521d9887fce482e870a10ea9283ed14ff9e926c5ba572b68fdb586faba891ed7e1d5d34e22a758a86afe680cc1e992a76580327ff538341b491189654c11028772e923211b88db29ca6e8672be7159f5dd071110f4ea81683dcadc8042c474874334ef477738862f0cad0a2776c6a50caa76c0489593c853672f9129dfc1c7c98c90066fd583c89980092eb00ea474ad91b1a0454a00b680dac448d956d33c7858dab938bac4f90d403855a632f0232032b845c162026d3394afdca94d33d95d81c5772486f6e77bf39c0bddf7ae4f2aba0ee7db98ea1fce586b9cc1bf0a9383f59794589ff6bd4d07db85fc687dfa14d88fcd37b04b308d714badedd8e65fddb803c0d80beb860c652e41f4310bee2cb8e8fde1c6479c4e0cbf204afe59cbbd7d0004787bdcca07484187c09c455b5a9388d9afa6d250801bdaf19ad8ee61811e5e570dfc127b2401b4afb108dd1179ed9480c8d055007c0ffc9e517641ed6a423b21a1c79a07d8eb2f12fff4f77e8a9ad3138a1eb79ef3203afc650b6ad12662ef479e1b4f9960f5727b4d6c3fd0b9527e36d6858b43e2887aa3f91cb80f8275b3ab1384de51cc8083d4b443d5ba88a0f7d2e6f8a47c7917e62aa54a0ca68f0244e4e602dd8cd23d46acc0c123dcb97d8695f4f7eb40b7d00b881bb7bd6a325ead92a3918f661265569f820285c3e7242c87679cbebbf88d09c75b8a8b95e1f2f718b1490bae9e90302670379a40195ef0f9a0af4d09d318a529ea6d79dd2a30da0f830b11019073080523b96ec24a7f29524d063b389c28dd2a9fbe91f7c96ef0acf084fef47357af4fc43a02c119a792cee117475e391844697bd1090a6387862c7dbd533d712d1e95c6905791d7536900dbf8f2f2f58e6219cd7913df50507e113631776009f19837be4eae1236a6956f3cd64f6ae2727ed7b76e6eb743a2759f525f50a51e510efd627a66bddc9996c4affe16368f876d142778c85d0dcd903f4a1f7ed37926120da16bff1950f5c29d7a89db20f3f1ce607c9288fd695983f66b78c074d0b10ecb96b03c6b0bf3fee2eca4580040d6be3fe6653efe2cc1ed55323c85bc0c30e2a00a4bbdabd8aa48b87ab3a64f334e7cd963b410f7c1eed62570a796c8fd6f24832188ac94973918b5986d2aef6a0c0fc9b42e4ce2b7d21381f243c3884067aed9930db8b6d0593c385d4bb58c65bef58d18ba89e0791d686acadc9d53b3675a389a77bf25c35c8567e2b549a14a204d6994105c051ee757e17cb8b30a4b471632b602d47e72d92a1db80891f77bd4e32310aca03f20950da36b5f41737c97122fe0948fd8a4e8234e7fa76fccb51aef6063a467d0f017cb389c3a05ef11ae9a5d091ef742f7d0d11a4e01be71f3a41287190c4d157c404d60a8ca133c16766d1bdcac63424fd7806a7be6ccb2fd4b6507d85ebfbed0bfaf0267baf62480c4bb7273cc1fc7af1494c44de6a90ed3f26b97fa16f23cae2d8f2ecb4840788c79fb4d9a8780da654874db2d6be84e9908f7304adef2dee334cbcc5727d33d54b0ab91cc39f23416e4697b1ea0ffcc054a3f0a541ea3aaa9c761fd7168fa542c95d575c4b30aa33f7a17091a17d6707c688144961444e966ad5c087303c6ea1442357112f2d296843849a4f7a7f15f231861a5f147fa9ddd63862a92a6fd055f2b14a76d136dc9d6b353febab2ad7a8bb1009e00e9aef3602b14a0fbd2e4d0f9c3b0b5f0cb464f346918a7318f3cfb7d83b857d61cfe479365f2174bc561b8638bebd0c5c72e83cc11af8a36f824f5be854e248a4b63b6f4c576d2c9cc9beb040c38c7824f0c9c5877744f008df185abfde8d2eb3c292d953f53ded3ccba2224f5f00d03e920433270bb09b89679347a5aea67d02384ea23e94ed043fdd0c90fa7d48df07749fed2e217a860af28141402f091f70b381ef5f439abb7946d0c0cf7fa394601ba7c44f27feca127b82da2997f4929e5aacc8215af87b0a0d0d3df90fbb2dd32a8dc128f52f4759df320f6241be99f5fd59a7897ba3be8cb3031c6d1e1f4b3aa0ecae7199be366583362c454a83d61f6f3d6e74f2e2ecb580660e1e5e99b05b01f624ff583076645843f01472d44c64cd055369c5a955fe499783283b66e6aaa8b6120cd83aa2fedbced8d46befc7d75f64f18d9c51ae9886b919cc0b52eb91a2408af2803f67a29994105f36cac7bea200ca413a00079066d1334464ae1f1e28f210e6659a1d0824eadc6377d1919410eac837fd163c3cbd28faad766c7143375d4c1a443bac710a0de1464bfbceca0362aae71e48f6366c3b8e8df85746e16d2d7338ab88782609340fe688ff440484e68a9c4114b24e19034a79dd719d0bab01014f6e0cce3a8ff79dcc6d13681c0119c10de4baa1c48db57e1a1b5d8239193fc8ee212c8ece887458c05dc46135744b88259071d4c60bc5ff8a9ca7cf06c9a3350fe583836a1c872c9732a7faf5aa9860fabfe060b2d3f988136b83037a8e3648d7031424d5143bc90a439a7b6554868d4b6e826512ce30c08a1fe1c1feb3fdd027cc88fdd8702f7529d5ec618680d9423b3c90fc96efa8314b6a96d77b2396475ccbae19fa5f1da96fcae210ee03a2", 0x1000}, {&(0x7f0000000240)="da567424ab239b21", 0x8}], 0x2, 0x200103, 0x4) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(0xffffffffffffffff, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) 137.878603ms ago: executing program 4 (id=5047): openat$autofs(0xffffffffffffff9c, 0x0, 0x40100, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0xa80, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) (async) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) (async) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x2, 0x2, 0x0, 0x3, 0xfffffffdffffffff, 0x10000000c, 0x0, 0x2}, 0x0) (async) io_setup(0x8, &(0x7f0000000040)) (async) r2 = epoll_create1(0x0) fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) (async) ioctl$SW_SYNC_IOC_INC(0xffffffffffffffff, 0x40045701, &(0x7f0000000080)=0x10) (async) r3 = socket$can_j1939(0x1d, 0x2, 0x7) syz_open_dev$usbfs(&(0x7f0000000140), 0xee6, 0x101301) (async) bind$can_j1939(r3, 0x0, 0x0) (async, rerun: 32) r4 = socket$igmp(0x2, 0x3, 0x2) (rerun: 32) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000280)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_b, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @val={0x6, 0x2, 0x3}, @void, @val={0x25, 0x3, {0x0, 0x6, 0x4}}, @val={0x2a, 0x1, {0x1, 0x1}}, @val={0x3c, 0x4, {0x0, 0x3d, 0xab, 0x5}}, @val={0x2d, 0x1a, {0x1350, 0x3, 0x1, 0x0, {0x5, 0x1009, 0x0, 0x6, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x400, 0x4, 0x5}}, @void, @val={0x71, 0x7, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0x21}}, @void}, 0x5b) (async) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f0000000340)={0x0, 0x1, 0x0, 0x0, @vifc_lcl_ifindex, @private}, 0x10) (async) unshare(0x60040400) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000070000000900010073797a300000000084000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000838001180090001006c61737400000000280002800c00024000000000000000090800014000000ba308000140000010000800014000003f5e980000000c0a010100000000000000000700000009f9f40073797a31000000000900010073797a30000000006c0003806800008008000340000000025c0002800c00028008000340000000024c000280080003400000000408000180fffffffd"], 0x164}, 0x1, 0x0, 0x0, 0x4000819}, 0x8000) 0s ago: executing program 4 (id=5048): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') open_by_handle_at(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="20000000f1000000010000000000000000000004"], 0x0) kernel console output (not intermixed with test programs): dummy_hcd [ 1333.709307][T23117] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4486'. [ 1334.072211][T16987] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1334.135238][T16987] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1334.209531][T23083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1334.221251][ T9] logitech 0003:046D:C218.0036: unknown main item tag 0x0 [ 1334.232876][T16987] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1334.242351][T23083] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1334.380040][ T9] logitech 0003:046D:C218.0036: hidraw0: USB HID v0.00 Device [HID 046d:c218] on usb-dummy_hcd.1-1/input0 [ 1334.414069][T16987] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1334.422642][ T9] logitech 0003:046D:C218.0036: no inputs found [ 1334.439808][ T5892] usb 4-1: config 0 has an invalid interface number: 160 but max is 0 [ 1334.880410][T16987] usb 6-1: config 0 descriptor?? [ 1335.044114][ T5892] usb 4-1: config 0 has no interface number 0 [ 1335.051807][ T5892] usb 4-1: config 0 interface 160 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1335.068676][ T5892] usb 4-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=9e.4e [ 1335.078002][ T5892] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1335.086681][ T5892] usb 4-1: Product: syz [ 1335.091069][ T5892] usb 4-1: Manufacturer: syz [ 1335.095662][ T5892] usb 4-1: SerialNumber: syz [ 1335.115854][ T5892] usb 4-1: config 0 descriptor?? [ 1335.289145][T23118] Unsupported ieee802154 address type: 0 [ 1335.471437][ T5892] usb 4-1: Found UVC 0.00 device syz (05ac:8501) [ 1335.477806][ T5892] usb 4-1: No valid video chain found. [ 1335.591468][ T943] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 1335.749671][ T943] usb 5-1: Using ep0 maxpacket: 32 [ 1335.756003][ T943] usb 5-1: too many configurations: 140, using maximum allowed: 8 [ 1335.766199][ T943] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1335.774096][ T943] usb 5-1: can't read configurations, error -61 [ 1335.853309][ T5891] usb 4-1: USB disconnect, device number 115 [ 1335.859325][ T5892] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1335.894409][T16987] uclogic 0003:256C:006D.0037: interface is invalid, ignoring [ 1335.920634][ T943] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 1336.029744][ T5892] usb 3-1: Using ep0 maxpacket: 16 [ 1336.041198][ T5892] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1336.064993][ T5892] usb 3-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice= 0.5a [ 1336.079687][ T943] usb 5-1: Using ep0 maxpacket: 32 [ 1336.087194][ T943] usb 5-1: too many configurations: 140, using maximum allowed: 8 [ 1336.098104][ T5892] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1336.149771][ T943] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1336.174055][ T5892] usb 3-1: config 0 descriptor?? [ 1336.181984][ T943] usb 5-1: can't read configurations, error -61 [ 1336.213990][ T943] usb usb5-port1: attempt power cycle [ 1336.222034][ T5892] pegasus_notetaker 3-1:0.0: Invalid number of endpoints [ 1336.235508][ T5892] pegasus_notetaker 3-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 1336.286391][ T5892] usb 6-1: USB disconnect, device number 6 [ 1336.344163][ T5891] usb 2-1: USB disconnect, device number 2 [ 1336.579851][ T943] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 1336.636293][ T943] usb 5-1: Using ep0 maxpacket: 32 [ 1336.656607][ T943] usb 5-1: too many configurations: 140, using maximum allowed: 8 [ 1336.673757][ T30] audit: type=1400 audit(1336.626:2535): avc: denied { create } for pid=23146 comm="syz.1.4492" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 1336.704630][T23148] openvswitch: netlink: IP tunnel dst address not specified [ 1336.708855][ T30] audit: type=1400 audit(1336.676:2536): avc: denied { write } for pid=23146 comm="syz.1.4492" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1336.749355][T23148] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4493'. [ 1336.759826][ T943] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1336.784586][ T943] usb 5-1: can't read configurations, error -61 [ 1336.939713][ T943] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1336.971542][ T943] usb 5-1: Using ep0 maxpacket: 32 [ 1337.001500][ T943] usb 5-1: too many configurations: 140, using maximum allowed: 8 [ 1337.423763][ T943] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1337.432559][ T943] usb 5-1: can't read configurations, error -71 [ 1337.443644][ T943] usb usb5-port1: unable to enumerate USB device [ 1338.314170][T23174] kernel read not supported for file /eth0 (pid: 23174 comm: syz.5.4500) [ 1338.420455][ T30] audit: type=1800 audit(1338.306:2537): pid=23174 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.4500" name="eth0" dev="mqueue" ino=77507 res=0 errno=0 [ 1338.640895][ T943] usb 3-1: USB disconnect, device number 116 [ 1338.741219][T23185] Bluetooth: MGMT ver 1.23 [ 1340.740453][ T943] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 1340.983124][ T943] usb 4-1: Using ep0 maxpacket: 32 [ 1341.018636][ T943] usb 4-1: too many configurations: 140, using maximum allowed: 8 [ 1341.052252][ T943] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1341.120457][ T943] usb 4-1: can't read configurations, error -61 [ 1341.163714][ T30] audit: type=1400 audit(1341.126:2538): avc: denied { read write } for pid=23203 comm="syz.2.4509" name="file0" dev="tmpfs" ino=1226 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1341.268107][ T30] audit: type=1400 audit(1341.136:2539): avc: denied { open } for pid=23203 comm="syz.2.4509" path="/229/file0" dev="tmpfs" ino=1226 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1341.349719][ T943] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 1341.514410][T23214] netlink: 5 bytes leftover after parsing attributes in process `syz.1.4513'. [ 1341.910072][ T943] usb 4-1: Using ep0 maxpacket: 32 [ 1342.014998][T23226] netlink: 'syz.1.4513': attribute type 12 has an invalid length. [ 1342.880725][ T943] usb 4-1: too many configurations: 140, using maximum allowed: 8 [ 1343.001395][ T943] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1343.008987][ T943] usb 4-1: can't read configurations, error -61 [ 1343.040301][ T943] usb usb4-port1: attempt power cycle [ 1343.145189][T23236] NILFS (loop4): device size too small [ 1345.769830][ T5892] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 1346.004746][ T5892] usb 3-1: config 1 has an invalid interface number: 7 but max is 0 [ 1346.049826][ T943] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1346.155838][ T5892] usb 3-1: config 1 has no interface number 0 [ 1346.168847][ T30] audit: type=1400 audit(1346.136:2540): avc: denied { compute_member } for pid=23278 comm="syz.4.4529" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 1346.197233][ T5892] usb 3-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1346.220389][T23280] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 1346.226891][T23280] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1346.234523][T23280] vhci_hcd vhci_hcd.0: Device attached [ 1346.245967][T23282] vhci_hcd: connection closed [ 1346.258151][ T12] vhci_hcd: stop threads [ 1346.263285][ T5892] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1346.270121][ T12] vhci_hcd: release socket [ 1346.279014][ T5892] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 1346.283385][ T12] vhci_hcd: disconnect device [ 1346.295890][ T5892] usb 3-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1346.329403][T23285] NILFS (loop3): device size too small [ 1346.329772][ T943] usb 6-1: Using ep0 maxpacket: 32 [ 1346.362278][ T943] usb 6-1: too many configurations: 140, using maximum allowed: 8 [ 1346.376167][ T5892] usb 3-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1346.388944][ T5892] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1346.398739][ T943] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1346.406527][ T5892] usb 3-1: Product: syz [ 1346.412804][ T943] usb 6-1: can't read configurations, error -61 [ 1346.419124][ T5892] usb 3-1: Manufacturer: syz [ 1346.427540][ T5892] usb 3-1: SerialNumber: syz [ 1346.437971][ T30] audit: type=1400 audit(1346.396:2541): avc: denied { create } for pid=23286 comm="syz.1.4531" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1346.457750][T23274] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1346.465709][T23274] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1346.479220][ T30] audit: type=1400 audit(1346.406:2542): avc: denied { ioctl } for pid=23286 comm="syz.1.4531" path="socket:[77713]" dev="sockfs" ino=77713 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1346.508724][ T30] audit: type=1400 audit(1346.446:2543): avc: denied { ioctl } for pid=23286 comm="syz.1.4531" path="user:[4026531837]" dev="nsfs" ino=4026531837 ioctlcmd=0x9402 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1346.564510][ T943] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1346.966444][ T30] audit: type=1400 audit(1346.556:2544): avc: denied { read append } for pid=23288 comm="syz.3.4532" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1347.048622][T23293] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4527'. [ 1347.060099][T23293] netlink: 92 bytes leftover after parsing attributes in process `syz.2.4527'. [ 1347.117423][T23294] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1347.124729][T23294] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1347.365343][ T30] audit: type=1400 audit(1346.556:2545): avc: denied { open } for pid=23288 