last executing test programs: 12m7.732335641s ago: executing program 32 (id=253): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x6c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x4c, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x3c, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}, @IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}, @IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}, @IFLA_BATADV_ALGO_NAME={0xc, 0x1, 'BATMAN_V'}]}}}]}, 0x6c}}, 0x40004) 11m48.938266673s ago: executing program 3 (id=311): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x40040) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) bind$unix(r3, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r4 = socket$unix(0x1, 0x2, 0x0) connect$unix(r4, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r4, &(0x7f0000000240)=[{&(0x7f0000000000)="f1", 0x1}], 0x1) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x23, &(0x7f0000000080)=0x6, 0x26) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, 0x0, 0x0) recvmmsg(r3, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) 11m46.87387405s ago: executing program 4 (id=316): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000002ac0), 0x0, 0x0) read$rfkill(r1, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000400000000000000000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) ioctl$BTRFS_IOC_ADD_DEV(r2, 0x5000940a, &(0x7f0000001440)={{r5}, "b25982e493e854a4064543dbd6ad8700c7ecb016eb51ecf8c8daed8c3773d2c73b4b8603383e0414d209a9f559d574e555654839205daa05228c317cc920ef716833a55d1014ef31d33b33a188d54b8d9d5523ba5eb7cfe6ba96c5398d33f9d291b86f691e3a012d886e3ffa5468971037379bf9a8c0bde7bee68b1201070be4a0fff74cfd22f948dd81362e65da1f94f3cd7ec09dd2ef1023de8c8f06541d516d7bde02c7be37df0fb12c8f74c9f92b02c71f96e19721f85d24b9af0ae0b3d91083cc93100f41ff71125af2126205ed88120706f3efb4717001cca24729a5c0d497925f1e99307e06468bfdb44e90b388f642848755ef4c0f5d6239a6a996d1b8bacb8da682a985a880e020632db7da38f1452abef47e6913851e1265162973e32c611bd364e03a47d3ef86b5221f62705f6ac8afa95dc58816b1837212a10a9befd0b52aace9ddb7a48a2b4ed7ce7339b2868a7e39b673f2f572c38e19c342f6d17e90ccc0de5bb14c816c5407a1d739c5512b4808572ad1fe2e78721094a24f8aa6e9691b4e38efef76fd7333d00a504aa9549fa4e96e4723b43037eada92616d2197b6805cbcc17d3848dc1918c63a39a02e31fa6e68df1465b39025b2d85da3d6cffa14d47218e7288aa2c887afba498d01a3543673f3de001ca1c283214a37fe5338df4d683f962061e99686bf76fbf756494833fa5f76e5eae54d7c82f794b8db95ae7e236dff36c1fb6cd14e69e29d7ca7cb3afe50993cfaf798f0105a08d76dc0036ba9a53528c8d10b69f9a8af57986a72bc55feade1e4ce8594344a60f12da336b3751751cfaa2238e8cd52ff1cc52c3074cdc700401725988e80ccbc971972d2debcb935d0487115198b2fa6e76ae1b9b8a7359fd8b9e027cedd23bfc98a694d1c2a347bf3884de7f6e90898c3c646142070c5206b3f1e62a5383df6a8b9688fd5bda97bc43c05837778e785277f4f8667165387b6c57bd6ecaa7faaa3be693327f7d71e0eba1b2835e90ff99c7e8fb7fb9358a4f92991aeac27afb1968a239d9c13f42a0c65f7c05677eec9f89b2528ef7046cc2526b606e8f43b54fdbe14802842ac8c0659b3df787f4a172b9a73b7a7db4727af41a1ae45e1d13676ae8ce8cbab10ab8c4f5dfc857922610fca5d7474dbaa72d770f276cb3e913a0f75319bf0c29b8aaa96325f381c2b8ce579829382c2d3798b7554b809a1871e8cc347d6b51d4ea820a345dd72c67211e6550df13cf142d848365f9a89fdb890c2bbcfc2f3ff7b25258edbff8a3f3d8e887934c712a440e6fe669aeef292d9d94dee722ff1d7144f4cba17ecd5deebc48126f31f03c7b21b3f5355c8c56e4a6615f4402de11862d5f40bcc1dad2570d1d5ecc6c05df9f5059781caafcb8474b5e2059addefeb82cfa26d5d62b8fd725806352e0d0be436a95a4450d252b8e50f60ae1c81e5b1ee7e140240cfcd222ddc822eb882e90756123f967f66b7d52221e625ae472ac0c370b15209295e002b5e371902c25cbe8910c72d11e11dd0b121b448a9aadcb472cad3c10679364239889058be65955038817590e3afe230b1e3687b2801b7f0c2093b86e225067383249b338f81d406b78ba3183c36eecccf497fa658789ae1266aa11941c99431ac0f292c2e8b17f1ac5c09f3137034d4a02ebb2bafe73d29f60f90209e83bb4591f69e7a1ee7fdb9d854677152a66da19a82ddf4f9d1dcbdfd8364b1696f54f51431d0f7adf8d517b73b8ed5329bfbd0e5395c3f39e3ea9274e98ee568c198d31c377c2819bb4eb40cee0fc0d0029bf6f41a126fc404cbb560fbe560c7c84a3a3d0d8faf3583973838a54490d82c794cccd19aec61e079c02665cc5abfb450c6cebfa076dcaada8265bd994300b5500db1c1e95bb69fd551e99676bfee68580c99a9bdd970981b238097f08ac7ee6d72963646a4d9e6a842dc3fdb296f5c2f2d47dd7ddb32cfddff17714add352806d8a9fad2271c5a2de5b143da0014c2b0112ddf13dc1bcd544453fedb94900d07256cbb855bc71e4db37c57f33c534c8d606185a83ebe31a910a38285e4d9a72442631eb9e650d4054c61f9f8ad4fc56cdfb380d8eae536c21e9545b9c34bf26d0c86d6ed9fb9a0f8503cddca6ad4bcdb395f6db390074c882a78735029d35a5372ac6a26ee580b93630458a826ada5e087ba7541058ec7cb7dd1a04e3b298d3694a15201cfdd179cfa0d2db010ae8652e91da2bd61adbfd96fc6bde797098a39c47cb1c53a54cc955d52082af6a5b9b3c266b8f71868c2830cfa43dac79140203d1bf958d95b55490aa29499305994119b4e1964ff27c2eeff541bd55a8f2731524e2e022c235c90a06fc8c3530693283137e013d5ea7919b7f67971ece132926132e227bc87f781c60f27bfe10dc74f40aefd1444c05d6f8634f1e8d7ec367c3e43c900d03f75216c19df086809e01aa867ff51486825dbbcd7041134e33d923c28322731638017e989365efb8de024191baf031b2ad092a4ac46d1deda09917b681a99627844767f3a0993eead8f9fe4684be444d656c46bb76ccafbcc1a477a0a986a3bd66a85c8013551b8ab7d824ac6714aafc7b22e54369c02e3acaa56382379e1f64597514d5955a25058a25d56fcf8d9dff5a281a24b61c9faf841b0a7dd7927bc1c3377e408e0a4a28fdb7b5d4aaba98d5df38e82afe725715dd3e1de6ce906c6dfa18314642076940fdfed0011eea4dfd6fedff55d080bc40957a1daf3203bca74c0ca024d6d385f543a3e2b0af0bc9855a21b015effb287d07b39e577f5a2ed2a689f4cc5101a57331b63c41bc1a5339f1d7439dd64bc3e9110b8c4a23a276ea3950a8dffb10426f7944fc01b3c0f42feb8c56be764caef08940690d5a10acb3a78830ffca083242b6769f2011058589422541901c0ed6d96d2d2030222313519dba22664b0191ac039fafbfbe2824f7199881a0ebaf99daa18890921b311034fc0026b310106d7a087e3b6a5d70ae943cec2cac1a97e76aaab140ac022e732ea880585faf38776a0d9c86a1d1e7eb584e8b14884571ccd2fc5701cb04c7a86a5faee9caf5ff8d3f7afbdff802a4bb386b8114ad24cb87f1e48a46ab2d729f8ab6c5b31fd88ffb17dbd1a0792eb38a48df8ccc5462834c9a074785a2562c917ee9facbe96f8300c1ce21787ffdbf4c9b01968f3689b6baa7f656eb1f21eedc89030bde401a0b7c3d1ba42f0a4b61011e8bc4d0006709de65889f581a243f9963a7f7fd493a746d8b658d5b48eeae5ca28aafeb800e4776f5aa7a6adbb02e098cdb68e6ef90a28f74db17b3a03546b995af497792a75e5fd585275232e2213e6d0888312506cb6877dcf32a5b825cf3cd4e264afb202dfe0e031034bd03f39822db94efdd354982c064a907d55a567bd88aff4bdf2c5ef5491e854d2028759551f09b1b37ed50fc74ab210368efafb4239d44e2438b143a47e4ee7e1796221904ad7066b9f759c10217c9ea0628bb61e9a2c0ea693c683f8f22d64f781baa755d804dcd4a6eacbc4a51bd2c305cef0270b7c215ca5bb698ddffdc0847005a2d36b342ecd14de307a896d6580a096fdc4c770251bec0d64c11a73943610df8184d1b3be9a6e3fcff22097b400715edb4f395581ddd4462e1753ef3e4ca930d71033c8f6c4c91b3caa8bbe6cc26f613680b542ef6bd2b548ba0806751d742ac30e2e6482972b2f9bdc91a712905f3d65129e95f46a771b5cbe1b83600846c2f009b458f1604f35270a484a23045b2997cda582d350bdc1c22ffed84e939f86da80992ad6586d0bdfaf8e8be34fb585d7caefa823bf6d7872bae0d4bb32ea9ffe4b023b3f80253e88e32c61048db8834b645f0da2c7141eec47bc36865fc24abea1a7a0b2099a1b3d23d1bb988215ff6f2b3d8a4d602bc3b8fb891637830f7f559521f918d0bc9d8f613c9dfc40aebbb8288c7c7e0019cc5e4fc22dd71857c98fa83122a223a4ecbee27e347a272149840e7c9e7804c3a2096f6799f1d9633b75c9eee61417d504524af96a773d289df987299bbc5e5f34c5bb0ff9705ee05d2ac6b07327f00c8a791a744bf61ad4843babca7c658908c815f4668728b5d459d49f921d6a8811bdf31216f037eef22c8d19b4b311f244c7a482b2eef8df063bc2658333f1cc5ae6b90fe0791251e80b20357531a400ce5309370203ae1272c96ba75372ba742c24fff08912797458badbd22d67ebf282051f69142facd5ccf106791ead0a751cad4bf2924db3dc042a0846519c5da4cf896fce0c268e9b096f558f35ef3dcc363b8b02ad9a4cc57d0ac28e696f1e5182ff410db0247e75a3cf4c030093e71e76b5dd80cb61ce3aa30ee82ad540c935ea27e4b00fe32cfbe2c89e5c1359731fef8e66af8b395cf6a8546281450f42b9d33f913247b9eee843ca7164bb5768d13c8fae4f28757910f5dd21f137d58f13fe714c948d088107f955090d5e8916d3c8d7bb368b1a889a13afa80df513fa3ece40d44602553de11ec93cc1e2aa77da0d817130401eb067403dbb77a8739fc482a3a0c1165697877bab1a4f9af7c8cf2f69309bde15940e50d7db093d48dd318f88e21b73e91ac03748c4902b1fc83a27aa0f67b4373307fe63bfabfbf1fec837dedc4acae0e15362dfaaa17127f4cbb0ae39fe59f0754320e13a453758aeab45a8f56bd669cd37657c55c4caa9ef44900be26d6fb5b137f9ee33ab10a25bfc3d62fc9ab652c0918462af90ca874a6450284bb66ca86542fb51f4dce661b99fe2a78af0c5c2bc6b76fdea847a5ee0fe5663a1cecf44fa9da3fbf3fee13a58829d9adf717cff8dd1da84865314d9f93300bc53cbc80830a2507d6386acd78eda76d24722d07cf4ebd5897896f4092ad042218aceb17992657f1851655d9e08d70fd23c812ab07d90c46b036bebcf64ab4efbbe140d0c706b0cb756e5cbff80d098455d962307ca686724766d27a7d0efef829bf90cabd80decc56278443c120d01cc2cc256ac173a43c0c843dfedbd59aff0eebdc3dc32c95f821420d31528c21eb9e63c010802e80d8c888db8f2cddbcf45997e7e50de25f2414f832cb59b7249af74f69d1b8a7d29006751591b1877a988548ee86a2ec4bb8ca8002c272b19eec0f657dcfa436fb151e029cb232eefda6daa388b12883a76398b53f499af62fe987051f24eba9d6cf0fff391c858ce377b1aaad24b3931dfc3ae5b93dd0ee45ae46d63aef504126befda77df20f77d69dd81d25b2c739c40380abea636c2fe10d453d287a061d52ff07d0dbdc66f4567be2164f7a4c1726ee65c3a417ae2621c9b904b1d8e146ac115c5b56ee1d349a8537ce8b0aba1de1810326b8122e59f2fc4c99d4e498df6d628864522bc171f8e73fc6de106145877ff3870b67eb140fc50b205145b64ae7479d1ae179be5582c4e55c451961652bfe996c6d695245c63b2600c689910156eb6d17aa3f4f0c31c5917292ed02389e0e8ab634357e4505686d21f6fc9be91a3652d1a2821f2dbc827be5047523d6351eb9718827ace7398cfd980a1584aedb7ccfe56fde3dd3f6ee006df07a385b38ba09c1096ecc596313416d1fd93dcbe938f5378e2dd425e0ca59bd90b1437006460cbc0d899bfd924f3cd46951897ea992abc851d87351961b1a32317823d05d123ef5e4815480de0462f9e6485759cf7f53a71143baee31e706659544e3164e8249c728dfcbc491bf0754c65a597776790a62675acf228c0ba927b17e1ae0c0f288ee4e42b9326"}) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00') preadv(r6, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0xc002a0, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r6, &(0x7f0000000580)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="8c000000", @ANYRES16=0x0, @ANYBLOB="000126bd7000fcdbdf253900000008000300", @ANYRES32=0x0, @ANYBLOB="70005a801400028005000600010000000500040002000000580003801400030000040900bc00050055000500ff070700050006000200000005000700010000001400030004004000070002001000270604007afc05000400000000001400050006009022020003000100010100f01137"], 0x8c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) syz_open_dev$I2C(&(0x7f0000000380), 0x7, 0x123001) r7 = syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) ptrace$getregset(0x4204, r7, 0x201, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) syz_usb_connect$uac1(0x69a90eab3db9c902, 0xa5, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010002000000406b1d010140000102030109029300030104a0090904000000010100000a2401f7ff0702010209240303000303030b05240509020904010000010200000904010101010200000924020182040910ca0c240201090407105148a148b64f4a51a635bb827987552d090501090004ffc803072501000405000904020000010200000904020101010200000a240201060108013a3807240101c0050009058209d24d033231c8610ea8e096e2f7"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x3000000) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) 11m46.307780702s ago: executing program 3 (id=318): r0 = socket(0x26, 0x5, 0x5) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0xfffffffffffffecc, &(0x7f0000000040)=[{&(0x7f0000000180)="1c00000021006bcd210002006e04000081000010000000017aa60864", 0x1c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010000104fcfffeff00000000000035ec", @ANYRES32=0x0, @ANYBLOB="000000000000000008001d0001000000"], 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001400000014000000070000000000000000000081"], 0x0, 0x33, 0x0, 0x1, 0x8000, 0x0, @void, @value}, 0x28) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[], 0x34020) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000800000/0x800000)=nil, 0x802000}, 0x2}) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$UFFDIO_CONTINUE(r4, 0xc020aa08, &(0x7f00000000c0)={{&(0x7f0000800000/0x800000)=nil, 0x800000}}) r5 = syz_open_dev$admmidi(&(0x7f0000000280), 0x6006, 0x4002) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r5, 0xc0385720, &(0x7f00000001c0)={0x1}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x400000c) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="6c00000010000304fcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0800000085e401004400128009000100766c616e000000003400028006000100000000000000000c00010003000000040000000c000100ef0200000004000008000500"/80, @ANYRES32=0x0, @ANYBLOB], 0x6c}, 0x1, 0xba01, 0x0, 0x4008010}, 0x0) syz_open_procfs(0x0, 0x0) r7 = open(0x0, 0x14927e, 0x0) fallocate(r7, 0x3, 0x4, 0x10000) write$dsp(0xffffffffffffffff, &(0x7f0000000000), 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r8, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) 11m43.443582689s ago: executing program 3 (id=327): r0 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@dev, 0x800, 0x0, 0x2000000000903, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@rthdrdstopts={{0x18}}], 0x18}, 0x0) (fail_nth: 1) 11m43.442522299s ago: executing program 2 (id=328): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='illinois\x00', 0x9) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='maps\x00') io_setup(0x9, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) syz_open_dev$sndctrl(&(0x7f0000000e00), 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r3, 0x8983, &(0x7f0000000000)={0x6, 'veth0_vlan\x00', {0x2}, 0x101}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f0000000040)={0x0, 'veth0_vlan\x00', {0x1}, 0x2b1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='::,:/', 0x0) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth0_vlan\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x40000, 0x40000000, 0x2, 0x1}}) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}}) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x3fa1dc947ffe4b82}) r8 = socket(0x1, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, 0x0, &(0x7f0000001380)=@udp=r8}, 0x20) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x5452, &(0x7f00000000c0)={'gre0\x00', 0x0}) recvmsg(r8, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 11m42.870831279s ago: executing program 3 (id=329): mknod(0x0, 0x0, 0x8000) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000090401"], 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/card3/oss_mixer\x00', 0x260601, 0x0) add_key$fscrypt_provisioning(&(0x7f0000002300), 0x0, 0x0, 0x0, 0xfffffffffffffffb) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) socketpair$unix(0x1, 0x3, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x60240) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0xc0a85320, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) socket$inet(0x2, 0x2, 0x0) close(0x3) 11m42.549654821s ago: executing program 4 (id=331): r0 = io_uring_setup(0x1612, &(0x7f0000000200)={0x0, 0x0, 0x3040}) r1 = socket$netlink(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@ipv6_newaddr={0x34, 0x14, 0x1, 0x0, 0x0, {0xa, 0x0, 0xa1, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @mcast1={0xff, 0x5}}, @IFA_FLAGS={0x8, 0x8, 0x402}]}, 0x34}}, 0x0) syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)={0x9c, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x9c}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f0000001580)={0x3, 0x0, 0x0, &(0x7f00000014c0)=[{&(0x7f0000000040)=""/168, 0xa8}, {0x0}, {&(0x7f0000000280)=""/4086, 0xff6}], &(0x7f0000001540)=[0x2]}, 0x20) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000001b00)={0x0, 0x0, &(0x7f0000001a80)=[{0x0}], 0x0, 0x1}, 0x20) socket$alg(0x26, 0x5, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r7 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r7, &(0x7f00000000c0)="b8", 0x1) ioctl$SNDCTL_DSP_SYNC(r7, 0x5001, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r7, 0x80045017, &(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) 11m41.762200742s ago: executing program 2 (id=332): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) personality(0x8) socket$xdp(0x2c, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001dc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad0e0e2b45d14ee446b840edaa1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c50ce6a8e9f65de13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87915ed063f608dddb03a95b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0fd9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000c3d51d9a161446b4373e06a9e07f8a000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='map_files\x00') getdents(r0, 0xffffffffffffffff, 0x5a) syz_emit_vhci(0x0, 0x0) r1 = syz_open_dev$radio(0x0, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$igmp6(0xa, 0x3, 0x2) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4820) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000140)={0x3, 0x2}) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='qnx6\x00', 0x200000, 0x0) syz_emit_vhci(&(0x7f0000000200)=@HCI_EVENT_PKT={0x4, @hci_ev_encrypt_change={{0x8, 0x4}, {0x10, 0xc9, 0x81}}}, 0x7) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0x4, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000006c0)=[{0x0}, {0x0}], 0x2}, 0x0, 0x2000c000}) 11m40.423562222s ago: executing program 2 (id=336): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r1, 0x0, 0x8000000000000000}, 0x18) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x40000000, 0x8, 0x1000000, 0x0, 0x0, 0x1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) set_mempolicy(0x1, 0x0, 0x4) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r2, &(0x7f0000000200)=0x1, 0x12) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r2, 0xc018937e, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'veth1\x00', &(0x7f0000000000)=@ethtool_wolinfo={0x5, 0xab, 0x8, "ea4a05f19df6"}}) 11m39.779516915s ago: executing program 2 (id=339): mknod(&(0x7f0000000040)='./file0\x00', 0x2, 0x7ffd) mount(&(0x7f0000000580)=@nullb, &(0x7f0000000100)='./file0\x00', &(0x7f0000000380)='xfs\x00', 0x0, &(0x7f0000000980)='norecovery') r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000500)={{0x80, 0x40}, 'port0\x00', 0x100, 0xd1050, 0x0, 0x0, 0x4, 0x0, 0xfffffffd}) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x501) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000200)={{0x80, 0x4}, 'port1\x00', 0x89, 0x0, 0x0, 0xfffffeff, 0x0, 0x0, 0x200000, 0x0, 0x4875c99660ff2b28}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{&(0x7f0000000080)={0x2, 0x4e23, @remote}, 0x10, 0x0}}], 0x1, 0x20000000) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0xb8}}, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x43033, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000fde000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0) munmap(&(0x7f000075a000/0xb000)=nil, 0xb000) munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000) munmap(&(0x7f0000482000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000) munmap(&(0x7f0000f62000/0x1000)=nil, 0x1000) mmap$KVM_VCPU(&(0x7f0000f3d000/0x4000)=nil, 0x930, 0x0, 0x4030031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000eb0000/0x3000)=nil, 0x3000) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000c00)={0x4, 0x9, 0x8, 0x7, 0xf70, 0x7}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x22800, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r3, 0x80045105, &(0x7f00000000c0)) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) write$cgroup_int(r4, &(0x7f0000000080)=0x3, 0x12) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000980)={r4, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f00000004c0)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x9, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x74, &(0x7f0000000780)=[{}], 0x8, 0x10, &(0x7f00000007c0), &(0x7f0000000800), 0x8, 0x1b, 0x8, 0x8, &(0x7f0000000840)}}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000b80)={0x34, r6, 0x1, 0xce, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000a00)=@generic={&(0x7f00000009c0)='./file0\x00', 0x0, 0x8}, 0x18) 11m39.180566354s ago: executing program 2 (id=341): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000180)={0x1, 'ip6tnl0\x00', {}, 0x6}) close_range(r0, 0xffffffffffffffff, 0x0) 11m39.097266859s ago: executing program 4 (id=342): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x69703000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) lseek(0xffffffffffffffff, 0xfffffffffffffff5, 0x1) ioctl$int_in(r0, 0x5421, &(0x7f0000000040)=0x8) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f000000d100)=0x9, 0x4) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f000000e840), &(0x7f000000e880)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_usb_connect(0x2, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = socket(0x1d, 0x4, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r5, 0x8983, &(0x7f0000000200)={0x7, 'vlan0\x00', {0x5}, 0x200}) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, 0x0, 0x0) syz_open_dev$MSR(0x0, 0x6, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000032680)=""/102400, 0x19000) setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) recvmsg$unix(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)=""/210, 0xd2}], 0x1}, 0x61) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x5, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x11, 0x9d}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x10000000}], {0x95, 0x0, 0x5a5}}, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$inet6(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) 11m38.730077711s ago: executing program 2 (id=343): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x4a301, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8d11}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'\x00', 0x400}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = eventfd(0x1ff) read$eventfd(r2, &(0x7f0000000040), 0x8) write$tun(r0, &(0x7f0000000440)=ANY=[], 0x3e) 11m37.946078727s ago: executing program 5 (id=345): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r2, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000040)=r3, 0x4) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r3, 0x0, 0x0}, 0x10) mkdir(0x0, 0x0) 11m37.912671376s ago: executing program 3 (id=346): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x8, [{0x0, 0x3}]}, @ptr={0x0, 0x0, 0x0, 0x2, 0x3}, @restrict={0x0, 0x0, 0x0, 0x9, 0x2}]}}, 0x0, 0x4a, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) 11m37.790034492s ago: executing program 5 (id=348): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0xe, &(0x7f0000002300)=ANY=[@ANYBLOB="b702000000001700bfa300000000000007030000f0ffffff7a0af0ff1100000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000000000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd844a954b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129da487130d5f24bf901115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4b9535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024a0041b1df65b3e1b9bf115646d14ce53d13d0ccacda1efc5f9094fa737c28b994a8512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4fdc4b4861004eefbc17f54f82a804d4a69bf9bc5fa77ee2922bd165a5a68488e010030166565a097b103b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f940b6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c2d7f22b0d22772c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d366501753a7ac7fedb8d34f5bc381604fcd46105c457e7dd13cab6692422a47e9ffe2d4a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c9585638c2153a6eee01738b0c10671f4f559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670100be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c160119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d300e4d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d0000002000000001c800000000000000000000000928ee53595a779d243a48cea769470424d28804c024ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d74bf0a305790c9d644735efbf3411718d6ee7aebf9ef40662d7836d252c566f5ee934c679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da2022f23daec61854f640f701db0276652f6c031578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada209bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6155e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2f085185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bcdb7c89739f5d81e750d50517a59a3ad09e8802e8f4f535447cc0facd5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5b473332f2011e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d3fcd116bce9c764c714c9402c21d181aae59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755367fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf00000048d2570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749e1338636555009edf66be445d6975d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab0043ebf7c79a953e023f74afad591821610b857e8717764b633b21cb32f09f4db033e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c1960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000000000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd5c17d5486b0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dff7aa46e820a74f9530bdcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fdca4e9eda0072f6df342f3e7071e28ef6806bc8e139c49b91c76b0d3958f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7194d1eb3de6a5f99f301f89c2ee627e949cdd22000026a9960503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640000cd9e7f2e236ef5f1e3a94b108eb9750b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a2050000c375c705c798e0e208e4a5259d0bda526b462af45a6e9a84aebe025c8a7f65819f397574db7ab01bd2b3e3cd28c5aec50f8edfe39a00bafd688a7eea04efdeed96f67012bc3f795edb68b5dec80ad31a858eb756c815e7695d00000000000000000000000000000000000000000000000000007ccf0ce549d97510f7f8765408bb702f0000006d4754d98b7064cf31a681421994e1f307f0ab4ff2e33d3c88fea5d218a276b77adfee7c8fb145783ee1f8cf632c2604eab3a62a28611da1cae5ce60003111ce5c96a1d6e45ee144ffa3dcca32a33f8f0ce2995b7b7aa0bce228cbf37412e1bdebae06edb51a134301b4627d4927287daf9dcae6720334862f3a18094f1edd9e3503379815dcfbbc8141f6e1bbb0901ae91357677fd9d2bb00d4f17fb441c2dfa2b424bf46ae299d68ac27792cdac2f09e99f4ab5546ba1e5ad6a329f24e73a9c38eec34bd4dcc1609f6150e2de72f6599a2310c3841f4bb7f39cabc82c9fdfff5587ed4fa84090635fa3445c4cc54478b2f98320944ac7cb1c4e414556f7b0b763a00a84327cec7e11b3470f0384b27bbfdd8b2472497e7fe8c5df7e0a00641872472efa21c9ad3979e642dcc85c17ca8e084aa9689b83426e2fdaa01f500000000000000000000f9fd84fa991466ff749afe900d02281b2bb60d458340c4f68ec34835760ceca945bf181a000000c000000000b4a76515564ae189de7c1765f0ff68a0388ca8dd2aa831d0e01f0d7ce74401a58cef60e63e97a50c18de54121ce66380224ab7b9c0d4710f2347bad2c9b3e41cc738c1092728687f33e5cdb077223dc82c2137b4e3ba6791a2cd764e654f904c9505b7c5e3b2897072e747534952dcda50cde3e4deb6ebf85a04c3e415112b01eed6515c845a8a20519cd21787d560e9d8283fa8ff0c17b63ba06577c26678ff45420a1f85df47dbfc44e534f71aae5693fb5df61c5096219091ce0cd8e1e2e79bf9d37779e52007c66a00e6ded1499ed3892ed1544d1577906b52e16c734d4aec07dd15faa768c97298be87dd34ce704ffe3da8b46708cf972de4f31c0705ac933db80bdcfcb35c0d4620d4ec270ff7c9ce1b78994dd2b28b9d1c5c469d4c1a61781dce2f1b54d6138bd3f7df9e9ca613bec407c1b8d1bd0c7cb9d76eebf2f17c"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040), 