last executing test programs: 2m52.88530461s ago: executing program 1 (id=367): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffd2a9dc6da626c0e21677ffaaaaaaaaaa2b86dd6700000100513afffe880000000000000000000000000201ff02000000000000000000000000000189009078000000002001000000000000000000000001fe800000000000000000000000000038220560aeb59d3fb13258c6f29dd7eed9c5aaa04a18f74d2a89000000000000"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = mq_open(&(0x7f0000000000)='e_1\x00', 0x8c2, 0x30, &(0x7f0000000080)={0x0, 0x4, 0x4, 0x1}) mq_timedsend(r2, 0x0, 0x0, 0x5, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000000c0)={0x18}) mq_timedreceive(r2, &(0x7f0000000140)=""/139, 0x8b, 0x0, &(0x7f0000000200)={0x77359400}) creat(&(0x7f00000001c0)='./file0\x00', 0x16c) r4 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x1) ioctl$TCSETA(r4, 0x8925, &(0x7f0000000100)={0x2, 0x0, 0x1, 0xffff, 0x13, "31f40000f7ece2f4"}) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ZERO(r5, 0x0, 0x48f, &(0x7f0000000740)={0x11, @multicast2, 0x4e24, 0x4, 'wrr\x00', 0x39, 0x7ff, 0x22}, 0x2c) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240), 0x0, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r7 = openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) write$UHID_CREATE2(r7, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r7, 0x1000) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read(r1, 0x0, 0x0) add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) close_range(r6, 0xffffffffffffffff, 0x0) 2m50.477318731s ago: executing program 1 (id=379): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) prctl$PR_GET_TID_ADDRESS(0x28, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x10004, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,use', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0xc000, &(0x7f0000000040)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000080)) writev(r2, &(0x7f0000000800)=[{&(0x7f0000000700)="ebfa0e81ceb3dc4c43c215dc4dade38ff8c84ace9d15af003afa41ae5fbebe5b175c12cf29c48c2d4b61ce76443645c1dc73113beeb9b5a73cd0415b0437839aa6c68111a4582c3a6a3bb8f9e0c37b9b3f386c", 0x53}], 0x1) r3 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r3, &(0x7f0000000000)=[{0x0, 0x47, 0x0, 0x0, @time={0xd9, 0x7}, {0x40, 0xff}, {0x0, 0x9}, @queue={0xee, {0x7, 0xc9a}}}, {0x0, 0x0, 0x0, 0x0, @time={0x367f, 0xfffffffd}, {}, {0x4}, @connect={{0x40, 0x7}, {0x80, 0xf6}}}], 0x38) ioctl$SG_GET_NUM_WAITING(r3, 0x227d, &(0x7f0000000380)) 2m50.145710464s ago: executing program 1 (id=381): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010bd287100000000000001090224000100000000090401000103000000092102000001220500090581"], 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r0}, 0x18) timer_create(0x0, 0x0, &(0x7f0000000280)) timer_getoverrun(0x0) pread64(0xffffffffffffffff, &(0x7f00000001c0)=""/200, 0xc8, 0x0) lseek(0xffffffffffffffff, 0x42, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="24000000cab2170ccc36c84e6bfed490668076fa837d7696f8a59af12096e5b1cb30", @ANYRES16=r2, @ANYBLOB="03002dbd70000000000003000000100001800b0001006574683a6c6f0000"], 0x24}}, 0x4044844) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x1) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x1000d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3c}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r3, 0x8b0f, &(0x7f0000000040)) 2m46.997225532s ago: executing program 1 (id=395): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x800) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000066000000004b64ffec850000006d000000c50000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x0, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001200)=ANY=[@ANYBLOB="020000000400000008000000c877de09996cd86e", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r6}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001100)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x101}, 0x94) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$FBIOPUT_VSCREENINFO(r7, 0x4601, &(0x7f0000000040)={0x191, 0x78, 0xa0, 0x3f, 0x32, 0x1c0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x1, 0x1, 0x0, 0xfffffffd, 0x0, 0x8, 0x4, 0x0, 0x2, 0xa}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@map=r0, 0x24, 0x0, 0x5, &(0x7f0000000440)=[0x0], 0x3ffffe70, 0x0, 0x0, 0x0, 0x0}, 0x40) 2m45.846879002s ago: executing program 1 (id=403): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001140)=ANY=[@ANYRESDEC=r0, @ANYBLOB="67a3ac5f0f1448e6436bbd93056a288fe09aa92f608d18f2a28c5d8ebc847d49591f3832b7eb7b5659f208b1d89269995e03731ffa4291436c84e17aca841dc3d08dc61a8b53f9f122517be525fdeeb9a339dc9fe8266b3e09167b94fabf87893b241ca6b47506d67ae272e6bb3270ee8a24266ad62adb1ed1e9a1fadc36ffa55c5604003dc1d3e32f734cc5e267b8284d8b0bbf9a8492f0cb6c3d69bf25abbfe1ac6d49dd12a64676577cc39fb6b5491605193e651b8b598bed89486d081907e220a26a58c24d3684cdcf1394eb7af3ff03c87ba500dd0479dead80b92bd917c3e63548753150c2346e5318c523a42f603bf59d71e1b1acffdeb9f81d3d9e79d2b35b2d76702cd8c9946275c7621600a224d136c5eac2b2356aa10a9accd2108d0c3ad71ea59117f037bbd2969bf6da7285646cb1b6988181691307ba4661e0e2a7645c62fb0aa2277742feb7481bef935a085e10e531a72e701e75b90cea5a88ec24b3bb5def64d12761eeed61b4db93415f4334c0b25174139bd3c191fc8a86bdeb41688b76e1b4412aa9dcb350d91a85537fde664361a6a6304c45443030401826769b4680ead96f648a092f199b14ecaa25c626e4744c84d849cd085d232be236f5f95649f7e7b2c9233399dd9a96d57d4c3f35a5b0f6920440118dd6f8b3aff1259a0f454440f0056d48ff0e9442deb8c579f0b7dfb8a52aed6250dda2dc27e2bfdfaa52c1b7b257b9d82346112a973a467af266ed4081e7a89c987ed00c263c5eae995e3a6df706914ee86934005e157d4abd09beeee387c784db6ebc2e28505b0c463a7acff8e0ce0b22dea63c632d8a2107ad94e48dee19fdc6e6829340ba187358cb7513ec0424dfe29bcaf4311b8541d34f91f02fb61d736bab0dfbcc74162eb0170c437cc473662a2b5b8ef9dce683f9cfe36595bcf52efa762067e1a0ded2d75865b3228c564a34fed3691db80f9d0684890155045e4a90b954bf31925e9bcdfc5e56bf6b947c3df6e747524c0d20d4751ae089ada559333f39f19bd5bb0e1219d5234258e7a7c9b62383bf6e8ca92cff10b07e5ac593f4beef40af2896d720372d363468c9a31799f3a8f56548db6a03deae40fac4c1f12a2931cc019209c829ebba0f957b94178c7ed3d4a1e15e8b9ed8191b78bfbc28ff2c1b35a68baf9a803d2d41fc4cea290bcff723c5c23cbef2395888f1fd0ca99bb15a9890a4fb4de077284703b57c14c688a764768003350a00dfb5f79ef0b2f229d72f08392bd2eb40c8ab014cb96a451d92603826cdc731987657837ebac80b0e02f2553ee18e9cf65ba794733d49e90a7b7040b0c3047f86d6d2974662348e86c08ed0736c8c6b56b16244f2bffe6c4c961f74c71f4e1e7071f2922c2679c87da43293b59897b5295c0b338959aa0d5abf441bb3215273bf7c548f9e2cd8f9f63ca9360ad32a17d980140863f4ac90d2dbead5eebcbc9484b20f7e36d2003bc5d5deeb5e9e2462ea9078632e5e9e8cc1feaf1940c8af781f7ebf50a7096a0f3f2dc5f93bf0a4cfdfc81e89c1becabc420bd4fb1f7b667a38e2572f5e9dc7cce7f6dae3a56c8f7fa9ebb041c92152bac54894de0a97623a20f810f0a04dfbe4d2afe3c22419617078f8e546458659e7f387ecac53f73491d9235073862727267446e3bb456c0741009156268ea1986e4871307d77468f22818449c1923923cc7c4a3588b3088f799273daf67628fefe82b8db141147bc1e5b85677fb75d6b0c67180a36a377365b62ec3666f95751d45776811817af677a1abf18006184d0cb743c5f22ed8b79b827e108aad9d22aac6313f4b9d41057b3182f847353f3ad0150046e4971bcb81aeb431da3fa74c8e8831722ec0b33133f43743e1dbd619ed87d5cd46a2752e1849c62d7a7f871c08