comm="syz.3.4532" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1347.369754][ T5892] usb 3-1: Incompatible driver and firmware versions [ 1347.464545][T23300] random: crng reseeded on system resumption [ 1347.465766][ T30] audit: type=1400 audit(1347.436:2546): avc: denied { append } for pid=23299 comm="syz.3.4535" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1347.560851][ T30] audit: type=1400 audit(1347.436:2547): avc: denied { open } for pid=23299 comm="syz.3.4535" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1347.657116][ T943] usb 6-1: Using ep0 maxpacket: 32 [ 1347.668032][ T943] usb 6-1: too many configurations: 140, using maximum allowed: 8 [ 1347.693429][ T943] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1347.705619][ T943] usb 6-1: can't read configurations, error -61 [ 1348.790459][ T30] audit: type=1400 audit(1348.756:2548): avc: denied { write } for pid=23299 comm="syz.3.4535" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1349.802940][ T5823] usb 3-1: USB disconnect, device number 117 [ 1349.814647][ T30] audit: type=1400 audit(1348.796:2549): avc: denied { ioctl } for pid=23299 comm="syz.3.4535" path="/dev/snapshot" dev="devtmpfs" ino=92 ioctlcmd=0x3312 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1350.078589][ T943] usb usb6-port1: attempt power cycle [ 1350.483780][T23317] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4537'. [ 1352.122112][T23337] : renamed from bridge_slave_0 (while UP) [ 1352.141807][T16987] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1352.709965][T16987] usb 2-1: Using ep0 maxpacket: 32 [ 1352.802148][T16987] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 1352.830586][T16987] usb 2-1: config 0 has no interface number 0 [ 1352.839533][T16987] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1353.055727][T16987] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1353.085757][T16987] usb 2-1: Product: syz [ 1353.099827][T16987] usb 2-1: Manufacturer: syz [ 1353.109723][T16987] usb 2-1: SerialNumber: syz [ 1353.135136][T16987] usb 2-1: config 0 descriptor?? [ 1353.172049][T16987] smsc95xx v2.0.0 [ 1353.176250][T16987] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1353.230306][T16987] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -22 [ 1354.050238][ T5891] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 1354.138286][T23357] netlink: 220 bytes leftover after parsing attributes in process `syz.5.4548'. [ 1354.149075][T23357] netlink: 220 bytes leftover after parsing attributes in process `syz.5.4548'. [ 1354.185062][T23357] lo: entered allmulticast mode [ 1354.200156][T23357] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1354.251946][ T5891] usb 4-1: Using ep0 maxpacket: 32 [ 1354.370271][ T5891] usb 4-1: too many configurations: 140, using maximum allowed: 8 [ 1354.416165][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 1354.416180][ T30] audit: type=1400 audit(1354.376:2551): avc: denied { create } for pid=23358 comm="syz.4.4549" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1354.514782][T20614] usb 2-1: USB disconnect, device number 3 [ 1354.523064][ T5891] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1354.549894][ T5891] usb 4-1: can't read configurations, error -61 [ 1354.716091][ T5891] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 1354.789252][T23370] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.4551'. [ 1355.015295][ T30] audit: type=1400 audit(1354.806:2552): avc: denied { listen } for pid=23367 comm="syz.1.4551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1355.039665][T16987] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 1355.077757][ T30] audit: type=1400 audit(1354.816:2553): avc: denied { setopt } for pid=23367 comm="syz.1.4551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1355.199683][ T5891] usb 4-1: Using ep0 maxpacket: 32 [ 1355.219058][ T5891] usb 4-1: too many configurations: 140, using maximum allowed: 8 [ 1355.219968][T16987] usb 3-1: Using ep0 maxpacket: 32 [ 1355.252198][T16987] usb 3-1: too many configurations: 140, using maximum allowed: 8 [ 1355.274220][ T5891] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1355.299007][T23378] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4553'. [ 1355.311295][T16987] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1355.318987][T16987] usb 3-1: can't read configurations, error -61 [ 1355.325311][ T5891] usb 4-1: can't read configurations, error -61 [ 1355.381160][ T5891] usb usb4-port1: attempt power cycle [ 1355.469998][T16987] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 1355.649787][T16987] usb 3-1: Using ep0 maxpacket: 32 [ 1355.661424][T16987] usb 3-1: too many configurations: 140, using maximum allowed: 8 [ 1355.696482][T16987] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1355.709481][T16987] usb 3-1: can't read configurations, error -61 [ 1355.716346][T16987] usb usb3-port1: attempt power cycle [ 1355.739861][ T5891] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 1355.801224][ T5891] usb 4-1: Using ep0 maxpacket: 32 [ 1355.807430][ T5891] usb 4-1: too many configurations: 140, using maximum allowed: 8 [ 1355.886027][ T5891] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1355.909714][ T5891] usb 4-1: can't read configurations, error -61 [ 1355.938227][ T943] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1356.069911][T16987] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 1356.079701][ T5891] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 1356.091549][T16987] usb 3-1: Using ep0 maxpacket: 32 [ 1356.097304][T16987] usb 3-1: too many configurations: 140, using maximum allowed: 8 [ 1356.100527][ T5891] usb 4-1: Using ep0 maxpacket: 32 [ 1356.108832][T16987] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1356.111595][ T5891] usb 4-1: too many configurations: 140, using maximum allowed: 8 [ 1356.118870][ T5823] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1356.136009][T16987] usb 3-1: can't read configurations, error -61 [ 1356.152854][ T943] usb 6-1: New USB device found, idVendor=046d, idProduct=c218, bcdDevice= 0.00 [ 1356.162017][ T943] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1356.184571][ T5891] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1356.196491][ T943] usb 6-1: config 0 descriptor?? [ 1356.201620][ T5891] usb 4-1: can't read configurations, error -61 [ 1356.222849][ T5891] usb usb4-port1: unable to enumerate USB device [ 1356.279911][T16987] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 1356.300983][ T5823] usb 2-1: config 0 has no interfaces? [ 1356.306459][ T5823] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1356.316528][T16987] usb 3-1: Using ep0 maxpacket: 32 [ 1356.329718][T16987] usb 3-1: too many configurations: 140, using maximum allowed: 8 [ 1356.415532][ T5823] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1356.434739][T16987] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1356.470102][T16987] usb 3-1: can't read configurations, error -61 [ 1356.479725][ T5823] usb 2-1: config 0 descriptor?? [ 1356.487924][T16987] usb usb3-port1: unable to enumerate USB device [ 1356.515217][T23399] NILFS (loop3): device size too small [ 1356.635157][ T943] logitech 0003:046D:C218.0038: unknown main item tag 0x0 [ 1356.646318][ T943] logitech 0003:046D:C218.0038: hidraw0: USB HID v0.00 Device [HID 046d:c218] on usb-dummy_hcd.5-1/input0 [ 1356.662937][ T943] logitech 0003:046D:C218.0038: no inputs found [ 1356.833375][T16987] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 1357.132358][T16987] usb 4-1: Using ep0 maxpacket: 8 [ 1357.138351][T23391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1357.293452][T16987] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 1357.363814][T23391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1357.371063][T23405] netlink: 5 bytes leftover after parsing attributes in process `syz.4.4564'. [ 1357.389027][T16987] usb 4-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 1357.431898][ T30] audit: type=1400 audit(2000000001.850:2554): avc: denied { ioctl } for pid=23404 comm="syz.4.4564" path="socket:[78286]" dev="sockfs" ino=78286 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1357.466508][T16987] usb 4-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 1357.498150][T16987] usb 4-1: Product: syz [ 1357.520108][T23405] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4564'. [ 1357.524945][T16987] usb 4-1: Manufacturer: syz [ 1357.778380][T16987] usb 4-1: SerialNumber: syz [ 1358.102236][T16987] usb 4-1: Invalid connection information received from device [ 1358.497161][T23426] FAULT_INJECTION: forcing a failure. [ 1358.497161][T23426] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1358.512556][T23426] CPU: 0 UID: 0 PID: 23426 Comm: syz.2.4569 Not tainted syzkaller #0 PREEMPT(full) [ 1358.512582][T23426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1358.512593][T23426] Call Trace: [ 1358.512599][T23426] [ 1358.512606][T23426] dump_stack_lvl+0x16c/0x1f0 [ 1358.512635][T23426] should_fail_ex+0x512/0x640 [ 1358.512660][T23426] _copy_from_user+0x2e/0xd0 [ 1358.512684][T23426] io_submit_one+0xbb/0x1df0 [ 1358.512705][T23426] ? __lock_acquire+0xb97/0x1ce0 [ 1358.512727][T23426] ? __pfx_io_submit_one+0x10/0x10 [ 1358.512755][T23426] ? __might_fault+0xe3/0x190 [ 1358.512778][T23426] ? __might_fault+0x13b/0x190 [ 1358.512807][T23426] ? __x64_sys_io_submit+0x1a9/0x350 [ 1358.512826][T23426] __x64_sys_io_submit+0x1a9/0x350 [ 1358.512847][T23426] ? __pfx___x64_sys_io_submit+0x10/0x10 [ 1358.512880][T23426] do_syscall_64+0xcd/0x4e0 [ 1358.512905][T23426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1358.512924][T23426] RIP: 0033:0x7fe389b8eec9 [ 1358.512939][T23426] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1358.512956][T23426] RSP: 002b:00007fe38a9b1038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 1358.512973][T23426] RAX: ffffffffffffffda RBX: 00007fe389de5fa0 RCX: 00007fe389b8eec9 [ 1358.512984][T23426] RDX: 0000200000000100 RSI: 0000000000000001 RDI: 00007fe38a990000 [ 1358.512996][T23426] RBP: 00007fe38a9b1090 R08: 0000000000000000 R09: 0000000000000000 [ 1358.513006][T23426] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1358.513017][T23426] R13: 00007fe389de6038 R14: 00007fe389de5fa0 R15: 00007ffdee9859f8 [ 1358.513041][T23426] [ 1359.207105][ T30] audit: type=1400 audit(2000000003.340:2555): avc: denied { name_bind } for pid=23417 comm="syz.4.4567" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 1359.240911][ T30] audit: type=1400 audit(2000000003.340:2556): avc: denied { node_bind } for pid=23417 comm="syz.4.4567" saddr=fe80::aa src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 1359.265268][T20614] usb 2-1: USB disconnect, device number 4 [ 1359.448675][ T5823] usb 6-1: USB disconnect, device number 10 [ 1360.098319][T23440] NILFS (loop1): device size too small [ 1360.099735][ T5823] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1360.319705][ T5823] usb 6-1: Using ep0 maxpacket: 32 [ 1360.373380][ T5823] usb 6-1: config 0 has an invalid interface number: 85 but max is 0 [ 1360.442477][ T5823] usb 6-1: config 0 has no interface number 0 [ 1360.477364][ T5823] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1360.617802][ T5823] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1360.638053][ T5823] usb 6-1: config 0 interface 85 has no altsetting 0 [ 1360.646808][ T5823] usb 6-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1360.698753][ T5823] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1360.714006][ T5953] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1360.722661][ T5823] usb 6-1: Product: syz [ 1360.740265][ T5823] usb 6-1: Manufacturer: syz [ 1360.747703][ T5832] Bluetooth: hci2: unexpected event for opcode 0x1004 [ 1360.755439][ T5953] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1360.766301][ T5823] usb 6-1: SerialNumber: syz [ 1360.813541][ T5823] usb 6-1: config 0 descriptor?? [ 1360.899890][T16987] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 1361.081440][T16987] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1361.098732][T16987] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1361.113845][T16987] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1361.138001][T16987] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1361.149439][T16987] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1361.303040][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.579733][ T5823] appletouch 6-1:0.85: Geyser mode initialized. [ 1361.588185][ T5823] input: appletouch as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.85/input/input38 [ 1361.607818][T16987] usb 3-1: config 0 descriptor?? [ 1361.723063][ T5823] usb 6-1: USB disconnect, device number 11 [ 1361.792604][ T5823] appletouch 6-1:0.85: input: appletouch disconnected [ 1362.112970][ T5891] usb 4-1: USB disconnect, device number 123 [ 1362.238749][ T30] audit: type=1400 audit(2000000006.650:2557): avc: denied { open } for pid=23451 comm="syz.2.4576" path="/dev/ptyq9" dev="devtmpfs" ino=127 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 1362.304974][ T30] audit: type=1400 audit(2000000006.720:2558): avc: denied { ioctl } for pid=23451 comm="syz.2.4576" path="/dev/ptyq9" dev="devtmpfs" ino=127 ioctlcmd=0x5438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 1362.399731][T20614] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 1362.442072][T23480] netlink: 4400 bytes leftover after parsing attributes in process `syz.4.4580'. [ 1362.581288][T20614] usb 2-1: New USB device found, idVendor=046d, idProduct=c218, bcdDevice= 0.00 [ 1362.591506][T20614] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1362.604839][T20614] usb 2-1: config 0 descriptor?? [ 1362.619828][ T5823] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1362.692804][T23485] NILFS (loop3): device size too small [ 1362.732820][T16987] usbhid 3-1:0.0: can't add hid device: -71 [ 1362.738959][T16987] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1362.807628][ T5823] usb 6-1: Using ep0 maxpacket: 32 [ 1362.832619][ T5823] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1362.849001][T16987] usb 3-1: USB disconnect, device number 122 [ 1362.859560][ T5823] usb 6-1: config 0 has no interface number 0 [ 1362.911530][ T5823] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1362.940911][ T5823] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1362.953272][ T5823] usb 6-1: Product: syz [ 1362.963864][ T5823] usb 6-1: Manufacturer: syz [ 1362.968477][ T5823] usb 6-1: SerialNumber: syz [ 1362.977788][ T5823] usb 6-1: config 0 descriptor?? [ 1363.004452][ T5823] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1363.032123][ T5823] usb 6-1: selecting invalid altsetting 1 [ 1363.041960][ T5823] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1363.046490][T20614] logitech 0003:046D:C218.0039: unknown main item tag 0x0 [ 1363.094031][T20614] logitech 0003:046D:C218.0039: hidraw0: USB HID v0.00 Device [HID 046d:c218] on usb-dummy_hcd.1-1/input0 [ 1363.094249][ T5823] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1363.136043][T20614] logitech 0003:046D:C218.0039: no inputs found [ 1363.162905][ T5823] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1363.209660][ T5823] usb 6-1: media controller created [ 1363.254101][T23464] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1363.284042][T23464] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1363.287182][ T5823] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1363.323640][ T30] audit: type=1400 audit(2000000007.720:2559): avc: denied { create } for pid=23494 comm="syz.3.4589" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1363.331507][T23498] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1363.430583][ T30] audit: type=1400 audit(2000000007.720:2560): avc: denied { ioctl } for pid=23494 comm="syz.3.4589" path="socket:[79355]" dev="sockfs" ino=79355 ioctlcmd=0x8b2c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1363.579323][ T30] audit: type=1400 audit(2000000007.980:2561): avc: denied { connect } for pid=23494 comm="syz.3.4589" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1363.599153][ C1] vkms_vblank_simulate: vblank timer overrun [ 1363.665427][ T5832] Bluetooth: hci6: unexpected event 0x10 length: 11 > 1 [ 1363.667161][ T5832] Bluetooth: hci6: hardware error 0x40 [ 1363.699199][T23514] Unsupported ieee802154 address type: 0 [ 1364.615120][ T5823] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1364.671156][ T5823] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1364.823892][T21283] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 1364.843819][T21283] Bluetooth: hci2: Injecting HCI hardware error event [ 1364.854935][T21283] Bluetooth: hci2: hardware error 0x00 [ 1365.167035][ T5891] usb 2-1: USB disconnect, device number 5 [ 1365.290640][T23533] netlink: 80 bytes leftover after parsing attributes in process `syz.1.4596'. [ 1365.367641][T23536] afs: Unknown parameter 'd' [ 1366.137911][ T30] audit: type=1400 audit(2000000009.830:2562): avc: denied { create } for pid=23534 comm="syz.4.4597" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 1366.169768][ T5832] Bluetooth: hci6: Opcode 0x0c03 failed: -110 [ 1366.234581][ T5823] usb 6-1: USB disconnect, device number 12 [ 1366.726695][T23555] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4598'. [ 1366.958180][T21283] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 1367.053147][ T5891] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1367.235581][T23556] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4601'. [ 1367.412747][ T5891] usb 5-1: Using ep0 maxpacket: 32 [ 1367.457375][ T5891] usb 5-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1367.485920][ T30] audit: type=1400 audit(2000000011.890:2563): avc: denied { append } for pid=23563 comm="syz.2.4606" name="loop5" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1367.533945][ T5891] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1367.554016][ T5891] usb 5-1: config 0 descriptor?? [ 1367.584575][ T5891] as10x_usb: device has been detected [ 1367.606743][ T5891] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1367.668909][ T5891] usb 5-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1367.906261][T20614] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 1367.914371][T22853] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 1367.929723][ T30] audit: type=1400 audit(2000000012.340:2564): avc: denied { firmware_load } for pid=5891 comm="kworker/1:3" path="/lib/firmware/as102_data1_st.hex" dev="sda1" ino=297 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 1367.957041][ T5891] as10x_usb: error during firmware upload part1 [ 1368.019735][ T5823] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1368.411009][ T5891] Registered device nBox DVB-T Dongle [ 1368.452405][T23573] Context (ID=0x0) not attached to queue pair (handle=0x1:0xfffffffa) [ 1368.489655][T22853] usb 4-1: Using ep0 maxpacket: 16 [ 1368.495442][T20614] usb 3-1: Using ep0 maxpacket: 32 [ 1368.502773][T20614] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1368.514522][T20614] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1368.521025][ T5823] usb 2-1: New USB device found, idVendor=046d, idProduct=c218, bcdDevice= 0.00 [ 1368.525304][T20614] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1368.543495][T20614] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1368.550371][ T5823] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1368.552758][T22853] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1368.568953][T22853] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1368.578393][T22853] usb 4-1: Product: syz [ 1368.583804][T20614] usb 3-1: config 0 descriptor?? [ 1368.592231][T22853] usb 4-1: Manufacturer: syz [ 1368.603333][T20614] hub 3-1:0.0: USB hub found [ 1368.607058][ T5823] usb 2-1: config 0 descriptor?? [ 1368.618311][T22853] usb 4-1: SerialNumber: syz [ 1368.636956][T22853] usb 4-1: config 0 descriptor?? [ 1368.794936][T20614] hub 3-1:0.0: 1 port detected [ 1369.036828][ T9] usb 4-1: USB disconnect, device number 124 [ 1369.057994][ T5823] logitech 0003:046D:C218.003A: unknown main item tag 0x0 [ 1369.462801][T23571] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1369.478304][T16987] usb 5-1: USB disconnect, device number 86 [ 1369.482371][T23571] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1369.533575][ T5823] logitech 0003:046D:C218.003A: hidraw0: USB HID v0.00 Device [HID 046d:c218] on usb-dummy_hcd.1-1/input0 [ 1369.567029][T16987] Unregistered device nBox DVB-T Dongle [ 1369.568136][ T5823] logitech 0003:046D:C218.003A: no inputs found [ 1369.580743][T16987] as10x_usb: device has been disconnected [ 1369.874668][T22853] hub 3-1:0.0: activate --> -90 [ 1370.016151][T23587] Unsupported ieee802154 address type: 0 [ 1370.278825][ T30] audit: type=1326 audit(2000000014.690:2565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23563 comm="syz.2.4606" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe389b8eec9 code=0x0 [ 1370.310065][ T30] audit: type=1400 audit(2000000014.720:2566): avc: denied { map } for pid=23590 comm="syz.3.4611" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1371.448562][T16987] usb 2-1: USB disconnect, device number 6 [ 1371.588592][T22853] hub 3-1:0.0: hub_ext_port_status failed (err = -32) [ 1371.603147][T22853] usb 3-1-port1: config error [ 1371.614536][T22853] usb 3-1-port1: cannot disable (err = -32) [ 1371.635083][T22853] hub 3-1:0.0: hub_ext_port_status failed (err = -32) [ 1371.715499][T22853] usb 3-1-port1: connect-debounce failed [ 1371.934014][T23593] syz.3.4611 (23593): drop_caches: 2 [ 1372.015130][T23618] Context (ID=0x0) not attached to queue pair (handle=0x1:0xfffffffa) [ 1372.196999][T22853] usb 3-1: USB disconnect, device number 123 [ 1372.930340][ T30] audit: type=1400 audit(2000000017.350:2567): avc: denied { write } for pid=23632 comm="syz.1.4622" name="sg0" dev="devtmpfs" ino=752 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1372.997403][ T30] audit: type=1400 audit(2000000017.350:2568): avc: denied { ioctl } for pid=23632 comm="syz.1.4622" path="/dev/sg0" dev="devtmpfs" ino=752 ioctlcmd=0x2285 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1373.299539][T23639] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=30235 sclass=netlink_xfrm_socket pid=23639 comm=syz.3.4623 [ 1373.403583][T23641] Context (ID=0x0) not attached to queue pair (handle=0x1:0xfffffffa) [ 1373.480011][ T5832] Bluetooth: hci0: command 0x0405 tx timeout [ 1374.268594][T23652] binder: 23647:23652 ioctl c0306201 0 returned -14 [ 1374.867549][T23657] audit: audit_lost=2 audit_rate_limit=0 audit_backlog_limit=64 [ 1374.867598][T23657] audit: out of memory in audit_log_start [ 1376.956788][ T30] audit: type=1400 audit(2000000021.350:2569): avc: denied { create } for pid=23669 comm="syz.4.4631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1376.956837][ T30] audit: type=1400 audit(2000000021.360:2570): avc: denied { ioctl } for pid=23669 comm="syz.4.4631" path="socket:[79949]" dev="sockfs" ino=79949 ioctlcmd=0x89e7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1376.956876][ T30] audit: type=1400 audit(2000000021.360:2571): avc: denied { write } for pid=23669 comm="syz.4.4631" path="socket:[79602]" dev="sockfs" ino=79602 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1377.684564][T23679] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4633'. [ 1377.704585][T23679] syzkaller1: entered promiscuous mode [ 1377.778376][ T30] audit: type=1400 audit(2000000022.200:2572): avc: denied { setopt } for pid=23669 comm="syz.4.4631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1377.974676][T23679] syzkaller1: entered allmulticast mode [ 1378.231156][T23685] C: renamed from team_slave_0 (while UP) [ 1378.307288][T23685] netlink: 'syz.1.4634': attribute type 3 has an invalid length. [ 1378.307325][T23685] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4634'. [ 1378.314232][T23685] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1379.405131][ T30] audit: type=1400 audit(2000000023.820:2573): avc: denied { connect } for pid=23698 comm="syz.5.4639" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1379.405181][ T30] audit: type=1400 audit(2000000023.820:2574): avc: denied { bind } for pid=23698 comm="syz.5.4639" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1379.467787][T22853] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 1379.467892][T22853] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 1379.467914][T22853] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 1379.467931][T22853] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 1379.467943][T22853] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 1379.467956][T22853] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 1379.467968][T22853] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 1379.467981][T22853] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 1379.467993][T22853] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 1379.468006][T22853] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 1379.486292][T22853] hid-generic 0000:0000:0000.003B: hidraw0: HID v0.00 Device []ê QÖ~µ¶{”œ¥o»a÷‚šðR¥º‹Â¼±¨Ý«YlÉû¾³C¡LæÔ®(Ó] on pA‹¸…mÓótŒÉs®îÒvfØÙ'Ô_pê'°1­ž [ 1379.570900][T23697] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4638'. [ 1379.754517][T23704] fido_id[23704]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1379.973300][T23716] netlink: 80 bytes leftover after parsing attributes in process `syz.2.4643'. [ 1380.016238][T23715] NILFS (loop4): device size too small [ 1380.510063][T16987] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 1380.659703][T16987] usb 3-1: Using ep0 maxpacket: 8 [ 1380.665165][T16987] usb 3-1: config 0 has no interfaces? [ 1380.674354][T16987] usb 3-1: New USB device found, idVendor=19d2, idProduct=0069, bcdDevice=e8.67 [ 1380.674414][T16987] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1380.674462][T16987] usb 3-1: Product: syz [ 1380.674505][T16987] usb 3-1: Manufacturer: syz [ 1380.674551][T16987] usb 3-1: SerialNumber: syz [ 1380.884264][T16987] usb 3-1: config 0 descriptor?? [ 1380.909855][T22853] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1381.057746][T23730] FAULT_INJECTION: forcing a failure. [ 1381.057746][T23730] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1381.057776][T23730] CPU: 0 UID: 0 PID: 23730 Comm: syz.5.4648 Not tainted syzkaller #0 PREEMPT(full) [ 1381.057797][T23730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1381.057808][T23730] Call Trace: [ 1381.057814][T23730] [ 1381.057822][T23730] dump_stack_lvl+0x16c/0x1f0 [ 1381.057849][T23730] should_fail_ex+0x512/0x640 [ 1381.057875][T23730] _copy_from_user+0x2e/0xd0 [ 1381.057899][T23730] copy_msghdr_from_user+0x98/0x160 [ 1381.057922][T23730] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1381.057957][T23730] ___sys_sendmsg+0xfe/0x1d0 [ 1381.057985][T23730] ? __pfx____sys_sendmsg+0x10/0x10 [ 1381.058039][T23730] __sys_sendmsg+0x16d/0x220 [ 1381.058063][T23730] ? __pfx___sys_sendmsg+0x10/0x10 [ 1381.058103][T23730] do_syscall_64+0xcd/0x4e0 [ 1381.058129][T23730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1381.058148][T23730] RIP: 0033:0x7f364cd8eec9 [ 1381.058162][T23730] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1381.058178][T23730] RSP: 002b:00007f364db9a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1381.058195][T23730] RAX: ffffffffffffffda RBX: 00007f364cfe5fa0 RCX: 00007f364cd8eec9 [ 1381.058207][T23730] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000004 [ 1381.058218][T23730] RBP: 00007f364db9a090 R08: 0000000000000000 R09: 0000000000000000 [ 1381.058229][T23730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1381.058239][T23730] R13: 00007f364cfe6038 R14: 00007f364cfe5fa0 R15: 00007ffeda6652d8 [ 1381.058263][T23730] [ 1381.113651][T23696] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 1382.076172][T21283] Bluetooth: hci0: command 0x0405 tx timeout [ 1382.580898][T23756] Context (ID=0x0) not attached to queue pair (handle=0x1:0xfffffffa) [ 1383.275769][T22853] usb 3-1: USB disconnect, device number 124 [ 1383.289183][T23761] netlink: 'syz.5.4655': attribute type 1 has an invalid length. [ 1383.344887][T23761] bond1: entered promiscuous mode [ 1383.345177][T23761] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1383.651518][T23773] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4658'. [ 1383.796578][T23774] overlayfs: failed lookup in lower (newroot/60, name='bus', err=-40): overlapping layers [ 1383.915466][T23774] netlink: 1004 bytes leftover after parsing attributes in process `syz.5.4655'. [ 1383.981338][T23765] overlayfs: failed lookup in lower (newroot/60, name='file0', err=-40): overlapping layers [ 1384.797022][T23784] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4662'. [ 1384.876208][T23785] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1385.441040][T16987] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 1385.590238][T16987] usb 2-1: Using ep0 maxpacket: 8 [ 1385.594528][T16987] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1385.594581][T16987] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1385.594602][T16987] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1385.594625][T16987] usb 2-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1385.594645][T16987] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1385.594679][T16987] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1385.594699][T16987] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1385.621041][T16987] usbtmc 2-1:16.0: bulk endpoints not found [ 1386.743138][T21283] Bluetooth: hci1: Malformed LE Event: 0x0b [ 1387.959924][T16987] usb 2-1: USB disconnect, device number 7 [ 1388.022703][T23821] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4668'. [ 1388.147638][T23825] FAULT_INJECTION: forcing a failure. [ 1388.147638][T23825] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1388.147662][T23825] CPU: 1 UID: 0 PID: 23825 Comm: syz.1.4670 Not tainted syzkaller #0 PREEMPT(full) [ 1388.147675][T23825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1388.147682][T23825] Call Trace: [ 1388.147686][T23825] [ 1388.147691][T23825] dump_stack_lvl+0x16c/0x1f0 [ 1388.147710][T23825] should_fail_ex+0x512/0x640 [ 1388.147727][T23825] _copy_from_user+0x2e/0xd0 [ 1388.147744][T23825] copy_msghdr_from_user+0x98/0x160 [ 1388.147760][T23825] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1388.147781][T23825] ___sys_sendmsg+0xfe/0x1d0 [ 1388.147795][T23825] ? __pfx____sys_sendmsg+0x10/0x10 [ 1388.147826][T23825] __sys_sendmsg+0x16d/0x220 [ 1388.147840][T23825] ? __pfx___sys_sendmsg+0x10/0x10 [ 1388.147859][T23825] ? fput+0x9b/0xd0 [ 1388.147879][T23825] do_syscall_64+0xcd/0x4e0 [ 1388.147896][T23825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1388.147907][T23825] RIP: 0033:0x7f406958eec9 [ 1388.147916][T23825] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1388.147927][T23825] RSP: 002b:00007f40677f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1388.147938][T23825] RAX: ffffffffffffffda RBX: 00007f40697e5fa0 RCX: 00007f406958eec9 [ 1388.147945][T23825] RDX: 0000000000000850 RSI: 0000200000000240 RDI: 0000000000000004 [ 1388.147952][T23825] RBP: 00007f40677f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1388.147958][T23825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1388.147965][T23825] R13: 00007f40697e6038 R14: 00007f40697e5fa0 