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000028000000280000000200000000000000000000030000000000000000000000000000000000000000000000010502"], 0x0, 0x42, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22000000"], 0xfdef) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 11m37.789926877s ago: executing program 3 (id=349): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)='!', 0x1}], 0x1}, 0x0) syz_clone(0x164000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TUNGETVNETLE(r0, 0xc008744c, &(0x7f0000000180)) 11m36.420151577s ago: executing program 4 (id=350): bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1f, 0x4, &(0x7f0000000200)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xb6}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 11m35.361955636s ago: executing program 4 (id=352): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x4, 0xdd, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r2}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000001c0)={{r0}, &(0x7f0000000040), &(0x7f0000000080)='%+9llu \x00'}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 11m35.349995353s ago: executing program 5 (id=353): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000f00)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b708000000bc7a007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 11m35.230030415s ago: executing program 5 (id=355): write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, &(0x7f0000000280), &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000100), &(0x7f0000000000), 0x2}, 0x20) 11m35.229804213s ago: executing program 4 (id=356): bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) close(0xffffffffffffffff) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="2d8400"], 0xffdd) 11m35.186368188s ago: executing program 5 (id=358): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000d00)='cgroup.clone_children\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000d40)=0x200, 0x12) 11m35.069539255s ago: executing program 5 (id=360): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x69703000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) lseek(0xffffffffffffffff, 0xfffffffffffffff5, 0x1) ioctl$int_in(r0, 0x5421, &(0x7f0000000040)=0x8) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f000000d100)=0x9, 0x4) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f000000e840), &(0x7f000000e880)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_usb_connect(0x2, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = socket(0x1d, 0x4, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r5, 0x8983, &(0x7f0000000200)={0x7, 'vlan0\x00', {0x5}, 0x200}) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, 0x0, 0x0) syz_open_dev$MSR(0x0, 0x6, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000032680)=""/102400, 0x19000) setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) recvmsg$unix(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)=""/210, 0xd2}], 0x1}, 0x61) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x5, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x11, 0x9d}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x10000000}], {0x95, 0x0, 0x5a5}}, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$inet6(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) 11m19.623263411s ago: executing program 33 (id=359): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000300)='sys_enter\x00', r1}, 0x10) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) 11m19.572571112s ago: executing program 34 (id=360): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x69703000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) lseek(0xffffffffffffffff, 0xfffffffffffffff5, 0x1) ioctl$int_in(r0, 0x5421, &(0x7f0000000040)=0x8) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f000000d100)=0x9, 0x4) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f000000e840), &(0x7f000000e880)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_usb_connect(0x2, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = socket(0x1d, 0x4, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r5, 0x8983, &(0x7f0000000200)={0x7, 'vlan0\x00', {0x5}, 0x200}) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, 0x0, 0x0) syz_open_dev$MSR(0x0, 0x6, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000032680)=""/102400, 0x19000) setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) recvmsg$unix(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)=""/210, 0xd2}], 0x1}, 0x61) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x5, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x11, 0x9d}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x10000000}], {0x95, 0x0, 0x5a5}}, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$inet6(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) 11m19.485643227s ago: executing program 35 (id=343): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x4a301, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8d11}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'\x00', 0x400}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = eventfd(0x1ff) read$eventfd(r2, &(0x7f0000000040), 0x8) write$tun(r0, &(0x7f0000000440)=ANY=[], 0x3e) 11m19.400124701s ago: executing program 36 (id=349): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)='!', 0x1}], 0x1}, 0x0) syz_clone(0x164000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TUNGETVNETLE(r0, 0xc008744c, &(0x7f0000000180)) 11m19.310251698s ago: executing program 37 (id=356): bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) close(0xffffffffffffffff) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="2d8400"], 0xffdd) 5m36.806788302s ago: executing program 7 (id=1784): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r0}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_icmp(0xa, 0x2, 0x3a) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x1, 0x84) socket$alg(0x26, 0x5, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) userfaultfd(0x80003) sendmmsg(r1, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r3}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) syz_usb_connect(0x0, 0x627, &(0x7f0000000780)={{0x12, 0x1, 0x200, 0x52, 0x23, 0x99, 0x10, 0x499, 0x1012, 0xb215, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x615, 0x3, 0x85, 0x3, 0x100, 0x7, [{{0x9, 0x4, 0x1, 0x3, 0x6, 0x14, 0xe3, 0x21, 0x3, [], [{{0x9, 0x5, 0x0, 0x1, 0x3ff, 0x0, 0x9, 0x1, [@generic={0x33, 0x22, "9e1dcd6fcedba39eef120c4c426896ca83412b3fc1fad29623e6ef291867afc3c86e3c1b5b1ae7b04c1d253ddbdadf6e10"}]}}, {{0x9, 0x5, 0x80, 0x8, 0x3ff, 0x40, 0x63, 0x81, [@generic={0xb7, 0x38, "42a666b5678d7cc3ac33a9dc2d458b9c6d19b2033d506f2eeac1208c00188f655d0cb8cc765a6f5d6058cc72697fe2e6c57dcdb60202bf508b321db20387db057f0106f51b235d794501ab2d6a8a95ea61a1621eb355ddde5797b4fae1905266b026c43afe1f59e8a8690841843591fbb08751cfba877e98c94af03f418496e0ca6c882b163c83325c2a53f05acfebfb548eeab72e343580e5f6cc2a2c891598977fba278f9a1380c7ceddded5ddb5a23dc5318375"}]}}, {{0x9, 0x5, 0x4, 0x4, 0x400, 0x8, 0x6c, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x5, 0x80}]}}, {{0x9, 0x5, 0x7, 0x10, 0x10, 0xc6, 0x5, 0x5}}, {{0x9, 0x5, 0x1, 0x0, 0x200, 0x7, 0x7, 0x3}}, {{0x9, 0x5, 0x2, 0x3, 0x10, 0x6, 0x2, 0x3, [@generic={0xdf, 0x22, "073ad2b2bd3ec32f4662b332f1f65f0a23020c901235afe08e7b3426bb4582f22747c17ec7ea576a6d377b7ee57ee7dad5411b98cff49206ed067d8b540a8d76f8b481d976944cc752c1904d3ba3904d0dfe612545d906eb19fc74d04c385ddf2a544e0e5feda3f02b1aae2a6675c6aab67f42724e1d9a5778cbeec938a10fca036ea89d36ca35be0f318420cf74cc0c7ef44ee27c2d69a8e3fae9300c507490e2b9c8ac31cb7d30ef5d49c4a1695841b050f0268fc2f380f6b17c93312a0eb76061713e568207e0e06404c4f6a0c69b3f32b533e94173bd9efa3a2be0"}, @generic={0x67, 0x0, "f50c05e269d761e737e3cf728ceac71c31694e0a982096af59742dcffd8b13376ae60c67883507f063421b9894b7965ff1e89f5d8ced4fa00ba9624774723a7bd3563be0a60a9a84c8fe4e6981b61edf1fb6c9d4ed1a6143634c9edcd8016c230212440a75"}]}}]}}, {{0x9, 0x4, 0xf5, 0x8, 0x8, 0x5d, 0xb8, 0x22, 0x7, [], [{{0x9, 0x5, 0x9, 0x12, 0x3ff, 0x2, 0x2, 0x4, [@generic={0x23, 0x22, "fddb3b980eda99fc62cf94a4293be140f1dbfa601e2519de1d80755e5e843bb329"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x40}]}}, {{0x9, 0x5, 0x8, 0x8, 0xa884a0131c572d92, 0xfe, 0x4, 0x9, [@generic={0xfa, 0x21, "201739b7b7b43466dd8593786e197041b042aef307a037ff2be7008033859f44031bcabea23f0fe5106f24050145977fb4fdf7d5b9deaf43b064f41a9cb161327a2eac07b5b2edfce5b3a3628ed3c803a19b1552aafff27bdb777062f84a0a58e39f77cb482ded7dc03e3d001d18629fae2ee01bbd4fc4319a6e776c9b0dbf8d5d907111c9840e1e249e5e708718bd64cecf3ae2a786dce51048720de729b20cf3ee752bbc1b7c01d00b20036524df9fc875210e33631bf0de9228c2c89cd781d6cdcfcd9ffbe11788b6da211a22ef6219676f462871e7a92c582306ac6c829cd86ea8ce5d1390493d5cb9256b36f06e8b2c3617f1d477b4"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x40, 0x8, 0x1, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x8, 0x8}]}}, {{0x9, 0x5, 0xc, 0x10, 0x10, 0x4, 0x9, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x8, 0x800}]}}, {{0x9, 0x5, 0x0, 0x0, 0x3ff, 0x6, 0x7, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x40, 0xe8}]}}, {{0x9, 0x5, 0xc, 0x0, 0x20, 0x5, 0x6, 0xa9, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x4, 0xb7d}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x0, 0xd70}]}}, {{0x9, 0x5, 0x2, 0x1, 0x10, 0xf2, 0x6, 0x8}}, {{0x9, 0x5, 0x3, 0x0, 0x200, 0xd7, 0xf1, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x0, 0xfff4}]}}]}}, {{0x9, 0x4, 0xfd, 0x81, 0x2, 0xe6, 0x1b, 0xbb, 0x7, [@uac_as={[@as_header={0x7, 0x24, 0x1, 0x5, 0x0, 0x1}, @as_header={0x7, 0x24, 0x1, 0x59, 0x2, 0x2004}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x3, 0x6, 0xf5, "0f584b5ea0"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0xb0, 0x2, 0x5b, 0x5, 'T$M'}]}, @cdc_ecm={{0x9, 0x24, 0x6, 0x0, 0x0, "ed42a612"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x0, 0x6, 0xd}, [@network_terminal={0x7, 0x24, 0xa, 0x3, 0x4, 0x6, 0x5}, @dmm={0x7, 0x24, 0x14, 0x80, 0x7}, @mdlm_detail={0x7f, 0x24, 0x13, 0x5, "8797e81c5367b9c34c517f08514c2c8eeb45c134da9de94814c650298f175613b587932fc535f76626a3858a7121ab292b16f9fc6a1568c3ee0cefe0737d39d15c5e03b8c5665c78a536bafd7d3aba95065b1c3179019e1e38e87d26641ca9542aa77429c6b5f736ed3ad7df8f45406ed1c69d5f5dc0adbc8acd19"}, @acm={0x4, 0x24, 0x2, 0x7}, @acm={0x4, 0x24, 0x2, 0xf}]}], [{{0x9, 0x5, 0xc, 0xc, 0x200, 0x6, 0x0, 0x5, [@generic={0xfe, 0x8, "d15bd8ed9990b31ba126a91eef991feb6cf67459430a358f1afa2a3bf92680dc01d42025e92d1a108200356cb528fc8e6ad36665b628c97365eeaa64988fb4afd50a3b92ba9c8b4868740fdbb3584bf18c00310e1de6a513d3c8e2bf6413048033a8f1aa9f2831e04da834abfcf3d33a0de560f5859733e3e546bc37019da8a817c6fbcdbbb03ac2bc5eac9287b96494c438ccf16c8a283b1ade53d612da7bf9a043602d14798c993f082591d0d19f560fcbeed9b0177330ba7c46b30ec26606474a6442cfaf8ed453117faec99a974fc7bb208299a78a276f0a6f238f2c7db81a406ff2832796281280676f83dbf3e496c12682f67ccaf34fec94b5"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x7}]}}, {{0x9, 0x5, 0x8, 0x5, 0x40, 0x7, 0x0, 0x3}}]}}]}}]}}, &(0x7f0000000200)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x7f, 0x5, 0x7, 0x40, 0x4}, 0x5, &(0x7f0000000100)={0x5, 0xf, 0x5}, 0x3, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x2401}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x140a}}, {0x80, &(0x7f0000000500)=@string={0x80, 0x3, "fb78473ec0cb04feb9b5e95e1553f14e792143f694aedb211d57108a4cfabdd754c90524150bec776442b50ab056a391e2acf58fb8c0960697bd356e736322391f59e59340af78d8cec935575422422cc7a5b06f83668e00f3c86df2db7f17e244bc76668c55092e1cd65228ed18e843407c3c28db984991ea1b84fbfd62"}}]}) 5m33.577997045s ago: executing program 7 (id=1805): setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='illinois\x00', 0x9) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) io_setup(0x9, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) syz_open_dev$sndctrl(&(0x7f0000000e00), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8983, &(0x7f0000000000)={0x6, 'veth0_vlan\x00', {0x2}, 0x101}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r2, 0x8982, &(0x7f0000000040)={0x0, 'veth0_vlan\x00', {0x1}, 0x2b1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='::,:/', 0x0) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000002c0)={'veth0_vlan\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x40000, 0x40000000, 0x2, 0x1}}) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}}) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x3fa1dc947ffe4b82}) r7 = socket(0x1, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, 0x0, &(0x7f0000001380)=@udp=r7}, 0x20) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x5452, &(0x7f00000000c0)={'gre0\x00', 0x0}) recvmsg(r7, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x0) socket(0x3, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 5m31.040641398s ago: executing program 7 (id=1810): connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) timer_create(0x2, 0x0, &(0x7f0000000280)) r0 = syz_open_procfs(0x0, 0x0) preadv(r0, &(0x7f0000000580)=[{&(0x7f0000000200)=""/122, 0x7a}], 0x1, 0x45, 0x0) sched_setaffinity(0x0, 0x0, 0x0) getpid() setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x24, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$DRM_IOCTL_RM_MAP(r0, 0x4028641b, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000ffd000/0x3000)=nil}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, r4, 0x1000000, 0x20010, r0, 0x0) write$P9_RVERSION(r3, 0x0, 0x0) r5 = dup(r3) write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_INIT(r5, &(0x7f0000000280)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x4}}, 0x50) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000004380), 0x0, &(0x7f0000000740)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@version_L}, {@nodevmap}], [], 0x6b}}) fchmodat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x1ff) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000340)={@multicast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "02adf7", 0x38, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @time_exceed={0x2, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "fd9063", 0x0, 0x3a, 0x0, @loopback, @loopback, [], "1e520b4c951ee12e"}}}}}}}, 0x0) 5m30.889792126s ago: executing program 7 (id=1812): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file0/file0\x00', 0x201) (fail_nth: 1) 5m30.465708966s ago: executing program 7 (id=1816): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x107842, 0x0) pwritev2(r2, &(0x7f0000000100)=[{&(0x7f0000000280)="d8", 0x1}], 0x1, 0x81, 0x4, 0x82) bind$tipc(r1, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = userfaultfd(0x80001) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'macsec0\x00', @random="06517dc2e6ea"}) r5 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r5, &(0x7f00000000c0)={0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="0000f50000000341e9"], 0x0}, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$UFFDIO_REGISTER(r3, 0xc020aa04, &(0x7f0000000100)={{&(0x7f00001a4000/0x1000)=nil, 0x1000}, 0x4, 0x2}) bind$tipc(r1, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r1, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) bind$tipc(r0, 0x0, 0x0) 5m30.287347577s ago: executing program 7 (id=1818): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00220f000000"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000140), 0x0, 0x0) ioctl$HIDIOCGREPORT(r1, 0x400c4807, 0x0) 5m30.079781721s ago: executing program 38 (id=1818): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00220f000000"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000140), 0x0, 0x0) ioctl$HIDIOCGREPORT(r1, 0x400c4807, 0x0) 2m10.750561921s ago: executing program 9 (id=2329): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newtaction={0x6c, 0x30, 0x1af, 0x1000, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0xfc000000, 0x7, 0x4, 0xfffffffd}, @multicast1, @broadcast, 0xffffffff}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0x28}}, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x8400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r1, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)={0x134, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x800, 0x65}}}}, [@NL80211_ATTR_QOS_MAP={0x30, 0xc7, {[{0x80, 0x2}, {0x9, 0x7}, {0x3}, {0x6, 0x4}, {0xff}, {0xdd, 0x4}, {0x98}, {0x6, 0x2}, {0x9, 0x1}, {0x2, 0x3}, {0x81, 0x7}, {0x1, 0x2}, {0x6, 0x1}, {0x7f, 0x1}, {0x9}, {0x2, 0x7}, {0xd, 0x2}, {0xf9, 0x7}], "d47749cbe7e6bf46"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x80, 0x1}, {0x1, 0x3}, {0x76, 0x3}, {0x1, 0x6}, {0x3, 0x3}, {0x8, 0x1}, {0x4, 0x3}, {0x1, 0x3}, {0xea, 0x6}, {0x93, 0x3}, {0xd8}, {0x2, 0x6}], "9b907ca69d85a1b1"}}, @NL80211_ATTR_QOS_MAP={0x22, 0xc7, {[{0x6}, {0x3, 0x6}, {0x5, 0x3}, {0xe}, {0x5, 0x4}, {0xec, 0x7}, {0x2, 0x5}, {0x2, 0x5}, {0x4, 0x4}, {0xf6, 0x1}, {0xa, 0x3}], "b52daa51555c94e3"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0xfc, 0x7}, {0x1, 0x6}, {0x2, 0x2}, {0x0, 0x5}, {0x37, 0x7}, {0x2, 0x2}, {0x2, 0x1}], "48b4d75c6d18b61b"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x5}, {0x2, 0x3}, {0x4, 0x5}, {0xc, 0x4}, {0x95, 0x6}, {0xf1, 0x1}, {0x6, 0x4}, {0x7}, {0x90}, {0x7, 0x4}, {0xb, 0x3}, {0xf7}, {0x8, 0x5}, {0x0, 0x3}], "e66df8e69494e4de"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x7, 0x3}, {0x7, 0x6}, {0x1, 0x4}, {0x8, 0x3}, {0x77, 0x2}, {0x4}, {0x0, 0x4}, {0x8, 0x7}, {0x10, 0x7}, {0x9, 0x7}, {0xa, 0x2}, {0x5, 0x4}, {0x0, 0x6}, {0x80, 0x5}, {0xe7, 0x7}, {0x1, 0x5}, {0x5, 0x2}, {0x1}, {0xe0, 0x5}], "06abdb4f7ef6e15b"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0x6, 0x7}, {0x5, 0x7}, {0x7, 0x3}, {0x8, 0x5}, {0x5, 0x6}, {0xa, 0x1}, {0x81, 0x4}], "d511221ee0b71e1c"}}]}, 0x134}, 0x1, 0x0, 0x0, 0xa51a4ef2580c5b4a}, 0x20001001) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x2, 0x80805, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r6, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r8}) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e20, 0x3, 'rr\x00', 0x16, 0x2, 0x6f}, 0x2c) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00008c3000/0x2000)=nil, 0x2000}, 0x8}) setsockopt$IP_VS_SO_SET_ADDDEST(r9, 0x0, 0x487, &(0x7f0000000000)={{0xff, @private=0xa010101, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x83, 0x77}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcd, 0x3d71, 0x2}}, 0x44) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, 0x7, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040880) 1m50.413347193s ago: executing program 9 (id=2329): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newtaction={0x6c, 0x30, 0x1af, 0x1000, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0xfc000000, 0x7, 0x4, 0xfffffffd}, @multicast1, @broadcast, 0xffffffff}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0x28}}, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x8400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r1, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)={0x134, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x800, 0x65}}}}, [@NL80211_ATTR_QOS_MAP={0x30, 0xc7, {[{0x80, 0x2}, {0x9, 0x7}, {0x3}, {0x6, 0x4}, {0xff}, {0xdd, 0x4}, {0x98}, {0x6, 0x2}, {0x9, 0x1}, {0x2, 0x3}, {0x81, 0x7}, {0x1, 0x2}, {0x6, 0x1}, {0x7f, 0x1}, {0x9}, {0x2, 0x7}, {0xd, 0x2}, {0xf9, 0x7}], "d47749cbe7e6bf46"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x80, 0x1}, {0x1, 0x3}, {0x76, 0x3}, {0x1, 0x6}, {0x3, 0x3}, {0x8, 0x1}, {0x4, 0x3}, {0x1, 0x3}, {0xea, 0x6}, {0x93, 0x3}, {0xd8}, {0x2, 0x6}], "9b907ca69d85a1b1"}}, @NL80211_ATTR_QOS_MAP={0x22, 0xc7, {[{0x6}, {0x3, 0x6}, {0x5, 0x3}, {0xe}, {0x5, 0x4}, {0xec, 0x7}, {0x2, 0x5}, {0x2, 0x5}, {0x4, 0x4}, {0xf6, 0x1}, {0xa, 0x3}], "b52daa51555c94e3"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0xfc, 0x7}, {0x1, 0x6}, {0x2, 0x2}, {0x0, 0x5}, {0x37, 0x7}, {0x2, 0x2}, {0x2, 0x1}], "48b4d75c6d18b61b"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x5}, {0x2, 0x3}, {0x4, 0x5}, {0xc, 0x4}, {0x95, 0x6}, {0xf1, 0x1}, {0x6, 0x4}, {0x7}, {0x90}, {0x7, 0x4}, {0xb, 0x3}, {0xf7}, {0x8, 0x5}, {0x0, 0x3}], "e66df8e69494e4de"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x7, 0x3}, {0x7, 0x6}, {0x1, 0x4}, {0x8, 0x3}, {0x77, 0x2}, {0x4}, {0x0, 0x4}, {0x8, 0x7}, {0x10, 0x7}, {0x9, 0x7}, {0xa, 0x2}, {0x5, 0x4}, {0x0, 0x6}, {0x80, 0x5}, {0xe7, 0x7}, {0x1, 0x5}, {0x5, 0x2}, {0x1}, {0xe0, 0x5}], "06abdb4f7ef6e15b"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0x6, 0x7}, {0x5, 0x7}, {0x7, 0x3}, {0x8, 0x5}, {0x5, 0x6}, {0xa, 0x1}, {0x81, 0x4}], "d511221ee0b71e1c"}}]}, 0x134}, 0x1, 0x0, 0x0, 0xa51a4ef2580c5b4a}, 0x20001001) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x2, 0x80805, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r6, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r8}) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e20, 0x3, 'rr\x00', 0x16, 0x2, 0x6f}, 0x2c) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00008c3000/0x2000)=nil, 0x2000}, 0x8}) setsockopt$IP_VS_SO_SET_ADDDEST(r9, 0x0, 0x487, &(0x7f0000000000)={{0xff, @private=0xa010101, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x83, 0x77}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcd, 0x3d71, 0x2}}, 0x44) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, 0x7, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040880) 1m26.191552792s ago: executing program 9 (id=2329): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newtaction={0x6c, 0x30, 0x1af, 0x1000, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0xfc000000, 0x7, 0x4, 0xfffffffd}, @multicast1, @broadcast, 0xffffffff}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0x28}}, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x8400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r1, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)={0x134, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x800, 0x65}}}}, [@NL80211_ATTR_QOS_MAP={0x30, 0xc7, {[{0x80, 0x2}, {0x9, 0x7}, {0x3}, {0x6, 0x4}, {0xff}, {0xdd, 0x4}, {0x98}, {0x6, 0x2}, {0x9, 0x1}, {0x2, 0x3}, {0x81, 0x7}, {0x1, 0x2}, {0x6, 0x1}, {0x7f, 0x1}, {0x9}, {0x2, 0x7}, {0xd, 0x2}, {0xf9, 0x7}], "d47749cbe7e6bf46"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x80, 0x1}, {0x1, 0x3}, {0x76, 0x3}, {0x1, 0x6}, {0x3, 0x3}, {0x8, 0x1}, {0x4, 0x3}, {0x1, 0x3}, {0xea, 0x6}, {0x93, 0x3}, {0xd8}, {0x2, 0x6}], "9b907ca69d85a1b1"}}, @NL80211_ATTR_QOS_MAP={0x22, 0xc7, {[{0x6}, {0x3, 0x6}, {0x5, 0x3}, {0xe}, {0x5, 0x4}, {0xec, 0x7}, {0x2, 0x5}, {0x2, 0x5}, {0x4, 0x4}, {0xf6, 0x1}, {0xa, 0x3}], "b52daa51555c94e3"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0xfc, 0x7}, {0x1, 0x6}, {0x2, 0x2}, {0x0, 0x5}, {0x37, 0x7}, {0x2, 0x2}, {0x2, 0x1}], "48b4d75c6d18b61b"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x5}, {0x2, 0x3}, {0x4, 0x5}, {0xc, 0x4}, {0x95, 0x6}, {0xf1, 0x1}, {0x6, 0x4}, {0x7}, {0x90}, {0x7, 0x4}, {0xb, 0x3}, {0xf7}, {0x8, 0x5}, {0x0, 0x3}], "e66df8e69494e4de"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x7, 0x3}, {0x7, 0x6}, {0x1, 0x4}, {0x8, 0x3}, {0x77, 0x2}, {0x4}, {0x0, 0x4}, {0x8, 0x7}, {0x10, 0x7}, {0x9, 0x7}, {0xa, 0x2}, {0x5, 0x4}, {0x0, 0x6}, {0x80, 0x5}, {0xe7, 0x7}, {0x1, 0x5}, {0x5, 0x2}, {0x1}, {0xe0, 0x5}], "06abdb4f7ef6e15b"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0x6, 0x7}, {0x5, 0x7}, {0x7, 0x3}, {0x8, 0x5}, {0x5, 0x6}, {0xa, 0x1}, {0x81, 0x4}], "d511221ee0b71e1c"}}]}, 0x134}, 0x1, 0x0, 0x0, 0xa51a4ef2580c5b4a}, 0x20001001) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x2, 0x80805, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r6, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r8}) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e20, 0x3, 'rr\x00', 0x16, 0x2, 0x6f}, 0x2c) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00008c3000/0x2000)=nil, 0x2000}, 0x8}) setsockopt$IP_VS_SO_SET_ADDDEST(r9, 0x0, 0x487, &(0x7f0000000000)={{0xff, @private=0xa010101, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x83, 