last executing test programs: 7.368537396s ago: executing program 0 (id=75): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_usb_connect(0x5, 0x1cb, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3, 0x8f5}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xff, 0xb}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4004884) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000300)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000340)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000003c0)="05031c00d3fc1400fd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000400)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 5.83829752s ago: executing program 0 (id=90): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test\x00', 0x777) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000140)='100000', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r3, &(0x7f0000000340)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r4, &(0x7f0000000480)='0', 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x60, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x34, 0x3, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_EXPR={0x28, 0x7, 0x0, 0x1, @target={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TARGET_NAME={0x9, 0x1, 'SNAT\x00'}]}}}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe4}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1, 0xb, &(0x7f0000000700)=ANY=[@ANYRESDEC=r3], &(0x7f0000000740)='syzkaller\x00', 0x2, 0xfef, &(0x7f0000000780)=""/4079, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe979}, 0x94) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0xfffffffffffffff9, 0x7, 0x2, 0x182, 0x2, 0x10, 0xf1, 0x10000000000003, 0x1, 0x5, 0x0, 0x29, 0x0, 0xf48, 0x9, 0xfffffffffffffffa], 0xe000}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x3, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0x0, 0x68ff, 0x7529, 0x8000000009, 0x803, 0x0, 0x9, 0x2], 0xeeee8000, 0x306780}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x41000, 0x8, 0x8, 0xf, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x1, 0x5, 0x75, 0x6, 0x36, 0xe, 0x2, 0x87}, {0x3000, 0xdddd0000, 0x4, 0x5, 0x3, 0x6, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0xfec00000, 0xeeee0000, 0x4, 0x6, 0x5, 0x7f, 0xb, 0xff, 0x8, 0x7, 0xe, 0x9}, {0xf000, 0x0, 0xf, 0x3, 0x16, 0x6, 0x2, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0x0, 0x8, 0x9e, 0xb1, 0xc, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0xdddd0000, 0xc, 0x5, 0x7, 0x5, 0x7, 0x8, 0x3, 0x81, 0x42, 0x70}, {0xdddd0000, 0xa000, 0xf, 0x5, 0xcd, 0x7, 0x9, 0x9, 0x7, 0xc, 0xb0, 0x99}, {0xffff1000, 0x30}, {0x100000, 0x7}, 0x1, 0x0, 0x3000, 0x2024, 0x2, 0xdc01, 0x100000, [0x6800000000000000, 0x3, 0x4, 0x8]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 5.811223401s ago: executing program 0 (id=91): unshare(0x400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) 5.761811612s ago: executing program 0 (id=92): syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0) mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x10, 0x0) mount$fuse(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x80, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=000000', @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0]) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8001}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000065c0)='memory.events\x00', 0x275a, 0x0) syz_create_resource$binfmt(0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000006780), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000067c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000006800), 0x318, 0x0) recvmmsg(r0, &(0x7f0000006840), 0x10106, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000006a00)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000006a40)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000006a80)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 5.41234827s ago: executing program 4 (id=93): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000880)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200000}]}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000008c0)={0x3, 0x0, [{0x1b, 0x0, 0xc00}, {0x80f, 0x0, 0x1ff}, {0x832, 0x0, 0x40000}]}) 5.39448336s ago: executing program 4 (id=94): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './proc/mtrr\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x8, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB], &(0x7f00000005c0)='syzkaller\x00'}, 0x94) fsmount(0xffffffffffffffff, 0x0, 0x8) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r3, 0x40104d06, &(0x7f0000000100)="00000200000000000000020001") 4.50954283s ago: executing program 4 (id=95): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x4, 0x5, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x3, &(0x7f0000000280)=@raw=[@alu={0x7, 0x0, 0x0, 0x2, 0x0, 0x30, 0xfffffffc}, @exit, @exit], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.50926388s ago: executing program 4 (id=96): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x4c881, &(0x7f0000000180)={0xa, 0x4e25, 0x10, @mcast2}, 0x1c) close(r0) 4.50910208s ago: executing program 4 (id=97): r0 = syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e79"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB="40010400000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000280)={0x40, 0x7, 0x1b, "239e9a77e436f288ba0275f9c295621fd42dfca15187b435fd8614"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) 3.325935336s ago: executing program 3 (id=98): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0x10000)=nil, 0x10000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000001000)=nil, 0x10000}, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0xffff0000, 0x10000, &(0x7f0000001000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000300)={[], 0xfff0, 0x202}) r4 = socket(0x40000000015, 0x5, 0x0) recvmsg$can_bcm(r4, 0x0, 0x200121e1) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.038620342s ago: executing program 1 (id=100): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000880)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x7, 0x4, 0xffffffff, 0x4e38}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f00000008c0)=@vmx={0x4, 0x0, 0x2080, {0x1000, 0xffffffffffffffff, {0x3}, 0x1}, {"0100"}}) 2.987696154s ago: executing program 1 (id=101): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test\x00', 0x777) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000140)='100000', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r3, &(0x7f0000000340)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r4, &(0x7f0000000480)='0', 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x60, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x34, 0x3, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_EXPR={0x28, 0x7, 0x0, 0x1, @target={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TARGET_NAME={0x9, 0x1, 'SNAT\x00'}]}}}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe4}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1, 0xb, &(0x7f0000000700)=ANY=[@ANYRESDEC=r3], &(0x7f0000000740)='syzkaller\x00', 0x2, 0xfef, &(0x7f0000000780)=""/4079, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe979}, 0x94) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0xfffffffffffffff9, 0x7, 0x2, 0x182, 0x2, 0x10, 0xf1, 0x10000000000003, 0x1, 0x5, 0x0, 0x29, 0x0, 0xf48, 0x9, 0xfffffffffffffffa], 0xe000}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x3, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0x0, 0x68ff, 0x7529, 0x8000000009, 0x803, 0x0, 0x9, 0x2], 0xeeee8000, 0x306780}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x41000, 0x8, 0x8, 0xf, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x1, 0x5, 0x75, 0x6, 0x36, 