e93ff9b51a368f0b5805d22e31db67cbafcf2336ad33fb294b06d4b21d37637bb74dd5b22be10706d2eeae67403bb4b7bec924a27e8d3c04ef5308e8c84b7da79b7a750c420b0b839899470a4036d858603292e785bee7872be1b1f9d5daf33f71e970ca5f7035e419a89835432383c4ac8e001d479c426064bc887fe3ea6ffac74e1c1b58be9139059476a78e6291b27d6b2c1153fe433fce60786b43822a3889ec75131046ba8cfd1ba70b520c1625fd649ccbffaa54b5ed5c2538b3dab6eda46e47c0fe6f20b008ef9794f0d0e61b16cf2e46825607bad657a7376335160fa9770793568c0da298cddd649c9743d458db6abd884a3e93d9b4ea7c877686ff897c177888b7ac6a000f0f275d3d16ab6cb3d36a624cd7fc935946685d8c9464f96e7c722278fd43646c0ec82f3d3b1fc9153c9bac1e3725bfea64e14d3a2480c7a9bab8bef974be0ccb5803596efc619a67ca18cb5c47f9702a81d3163ce2ac892d7244df3c268b154164b7d3a257b1aedf97bb1128683082c4acb4d7585f202935dbf0c6cdcff46ff5cb9284c398ad25b57a3e6cfed5a8c883e8eb0fe40100eafc35e140d73750d1f377a0ddc604917cf8283969d0cada96128e0ff56b92faad007c7430689c7cce31e84e5c46178ea257b6c3018766c9d7368eff0770b0ce4694806f6afe17fd733cdfa2bd49e5ec813a2a71dad9e1b3d16c243cfa01a4894bc0ecfc288ec1d03fcb34e084c4733e334f6e465140432ee82099bcc48fe7dcecabff60ab67c8198f8ba08b97985cb9654043139dee0aabf7a6363e7f6bcbc3514b43fd5eed523b5cf3cc40c75717ac5694e05d3ddd01ce742a45d79a6567d5a1942ce45f5a579fff4258c3ae7df8827bac642f88da656191ea0381ef371e1f0f8491c3ac182f4b1f313bfce09c101de94dd84a7df2c2af5778de83ddf26b24179ac1cc4968727e320f9e3921e84c61337dd3bba0385e534293ed4d8bc0f5767afdb277a9afc4d4732e57d13379303f88bd2db41082c8f13956a1dc38bc40eeccbe731f81a2b06c5e5dde1d6199233e2962b5e45dae3dd65dfb981334d7827fc9064d3ab88556eedf787776390037a1fde88cec967d34bf3c6503f8cb4ba2179c8b106cb581f05c1e7fc59a8daa9afeac0af281b6b322ae7126c313b0bda7f6207cd3a99f9b909379d50ad2c5b340249ebc08cc478d712be0476043b74e56a1187e1d7914da4711dd83419304a110d48974fe8f313746faf945baa64042e2f1e0e81e86a8862dd9cd90b232bf2a56e7243c104dd1d34ddf2574127927151ce7c7a4068733f2b0cf7abf8c37f2da64059be1b38d188161f298c3e2b4660484c59eb5c2b2e7c6b363a4b74bc0ffd382945612b8d3a011d057a92fd32f3992a9696554ade471d08738e6f4e9369fc15966a436fce00e574b88f04748de01629a0e2a5f53f6bb950f0fc9c59c65d93968ff67e13fb71b736fed016d886ce1cc0ae4b26a5ccd4522fa02e124b3504ee2ca547f535e11e41c4bc782ad7ecd0b3e78e1933c7a5d7fcea0a5db40d9705da69a29205aeeae73815f720f9e1204d47a3c8be57ba8214b196db0e72537f5182a7c89e076c47eb968092f4277301622ec8e0d8088d5a9f70950d68699c1424ead0c583233fbbc74a322257003cf21ae7aeda83268396f2b241eaac2f1b4d9d04eb1737ca7f1446435b124f9b087169d5ab00599c8c602e760216144e18791326e86f061f2d54b9d5d38554db8392af80df28228e7d654fbcf6cef98d51cc3cb49a092b74d9f1be7448fdea1c578c728faf5710175f3365880c58d889e706ab64dd3dd8c0e1b043f09f85193b7132836cebfe3fd2a68d956e057d31b593ebbe6220b9391d02e6d401e24236992f0ec1c8fd19712e262dfb4a4889a2560bae0562e6ca2445910d80bbda50e9173540e47d016632f7d859733da702eea77145b151c2c3a6472583eae8fc89a15eb1e0340ba42190500d379f0a9b417af0801bdb0cdeb2a08731a8c5d29a7c1fd49bd820fe6a32cc505dd9b4815469bfa8ad694d4ee9f7c543b3470ec9c5ffee233456c1826efc9f19a21061ebb578ea84b538bc7be3f497a8858073a3e5b2aa6ff97c7e4255077e880897dc1bb26f5e5ffeaf8454ef516ce3925b83839ae8263ab4e33e8d8216836bdd4d31e98040a8e2dfd7b918d008152c4f31bc7ba736e417b42e66f4b1362834ec102dae26dad08df78030bb96315f6a5fe08fb274800f2fe88685e9f8b60e84fc4904dc7470b1842c990ad75f675ce0fc27137002d78d16e4ebc42f03c96f1a85fcc6d1abd7ed43de93d47b0df8e545f24a11a93c7719c72e406272ff0de94c13fad619892a9ced94b6ce61b1eb17c5312c7963c7146b52dc50cfc29af8e5682c09a5b0ddf8302d6ba1b289a0fc377a3b4511c9787463a1c9fbb1f116a84f7fc5c8f9a5a4d37241a385d8694a0d040b608da7e27da99f5e851867845bbbfc240325f008b04d1c47841e674e07d92abe43cfe20f3e0a709b521896322f7278f07a850ec46d4718