0x77}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcd, 0x3d71, 0x2}}, 0x44) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, 0x7, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040880) 1m11.165531858s ago: executing program 9 (id=2329): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newtaction={0x6c, 0x30, 0x1af, 0x1000, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0xfc000000, 0x7, 0x4, 0xfffffffd}, @multicast1, @broadcast, 0xffffffff}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0x28}}, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x8400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r1, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)={0x134, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x800, 0x65}}}}, [@NL80211_ATTR_QOS_MAP={0x30, 0xc7, {[{0x80, 0x2}, {0x9, 0x7}, {0x3}, {0x6, 0x4}, {0xff}, {0xdd, 0x4}, {0x98}, {0x6, 0x2}, {0x9, 0x1}, {0x2, 0x3}, {0x81, 0x7}, {0x1, 0x2}, {0x6, 0x1}, {0x7f, 0x1}, {0x9}, {0x2, 0x7}, {0xd, 0x2}, {0xf9, 0x7}], "d47749cbe7e6bf46"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x80, 0x1}, {0x1, 0x3}, {0x76, 0x3}, {0x1, 0x6}, {0x3, 0x3}, {0x8, 0x1}, {0x4, 0x3}, {0x1, 0x3}, {0xea, 0x6}, {0x93, 0x3}, {0xd8}, {0x2, 0x6}], "9b907ca69d85a1b1"}}, @NL80211_ATTR_QOS_MAP={0x22, 0xc7, {[{0x6}, {0x3, 0x6}, {0x5, 0x3}, {0xe}, {0x5, 0x4}, {0xec, 0x7}, {0x2, 0x5}, {0x2, 0x5}, {0x4, 0x4}, {0xf6, 0x1}, {0xa, 0x3}], "b52daa51555c94e3"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0xfc, 0x7}, {0x1, 0x6}, {0x2, 0x2}, {0x0, 0x5}, {0x37, 0x7}, {0x2, 0x2}, {0x2, 0x1}], "48b4d75c6d18b61b"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x5}, {0x2, 0x3}, {0x4, 0x5}, {0xc, 0x4}, {0x95, 0x6}, {0xf1, 0x1}, {0x6, 0x4}, {0x7}, {0x90}, {0x7, 0x4}, {0xb, 0x3}, {0xf7}, {0x8, 0x5}, {0x0, 0x3}], "e66df8e69494e4de"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x7, 0x3}, {0x7, 0x6}, {0x1, 0x4}, {0x8, 0x3}, {0x77, 0x2}, {0x4}, {0x0, 0x4}, {0x8, 0x7}, {0x10, 0x7}, {0x9, 0x7}, {0xa, 0x2}, {0x5, 0x4}, {0x0, 0x6}, {0x80, 0x5}, {0xe7, 0x7}, {0x1, 0x5}, {0x5, 0x2}, {0x1}, {0xe0, 0x5}], "06abdb4f7ef6e15b"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0x6, 0x7}, {0x5, 0x7}, {0x7, 0x3}, {0x8, 0x5}, {0x5, 0x6}, {0xa, 0x1}, {0x81, 0x4}], "d511221ee0b71e1c"}}]}, 0x134}, 0x1, 0x0, 0x0, 0xa51a4ef2580c5b4a}, 0x20001001) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x2, 0x80805, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r6, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r8}) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e20, 0x3, 'rr\x00', 0x16, 0x2, 0x6f}, 0x2c) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00008c3000/0x2000)=nil, 0x2000}, 0x8}) setsockopt$IP_VS_SO_SET_ADDDEST(r9, 0x0, 0x487, &(0x7f0000000000)={{0xff, @private=0xa010101, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x83, 0x77}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcd, 0x3d71, 0x2}}, 0x44) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, 0x7, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040880) 44.118241213s ago: executing program 9 (id=2329): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newtaction={0x6c, 0x30, 0x1af, 0x1000, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0xfc000000, 0x7, 0x4, 0xfffffffd}, @multicast1, @broadcast, 0xffffffff}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0x28}}, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x8400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r1, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)={0x134, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x800, 0x65}}}}, [@NL80211_ATTR_QOS_MAP={0x30, 0xc7, {[{0x80, 0x2}, {0x9, 0x7}, {0x3}, {0x6, 0x4}, {0xff}, {0xdd, 0x4}, {0x98}, {0x6, 0x2}, {0x9, 0x1}, {0x2, 0x3}, {0x81, 0x7}, {0x1, 0x2}, {0x6, 0x1}, {0x7f, 0x1}, {0x9}, {0x2, 0x7}, {0xd, 0x2}, {0xf9, 0x7}], "d47749cbe7e6bf46"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x80, 0x1}, {0x1, 0x3}, {0x76, 0x3}, {0x1, 0x6}, {0x3, 0x3}, {0x8, 0x1}, {0x4, 0x3}, {0x1, 0x3}, {0xea, 0x6}, {0x93, 0x3}, {0xd8}, {0x2, 0x6}], "9b907ca69d85a1b1"}}, @NL80211_ATTR_QOS_MAP={0x22, 0xc7, {[{0x6}, {0x3, 0x6}, {0x5, 0x3}, {0xe}, {0x5, 0x4}, {0xec, 0x7}, {0x2, 0x5}, {0x2, 0x5}, {0x4, 0x4}, {0xf6, 0x1}, {0xa, 0x3}], "b52daa51555c94e3"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0xfc, 0x7}, {0x1, 0x6}, {0x2, 0x2}, {0x0, 0x5}, {0x37, 0x7}, {0x2, 0x2}, {0x2, 0x1}], "48b4d75c6d18b61b"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x5}, {0x2, 0x3}, {0x4, 0x5}, {0xc, 0x4}, {0x95, 0x6}, {0xf1, 0x1}, {0x6, 0x4}, {0x7}, {0x90}, {0x7, 0x4}, {0xb, 0x3}, {0xf7}, {0x8, 0x5}, {0x0, 0x3}], "e66df8e69494e4de"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x7, 0x3}, {0x7, 0x6}, {0x1, 0x4}, {0x8, 0x3}, {0x77, 0x2}, {0x4}, {0x0, 0x4}, {0x8, 0x7}, {0x10, 0x7}, {0x9, 0x7}, {0xa, 0x2}, {0x5, 0x4}, {0x0, 0x6}, {0x80, 0x5}, {0xe7, 0x7}, {0x1, 0x5}, {0x5, 0x2}, {0x1}, {0xe0, 0x5}], "06abdb4f7ef6e15b"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0x6, 0x7}, {0x5, 0x7}, {0x7, 0x3}, {0x8, 0x5}, {0x5, 0x6}, {0xa, 0x1}, {0x81, 0x4}], "d511221ee0b71e1c"}}]}, 0x134}, 0x1, 0x0, 0x0, 0xa51a4ef2580c5b4a}, 0x20001001) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x2, 0x80805, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r6, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r8}) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e20, 0x3, 'rr\x00', 0x16, 0x2, 0x6f}, 0x2c) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00008c3000/0x2000)=nil, 0x2000}, 0x8}) setsockopt$IP_VS_SO_SET_ADDDEST(r9, 0x0, 0x487, &(0x7f0000000000)={{0xff, @private=0xa010101, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x83, 0x77}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcd, 0x3d71, 0x2}}, 0x44) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, 0x7, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040880) 17.722306982s ago: executing program 9 (id=2329): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newtaction={0x6c, 0x30, 0x1af, 0x1000, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0xfc000000, 0x7, 0x4, 0xfffffffd}, @multicast1, @broadcast, 0xffffffff}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0x28}}, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x8400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r1, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)={0x134, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x800, 0x65}}}}, [@NL80211_ATTR_QOS_MAP={0x30, 0xc7, {[{0x80, 0x2}, {0x9, 0x7}, {0x3}, {0x6, 0x4}, {0xff}, {0xdd, 0x4}, {0x98}, {0x6, 0x2}, {0x9, 0x1}, {0x2, 0x3}, {0x81, 0x7}, {0x1, 0x2}, {0x6, 0x1}, {0x7f, 0x1}, {0x9}, {0x2, 0x7}, {0xd, 0x2}, {0xf9, 0x7}], "d47749cbe7e6bf46"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x80, 0x1}, {0x1, 0x3}, {0x76, 0x3}, {0x1, 0x6}, {0x3, 0x3}, {0x8, 0x1}, {0x4, 0x3}, {0x1, 0x3}, {0xea, 0x6}, {0x93, 0x3}, {0xd8}, {0x2, 0x6}], "9b907ca69d85a1b1"}}, @NL80211_ATTR_QOS_MAP={0x22, 0xc7, {[{0x6}, {0x3, 0x6}, {0x5, 0x3}, {0xe}, {0x5, 0x4}, {0xec, 0x7}, {0x2, 0x5}, {0x2, 0x5}, {0x4, 0x4}, {0xf6, 0x1}, {0xa, 0x3}], "b52daa51555c94e3"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0xfc, 0x7}, {0x1, 0x6}, {0x2, 0x2}, {0x0, 0x5}, {0x37, 0x7}, {0x2, 0x2}, {0x2, 0x1}], "48b4d75c6d18b61b"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x5}, {0x2, 0x3}, {0x4, 0x5}, {0xc, 0x4}, {0x95, 0x6}, {0xf1, 0x1}, {0x6, 0x4}, {0x7}, {0x90}, {0x7, 0x4}, {0xb, 0x3}, {0xf7}, {0x8, 0x5}, {0x0, 0x3}], "e66df8e69494e4de"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x7, 0x3}, {0x7, 0x6}, {0x1, 0x4}, {0x8, 0x3}, {0x77, 0x2}, {0x4}, {0x0, 0x4}, {0x8, 0x7}, {0x10, 0x7}, {0x9, 0x7}, {0xa, 0x2}, {0x5, 0x4}, {0x0, 0x6}, {0x80, 0x5}, {0xe7, 0x7}, {0x1, 0x5}, {0x5, 0x2}, {0x1}, {0xe0, 0x5}], "06abdb4f7ef6e15b"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0x6, 0x7}, {0x5, 0x7}, {0x7, 0x3}, {0x8, 0x5}, {0x5, 0x6}, {0xa, 0x1}, {0x81, 0x4}], "d511221ee0b71e1c"}}]}, 0x134}, 0x1, 0x0, 0x0, 0xa51a4ef2580c5b4a}, 0x20001001) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x2, 0x80805, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r6, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r8}) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e20, 0x3, 'rr\x00', 0x16, 0x2, 0x6f}, 0x2c) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00008c3000/0x2000)=nil, 0x2000}, 0x8}) setsockopt$IP_VS_SO_SET_ADDDEST(r9, 0x0, 0x487, &(0x7f0000000000)={{0xff, @private=0xa010101, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x83, 0x77}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcd, 0x3d71, 0x2}}, 0x44) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, 0x7, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040880) 9.770443361s ago: executing program 0 (id=2823): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000140)={0x0, @loopback, @empty}, &(0x7f0000000180)=0xc) r3 = getuid() r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0x5) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000200)=0xdb) ioprio_set$uid(0x0, r3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="f40300001000000026bd7000fedbdf25ff010000000000000000000000000001000000000000000000000000000000004e2400514e2100020a0020202c000000", @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="fe800000000000000000000000000030000004d26c00000000000000000000000000ffffffffffff06000000000000000080000000000000ff0100000000000002000000000000000500000000000000bc000000000000000500000000000000a30000000000000007000000000000000000000000000000ee0a00000000000006000000000000003df800003b520000060000002dbd70000000000002000309110000000000000014000d00ac14141b00000000000000000000000008000b0000000000020112006d6f727573313238302d617678320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b005000000010000d0eb1b4101280daab2706e25022702bf7db5f67abbd8740755babe86216268e344c488aedede3223463b9dca282fd7f56067ac121468cf8810c92bb52949974638896348312f549f812d0c557211fe3ed5ddeef119acf60822fbe73d103fdedd6a19b055abe3f058097888fdd65b19fbfdadd7210a65a469826041070fa7b38dac9d717f1489e7cd1c674c504645976336618a1d0152fe898fc5c2af8337bbe77fb615b2b533f5a76002bc2187b245979b706ed16bbf075e5c3e8df3000008001f000200000021010100686d6163287368613235362d63652900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c80600005111931409a890d04e38143605183de5307950cac298d0723b3967dca01541f45a4a1aafcfeeedc1b81f54c514f90fde685f6d722516e191792fb9dca4aa2d9bdbc6c0d59bab0cc284c490e25914d728c4e915b886c81ba54eff75742a62f0d87dc2f84a287a67e2ff386bc074eec927ab656d1563797d8a4a810e817d87432032746ceb2bdcc41e951f40d39c07fefbfdf536ff4c4415dc6455bc3644a46e9bb0f36f37f11b631c4cf58262c443aa70b6d5154ea1df319022a5b8deba95d2cfe84cc0b8b52eedaca5b0bf9335596dd4333c21d622a5daa433000000b7000100786362632d6165732d6e656f6e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078030000a7a8bbca716e3efc767f60e3317b36f3432e9d8e4d7cea67ea5321ca04a646a0a477174bae075fffd24cf0d202c470ff077f85d97d8a7953f0eb0e0166a67c770c54f6d337c75e1eca069a5ad80239665abd644f2ebca40a5322fbd5b8194b7f376474619d5184b8a5e56c11ab48ab0003021217e7dce4e37bee813a81d4c515a9ad6e645c017346d559194c37f11c1976f06ab1f55954834760107d3141a276ceb7f173df77d1b626f08a51caf222eb30df"], 0x3f4}, 0x1, 0x0, 0x0, 0x408c0}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000fc0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DISCONNECT(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fcdbdf253000000008000300", @ANYRES32=r5, @ANYBLOB="0000000000000000c71921edcf88d96c2e52910c3e2b4a656e874f0c53d6820b0cb5ed533123b4bc2e1be9e79f69571f520ab5966ab6e6639a8ccc527a7bd3c3152ab433f4d3ade9ea7c911472669d17f98aecacf258d5bd00286412b27e3962acbb14976cea10891890fbd9355e235fa822fc69967fe0176ccdfd4aab3342f9f6481d743de708f2d7294f06c1cf306e97e39503d4b50ddefbbb664b2a0b87d62ddbcd248cfee9d24bf43d91d4712e5105e43ccac2e8b392e8a667407e639496abeed992c327ea251c1894d4ce8d7799e2f49738e9b4da6fc1368380ccd1f1200a"], 0x24}, 0x1, 0x0, 0x0, 0x20048000}, 0x48800) 9.417970257s ago: executing program 0 (id=2826): openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_open_dev$evdev(0x0, 0xfffffffffffffff4, 0x862b01) ioctl$EVIOCSFF(r0, 0x40304580, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80280, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300), 0x280449c, &(0x7f0000002140)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000000c0)={0x14, r4, 0x1, 0x0, 0x0, {0x54}}, 0x14}}, 0x0) 9.3549654s ago: executing program 0 (id=2827): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000006900000000000001000000940000000fad413e850000000700"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r1) sendmsg$IEEE802154_START_REQ(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="2ce3ff00", @ANYRES16=r2, @ANYBLOB="010000000000000000000d000000050007001200000006000800a0aa000006000a00ffff0000"], 0x2c}, 0x1, 0x0, 0x0, 0x18000}, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/netlink\x00') setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000500)={@in={{0x2, 0x4e20, @empty}}, 0x0, 0x0, 0x41, 0x0, "d86adaa9ce82e10f6177fa999685c43d5042ddd6740fb249181d73dab87ea2fa8ee95f3f70c56ff9ef31c4fc281a67440ff0e38e6ba0997b1028741368abc8cd7c8d9d9ae736ede0eb4ff476a0469d17"}, 0xd8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x8971, &(0x7f0000000040)={'netdevsim0\x00', @ifru_ivalue=0x85ac}) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) r5 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r5, &(0x7f00000001c0)='./file1\x00', 0x10, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') linkat(r5, &(0x7f0000000100)='./file1\x00', r5, &(0x7f0000000240)='./file0\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file1\x00', 0x2) lstat(&(0x7f0000000680)='./file0\x00', &(0x7f0000000440)) 8.297210695s ago: executing program 0 (id=2831): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000001e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a0b04320000000000000002000000380004803400018009000100686173680000000024000280080006400000001108000740000000a046ff521b2f06eefc08000240000000000900010073797a30000000000900020073797a32"], 0x8c}}, 0x0) 7.557324106s ago: executing program 0 (id=2832): r0 = io_uring_setup(0x1612, &(0x7f0000000200)={0x0, 0x0, 0x3040}) r1 = socket$netlink(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@ipv6_newaddr={0x34, 0x14, 0x1, 0x0, 0x0, {0xa, 0x0, 0xa1, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @mcast1={0xff, 0x5}}, @IFA_FLAGS={0x8, 0x8, 0x402}]}, 0x34}}, 0x0) syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)={0x70, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x10, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x70}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, 0x0, 0x0) r7 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r7, &(0x7f00000000c0)="b8", 0x1) ioctl$SNDCTL_DSP_SYNC(r7, 0x5001, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) 4.93787774s ago: executing program 6 (id=2837): openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_open_dev$evdev(0x0, 0xfffffffffffffff4, 0x862b01) ioctl$EVIOCSFF(r0, 0x40304580, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80280, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300), 0x280449c, &(0x7f0000002140)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000000c0)={0x14, r4, 0x1, 0x0, 0x0, {0x54}}, 0x14}}, 0x0) 4.889324738s ago: executing program 6 (id=2838): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x84, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x8}, &(0x7f0000000200)=0x90) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000280)={{0x5}, 'syz1\x00', 0x10}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001380)=@newtaction={0x48, 0x30, 0xffff, 0x0, 0x0, {}, [{0x34, 0x1, [@m_police={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4, 0x21}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$UI_DEV_CREATE(r2, 0x5501) r4 = syz_open_dev$evdev(&(0x7f0000000340), 0xaa54, 0x8042) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r5, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000009c0)={0x14, 0x0, 0x200, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4048054}, 0x8000) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000094) ioctl$UI_DEV_DESTROY(r2, 0x5502) write(r4, 0x0, 0x0) 4.554583056s ago: executing program 6 (id=2839): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newtaction={0x6c, 0x30, 0x1af, 0x1000, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0xfc000000, 0x7, 0x4, 0xfffffffd}, @multicast1, @broadcast, 0xffffffff}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0x28}}, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x8400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r2, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)={0x134, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x800, 0x65}}}}, [@NL80211_ATTR_QOS_MAP={0x30, 0xc7, {[{0x80, 0x2}, {0x9, 0x7}, {0x3}, {0x6, 0x4}, {0xff}, {0xdd, 0x4}, {0x98}, {0x6, 0x2}, {0x9, 0x1}, {0x2, 0x3}, {0x81, 0x7}, {0x1, 0x2}, {0x6, 0x1}, {0x7f, 0x1}, {0x9}, {0x2, 0x7}, {0xd, 0x2}, {0xf9, 0x7}], "d47749cbe7e6bf46"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x80, 0x1}, {0x1, 0x3}, {0x76, 0x3}, {0x1, 0x6}, {0x3, 0x3}, {0x8, 0x1}, {0x4, 0x3}, {0x1, 0x3}, {0xea, 0x6}, {0x93, 0x3}, {0xd8}, {0x2, 0x6}], "9b907ca69d85a1b1"}}, @NL80211_ATTR_QOS_MAP={0x22, 0xc7, {[{0x6}, {0x3, 0x6}, {0x5, 0x3}, {0xe}, {0x5, 0x4}, {0xec, 0x7}, {0x2, 0x5}, {0x2, 0x5}, {0x4, 0x4}, {0xf6, 0x1}, {0xa, 0x3}], "b52daa51555c94e3"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0xfc, 0x7}, {0x1, 0x6}, {0x2, 0x2}, {0x0, 0x5}, {0x37, 0x7}, {0x2, 0x2}, {0x2, 0x1}], "48b4d75c6d18b61b"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x5}, {0x2, 0x3}, {0x4, 0x5}, {0xc, 0x4}, {0x95, 0x6}, {0xf1, 0x1}, {0x6, 0x4}, {0x7}, {0x90}, {0x7, 0x4}, {0xb, 0x3}, {0xf7}, {0x8, 0x5}, {0x0, 0x3}], "e66df8e69494e4de"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x7, 0x3}, {0x7, 0x6}, {0x1, 0x4}, {0x8, 0x3}, {0x77, 0x2}, {0x4}, {0x0, 0x4}, {0x8, 0x7}, {0x10, 0x7}, {0x9, 0x7}, {0xa, 0x2}, {0x5, 0x4}, {0x0, 0x6}, {0x80, 0x5}, {0xe7, 0x7}, {0x1, 0x5}, {0x5, 0x2}, {0x1}, {0xe0, 0x5}], "06abdb4f7ef6e15b"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0x6, 0x7}, {0x5, 0x7}, {0x7, 0x3}, {0x8, 0x5}, {0x5, 0x6}, {0xa, 0x1}, {0x81, 0x4}], "d511221ee0b71e1c"}}]}, 0x134}, 0x1, 0x0, 0x0, 0xa51a4ef2580c5b4a}, 0x20001001) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x2, 0x80805, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r8, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r7, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r9}) r10 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r10, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e20, 0x3, 'rr\x00', 0x16, 0x2, 0x6f}, 0x2c) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00008c3000/0x2000)=nil, 0x2000}, 0x8}) setsockopt$IP_VS_SO_SET_ADDDEST(r10, 0x0, 0x487, &(0x7f0000000000)={{0xff, @private=0xa010101, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x83, 0x77}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcd, 0x3d71, 0x2}}, 0x44) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, 0x7, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040880) 3.552028929s ago: executing program 6 (id=2841): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001800)={0x6, 0x3, &(0x7f00000006c0)=@framed, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x25dfdbfd, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r2}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x0) (fail_nth: 1) 2.954023584s ago: executing program 8 (id=2843): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x20e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) 2.6821346s ago: executing program 6 (id=2844): socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) r3 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r3, &(0x7f0000000480)={0xa, 0x0, 0x3c000, @empty, 0x5}, 0x1c) r4 = dup2(r3, r3) sendmmsg$unix(r4, &(0x7f0000008380), 0x400000000000174, 0x4008890) 2.677557041s ago: executing program 8 (id=2845): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text16={0x10, 0x0}], 0x1, 0x10, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f7f"], 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.578055964s ago: executing program 1 (id=2846): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0e000000040000000400000009"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000002300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) 2.565931456s ago: executing program 0 (id=2847): r0 = timerfd_create(0x0, 0x0) r1 = syz_usb_connect(0x2, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000e09d7040460a2196324f01020301090224000100000000090400000206d3450009050102100000000009058b0240"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f00000023c0)={0x34, &(0x7f0000002240)=ANY=[@ANYBLOB="400e06"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f00000002c0)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB="001201"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000200)) timerfd_settime(r0, 0x3, &(0x7f0000000440)={{0x0, 0x989680}}, 0x0) clock_adjtime(0x0, &(0x7f0000000480)={0xd54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000002}) 2.465229693s ago: executing program 1 (id=2848): openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_open_dev$evdev(0x0, 0xfffffffffffffff4, 0x862b01) ioctl$EVIOCSFF(r0, 0x40304580, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80280, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300), 0x280449c, &(0x7f0000002140)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000000c0)={0x14, r4, 0x1, 0x0, 0x0, {0x54}}, 0x14}}, 0x0) 2.302672263s ago: executing program 1 (id=2849): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3b) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x44004) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r2 = syz_open_dev$usbmon(&(0x7f00000000c0), 0x6, 0x2) mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000240), 0xe400, &(0x7f00000007c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB="00009f2a0000000000000000000000000000fe301cc239a618e947f065fe62433ac4a7f404dfa4e1d157824fbbe59ed9c988ec484f0b68adade5078e13619f74618bccffb51ab3f58efd5be37a4e547911bceca0e9026d35821c8e8061412af3370154faa8e99f423750da7acdc0b6e2276f4bd0753f365a69bd2e6d8d18e2e40c8aa91c3473fafaabfd49"]) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="1f4dc3b57b4ef7db07d204c70cdc758fae1a21fd4ec4a3e3c9ae591f61396237b39f327ad2ff14e1828be582b342499a1272f78a47fcf565a53ca090c1ccbdc7af337bf696ae61a5cea93d9fa3ab425a33a8158e39012621faa98c641e8fc9e2f5a0", @ANYRES32=0x0], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000200)={'syztnl2\x00', &(0x7f0000000180)={'gre0\x00', 0x0, 0x20, 0x20, 0x5, 0x5, {{0x7, 0x4, 0x3, 0x6, 0x1c, 0x64, 0x0, 0x6, 0x4, 0x0, @multicast2, @private=0xa010101, {[@end, @generic={0x89, 0x6, "03e22307"}, @end]}}}}}) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000500)={0xffffffffffffffff, 0x8, 0x8}, 0xc) ioctl$FS_IOC_MEASURE_VERITY(r3, 0xc0046686, &(0x7f00000002c0)={0x1, 0xffffffffffffff15, "d7f55fed2b8c89679fd2d77ea16ae63e2d3019ff19e7b80200000000000000f76bdd648a1ee2cc2cca32fe8349e62b80b362d47d7f16ef2c1f6da33f58c74f9fd6b488f5575cd6eefd1daf64bbd3cae95d05d1edab0d8214980b5eb1709e0e08edf28f3bc92aa496044e0ff5cd84ef2fedc262b28efbb1a60e4744ae592771f91c"}) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) unshare(0x60400) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000040)=0x100000001, 0x4) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2}, 0xa0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x20}, 0xc) socket(0x10, 0x803, 0x0) 2.240806235s ago: executing program 8 (id=2850): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newtaction={0x6c, 0x30, 0x1af, 0x1000, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0xfc000000, 0x7, 0x4, 0xfffffffd}, @multicast1, @broadcast, 0xffffffff}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0x28}}, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x8400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r2, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)={0x134, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x800, 0x65}}}}, [@NL80211_ATTR_QOS_MAP={0x30, 0xc7, {[{0x80, 0x2}, {0x9, 0x7}, {0x3}, {0x6, 0x4}, {0xff}, {0xdd, 0x4}, {0x98}, {0x6, 0x2}, {0x9, 0x1}, {0x2, 0x3}, {0x81, 0x7}, {0x1, 0x2}, {0x6, 0x1}, {0x7f, 0x1}, {0x9}, {0x2, 0x7}, {0xd, 0x2}, {0xf9, 0x7}], "d47749cbe7e6bf46"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x80, 0x1}, {0x1, 0x3}, {0x76, 0x3}, {0x1, 0x6}, {0x3, 0x3}, {0x8, 0x1}, {0x4, 0x3}, {0x1, 0x3}, {0xea, 0x6}, {0x93, 0x3}, {0xd8}, {0x2, 0x6}], "9b907ca69d85a1b1"}}, @NL80211_ATTR_QOS_MAP={0x22, 0xc7, {[{0x6}, {0x3, 0x6}, {0x5, 0x3}, {0xe}, {0x5, 0x4}, {0xec, 0x7}, {0x2, 0x5}, {0x2, 0x5}, {0x4, 0x4}, {0xf6, 0x1}, {0xa, 0x3}], "b52daa51555c94e3"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0xfc, 0x7}, {0x1, 0x6}, {0x2, 0x2}, {0x0, 0x5}, {0x37, 0x7}, {0x2, 0x2}, {0x2, 0x1}], "48b4d75c6d18b61b"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x5}, {0x2, 0x3}, {0x4, 0x5}, {0xc, 0x4}, {0x95, 0x6}, {0xf1, 0x1}, {0x6, 0x4}, {0x7}, {0x90}, {0x7, 0x4}, {0xb, 0x3}, {0xf7}, {0x8, 0x5}, {0x0, 0x3}], "e66df8e69494e4de"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x7, 0x3}, {0x7, 0x6}, {0x1, 0x4}, {0x8, 0x3}, {0x77, 0x2}, {0x4}, {0x0, 0x4}, {0x8, 0x7}, {0x10, 0x7}, {0x9, 0x7}, {0xa, 0x2}, {0x5, 0x4}, {0x0, 0x6}, {0x80, 0x5}, {0xe7, 0x7}, {0x1, 0x5}, {0x5, 0x2}, {0x1}, {0xe0, 