0xe, 0x2, 0x87}, {0x3000, 0xdddd0000, 0x4, 0x5, 0x3, 0x6, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0xfec00000, 0xeeee0000, 0x4, 0x6, 0x5, 0x7f, 0xb, 0xff, 0x8, 0x7, 0xe, 0x9}, {0xf000, 0x0, 0xf, 0x3, 0x16, 0x6, 0x2, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0x0, 0x8, 0x9e, 0xb1, 0xc, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0xdddd0000, 0xc, 0x5, 0x7, 0x5, 0x7, 0x8, 0x3, 0x81, 0x42, 0x70}, {0xdddd0000, 0xa000, 0xf, 0x5, 0xcd, 0x7, 0x9, 0x9, 0x7, 0xc, 0xb0, 0x99}, {0xffff1000, 0x30}, {0x100000, 0x7}, 0x1, 0x0, 0x3000, 0x2024, 0x2, 0xdc01, 0x100000, [0x6800000000000000, 0x3, 0x4, 0x8]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.908789665s ago: executing program 1 (id=102): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x2c, r1, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY={0x10, 0x50, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x40) 2.842026847s ago: executing program 1 (id=103): syz_usb_connect(0x2, 0x86, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000b8db3008720541005470012207010902740001000040000904"], 0x0) 2.781297708s ago: executing program 0 (id=104): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000880)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200000}]}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000008c0)={0x3, 0x0, [{0x1b, 0x0, 0xc00}, {0x80f, 0x0, 0x1ff}, {0x832, 0x0, 0x40000}]}) 2.738889669s ago: executing program 0 (id=105): r0 = syz_open_dev$usbfs(&(0x7f0000000140), 0x204, 0xa0c2) r1 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) r2 = socket(0x2, 0xa, 0x300) setsockopt$packet_fanout_data(r2, 0x107, 0x16, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f00000000c0)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x7, 0x6, "431600", 0x28, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @loopback={0xff00000000000000}, @loopback}}}}}}, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000001bc0)) r3 = io_uring_setup(0x105a, &(0x7f0000000180)={0x0, 0x3873, 0x40, 0x2, 0x1ce}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000300)=[{0x0}, {&(0x7f0000000280)=""/80, 0x50}], 0x2) 2.474969575s ago: executing program 3 (id=107): syz_usb_connect(0x1, 0x3d, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 1.602091534s ago: executing program 2 (id=108): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) 1.507195716s ago: executing program 4 (id=109): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@loopback, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0xfffd, 0x0, 0x3000, 0xa, 0x20}, {0x0, 0x800000000000, 0x4, 0x3, 0x0, 0x0, 0x0, 0x10000000000}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private=0x4, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) syz_usb_connect(0x0, 0x73, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x8e, 0xb5, 0xfd, 0x20, 0x12d1, 0x3e5b, 0xd84b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x61, 0x1, 0x3, 0x40, 0x0, 0x1, "", [{{0x9, 0x4, 0x29, 0x7, 0x3, 0xff, 0x1, 0x7, 0x8, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0xff6f}, {0xd, 0x24, 0xf, 0x1, 0x3ff, 0xe4, 0xe8, 0x7f}}, @cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0xb, 0x400, 0x8001, 0x1}, {0x6, 0x24, 0x1a, 0x8, 0x4}}], [{{0x9, 0x5, 0x6, 0xc, 0x40, 0x6, 0x72, 0xff}}, {{0x9, 0x5, 0xd, 0x0, 0x10, 0x2c, 0x0, 0x6}}, {{0x9, 0x5, 0xe, 0x0, 0x400, 0x6, 0xb, 0x2}}]}}]}}]}}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, 0x0) statx(0xffffffffffffffff, 0x0, 0x149e065c1a1d0500, 0x802, 0x0) gettid() r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="020602000200000002"], 0x10}}, 0x0) 1.228819013s ago: executing program 2 (id=110): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000001fc0)={0x0, 0x0, &(0x7f0000001f80)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELCHAIN={0x14, 0x5, 0xa, 0x5, 0x0, 0x0, {0x5}}, @NFT_MSG_NEWSETELEM={0x84, 0xc, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x58, 0x3, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x50, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x39, 0x1, "f2f5615ebbc4223df0a1a20f38cf07f4bf56480e686dd97b5e834a4f10471cbe648dc1b387bf6be3454550dbbbc9e58145fc49eb28"}, @NFTA_DATA_VALUE={0xd, 0x1, "743f2c072ac8b1be9a"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xc0}, 0x1, 0x0, 0x0, 0x40000c1}, 0x20000000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000011c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}, 0x1, 0x0, 0x0, 0x4}, 0x0) 1.178031854s ago: executing program 2 (id=111): creat(&(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x166) link(&(0x7f0000000880)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000980)='./file0\x00') unlink(&(0x7f00000009c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unlink(&(0x7f0000000ac0)='./file0\x00') 1.177779764s ago: executing program 2 (id=112): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000440)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000980)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000000a00), 0x307017fdb7a66cb, 0x53fe0) ppoll(&(0x7f0000000a40)=[{r1, 0x610a}], 0x1, 0x0, 0x0, 0x0) connect$unix(r1, &(0x7f0000000a80)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 1.130308055s ago: executing program 1 (id=113): socket$inet6_tcp(0xa, 0x1, 0x0) close(0x3) r0 = socket$inet_tcp(0x2, 0x1, 0x6) close(0x3) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000280)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f00000003c0)=0x2, 0x4) connect$inet(r1, &(0x7f0000000400)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) sendto(r1, &(0x7f0000000440)='A', 0xfffff, 0x40008c1, 0x0, 0x0) recvmmsg(r1, &(0x7f00000005c0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000640)=""/4096, 0x1000}], 0x1}, 0x1}], 0x256, 0x10022, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000001640)='espintcp', 0x8) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000340)="85952b1773", 0x5, 0xfffffffffffffffd) socket$unix(0x1, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) 1.113971715s ago: executing program 1 (id=114): r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040e60405000001010203010902200001010080320904000002080650000705810200020007050202"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000240)={0x40, 0x7, 0x2, "a38f"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 860.785871ms ago: executing program 3 (id=115): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xd53}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000280)={"3b9808889f69b1cf029f197305d54cf4aed830bf3971f92f0fda5ddd3017dd5c15dbf6b4bb1600a210a03b8feb892ccb8ad3f74400afe82de26ede503cb4cbda1d763fd7f9f18d05d857151dc91071e80c225cf33ac20eaa123e3c620175f7d134c9887da9f6cf040098193c59dd5c2f5ec39536a011defc674c57a09a9a0c1ad844239ac22df94a67507b08bd0abbffa55363c9a4c3a278bddc616422bd81b63eb1b8180c058ed89199cfa9b134d8edbf93d1e04ad4c91a3dd5f2dd1b8282576b4768dbc7d0cea86b8d7ef211dbd14ac2dfeaf9f4a789b41f12e0dec532907ecbc483f3cb8a8434d2583cddef9b68e4cbceaf141244dc0116b4bce2c64733480981bc1cc0941ea6a9a4fe5d5f953359e1234933b1b9e84ebfe8cdd264dc3bc63fd802ea59043292a3f61a210797b7a6a4f695ee19f6dd50d812b43bc86efd1a1c50b9ee6129d3a2a3e9540ef3489b74b69528cf5d804c5c78adad8dc34b2327cf4bbc74424b9d0c1f0d9847b664a268a2ccebbdc93ba268171d81602eea7d750b91f500ef9371d3ea8cdd83d48874e6ebdf00b1eb1cb3add14cc3befefc0337dc393c68661a36aa2c94fee27f354a77a5bbc2d069d35ffd6d66cb5806f5ee22ad23ed960d2ca077887dd3096aba90c92b282a4bdb6909664e070000002dd28b1ba92dbbfdd1a9467bfe0e0d665d92df83df5c6da303900806785aeff27da619734d2d74a03a51a0ee90fd0e6b0c794d1b0eacf8cd9c78ee6b40f66775384c44ec65814dcec18a3c55d946703a99a84ce7c6a86e3a1b6e73c872fdf5340221a99523a5f0239f302b72bc166f2a5ae8f673a576ced49c487abd55a8bc88eaa17c3a052c61bfb40d3b525145fff0467e263141e6ae6b40c78c6360d1f845d1bd91f0125ce5d90900397cbd4235cfe