R15: 00007ffc16b4d3a8 [ 1388.147978][T23825] [ 1388.289816][T22853] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1388.464374][T22853] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 1388.464622][T22853] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1388.464687][T22853] usb 6-1: Product: syz [ 1388.464745][T22853] usb 6-1: Manufacturer: syz [ 1388.464803][T22853] usb 6-1: SerialNumber: syz [ 1388.854203][T22853] rtl8150 6-1:1.0: couldn't reset the device [ 1388.854460][T22853] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 1388.859434][T22853] usb 6-1: USB disconnect, device number 14 [ 1388.936990][T23837] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4673'. [ 1389.528920][T16154] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 1390.121077][T16154] usb 4-1: config 0 descriptor has 1 excess byte, ignoring [ 1390.257824][T16154] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1390.333444][ T30] audit: type=1400 audit(2000000034.740:2575): avc: denied { setopt } for pid=23842 comm="syz.1.4675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1390.373301][T16154] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1390.478471][T16154] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1390.478488][T16154] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1390.478500][T16154] usb 4-1: Product: syz [ 1390.478509][T16154] usb 4-1: Manufacturer: syz [ 1390.478518][T16154] usb 4-1: SerialNumber: syz [ 1390.489098][T16154] usb 4-1: config 0 descriptor?? [ 1390.531483][T23848] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4676'. [ 1390.728576][T16154] usb 4-1: USB disconnect, device number 125 [ 1391.103776][T23850] netlink: 80 bytes leftover after parsing attributes in process `syz.1.4677'. [ 1391.399647][T16154] usb 2-1: new low-speed USB device number 8 using dummy_hcd [ 1391.929923][ T30] audit: type=1400 audit(2000000036.340:2576): avc: denied { setopt } for pid=23853 comm="syz.3.4680" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1391.939795][T16154] usb 2-1: device descriptor read/64, error -71 [ 1392.262077][T16154] usb 2-1: new low-speed USB device number 9 using dummy_hcd [ 1392.382162][ T30] audit: type=1400 audit(2000000036.800:2577): avc: denied { append } for pid=23860 comm="syz.5.4681" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1392.390850][T16154] usb 2-1: device descriptor read/64, error -71 [ 1392.500636][T16154] usb usb2-port1: attempt power cycle [ 1392.839694][T16154] usb 2-1: new low-speed USB device number 10 using dummy_hcd [ 1392.860160][T16154] usb 2-1: device descriptor read/8, error -71 [ 1393.109825][T16154] usb 2-1: new low-speed USB device number 11 using dummy_hcd [ 1393.134924][T16154] usb 2-1: device descriptor read/8, error -71 [ 1393.297641][T16154] usb usb2-port1: unable to enumerate USB device [ 1394.183932][T20614] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1394.840698][T20614] usb 6-1: New USB device found, idVendor=046d, idProduct=c218, bcdDevice= 0.00 [ 1395.047123][T20614] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1395.083618][T20614] usb 6-1: config 0 descriptor?? [ 1395.861805][T20614] hid_parser_main: 90 callbacks suppressed [ 1395.861824][T20614] logitech 0003:046D:C218.003C: unknown main item tag 0x0 [ 1395.889437][T23876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1395.901680][T23876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1395.904855][T20614] logitech 0003:046D:C218.003C: hidraw0: USB HID v0.00 Device [HID 046d:c218] on usb-dummy_hcd.5-1/input0 [ 1395.969657][T20614] logitech 0003:046D:C218.003C: no inputs found [ 1396.181543][T23914] NILFS (loop1): device size too small [ 1396.334091][T23918] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4695'. [ 1396.366379][ T30] audit: type=1400 audit(2000000040.778:2578): avc: denied { read } for pid=23915 comm="syz.4.4695" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1396.619007][ T30] audit: type=1400 audit(2000000040.778:2579): avc: denied { open } for pid=23915 comm="syz.4.4695" path="/dev/ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1396.915686][T23929] Unsupported ieee802154 address type: 0 [ 1397.162871][T23931] sp0: Synchronizing with TNC [ 1397.196862][T23931] sp0: Found TNC [ 1398.150094][T20614] usb 6-1: USB disconnect, device number 15 [ 1398.489864][T16154] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 1398.665151][T16154] usb 3-1: New USB device found, idVendor=046d, idProduct=c218, bcdDevice= 0.00 [ 1398.899538][T16154] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1398.946318][T16154] usb 3-1: config 0 descriptor?? [ 1399.072267][T21283] Bluetooth: hci3: command 0x0406 tx timeout [ 1399.174711][T23953] Bluetooth: MGMT ver 1.23 [ 1399.585371][T23947] 9pnet_fd: Insufficient options for proto=fd [ 1399.594887][T16154] logitech 0003:046D:C218.003D: unknown main item tag 0x0 [ 1399.713707][T16154] logitech 0003:046D:C218.003D: hidraw0: USB HID v0.00 Device [HID 046d:c218] on usb-dummy_hcd.2-1/input0 [ 1399.727134][T16154] logitech 0003:046D:C218.003D: no inputs found [ 1399.900657][T23938] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1400.201353][T23938] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1400.637635][T23968] netlink: 830 bytes leftover after parsing attributes in process `syz.3.4706'. [ 1400.794706][ T30] audit: type=1400 audit(2000000045.198:2580): avc: denied { getattr } for pid=23969 comm="syz.5.4707" name="/" dev="pidfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 1400.817202][ C0] vkms_vblank_simulate: vblank timer overrun [ 1400.825874][T23968] SQUASHFS error: Failed to read block 0x0: -5 [ 1400.864710][T23968] unable to read squashfs_super_block [ 1400.920072][T23968] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1400.928109][T23976] Unsupported ieee802154 address type: 0 [ 1400.933843][ T30] audit: type=1400 audit(2000000045.298:2581): avc: denied { write } for pid=23969 comm="syz.5.4707" path="socket:[81339]" dev="sockfs" ino=81339 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1401.419666][T16987] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 1401.581957][T16987] usb 6-1: too many configurations: 67, using maximum allowed: 8 [ 1401.608183][T16987] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1401.618823][T16987] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1401.629264][T16987] usb 6-1: Product: syz [ 1401.637492][T16987] usb 6-1: Manufacturer: syz [ 1401.675426][T16987] usb 6-1: SerialNumber: syz [ 1401.722379][T16987] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1401.837276][ T5823] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1401.846679][T23981] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=23981 comm=syz.4.4709 [ 1402.025506][T23981] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=7 sclass=netlink_xfrm_socket pid=23981 comm=syz.4.4709 [ 1402.502207][T22853] usb 3-1: USB disconnect, device number 125 [ 1403.239451][ T30] audit: type=1400 audit(2000000047.648:2582): avc: denied { read } for pid=23992 comm="syz.2.4712" name="usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1403.284860][ T30] audit: type=1400 audit(2000000047.648:2583): avc: denied { open } for pid=23992 comm="syz.2.4712" path="/dev/usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1403.336356][ T30] audit: type=1400 audit(2000000047.738:2584): avc: denied { bind } for pid=23992 comm="syz.2.4712" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1403.543670][ T5823] usb 6-1: Service connection timeout for: 256 [ 1403.568003][ T5823] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services [ 1403.657938][T24005] FAULT_INJECTION: forcing a failure. [ 1403.657938][T24005] name failslab, interval 1, probability 0, space 0, times 0 [ 1403.696361][ T5823] ath9k_htc: Failed to initialize the device [ 1403.704813][ T5823] usb 6-1: ath9k_htc: USB layer deinitialized [ 1403.713105][T24005] CPU: 0 UID: 0 PID: 24005 Comm: syz.2.4715 Not tainted syzkaller #0 PREEMPT(full) [ 1403.713121][T24005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1403.713128][T24005] Call Trace: [ 1403.713133][T24005] [ 1403.713137][T24005] dump_stack_lvl+0x16c/0x1f0 [ 1403.713157][T24005] should_fail_ex+0x512/0x640 [ 1403.713171][T24005] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1403.713190][T24005] should_failslab+0xc2/0x120 [ 1403.713201][T24005] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1403.713218][T24005] ? __alloc_skb+0x2b2/0x380 [ 1403.713234][T24005] __alloc_skb+0x2b2/0x380 [ 1403.713247][T24005] ? __pfx___alloc_skb+0x10/0x10 [ 1403.713263][T24005] ? pn_socket_bind+0x49c/0x580 [ 1403.713281][T24005] pep_alloc_skb+0x36/0x2c0 [ 1403.713293][T24005] pep_sock_connect+0x10b/0x3e0 [ 1403.713305][T24005] ? __pfx_pep_sock_connect+0x10/0x10 [ 1403.713318][T24005] ? __local_bh_enable_ip+0xa4/0x120 [ 1403.713336][T24005] pn_socket_connect+0x430/0x9b0 [ 1403.713353][T24005] ? find_held_lock+0x2b/0x80 [ 1403.713389][T24005] ? __pfx_pn_socket_connect+0x10/0x10 [ 1403.713405][T24005] ? rcu_is_watching+0x12/0xc0 [ 1403.713420][T24005] ? __local_bh_enable_ip+0xa4/0x120 [ 1403.713436][T24005] ? lockdep_hardirqs_on+0x7c/0x110 [ 1403.713449][T24005] ? selinux_netlbl_socket_connect+0x30/0x40 [ 1403.713464][T24005] ? __local_bh_enable_ip+0xa4/0x120 [ 1403.713479][T24005] ? selinux_netlbl_socket_connect+0x30/0x40 [ 1403.713493][T24005] ? selinux_socket_connect+0x6b/0x80 [ 1403.713508][T24005] ? __pfx_pn_socket_connect+0x10/0x10 [ 1403.713524][T24005] __sys_connect_file+0x13e/0x1a0 [ 1403.713539][T24005] __sys_connect+0x13b/0x160 [ 1403.713550][T24005] ? __pfx___sys_connect+0x10/0x10 [ 1403.713568][T24005] ? __pfx_ksys_write+0x10/0x10 [ 1403.713587][T24005] __x64_sys_connect+0x72/0xb0 [ 1403.713599][T24005] ? lockdep_hardirqs_on+0x7c/0x110 [ 1403.713614][T24005] do_syscall_64+0xcd/0x4e0 [ 1403.713630][T24005] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.713642][T24005] RIP: 0033:0x7fe389b8eec9 [ 1403.713651][T24005] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1403.713662][T24005] RSP: 002b:00007fe38a9b1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1403.713673][T24005] RAX: ffffffffffffffda RBX: 00007fe389de5fa0 RCX: 00007fe389b8eec9 [ 1403.713680][T24005] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000004 [ 1403.713686][T24005] RBP: 00007fe38a9b1090 R08: 0000000000000000 R09: 0000000000000000 [ 1403.713693][T24005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1403.713704][T24005] R13: 00007fe389de6038 R14: 00007fe389de5fa0 R15: 00007ffdee9859f8 [ 1403.713719][T24005] [ 1403.982265][ C0] vkms_vblank_simulate: vblank timer overrun [ 1404.148595][T16987] usb 6-1: USB disconnect, device number 16 [ 1404.827890][ T30] audit: type=1400 audit(2000000049.238:2585): avc: denied { unmount } for pid=22356 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 1404.888290][T24022] syz_tun: entered allmulticast mode [ 1404.926763][T24020] syz_tun: left allmulticast mode [ 1404.975073][T24026] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4722'. [ 1405.084650][T24028] netlink: 'syz.4.4724': attribute type 4 has an invalid length. [ 1405.189651][T16987] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1405.329665][T22853] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 1405.349737][T16987] usb 2-1: Using ep0 maxpacket: 8 [ 1405.371087][T16987] usb 2-1: config 0 has no interfaces? [ 1405.399160][T16987] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1405.426756][T16987] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1405.447290][T16987] usb 2-1: Product: syz [ 1405.466160][T16987] usb 2-1: Manufacturer: syz [ 1405.486119][T16987] usb 2-1: SerialNumber: syz [ 1405.503353][T16987] usb 2-1: config 0 descriptor?? [ 1405.511038][T22853] usb 6-1: New USB device found, idVendor=046d, idProduct=c218, bcdDevice= 0.00 [ 1405.520374][T22853] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1405.550165][T22853] usb 6-1: config 0 descriptor?? [ 1405.613385][ T30] audit: type=1400 audit(2000000050.028:2586): avc: denied { getopt } for pid=24045 comm="syz.3.4730" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1405.646229][T16154] IPVS: starting estimator thread 0... [ 1405.861691][T24050] IPVS: using max 44 ests per chain, 105600 per kthread [ 1406.195201][T24032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1406.254589][T22853] logitech 0003:046D:C218.003E: unknown main item tag 0x0 [ 1406.262992][T22853] logitech 0003:046D:C218.003E: hidraw0: USB HID v0.00 Device [HID 046d:c218] on usb-dummy_hcd.5-1/input0 [ 1406.283150][T22853] logitech 0003:046D:C218.003E: no inputs found [ 1406.304900][T24032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1406.330673][T24018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1406.342638][T24018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1406.400079][T16987] usb 2-1: USB disconnect, device number 12 [ 1406.617734][ T30] audit: type=1400 audit(2000000051.028:2587): avc: denied { read } for pid=24064 comm="syz.4.4733" name="mice" dev="devtmpfs" ino=915 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1406.668162][ T30] audit: type=1400 audit(2000000051.028:2588): avc: denied { open } for pid=24064 comm="syz.4.4733" path="/dev/input/mice" dev="devtmpfs" ino=915 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1406.695032][T24067] Unsupported ieee802154 address type: 0 [ 1406.714324][ T30] audit: type=1400 audit(2000000051.128:2589): avc: denied { ioctl } for pid=24064 comm="syz.4.4733" path="/dev/input/mice" dev="devtmpfs" ino=915 ioctlcmd=0x6613 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1408.022816][T24086] IPv6: Can't replace route, no match found [ 1408.034927][T24086] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4738'. [ 1408.086154][T24088] pimreg: entered allmulticast mode [ 1408.468422][T22853] usb 6-1: USB disconnect, device number 17 [ 1408.720678][T24099] SQUASHFS error: Failed to read block 0x0: -5 [ 1408.727005][T24099] unable to read squashfs_super_block [ 1408.829259][T24099] tls_set_device_offload: netdev not found [ 1408.854388][T24099] fuse: Bad value for 'fd' [ 1409.515625][ T30] audit: type=1400 audit(2000000053.918:2590): avc: denied { bind } for pid=24111 comm="syz.2.4745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1409.830280][ T30] audit: type=1400 audit(2000000054.138:2591): avc: denied { listen } for pid=24111 comm="syz.2.4745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1409.855919][ T30] audit: type=1400 audit(2000000054.138:2592): avc: denied { write } for pid=24111 comm="syz.2.4745" path="socket:[80750]" dev="sockfs" ino=80750 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1409.889735][ T30] audit: type=1400 audit(2000000054.138:2593): avc: denied { accept } for pid=24111 comm="syz.2.4745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1409.911956][ T30] audit: type=1400 audit(2000000054.138:2594): avc: denied { read } for pid=24111 comm="syz.2.4745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1410.026453][ T9] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 1410.086516][ T30] audit: type=1800 audit(2000000054.498:2595): pid=24103 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.4742" name="/" dev="9p" ino=2 res=0 errno=0 [ 1410.169341][T24117] usb 1-1: USB disconnect, device number 65 [ 1410.293638][T24117] hub 1-0:1.0: USB hub found [ 1410.299854][T24117] hub 1-0:1.0: 1 port detected [ 1410.482767][T16154] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 1410.520816][ T9] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 1410.554689][ T9] usb 3-1: config 0 has no interface number 0 [ 1410.583576][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 1410.655816][T16154] usb 1-1: device descriptor read/64, error -32 [ 