0x5}], "06abdb4f7ef6e15b"}}, @NL80211_ATTR_QOS_MAP={0x1a, 0xc7, {[{0x6, 0x7}, {0x5, 0x7}, {0x7, 0x3}, {0x8, 0x5}, {0x5, 0x6}, {0xa, 0x1}, {0x81, 0x4}], "d511221ee0b71e1c"}}]}, 0x134}, 0x1, 0x0, 0x0, 0xa51a4ef2580c5b4a}, 0x20001001) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x2, 0x80805, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, 0x0, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r7, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r8}) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e20, 0x3, 'rr\x00', 0x16, 0x2, 0x6f}, 0x2c) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00008c3000/0x2000)=nil, 0x2000}, 0x8}) setsockopt$IP_VS_SO_SET_ADDDEST(r9, 0x0, 0x487, &(0x7f0000000000)={{0xff, @private=0xa010101, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x83, 0x77}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcd, 0x3d71, 0x2}}, 0x44) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, 0x7, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040880) 1.224486698s ago: executing program 8 (id=2851): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r0, 0x1) connect$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x15}, 0xa) (fail_nth: 1) 1.034647388s ago: executing program 8 (id=2852): openat$hwrng(0xffffffffffffff9c, 0x0, 0x200000, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000300)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$sndpcmp(&(0x7f0000000500), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r2, 0xc2604110, &(0x7f0000000000)={0xfffffffc, [[0x7fff, 0x0, 0x0, 0x11, 0x0, 0xfffffffd, 0x0, 0xfffffffc], [0x1, 0x0, 0x0, 0x0, 0x4, 0x5, 0x5000000], [0x0, 0x5, 0x0, 0x0, 0xfffffffe, 0x7, 0x2]], '\x00', [{0x0, 0x3}, {}, {0x4, 0x1}, {0x2, 0x1}, {0x5f08, 0x2006}, {}, {0x6}, {}, {}, {0x4, 0xffff}, {0xfffffffe, 0xfffffffc}, {0x0, 0xfffffffc}], '\x00', 0x0, 0x0, 0x0, 0x2, 0x0, 0x35}) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) memfd_create(&(0x7f0000000180)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\x00\x04\x00\x00\x00\x00\x00\x00nh#\xcf)\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb90a\xa9\xb2\x04\x1d\xa1\xce\x8b\x19\xea\xef\xe3\x00\x00\x00\x00\x00\x00\x00\x00', 0x1) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[], 0xe0}}, 0x810) sched_setaffinity(0x0, 0x8, &(0x7f0000000740)=0x410000002) openat$audio(0xffffffffffffff9c, 0x0, 0x800, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r7 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x0, 0x3c000, @loopback, 0x5}, 0x1c) r8 = dup2(r7, r7) sendmmsg$unix(r8, &(0x7f0000004700)=[{{&(0x7f0000000440)=@abs={0x0, 0x0, 0x4e21}, 0xfffffffffffffd47, 0x0, 0x0, 0x0, 0x0, 0x4008800}}], 0x1, 0x4008890) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r6, &(0x7f0000000340)="41000000010001", 0x7) close(r6) connect$bt_l2cap(r5, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) write(r5, 0x0, 0x0) 987.397457ms ago: executing program 6 (id=2853): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000094037b40fd080200fdca010203010902120001000000000904"], 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x67) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000040)={0x3, &(0x7f0000000080)=[{0x7ff, 0x3, 0x40, 0xa}, {0x1000, 0xb, 0x81, 0x7}, {0x7, 0xa, 0x9, 0x1}]}) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x350, 0xffffffff, 0x0, 0xf8, 0x1b8, 0xffffffff, 0xffffffff, 0x2b8, 0x2b8, 0x2b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0xffffffff, 0x0, 0x2, 0x1, 0xf}}, @common=@unspec=@connmark={{0x30}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@loopback, @private=0xa010102, 0x0, 0x0, 'veth1_to_hsr\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xc0, 0x100, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00'}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x4}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3b0) r2 = creat(&(0x7f00000003c0)='./file0\x00', 0xc4) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000400)=0x3) 967.049986ms ago: executing program 1 (id=2854): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$inet6(r0, &(0x7f0000019680)=[{{&(0x7f0000000100)={0xa, 0x4, 0x0, @loopback={0x0, 0xac141414}}, 0x1c, 0x0}}], 0x1, 0x20004855) 523.041145ms ago: executing program 1 (id=2855): socket$alg(0x26, 0x5, 0x0) (async) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) (async) bind$alg(r0, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x190) syz_emit_ethernet(0x26a, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) (async) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$ptys(0xc, 0x3, 0x0) syz_open_dev$vim2m(0x0, 0x8, 0x2) r2 = socket$igmp(0x2, 0x3, 0x2) r3 = add_key$keyring(&(0x7f00000010c0), &(0x7f0000001100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000000)='big_key\x00', 0x0, 0x0, 0xffffffffffffff2f, r3) (async) r4 = add_key(&(0x7f0000000000)='big_key\x00', 0x0, 0x0, 0xffffffffffffff2f, r3) keyctl$read(0x2, r4, &(0x7f00000000c0)=""/4096, 0x1000) add_key$keyring(&(0x7f0000000040), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, r4) setsockopt$MRT_ADD_MFC(r2, 0x0, 0xcc, &(0x7f0000000080)={@loopback, @multicast1, 0x0, "2634784b05261d387c92012000000000000000800000a67c6bf9002000", 0x0, 0x5, 0x5, 0xf5}, 0x3c) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r5 = dup(0xffffffffffffffff) copy_file_range(r5, &(0x7f0000000100)=0x9, 0xffffffffffffffff, 0x0, 0x8, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x89e2, &(0x7f0000004000)) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) 425.725854ms ago: executing program 8 (id=2856): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x0, 0x2000030a, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, @void, @value}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000dd0000000a"], 0x50) close(0x3) r2 = mq_open(0x0, 0x0, 0xb0, &(0x7f0000000180)={0x80000000, 0x80000040001, 0x6}) r3 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000000)='\x00', 0x1, 0xfffffffffffffffe) r4 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r3, r4, r4}, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={'poly1305-generic\x00'}}) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0b0000c52c00e9ff2ecd080000000000000004442f680200000000000000982647403845f2d582562c425b4f54461c598c0c15d27f060bd396b5e3179401e8108f218ece51ff5608fe9a9ea67f56", @ANYRES8=r3, @ANYRESHEX=r2, @ANYRES8=r4, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000073"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000040), &(0x7f0000000080)=r0}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r5}, 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="7a0a00ff00000000719500"/24], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$inet6(r6, &(0x7f0000019680)=[{{&(0x7f0000000100)={0xa, 0x4, 0x0, @loopback={0x0, 0xac141414}}, 0x1c, 0x0}}], 0x1, 0x20004855) r7 = openat$sw_sync_info(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r7) fsopen(&(0x7f00000002c0)='bpf\x00', 0x1) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f0000000100)={@hyper}) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r8, 0x7af, &(0x7f0000000080)={@my=0x0, 0x1}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0xca800, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r10, 0xae60) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r11, 0x4004ae99, &(0x7f00000001c0)=0x3) ioctl$KVM_CAP_HALT_POLL(r10, 0x4068aea3, &(0x7f0000000480)) ioctl$KVM_SET_LAPIC(r11, 0x4400ae8f, &(0x7f0000000880)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde9809c8814618e976832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34cf2645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6424923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff0000f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada133b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631def9f126c25ba4f37caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d3130180613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd60200c1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) 0s ago: executing program 1 (id=2857): ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000280)=ANY=[@ANYBLOB="01"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000000c0)=ANY=[@ANYBLOB="01"]) (fail_nth: 1) kernel console output (not intermixed with test programs): port 2(bridge_slave_1) entered blocking state [ 767.001063][T14869] bridge0: port 2(bridge_slave_1) entered disabled state [ 767.013647][T14869] bridge_slave_1: entered allmulticast mode [ 767.033611][T14869] bridge_slave_1: entered promiscuous mode [ 768.630894][ T5818] Bluetooth: hci4: command tx timeout [ 768.994545][T14869] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 769.147785][T14869] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 769.258751][T14953] hub 8-0:1.0: USB hub found [ 769.264314][T14953] hub 8-0:1.0: 1 port detected [ 769.714102][T14869] team0: Port device team_slave_0 added [ 769.741560][T14869] team0: Port device team_slave_1 added [ 769.821824][T14957] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 770.872814][T14869] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 770.880032][T14869] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 770.929044][T14869] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 771.339876][T14869] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 771.356366][T14869] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 771.388419][T14869] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 771.549877][T14975] netlink: 'syz.0.2586': attribute type 10 has an invalid length. [ 771.566624][T14976] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2584'. [ 771.615814][T14869] hsr_slave_0: entered promiscuous mode [ 771.676462][T14869] hsr_slave_1: entered promiscuous mode [ 771.730736][T14869] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 771.793907][T14869] Cannot create hsr debugfs directory [ 772.321361][T14971] xt_l2tp: invalid flags combination: 0 [ 773.172216][T14994] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 775.303753][T15009] FAULT_INJECTION: forcing a failure. [ 775.303753][T15009] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 775.316996][T15009] CPU: 0 UID: 0 PID: 15009 Comm: syz.6.2597 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 775.317024][T15009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 775.317035][T15009] Call Trace: [ 775.317042][T15009] [ 775.317049][T15009] dump_stack_lvl+0x16c/0x1f0 [ 775.317083][T15009] should_fail_ex+0x512/0x640 [ 775.317113][T15009] _copy_from_user+0x2e/0xd0 [ 775.317140][T15009] move_addr_to_kernel+0x65/0x170 [ 775.317169][T15009] __sys_connect+0xaf/0x170 [ 775.317186][T15009] ? __pfx___sys_connect+0x10/0x10 [ 775.317219][T15009] ? __pfx_ksys_write+0x10/0x10 [ 775.317252][T15009] __x64_sys_connect+0x72/0xb0 [ 775.317268][T15009] ? lockdep_hardirqs_on+0x7c/0x110 [ 775.317292][T15009] do_syscall_64+0xcd/0x260 [ 775.317320][T15009] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 775.317338][T15009] RIP: 0033:0x7f63d4d8e969 [ 775.317353][T15009] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 775.317370][T15009] RSP: 002b:00007f63d2bb4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 775.317387][T15009] RAX: ffffffffffffffda RBX: 00007f63d4fb6160 RCX: 00007f63d4d8e969 [ 775.317398][T15009] RDX: 000000000000001c RSI: 0000200000000040 RDI: 0000000000000005 [ 775.317410][T15009] RBP: 00007f63d2bb4090 R08: 0000000000000000 R09: 0000000000000000 [ 775.317420][T15009] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 775.317431][T15009] R13: 0000000000000000 R14: 00007f63d4fb6160 R15: 00007ffd335c3948 [ 775.317455][T15009] [ 775.527730][T14869] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 775.537380][T14869] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 775.548353][T14869] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 775.563152][T14869] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 776.782611][T14869] 8021q: adding VLAN 0 to HW filter on device bond0 [ 776.919327][T14869] 8021q: adding VLAN 0 to HW filter on device team0 [ 777.478940][ T6404] bridge0: port 1(bridge_slave_0) entered blocking state [ 777.486261][ T6404] bridge0: port 1(bridge_slave_0) entered forwarding state [ 777.551984][ T6404] bridge0: port 2(bridge_slave_1) entered blocking state [ 777.559220][ T6404] bridge0: port 2(bridge_slave_1) entered forwarding state [ 777.743274][T14869] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 778.005870][T15037] QAT: Stopping all acceleration devices. [ 779.395249][T15040] Cannot find add_set index 1 as target [ 780.373201][T14869] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 780.758358][T14869] veth0_vlan: entered promiscuous mode [ 780.772924][T14869] veth1_vlan: entered promiscuous mode [ 781.011955][T14869] veth0_macvtap: entered promiscuous mode [ 781.177223][T14869] veth1_macvtap: entered promiscuous mode [ 781.230008][T14869] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 781.258413][T14869] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 781.339224][T14869] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 781.359851][T14869] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 781.377270][T14869] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 781.395788][T14869] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 781.483428][ T6897] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 781.495417][ T6897] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 781.529097][ T6897] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 781.541002][ T6897] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 782.228706][ T13] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 782.413735][ T13] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 782.478785][ T13] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 782.570252][ T13] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 782.631127][ T58] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 782.800748][ T58] usb 2-1: Using ep0 maxpacket: 32 [ 782.806379][ T58] usb 2-1: no configurations [ 782.811152][ T58] usb 2-1: can't read configurations, error -22 [ 782.916961][ T13] bridge_slave_1: left allmulticast mode [ 782.922839][ T13] bridge_slave_1: left promiscuous mode [ 782.928512][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 782.937434][ T13] bridge_slave_0: left allmulticast mode [ 782.943435][ T58] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 782.951207][ T13] bridge_slave_0: left promiscuous mode [ 782.956909][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 783.236912][T15086] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 783.310767][ T3161] usb 9-1: new full-speed USB device number 53 using dummy_hcd [ 783.312645][T15085] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 783.571244][ T58] usb 2-1: Using ep0 maxpacket: 32 [ 783.690657][ T58] usb 2-1: no configurations [ 783.695728][ T58] usb 2-1: can't read configurations, error -22 [ 784.029259][ T58] usb usb2-port1: attempt power cycle [ 784.182287][ T3161] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 784.190431][ T3161] usb 9-1: config 0 has no interface number 0 [ 784.211105][ T3161] usb 9-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 784.228968][ T3161] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 784.252919][ T3161] usb 9-1: config 0 descriptor?? [ 784.261452][ T3161] usb 9-1: selecting invalid altsetting 1 [ 784.271217][ T3161] dvb_ttusb_budget: ttusb_init_controller: error [ 784.277637][ T3161] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 784.287128][ T5817] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 784.324371][ T5817] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 784.350294][ T5817] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 784.351212][ T3161] DVB: Unable to find symbol cx22700_attach() [ 784.461948][ T58] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 784.501673][ T5817] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 784.509390][ T5817] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 784.523114][T15082] FAULT_INJECTION: forcing a failure. [ 784.523114][T15082] name failslab, interval 1, probability 0, space 0, times 0 [ 784.541147][ T58] usb 2-1: Using ep0 maxpacket: 32 [ 784.546581][T15082] CPU: 1 UID: 0 PID: 15082 Comm: syz.8.2616 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 784.546606][T15082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 784.546617][T15082] Call Trace: [ 784.546622][T15082] [ 784.546629][T15082] dump_stack_lvl+0x16c/0x1f0 [ 784.546659][T15082] should_fail_ex+0x512/0x640 [ 784.546682][T15082] ? fs_reclaim_acquire+0xae/0x150 [ 784.546703][T15082] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 784.546726][T15082] should_failslab+0xc2/0x120 [ 784.546743][T15082] __kmalloc_noprof+0xd2/0x510 [ 784.546763][T15082] tomoyo_realpath_from_path+0xc2/0x6e0 [ 784.546787][T15082] ? tomoyo_profile+0x47/0x60 [ 784.546804][T15082] tomoyo_path_number_perm+0x245/0x580 [ 784.546822][T15082] ? tomoyo_path_number_perm+0x237/0x580 [ 784.546843][T15082] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 784.546864][T15082] ? find_held_lock+0x2b/0x80 [ 784.546904][T15082] ? find_held_lock+0x2b/0x80 [ 784.546921][T15082] ? hook_file_ioctl_common+0x145/0x410 [ 784.546943][T15082] ? __fget_files+0x20e/0x3c0 [ 784.546961][T15082] security_file_ioctl+0x9b/0x240 [ 784.546985][T15082] __x64_sys_ioctl+0xb7/0x200 [ 784.547007][T15082] do_syscall_64+0xcd/0x260 [ 784.547031][T15082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.547046][T15082] RIP: 0033:0x7fa12498e969 [ 784.547060][T15082] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 784.547075][T15082] RSP: 002b:00007fa1258c4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 784.547090][T15082] RAX: ffffffffffffffda RBX: 00007fa124bb5fa0 RCX: 00007fa12498e969 [ 784.547099][T15082] RDX: 0000200000000a40 RSI: 0000000000000707 RDI: 0000000000000004 [ 784.547108][T15082] RBP: 00007fa1258c4090 R08: 0000000000000000 R09: 0000000000000000 [ 784.547116][T15082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 784.547126][T15082] R13: 0000000000000000 R14: 00007fa124bb5fa0 R15: 00007ffc691143a8 [ 784.547147][T15082] [ 784.547211][T15082] ERROR: Out of memory at tomoyo_realpath_from_path. [ 784.617941][T15099] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 784.630746][ T3161] DVB: Unable to find symbol tda10046_attach() [ 784.724561][T15100] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 784.795685][ T58] usb 2-1: no configurations [ 784.800464][ T58] usb 2-1: can't read configurations, error -22 [ 784.807734][ T3161] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 784.818928][ T3161] usb 9-1: USB disconnect, device number 53 [ 784.924282][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 784.935481][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 784.946240][ T13] bond0 (unregistering): Released all slaves [ 784.951088][ T58] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 784.981415][ T58] usb 2-1: Using ep0 maxpacket: 32 [ 784.987316][ T58] usb 2-1: no configurations [ 784.992092][ T58] usb 2-1: can't read configurations, error -22 [ 784.998747][ T58] usb usb2-port1: unable to enumerate USB device [ 785.181035][T15089] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 785.264681][T15107] FAULT_INJECTION: forcing a failure. [ 785.264681][T15107] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 785.278403][T15107] CPU: 0 UID: 0 PID: 15107 Comm: syz.1.2619 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 785.278430][T15107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 785.278441][T15107] Call Trace: [ 785.278447][T15107] [ 785.278454][T15107] dump_stack_lvl+0x16c/0x1f0 [ 785.278485][T15107] should_fail_ex+0x512/0x640 [ 785.278514][T15107] _copy_from_user+0x2e/0xd0 [ 785.278538][T15107] copy_msghdr_from_user+0x98/0x160 [ 785.278560][T15107] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 785.278590][T15107] ___sys_sendmsg+0xfe/0x1d0 [ 785.278611][T15107] ? __pfx____sys_sendmsg+0x10/0x10 [ 785.278662][T15107] __sys_sendmsg+0x16d/0x220 [ 785.278682][T15107] ? __pfx___sys_sendmsg+0x10/0x10 [ 785.278708][T15107] ? rcu_is_watching+0x12/0xc0 [ 785.278737][T15107] do_syscall_64+0xcd/0x260 [ 785.278766][T15107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.278785][T15107] RIP: 0033:0x7f386518e969 [ 785.278800][T15107] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 785.278815][T15107] RSP: 002b:00007f3866063038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 785.278834][T15107] RAX: ffffffffffffffda RBX: 00007f38653b5fa0 RCX: 00007f386518e969 [ 785.278856][T15107] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 785.278867][T15107] RBP: 00007f3866063090 R08: 0000000000000000 R09: 0000000000000000 [ 785.278877][T15107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 785.278887][T15107] R13: 0000000000000000 R14: 00007f38653b5fa0 R15: 00007fffc12eea78 [ 785.278908][T15107] [ 785.468293][T15092] chnl_net:caif_netlink_parms(): no params data found [ 785.478434][T15089] usb 1-1: Using ep0 maxpacket: 8 [ 785.953963][T15092] bridge0: port 1(bridge_slave_0) entered blocking state [ 785.965177][T15092] bridge0: port 1(bridge_slave_0) entered disabled state [ 785.974894][T15092] bridge_slave_0: entered allmulticast mode [ 785.993356][T15092] bridge_slave_0: entered promiscuous mode [ 786.005500][T15092] bridge0: port 2(bridge_slave_1) entered blocking state [ 786.013561][ T5874] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 786.027854][T15092] bridge0: port 2(bridge_slave_1) entered disabled state [ 786.035338][T15092] bridge_slave_1: entered allmulticast mode [ 786.046890][T15092] bridge_slave_1: entered promiscuous mode [ 786.113023][T15089] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 786.121752][T15089] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 786.137270][T15089] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 786.147140][T15089] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 786.157901][T15089] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 786.158353][T15092] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 786.170938][T15089] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 786.170967][T15089] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 786.211850][ T5874] usb 2-1: config 4 has an invalid interface number: 44 but max is 0 [ 786.224514][ T13] hsr_slave_0: left promiscuous mode [ 786.231665][ T5874] usb 2-1: config 4 has no interface number 0 [ 786.237869][ T13] hsr_slave_1: left promiscuous mode [ 786.237869][ T5874] usb 2-1: config 4 interface 44 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 786.239805][ T5874] usb 2-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 786.244179][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 786.253808][ T5874] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.267091][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 786.280330][ T5874] usb 2-1: Product: syz [ 786.289626][ T5874] usb 2-1: Manufacturer: syz [ 786.290734][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 786.295634][ T30] audit: type=1400 audit(1747953700.751:2854): avc: denied { accept } for pid=15118 comm="syz.8.2623" path="socket:[60060]" dev="sockfs" ino=60060 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 786.307293][ T5874] usb 2-1: SerialNumber: syz [ 786.327123][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 786.359231][ T13] veth1_macvtap: left promiscuous mode [ 786.365176][ T13] veth0_macvtap: left promiscuous mode [ 786.370955][ T13] veth1_vlan: left promiscuous mode [ 786.378136][ T13] veth0_vlan: left promiscuous mode [ 786.383595][T15089] usb 1-1: GET_CAPABILITIES returned 0 [ 786.389738][T15089] usbtmc 1-1:16.0: can't read capabilities [ 786.412990][T15089] usb 1-1: USB disconnect, device number 30 [ 786.554363][ T5818] Bluetooth: hci4: command tx timeout [ 786.791762][ T5874] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 786.839753][ T5874] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 786.859178][ T5874] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 786.866535][ T5874] usb 2-1: media controller created [ 786.875274][ T5874] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 786.927687][ T5874] DVB: Unable to find symbol dib7000p_attach() [ 786.935551][ T5874] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 787.029840][ T5874] rc_core: IR keymap rc-dib0700-rc5 not found [ 787.042642][ T5874] Registered IR keymap rc-empty [ 787.062652][ T5874] dvb-usb: could not initialize remote control. [ 787.069140][ T5874] dvb-usb: Gigabyte U7000 successfully initialized and connected. [ 787.115732][ T5874] dib0700: There's no endpoint for remote controller [ 787.151687][ T13] team0 (unregistering): Port device team_slave_1 removed [ 787.209553][ T13] team0 (unregistering): Port device team_slave_0 removed [ 787.360181][ T5914] usb 2-1: USB disconnect, device number 69 [ 787.441659][ T5914] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected. [ 787.547186][T15130] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 787.558738][T15130] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 788.302127][T15092] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 788.401702][T15133] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 788.413565][T15133] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 788.417370][T15092] team0: Port device team_slave_0 added [ 788.441828][T15092] team0: Port device team_slave_1 