15aef3efaebe34ea6a27c3820236633ab08b3f36e742df56d8310b8dbc9962a1b9b2b8f338c2055e264cc3a129497ab4d8d5452f72572919b565dc77109b12421bef7764fbe22eb985e36cc03fdb44cbe1f759fe512b8ee0772ac413dde661982c45df1ed3d686b4a93176d2271e86855d3e8411ee9b692bac8ccd5620d55fd162f866f2b36acecaf58cd317387e640fdd038afef067da1190000000000000000381a96dabbb217e132222faa3845297d0ba266b2e3390f0b3fa75630b7235b31488fb984f84e2a797f245f30942a0dec21d5145ad6df273ce41aada28cb6915e13640580c75f44994282fbd50f95166a2f4cb5dfec8e6d3247853a2c4259555cb22a6ad0f81b0482bf8ab76a1c984d7055c05931f7310feb27d50032c41499113720288d10e85438b7c7f0ce6c34c284000000000000000000000000000000000000000000000000b800"}) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000007c0)={"576aeb6369739c049af9bceac470f29c707d16ddfc6c55b157a1c913e0c516e9900ff57d6ab72b119fb8d45e9239f32c743b62ba66f034ab5547be20c6d3a4f3d24144d4b130be20ee50d1a0c10728ed1f10052263247c2ad4cd196ac9f960835dfbc4a9ee22a248c2d3cd68cc3304019f8b29426a1f7c2456897116da81726991b25486da714b8aece4fd8b155e94e7f486d9111ced6d6773946469ac8c7606f8b9ac587b1b99bb4cd8d41dac866db417e39758acb19e1f3ef4eef447c6111ebe905bfcb49475408e9b204f0e50108c505e9c3c52d9010b128200b6492352b482709dacbab676665bd2e7f88266b927a6f59618364085ce885a04720ab5057346bcf59c2e69335c20816d5df0def3af165e679c40710cfdabd7447d4a05f1485f8cf85f0ba04069f0974bf163e9857397ec3606951bc5eb705710f5ae3dc23996bb4074bfd0bc7369d2d005557010e1214927ae070c715968b9b303a7e78ccbc679a2704546cce5b994130f6f3a81d3813dd5093c362b489fc3f09500df4dd0186ce31045264ec55efb5083810c52faf43dc34d9b23aa909759151040bf064cfca095e55342be58ff0f76e87e9045cafa5a53e178025f657c80504abb783339880ce417475a9255b7f13d062da01d682b33850dd8d69e83f5945c936f6d463358111855fa0f3a54a683737e9e6110a0e78f3bbda48d45c08acfcde8868893491ae589f0c7e4f5b9cd20fb549c00b59d584fa2606b6164e465388a331c59832a87fc098ae900c63d9f6d94988caf66194e7e5e673fad2a38a2f6d1efd6cc29b82377c33a402bafe28b8d61fee04a24c4fee6404ea332744d695ff50fa48297674b0cad9122a4100c5224a378739984fd49dc569fdc9af8248782a7f3d5862412e277bb3fc16847ca01742183cef30cc10c7b274a007ad2a30c1c1b17562600253c3811747d5a4398e069fad61868ad255c01c3f80acf6d9325187a40e2df13a2c5be0342041b4b213949e91d7ec079d3c4b14e4f37c37ee8df29081788a009af1a80b9607e24608b67f31f72f104543aba322334426777aee90bec200b1467095a94e8b6d93e4892985eec7a6ef43daa2cb13d36a2660333adbc14431aad1e732eb34b56f4e1a2f27f858899832de6d38823395c64ea0bd9c0a023debcdf63e98aec2b191db613850b89ee54558ff3cfaeba8ffa7ac6f9383d90006cb4e5be6b81f3836fb8d78e94ced7bde6ed9832aec6b2a9ed022fa1bbe496a2ee7d64e2e38a413c613f1c03e8bcd3730add5af9bbff187d505a8653b8221169d0c1902ca37d4defe71abded3c76dd2270876708216f64e71980efb3ac51946ca1bda533739fff72083fd7b527273928ea7a63b395e09ac840783063eae52adfeafdcb909140a8c293768688dde430ac8a24db9bfdecdecd548328b4f8e47c036031f85051"}) 859.539971ms ago: executing program 3 (id=116): r0 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000200)=0xffffffffffffffff) fcntl$setsig(r1, 0xa, 0x12) ppoll(&(0x7f0000000280)=[{r2}], 0x1, 0x0, &(0x7f00000002c0)={[0x8001a0efffffff]}, 0x8) dup2(r1, r2) fcntl$setown(r2, 0x8, r0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) tkill(r0, 0x13) 375.426992ms ago: executing program 2 (id=117): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x18, 0x41, 0x107, 0xfffff7fe, 0xfffffffe, {0x1, 0x7c}, [@nested={0x4, 0x142}]}, 0x18}, 0x1, 0x0, 0x0, 0x4048011}, 0x4000000) 325.959943ms ago: executing program 2 (id=118): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000040154220a9055015bbe401020301090212"], 0x0) syz_usb_disconnect(r0) syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000006c0)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0xff, 0x8, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x10}, {0xd, 0x24, 0xf, 0x1, 0xff, 0x4, 0x1, 0x49}, {0x6, 0x24, 0x1a, 0x8, 0x20}}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0x1, 0xe0, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0x6, 0x1, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x5, 0x8, 0x80}}}}}}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 11.37053ms ago: executing program 3 (id=119): socket$packet(0x11, 0x2, 0x300) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000b40)={0xa, 0x3, 0xc, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000b80)={0x0, 0x33, &(0x7f0000000bc0)=[{&(0x7f0000000c00)=',', 0x588}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 0s ago: executing program 3 (id=120): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000340)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f00000008c0)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast1}, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f0000000900)="d9b604") 0s ago: executing program 3 (id=121): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0xfffffffffffffffd, 0x0, 0x51}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x8054}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x10}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, 0x0, 0x6e6bb5, 0x0, 0x1}}, 0xb8}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.97' (ED25519) to the list of known hosts. [ 20.463385][ T30] audit: type=1400 audit(1791905115.497:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.464576][ T277] cgroup: Unknown subsys name 'net' [ 20.486064][ T30] audit: type=1400 audit(1791905115.497:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.513388][ T30] audit: type=1400 audit(1791905115.527:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.513891][ T277] cgroup: Unknown subsys name 'devices' [ 20.652577][ T277] cgroup: Unknown subsys name 'hugetlb' [ 20.658161][ T277] cgroup: Unknown subsys name 'rlimit' [ 20.794576][ T30] audit: type=1400 audit(1791905115.827:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.817765][ T30] audit: type=1400 audit(1791905115.827:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 20.838884][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 20.842826][ T30] audit: type=1400 audit(1791905115.827:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 20.874303][ T30] audit: type=1400 audit(1791905115.887:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.878948][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 20.899920][ T30] audit: type=1400 audit(1791905115.887:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.933981][ T30] audit: type=1400 audit(1791905115.907:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.960261][ T30] audit: type=1400 audit(1791905115.907:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.800771][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.807935][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.815358][ T285] device bridge_slave_0 entered promiscuous mode [ 21.823542][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.830567][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.838049][ T285] device bridge_slave_1 entered promiscuous mode [ 21.914464][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.921557][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.928833][ T286] device bridge_slave_0 entered promiscuous mode [ 21.938219][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.945425][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.952768][ T286] device bridge_slave_1 entered promiscuous mode [ 21.964955][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.972004][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.979246][ T288] device bridge_slave_0 entered promiscuous mode [ 21.985930][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.992963][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.000211][ T287] device bridge_slave_0 entered promiscuous mode [ 22.007517][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.014577][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.021976][ T287] device bridge_slave_1 entered promiscuous mode [ 22.033879][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.040908][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.048530][ T288] device bridge_slave_1 entered promiscuous mode [ 22.151621][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.158671][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.166066][ T289] device bridge_slave_0 entered promiscuous mode [ 22.173069][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.180090][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.187538][ T289] device bridge_slave_1 entered promiscuous mode [ 22.225077][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.232141][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.239408][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.246461][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.271530][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.278574][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.285854][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.292894][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.349533][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.356595][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.363994][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.371022][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.378925][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.386348][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.393475][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.401262][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.408531][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.415697][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.422896][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.450916][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.458448][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.466094][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.474404][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.481450][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.488777][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.496967][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.503997][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.511477][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.519577][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.526625][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.534591][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.542753][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.549756][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.570106][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.578325][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.586306][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.594559][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.601622][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.609213][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.632179][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.641383][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.649510][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.656530][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.674055][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.682568][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.692528][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.702059][ T288] device veth0_vlan entered promiscuous mode [ 22.723953][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.731819][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.739946][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.748135][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.755702][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.763956][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.771013][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.778386][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.786552][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.793569][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.800860][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.809136][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.816155][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.823627][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.831900][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.838910][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.846317][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.854233][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.862465][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.870047][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.877545][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.886321][ T288] device veth1_macvtap entered promiscuous mode [ 22.897055][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.905162][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.923986][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.932360][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.940181][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.948327][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.957124][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.965610][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.973690][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.981971][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.002066][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.010297][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.018753][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.027154][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.035553][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.044009][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.052856][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.061273][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.075836][ T285] device veth0_vlan entered promiscuous mode [ 23.085505][ T286] device veth0_vlan entered promiscuous mode [ 23.093263][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 23.097053][ T289] device veth0_vlan entered promiscuous mode [ 23.107796][ T287] device veth0_vlan entered promiscuous mode [ 23.114223][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.122625][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.130851][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.138936][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.147082][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.155077][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.163090][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.171149][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.179180][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.187192][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.195283][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.202775][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.210108][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.217640][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.225198][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.232665][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.240040][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.247686][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.263790][ T289] device veth1_macvtap entered promiscuous mode [ 23.274432][ T286] device veth1_macvtap entered promiscuous mode [ 23.282457][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.290809][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.299439][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.308437][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.316923][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.325690][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.339352][ T285] device veth1_macvtap entered promiscuous mode [ 23.383314][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.394053][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.404139][ T311] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.421904][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.429543][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.451366][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.459896][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.468820][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.477594][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.486297][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.495064][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.503782][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.512606][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.521300][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.529779][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.538729][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.563031][ T287] device veth1_macvtap entered promiscuous mode [ 23.583495][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.594257][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.602955][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.635261][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.665798][ T309] loop4: detected capacity change from 0 to 131072 [ 23.670099][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.686658][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.695050][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.717157][ T309] F2FS-fs (loop4): Wrong CP boundary, start(512) end(1536) blocks(0) [ 23.725428][ T309] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 23.735203][ T309] F2FS-fs (loop4): invalid crc value [ 23.755787][ T326] tmpfs: Unknown parameter 'casefold' [ 23.761829][ T324] process 'syz.1.8' launched './file1' with NULL argv: empty string added [ 23.772129][ T327] loop3: detected capacity change from 0 to 512 [ 23.779367][ T309] F2FS-fs (loop4): Found nat_bits in checkpoint [ 23.815289][ T333] ip_tables: iptables: counters copy to user failed while replacing table [ 23.817147][ T309] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 23.831452][ T309] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 23.839408][ T333] ip_tables: iptables: counters copy to user failed while replacing table [ 23.887389][ T327] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.899949][ T327] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 23.925680][ T327] EXT4-fs warning (device loop3): verify_group_input:147: Cannot add at group 25 (only 1 groups) [ 23.970419][ T343] netlink: 'syz.1.11': attribute type 3 has an invalid length. [ 23.978034][ T343] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11'. [ 23.987357][ T343] Zero length message leads to an empty skb [ 24.083458][ T355] netlink: 'syz.3.17': attribute type 12 has an invalid length. [ 24.092861][ T351] fuse: Unknown parameter '0x0000000000000007' [ 24.126660][ T351] fuse: Unknown parameter '0x0000000000000008' [ 24.377262][ T360] futex_wake_op: syz.4.13 tries to shift op by 144; fix this program [ 24.412696][ T360] futex_wake_op: syz.4.13 tries to shift op by 144; fix this program [ 24.451710][ T371] ip_tables: iptables: counters copy to user failed while replacing table [ 24.477044][ T371] ip_tables: iptables: counters copy to user failed while replacing table [ 24.541573][ T379] netlink: 'syz.3.26': attribute type 3 has an invalid length. [ 24.575676][ T385] netlink: 'syz.3.29': attribute type 3 has an invalid length. [ 24.583472][ T385] netlink: 4 bytes leftover after parsing attributes in process `syz.3.29'. [ 24.604297][ T388] netlink: 8 bytes leftover after parsing attributes in process `syz.3.30'. [ 24.613150][ T388] netlink: 8 bytes leftover after parsing attributes in process `syz.3.30'. [ 24.656774][ T394] capability: warning: `syz.3.33' uses deprecated v2 capabilities in a way that may be insecure [ 24.831013][ T26] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 24.841033][ T293] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.071031][ T26] usb 5-1: Using ep0 maxpacket: 32 [ 25.081103][ T293] usb 2-1: Using ep0 maxpacket: 32 [ 25.191043][ T26] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 25.199499][ T26] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 25.208246][ T293] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 25.218307][ T26] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 25.227519][ T293] usb 2-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 25.237576][ T26] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 25.248850][ T293] usb 2-1: config 0 interface 0 has no altsetting 0 [ 25.261344][ T26] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 25.272457][ T26] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 25.285635][ T26] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 25.294888][ T26] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.306141][ T26] usb 5-1: config 0 descriptor?? [ 25.315861][ T455] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 25.431059][ T293] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 25.440157][ T293] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.448521][ T293] usb 2-1: Product: syz [ 25.452728][ T293] usb 2-1: Manufacturer: syz [ 25.457354][ T293] usb 2-1: SerialNumber: syz [ 25.462456][ T293] usb 2-1: config 0 descriptor?? [ 25.571840][ T26] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 25.701009][ T307] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.754066][ T30] kauditd_printk_skb: 79 callbacks suppressed [ 25.754078][ T30] audit: type=1400 audit(1791905120.787:153): avc: denied { read write } for pid=382 comm="syz.4.28" name="lp0" dev="devtmpfs" ino=570 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 25.783500][ T30] audit: type=1400 audit(1791905120.787:154): avc: denied { open } for pid=382 comm="syz.4.28" path="/dev/usb/lp0" dev="devtmpfs" ino=570 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 25.807895][ T293] usb 5-1: USB disconnect, device number 2 [ 25.814501][ T293] usblp0: removed [ 25.951000][ T307] usb 3-1: Using ep0 maxpacket: 8 [ 25.981108][ T26] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.071021][ T307] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 26.079397][ T307] usb 3-1: config 179 has no interface number 0 [ 26.085728][ T307] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 26.096785][ T307] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 26.108678][ T307] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 26.119832][ T307] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 26.131233][ T307] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 26.144447][ T307] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 26.153477][ T307] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.181196][ T480] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 26.205415][ T30] audit: type=1400 audit(1791905121.237:155): avc: denied { create } for pid=492 comm="syz.0.72" dev="anon_inodefs" ino=16896 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 26.221022][ T26] usb 4-1: Using ep0 maxpacket: 32 [ 26.326745][ T506] bridge: RTM_DELNEIGH with unconfigured vlan 1 on bridge0 [ 26.351421][ T26] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.362475][ T26] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.372239][ T26] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 26.381294][ T26] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.389906][ T26] usb 4-1: config 0 descriptor?? [ 26.456464][ T30] audit: type=1400 audit(1791905121.487:156): avc: denied { setopt } for pid=511 comm="syz.4.