418852e829a5bae1037f23918cfcd0dcb15448ac651829a5a28c7ea7be92bc84fc91c8544f63b8565688a5e500337bb55420a7010fe4b9bfddcfae9d85816d0d61fc243b1ff2232be876babe4cda5f8c09119e28ba2f707ebc1461af1fc8db60751d9050a26cdb8951cac8ec6656c5125e7661ffc0794cca8bd387b917276d2cacb3eca2822b382aeb33e8fbb85cbfc3cbfb567ecc7a22193df32d77c1ec696a7600e2b3b68cbf3d7775adc47f00c70f666d501fb3efd3f410d4ae83b8cc671cd5e67a4c73b4bdef7503afb1f52f46322421d7917c8bdb5d1243ff974223f8991f7a60244637fc422dcdc8f88a85d021b71fa41cd181d42a8897f8503678feb21d059f66802af4b62c38894ed3c45c6a4c984ad4562644d38314e10f4605e75492ea10c49059afd22a2200218d713c2b7e790f0aaa56e1415eee64c1986f92dab403a4fcf060519c52385232376ea8a8c2453ab2bd36768f0836a7a33e8d83426be0cbb6f8c3449cceedd0dd5756acf315a3838402d9940f7561f776124027530adfa61d96f1d8b62a6c623a2e97379d143338d59b393abd263537c470290d43ef64062dde34d7031665069e79997a804f62c511b67ffcd9c2733c7e6f56ee0bedf942cb2cabd418e65be658bf30e52e4a1648ec4c809e09026fdac93a1fcb33c6daf0384268a2a18f3fbc625e568f4a76704923bf3f1d646f367278d582b6fd8d58d12dbdceb84e65cea9c2c9abdc9f7b19b7917d2879747cf4312ef2a7369e0ed271b41f632b503311bbc48defa445d9aa52941f4b56d4d54f1309d1da8d84af9ce05e1184819f852ed073ffa2e02d2dcc9ad72b63d94117d747169f7e86ea30152d645778187a0f2cc733a00e693496b48d30cf2268e7294c958f6f13dba984ddf8d3e8ba2feb981b46f7aa8df67b73b2e1b5024fb0b686d90ae8bc9ba59899396e58c8be642333e1f3849ecfb616558e8dc05c4eb393177814266655f9ef9de0b3677e91094da38a60a2d434694d814ff90244797660ec6e14fe802d5c92e136b9ca1885ab893ceb6b9225f9e2972e1c59bcb26582e095bdb67e4fc8c1054b5823ffaf7f7c94da1cfbf2799c921c6bde77841d90c2c9231451628e30c7b285f6662a463a17ee772ba5265d38d95bc0e663ee3ffbc03d9332a9fee78589c4bf3acf98cb1b8e84a19e489e8ea1fc45a354b9b2dfe5ae0a377d7e07ecfd55fd32cd331a0120190579a0251adbfce9d3827be9838a9c4b9c8ff13b0d388763fb1ea7781d897ff5930a2a6e2200ac3f592394e8a22ac9fc8dd9fcdcde673c68aa7f18aed11653ec03ee", @ANYRESOCT, @ANYBLOB="0000000000000000000000000000000000000000320000000000000000000000000000000000000000000000000000000001000000000000000000e2591109060ead3fffffffa09483e14e7777bb03679844ffff000000000000000000000000000000000000000000000000e300000000000000fdffffffffffffff04000000000000000000000800000000000000000100000000000000000000000270bb99498bbafeacc6a7ca4238711000000000000000000000000a000000cd000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cb0d00001c0017000000000027bd700000000000"], 0x154}, 0x1, 0x0, 0x0, 0x40080}, 0x0) 2m45.520723267s ago: executing program 1 (id=405): socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x400, 0x20000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4}, {0x0, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad6000", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c"], 0x50}}, 0x20008844) r1 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x402, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3fd, 0x4000009, 0x200, 0xe2df, 0x9, 0x1, 0x4, 0x40000, 0x7, 0xf58, 0x6]}) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000000)={0x4000000, 0xffffffffffffffb6, 0x0, 0x1, 0x80000000}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000900)={'bridge0\x00', @remote}) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) sendmsg$NFT_MSG_GETOBJ_RESET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x20, 0x15, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40090}, 0x0) syz_emit_vhci(0x0, 0x47) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x89a1, &(0x7f0000000900)={'bridge0\x00', @broadcast}) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) setsockopt$sock_cred(r0, 0x1, 0x11, 0x0, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(md5)\x00'}, 