1410.667027][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1410.733431][ T9] usb 3-1: Product: syz [ 1410.760415][T24130] FAULT_INJECTION: forcing a failure. [ 1410.760415][T24130] name failslab, interval 1, probability 0, space 0, times 0 [ 1410.766375][ T9] usb 3-1: Manufacturer: syz [ 1410.801071][T24130] CPU: 1 UID: 0 PID: 24130 Comm: syz.5.4750 Not tainted syzkaller #0 PREEMPT(full) [ 1410.801096][T24130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1410.801107][T24130] Call Trace: [ 1410.801113][T24130] [ 1410.801120][T24130] dump_stack_lvl+0x16c/0x1f0 [ 1410.801149][T24130] should_fail_ex+0x512/0x640 [ 1410.801169][T24130] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1410.801197][T24130] should_failslab+0xc2/0x120 [ 1410.801215][T24130] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1410.801239][T24130] ? __alloc_skb+0x2b2/0x380 [ 1410.801269][T24130] __alloc_skb+0x2b2/0x380 [ 1410.801288][T24130] ? __pfx___alloc_skb+0x10/0x10 [ 1410.801310][T24130] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1410.801337][T24130] netlink_alloc_large_skb+0x69/0x130 [ 1410.801363][T24130] netlink_sendmsg+0x6a1/0xdd0 [ 1410.801390][T24130] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1410.801422][T24130] ____sys_sendmsg+0xa98/0xc70 [ 1410.801450][T24130] ? copy_msghdr_from_user+0x10a/0x160 [ 1410.801472][T24130] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1410.801507][T24130] ___sys_sendmsg+0x134/0x1d0 [ 1410.801531][T24130] ? __pfx____sys_sendmsg+0x10/0x10 [ 1410.801582][T24130] __sys_sendmsg+0x16d/0x220 [ 1410.801606][T24130] ? __pfx___sys_sendmsg+0x10/0x10 [ 1410.801645][T24130] do_syscall_64+0xcd/0x4e0 [ 1410.801670][T24130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1410.801688][T24130] RIP: 0033:0x7f364cd8eec9 [ 1410.801703][T24130] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1410.801719][T24130] RSP: 002b:00007f364db9a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1410.801737][T24130] RAX: ffffffffffffffda RBX: 00007f364cfe5fa0 RCX: 00007f364cd8eec9 [ 1410.801750][T24130] RDX: 0000000000000000 RSI: 0000200000002440 RDI: 0000000000000004 [ 1410.801761][T24130] RBP: 00007f364db9a090 R08: 0000000000000000 R09: 0000000000000000 [ 1410.801773][T24130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1410.801784][T24130] R13: 00007f364cfe6038 R14: 00007f364cfe5fa0 R15: 00007ffeda6652d8 [ 1410.801809][T24130] [ 1410.804568][ T9] usb 3-1: SerialNumber: syz [ 1410.965444][ C0] vkms_vblank_simulate: vblank timer overrun [ 1411.486819][T16154] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 1411.488664][ T9] usb 3-1: config 0 descriptor?? [ 1411.629701][T16154] usb 1-1: device descriptor read/64, error -32 [ 1411.742194][T16154] usb usb1-port1: attempt power cycle [ 1411.799726][T20614] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 1411.846902][ T9] usb 3-1: Found UVC 0.08 device syz (046d:0823) [ 1411.853427][ T9] usb 3-1: No valid video chain found. [ 1411.862635][ T9] usb 3-1: USB disconnect, device number 126 [ 1411.951631][T20614] usb 6-1: New USB device found, idVendor=046d, idProduct=c218, bcdDevice= 0.00 [ 1411.960952][T20614] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1411.971731][T20614] usb 6-1: config 0 descriptor?? [ 1411.989709][T22853] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1412.030063][T16154] raw-gadget.0 gadget.0: failed to queue resume event [ 1412.089796][T16154] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 1412.119908][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 1412.127070][T16154] usb 1-1: device descriptor read/8, error -32 [ 1412.152947][T22853] usb 2-1: config 0 has an invalid interface number: 160 but max is 0 [ 1412.161387][T22853] usb 2-1: config 0 has no interface number 0 [ 1412.167477][T22853] usb 2-1: config 0 interface 160 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1412.185727][T22853] usb 2-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=9e.4e [ 1412.194851][T22853] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1412.202979][T22853] usb 2-1: Product: syz [ 1412.207138][T22853] usb 2-1: Manufacturer: syz [ 1412.211741][T22853] usb 2-1: SerialNumber: syz [ 1412.217918][T22853] usb 2-1: config 0 descriptor?? [ 1412.226436][T22853] usb 2-1: Found UVC 0.00 device syz (05ac:8501) [ 1412.232898][T22853] usb 2-1: No valid video chain found. [ 1412.239702][T16154] raw-gadget.0 gadget.0: failed to queue suspend event [ 1412.247716][T16154] raw-gadget.0 gadget.0: failed to queue reset event [ 1412.330602][T16154] raw-gadget.0 gadget.0: failed to queue resume event [ 1412.387431][T20614] logitech 0003:046D:C218.003F: unknown main item tag 0x0 [ 1412.394939][T16154] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 1412.404669][T20614] logitech 0003:046D:C218.003F: hidraw0: USB HID v0.00 Device [HID 046d:c218] on usb-dummy_hcd.5-1/input0 [ 1412.416434][T20614] logitech 0003:046D:C218.003F: no inputs found [ 1412.429870][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 1412.437016][T16154] usb 1-1: device descriptor read/8, error -32 [ 1412.559992][T16154] raw-gadget.0 gadget.0: failed to queue suspend event [ 1412.573222][T16154] usb usb1-port1: unable to enumerate USB device [ 1412.673650][T24136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1412.809407][T24136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1413.249886][T16154] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1413.511761][T16154] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1413.531722][T16154] usb 5-1: can't read configurations, error -61 [ 1413.679995][T16154] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1413.852596][T16154] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1413.874971][T16154] usb 5-1: can't read configurations, error -61 [ 1413.886974][T16154] usb usb5-port1: attempt power cycle [ 1414.002398][ T5823] usb 2-1: USB disconnect, device number 13 [ 1414.260406][T16154] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1414.463440][T16154] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1414.472486][T16154] usb 5-1: can't read configurations, error -61 [ 1414.597127][ T5823] usb 6-1: USB disconnect, device number 18 [ 1414.689656][T16154] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1415.014955][T16154] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1415.022693][T16154] usb 5-1: can't read configurations, error -61 [ 1415.029233][T16154] usb usb5-port1: unable to enumerate USB device [ 1415.309946][ T5823] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 1415.541311][ T5823] usb 2-1: Using ep0 maxpacket: 8 [ 1415.549321][ T5823] usb 2-1: config 1 has an invalid descriptor of length 100, skipping remainder of the config [ 1415.560838][ T5823] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1415.571353][ T5823] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1415.590933][ T5823] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 1415.603621][ T5823] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1415.636421][ T5823] hub 2-1:1.0: bad descriptor, ignoring hub [ 1415.654086][ T5823] hub 2-1:1.0: probe with driver hub failed with error -5 [ 1415.663837][ T5823] cdc_wdm 2-1:1.0: skipping garbage [ 1415.669086][ T5823] cdc_wdm 2-1:1.0: skipping garbage [ 1415.675245][ T5823] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1416.485110][T16154] usb 2-1: USB disconnect, device number 14 [ 1416.629699][T22853] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1416.673445][T24211] netlink: 284 bytes leftover after parsing attributes in process `syz.2.4775'. [ 1417.269765][T22853] usb 5-1: Using ep0 maxpacket: 16 [ 1417.273023][T24223] overlayfs: failed to resolve './bus': -2 [ 1417.302010][T22853] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1417.316400][T22853] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1417.327546][T22853] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1417.349913][T22853] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1417.359262][T22853] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1417.379715][T16154] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 1417.433294][T22853] usb 5-1: config 0 descriptor?? [ 1417.575516][T16154] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1417.595783][T16154] usb 2-1: no configurations [ 1417.600611][T16154] usb 2-1: can't read configurations, error -22 [ 1418.282844][T24231] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1418.294467][T24231] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1418.471612][T22853] microsoft 0003:045E:07DA.0040: unknown main item tag 0x0 [ 1418.482419][T22853] microsoft 0003:045E:07DA.0040: unknown main item tag 0x0 [ 1418.500239][T22853] microsoft 0003:045E:07DA.0040: unknown main item tag 0x0 [ 1418.507787][T22853] microsoft 0003:045E:07DA.0040: unknown main item tag 0x0 [ 1418.530829][T22853] microsoft 0003:045E:07DA.0040: unknown main item tag 0x0 [ 1418.544444][T22853] microsoft 0003:045E:07DA.0040: unknown main item tag 0x0 [ 1418.557011][T22853] microsoft 0003:045E:07DA.0040: unknown main item tag 0x0 [ 1418.565314][T22853] microsoft 0003:045E:07DA.0040: unknown main item tag 0x0 [ 1418.573121][T22853] microsoft 0003:045E:07DA.0040: unknown main item tag 0x0 [ 1418.581415][T22853] microsoft 0003:045E:07DA.0040: unknown main item tag 0x0 [ 1418.649800][T24235] Context (ID=0x0) not attached to queue pair (handle=0x1:0xfffffffa) [ 1418.768284][T22853] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.0040/input/input40 [ 1418.800027][T22853] microsoft 0003:045E:07DA.0040: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 1419.537896][ T5823] usb 5-1: USB disconnect, device number 91 [ 1419.605568][T24250] comedi comedi4: bad chanlist[0]=0x00040004 chan=4 range length=2 [ 1420.150825][T24257] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=24257 comm=syz.5.4786 [ 1420.356062][T24260] fuse: Bad value for 'fd' [ 1420.724639][T24264] fuse: Bad value for 'fd' [ 1420.810770][T24265] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1420.818047][T24265] IPv6: NLM_F_CREATE should be set when creating new route [ 1420.825441][T24265] IPv6: NLM_F_CREATE should be set when creating new route [ 1420.832745][T24265] IPv6: NLM_F_CREATE should be set when creating new route [ 1420.939945][ T30] audit: type=1400 audit(2000000065.228:2596): avc: denied { ioctl } for pid=24261 comm="syz.5.4789" path="socket:[82025]" dev="sockfs" ino=82025 ioctlcmd=0x89ef scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1421.179713][ T30] audit: type=1800 audit(2000000065.228:2597): pid=24266 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.4787" name="/" dev="9p" ino=2 res=0 errno=0 [ 1421.221602][ T30] audit: type=1400 audit(2000000065.318:2598): avc: denied { connect } for pid=24261 comm="syz.5.4789" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1421.826395][T24276] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4792'. [ 1422.670342][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.354118][T24285] 9pnet_fd: Insufficient options for proto=fd [ 1423.497599][ T30] audit: type=1800 audit(2000000067.908:2599): pid=24282 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.4795" name="/" dev="9p" ino=2 res=0 errno=0 [ 1423.679921][T16154] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 1423.912381][T24299] fuse: Bad value for 'fd' [ 1423.935897][T16154] usb 3-1: config 1 has an invalid interface number: 7 but max is 0 [ 1424.022878][T16154] usb 3-1: config 1 has no interface number 0 [ 1424.134651][T16154] usb 3-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1424.228372][T16154] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1424.251105][T16154] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 1424.264153][T16154] usb 3-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1424.314154][T16154] usb 3-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1424.333570][T16154] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1424.358410][T16154] usb 3-1: Product: syz [ 1424.381924][T16154] usb 3-1: Manufacturer: syz [ 1424.392164][T16154] usb 3-1: SerialNumber: syz [ 1424.409496][T24292] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1424.431027][T24292] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1424.552523][T16987] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 1424.982801][T24314] netlink: 92 bytes leftover after parsing attributes in process `syz.2.4797'. [ 1425.038823][T24315] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1425.046103][T24315] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1425.399699][T16154] usb 3-1: Incompatible driver and firmware versions [ 1425.458618][T16987] usb 2-1: too many configurations: 67, using maximum allowed: 8 [ 1425.483586][T16987] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1425.599129][T16987] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1425.762886][T16987] usb 2-1: Product: syz [ 1425.767784][T16987] usb 2-1: Manufacturer: syz [ 1425.829601][T16987] usb 2-1: SerialNumber: syz [ 1425.987227][T16987] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1426.006921][ T9] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1426.084901][T24326] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4806'. [ 1426.674693][T16987] usb 3-1: USB disconnect, device number 127 [ 1426.918987][ T30] audit: type=1400 audit(2000000071.328:2600): avc: denied { mounton } for pid=24331 comm="syz.3.4808" path="/127/file0" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 1427.657758][ T9] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1427.665134][ T9] ath9k_htc: Failed to initialize the device [ 1427.693350][ T9] usb 2-1: ath9k_htc: USB layer deinitialized [ 1427.762713][T16987] usb 2-1: USB disconnect, device number 17 [ 1428.679755][ T5891] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 1428.868871][ T5891] usb 6-1: Using ep0 maxpacket: 8 [ 1428.892003][ T5891] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1428.929670][ T5891] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1428.958553][ T5891] usb 6-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x76, changing to 0x6 [ 1428.978781][ T30] audit: type=1400 audit(2000000073.388:2601): avc: denied { load_policy } for pid=24367 comm="syz.3.4816" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 1428.989742][ T5891] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x6 has an invalid bInterval 100, changing to 10 [ 1429.057336][ T5891] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 24936, setting to 1024 [ 1429.090833][ T5891] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 1429.110775][ T5891] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1429.151279][ T5891] hub 6-1:1.0: bad descriptor, ignoring hub [ 1429.169747][ T5891] hub 6-1:1.0: probe with driver hub failed with error -5 [ 1429.208386][ T5891] cdc_wdm 6-1:1.0: skipping garbage [ 1429.232129][ T5891] cdc_wdm 6-1:1.0: skipping garbage [ 1429.337888][ T5891] cdc_wdm 6-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1429.815670][T24368] SELinux: failed to load policy [ 1430.018131][ T5891] usb 6-1: USB disconnect, device number 19 [ 1430.134290][T24380] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4818'. [ 1431.988308][ T30] audit: type=1400 audit(2000000076.398:2602): avc: denied { unmount } for pid=17840 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1432.201143][T20614] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1432.478966][T24413] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4827'. [ 1432.493372][T24413] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4827'. [ 1432.503069][T24413] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4827'. [ 1432.515921][T24413] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4827'. [ 