added [ 788.584206][T15092] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 788.608213][T15092] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 788.652036][ T5818] Bluetooth: hci4: command tx timeout [ 788.730811][T15092] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 788.743725][T15139] IPv6: NLM_F_CREATE should be specified when creating new route [ 788.784032][T15092] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 788.917968][T15092] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 789.184459][T15092] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 789.281599][T15144] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 789.566037][T15092] hsr_slave_0: entered promiscuous mode [ 789.573920][T15092] hsr_slave_1: entered promiscuous mode [ 789.585361][T15092] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 789.599690][T15092] Cannot create hsr debugfs directory [ 789.885602][T15149] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 790.199183][T15148] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 790.581589][T15153] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 790.710484][T15158] netlink: 'syz.6.2632': attribute type 10 has an invalid length. [ 790.720801][ T5818] Bluetooth: hci4: command tx timeout [ 790.735786][ T5874] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 790.736980][T15158] 8021q: adding VLAN 0 to HW filter on device team0 [ 790.760009][T15158] bond0: (slave team0): Enslaving as an active interface with an up link [ 790.900279][T15092] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 790.918092][T15092] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 790.937429][T15092] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 790.957214][T15092] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 791.087123][T15092] 8021q: adding VLAN 0 to HW filter on device bond0 [ 791.141968][T15092] 8021q: adding VLAN 0 to HW filter on device team0 [ 791.160696][ T6404] bridge0: port 1(bridge_slave_0) entered blocking state [ 791.167891][ T6404] bridge0: port 1(bridge_slave_0) entered forwarding state [ 791.196755][ T6404] bridge0: port 2(bridge_slave_1) entered blocking state [ 791.203967][ T6404] bridge0: port 2(bridge_slave_1) entered forwarding state [ 791.510790][ T5874] usb 2-1: Using ep0 maxpacket: 8 [ 791.744066][T15175] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 791.978276][T15177] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 791.993586][T15177] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 792.096521][ T5874] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 792.109961][ T5874] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 792.121572][ T5874] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 792.138235][ T5874] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 792.152878][ T5874] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 792.166931][ T5874] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 792.182330][ T5874] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 792.196336][T15092] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 792.204861][ T5874] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 792.218101][ T5874] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 792.229916][ T5874] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 792.247432][ T5874] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 792.268518][ T5874] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 792.295541][ T5874] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 792.433386][T15185] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 792.797590][ T5818] Bluetooth: hci4: command tx timeout [ 793.145667][ T5874] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 793.157196][ T5874] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 793.227761][T15193] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 793.242858][T15193] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 793.710742][ T5874] usb 2-1: string descriptor 0 read error: -71 [ 793.717252][ T5874] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 793.726966][ T5874] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 793.741897][ T5874] usb 2-1: can't set config #168, error -71 [ 793.831327][ T5874] usb 2-1: USB disconnect, device number 70 [ 793.844219][T15204] FAULT_INJECTION: forcing a failure. [ 793.844219][T15204] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 793.878275][T15204] CPU: 1 UID: 0 PID: 15204 Comm: syz.6.2643 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 793.878303][T15204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 793.878314][T15204] Call Trace: [ 793.878320][T15204] [ 793.878327][T15204] dump_stack_lvl+0x16c/0x1f0 [ 793.878357][T15204] should_fail_ex+0x512/0x640 [ 793.878383][T15204] _copy_from_user+0x2e/0xd0 [ 793.878409][T15204] move_addr_to_kernel+0x65/0x170 [ 793.878437][T15204] __sys_sendto+0x1be/0x510 [ 793.878454][T15204] ? __pfx___sys_sendto+0x10/0x10 [ 793.878492][T15204] ? ksys_write+0x1b9/0x240 [ 793.878519][T15204] ? __pfx_ksys_write+0x10/0x10 [ 793.878541][T15204] ? rcu_is_watching+0x12/0xc0 [ 793.878565][T15204] __x64_sys_sendto+0xe0/0x1c0 [ 793.878580][T15204] ? do_syscall_64+0x91/0x260 [ 793.878603][T15204] ? lockdep_hardirqs_on+0x7c/0x110 [ 793.878625][T15204] do_syscall_64+0xcd/0x260 [ 793.878650][T15204] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.878668][T15204] RIP: 0033:0x7f63d4d8e969 [ 793.878683][T15204] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 793.878700][T15204] RSP: 002b:00007f63d2bf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 793.878718][T15204] RAX: ffffffffffffffda RBX: 00007f63d4fb5fa0 RCX: 00007f63d4d8e969 [ 793.878730][T15204] RDX: 0000000000000010 RSI: 0000200000000080 RDI: 0000000000000003 [ 793.878741][T15204] RBP: 00007f63d2bf6090 R08: 00002000000000c0 R09: 0000000000000014 [ 793.878752][T15204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 793.878762][T15204] R13: 0000000000000000 R14: 00007f63d4fb5fa0 R15: 00007ffd335c3948 [ 793.878785][T15204] [ 794.789862][T15092] veth0_vlan: entered promiscuous mode [ 794.806412][T15092] veth1_vlan: entered promiscuous mode [ 794.846795][T15092] veth0_macvtap: entered promiscuous mode [ 794.860245][T15092] veth1_macvtap: entered promiscuous mode [ 794.891874][T15092] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 794.976681][T15092] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 794.987271][T15092] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.246963][T15092] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.256004][T15092] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.264930][T15092] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.722637][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 796.748104][ T6404] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 796.750203][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 796.756437][ T5914] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 796.776687][ T6404] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 796.882168][ T30] audit: type=1400 audit(1747953711.331:2855): avc: denied { read } for pid=15228 comm="syz.0.2651" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 796.957994][ T5914] usb 7-1: Using ep0 maxpacket: 8 [ 796.987688][ T5914] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 797.017382][T15229] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2651'. [ 797.026436][ T5914] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 797.026486][ T5914] usb 7-1: New USB device found, idVendor=046a, idProduct=0027, bcdDevice= 0.00 [ 797.026508][ T5914] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 797.029079][ T5914] usb 7-1: config 0 descriptor?? [ 797.239207][ T36] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 797.534254][T15225] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2650'. [ 797.586884][ T36] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 797.614293][ T5914] usbhid 7-1:0.0: can't add hid device: -71 [ 797.620357][ T5914] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 797.631463][ T5914] usb 7-1: USB disconnect, device number 18 [ 797.671806][ T36] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 797.741359][ T36] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 797.977443][ T36] bridge_slave_1: left allmulticast mode [ 797.983233][ T36] bridge_slave_1: left promiscuous mode [ 797.988996][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 797.997926][ T36] bridge_slave_0: left allmulticast mode [ 798.003915][ T36] bridge_slave_0: left promiscuous mode [ 798.009558][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 798.255780][T15241] /dev/nullb0: Can't open blockdev [ 798.489356][T15244] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 798.500666][T15244] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 798.983121][T15241] netlink: 'syz.0.2652': attribute type 4 has an invalid length. [ 798.994685][T15241] netlink: 17 bytes leftover after parsing attributes in process `syz.0.2652'. [ 799.064176][T15245] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 799.591913][ T5817] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 799.628464][ T5817] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 799.642317][ T5817] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 799.674112][ T5817] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 799.689011][ T5817] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 799.769536][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 799.785350][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 799.795801][ T36] bond0 (unregistering): Released all slaves [ 800.308248][ T30] audit: type=1400 audit(1747953714.761:2856): avc: denied { ioctl } for pid=15268 comm="syz.1.2660" path="socket:[61636]" dev="sockfs" ino=61636 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 800.375197][T15255] chnl_net:caif_netlink_parms(): no params data found [ 800.495725][ T36] hsr_slave_0: left promiscuous mode [ 800.502208][ T36] hsr_slave_1: left promiscuous mode [ 800.508206][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 800.516116][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 800.525053][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 800.533487][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 800.555736][ T36] veth1_macvtap: left promiscuous mode [ 800.561408][ T36] veth0_macvtap: left promiscuous mode [ 800.567093][ T36] veth1_vlan: left promiscuous mode [ 800.572525][ T36] veth0_vlan: left promiscuous mode [ 800.602672][ T5874] usb 9-1: new high-speed USB device number 54 using dummy_hcd [ 801.192948][ T5874] usb 9-1: Using ep0 maxpacket: 32 [ 801.206617][ T5874] usb 9-1: config 0 has an invalid interface number: 184 but max is 0 [ 801.258451][ T5874] usb 9-1: config 0 has no interface number 0 [ 801.278729][ T5874] usb 9-1: config 0 interface 184 has no altsetting 0 [ 801.340921][T15291] fuse: Unknown parameter 'C(rootmode' [ 801.367034][ T5874] usb 9-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 801.378499][ T5874] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 801.398977][ T5874] usb 9-1: Product: syz [ 801.403935][ T5874] usb 9-1: Manufacturer: syz [ 801.420457][ T5874] usb 9-1: SerialNumber: syz [ 801.611746][T15296] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 801.654462][ T5874] usb 9-1: config 0 descriptor?? [ 801.688641][ T5874] smsc75xx v1.0.0 [ 801.750678][ T5818] Bluetooth: hci4: command tx timeout [ 803.265411][T15306] FAULT_INJECTION: forcing a failure. [ 803.265411][T15306] name failslab, interval 1, probability 0, space 0, times 0 [ 803.280083][T15306] CPU: 1 UID: 0 PID: 15306 Comm: syz.1.2668 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 803.280115][T15306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 803.280126][T15306] Call Trace: [ 803.280132][T15306] [ 803.280140][T15306] dump_stack_lvl+0x16c/0x1f0 [ 803.280171][T15306] should_fail_ex+0x512/0x640 [ 803.280194][T15306] ? __kvmalloc_node_noprof+0x122/0x600 [ 803.280223][T15306] should_failslab+0xc2/0x120 [ 803.280241][T15306] __kvmalloc_node_noprof+0x135/0x600 [ 803.280265][T15306] ? seq_read_iter+0x826/0x12c0 [ 803.280290][T15306] ? seq_read_iter+0x826/0x12c0 [ 803.280309][T15306] seq_read_iter+0x826/0x12c0 [ 803.280341][T15306] proc_reg_read_iter+0x220/0x310 [ 803.280362][T15306] vfs_read+0x8cb/0xc70 [ 803.280390][T15306] ? __pfx___mutex_lock+0x10/0x10 [ 803.280415][T15306] ? __pfx_vfs_read+0x10/0x10 [ 803.280461][T15306] ksys_read+0x12a/0x240 [ 803.280482][T15306] ? __pfx_ksys_read+0x10/0x10 [ 803.280501][T15306] ? rcu_is_watching+0x12/0xc0 [ 803.280528][T15306] do_syscall_64+0xcd/0x260 [ 803.280551][T15306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 803.280567][T15306] RIP: 0033:0x7f386518e969 [ 803.280579][T15306] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 803.280596][T15306] RSP: 002b:00007f3866021038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 803.280613][T15306] RAX: ffffffffffffffda RBX: 00007f38653b6160 RCX: 00007f386518e969 [ 803.280624][T15306] RDX: 0000000000002024 RSI: 0000200000000180 RDI: 0000000000000003 [ 803.280634][T15306] RBP: 00007f3866021090 R08: 0000000000000000 R09: 0000000000000000 [ 803.280644][T15306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 803.280654][T15306] R13: 0000000000000000 R14: 00007f38653b6160 R15: 00007fffc12eea78 [ 803.280680][T15306] [ 803.465983][ C1] vkms_vblank_simulate: vblank timer overrun [ 803.945283][ T5818] Bluetooth: hci4: command tx timeout [ 804.255780][ T5874] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 804.307342][ T5874] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 804.345153][ T5874] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 804.426016][ T5874] smsc75xx 9-1:0.184: probe with driver smsc75xx failed with error -71 [ 804.462108][ T5874] usb 9-1: USB disconnect, device number 54 [ 804.970389][T15325] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 804.981507][T15325] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 805.357444][ T36] team0 (unregistering): Port device team_slave_1 removed [ 805.405723][ T36] team0 (unregistering): Port device team_slave_0 removed [ 805.540880][ T5874] usb 9-1: new high-speed USB device number 55 using dummy_hcd [ 805.731010][ T5874] usb 9-1: Using ep0 maxpacket: 8 [ 805.742614][ T5874] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 805.755842][ T5874] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 805.767341][ T5874] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 805.781671][ T5874] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 805.793604][ T5874] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 805.808545][ T5874] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 805.817657][ T5874] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 805.829819][ T5874] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 805.842048][ T5874] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 805.856871][ T5874] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 805.869882][ T5874] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 805.878246][ T5874] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 805.889914][ T5874] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 805.902419][ T5874] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 805.915050][ T5874] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 805.929878][ T5874] usb 9-1: string descriptor 0 read error: -22 [ 805.936348][ T5874] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 805.945507][ T5874] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 805.967211][ T5874] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 805.996031][ T5818] Bluetooth: hci4: command tx timeout [ 806.029143][T15255] bridge0: port 1(bridge_slave_0) entered blocking state [ 806.039877][T15255] bridge0: port 1(bridge_slave_0) entered disabled state [ 806.051905][T15255] bridge_slave_0: entered allmulticast mode [ 806.071599][T15255] bridge_slave_0: entered promiscuous mode [ 806.096218][T15255] bridge0: port 2(bridge_slave_1) entered blocking state [ 806.104954][T15255] bridge0: port 2(bridge_slave_1) entered disabled state [ 806.112505][T15331] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2674'. [ 806.115775][T15255] bridge_slave_1: entered allmulticast mode [ 806.130111][T15255] bridge_slave_1: entered promiscuous mode [ 806.650798][T15340] FAULT_INJECTION: forcing a failure. [ 806.650798][T15340] name failslab, interval 1, probability 0, space 0, times 0 [ 806.667540][T15340] CPU: 1 UID: 0 PID: 15340 Comm: syz.0.2677 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 806.667569][T15340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 806.667581][T15340] Call Trace: [ 806.667588][T15340] [ 806.667595][T15340] dump_stack_lvl+0x16c/0x1f0 [ 806.667627][T15340] should_fail_ex+0x512/0x640 [ 806.667652][T15340] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 806.667674][T15340] should_failslab+0xc2/0x120 [ 806.667695][T15340] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 806.667714][T15340] ? getname_flags.part.0+0x4c/0x550 [ 806.667741][T15340] getname_flags.part.0+0x4c/0x550 [ 806.667763][T15340] ? rcu_is_watching+0x12/0xc0 [ 806.667788][T15340] getname_flags+0x93/0xf0 [ 806.667820][T15340] __x64_sys_mknod+0x74/0xb0 [ 806.667839][T15340] do_syscall_64+0xcd/0x260 [ 806.667867][T15340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.667885][T15340] RIP: 0033:0x7f483fb8e969 [ 806.667901][T15340] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 806.667919][T15340] RSP: 002b:00007f4840ade038 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 806.667940][T15340] RAX: ffffffffffffffda RBX: 00007f483fdb5fa0 RCX: 00007f483fb8e969 [ 806.667952][T15340] RDX: 0000000000000700 RSI: 00000000ffffc000 RDI: 00002000000002c0 [ 806.667963][T15340] RBP: 00007f4840ade090 R08: 0000000000000000 R09: 0000000000000000 [ 806.667974][T15340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 806.667985][T15340] R13: 0000000000000000 R14: 00007f483fdb5fa0 R15: 00007fff32663ee8 [ 806.668010][T15340] [ 806.717776][T15255] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 806.720347][ C1] vkms_vblank_simulate: vblank timer overrun [ 806.727538][T15255] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 806.941065][T15255] team0: Port device team_slave_0 added [ 806.949165][T15255] team0: Port device team_slave_1 added [ 807.075334][ T5874] usb 9-1: USB disconnect, device number 55 [ 807.377438][ T30] audit: type=1400 audit(1747953721.751:2857): avc: denied { create } for pid=15313 comm="syz.8.2670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 807.425543][T15343] team0: Mode changed to "roundrobin" [ 807.494223][T15346] FAULT_INJECTION: forcing a failure. [ 807.494223][T15346] name failslab, interval 1, probability 0, space 0, times 0 [ 807.540726][T15346] CPU: 0 UID: 0 PID: 15346 Comm: syz.6.2678 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 807.540754][T15346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 807.540772][T15346] Call Trace: [ 807.540779][T15346] [ 807.540786][T15346] dump_stack_lvl+0x16c/0x1f0 [ 807.540818][T15346] should_fail_ex+0x512/0x640 [ 807.540842][T15346] ? fs_reclaim_acquire+0xae/0x150 [ 807.540869][T15346] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 807.540896][T15346] should_failslab+0xc2/0x120 [ 807.540916][T15346] __kmalloc_noprof+0xd2/0x510 [ 807.540940][T15346] tomoyo_realpath_from_path+0xc2/0x6e0 [ 807.540969][T15346] ? tomoyo_profile+0x47/0x60 [ 807.540990][T15346] tomoyo_path_number_perm+0x245/0x580 [ 807.541013][T15346] ? tomoyo_path_number_perm+0x237/0x580 [ 807.541037][T15346] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 807.541062][T15346] ? find_held_lock+0x2b/0x80 [ 807.541108][T15346] ? find_held_lock+0x2b/0x80 [ 807.541129][T15346] ? hook_file_ioctl_common+0x145/0x410 [ 807.541154][T15346] ? __fget_files+0x20e/0x3c0 [ 807.541175][T15346] security_file_ioctl+0x9b/0x240 [ 807.541203][T15346] __x64_sys_ioctl+0xb7/0x200 [ 807.541229][T15346] do_syscall_64+0xcd/0x260 [ 807.541257][T15346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.541276][T15346] RIP: 0033:0x7f63d4d8e969 [ 807.541292][T15346] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 807.541309][T15346] RSP: 002b:00007f63d2bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 807.541327][T15346] RAX: ffffffffffffffda RBX: 00007f63d4fb5fa0 RCX: 00007f63d4d8e969 [ 807.541338][T15346] RDX: 0000000000000000 RSI: 0000000000005523 RDI: 0000000000000003 [ 807.541349][T15346] RBP: 00007f63d2bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 807.541360][T15346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 807.541370][T15346] R13: 0000000000000000 R14: 00007f63d4fb5fa0 R15: 00007ffd335c3948 [ 807.541395][T15346] [ 807.541403][T15346] ERROR: Out of memory at tomoyo_realpath_from_path. [ 808.126014][T15255] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 808.140879][ T5818] Bluetooth: hci4: command tx timeout [ 808.156832][T15255] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 808.500737][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.580005][T15361] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 808.969486][T15255] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 809.000563][T15255] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 809.019869][T15255] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 809.076642][T15255] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 809.244032][T15255] hsr_slave_0: entered promiscuous mode [ 809.252004][T15255] hsr_slave_1: entered promiscuous mode [ 809.258911][T15255] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 809.268686][T15255] Cannot create hsr debugfs directory [ 809.282981][T15370] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2683'. [ 809.316522][T15369] FAULT_INJECTION: forcing a failure. [ 809.316522][T15369] name failslab, interval 1, probability 0, space 0, times 0 [ 809.345533][T15369] CPU: 0 UID: 0 PID: 15369 Comm: syz.1.2683 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 809.345560][T15369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 809.345567][T15369] Call Trace: [ 809.345571][T15369] [ 809.345576][T15369] dump_stack_lvl+0x16c/0x1f0 [ 809.345599][T15369] should_fail_ex+0x512/0x640 [ 809.345616][T15369] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 809.345629][T15369] should_failslab+0xc2/0x120 [ 809.345642][T15369] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 809.345653][T15369] ? __alloc_skb+0x2b2/0x380 [ 809.345668][T15369] __alloc_skb+0x2b2/0x380 [ 809.345679][T15369] ? __pfx___alloc_skb+0x10/0x10 [ 809.345690][T15369] ? find_held_lock+0x2b/0x80 [ 809.345706][T15369] ? mark_held_locks+0x49/0x80 [ 809.345725][T15369] alloc_skb_with_frags+0xe0/0x860 [ 809.345740][T15369] ? rcu_is_watching+0x12/0xc0 [ 809.345754][T15369] ? trace_sched_exit_tp+0xde/0x130 [ 809.345775][T15369] sock_alloc_send_pskb+0x7fb/0x990 [ 809.345792][T15369] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 809.345804][T15369] ? __pfx___schedule+0x10/0x10 [ 809.345819][T15369] ? irqentry_exit+0x3b/0x90 [ 809.345834][T15369] ? lockdep_hardirqs_on+0x7c/0x110 [ 809.345854][T15369] l2cap_sock_alloc_skb_cb+0xc5/0x510 [ 809.345869][T15369] ? __pfx_l2cap_sock_alloc_skb_cb+0x10/0x10 [ 809.345882][T15369] ? preempt_schedule_common+0x44/0xc0 [ 809.345898][T15369] ? __pfx_l2cap_sock_alloc_skb_cb+0x10/0x10 [ 809.345912][T15369] l2cap_chan_send+0xa42/0x2c50 [ 809.345929][T15369] ? __mutex_lock+0x33e/0xb90 [ 809.345955][T15369] ? l2cap_sock_sendmsg+0x3aa/0x480 [ 809.345981][T15369] ? __pfx_l2cap_chan_send+0x10/0x10 [ 809.346001][T15369] ? preempt_schedule_thunk+0x16/0x30 [ 809.346021][T15369] l2cap_sock_sendmsg+0x3bd/0x480 [ 809.346034][T15369] ? __pfx_l2cap_sock_sendmsg+0x10/0x10 [ 809.346046][T15369] ? mark_held_locks+0x49/0x80 [ 809.346062][T15369] ? lockdep_hardirqs_on+0x7c/0x110 [ 809.346081][T15369] sock_sendmsg+0x3cc/0x470 [ 809.346099][T15369] ? __pfx_sock_sendmsg+0x10/0x10 [ 809.346127][T15369] splice_to_socket+0xaf6/0x1110 [ 809.346153][T15369] ? __pfx_splice_to_socket+0x10/0x10 [ 809.346176][T15369] ? inode_has_perm+0x16f/0x1d0 [ 809.346203][T15369] ? bpf_lsm_file_permission+0x9/0x10 [ 809.346226][T15369] ? security_file_permission+0x71/0x210 [ 809.346245][T15369] ? rw_verify_area+0xcf/0x680 [ 809.346260][T15369] ? __pfx_splice_to_socket+0x10/0x10 [ 809.346278][T15369] do_splice+0x1475/0x1fc0 [ 809.346295][T15369] ? __lock_acquire+0x5ca/0x1ba0 [ 809.346317][T15369] ? __pfx_do_splice+0x10/0x10 [ 809.346337][T15369] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 809.346354][T15369] ? find_held_lock+0x2b/0x80 [ 809.346368][T15369] __do_splice+0x32a/0x360 [ 809.346394][T15369] ? __pfx___do_splice+0x10/0x10 [ 809.346418][T15369] ? fput+0x10/0xf0 [ 809.346438][T15369] __x64_sys_splice+0x187/0x250 [ 809.346450][T15369] do_syscall_64+0xcd/0x260 [ 809.346468][T15369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 809.346480][T15369] RIP: 0033:0x7f386518e969 [ 809.346490][T15369] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 809.346501][T15369] RSP: 002b:00007f3866042038 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 809.346513][T15369] RAX: ffffffffffffffda RBX: 00007f38653b6080 RCX: 00007f386518e969 [ 809.346521][T15369] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000004 [ 809.346527][T15369] RBP: 00007f3866042090 R08: 0000000000000080 R09: 