0x58) r5 = accept$alg(r4, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) sendmmsg$sock(r5, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="ff", 0x1}], 0x1}}], 0x1, 0x4c015) accept(r5, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000540)={'bridge_slave_1\x00', 0x0}) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-arm)\x00'}, 0x58) 2m31.061595865s ago: executing program 0 (id=456): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14, 0x10, 0x1, 0xf5}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6, 0x1, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x0) 2m30.82918407s ago: executing program 0 (id=457): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) r2 = syz_open_procfs(r0, &(0x7f0000000000)='map_files\x00') fchdir(r2) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x6a) r3 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x400, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r3, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000200)=r1}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000500)={'batadv0\x00', 0x0}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001640)={r1, 0x20, &(0x7f0000001600)={&(0x7f00000005c0)=""/4096, 0x1000, 0x0, &(0x7f00000015c0)=""/58, 0x3a}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001940)={0x18, 0x2f, &(0x7f0000001680)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, [@generic={0x5, 0x5, 0x0, 0x0, 0x2691}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xe5}}, @snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @ringbuf_output, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}}]}, &(0x7f0000001800)='syzkaller\x00', 0x6, 0x27, &(0x7f0000001b00)=""/39, 0x41000, 0x61, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000001880)={0x1, 0x3}, 0x8, 0x10, &(0x7f00000018c0)={0x3, 0xe, 0xfffff287, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000001900)=[r2, r3], 0x0, 0x10, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x4, 0x10, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0xed, 0x0, 0x0, 0x0, 0x9}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @alu={0x7, 0x0, 0x2, 0x6, 0x2, 0xfffffffffffffff8, 0x1}, @call={0x85, 0x0, 0x0, 0x6d}, @tail_call={{0x18, 0x2, 0x1, 0x0, r8}}]}, &(0x7f0000000380)='syzkaller\x00', 0x80000001, 0xec, &(0x7f0000000400)=""/236, 0x41000, 0x20, '\x00', r9, @fallback=0x21, r1, 0x8, &(0x7f0000000540)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000580)={0x4, 0xa, 0x7fff, 0x3ff}, 0x10, r10, r2, 0x2, 0x0, &(0x7f0000001a00)=[{0x1, 0x4, 0x2, 0x4}, {0x3, 0x3, 0xb, 0x3}]}, 0x94) openat$vsock(0xffffffffffffff9c, &(0x7f0000001840), 0x8200, 0x0) io_uring_enter(r6, 0x47f6, 0x0, 0x2, 0x0, 0x300) getdents64(r3, 0x0, 0x0) 2m30.022155446s ago: executing program 32 (id=405): socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x400, 0x20000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4}, {0x0, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad6000", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c"], 0x50}}, 0x20008844) r1 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x402, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3fd, 0x4000009, 0x200, 0xe2df, 0x9, 0x1, 0x4, 0x40000, 0x7, 0xf58, 0x6]}) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000000)={0x4000000, 0xffffffffffffffb6, 0x0, 0x1, 0x80000000}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000900)={'bridge0\x00', @remote}) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) sendmsg$NFT_MSG_GETOBJ_RESET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x20, 