1432.621847][T20614] usb 5-1: config 0 has an invalid interface number: 160 but max is 0 [ 1432.654833][T20614] usb 5-1: config 0 has no interface number 0 [ 1432.678433][T20614] usb 5-1: config 0 interface 160 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1432.761564][T24419] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4829'. [ 1432.893583][T24426] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4831'. [ 1433.315471][T24427] hub 9-0:1.0: USB hub found [ 1433.335923][T24427] hub 9-0:1.0: 1 port detected [ 1433.575125][T20614] usb 5-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=9e.4e [ 1433.612045][T20614] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1433.832234][T20614] usb 5-1: Product: syz [ 1433.851112][T20614] usb 5-1: Manufacturer: syz [ 1433.855741][T20614] usb 5-1: SerialNumber: syz [ 1433.876176][T20614] usb 5-1: config 0 descriptor?? [ 1433.888795][T20614] usb 5-1: Found UVC 0.00 device syz (05ac:8501) [ 1434.175279][T20614] usb 5-1: No valid video chain found. [ 1434.464512][ T30] audit: type=1400 audit(2000000078.788:2603): avc: denied { accept } for pid=24438 comm="syz.2.4834" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1435.145677][ T30] audit: type=1400 audit(2000000079.538:2604): avc: denied { relabelto } for pid=24433 comm="syz.1.4833" name="cgroup.procs" dev="cgroup" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object" [ 1435.276849][ T30] audit: type=1400 audit(2000000079.538:2605): avc: denied { associate } for pid=24433 comm="syz.1.4833" name="cgroup.procs" dev="cgroup" ino=236 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 srawcon="system_u:object" [ 1435.298340][ T5891] IPVS: starting estimator thread 0... [ 1435.369703][T20614] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 1435.419784][T24454] IPVS: using max 76 ests per chain, 182400 per kthread [ 1435.581151][T20614] usb 4-1: Using ep0 maxpacket: 8 [ 1435.596730][T20614] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1435.609915][T20614] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 1435.628217][T20614] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 1435.645633][T20614] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1435.662380][T20614] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1435.699212][T20614] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 1435.709962][T20614] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 1435.718232][T20614] usb 4-1: Product: syz [ 1435.723027][T20614] usb 4-1: Manufacturer: syz [ 1435.727732][T20614] usb 4-1: SerialNumber: syz [ 1435.753452][T20614] usb 4-1: config 0 descriptor?? [ 1435.976338][T20614] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 1436.032073][T20614] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 1436.076802][T22853] usb 5-1: USB disconnect, device number 92 [ 1436.278168][T20614] radio-si470x 4-1:0.0: software version 0, hardware version 0 [ 1436.298166][T20614] radio-si470x 4-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 1436.311062][T20614] radio-si470x 4-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 1436.618870][T20614] radio-si470x 4-1:0.0: submitting int urb failed (-90) [ 1437.329408][ T30] audit: type=1800 audit(2000000081.738:2606): pid=24468 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.4839" name="/" dev="9p" ino=2 res=0 errno=0 [ 1437.741801][T24481] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4842'. [ 1438.099022][T20614] radio-si470x 4-1:0.0: si470x_set_report: usb_control_msg returned -110 [ 1438.126770][T20614] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -22 [ 1438.149174][ T30] audit: type=1400 audit(2000000082.558:2607): avc: denied { create } for pid=24474 comm="syz.4.4844" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1438.202633][T20614] usb 4-1: USB disconnect, device number 126 [ 1438.237746][ T30] audit: type=1326 audit(2000000082.648:2608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24487 comm="syz.5.4845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f364cd8eec9 code=0x7ffc0000 [ 1438.264833][ T30] audit: type=1326 audit(2000000082.688:2609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24487 comm="syz.5.4845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f364cd8eec9 code=0x7ffc0000 [ 1438.304061][ T30] audit: type=1326 audit(2000000082.688:2610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24487 comm="syz.5.4845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f364cd8eec9 code=0x7ffc0000 [ 1438.391033][ T30] audit: type=1326 audit(2000000082.688:2611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24487 comm="syz.5.4845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f364cd8eec9 code=0x7ffc0000 [ 1438.421516][ T30] audit: type=1326 audit(2000000082.688:2612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24487 comm="syz.5.4845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f364cd8eec9 code=0x7ffc0000 [ 1438.465503][ T30] audit: type=1326 audit(2000000082.688:2613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24487 comm="syz.5.4845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f364cd8eec9 code=0x7ffc0000 [ 1438.669651][ T30] audit: type=1326 audit(2000000082.688:2614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24487 comm="syz.5.4845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f364cd8eec9 code=0x7ffc0000 [ 1438.729659][ T30] audit: type=1326 audit(2000000082.688:2615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24487 comm="syz.5.4845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f364cd8eec9 code=0x7ffc0000 [ 1440.200752][T24511] netlink: 188 bytes leftover after parsing attributes in process `syz.4.4852'. [ 1441.435902][T24532] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4856'. [ 1442.639680][ T5823] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 1442.859656][ T5823] usb 3-1: Using ep0 maxpacket: 8 [ 1442.929249][ T5823] usb 3-1: config 0 has no interfaces? [ 1442.944954][ T5823] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1443.183972][ T5823] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1443.210502][ T5823] usb 3-1: Product: syz [ 1443.263408][ T5823] usb 3-1: Manufacturer: syz [ 1443.270328][ T5823] usb 3-1: SerialNumber: syz [ 1443.284761][ T5823] usb 3-1: config 0 descriptor?? [ 1443.490647][T24552] netlink: 'syz.3.4862': attribute type 4 has an invalid length. [ 1443.629341][T24529] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1443.668827][T24529] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1443.794249][ T9] usb 3-1: USB disconnect, device number 2 [ 1444.156222][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 1444.156240][ T30] audit: type=1400 audit(2000000088.568:2625): avc: denied { getopt } for pid=24557 comm="syz.5.4864" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1444.743534][ T30] audit: type=1400 audit(2000000089.128:2626): avc: denied { write } for pid=24564 comm="syz.5.4866" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1444.791184][ T30] audit: type=1400 audit(2000000089.138:2627): avc: denied { unmount } for pid=17840 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 1445.085577][ T30] audit: type=1800 audit(2000000089.498:2628): pid=24571 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.4868" name="/" dev="9p" ino=2 res=0 errno=0 [ 1445.501221][T24579] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4870'. [ 1449.581695][ T9] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1449.660059][ T5823] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 1449.740406][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 1449.748717][ T9] usb 5-1: config 0 has no interfaces? [ 1449.759018][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1449.770641][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1449.778845][ T9] usb 5-1: Product: syz [ 1449.784431][ T9] usb 5-1: Manufacturer: syz [ 1449.789294][ T9] usb 5-1: SerialNumber: syz [ 1449.823226][ T9] usb 5-1: config 0 descriptor?? [ 1449.833693][ T5823] usb 2-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 1449.844876][ T5823] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1449.854891][ T5823] usb 2-1: Product: syz [ 1449.859091][ T5823] usb 2-1: Manufacturer: syz [ 1449.865110][ T5823] usb 2-1: SerialNumber: syz [ 1449.878608][ T5823] usb 2-1: config 0 descriptor?? [ 1450.063874][T24608] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1450.076443][T24608] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1450.109978][ T9] usb 5-1: USB disconnect, device number 93 [ 1450.347289][ T5823] airspy 2-1:0.0: Board ID: 00 [ 1450.354230][ T5823] airspy 2-1:0.0: Firmware version: [ 1450.423617][T24624] FAULT_INJECTION: forcing a failure. [ 1450.423617][T24624] name failslab, interval 1, probability 0, space 0, times 0 [ 1450.438466][T24624] CPU: 0 UID: 0 PID: 24624 Comm: syz.2.4882 Not tainted syzkaller #0 PREEMPT(full) [ 1450.438484][T24624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1450.438491][T24624] Call Trace: [ 1450.438495][T24624] [ 1450.438500][T24624] dump_stack_lvl+0x16c/0x1f0 [ 1450.438520][T24624] should_fail_ex+0x512/0x640 [ 1450.438534][T24624] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1450.438553][T24624] should_failslab+0xc2/0x120 [ 1450.438565][T24624] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1450.438582][T24624] ? __alloc_skb+0x2b2/0x380 [ 1450.438598][T24624] __alloc_skb+0x2b2/0x380 [ 1450.438610][T24624] ? __pfx___alloc_skb+0x10/0x10 [ 1450.438624][T24624] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1450.438643][T24624] netlink_alloc_large_skb+0x69/0x130 [ 1450.438660][T24624] netlink_sendmsg+0x6a1/0xdd0 [ 1450.438678][T24624] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1450.438698][T24624] ____sys_sendmsg+0xa98/0xc70 [ 1450.438717][T24624] ? copy_msghdr_from_user+0x10a/0x160 [ 1450.438731][T24624] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1450.438757][T24624] ___sys_sendmsg+0x134/0x1d0 [ 1450.438772][T24624] ? __pfx____sys_sendmsg+0x10/0x10 [ 1450.438808][T24624] __sys_sendmsg+0x16d/0x220 [ 1450.438823][T24624] ? __pfx___sys_sendmsg+0x10/0x10 [ 1450.438846][T24624] do_syscall_64+0xcd/0x4e0 [ 1450.438863][T24624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1450.438875][T24624] RIP: 0033:0x7fe389b8eec9 [ 1450.438884][T24624] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1450.438896][T24624] RSP: 002b:00007fe38a9b1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1450.438907][T24624] RAX: ffffffffffffffda RBX: 00007fe389de5fa0 RCX: 00007fe389b8eec9 [ 1450.438914][T24624] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 1450.438921][T24624] RBP: 00007fe38a9b1090 R08: 0000000000000000 R09: 0000000000000000 [ 1450.438927][T24624] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1450.438933][T24624] R13: 00007fe389de6038 R14: 00007fe389de5fa0 R15: 00007ffdee9859f8 [ 1450.438947][T24624] [ 1451.088886][T24619] syz.5.4880 (24619): drop_caches: 2 [ 1451.428922][ T5823] airspy 2-1:0.0: usb_control_msg() failed -110 request 11 [ 1451.538220][ T5823] airspy 2-1:0.0: Registered as swradio24 [ 1452.064464][ T5823] airspy 2-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 1452.379768][T22853] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1452.532397][T16154] usb 2-1: USB disconnect, device number 18 [ 1452.590064][T22853] usb 5-1: Using ep0 maxpacket: 8 [ 1452.603888][T22853] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1452.618479][T22853] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1452.629036][T22853] usb 5-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x76, changing to 0x6 [ 1452.689868][T22853] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x6 has an invalid bInterval 100, changing to 10 [ 1452.702318][T22853] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 24936, setting to 1024 [ 1452.714765][T22853] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 1452.724925][T22853] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1453.195690][T22853] hub 5-1:1.0: bad descriptor, ignoring hub [ 1453.260004][T22853] hub 5-1:1.0: probe with driver hub failed with error -5 [ 1453.300667][T22853] cdc_wdm 5-1:1.0: skipping garbage [ 1453.337786][T22853] cdc_wdm 5-1:1.0: skipping garbage [ 1453.349642][T22853] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1453.594568][T22853] usb 5-1: USB disconnect, device number 94 [ 1453.940111][T22853] usb 5-1: new full-speed USB device number 95 using dummy_hcd [ 1454.714632][T22853] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1454.750525][T22853] usb 5-1: no configurations [ 1454.760332][ T30] audit: type=1800 audit(2000000099.168:2629): pid=24690 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.4899" name="/" dev="9p" ino=2 res=0 errno=0 [ 1454.787487][T22853] usb 5-1: can't read configurations, error -22 [ 1455.065547][ T30] audit: type=1400 audit(2000000099.478:2630): avc: denied { wake_alarm } for pid=24691 comm="syz.2.4900" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1455.285296][T24700] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4903'. [ 1455.553353][ T5940] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 1455.831033][T24707] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4905'. [ 1456.104002][T24715] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4906'. [ 1456.583797][ T5940] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1456.605015][ T5940] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1456.621499][T24722] syz_tun: entered allmulticast mode [ 1456.628304][ T5940] usb 3-1: can't read configurations, error -71 [ 1456.979798][T24730] syz_tun: entered allmulticast mode [ 1457.028128][T24730] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4910'. [ 1457.181618][T24739] FAULT_INJECTION: forcing a failure. [ 1457.181618][T24739] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1457.194986][T24739] CPU: 1 UID: 0 PID: 24739 Comm: syz.5.4913 Not tainted syzkaller #0 PREEMPT(full) [ 1457.195011][T24739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1457.195021][T24739] Call Trace: [ 1457.195028][T24739] [ 1457.195035][T24739] dump_stack_lvl+0x16c/0x1f0 [ 1457.195065][T24739] should_fail_ex+0x512/0x640 [ 1457.195091][T24739] _copy_from_user+0x2e/0xd0 [ 1457.195116][T24739] copy_from_sockptr_offset.constprop.0+0x136/0x170 [ 1457.195143][T24739] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 1457.195170][T24739] ? sock_has_perm+0x259/0x2f0 [ 1457.195192][T24739] tipc_setsockopt+0x1ef/0xdb0 [ 1457.195219][T24739] ? __pfx_tipc_setsockopt+0x10/0x10 [ 1457.195252][T24739] ? selinux_socket_setsockopt+0x6a/0x80 [ 1457.195272][T24739] ? __pfx_tipc_setsockopt+0x10/0x10 [ 1457.195298][T24739] do_sock_setsockopt+0xf3/0x1d0 [ 1457.195329][T24739] __sys_setsockopt+0x1a0/0x230 [ 1457.195355][T24739] __x64_sys_setsockopt+0xbd/0x160 [ 1457.195375][T24739] ? syscall_trace_enter+0xee/0x240 [ 1457.195399][T24739] do_syscall_64+0xcd/0x4e0 [ 1457.195426][T24739] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.195443][T24739] RIP: 0033:0x7f364cd8eec9 [ 1457.195458][T24739] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1457.195475][T24739] RSP: 002b:00007f364db9a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1457.195494][T24739] RAX: ffffffffffffffda RBX: 00007f364cfe5fa0 RCX: 00007f364cd8eec9 [ 1457.195507][T24739] RDX: 000000000000007f RSI: 000000000000010f RDI: 0000000000000003 [ 1457.195528][T24739] RBP: 00007f364db9a090 R08: 0000000000000004 R09: 0000000000000000 [ 1457.195539][T24739] R10: 0000200000000a80 R11: 0000000000000246 R12: 0000000000000001 [ 1457.195549][T24739] R13: 00007f364cfe6038 R14: 00007f364cfe5fa0 R15: 00007ffeda6652d8 [ 1457.195574][T24739] [ 1457.467549][T24721] syz_tun: left allmulticast mode [ 1457.651514][ T30] audit: type=1400 audit(2000000102.068:2631): avc: denied { getopt } for pid=24754 comm="syz.3.4919" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1457.670986][ C0] vkms_vblank_simulate: vblank timer overrun [ 1457.819859][ T5891] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1457.999700][ T5891] usb 5-1: Using ep0 maxpacket: 32 [ 1458.035329][ T5891] usb 5-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1458.094146][ T5891] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1458.209411][ T5891] usb 5-1: config 0 descriptor?? [ 1458.248652][ T5891] as10x_usb: device has been detected [ 1458.302405][ T5891] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1458.388196][ T5891] usb 5-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1459.064661][ T30] audit: type=1800 audit(2000000103.478:2632): pid=24760 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.4920" name="/" dev="9p" ino=2 res=0 errno=0 [ 1459.193727][ T5891] as10x_usb: error during firmware upload part1 [ 1459.200460][ T5891] Registered device nBox DVB-T Dongle [ 1459.284377][ T5940] hid_parser_main: 5 callbacks suppressed [ 1459.284390][ T5940] hid-generic 0006:0004:0009.0041: unknown main item tag 0x0 [ 1459.342294][ T5940] hid-generic 0006:0004:0009.0041: unknown main item tag 0x0 [ 1459.354893][ T5940] hid-generic 0006:0004:0009.0041: reserved main item tag 0xe [ 1459.362956][ T5940] hid-generic 0006:0004:0009.0041: unknown main item tag 0x0 [ 1459.374247][T24779] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4925'. [ 1459.374625][ T5940] hid-generic 0006:0004:0009.0041: unknown main item tag 0x0 [ 1459.417270][ T5940] hid-generic 0006:0004:0009.0041: unknown main item tag 0x0 [ 1459.447286][ T5940] hid-generic 0006:0004:0009.0041: unknown main item tag 0x0 [ 1459.473688][ T30] audit: type=1400 audit(2000000103.888:2633): avc: denied { setopt } for pid=24784 comm="syz.1.4926" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1459.501790][ T5940] hid-generic 0006:0004:0009.0041: unknown main item tag 0x0 [ 1459.529195][ T5940] hid-generic 0006:0004:0009.0041: unknown main item tag 0x0 [ 1459.564118][ T30] audit: type=1400 audit(2000000103.978:2634): avc: denied { create } for pid=24789 comm="syz.5.4927" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1459.585045][ T5940] hid-generic 0006:0004:0009.0041: unknown main item tag 0x0 [ 1459.585072][ T5940] hid-generic 0006:0004:0009.0041: unknown main item tag 0x0 [ 1459.627758][ T5940] hid-generic 0006:0004:0009.0041: hidraw0: VIRTUAL HID v0.04 Device [syz1] on syz0 [ 1459.632923][ T30] audit: type=1400 audit(2000000103.978:2635): avc: denied { mounton } for pid=24789 comm="syz.5.4927" path="/125/file0" dev="tmpfs" ino=691 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1459.697258][T24797] IPVS: sync thread started: state = MASTER, mcast_ifn = bond_slave_0, syncid = 1, id = 0 [ 1459.747646][ T30] audit: type=1400 audit(2000000104.158:2636): avc: denied { unlink } for pid=22356 comm="syz-executor" name="file0" dev="tmpfs" ino=691 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1459.921079][T24798] syzkaller0: entered promiscuous mode [ 1459.926887][T24798] syzkaller0: entered allmulticast mode [ 1460.164690][T24796] fido_id[24796]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1460.406917][T24805] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1460.691651][ T5940] usb 5-1: USB disconnect, device number 97 [ 1460.790685][ T5940] Unregistered device nBox DVB-T Dongle [ 1460.793681][ T5940] as10x_usb: device has been disconnected [ 1461.205946][ T30] audit: type=1800 audit(2000000105.618:2637): pid=24809 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.4934" name="/" dev="9p" ino=2 res=0 errno=0 [ 1461.389347][T24800] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4930'. [ 1461.709872][T16987] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 1461.763222][T24836] IPVS: set_ctl: invalid protocol: 50 0.0.0.0:20002 [ 1461.774250][T16154] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 1461.869647][T16987] usb 4-1: Using ep0 maxpacket: 8 [ 1461.878824][T16987] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1461.919360][T16987] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1461.929732][T16154] usb 5-1: Using ep0 maxpacket: 16 [ 1461.936907][ T30] audit: type=1400 audit(2000000106.328:2638): avc: denied { ioctl } for pid=24833 comm="syz.5.4940" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0x940a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1461.961699][ C0] vkms_vblank_simulate: vblank timer overrun [ 1461.970639][T16987] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 1461.972220][T16154] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1461.982079][T16987] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 1462.002716][T16987] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 1462.009795][T16154] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1462.034408][T16154] usb 5-1: Product: syz [ 1462.038690][T16987] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1462.052080][T16987] hub 4-1:1.0: bad descriptor, ignoring hub [ 1462.059810][T16987] hub 4-1:1.0: probe with driver hub failed with error -5 [ 1462.074597][T16987] cdc_wdm 4-1:1.0: skipping garbage [ 1462.082022][T16987] cdc_wdm 4-1:1.0: skipping garbage [ 1462.088103][T16987] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1462.098104][T16987] cdc_wdm 4-1:1.0: Unknown control protocol [ 1462.193189][T16154] usb 5-1: Manufacturer: syz [ 1462.197994][T16154] usb 5-1: SerialNumber: syz [ 1462.237651][T16154] usb 5-1: config 0 descriptor?? [ 1462.401683][ T5832] Bluetooth: hci1: Malformed LE Event: 0x0b [ 1462.881840][T16987] usb 4-1: USB disconnect, device number 127 [ 1462.899156][T24828] cdc_wdm 4-1:1.0: Error autopm - -16 [ 1463.109893][T16154] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 1463.216730][T16987] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 1463.379910][T16154] usb 6-1: Using ep0 maxpacket: 8 [ 1463.394601][T16154] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1463.421100][T16987] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1463.432639][T16987] usb 4-1: no configurations [ 1463.442743][T16154] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1463.474335][T16987] usb 4-1: can't read configurations, error -22 [ 1463.474343][T16154] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 1463.514032][T16154] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 1463.536401][T16154] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 1463.546569][T16154] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1463.602318][T16154] hub 6-1:1.0: bad descriptor, ignoring hub [ 1463.613863][T16154] hub 6-1:1.0: probe with driver hub failed with error -5 [ 1463.739282][T16154] cdc_wdm 6-1:1.0: skipping garbage [ 1463.772488][T16154] cdc_wdm 6-1:1.0: skipping garbage [ 1463.821784][T16154] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 1463.856562][T16154] cdc_wdm 6-1:1.0: Unknown control protocol [ 1463.952126][T16154] usb 6-1: USB disconnect, device number 21 [ 1464.379615][ T9] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 1465.090503][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1465.123536][ T9] usb 3-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.40 [ 1465.132901][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1465.141136][ T9] usb 3-1: Product: syz [ 1465.145501][ T9] usb 3-1: Manufacturer: syz [ 1465.152185][ T9] usb 3-1: SerialNumber: syz [ 1465.418718][T24856] IPVS: set_ctl: invalid protocol: 29487 47.112.111.119:25970 [ 1465.434132][ T9] pxrc 3-1:1.0: Could not find endpoint [ 1465.441327][ T9] usb 3-1: USB disconnect, device number 5 [ 1465.542636][T16154] usb 5-1: USB disconnect, device number 98 [ 1465.659667][ T30] audit: type=1326 audit(2000000110.068:2639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24873 comm="syz.1.4950" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f406958eec9 code=0x0 [ 1465.714192][T24875] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4950'. [ 1466.071195][ T30] audit: type=1400 audit(2000000110.488:2640): avc: denied { bind } for pid=24886 comm="syz.2.4954" lport=41112 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1466.109043][ T30] audit: type=1400 audit(2000000110.488:2641): avc: denied { node_bind } for pid=24886 comm="syz.2.4954" scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 1466.110282][T16154] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1466.482809][T16154] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1466.506334][T16154] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1466.514756][T24893] FAULT_INJECTION: forcing a failure. [ 1466.514756][T24893] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1466.557220][T16154] usb 5-1: Product: syz [ 1466.564840][ T5832] Bluetooth: hci3: Malformed LE Event: 0x0b [ 1466.573021][T24893] CPU: 0 UID: 0 PID: 24893 Comm: syz.3.4957 Not tainted syzkaller #0 PREEMPT(full) [ 1466.573047][T24893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1466.573058][T24893] Call Trace: [ 1466.573064][T24893] [ 1466.573072][T24893] dump_stack_lvl+0x16c/0x1f0 [ 1466.573100][T24893] should_fail_ex+0x512/0x640 [ 1466.573126][T24893] _copy_from_user+0x2e/0xd0 [ 1466.573150][T24893] move_addr_to_kernel+0x65/0x170 [ 1466.573170][T24893] __sys_sendto+0x1be/0x520 [ 1466.573191][T24893] ? __pfx___sys_sendto+0x10/0x10 [ 1466.573233][T24893] ? ksys_write+0x1ac/0x250 [ 1466.573259][T24893] ? __pfx_ksys_write+0x10/0x10 [ 1466.573288][T24893] __x64_sys_sendto+0xe0/0x1c0 [ 1466.573308][T24893] ? do_syscall_64+0x91/0x4e0 [ 1466.573331][T24893] ? lockdep_hardirqs_on+0x7c/0x110 [ 1466.573353][T24893] do_syscall_64+0xcd/0x4e0 [ 1466.573378][T24893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1466.573400][T24893] RIP: 0033:0x7f0999b8eec9 [ 1466.573415][T24893] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1466.573432][T24893] RSP: 002b:00007f099a9c0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1466.573451][T24893] RAX: ffffffffffffffda RBX: 00007f0999de5fa0 RCX: 00007f0999b8eec9 [ 1466.573463][T24893] RDX: 000000000000e955 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1466.573474][T24893] RBP: 00007f099a9c0090 R08: 0000200000000540 R09: 0000000000000014 [ 1466.573485][T24893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1466.573496][T24893] R13: 00007f0999de6038 R14: 00007f0999de5fa0 R15: 00007ffe395f0368 [ 1466.573521][T24893] [ 1466.588037][T16154] usb 5-1: Manufacturer: syz [ 1467.102175][T16154] usb 5-1: SerialNumber: syz [ 1467.143139][T24909] Bluetooth: MGMT ver 1.23 [ 1467.895234][T16154] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 1467.925555][T24920] netlink: 'syz.2.4962': attribute type 4 has an invalid length. [ 1467.928556][T16154] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1467.969563][T24920] netlink: 152 bytes leftover after parsing attributes in process `syz.2.4962'. [ 1468.028346][T16154] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1468.101019][T24924] nft_compat: unsupported protocol 0 [ 1468.109180][T24920] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1468.109694][T16154] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 1468.290073][T16154] usb 5-1: USB disconnect, device number 99 [ 1468.972547][ T30] audit: type=1400 audit(2000000113.388:2642): avc: denied { call } for pid=24936 comm="syz.1.4969" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 1469.464295][T24943] binder: 24936:24943 ioctl ae01 4000000000000 returned -22 [ 1470.388240][ T30] audit: type=1400 audit(2000000114.798:2643): avc: denied { ioctl } for pid=24956 comm="syz.2.4976" path="socket:[85286]" dev="sockfs" ino=85286 ioctlcmd=0x8b18 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1470.558472][ T30] audit: type=1800 audit(2000000114.968:2644): pid=24964 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.4977" name="/" dev="9p" ino=2 res=0 errno=0 [ 1471.759334][T24983] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4982'. [ 1472.637755][ T30] audit: type=1800 audit(2000000117.049:2645): pid=24996 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.4985" name="/" dev="9p" ino=2 res=0 errno=0 [ 1472.684413][T25002] netlink: 4400 bytes leftover after parsing attributes in process `syz.5.4987'. [ 1472.694850][T25002] workqueue: name exceeds WQ_NAME_LEN. Truncating to: Ç`]Š •Iöq¯!¾>Ýsó³Îú*Š®!)\Ç+` [ 1472.842726][ T9] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 1473.042606][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 1473.188397][ T9] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1473.212459][ T9] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1473.219204][ T9] usb 5-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 1473.233881][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1473.247778][ T9] usb 5-1: config 0 descriptor?? [ 1475.559137][ T30] audit: type=1400 audit(2000000119.969:2646): avc: denied { write } for pid=25027 comm="syz.2.4994" name="mice" dev="devtmpfs" ino=915 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1475.670225][ T9] usbhid 5-1:0.0: can't add hid device: -71 [ 1475.714015][ T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1475.730113][T25024] SELinux: failed to load policy [ 1475.840938][ T9] usb 5-1: USB disconnect, device number 100 [ 1478.481509][T25031] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=25031 comm=syz.2.4994 [ 1478.496482][T25040] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.4997'. [ 1478.528821][T25031] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1024 sclass=netlink_route_socket pid=25031 comm=syz.2.4994 [ 1478.544721][T25031] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=25031 comm=syz.2.4994 [ 1478.563586][T25031] IPv6: NLM_F_CREATE should be specified when creating new route [ 1478.581795][T25040] openvswitch: netlink: Message has 5 unknown bytes. [ 1478.660060][T25031] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1478.667290][T25031] IPv6: NLM_F_CREATE should be set when creating new route [ 1478.674527][T25031] IPv6: NLM_F_CREATE should be set when creating new route [ 1478.859689][T16154] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 1479.029626][T16154] usb 2-1: Using ep0 maxpacket: 32 [ 1479.048033][T16154] usb 2-1: config 0 has an invalid interface number: 85 but max is 0 [ 1479.067406][T16154] usb 2-1: config 0 has no interface number 0 [ 1479.088636][T16154] usb 2-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1479.116630][T16154] usb 2-1: config 0 interface 85 has no altsetting 0 [ 1479.147183][T16154] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1479.163101][T16154] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1479.187259][T16154] usb 2-1: Product: syz [ 1479.234682][T25051] NILFS (loop3): device size too small [ 1479.242816][T16154] usb 2-1: Manufacturer: syz [ 1479.251026][T16154] usb 2-1: SerialNumber: syz [ 1479.263489][T16154] usb 2-1: config 0 descriptor?? [ 1479.477416][T25055] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.5002'. [ 1479.682399][T16154] appletouch 2-1:0.85: Geyser mode initialized. [ 1479.695666][T16154] input: appletouch as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.85/input/input42 [ 1479.951836][ C0] appletouch 2-1:0.85: appletouch: OVERFLOW with data length 64, actual length is 64 [ 1480.175642][ T5823] usb 2-1: USB disconnect, device number 19 [ 1480.181680][ T9] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1480.210567][ T5823] appletouch 2-1:0.85: input: appletouch disconnected [ 1480.349582][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 1480.356627][ T9] usb 6-1: config 0 has an invalid interface number: 85 but max is 0 [ 1480.371467][ T9] usb 6-1: config 0 has no