000000000000000a [ 809.346533][T15369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 809.346540][T15369] R13: 0000000000000000 R14: 00007f38653b6080 R15: 00007fffc12eea78 [ 809.346554][T15369] [ 810.915907][T15379] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 810.925466][T15379] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 811.356385][T15391] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 811.367691][T15391] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 811.584988][ T5950] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 811.769115][ T5950] usb 7-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 811.970432][ T5950] usb 7-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 811.993912][ T5950] usb 7-1: config 0 interface 0 has no altsetting 0 [ 812.024753][ T5950] usb 7-1: New USB device found, idVendor=045e, idProduct=00f9, bcdDevice= 0.00 [ 812.034439][ T5950] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 812.059959][ T5950] usb 7-1: config 0 descriptor?? [ 812.430910][T15402] overlayfs: workdir and upperdir must reside under the same mount [ 812.458583][T15387] SELinux: failed to load policy [ 812.564898][T15403] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2693'. [ 813.113586][ T5950] microsoft 0003:045E:00F9.0024: item fetching failed at offset 1/3 [ 813.122683][ T5950] microsoft 0003:045E:00F9.0024: parse failed [ 813.128864][ T5950] microsoft 0003:045E:00F9.0024: probe with driver microsoft failed with error -22 [ 813.165157][ T5950] usb 7-1: USB disconnect, device number 19 [ 813.197440][T15255] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 813.216916][T15407] FAULT_INJECTION: forcing a failure. [ 813.216916][T15407] name failslab, interval 1, probability 0, space 0, times 0 [ 813.233264][T15407] CPU: 1 UID: 0 PID: 15407 Comm: syz.0.2694 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 813.233292][T15407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 813.233303][T15407] Call Trace: [ 813.233309][T15407] [ 813.233316][T15407] dump_stack_lvl+0x16c/0x1f0 [ 813.233348][T15407] should_fail_ex+0x512/0x640 [ 813.233372][T15407] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 813.233394][T15407] should_failslab+0xc2/0x120 [ 813.233414][T15407] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 813.233432][T15407] ? getname_flags.part.0+0x4c/0x550 [ 813.233459][T15407] getname_flags.part.0+0x4c/0x550 [ 813.233480][T15407] ? rcu_is_watching+0x12/0xc0 [ 813.233505][T15407] getname_flags+0x93/0xf0 [ 813.233531][T15407] __x64_sys_mknod+0x74/0xb0 [ 813.233548][T15407] do_syscall_64+0xcd/0x260 [ 813.233576][T15407] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 813.233594][T15407] RIP: 0033:0x7f483fb8e969 [ 813.233609][T15407] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 813.233627][T15407] RSP: 002b:00007f4840ade038 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 813.233645][T15407] RAX: ffffffffffffffda RBX: 00007f483fdb5fa0 RCX: 00007f483fb8e969 [ 813.233657][T15407] RDX: 0000000000000700 RSI: 0000000000006020 RDI: 0000200000000200 [ 813.233668][T15407] RBP: 00007f4840ade090 R08: 0000000000000000 R09: 0000000000000000 [ 813.233679][T15407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 813.233689][T15407] R13: 0000000000000000 R14: 00007f483fdb5fa0 R15: 00007fff32663ee8 [ 813.233719][T15407] [ 813.414473][T15255] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 813.472793][T15411] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 813.486629][T15255] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 813.497241][T15255] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 813.573713][T15255] 8021q: adding VLAN 0 to HW filter on device bond0 [ 813.712385][T15255] 8021q: adding VLAN 0 to HW filter on device team0 [ 813.737161][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 813.740764][ T5874] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 813.744371][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 813.819446][T15418] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 813.839996][T15418] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 814.222960][ T6897] bridge0: port 2(bridge_slave_1) entered blocking state [ 814.230194][ T6897] bridge0: port 2(bridge_slave_1) entered forwarding state [ 814.240918][ T5874] usb 2-1: device descriptor read/64, error -71 [ 814.459314][T15421] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 814.473809][ T5950] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 814.531007][ T5874] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 814.782695][ T5950] usb 1-1: Using ep0 maxpacket: 32 [ 814.855563][ T5950] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=67.fe [ 814.875257][ T5950] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 814.888707][ T5950] usb 1-1: Product: syz [ 814.895040][ T5874] usb 2-1: device descriptor read/64, error -71 [ 814.906809][ T5950] usb 1-1: Manufacturer: syz [ 814.916809][ T5950] usb 1-1: SerialNumber: syz [ 815.036763][ T5874] usb usb2-port1: attempt power cycle [ 815.048928][ T5950] usb 1-1: config 0 descriptor?? [ 815.670179][ T5950] snd-usb-6fire 1-1:0.0: unknown device firmware state received from device: [ 815.695883][ T5950] eb 9a 47 80 9b f8 7a f0 [ 815.702347][ T5950] snd-usb-6fire 1-1:0.0: probe with driver snd-usb-6fire failed with error -5 [ 815.738256][T15255] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 815.880795][ T5874] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 815.924890][ T5874] usb 2-1: device descriptor read/8, error -71 [ 816.300542][T15445] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 816.515419][ T5874] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 817.035524][ T5874] usb 2-1: device descriptor read/8, error -71 [ 817.131160][T15255] veth0_vlan: entered promiscuous mode [ 817.145560][ T5864] usb 1-1: USB disconnect, device number 31 [ 817.147784][T15255] veth1_vlan: entered promiscuous mode [ 817.241758][T15455] netlink: 52 bytes leftover after parsing attributes in process `syz.8.2704'. [ 817.782464][ T5874] usb usb2-port1: unable to enumerate USB device [ 817.836140][T15255] veth0_macvtap: entered promiscuous mode [ 817.877166][T15255] veth1_macvtap: entered promiscuous mode [ 817.906649][T15255] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 818.030174][T15255] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 818.041173][T15255] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.050027][T15255] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.058944][T15255] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.067997][T15255] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.426280][T15461] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 818.441823][T15461] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 818.559934][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 818.612074][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 818.719473][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 819.351706][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 819.538501][T15478] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 820.430668][ T30] audit: type=1400 audit(1747953734.811:2858): avc: denied { accept } for pid=15466 comm="syz.6.2708" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 820.527818][T15480] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 820.882985][ T30] audit: type=1400 audit(1747953735.341:2859): avc: denied { bind } for pid=15482 comm="syz.0.2713" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 821.198110][T15492] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 821.213051][T15492] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 821.624915][T15494] FAULT_INJECTION: forcing a failure. [ 821.624915][T15494] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 821.639319][T15494] CPU: 1 UID: 0 PID: 15494 Comm: syz.1.2717 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 821.639347][T15494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 821.639358][T15494] Call Trace: [ 821.639364][T15494] [ 821.639372][T15494] dump_stack_lvl+0x16c/0x1f0 [ 821.639404][T15494] should_fail_ex+0x512/0x640 [ 821.639433][T15494] _copy_from_user+0x2e/0xd0 [ 821.639460][T15494] ucma_write+0x128/0x330 [ 821.639484][T15494] ? __pfx_ucma_write+0x10/0x10 [ 821.639505][T15494] ? bpf_lsm_file_permission+0x9/0x10 [ 821.639531][T15494] ? security_file_permission+0x71/0x210 [ 821.639559][T15494] ? rw_verify_area+0xcf/0x680 [ 821.639586][T15494] vfs_write+0x25f/0x1180 [ 821.639611][T15494] ? __pfx_ucma_write+0x10/0x10 [ 821.639637][T15494] ? __pfx_vfs_write+0x10/0x10 [ 821.639660][T15494] ? find_held_lock+0x2b/0x80 [ 821.639682][T15494] ? __fget_files+0x204/0x3c0 [ 821.639704][T15494] ? __fget_files+0x20e/0x3c0 [ 821.639728][T15494] ksys_write+0x205/0x240 [ 821.639753][T15494] ? __pfx_ksys_write+0x10/0x10 [ 821.639777][T15494] ? rcu_is_watching+0x12/0xc0 [ 821.639807][T15494] do_syscall_64+0xcd/0x260 [ 821.639836][T15494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 821.639855][T15494] RIP: 0033:0x7f386518e969 [ 821.639871][T15494] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 821.639888][T15494] RSP: 002b:00007f3866063038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 821.639911][T15494] RAX: ffffffffffffffda RBX: 00007f38653b5fa0 RCX: 00007f386518e969 [ 821.639924][T15494] RDX: 0000000000000090 RSI: 00002000000001c0 RDI: 0000000000000003 [ 821.639935][T15494] RBP: 00007f3866063090 R08: 0000000000000000 R09: 0000000000000000 [ 821.639947][T15494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 821.639958][T15494] R13: 0000000000000000 R14: 00007f38653b5fa0 R15: 00007fffc12eea78 [ 821.639983][T15494] [ 821.834969][ C1] vkms_vblank_simulate: vblank timer overrun [ 822.190864][T15089] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 822.381751][T15507] netlink: 'syz.8.2722': attribute type 4 has an invalid length. [ 822.389527][T15507] netlink: 17 bytes leftover after parsing attributes in process `syz.8.2722'. [ 822.499762][T15089] usb 1-1: Using ep0 maxpacket: 32 [ 822.604797][T15513] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 822.620203][T15513] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 822.988537][T15089] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 823.009846][T15089] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 823.028480][T15089] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 823.046627][T15089] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 823.068389][T15517] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2724'. [ 823.070011][T15089] usb 1-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 823.087346][T15089] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 823.096271][T15089] usb 1-1: Product: syz [ 823.100513][T15089] usb 1-1: Manufacturer: syz [ 823.105268][T15089] usb 1-1: SerialNumber: syz [ 823.112017][T15089] usb 1-1: config 0 descriptor?? [ 823.804083][ T5914] usb 1-1: USB disconnect, device number 32 [ 823.818108][ T5864] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 823.980720][ T5864] usb 7-1: Using ep0 maxpacket: 16 [ 824.012336][ T5864] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 824.023568][ T5864] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 824.043177][ T5864] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 824.058189][ T5864] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 824.067561][ T5864] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 824.075992][ T5864] usb 7-1: Product: syz [ 824.080977][ T5864] usb 7-1: Manufacturer: syz [ 824.085657][ T5864] usb 7-1: SerialNumber: syz [ 824.139367][ T30] audit: type=1400 audit(1747953738.591:2860): avc: denied { getopt } for pid=15524 comm="syz.8.2726" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 824.299725][ T5864] usb 7-1: 2:1 : format type 0 is detected, processed as PCM [ 824.325690][ T13] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 824.341707][ T5864] usb 7-1: 2:1: cannot set freq 9338507 to ep 0x82 [ 824.411267][ T5874] usb 9-1: new high-speed USB device number 56 using dummy_hcd [ 824.422806][ T5864] usb 7-1: USB disconnect, device number 20 [ 824.461108][ T13] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 824.518820][ T13] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 824.551087][ T5874] usb 9-1: device descriptor read/64, error -71 [ 824.606849][ T13] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 824.707208][ T13] bridge_slave_1: left allmulticast mode [ 824.714237][ T13] bridge_slave_1: left promiscuous mode [ 824.720367][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 824.728941][ T13] bridge_slave_0: left allmulticast mode [ 824.735271][ T13] bridge_slave_0: left promiscuous mode [ 824.741347][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 824.793771][ T5874] usb 9-1: new high-speed USB device number 57 using dummy_hcd [ 824.941007][ T5874] usb 9-1: device descriptor read/64, error -71 [ 825.053978][ T5874] usb usb9-port1: attempt power cycle [ 825.135291][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 825.145604][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 825.155819][ T13] bond0 (unregistering): Released all slaves [ 825.440895][ T5874] usb 9-1: new high-speed USB device number 58 using dummy_hcd [ 825.537733][ T5874] usb 9-1: device descriptor read/8, error -71 [ 825.910859][ T30] audit: type=1400 audit(1747953740.151:2861): avc: denied { checkpoint_restore } for pid=15528 comm="syz.6.2728" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 826.427875][ T5817] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 826.442966][ T5817] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 826.464849][ T5817] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 826.537406][ T5874] usb 9-1: new high-speed USB device number 59 using dummy_hcd [ 826.754223][ T5817] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 826.827549][ T5817] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 826.892888][ T5874] usb 9-1: device descriptor read/8, error -71 [ 826.917126][T15552] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 827.001066][ T5874] usb usb9-port1: unable to enumerate USB device [ 827.044902][ T13] hsr_slave_0: left promiscuous mode [ 827.054806][ T13] hsr_slave_1: left promiscuous mode [ 827.062511][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 827.070035][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 827.096877][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 827.117635][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 827.159869][ T13] veth1_macvtap: left promiscuous mode [ 827.165559][ T13] veth0_macvtap: left promiscuous mode [ 827.171292][ T13] veth1_vlan: left promiscuous mode [ 827.176818][ T13] veth0_vlan: left promiscuous mode [ 827.727155][ T5874] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 828.370791][ T5874] usb 7-1: Using ep0 maxpacket: 16 [ 828.378208][ T5874] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 828.408863][ T5874] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 828.422658][ T5874] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 828.462998][ T5874] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 828.475345][ T5874] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.502137][ T5874] usb 7-1: config 0 descriptor?? [ 828.964154][ T5818] Bluetooth: hci4: command tx timeout [ 829.109926][ T5874] input: HID 045e:07da as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:045E:07DA.0025/input/input32 [ 829.216771][ T5874] microsoft 0003:045E:07DA.0025: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 829.530052][ T13] team0 (unregistering): Port device team_slave_1 removed [ 829.589916][ T13] team0 (unregistering): Port device team_slave_0 removed [ 830.293136][T15591] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 831.088003][ T5817] Bluetooth: hci4: command tx timeout [ 831.163035][ T5874] usb 7-1: reset high-speed USB device number 21 using dummy_hcd [ 831.310685][T15595] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 832.114779][ T30] audit: type=1400 audit(1747953746.531:2862): avc: denied { accept } for pid=15597 comm="syz.1.2740" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 832.188259][ T5864] usb 7-1: USB disconnect, device number 21 [ 832.358445][T15547] chnl_net:caif_netlink_parms(): no params data found [ 832.984070][T15608] lo: entered allmulticast mode [ 833.120543][ T5818] Bluetooth: hci4: command tx timeout [ 833.860070][T15547] bridge0: port 1(bridge_slave_0) entered blocking state [ 833.890850][T15547] bridge0: port 1(bridge_slave_0) entered disabled state [ 833.898151][T15547] bridge_slave_0: entered allmulticast mode [ 833.933182][T15547] bridge_slave_0: entered promiscuous mode [ 833.954481][T15547] bridge0: port 2(bridge_slave_1) entered blocking state [ 833.978690][T15547] bridge0: port 2(bridge_slave_1) entered disabled state [ 834.093803][T15547] bridge_slave_1: entered allmulticast mode [ 834.114801][T15547] bridge_slave_1: entered promiscuous mode [ 834.133088][ T30] audit: type=1400 audit(1747953748.581:2863): avc: denied { bind } for pid=15626 comm="syz.6.2748" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 834.171838][T15606] fuse: Bad value for 'group_id' [ 834.181663][T15606] fuse: Bad value for 'group_id' [ 834.237211][T15547] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 834.322819][T15547] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 834.409437][T15633] netlink: 6 bytes leftover after parsing attributes in process `syz.8.2750'. [ 834.432707][T15633] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 834.455674][T15607] lo: left allmulticast mode [ 834.469197][T15547] team0: Port device team_slave_0 added [ 834.539716][T15547] team0: Port device team_slave_1 added [ 834.632688][T15547] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 834.648607][T15547] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 834.687633][T15547] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 834.728411][T15547] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 834.738070][T15547] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 834.765071][T15547] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 834.796888][T15650] Option ' ' to dns_resolver key: bad/missing value [ 834.860716][ T5874] usb 9-1: new high-speed USB device number 60 using dummy_hcd [ 834.928755][T15547] hsr_slave_0: entered promiscuous mode [ 834.954720][T15547] hsr_slave_1: entered promiscuous mode [ 834.999133][T15547] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 835.008180][T15547] Cannot create hsr debugfs directory [ 835.010949][ T5874] usb 9-1: Using ep0 maxpacket: 16 [ 835.049165][T15656] virtio-fs: tag not found [ 835.077728][ T30] audit: type=1400 audit(1747953749.501:2864): avc: denied { read } for pid=15652 comm="syz.0.2757" path="socket:[63950]" dev="sockfs" ino=63950 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 835.191082][ T5818] Bluetooth: hci4: command tx timeout [ 835.191150][ T5874] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 835.260653][ T5874] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 835.447580][ T5874] usb 9-1: New USB device found, idVendor=0c70, idProduct=f00a, bcdDevice= 0.00 [ 835.520551][ T5874] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 835.617061][ T5874] usb 9-1: config 0 descriptor?? [ 836.489803][ T5874] aquacomputer_d5next 0003:0C70:F00A.0026: hidraw0: USB HID v0.00 Device [HID 0c70:f00a] on usb-dummy_hcd.8-1/input0 [ 836.512740][ T30] audit: type=1400 audit(1747953750.971:2865): avc: denied { ioctl } for pid=15673 comm="syz.1.2762" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 836.614750][ T30] audit: type=1400 audit(1747953751.031:2866): avc: denied { read write } for pid=7368 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 836.668306][ T30] audit: type=1400 audit(1747953751.031:2867): avc: denied { open } for pid=7368 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 836.727816][ T30] audit: type=1400 audit(1747953751.031:2868): avc: denied { ioctl } for pid=7368 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 836.753382][ C0] vkms_vblank_simulate: vblank timer overrun [ 836.780194][T15680] FAULT_INJECTION: forcing a failure. [ 836.780194][T15680] name failslab, interval 1, probability 0, space 0, times 0 [ 836.792861][ T30] audit: type=1400 audit(1747953751.151:2869): avc: denied { read write } for pid=15676 comm="syz.1.2763" name="vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 836.792912][ T30] audit: type=1400 audit(1747953751.151:2870): avc: denied { open } for pid=15676 comm="syz.1.2763" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 836.823516][ T30] audit: type=1400 audit(1747953751.281:2871): avc: denied { read } for pid=15641 comm="syz.8.2752" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 836.865058][ C0] vkms_vblank_simulate: vblank timer overrun [ 836.867196][T15680] CPU: 1 UID: 0 PID: 15680 Comm: syz.0.2764 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 836.867223][T15680] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 836.867232][T15680] Call Trace: [ 836.867238][T15680] [ 836.867245][T15680] dump_stack_lvl+0x16c/0x1f0 [ 836.867275][T15680] should_fail_ex+0x512/0x640 [ 836.867297][T15680] ? fs_reclaim_acquire+0xae/0x150 [ 836.867321][T15680] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 836.867344][T15680] should_failslab+0xc2/0x120 [ 836.867363][T15680] __kmalloc_noprof+0xd2/0x510 [ 836.867384][T15680] tomoyo_realpath_from_path+0xc2/0x6e0 [ 836.867409][T15680] ? tomoyo_profile+0x47/0x60 [ 836.867428][T15680] tomoyo_path_number_perm+0x245/0x580 [ 836.867447][T15680] ? tomoyo_path_number_perm+0x237/0x580 [ 836.867470][T15680] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 836.867491][T15680] ? find_held_lock+0x2b/0x80 [ 836.867532][T15680] ? find_held_lock+0x2b/0x80 [ 836.867550][T15680] ? hook_file_ioctl_common+0x145/0x410 [ 836.867572][T15680] ? __fget_files+0x20e/0x3c0 [ 836.867592][T15680] security_file_ioctl+0x9b/0x240 [ 836.867617][T15680] __x64_sys_ioctl+0xb7/0x200 [ 836.867640][T15680] do_syscall_64+0xcd/0x260 [ 836.867664][T15680] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 836.867680][T15680] RIP: 0033:0x7f483fb8e969 [ 836.867694][T15680] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 836.867710][T15680] RSP: 002b:00007f4840ade038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 836.867726][T15680] RAX: ffffffffffffffda RBX: 00007f483fdb5fa0 RCX: 00007f483fb8e969 [ 836.867737][T15680] RDX: 0000200000000000 RSI: 000000004004af61 RDI: 0000000000000003 [ 836.867747][T15680] RBP: 00007f4840ade090 R08: 0000000000000000 R09: 0000000000000000 [ 836.867756][T15680] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 836.867765][T15680] R13: 0000000000000000 R14: 00007f483fdb5fa0 R15: 00007fff32663ee8 [ 836.867787][T15680] [ 836.867794][T15680] ERROR: Out of memory at tomoyo_realpath_from_path. [ 837.192950][T15693] FAULT_INJECTION: forcing a failure. [ 837.192950][T15693] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 837.206446][T15693] CPU: 0 UID: 0 PID: 15693 Comm: syz.0.2767 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 837.206473][T15693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 837.206484][T15693] Call Trace: [ 837.206491][T15693] [ 837.206498][T15693] dump_stack_lvl+0x16c/0x1f0 [ 837.206531][T15693] should_fail_ex+0x512/0x640 [ 837.206560][T15693] _copy_to_user+0x32/0xd0 [ 837.206588][T15693] simple_read_from_buffer+0xcb/0x170 [ 837.206618][T15693] proc_fail_nth_read+0x197/0x270 [ 837.206652][T15693] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 837.206680][T15693] ? rw_verify_area+0xcf/0x680 [ 837.206704][T15693] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 837.206731][T15693] vfs_read+0x1e1/0xc70 [ 837.206760][T15693] ? __pfx___mutex_lock+0x10/0x10 [ 837.206786][T15693] ? __pfx_vfs_read+0x10/0x10 [ 837.206820][T15693] ? __fget_files+0x20e/0x3c0 [ 837.206835][T15693] ? __pfx_rcu_is_watching+0x10/0x10 [ 837.206866][T15693] ksys_read+0x12a/0x240 [ 837.206890][T15693] ? __pfx_ksys_read+0x10/0x10 [ 837.206927][T15693] do_syscall_64+0xcd/0x260 [ 837.206955][T15693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 837.206974][T15693] RIP: 0033:0x7f483fb8d37c [ 837.206990][T15693] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 837.207008][T15693] RSP: 002b:00007f4840ade030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 837.207025][T15693] RAX: ffffffffffffffda RBX: 00007f483fdb5fa0 RCX: 00007f483fb8d37c [ 837.207037][T15693] RDX: 000000000000000f RSI: 00007f4840ade0a0 RDI: 0000000000000003 [ 837.207048][T15693] RBP: 00007f4840ade090 R08: 0000000000000000 R09: 0000000000000000 [ 837.207058][T15693] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 837.207069][T15693] R13: 0000000000000000 R14: 00007f483fdb5fa0 R15: 00007fff32663ee8 [ 837.207094][T15693] [ 837.396809][ C0] vkms_vblank_simulate: vblank timer overrun [ 837.417865][ T5874] usb 9-1: USB disconnect, device number 60 [ 837.495320][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 837.495343][ T30] audit: type=1400 audit(1747953751.951:2898): avc: denied { execmem } for pid=15697 comm="syz.6.2770" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 837.714928][ T30] audit: type=1400 audit(1747953752.171:2899): avc: denied { unmount } for pid=7368 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 838.267113][T15705] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 