0x15, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40090}, 0x0) syz_emit_vhci(0x0, 0x47) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x89a1, &(0x7f0000000900)={'bridge0\x00', @broadcast}) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) setsockopt$sock_cred(r0, 0x1, 0x11, 0x0, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(md5)\x00'}, 0x58) r5 = accept$alg(r4, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) sendmmsg$sock(r5, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="ff", 0x1}], 0x1}}], 0x1, 0x4c015) accept(r5, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000540)={'bridge_slave_1\x00', 0x0}) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-arm)\x00'}, 0x58) 2m28.839603179s ago: executing program 0 (id=462): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8005, 0x0, 0xe1, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="34000000000803000018000000000000000000000900010073797a30000000000600024088a80000050003000100000004000480"], 0x34}}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x4080}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x12}, 0x7}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000800000000000070000000900010073797a30000000007c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d38001280140001800c000100636f756e7465720004000280200001800e000100636f6e6e6c696d69740000000c000280080001400000000808000340000001"], 0xc4}}, 0x20050890) 2m26.673967265s ago: executing program 0 (id=467): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010028bd7000070000000200000008000100", @ANYRES32=r2], 0x1c}, 0x1, 0x200000000000000}, 0x8004) 2m25.842604978s ago: executing program 0 (id=470): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) accept4(r0, 0x0, 0x0, 0x800) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) eventfd2(0xe5c, 0x80000) eventfd2(0x4001, 0x800) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r5 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r4, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r5, @ANYRES32=r5], 0x44}}, 0x2000800) 2m25.392927602s ago: executing program 0 (id=472): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[], 0x48) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000180)={'8255\x00', [0x4f27, 0x1, 0x3, 0x4, 0x7, 0xcc9, 0xf, 0x1007, 0xa, 0xfffffffc, 0x2, 0x3, 0xfffffffe, 0x1001, 0x7, 0x101, 0xc, 0x1a449, 0x3, 0x40000003, 0x2, 0xcaa7, 0x6, 0x20001e58, 0x7, 0x63e, 0x13c, 0x8, 0x4, 0x8, 0xfffffff8]}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x141220, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40890}, 0x24008004) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSMRRU(r2, 0x4010744d, &(0x7f0000000080)=0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)={0x1b, 0x0, 0x0, 0x4, 0x0, r1, 0xcb2, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x5}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{0x1, 0xffffffffffffffff}, &(0x7f00000003c0), &(0x7f0000000400)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000500)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000480), &(0x7f00000004c0)}, 0x20) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000800)=0xffffffffffffffff, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000ac0)={0xffffffffffffffff, 0x20, &(0x7f0000000a80)={&(0x7f00000008c0)=""/194, 0xc2, 0x0, &(0x7f00000009c0)=""/132, 0x84}}, 0x10) r9 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000b00)={0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x1f, 0x2e, &(0x7f0000000540)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r6}}, @map_val={0x18, 