interface number 0 [ 1480.396702][ T9] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1480.475128][ T9] usb 6-1: config 0 interface 85 has no altsetting 0 [ 1480.491718][ T9] usb 6-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1480.506562][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1480.524319][ T9] usb 6-1: Product: syz [ 1480.532003][ T9] usb 6-1: Manufacturer: syz [ 1480.536595][ T9] usb 6-1: SerialNumber: syz [ 1480.565041][ T9] usb 6-1: config 0 descriptor?? [ 1481.151876][ T9] appletouch 6-1:0.85: Geyser mode initialized. [ 1481.260916][ T9] input: appletouch as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.85/input/input43 [ 1481.364049][ C0] appletouch 6-1:0.85: appletouch: OVERFLOW with data length 64, actual length is 64 [ 1481.561358][ T30] audit: type=1800 audit(2000000125.979:2647): pid=25085 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.5011" name="/" dev="9p" ino=2 res=0 errno=0 [ 1481.583280][ C0] appletouch 6-1:0.85: atp_complete: usb_submit_urb failed with result -1 [ 1481.597283][ T9] usb 6-1: USB disconnect, device number 22 [ 1481.611259][ T30] audit: type=1800 audit(2000000126.029:2648): pid=25087 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.5012" name="/" dev="9p" ino=2 res=0 errno=0 [ 1481.695384][ T9] appletouch 6-1:0.85: input: appletouch disconnected [ 1481.725328][T25093] NILFS (loop1): device size too small [ 1481.999726][ T943] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1482.089803][T20614] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 1482.150385][T25109] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5019'. [ 1482.219969][ T943] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1482.230648][T25110] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5019'. [ 1482.287405][T20614] usb 5-1: config 0 has an invalid interface number: 160 but max is 0 [ 1482.319968][ T943] usb 3-1: config 9 has an invalid interface number: 53 but max is 0 [ 1482.363586][T20614] usb 5-1: config 0 has no interface number 0 [ 1482.419709][ T943] usb 3-1: config 9 has no interface number 0 [ 1482.428397][T20614] usb 5-1: config 0 interface 160 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1482.449657][ T943] usb 3-1: config 9 interface 53 has no altsetting 0 [ 1482.471656][T20614] usb 5-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=9e.4e [ 1482.486127][ T943] usb 3-1: New USB device found, idVendor=0403, idProduct=9e90, bcdDevice=7e.4b [ 1482.495501][T20614] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1482.495525][T20614] usb 5-1: Product: syz [ 1482.495542][T20614] usb 5-1: Manufacturer: syz [ 1482.495558][T20614] usb 5-1: SerialNumber: syz [ 1482.496710][ T943] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1482.496731][ T943] usb 3-1: Product: syz [ 1482.496745][ T943] usb 3-1: Manufacturer: syz [ 1482.496760][ T943] usb 3-1: SerialNumber: syz [ 1482.498282][T20614] usb 5-1: config 0 descriptor?? [ 1482.505973][T20614] usb 5-1: Found UVC 0.00 device syz (05ac:8501) [ 1482.505992][T20614] usb 5-1: No valid video chain found. [ 1482.742337][ T943] ftdi_sio 3-1:9.53: FTDI USB Serial Device converter detected [ 1482.756402][ T943] ftdi_sio ttyUSB0: unknown device type: 0x7e4b [ 1482.790451][ T9] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 1482.810391][ T943] usb 3-1: USB disconnect, device number 6 [ 1482.823484][ T943] ftdi_sio 3-1:9.53: device disconnected [ 1482.959566][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 1482.959643][T20614] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 1482.966208][ T9] usb 6-1: config 0 has no interfaces? [ 1483.015876][ T9] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1483.028306][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1483.048525][ T9] usb 6-1: Product: syz [ 1483.057243][ T9] usb 6-1: Manufacturer: syz [ 1483.068472][ T9] usb 6-1: SerialNumber: syz [ 1483.090267][ T9] usb 6-1: config 0 descriptor?? [ 1483.149690][T20614] usb 4-1: Using ep0 maxpacket: 8 [ 1483.158137][T20614] usb 4-1: config 0 has no interfaces? [ 1483.166684][T20614] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1483.179393][T20614] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1483.194387][T20614] usb 4-1: Product: syz [ 1483.202020][T20614] usb 4-1: Manufacturer: syz [ 1483.207952][T20614] usb 4-1: SerialNumber: syz [ 1483.257923][T20614] usb 4-1: config 0 descriptor?? [ 1483.542004][T25119] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1483.566274][T25119] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1483.575895][T25115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1483.593553][T20614] usb 4-1: USB disconnect, device number 4 [ 1483.593833][T25115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1483.962969][ T5823] usb 6-1: USB disconnect, device number 23 [ 1484.024214][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.150701][ T5823] usb 5-1: USB disconnect, device number 101 [ 1484.191090][ T30] audit: type=1400 audit(2000000128.609:2649): avc: denied { ioctl } for pid=25132 comm="syz.1.5026" path="socket:[85586]" dev="sockfs" ino=85586 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1484.415728][T25139] NILFS (loop3): device size too small [ 1484.779687][ T9] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1485.239565][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 1485.246356][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1485.303508][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1485.471036][T25164] overlay: ./file1 is not a directory [ 1485.827673][T25163] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1485.916507][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1485.955891][ T9] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1485.996670][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1486.149715][ T9] usb 6-1: config 0 descriptor?? [ 1486.228391][T25176] fuse: Bad value for 'group_id' [ 1486.235890][T25176] fuse: Bad value for 'group_id' [ 1486.292691][ T30] audit: type=1800 audit(2000000130.709:2650): pid=25176 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.5038" name="/" dev="9p" ino=2 res=0 errno=0 [ 1486.344361][T20614] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 1486.458102][T25179] mkiss: ax0: crc mode is auto. [ 1486.529734][ T30] audit: type=1400 audit(2000000130.869:2651): avc: denied { connect } for pid=25174 comm="syz.2.5039" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1487.055953][T25184] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1487.069014][T25184] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1487.139787][T20614] usb 5-1: Using ep0 maxpacket: 8 [ 1487.199631][T20614] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1487.266141][T20614] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1487.277744][T20614] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1487.343945][T20614] usb 5-1: New USB device found, idVendor=28bd, idProduct=0905, bcdDevice= 0.00 [ 1487.358892][T20614] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1487.405391][T25188] trusted_key: encrypted_key: key user:syz not found [ 1487.420838][T20614] usb 5-1: config 0 descriptor?? [ 1487.507940][T25191] overlayfs: missing 'lowerdir' [ 1487.524430][T25191] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.5041'. [ 1488.189609][ T5940] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 1488.232204][T25172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1488.264746][ T9] usbhid 6-1:0.0: can't add hid device: -71 [ 1488.274038][T25172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1488.286876][ T9] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1488.329876][ T5823] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 1488.357262][T20614] input: HID 28bd:0905 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:28BD:0905.0042/input/input44 [ 1488.358126][ T9] usb 6-1: USB disconnect, device number 24 [ 1488.429598][ T5940] usb 2-1: Using ep0 maxpacket: 32 [ 1488.527103][ T5823] usb 4-1: device descriptor read/64, error -71 [ 1488.761240][ T5940] usb 2-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 1488.852020][ T5940] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1488.860820][ T5940] usb 2-1: Product: syz [ 1488.869853][ T5940] usb 2-1: Manufacturer: syz [ 1488.875704][ T5940] usb 2-1: SerialNumber: syz [ 1488.908199][T20614] uclogic 0003:28BD:0905.0042: input,hidraw0: USB HID v8.15 Mouse [HID 28bd:0905] on usb-dummy_hcd.4-1/input0 [ 1488.963401][ T5940] usb 2-1: config 0 descriptor?? [ 1488.968935][T20614] usb 5-1: USB disconnect, device number 102 [ 1488.999705][ T5823] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 1489.048494][ T5940] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 1489.072800][T25208] fido_id[25208]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 1489.179970][ T5823] usb 4-1: device descriptor read/64, error -71 [ 1489.330326][ T5823] usb usb4-port1: attempt power cycle [ 1489.514507][T25218] ------------[ cut here ]------------ [ 1489.520064][T25218] WARNING: CPU: 0 PID: 25218 at fs/nsfs.c:493 nsfs_fh_to_dentry+0x9de/0xe10 [ 1489.528739][T25218] Modules linked in: [ 1489.532696][T25218] CPU: 0 UID: 0 PID: 25218 Comm: syz.4.5048 Not tainted syzkaller #0 PREEMPT(full) [ 1489.542088][T25218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1489.552207][T25218] RIP: 0010:nsfs_fh_to_dentry+0x9de/0xe10 [ 1489.557918][T25218] Code: 0c 50 ff e9 63 fe ff ff e8 bf 30 74 ff 90 0f 0b 90 e9 7b f8 ff ff e8 b1 30 74 ff 90 0f 0b 90 e9 ce f8 ff ff e8 a3 30 74 ff 90 <0f> 0b 90 e9 32 f9 ff ff e8 95 30 74 ff 49 8d 7d 10 48 b8 00 00 00 [ 1489.577643][T25218] RSP: 0018:ffffc9000b987b38 EFLAGS: 00010283 [ 1489.583808][T25218] RAX: 0000000000000083 RBX: 0000000000000000 RCX: ffffc9001afb5000 [ 1489.591797][T25218] RDX: 0000000000080000 RSI: ffffffff8246e85d RDI: 0000000000000004 [ 1489.599771][T25218] RBP: ffff8880302e3f88 R08: 0000000000000004 R09: 00000000effffffe [ 1489.607741][T25218] R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff92001730f68 [ 1489.615723][T25218] R13: ffffffff90445d58 R14: 00000000effffffe R15: 0000000000000001 [ 1489.623722][T25218] FS: 00007ffa892106c0(0000) GS:ffff888124e71000(0000) knlGS:0000000000000000 [ 1489.632789][T25218] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1489.639415][T25218] CR2: 0000200000000000 CR3: 0000000083614000 CR4: 00000000003526f0 [ 1489.647386][T25218] Call Trace: [ 1489.650714][T25218] [ 1489.653655][T25218] ? do_handle_open+0x564/0xc90 [ 1489.658530][T25218] ? __pfx_nsfs_fh_to_dentry+0x10/0x10 [ 1489.664045][T25218] ? __kasan_kmalloc+0xaa/0xb0 [ 1489.668843][T25218] ? __kmalloc_noprof+0x223/0x510 [ 1489.673923][T25218] ? do_handle_open+0x564/0xc90 [ 1489.678790][T25218] ? do_syscall_64+0xcd/0x4e0 [ 1489.683532][T25218] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1489.689666][T25218] exportfs_decode_fh_raw+0x167/0x7d0 [ 1489.695068][T25218] ? __pfx_vfs_dentry_acceptable+0x10/0x10 [ 1489.700949][T25218] ? __pfx_nsfs_fh_to_dentry+0x10/0x10 [ 1489.706439][T25218] ? __pfx_exportfs_decode_fh_raw+0x10/0x10 [ 1489.712419][T25218] do_handle_open+0x702/0xc90 [ 1489.717131][T25218] ? __pfx_do_handle_open+0x10/0x10 [ 1489.722380][T25218] ? __x64_sys_futex+0x1e0/0x4c0 [ 1489.727344][T25218] ? xfd_validate_state+0x61/0x180 [ 1489.732512][T25218] ? do_syscall_64+0xcd/0x4e0 [ 1489.737223][T25218] do_syscall_64+0xcd/0x4e0 [ 1489.741787][T25218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1489.747694][T25218] RIP: 0033:0x7ffa8838eec9 [ 1489.752143][T25218] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1489.771760][T25218] RSP: 002b:00007ffa89210038 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 1489.780234][T25218] RAX: ffffffffffffffda RBX: 00007ffa885e5fa0 RCX: 00007ffa8838eec9 [ 1489.788197][T25218] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1489.796176][T25218] RBP: 00007ffa88411f91 R08: 0000000000000000 R09: 0000000000000000 [ 1489.804160][T25218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1489.812145][T25218] R13: 00007ffa885e6038 R14: 00007ffa885e5fa0 R15: 00007ffde27d2f18 [ 1489.820132][T25218] [ 1489.823148][T25218] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1489.830404][T25218] CPU: 0 UID: 0 PID: 25218 Comm: syz.4.5048 Not tainted syzkaller #0 PREEMPT(full) [ 1489.839747][T25218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1489.849780][T25218] Call Trace: [ 1489.853036][T25218] [ 1489.855957][T25218] dump_stack_lvl+0x3d/0x1f0 [ 1489.860529][T25218] vpanic+0x6e8/0x7a0 [ 1489.864486][T25218] ? __pfx_vpanic+0x10/0x10 [ 1489.868964][T25218] ? nsfs_fh_to_dentry+0x9de/0xe10 [ 1489.874047][T25218] panic+0xca/0xd0 [ 1489.877742][T25218] ? __pfx_panic+0x10/0x10 [ 1489.882136][T25218] check_panic_on_warn+0xab/0xb0 [ 1489.887060][T25218] __warn+0xf6/0x3c0 [ 1489.890942][T25218] ? nsfs_fh_to_dentry+0x9de/0xe10 [ 1489.896028][T25218] report_bug+0x3c3/0x580 [ 1489.900336][T25218] ? nsfs_fh_to_dentry+0x9de/0xe10 [ 1489.905431][T25218] handle_bug+0x184/0x210 [ 1489.909753][T25218] exc_invalid_op+0x17/0x50 [ 1489.914241][T25218] asm_exc_invalid_op+0x1a/0x20 [ 1489.919074][T25218] RIP: 0010:nsfs_fh_to_dentry+0x9de/0xe10 [ 1489.924777][T25218] Code: 0c 50 ff e9 63 fe ff ff e8 bf 30 74 ff 90 0f 0b 90 e9 7b f8 ff ff e8 b1 30 74 ff 90 0f 0b 90 e9 ce f8 ff ff e8 a3 30 74 ff 90 <0f> 0b 90 e9 32 f9 ff ff e8 95 30 74 ff 49 8d 7d 10 48 b8 00 00 00 [ 1489.944360][T25218] RSP: 0018:ffffc9000b987b38 EFLAGS: 00010283 [ 1489.950403][T25218] RAX: 0000000000000083 RBX: 0000000000000000 RCX: ffffc9001afb5000 [ 1489.958362][T25218] RDX: 0000000000080000 RSI: ffffffff8246e85d RDI: 0000000000000004 [ 1489.966318][T25218] RBP: ffff8880302e3f88 R08: 0000000000000004 R09: 00000000effffffe [ 1489.974268][T25218] R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff92001730f68 [ 1489.982223][T25218] R13: ffffffff90445d58 R14: 00000000effffffe R15: 0000000000000001 [ 1489.990190][T25218] ? nsfs_fh_to_dentry+0x9dd/0xe10 [ 1489.995282][T25218] ? nsfs_fh_to_dentry+0x9dd/0xe10 [ 1490.000375][T25218] ? do_handle_open+0x564/0xc90 [ 1490.005205][T25218] ? __pfx_nsfs_fh_to_dentry+0x10/0x10 [ 1490.010643][T25218] ? __kasan_kmalloc+0xaa/0xb0 [ 1490.015387][T25218] ? __kmalloc_noprof+0x223/0x510 [ 1490.020411][T25218] ? do_handle_open+0x564/0xc90 [ 1490.025265][T25218] ? do_syscall_64+0xcd/0x4e0 [ 1490.029929][T25218] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1490.035992][T25218] exportfs_decode_fh_raw+0x167/0x7d0 [ 1490.041353][T25218] ? __pfx_vfs_dentry_acceptable+0x10/0x10 [ 1490.047147][T25218] ? __pfx_nsfs_fh_to_dentry+0x10/0x10 [ 1490.052607][T25218] ? __pfx_exportfs_decode_fh_raw+0x10/0x10 [ 1490.058510][T25218] do_handle_open+0x702/0xc90 [ 1490.063164][T25218] ? __pfx_do_handle_open+0x10/0x10 [ 1490.068344][T25218] ? __x64_sys_futex+0x1e0/0x4c0 [ 1490.073261][T25218] ? xfd_validate_state+0x61/0x180 [ 1490.078355][T25218] ? do_syscall_64+0xcd/0x4e0 [ 1490.083012][T25218] do_syscall_64+0xcd/0x4e0 [ 1490.087495][T25218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1490.093364][T25218] RIP: 0033:0x7ffa8838eec9 [ 1490.097753][T25218] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1490.117348][T25218] RSP: 002b:00007ffa89210038 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 1490.125743][T25218] RAX: ffffffffffffffda RBX: 00007ffa885e5fa0 RCX: 00007ffa8838eec9 [ 1490.133696][T25218] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1490.141645][T25218] RBP: 00007ffa88411f91 R08: 0000000000000000 R09: 0000000000000000 [ 1490.149595][T25218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1490.157542][T25218] R13: 00007ffa885e6038 R14: 00007ffa885e5fa0 R15: 00007ffde27d2f18 [ 1490.165503][T25218] [ 1490.168700][T25218] Kernel Offset: disabled [ 1490.173014][T25218] Rebooting in 86400 seconds..