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 26.480932][ T30] audit: type=1400 audit(1791905121.487:157): avc: denied { setopt } for pid=511 comm="syz.4.80" lport=136 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.501274][ T512] syz.4.80 (512) used greatest stack depth: 21736 bytes left [ 26.504298][ T307] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input4 [ 26.522479][ T30] audit: type=1400 audit(1791905121.557:158): avc: denied { read } for pid=86 comm="acpid" name="event3" dev="devtmpfs" ino=575 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.544824][ T60] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.552895][ T30] audit: type=1400 audit(1791905121.557:159): avc: denied { open } for pid=86 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=575 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.576141][ T30] audit: type=1400 audit(1791905121.557:160): avc: denied { ioctl } for pid=86 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=575 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.635275][ T30] audit: type=1400 audit(1791905121.667:161): avc: denied { ioctl } for pid=522 comm="syz.4.83" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=17077 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 26.643271][ T523] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 26.661285][ T30] audit: type=1400 audit(1791905121.677:162): avc: denied { create } for pid=522 comm="syz.4.83" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 26.695541][ T6] usb 3-1: USB disconnect, device number 2 [ 26.700985][ C1] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 26.709699][ T6] xpad 3-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 26.863939][ T26] koneplus 0003:1E7D:2D51.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.3-1/input0 [ 26.971054][ T60] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.981298][ T60] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 26.990375][ T60] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.004408][ T60] usb 1-1: config 0 descriptor?? [ 27.071065][ T26] koneplus 0003:1E7D:2D51.0001: couldn't init struct koneplus_device [ 27.079198][ T26] koneplus 0003:1E7D:2D51.0001: couldn't install mouse [ 27.086868][ T26] koneplus: probe of 0003:1E7D:2D51.0001 failed with error -71 [ 27.096235][ T26] usb 4-1: USB disconnect, device number 2 [ 27.144674][ T525] fido_id[525]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 27.242842][ T500] device syzkaller0 entered promiscuous mode [ 27.251520][ T60] usb 1-1: USB disconnect, device number 2 [ 27.501020][ T386] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 27.565614][ T6] usb 2-1: USB disconnect, device number 2 [ 27.751014][ T386] usb 3-1: Using ep0 maxpacket: 8 [ 27.823143][ T544] fuse: Bad value for 'fd' [ 27.841056][ T26] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 27.871076][ T386] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 27.879333][ T386] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 27.889289][ T386] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 27.899104][ T386] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 27.909132][ T386] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 27.922168][ T386] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 27.931458][ T386] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.941199][ T6] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.080985][ T26] usb 4-1: Using ep0 maxpacket: 8 [ 28.201034][ T6] usb 2-1: Using ep0 maxpacket: 8 [ 28.221133][ T26] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 28.228654][ T26] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 28.239904][ T26] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 28.251397][ T26] usb 4-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 28.292276][ T26] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 28.305716][ T26] usb 4-1: config 168 interface 0 has no altsetting 0 [ 28.321050][ T6] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 28.329293][ T6] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 28.339027][ T6] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 28.348979][ T6] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 28.359160][ T6] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 28.391267][ T26] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 28.398821][ T26] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 28.414579][ T26] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 28.427586][ T26] usb 4-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 28.439774][ T26] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 28.454454][ T26] usb 4-1: config 168 interface 0 has no altsetting 0 [ 28.501920][ T6] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 28.511154][ T6] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.551033][ T26] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 28.558500][ T26] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 28.569806][ T26] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 28.581625][ T26] usb 4-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 28.592522][ T26] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 28.605961][ T26] usb 4-1: config 168 interface 0 has no altsetting 0 [ 28.871043][ T26] usb 4-1: string descriptor 0 read error: -22 [ 28.877325][ T26] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 28.886384][ T26] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.370993][ T26] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 29.534996][ T293] usb 4-1: USB disconnect, device number 3 [ 29.731053][ T26] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 29.741206][ T26] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xBA, skipping [ 29.911072][ T26] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 29.920188][ T26] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.928215][ T26] usb 5-1: Product: syz [ 29.932433][ T26] usb 5-1: Manufacturer: syz [ 29.937354][ T26] usb 5-1: SerialNumber: syz [ 29.942824][ T26] usb 5-1: config 0 descriptor?? [ 29.961071][ T562] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 29.968129][ T562] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 30.244663][ T6] usb 3-1: USB disconnect, device number 3 [ 30.578666][ T293] usb 2-1: USB disconnect, device number 3 [ 30.898720][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 30.898735][ T30] audit: type=1400 audit(1791905125.927:167): avc: denied { write } for pid=585 comm="syz.0.105" name="001" dev="devtmpfs" ino=175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 31.157667][ T293] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 31.230988][ T26] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 31.481036][ T26] usb 1-1: Using ep0 maxpacket: 16 [ 31.510992][ T20] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 31.541037][ T293] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 31.601015][ T26] usb 1-1: config 0 has no interfaces? [ 31.681041][ T26] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 31.690153][ T26] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 31.698249][ T26] usb 1-1: Manufacturer: syz [ 31.703377][ T26] usb 1-1: config 0 descriptor?? [ 31.711070][ T293] usb 2-1: New USB device found, idVendor=0572, idProduct=0041, bcdDevice=70.54 [ 31.720158][ T293] usb 2-1: New USB device strings: Mfr=1, Product=34, SerialNumber=7 [ 31.728296][ T293] usb 2-1: Product: syz [ 31.732491][ T293] usb 2-1: Manufacturer: syz [ 31.737095][ T293] usb 2-1: SerialNumber: syz [ 31.742877][ T293] usb 2-1: config 0 descriptor?? [ 31.901067][ T20] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 31.909214][ T20] usb 4-1: config 0 has no interface number 0 [ 31.915321][ T20] usb 4-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 31.925954][ T20] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 31.936565][ T20] usb 4-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 31.947660][ T20] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 31.960847][ T20] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 31.970063][ T20] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.982022][ T20] usb 4-1: config 0 descriptor?? [ 31.990619][ T293] usb 2-1: USB disconnect, device number 4 [ 32.011109][ T590] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 32.114363][ T307] usb 5-1: USB disconnect, device number 3 [ 32.122613][ T30] audit: type=1400 audit(1791905127.157:168): avc: denied { bind } for pid=595 comm="syz.4.