838.331102][T15701] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 838.686785][ T30] audit: type=1400 audit(1747953752.701:2900): avc: denied { read } for pid=15697 comm="syz.6.2770" name="iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 838.709557][ T30] audit: type=1400 audit(1747953752.701:2901): avc: denied { open } for pid=15697 comm="syz.6.2770" path="/dev/iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 838.732577][ C0] vkms_vblank_simulate: vblank timer overrun [ 838.916676][ T30] audit: type=1400 audit(1747953752.721:2902): avc: denied { ioctl } for pid=15697 comm="syz.6.2770" path="/dev/iommu" dev="devtmpfs" ino=624 ioctlcmd=0x3ba0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 839.169577][ T30] audit: type=1400 audit(1747953752.781:2903): avc: denied { create } for pid=15697 comm="syz.6.2770" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 839.339498][ T30] audit: type=1400 audit(1747953752.781:2904): avc: denied { setopt } for pid=15697 comm="syz.6.2770" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 839.392432][ T30] audit: type=1400 audit(1747953752.801:2905): avc: denied { create } for pid=15699 comm="syz.0.2769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 839.412037][ C0] vkms_vblank_simulate: vblank timer overrun [ 839.418261][ T30] audit: type=1400 audit(1747953753.501:2906): avc: denied { write } for pid=15706 comm="syz.1.2771" name="vmci" dev="devtmpfs" ino=697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 839.515943][T15547] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 839.537320][T15547] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 839.544226][ T30] audit: type=1400 audit(1747953753.731:2907): avc: denied { create } for pid=15708 comm="syz.6.2772" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 839.570909][ T5864] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 840.073333][T15547] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 840.280876][ T5864] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 840.331032][T15547] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 840.342316][ T5864] usb 2-1: config 0 interface 0 has no altsetting 0 [ 840.501490][ T5864] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 840.732186][ T5864] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 841.972566][ T5864] usb 2-1: Product: syz [ 841.980894][ T5864] usb 2-1: Manufacturer: syz [ 841.992553][ T5864] usb 2-1: SerialNumber: syz [ 842.020131][ T5864] usb 2-1: config 0 descriptor?? [ 842.062623][ T5864] usb 2-1: can't set config #0, error -71 [ 842.075842][ T5864] usb 2-1: USB disconnect, device number 75 [ 842.446960][T15547] 8021q: adding VLAN 0 to HW filter on device bond0 [ 842.522473][ T30] kauditd_printk_skb: 42 callbacks suppressed [ 842.522493][ T30] audit: type=1400 audit(1747953756.981:2950): avc: denied { map } for pid=15736 comm="syz.6.2780" path="/proc/sys/net/ipv4/tcp_rfc1337" dev="proc" ino=64303 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_net_t tclass=file permissive=1 [ 842.585478][T15547] 8021q: adding VLAN 0 to HW filter on device team0 [ 843.487220][ T30] audit: type=1400 audit(1747953757.681:2951): avc: denied { module_request } for pid=15741 comm="syz.1.2781" kmod="fs-" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 843.522708][ T6897] bridge0: port 1(bridge_slave_0) entered blocking state [ 843.530052][ T6897] bridge0: port 1(bridge_slave_0) entered forwarding state [ 843.603992][T15738] 9pnet: p9_errstr2errno: server reported unknown error ¤ÑÅl0î„&IØü [ 843.618252][ T6897] bridge0: port 2(bridge_slave_1) entered blocking state [ 843.625494][ T6897] bridge0: port 2(bridge_slave_1) entered forwarding state [ 843.639845][ T30] audit: type=1400 audit(1747953757.721:2952): avc: denied { setopt } for pid=15741 comm="syz.1.2781" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 843.873209][ T30] audit: type=1400 audit(1747953757.801:2953): avc: denied { accept } for pid=15741 comm="syz.1.2781" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 843.926442][ T1134] Bluetooth: hci5: Frame reassembly failed (-84) [ 844.587767][ T30] audit: type=1400 audit(1747953758.131:2954): avc: denied { read write } for pid=15753 comm="syz.8.2782" name="video2" dev="devtmpfs" ino=932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 844.630922][ T30] audit: type=1400 audit(1747953758.131:2955): avc: denied { open } for pid=15753 comm="syz.8.2782" path="/dev/video2" dev="devtmpfs" ino=932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 844.654859][ T30] audit: type=1400 audit(1747953758.141:2956): avc: denied { ioctl } for pid=15753 comm="syz.8.2782" path="/dev/video2" dev="devtmpfs" ino=932 ioctlcmd=0x5608 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 844.782214][ T30] audit: type=1400 audit(1747953758.461:2957): avc: denied { write } for pid=15753 comm="syz.8.2782" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 844.883655][ T30] audit: type=1400 audit(1747953758.471:2958): avc: denied { setopt } for pid=15753 comm="syz.8.2782" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 844.916529][T15774] netlink: 'syz.6.2787': attribute type 10 has an invalid length. [ 844.997319][ T30] audit: type=1400 audit(1747953759.111:2959): avc: denied { create } for pid=15763 comm="syz.6.2784" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 845.016201][T15774] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 845.111438][T15547] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 845.144955][T15778] FAULT_INJECTION: forcing a failure. [ 845.144955][T15778] name failslab, interval 1, probability 0, space 0, times 0 [ 845.179237][T15778] CPU: 1 UID: 0 PID: 15778 Comm: syz.8.2788 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 845.179269][T15778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 845.179280][T15778] Call Trace: [ 845.179286][T15778] [ 845.179294][T15778] dump_stack_lvl+0x16c/0x1f0 [ 845.179326][T15778] should_fail_ex+0x512/0x640 [ 845.179351][T15778] ? fs_reclaim_acquire+0xae/0x150 [ 845.179376][T15778] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 845.179402][T15778] should_failslab+0xc2/0x120 [ 845.179422][T15778] __kmalloc_noprof+0xd2/0x510 [ 845.179446][T15778] tomoyo_realpath_from_path+0xc2/0x6e0 [ 845.179474][T15778] ? tomoyo_profile+0x47/0x60 [ 845.179495][T15778] tomoyo_path_number_perm+0x245/0x580 [ 845.179517][T15778] ? tomoyo_path_number_perm+0x237/0x580 [ 845.179542][T15778] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 845.179566][T15778] ? find_held_lock+0x2b/0x80 [ 845.179613][T15778] ? find_held_lock+0x2b/0x80 [ 845.179633][T15778] ? hook_file_ioctl_common+0x145/0x410 [ 845.179659][T15778] ? __fget_files+0x20e/0x3c0 [ 845.179682][T15778] security_file_ioctl+0x9b/0x240 [ 845.179710][T15778] __x64_sys_ioctl+0xb7/0x200 [ 845.179739][T15778] do_syscall_64+0xcd/0x260 [ 845.179769][T15778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.179788][T15778] RIP: 0033:0x7fa12498e969 [ 845.179803][T15778] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 845.179826][T15778] RSP: 002b:00007fa1258c4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 845.179844][T15778] RAX: ffffffffffffffda RBX: 00007fa124bb5fa0 RCX: 00007fa12498e969 [ 845.179856][T15778] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 845.179867][T15778] RBP: 00007fa1258c4090 R08: 0000000000000000 R09: 0000000000000000 [ 845.179878][T15778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 845.179889][T15778] R13: 0000000000000000 R14: 00007fa124bb5fa0 R15: 00007ffc691143a8 [ 845.179915][T15778] [ 845.179922][T15778] ERROR: Out of memory at tomoyo_realpath_from_path. [ 845.433630][T15784] FAULT_INJECTION: forcing a failure. [ 845.433630][T15784] name failslab, interval 1, probability 0, space 0, times 0 [ 845.459007][T15784] CPU: 0 UID: 0 PID: 15784 Comm: syz.6.2789 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 845.459039][T15784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 845.459050][T15784] Call Trace: [ 845.459057][T15784] [ 845.459065][T15784] dump_stack_lvl+0x16c/0x1f0 [ 845.459096][T15784] should_fail_ex+0x512/0x640 [ 845.459122][T15784] ? fs_reclaim_acquire+0xae/0x150 [ 845.459149][T15784] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 845.459177][T15784] should_failslab+0xc2/0x120 [ 845.459198][T15784] __kmalloc_noprof+0xd2/0x510 [ 845.459223][T15784] tomoyo_realpath_from_path+0xc2/0x6e0 [ 845.459253][T15784] ? tomoyo_profile+0x47/0x60 [ 845.459273][T15784] tomoyo_path_number_perm+0x245/0x580 [ 845.459296][T15784] ? tomoyo_path_number_perm+0x237/0x580 [ 845.459322][T15784] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 845.459347][T15784] ? find_held_lock+0x2b/0x80 [ 845.459394][T15784] ? find_held_lock+0x2b/0x80 [ 845.459416][T15784] ? hook_file_ioctl_common+0x145/0x410 [ 845.459441][T15784] ? __fget_files+0x20e/0x3c0 [ 845.459464][T15784] security_file_ioctl+0x9b/0x240 [ 845.459491][T15784] __x64_sys_ioctl+0xb7/0x200 [ 845.459519][T15784] do_syscall_64+0xcd/0x260 [ 845.459548][T15784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.459573][T15784] RIP: 0033:0x7f63d4d8e969 [ 845.459590][T15784] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 845.459608][T15784] RSP: 002b:00007f63d2bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 845.459626][T15784] RAX: ffffffffffffffda RBX: 00007f63d4fb5fa0 RCX: 00007f63d4d8e969 [ 845.459638][T15784] RDX: 00002000000004c0 RSI: 00000000c08c5336 RDI: 0000000000000005 [ 845.459649][T15784] RBP: 00007f63d2bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 845.459660][T15784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 845.459671][T15784] R13: 0000000000000000 R14: 00007f63d4fb5fa0 R15: 00007ffd335c3948 [ 845.459696][T15784] [ 845.459705][T15784] ERROR: Out of memory at tomoyo_realpath_from_path. [ 846.272479][ T5818] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 846.419887][T15547] veth0_vlan: entered promiscuous mode [ 846.645558][T15547] veth1_vlan: entered promiscuous mode [ 846.859315][T15547] veth0_macvtap: entered promiscuous mode [ 846.931259][T15547] veth1_macvtap: entered promiscuous mode [ 846.964679][T15547] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 846.985418][T15547] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 847.971358][T13268] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 848.223732][T15547] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 848.232825][T15547] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 848.242041][T15547] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 848.252132][T15547] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 848.332850][T13268] usb 1-1: config 0 has an invalid interface number: 156 but max is 0 [ 848.343992][T13268] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 848.355322][T13268] usb 1-1: config 0 has no interface number 0 [ 848.370233][T13268] usb 1-1: config 0 interface 156 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 848.385733][T13268] usb 1-1: config 0 interface 156 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 848.405617][T13268] usb 1-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 848.415804][T13268] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 848.460102][T13268] usb 1-1: config 0 descriptor?? [ 848.469875][T13268] gspca_main: spca561-2.14.0 probing abcd:cdee [ 848.510734][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 848.510749][ T30] audit: type=1400 audit(1747953762.941:2966): avc: denied { bind } for pid=15812 comm="syz.6.2795" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 848.667594][ T30] audit: type=1400 audit(1747953763.121:2967): avc: denied { ioctl } for pid=15817 comm="syz.1.2796" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=64501 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 848.727310][ T2954] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 848.735539][ T2954] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 848.817048][ T1134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 848.826250][ T1134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 848.847811][ T30] audit: type=1400 audit(1747953763.301:2968): avc: denied { mounton } for pid=15547 comm="syz-executor" path="/root/syzkaller.bZywkY/syz-tmp" dev="sda1" ino=2081 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 848.887675][ T30] audit: type=1400 audit(1747953763.301:2969): avc: denied { mount } for pid=15547 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 849.065160][ T30] audit: type=1400 audit(1747953763.311:2970): avc: denied { mounton } for pid=15547 comm="syz-executor" path="/root/syzkaller.bZywkY/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 849.097732][T13268] spca561 1-1:0.156: probe with driver spca561 failed with error -22 [ 849.113365][ T30] audit: type=1400 audit(1747953763.311:2971): avc: denied { mounton } for pid=15547 comm="syz-executor" path="/root/syzkaller.bZywkY/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=65377 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 849.203054][T15823] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 849.218815][T15823] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 849.595806][ T30] audit: type=1400 audit(1747953763.331:2972): avc: denied { mounton } for pid=15547 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2774 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 849.598647][T13268] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 849.619822][ T30] audit: type=1400 audit(1747953763.331:2973): avc: denied { mount } for pid=15547 comm="syz-executor" name="/" dev="gadgetfs" ino=16354 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 849.650422][ T30] audit: type=1400 audit(1747953763.331:2974): avc: denied { mount } for pid=15547 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 849.705796][ T30] audit: type=1400 audit(1747953763.331:2975): avc: denied { mounton } for pid=15547 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 849.904677][T13268] usb 1-1: MIDIStreaming interface descriptor not found [ 850.619332][T13268] usb 1-1: USB disconnect, device number 33 [ 850.897193][ T2954] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 851.116970][ T2954] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 851.188708][ T2954] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 851.259064][ T2954] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 851.364784][ T2954] bridge_slave_1: left allmulticast mode [ 851.370457][ T2954] bridge_slave_1: left promiscuous mode [ 851.376238][ T2954] bridge0: port 2(bridge_slave_1) entered disabled state [ 851.386649][ T2954] bridge_slave_0: left allmulticast mode [ 851.392486][ T2954] bridge_slave_0: left promiscuous mode [ 851.398427][ T2954] bridge0: port 1(bridge_slave_0) entered disabled state [ 851.776212][ T2954] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 851.787798][ T2954] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 851.798156][ T2954] bond0 (unregistering): Released all slaves [ 852.096051][T15846] FAULT_INJECTION: forcing a failure. [ 852.096051][T15846] name failslab, interval 1, probability 0, space 0, times 0 [ 852.109592][T15846] CPU: 0 UID: 0 PID: 15846 Comm: syz.6.2801 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 852.109619][T15846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 852.109630][T15846] Call Trace: [ 852.109636][T15846] [ 852.109644][T15846] dump_stack_lvl+0x16c/0x1f0 [ 852.109676][T15846] should_fail_ex+0x512/0x640 [ 852.109701][T15846] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 852.109722][T15846] should_failslab+0xc2/0x120 [ 852.109742][T15846] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 852.109766][T15846] ? getname_flags.part.0+0x4c/0x550 [ 852.109793][T15846] getname_flags.part.0+0x4c/0x550 [ 852.109819][T15846] getname_flags+0x93/0xf0 [ 852.109845][T15846] do_sys_openat2+0xb8/0x1d0 [ 852.109866][T15846] ? __pfx_do_sys_openat2+0x10/0x10 [ 852.109893][T15846] ? __pfx___schedule+0x10/0x10 [ 852.109919][T15846] __x64_sys_openat+0x174/0x210 [ 852.109941][T15846] ? __pfx___x64_sys_openat+0x10/0x10 [ 852.109974][T15846] do_syscall_64+0xcd/0x260 [ 852.110002][T15846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.110021][T15846] RIP: 0033:0x7f63d4d8d2d0 [ 852.110036][T15846] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 [ 852.110054][T15846] RSP: 002b:00007f63d2bd4b70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 852.110071][T15846] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f63d4d8d2d0 [ 852.110083][T15846] RDX: 0000000000000000 RSI: 00007f63d2bd4c10 RDI: 00000000ffffff9c [ 852.110093][T15846] RBP: 00007f63d2bd4c10 R08: 0000000000000000 R09: 0000000000000000 [ 852.110104][T15846] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 852.110114][T15846] R13: 0000000000000000 R14: 00007f63d4fb6080 R15: 00007ffd335c3948 [ 852.110138][T15846] [ 852.770421][ T5818] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 852.782209][ T5818] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 852.814355][ T5818] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 852.837419][ T5818] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 852.840728][ T2954] hsr_slave_0: left promiscuous mode [ 852.854121][ T5818] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 852.873779][T15862] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 852.884173][T15862] /dev/nullb0: Can't open blockdev [ 852.943531][ T2954] hsr_slave_1: left promiscuous mode [ 852.949693][ T2954] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 852.960218][ T2954] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 852.974589][ T2954] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 852.993970][ T2954] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 852.997352][T15089] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 853.051938][T15865] syz.1.2808: attempt to access beyond end of device [ 853.051938][T15865] nbd1: rw=0, sector=64, nr_sectors = 1 limit=0 [ 853.073284][ T2954] veth1_macvtap: left promiscuous mode [ 853.080050][ T2954] veth0_macvtap: left promiscuous mode [ 853.098787][T15865] syz.1.2808: attempt to access beyond end of device [ 853.098787][T15865] nbd1: rw=0, sector=256, nr_sectors = 1 limit=0 [ 853.102756][ T2954] veth1_vlan: left promiscuous mode [ 853.117293][ T2954] veth0_vlan: left promiscuous mode [ 853.125715][T15865] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 853.137553][T15865] syz.1.2808: attempt to access beyond end of device [ 853.137553][T15865] nbd1: rw=0, sector=512, nr_sectors = 1 limit=0 [ 853.162850][T15865] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 853.173814][T15865] syz.1.2808: attempt to access beyond end of device [ 853.173814][T15865] nbd1: rw=0, sector=64, nr_sectors = 2 limit=0 [ 853.203037][T15865] syz.1.2808: attempt to access beyond end of device [ 853.203037][T15865] nbd1: rw=0, sector=512, nr_sectors = 2 limit=0 [ 853.217562][T15865] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 853.228970][T15865] syz.1.2808: attempt to access beyond end of device [ 853.228970][T15865] nbd1: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 853.252905][T15089] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 853.261496][T15865] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 853.288312][T15871] sd 0:0:1:0: PR command failed: 1026 [ 853.296908][T15865] syz.1.2808: attempt to access beyond end of device [ 853.296908][T15865] nbd1: rw=0, sector=64, nr_sectors = 4 limit=0 [ 853.303532][T15089] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 853.315077][T15865] syz.1.2808: attempt to access beyond end of device [ 853.315077][T15865] nbd1: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 853.350852][T15871] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 853.357610][T15871] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 853.406457][T15865] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 853.477264][T15865] syz.1.2808: attempt to access beyond end of device [ 853.477264][T15865] nbd1: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 853.509140][T15865] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 853.518785][T15089] usb 7-1: New USB device found, idVendor=1b96, idProduct=0012, bcdDevice= 0.00 [ 853.518815][T15089] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 853.520741][T15089] usb 7-1: config 0 descriptor?? [ 853.589927][T15878] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 853.600263][T15878] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 853.668095][T15865] syz.1.2808: attempt to access beyond end of device [ 853.668095][T15865] nbd1: rw=0, sector=64, nr_sectors = 8 limit=0 [ 853.742411][T15865] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 853.769966][T15865] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 853.786093][T15865] UDF-fs: warning (device nbd1): udf_fill_super: No partition found (1) [ 853.800514][T15877] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 853.815353][T15877] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 853.826669][T15877] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 853.840017][T15877] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 853.864364][T15877] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 853.874461][T15877] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 853.885697][T15877] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 853.895643][T15877] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 853.906657][T15877] UDF-fs: warning (device nbd1): udf_fill_super: No partition found (1) [ 854.186821][T15089] ntrig 0003:1B96:0012.0027: unknown main item tag 0x0 [ 854.205086][T15089] ntrig 0003:1B96:0012.0027: item fetching failed at offset 6/7 [ 854.219206][T15089] ntrig 0003:1B96:0012.0027: parse failed [ 854.225344][T15089] ntrig 0003:1B96:0012.0027: probe with driver ntrig failed with error -22 [ 854.297082][ T2954] team0 (unregistering): Port device team_slave_1 removed [ 854.350280][ T2954] team0 (unregistering): Port device team_slave_0 removed [ 854.405553][T15089] usb 7-1: USB disconnect, device number 22 [ 854.952003][ T5818] Bluetooth: hci4: command tx timeout [ 855.058897][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 855.058915][ T30] audit: type=1400 audit(1747953769.511:2992): avc: denied { mount } for pid=15890 comm="syz.8.2815" name="/" dev="ramfs" ino=66039 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 855.148122][T15893] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 855.374747][ T30] audit: type=1400 audit(1747953769.761:2993): avc: denied { shutdown } for pid=15892 comm="syz.6.2814" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 855.579053][ T30] audit: type=1400 audit(1747953769.771:2994): avc: denied { read } for pid=15892 comm="syz.6.2814" path="socket:[66661]" dev="sockfs" ino=66661 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 855.934097][ T30] audit: type=1400 audit(1747953769.811:2995): avc: denied { execute } for pid=15892 comm="syz.6.2814" path="/84/file0" dev="tmpfs" ino=521 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 855.957802][ T30] audit: type=1804 audit(1747953769.821:2996): pid=15894 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.6.2814" name="/newroot/84/file0" dev="tmpfs" ino=521 res=1 errno=0 [ 855.981327][ T30] audit: type=1800 audit(1747953769.821:2997): pid=15894 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.6.2814" name="file0" dev="tmpfs" ino=521 res=0 errno=0 [ 856.026428][ T30] audit: type=1400 audit(1747953770.481:2998): avc: denied { unmount } for pid=7366 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 856.203419][ T30] audit: type=1400 audit(1747953770.651:2999): avc: denied { create } for pid=15896 comm="syz.6.2816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 857.115389][ T5818] Bluetooth: hci4: command tx timeout [ 857.170126][ T30] audit: type=1400 audit(1747953770.971:3000): avc: denied { getopt } for pid=15900 comm="syz.0.2817" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 857.298991][ T30] audit: type=1400 audit(1747953771.721:3001): avc: denied { ioctl } for pid=15913 comm="syz.0.2819" path="socket:[66091]" dev="sockfs" ino=66091 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 857.299055][T15855] chnl_net:caif_netlink_parms(): no params data found [ 857.380773][ T5950] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 857.471186][ T5867] usb 9-1: new high-speed USB device number 61 using dummy_hcd [ 857.551709][ T5950] usb 7-1: Using ep0 maxpacket: 8 [ 857.589749][ T5950] usb 7-1: unable to get BOS descriptor or descriptor too short [ 857.608012][ T5950] usb 7-1: config 8 has an invalid interface number: 100 but max is 0 [ 857.616815][ T5950] usb 7-1: config 8 has no interface number 0 [ 857.623110][ T5950] usb 7-1: config 8 interface 100 has no altsetting 0 [ 857.632506][ T5867] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 858.167887][ T5867] usb 9-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 858.191283][ T5950] usb 7-1: New USB device found, idVendor=0b57, idProduct=6736, bcdDevice=4a.06 [ 858.200380][ T5950] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 858.217193][T15855] bridge0: port 1(bridge_slave_0) entered blocking state [ 858.218913][ T5867] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 858.224633][T15855] bridge0: port 1(bridge_slave_0) entered disabled state [ 858.243969][ T5950] usb 7-1: Product: syz [ 858.248205][ T5950] usb 7-1: Manufacturer: syz [ 858.264049][T15855] bridge_slave_0: entered allmulticast mode [ 858.267402][ T5950] usb 7-1: SerialNumber: syz [ 858.272387][T15855] bridge_slave_0: entered promiscuous mode [ 858.275001][ T5867] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 858.283256][T15855] bridge0: port 2(bridge_slave_1) entered blocking state [ 858.298805][T15855] bridge0: port 2(bridge_slave_1) entered disabled state [ 858.306961][T15855] bridge_slave_1: entered allmulticast mode [ 858.314473][T15855] bridge_slave_1: entered promiscuous mode [ 858.321030][ T5867] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 858.338384][ T5867] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 858.364283][ T5867] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 858.378135][ T5867] usb 9-1: Product: syz [ 858.382389][ T5867] usb 9-1: Manufacturer: syz [ 858.401383][ T5867] cdc_wdm 9-1:1.0: skipping garbage [ 858.406738][ T5867] cdc_wdm 9-1:1.0: skipping garbage [ 858.565540][ T5950] usbhid 7-1:8.100: couldn't find an input interrupt endpoint [ 858.584254][ T5867] cdc_wdm 9-1:1.0: cdc-wdm0: USB WDM device [ 858.601116][T15855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 858.619519][T15855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 858.643483][ T5867] cdc_wdm 9-1:1.0: Unknown control protocol [ 858.657805][ T5950] usb 7-1: USB disconnect, device number 23 [ 858.674845][ T5867] usb 9-1: USB disconnect, device number 61 [ 858.709166][T15933] mkiss: ax0: crc mode is auto. [ 858.724331][T15933] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2823'. [ 858.724972][T15855] team0: Port device team_slave_0 added [ 858.763349][T15855] team0: Port device team_slave_1 added [ 858.806071][T15855] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 858.813712][T15855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 858.841008][T15855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 858.853956][T15855] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 858.862188][T15855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 858.889056][T15855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 858.983756][T15855] hsr_slave_0: entered promiscuous mode [ 859.004274][T15855] hsr_slave_1: entered promiscuous mode [ 859.011094][T15855] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 859.018688][T15855] Cannot create hsr debugfs directory [ 859.115004][T15942] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 859.190933][ T5818] Bluetooth: hci4: command tx timeout [ 860.250041][T15953] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2831'. [ 860.308338][T15089] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 860.570858][T15089] usb 7-1: Using ep0 maxpacket: 8 [ 860.628739][T15089] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 860.726515][T15089] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 860.814303][T15089] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 860.923304][T15089] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 860.982840][T15089] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 861.038894][T15089] usb 7-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 861.090731][T15089] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 861.133831][T15089] usb 7-1: config 0 descriptor?? [ 861.146655][T15944] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 861.282099][ T5817] Bluetooth: hci4: command tx timeout [ 861.296858][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 861.296874][ T30] audit: type=1400 audit(1747953775.751:3004): avc: denied { create } for pid=15960 comm="syz.1.2834" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 861.399051][ T30] audit: type=1400 audit(1747953775.751:3005): avc: denied { create } for pid=15960 comm="syz.1.2834" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 861.723688][ T30] audit: type=1400 audit(1747953776.091:3006): avc: denied { connect } for pid=15960 comm="syz.1.2834" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 861.956641][ T30] audit: type=1400 audit(1747953776.171:3007): avc: denied { bind } for pid=15960 comm="syz.1.2834" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 861.995067][T15089] usb 7-1: USB disconnect, device number 24 [ 862.003375][ T5818] Bluetooth: hci5: Opcode 0x0c03 failed: -19 [ 862.066082][ T30] audit: type=1400 audit(1747953776.251:3008): avc: denied { read write } for pid=15960 comm="syz.1.2834" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 862.090825][ T5914] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 863.071147][ T30] audit: type=1400 audit(1747953776.251:3009): avc: denied { open } for pid=15960 comm="syz.1.2834" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 863.102557][ T30] audit: type=1400 audit(1747953776.581:3010): avc: denied { mount } for pid=15968 comm="syz.8.2835" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 863.105822][ T5914] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 863.126134][ T30] audit: type=1400 audit(1747953776.581:3011): avc: denied { search } for pid=15968 comm="syz.8.2835" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 863.163970][ T30] audit: type=1400 audit(1747953776.591:3012): avc: denied { wake_alarm } for pid=15968 comm="syz.8.2835" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 863.169910][ T5914] usb 2-1: config 0 interface 0 has no altsetting 0 [ 863.185871][ T30] audit: type=1400 audit(1747953776.741:3013): avc: denied { write } for pid=15968 comm="syz.8.2835" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 863.221122][ T5914] usb 2-1: New USB device found, idVendor=05a4, idProduct=2000, bcdDevice= 0.00 [ 863.230284][ T5914] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 863.263288][ T5914] usb 2-1: config 0 descriptor?? [ 863.461681][T15855] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 863.497990][ T5950] usb 9-1: new high-speed USB device number 62 using dummy_hcd [ 863.519773][T15855] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 863.537905][T15855] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 863.551641][T15855] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 863.591746][T15977] input: syz1 as /devices/virtual/input/input35 [ 863.663653][ T5950] usb 9-1: unable to get BOS descriptor or descriptor too short [ 863.683623][ T5950] usb 9-1: config 127 has an invalid interface number: 144 but max is 0 [ 863.702567][ T5950] usb 9-1: config 127 has no interface number 0 [ 863.716968][T15855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 863.724098][ T5950] usb 9-1: config 127 interface 144 has no altsetting 0 [ 863.746800][ T5950] usb 9-1: New USB device found, idVendor=0675, idProduct=1688, bcdDevice=83.f4 [ 863.763872][ T5950] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.793460][T15855] 8021q: adding VLAN 0 to HW filter on device team0 [ 863.807663][ T5950] usb 9-1: Product: syz [ 863.820877][ T5950] usb 9-1: Manufacturer: syz [ 863.836308][ T5950] usb 9-1: SerialNumber: syz [ 863.848292][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 863.855469][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 863.876723][ T1134] bridge0: port 2(bridge_slave_1) entered blocking state [ 863.884004][ T1134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 863.991135][ T5818] Bluetooth: hci4: command 0x0405 tx timeout [ 864.071653][ T5950] HFC-S_USB 9-1:127.144: probe with driver HFC-S_USB failed with error -5 [ 864.094769][ T5950] usb 9-1: USB disconnect, device number 62 [ 864.188898][T15982] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 864.202813][T15982] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 864.773881][ T5914] usbhid 2-1:0.0: can't add hid device: -71 [ 864.781176][ T5914] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 864.804879][ T5914] usb 2-1: USB disconnect, device number 76 [ 865.201597][T15988] FAULT_INJECTION: forcing a failure. [ 865.201597][T15988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 865.303571][T15986] bio_check_eod: 14 callbacks suppressed [ 865.303584][T15986] syz.1.2840: attempt to access beyond end of device [ 865.303584][T15986] loop1: rw=0, sector=64, nr_sectors = 2 limit=0 [ 865.322355][T15986] isofs_fill_super: bread failed, dev=loop1, iso_blknum=16, block=32 [ 865.373019][T15988] CPU: 1 UID: 0 PID: 15988 Comm: syz.6.2841 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 865.373049][T15988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 865.373060][T15988] Call Trace: [ 865.373066][T15988] [ 865.373074][T15988] dump_stack_lvl+0x16c/0x1f0 [ 865.373101][T15988] should_fail_ex+0x512/0x640 [ 865.373120][T15988] _copy_from_user+0x2e/0xd0 [ 865.373137][T15988] copy_msghdr_from_user+0x98/0x160 [ 865.373150][T15988] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 865.373170][T15988] ___sys_sendmsg+0xfe/0x1d0 [ 865.373182][T15988] ? __pfx____sys_sendmsg+0x10/0x10 [ 865.373211][T15988] __sys_sendmsg+0x16d/0x220 [ 865.373224][T15988] ? __pfx___sys_sendmsg+0x10/0x10 [ 865.373241][T15988] ? rcu_is_watching+0x12/0xc0 [ 865.373260][T15988] do_syscall_64+0xcd/0x260 [ 865.373278][T15988] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 865.373290][T15988] RIP: 0033:0x7f63d4d8e969 [ 865.373300][T15988] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 865.373311][T15988] RSP: 002b:00007f63d2bf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 865.373322][T15988] RAX: ffffffffffffffda RBX: 00007f63d4fb5fa0 RCX: 00007f63d4d8e969 [ 865.373330][T15988] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000005 [ 865.373337][T15988] RBP: 00007f63d2bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 865.373343][T15988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 865.373349][T15988] R13: 0000000000000000 R14: 00007f63d4fb5fa0 R15: 00007ffd335c3948 [ 865.373363][T15988] [ 865.591659][T15855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 866.330436][ T5867] usb 1-1: new full-speed USB device number 34 using dummy_hcd [ 866.338462][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 866.338477][ T30] audit: type=1400 audit(1747953780.621:3026): avc: denied { read write } for pid=16013 comm="syz.1.2849" name="usbmon6" dev="devtmpfs" ino=734 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 866.402881][ T30] audit: type=1400 audit(1747953780.621:3027): avc: denied { open } for pid=16013 comm="syz.1.2849" path="/dev/usbmon6" dev="devtmpfs" ino=734 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 866.686290][T16023] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 866.707087][T16023] IPVS: set_ctl: invalid protocol: 255 10.1.1.1:19999 [ 866.763767][ T30] audit: type=1400 audit(1747953781.111:3028): avc: denied { checkpoint_restore } for pid=16013 comm="syz.1.2849" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 866.786651][ T30] audit: type=1400 audit(1747953781.111:3029): avc: denied { create } for pid=16013 comm="syz.1.2849" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 866.804247][T15855] veth0_vlan: entered promiscuous mode [ 866.818932][T15855] veth1_vlan: entered promiscuous mode [ 866.828905][ T5867] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 866.840377][ T5867] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 866.854221][ T5867] usb 1-1: Product: syz [ 866.863617][ T5867] usb 1-1: Manufacturer: syz [ 866.874658][ T5867] usb 1-1: SerialNumber: syz [ 866.886039][ T5867] usb 1-1: config 0 descriptor?? [ 866.892676][T15855] veth0_macvtap: entered promiscuous mode [ 866.908826][T15855] veth1_macvtap: entered promiscuous mode [ 866.929693][T15855] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 866.957197][T15855] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 866.975306][T15855] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.118348][T15855] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.128334][T15855] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.129121][T16026] FAULT_INJECTION: forcing a failure. [ 867.129121][T16026] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 867.137223][ T30] audit: type=1400 audit(1747953781.591:3030): avc: denied { shutdown } for pid=16025 comm="syz.8.2851" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 867.137327][T15855] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.160597][T16026] CPU: 1 UID: 0 PID: 16026 Comm: syz.8.2851 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 867.160622][T16026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 867.160632][T16026] Call Trace: [ 867.160638][T16026] [ 867.160646][T16026] dump_stack_lvl+0x16c/0x1f0 [ 867.160674][T16026] should_fail_ex+0x512/0x640 [ 867.160701][T16026] _copy_from_user+0x2e/0xd0 [ 867.160725][T16026] move_addr_to_kernel+0x65/0x170 [ 867.160751][T16026] __sys_connect+0xaf/0x170 [ 867.160766][T16026] ? __pfx___sys_connect+0x10/0x10 [ 867.160789][T16026] ? __pfx_ksys_write+0x10/0x10 [ 867.160811][T16026] ? rcu_is_watching+0x12/0xc0 [ 867.160835][T16026] __x64_sys_connect+0x72/0xb0 [ 867.160849][T16026] ? lockdep_hardirqs_on+0x7c/0x110 [ 867.160871][T16026] do_syscall_64+0xcd/0x260 [ 867.160895][T16026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 867.160912][T16026] RIP: 0033:0x7fa12498e969 [ 867.160927][T16026] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 867.160943][T16026] RSP: 002b:00007fa1258c4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 867.160959][T16026] RAX: ffffffffffffffda RBX: 00007fa124bb5fa0 RCX: 00007fa12498e969 [ 867.160970][T16026] RDX: 000000000000000a RSI: 0000200000000000 RDI: 0000000000000004 [ 867.160979][T16026] RBP: 00007fa1258c4090 R08: 0000000000000000 R09: 0000000000000000 [ 867.160989][T16026] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 867.160999][T16026] R13: 0000000000000000 R14: 00007fa124bb5fa0 R15: 00007ffc691143a8 [ 867.161020][T16026] [ 867.437698][ T30] audit: type=1400 audit(1747953781.891:3031): avc: denied { create } for pid=16027 comm="syz.8.2852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 867.522095][ T30] audit: type=1400 audit(1747953781.891:3032): avc: denied { write } for pid=16027 comm="syz.8.2852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 867.553916][ T30] audit: type=1400 audit(1747953781.951:3033): avc: denied { write } for pid=16027 comm="syz.8.2852" path="socket:[67007]" dev="sockfs" ino=67007 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 867.554336][ T5867] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 867.660767][ T5950] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 867.836923][ T5950] usb 7-1: New USB device found, idVendor=08fd, idProduct=0002, bcdDevice=ca.fd [ 867.851837][ T6137] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 867.860833][ T5950] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 867.868892][ T5950] usb 7-1: Product: syz [ 867.873247][ T6137] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 867.888504][ T5950] usb 7-1: Manufacturer: syz [ 867.904805][ T5950] usb 7-1: SerialNumber: syz [ 867.937726][ T2976] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 867.946692][ T5950] usb 7-1: config 0 descriptor?? [ 867.954316][ T2976] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 867.971029][ T5817] Bluetooth: hci5: urb ffff8880650d4500 submission failed (2) [ 868.100471][ T30] audit: type=1400 audit(1747953782.541:3034): avc: denied { open } for pid=16036 comm="syz.1.2855" path="/dev/ttyq6" dev="devtmpfs" ino=381 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 868.333118][T16030] xt_l2tp: v2 tid > 0xffff: 4294967295 [ 868.344785][ T5914] usb 7-1: USB disconnect, device number 25 [ 973.340538][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 973.347534][ C1] rcu: 0-...!: (0 ticks this GP) idle=8bd4/1/0x4000000000000000 softirq=100192/100192 fqs=0 [ 973.359023][ C1] rcu: (detected by 1, t=10502 jiffies, g=77681, q=561 ncpus=2) [ 973.366765][ C1] Sending NMI from CPU 1 to CPUs 0: [ 973.366798][ C0] NMI backtrace for cpu 0 [ 973.366812][ C0] CPU: 0 UID: 0 PID: 16007 Comm: syz.0.2847 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 973.366833][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 973.366843][ C0] RIP: 0010:hlock_class+0x13/0x70 [ 973.366873][ C0] Code: 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f b7 47 20 66 25 ff 1f 0f b7 c0 48 0f a3 05 5d 56 13 14 <73> 15 48 8d 04 80 48 8d 04 80 48 8d 04 c5 60 0f ab 95 e9 c6 63 d8 [ 973.366890][ C0] RSP: 0018:ffffc90000007be8 EFLAGS: 00000007 [ 973.366904][ C0] RAX: 0000000000000071 RBX: 0000000000000002 RCX: 0000000000000002 [ 973.366914][ C0] RDX: 0000000000000040 RSI: 0000000000000002 RDI: ffff888029712f58 [ 973.366924][ C0] RBP: ffff888029712f30 R08: 0000000000080000 R09: 0000000000000001 [ 973.366935][ C0] R10: 0000000000000000 R11: ffffffff9ada6fa0 R12: 0000000000000001 [ 973.366945][ C0] R13: 0000000000000002 R14: ffff888029712440 R15: 0000000000000000 [ 973.366955][ C0] FS: 00007f4840ade6c0(0000) GS:ffff8881249da000(0000) knlGS:0000000000000000 [ 973.366972][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 973.366983][ C0] CR2: 0000001b30a10ff8 CR3: 000000007b9e7000 CR4: 00000000003526f0 [ 973.366993][ C0] Call Trace: [ 973.367001][ C0] [ 973.367007][ C0] __lock_acquire+0x2b6/0x1ba0 [ 973.367036][ C0] lock_acquire+0x179/0x350 [ 973.367057][ C0] ? debug_object_deactivate+0x135/0x3a0 [ 973.367075][ C0] ? do_raw_spin_unlock+0x172/0x230 [ 973.367093][ C0] _raw_spin_lock_irqsave+0x3a/0x60 [ 973.367114][ C0] ? debug_object_deactivate+0x135/0x3a0 [ 973.367130][ C0] debug_object_deactivate+0x135/0x3a0 [ 973.367144][ C0] ? __pfx_debug_object_activate+0x10/0x10 [ 973.367160][ C0] ? __pfx_debug_object_deactivate+0x10/0x10 [ 973.367177][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 973.367196][ C0] __hrtimer_run_queues+0x46f/0xad0 [ 973.367217][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 973.367233][ C0] ? read_tsc+0x9/0x20 [ 973.367254][ C0] ? rcu_is_watching+0x12/0xc0 [ 973.367275][ C0] hrtimer_interrupt+0x397/0x8e0 [ 973.367297][ C0] __sysvec_apic_timer_interrupt+0x108/0x3f0 [ 973.367317][ C0] sysvec_apic_timer_interrupt+0x9f/0xc0 [ 973.367337][ C0] [ 973.367343][ C0] [ 973.367348][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 973.367367][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 973.367387][ C0] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 b6 53 28 f6 48 89 df e8 5e a7 28 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 b5 13 19 f6 65 8b 05 fe 93 34 08 85 c0 74 16 5b [ 973.367402][ C0] RSP: 0018:ffffc90004437a30 EFLAGS: 00000246 [ 973.367414][ C0] RAX: 0000000000000006 RBX: ffff88804bcff088 RCX: ffffffff81c3097f [ 973.367424][ C0] RDX: 0000000000000000 RSI: ffffffff8dbe4615 RDI: ffffffff8bf4a2e0 [ 973.367434][ C0] RBP: 0000000000000287 R08: 0000000000000001 R09: 0000000000000001 [ 973.367444][ C0] R10: ffffffff90852e17 R11: 0000000000000000 R12: dffffc0000000000 [ 973.367455][ C0] R13: 1a1ed03aa0067304 R14: 1841f9ea28d0df04 R15: ffff88804bcff088 [ 973.367468][ C0] ? trace_irq_enable.constprop.0+0x2f/0x120 [ 973.367489][ C0] timerfd_clock_was_set+0x164/0x310 [ 973.367508][ C0] clock_was_set+0x678/0x870 [ 973.367527][ C0] ? __pfx_clock_was_set+0x10/0x10 [ 973.367544][ C0] ? rcu_is_watching+0x12/0xc0 [ 973.367561][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 973.367581][ C0] timekeeping_inject_offset+0x2e3/0x3f0 [ 973.367603][ C0] ? __pfx_timekeeping_inject_offset+0x10/0x10 [ 973.367625][ C0] ? bpf_lsm_capable+0x9/0x10 [ 973.367639][ C0] ? security_capable+0x7e/0x260 [ 973.367658][ C0] do_adjtimex+0x36f/0xaa0 [ 973.367681][ C0] ? __pfx_do_adjtimex+0x10/0x10 [ 973.367711][ C0] ? __pfx_posix_clock_realtime_adj+0x10/0x10 [ 973.367734][ C0] __do_sys_clock_adjtime+0x172/0x290 [ 973.367757][ C0] ? __pfx___do_sys_clock_adjtime+0x10/0x10 [ 973.367779][ C0] ? __pfx_do_futex+0x10/0x10 [ 973.367807][ C0] ? rcu_is_watching+0x12/0xc0 [ 973.367826][ C0] ? rcu_is_watching+0x12/0xc0 [ 973.367844][ C0] do_syscall_64+0xcd/0x260 [ 973.367873][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 973.367889][ C0] RIP: 0033:0x7f483fb8e969 [ 973.367903][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 973.367917][ C0] RSP: 002b:00007f4840ade038 EFLAGS: 00000246 ORIG_RAX: 0000000000000131 [ 973.367931][ C0] RAX: ffffffffffffffda RBX: 00007f483fdb5fa0 RCX: 00007f483fb8e969 [ 973.367941][ C0] RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000000 [ 973.367951][ C0] RBP: 00007f483fc10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 973.367961][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 973.367971][ C0] R13: 0000000000000000 R14: 00007f483fdb5fa0 R15: 00007fff32663ee8 [ 973.367987][ C0] [ 973.368791][ C1] rcu: rcu_preempt kthread starved for 10502 jiffies! g77681 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 973.864249][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 973.874215][ C1] rcu: RCU grace-period kthread stack dump: [ 973.880115][ C1] task:rcu_preempt state:R running task stack:27304 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 [ 973.893652][ C1] Call Trace: [ 973.896943][ C1] [ 973.899887][ C1] __schedule+0x116f/0x5de0 [ 973.904411][ C1] ? __lock_acquire+0x5ca/0x1ba0 [ 973.909362][ C1] ? __pfx___schedule+0x10/0x10 [ 973.914220][ C1] ? find_held_lock+0x2b/0x80 [ 973.918899][ C1] ? schedule+0x2d7/0x3a0 [ 973.923234][ C1] schedule+0xe7/0x3a0 [ 973.927309][ C1] schedule_timeout+0x123/0x290 [ 973.932162][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 973.937535][ C1] ? __pfx_process_timeout+0x10/0x10 [ 973.942840][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 973.948663][ C1] ? prepare_to_swait_event+0xf5/0x480 [ 973.954136][ C1] rcu_gp_fqs_loop+0x1ea/0xb00 [ 973.958912][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 973.964203][ C1] ? rcu_gp_init+0xc76/0x15a0 [ 973.968891][ C1] ? rcu_gp_cleanup+0x7c1/0xd90 [ 973.973774][ C1] rcu_gp_kthread+0x270/0x380 [ 973.978459][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 973.983667][ C1] ? rcu_is_watching+0x12/0xc0 [ 973.988447][ C1] ? lockdep_hardirqs_on+0x7c/0x110 [ 973.993660][ C1] ? __kthread_parkme+0x19e/0x250 [ 973.998693][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 974.003896][ C1] kthread+0x3c2/0x780 [ 974.007963][ C1] ? __pfx_kthread+0x10/0x10 [ 974.012550][ C1] ? __pfx_kthread+0x10/0x10 [ 974.017226][ C1] ? __pfx_kthread+0x10/0x10 [ 974.021856][ C1] ? __pfx_kthread+0x10/0x10 [ 974.026462][ C1] ? rcu_is_watching+0x12/0xc0 [ 974.031236][ C1] ? __pfx_kthread+0x10/0x10 [ 974.035826][ C1] ret_from_fork+0x45/0x80 [ 974.040247][ C1] ? __pfx_kthread+0x10/0x10 [ 974.044844][ C1] ret_from_fork_asm+0x1a/0x30 [ 974.049633][ C1] [ 974.052650][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 974.058969][ C1] CPU: 1 UID: 0 PID: 2976 Comm: kworker/u8:7 Not tainted 6.15.0-rc7-syzkaller-00014-gd608703fcdd9 #0 PREEMPT(full) [ 974.071133][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 974.081214][ C1] Workqueue: events_unbound toggle_allocation_gate [ 974.087746][ C1] RIP: 0010:smp_call_function_many_cond+0x4a5/0x1290 [ 974.094450][ C1] Code: 89 ee e8 de 12 0c 00 85 ed 74 48 48 8b 44 24 20 49 89 c4 83 e0 07 49 c1 ec 03 48 89 c5 4d 01 f4 83 c5 03 e8 7d 17 0c 00 f3 90 <41> 0f b6 04 24 40 38 c5 7c 08 84 c0 0f 85 de 0b 00 00 8b 43 08 31 [ 974.114075][ C1] RSP: 0018:ffffc9000bc17938 EFLAGS: 00000293 [ 974.120156][ C1] RAX: 0000000000000000 RBX: ffff8880b8441720 RCX: ffffffff81af2e99 [ 974.128127][ C1] RDX: ffff888030fd8000 RSI: ffffffff81af2e73 RDI: 0000000000000005 [ 974.136094][ C1] RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000 [ 974.144065][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed10170882e5 [ 974.152030][ C1] R13: 0000000000000001 R14: dffffc0000000000 R15: ffff8880b853b040 [ 974.160012][ C1] FS: 0000000000000000(0000) GS:ffff888124ada000(0000) knlGS:0000000000000000 [ 974.168960][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 974.175549][ C1] CR2: 000000110c336052 CR3: 000000000e180000 CR4: 00000000003526f0 [ 974.183533][ C1] Call Trace: [ 974.186819][ C1] [ 974.189766][ C1] ? __pfx_do_sync_core+0x10/0x10 [ 974.194806][ C1] on_each_cpu_cond_mask+0x40/0x90 [ 974.199927][ C1] text_poke_bp_batch+0x220/0x760 [ 974.204982][ C1] ? __pfx_text_poke_bp_batch+0x10/0x10 [ 974.210533][ C1] ? __jump_label_patch+0x1db/0x400 [ 974.215744][ C1] ? arch_jump_label_transform_queue+0xc0/0x120 [ 974.221991][ C1] ? find_held_lock+0x2b/0x80 [ 974.226674][ C1] text_poke_finish+0x30/0x40 [ 974.231353][ C1] arch_jump_label_transform_apply+0x1c/0x30 [ 974.237336][ C1] jump_label_update+0x376/0x550 [ 974.242273][ C1] static_key_disable_cpuslocked+0x158/0x1c0 [ 974.248250][ C1] static_key_disable+0x1a/0x20 [ 974.253096][ C1] toggle_allocation_gate+0x145/0x280 [ 974.258478][ C1] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 974.264373][ C1] ? rcu_is_watching+0x12/0xc0 [ 974.269142][ C1] process_one_work+0x9cf/0x1b70 [ 974.274090][ C1] ? __pfx_process_one_work+0x10/0x10 [ 974.279476][ C1] ? assign_work+0x1a0/0x250 [ 974.284090][ C1] worker_thread+0x6c8/0xf10 [ 974.288695][ C1] ? __pfx_worker_thread+0x10/0x10 [ 974.293803][ C1] kthread+0x3c2/0x780 [ 974.297869][ C1] ? __pfx_kthread+0x10/0x10 [ 974.302461][ C1] ? __pfx_kthread+0x10/0x10 [ 974.307045][ C1] ? __pfx_kthread+0x10/0x10 [ 974.311652][ C1] ? __pfx_kthread+0x10/0x10 [ 974.316252][ C1] ? rcu_is_watching+0x12/0xc0 [ 974.321023][ C1] ? __pfx_kthread+0x10/0x10 [ 974.325611][ C1] ret_from_fork+0x45/0x80 [ 974.330026][ C1] ? __pfx_kthread+0x10/0x10 [ 974.334612][ C1] ret_from_fork_asm+0x1a/0x30 [ 974.339393][ C1]