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 32.233632][ T293] usb 4-1: USB disconnect, device number 4 [ 32.341278][ T597] syz.0.105 uses obsolete (PF_INET,SOCK_PACKET) [ 32.561000][ T307] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 32.781039][ T6] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 32.820996][ T307] usb 5-1: Using ep0 maxpacket: 32 [ 32.991046][ T307] usb 5-1: unable to get BOS descriptor or descriptor too short [ 33.071048][ T307] usb 5-1: config 3 has an invalid interface number: 41 but max is 0 [ 33.079146][ T307] usb 5-1: config 3 has no interface number 0 [ 33.085289][ T307] usb 5-1: config 3 interface 41 altsetting 7 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 33.096160][ T307] usb 5-1: config 3 interface 41 has no altsetting 0 [ 33.171105][ T6] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 33.180826][ T6] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 33.261065][ T307] usb 5-1: New USB device found, idVendor=12d1, idProduct=3e5b, bcdDevice=d8.4b [ 33.270176][ T307] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.278224][ T307] usb 5-1: Product: syz [ 33.282605][ T307] usb 5-1: Manufacturer: syz [ 33.287183][ T307] usb 5-1: SerialNumber: syz [ 33.351113][ T6] usb 2-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 33.360201][ T6] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.368224][ T6] usb 2-1: Product: syz [ 33.372408][ T6] usb 2-1: Manufacturer: syz [ 33.377000][ T6] usb 2-1: SerialNumber: syz [ 33.421591][ T6] ums-sddr09 2-1:1.0: USB Mass Storage device detected [ 33.429156][ T6] ums-sddr09 2-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 33.429156][ T6] Please send a copy of this message to and [ 33.542881][ T386] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 33.582412][ T30] audit: type=1400 audit(1791905128.617:169): avc: denied { ioctl } for pid=595 comm="syz.4.109" path="socket:[17813]" dev="sockfs" ino=17813 ioctlcmd=0x8904 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.629433][ T30] audit: type=1400 audit(1791905128.657:170): avc: denied { create } for pid=626 comm="syz.3.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 33.651216][ T30] audit: type=1400 audit(1791905128.657:171): avc: denied { connect } for pid=626 comm="syz.3.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 33.665101][ T629] netlink: 104 bytes leftover after parsing attributes in process `syz.3.121'. [ 33.670770][ T30] audit: type=1400 audit(1791905128.687:172): avc: denied { ioctl } for pid=626 comm="syz.3.120" path="socket:[17851]" dev="sockfs" ino=17851 ioctlcmd=0x7436 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 33.679742][ C0] ================================================================== [ 33.704718][ T30] audit: type=1400 audit(1791905128.697:173): avc: denied { nlmsg_read } for pid=628 comm="syz.3.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.712184][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 33.739749][ C0] Read of size 8 at addr ffff8881142b9990 by task syz.3.121/629 [ 33.747354][ C0] [ 33.749671][ C0] CPU: 0 PID: 629 Comm: syz.3.121 Not tainted syzkaller #0 [ 33.756839][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.766879][ C0] Call Trace: [ 33.770136][ C0] [ 33.772957][ C0] __dump_stack+0x21/0x30 [ 33.777264][ C0] dump_stack_lvl+0x110/0x170 [ 33.781918][ C0] ? show_regs_print_info+0x20/0x20 [ 33.787098][ C0] ? load_image+0x3f0/0x3f0 [ 33.791575][ C0] print_address_description+0x7f/0x2c0 [ 33.797094][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 33.802094][ C0] kasan_report+0x10f/0x150 [ 33.806573][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 33.811573][ C0] __asan_report_load8_noabort+0x14/0x20 [ 33.817181][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 33.822007][ C0] rcu_do_batch+0x47d/0xbf0 [ 33.826513][ C0] ? local_bh_enable+0x20/0x20 [ 33.831263][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 33.837060][ C0] ? note_gp_changes+0x140/0x220 [ 33.841982][ C0] ? call_timer_fn+0x65/0x290 [ 33.846640][ C0] ? __run_timers+0x90d/0x9a0 [ 33.851296][ C0] rcu_core+0x4a3/0xef0 [ 33.855449][ C0] ? calc_index+0x200/0x200 [ 33.859933][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 33.865115][ C0] ? sched_clock_cpu+0x18/0x3d0 [ 33.869949][ C0] rcu_core_si+0x9/0x10 [ 33.874083][ C0] handle_softirqs+0x250/0x560 [ 33.878828][ C0] ? irqtime_account_irq+0xbe/0x390 [ 33.884004][ C0] __irq_exit_rcu+0x52/0xf0 [ 33.888485][ C0] irq_exit_rcu+0x9/0x10 [ 33.892710][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 33.898326][ C0] [ 33.901235][ C0] [ 33.904146][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 33.910112][ C0] RIP: 0010:console_unlock+0xb32/0xf10 [ 33.915554][ C0] Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 56 d4 17 00 49 81 e6 00 02 00 00 75 07 e8 08 d0 17 00 eb 06 e8 01 d0 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 f1 cf 17 00 85 db 74 19 e9 1b 03 00 00 [ 33.935141][ C0] RSP: 0018:ffffc9000126ee60 EFLAGS: 00000287 [ 33.941217][ C0] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000080000 [ 33.949166][ C0] RDX: ffffc90002f72000 RSI: 0000000000031bab RDI: 0000000000031bac [ 33.957114][ C0] RBP: ffffc9000126f0d0 R08: 0000000000000003 R09: 0000000000000004 [ 33.965065][ C0] R10: dffffc0000000000 R11: fffff5200024ddbc R12: 0000000000000064 [ 33.973020][ C0] R13: fffff5200024ddd8 R14: 0000000000000200 R15: dffffc0000000000 [ 33.980978][ C0] ? vprintk_emit+0x320/0x320 [ 33.985641][ C0] ? _raw_spin_lock+0xf0/0xf0 [ 33.990295][ C0] ? stack_trace_save+0xa6/0xf0 [ 33.995125][ C0] ? sysvec_apic_timer_interrupt+0x64/0xc0 [ 34.000917][ C0] ? vprintk_emit+0x2bb/0x320 [ 34.005581][ C0] vprintk_emit+0x13f/0x320 [ 34.010086][ C0] ? vprintk_store+0x13e0/0x13e0 [ 34.015002][ C0] ? __kasan_check_write+0x14/0x20 [ 34.020097][ C0] ? _raw_spin_trylock+0xb7/0x150 [ 34.025102][ C0] vprintk_default+0x26/0x30 [ 34.029670][ C0] vprintk+0x7a/0x80 [ 34.033547][ C0] _printk+0xda/0x130 [ 34.037511][ C0] ? load_image+0x3f0/0x3f0 [ 34.041996][ C0] __nla_validate_parse+0x1f6e/0x2850 [ 34.047349][ C0] ? selinux_capable+0x2b6/0x3b0 [ 34.052267][ C0] ? __nla_validate+0x60/0x60 [ 34.056921][ C0] ? cap_capable+0x1a6/0x230 [ 34.061498][ C0] ? security_capable+0x87/0xb0 [ 34.066328][ C0] __nla_parse+0x42/0x60 [ 34.070553][ C0] xfrm_user_rcv_msg+0x44f/0x7f0 [ 34.075472][ C0] ? xfrm_netlink_rcv+0x90/0x90 [ 34.080307][ C0] ? avc_has_perm_noaudit+0x490/0x490 [ 34.086797][ C0] ? x64_sys_call+0x4b/0x9a0 [ 34.091398][ C0] ? selinux_nlmsg_lookup+0x233/0x440 [ 34.096755][ C0] netlink_rcv_skb+0x1e9/0x430 [ 34.101506][ C0] ? xfrm_netlink_rcv+0x90/0x90 [ 34.106337][ C0] ? netlink_ack+0xb10/0xb10 [ 34.110920][ C0] ? wait_for_completion_killable_timeout+0x10/0x10 [ 34.117497][ C0] ? __netlink_lookup+0x387/0x3b0 [ 34.122507][ C0] xfrm_netlink_rcv+0x72/0x90 [ 34.127172][ C0] netlink_unicast+0x86c/0xa30 [ 34.131920][ C0] netlink_sendmsg+0x879/0xb80 [ 34.136669][ C0] ? netlink_getsockopt+0x530/0x530 [ 34.141847][ C0] ? alloc_file+0x59/0x580 [ 34.146246][ C0] ? security_socket_sendmsg+0x82/0xa0 [ 34.151683][ C0] ? netlink_getsockopt+0x530/0x530 [ 34.156863][ C0] ____sys_sendmsg+0x5be/0x8f0 [ 34.161608][ C0] ? __sys_sendmsg_sock+0x40/0x40 [ 34.166610][ C0] ? import_iovec+0x7c/0xb0 [ 34.171096][ C0] ___sys_sendmsg+0x236/0x2e0 [ 34.175752][ C0] ? __sys_sendmsg+0x280/0x280 [ 34.180518][ C0] ? percpu_counter_add_batch+0x13c/0x160 [ 34.186225][ C0] ? __fdget+0x1a1/0x230 [ 34.190454][ C0] __x64_sys_sendmsg+0x201/0x2d0 [ 34.195373][ C0] ? ___sys_sendmsg+0x2e0/0x2e0 [ 34.200204][ C0] ? __kasan_check_write+0x14/0x20 [ 34.205296][ C0] ? switch_fpu_return+0x15d/0x2c0 [ 34.210391][ C0] x64_sys_call+0x4b/0x9a0 [ 34.214796][ C0] do_syscall_64+0x4c/0xa0 [ 34.219207][ C0] ? clear_bhb_loop+0x50/0xa0 [ 34.223863][ C0] ? clear_bhb_loop+0x50/0xa0 [ 34.228521][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 34.234399][ C0] RIP: 0033:0x7f8ea19502d9 [ 34.238807][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.258479][ C0] RSP: 002b:00007f8ea03a9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 34.266889][ C0] RAX: ffffffffffffffda RBX: 00007f8ea1bd7fa0 RCX: 00007f8ea19502d9 [ 34.274864][ C0] RDX: 0000000000000000 RSI: 00002000000004c0 RDI: 0000000000000003 [ 34.282851][ C0] RBP: 00007f8ea19e7888 R08: 0000000000000000 R09: 0000000000000000 [ 34.290812][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.298766][ C0] R13: 00007f8ea1bd8038 R14: 00007f8ea1bd7fa0 R15: 00007ffc95a88e08 [ 34.306726][ C0] [ 34.309728][ C0] [ 34.312032][ C0] Allocated by task 627: [ 34.316259][ C0] __kasan_kmalloc+0xd4/0x100 [ 34.320922][ C0] __kmalloc+0x13d/0x2c0 [ 34.325148][ C0] l2tp_session_create+0x39/0xb60 [ 34.330162][ C0] pppol2tp_connect+0xbf5/0x1640 [ 34.335096][ C0] __sys_connect+0x3cb/0x450 [ 34.339684][ C0] __x64_sys_connect+0x7a/0x90 [ 34.344431][ C0] x64_sys_call+0x7c/0x9a0 [ 34.348831][ C0] do_syscall_64+0x4c/0xa0 [ 34.353229][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 34.359101][ C0] [ 34.361557][ C0] Freed by task 320: [ 34.365437][ C0] kasan_set_track+0x4a/0x70 [ 34.370023][ C0] kasan_set_free_info+0x23/0x40 [ 34.374944][ C0] ____kasan_slab_free+0x125/0x160 [ 34.380039][ C0] __kasan_slab_free+0x11/0x20 [ 34.384793][ C0] slab_free_freelist_hook+0xc2/0x190 [ 34.390159][ C0] kfree+0xc4/0x270 [ 34.393956][ C0] l2tp_session_put+0xaf/0x1a0 [ 34.399371][ C0] l2tp_session_delete+0x3a9/0x4a0 [ 34.404483][ C0] l2tp_tunnel_del_work+0x180/0x3d0 [ 34.409669][ C0] process_one_work+0x6c8/0xbb0 [ 34.414505][ C0] worker_thread+0xaa0/0x1250 [ 34.419175][ C0] kthread+0x3f5/0x4f0 [ 34.423227][ C0] ret_from_fork+0x1f/0x30 [ 34.427626][ C0] [ 34.429932][ C0] Last potentially related work creation: [ 34.435622][ C0] kasan_save_stack+0x3a/0x60 [ 34.440278][ C0] __kasan_record_aux_stack+0xd2/0x100 [ 34.445718][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 34.451503][ C0] call_rcu+0x10b/0xf60 [ 34.455641][ C0] pppol2tp_release+0x1e3/0x2b0 [ 34.460467][ C0] sock_close+0xb8/0x200 [ 34.464690][ C0] __fput+0x22b/0x900 [ 34.468650][ C0] ____fput+0x15/0x20 [ 34.472609][ C0] task_work_run+0x127/0x190 [ 34.477177][ C0] exit_to_user_mode_loop+0xd0/0xe0 [ 34.482354][ C0] exit_to_user_mode_prepare+0x87/0xd0 [ 34.487791][ C0] syscall_exit_to_user_mode+0x1a/0x30 [ 34.493237][ C0] do_syscall_64+0x58/0xa0 [ 34.497629][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 34.503506][ C0] [ 34.505811][ C0] The buggy address belongs to the object at ffff8881142b9800 [ 34.505811][ C0] which belongs to the cache kmalloc-512 of size 512 [ 34.519839][ C0] The buggy address is located 400 bytes inside of [ 34.519839][ C0] 512-byte region [ffff8881142b9800, ffff8881142b9a00) [ 34.533101][ C0] The buggy address belongs to the page: [ 34.538729][ C0] page:ffffea000450ae00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1142b8 [ 34.548952][ C0] head:ffffea000450ae00 order:2 compound_mapcount:0 compound_pincount:0 [ 34.557260][ C0] flags: 0x4000000000010200(slab|head|zone=1) [ 34.563320][ C0] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 34.571880][ C0] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 34.580437][ C0] page dumped because: kasan: bad access detected [ 34.586824][ C0] page_owner tracks the page as allocated [ 34.592522][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 596, ts 33565831516, free_ts 30754290775 [ 34.612902][ C0] post_alloc_hook+0x192/0x1b0 [ 34.617659][ C0] prep_new_page+0x1c/0x110 [ 34.622141][ C0] get_page_from_freelist+0x2c3a/0x2cd0 [ 34.627671][ C0] __alloc_pages+0x1a2/0x460 [ 34.632240][ C0] new_slab+0xa0/0x4d0 [ 34.636288][ C0] ___slab_alloc+0x3ac/0x840 [ 34.640856][ C0] __slab_alloc+0x49/0x90 [ 34.645164][ C0] __kmalloc_track_caller+0x169/0x2c0 [ 34.650519][ C0] __alloc_skb+0x210/0x730 [ 34.654913][ C0] __ip6_append_data+0x25c8/0x37e0 [ 34.660003][ C0] ip6_append_data+0x1d0/0x330 [ 34.664745][ C0] rawv6_sendmsg+0x11e3/0x16c0 [ 34.669486][ C0] inet_sendmsg+0xa5/0xc0 [ 34.673796][ C0] ____sys_sendmsg+0x5be/0x8f0 [ 34.678635][ C0] ___sys_sendmsg+0x236/0x2e0 [ 34.683287][ C0] __sys_sendmmsg+0x2ba/0x4e0 [ 34.687943][ C0] page last free stack trace: [ 34.692593][ C0] free_unref_page_prepare+0x5fa/0x600 [ 34.698031][ C0] free_unref_page+0xae/0x540 [ 34.702684][ C0] __free_pages+0x6c/0x100 [ 34.707078][ C0] __free_slab+0xe5/0x1e0 [ 34.711394][ C0] __unfreeze_partials+0x15a/0x190 [ 34.716482][ C0] put_cpu_partial+0xc6/0x120 [ 34.721136][ C0] __slab_free+0x1d4/0x290 [ 34.725533][ C0] ___cache_free+0x104/0x120 [ 34.730101][ C0] qlink_free+0x4d/0x90 [ 34.734237][ C0] qlist_free_all+0x5f/0xb0 [ 34.738720][ C0] kasan_quarantine_reduce+0x14a/0x170 [ 34.744156][ C0] __kasan_slab_alloc+0x2f/0xe0 [ 34.748986][ C0] slab_post_alloc_hook+0x4f/0x2b0 [ 34.754083][ C0] __kmalloc+0x120/0x2c0 [ 34.758305][ C0] kvmalloc_node+0x211/0x320 [ 34.762876][ C0] seq_read_iter+0x1f1/0xce0 [ 34.767447][ C0] [ 34.769747][ C0] Memory state around the buggy address: [ 34.775351][ C0] ffff8881142b9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.783387][ C0] ffff8881142b9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.791422][ C0] >ffff8881142b9980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.799456][ C0] ^ [ 34.804021][ C0] ffff8881142b9a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.812055][ C0] ffff8881142b9a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.820095][ C0] ================================================================== [ 34.828129][ C0] Disabling lock debugging due to kernel taint [ 34.840286][ T307] usb 5-1: USB disconnect, device number 4 [ 34.858218][ T30] audit: type=1400 audit(1791905129.887:174): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 34.880971][ T386] usb 3-1: Using ep0 maxpacket: 32 [ 34.881136][ T30] audit: type=1400 audit(1791905129.887:175): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 34.907496][ T30] audit: type=1400 audit(1791905129.887:176): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 34.937710][ T26] usb 1-1: USB disconnect, device number 3 [ 35.001017][ T386] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 35.011146][ T386] usb 3-1: config 0 has no interfaces? [ 35.141809][ T6] ums-sddr09: probe of 2-1:1.0 failed with error -5 [ 35.149307][ T6] usb 2-1: USB disconnect, device number 5 [ 35.171128][ T386] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 35.180248][ T386] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.188266][ T386] usb 3-1: Product: syz [ 35.192642][ T386] usb 3-1: Manufacturer: syz [ 35.197211][ T386] usb 3-1: SerialNumber: syz [ 35.202348][ T386] usb 3-1: config 0 descriptor?? [ 35.445944][ T386] usb 3-1: USB disconnect, device number 4