0x7, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x4}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x8}, @call={0x85, 0x0, 0x0, 0xab}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x1}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000006c0)='GPL\x00', 0x7fffffff, 0xd9, &(0x7f0000000700)=""/217, 0x41000, 0x66, '\x00', 0x0, @fallback=0x1, r7, 0x8, &(0x7f0000000840)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000880)={0x9, 0xc, 0x0, 0x7fed}, 0x10, r8, r9, 0x2, 0x0, &(0x7f0000000b40)=[{0x1, 0x1, 0x7}, {0x5, 0x5, 0xa, 0xc}], 0x10, 0x81}, 0x94) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r10, 0xc0189436, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x9, 0x3}) sendmsg$L2TP_CMD_NOOP(r10, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, 0x0, 0x8, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xfe}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x6000}, 0x24040010) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x1c, 0x1, 0x2, 0x3, 0x0, 0x0, {0x7, 0x0, 0x4}, [@CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4001080) utimes(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={{}, {0x77359400}}) 2m10.314331474s ago: executing program 33 (id=472): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[], 0x48) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000180)={'8255\x00', [0x4f27, 0x1, 0x3, 0x4, 0x7, 0xcc9, 0xf, 0x1007, 0xa, 0xfffffffc, 0x2, 0x3, 0xfffffffe, 0x1001, 0x7, 0x101, 0xc, 0x1a449, 0x3, 0x40000003, 0x2, 0xcaa7, 0x6, 0x20001e58, 0x7, 0x63e, 0x13c, 0x8, 0x4, 0x8, 0xfffffff8]}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x141220, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40890}, 0x24008004) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSMRRU(r2, 0x4010744d, &(0x7f0000000080)=0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)={0x1b, 0x0, 0x0, 0x4, 0x0, r1, 0xcb2, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x5}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{0x1, 0xffffffffffffffff}, &(0x7f00000003c0), &(0x7f0000000400)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000500)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000480), &(0x7f00000004c0)}, 0x20) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000800)=0xffffffffffffffff, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000ac0)={0xffffffffffffffff, 0x20, &(0x7f0000000a80)={&(0x7f00000008c0)=""/194, 0xc2, 0x0, &(0x7f00000009c0)=""/132, 0x84}}, 0x10) r9 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000b00)={0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x1f, 0x2e, &(0x7f0000000540)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r6}}, @map_val={0x18, 0x7, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x4}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x8}, @call={0x85, 0x0, 0x0, 0xab}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x1}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000006c0)='GPL\x00', 0x7fffffff, 0xd9, &(0x7f0000000700)=""/217, 0x41000, 0x66, '\x00', 0x0, @fallback=0x1, r7, 0x8, &(0x7f0000000840)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000880)={0x9, 0xc, 0x0, 0x7fed}, 0x10, r8, r9, 0x2, 0x0, &(0x7f0000000b40)=[{0x1, 0x1, 0x7}, {0x5, 0x5, 0xa, 0xc}], 0x10, 0x81}, 0x94) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r10, 0xc0189436, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x9, 0x3}) sendmsg$L2TP_CMD_NOOP(r10, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, 0x0, 0x8, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xfe}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x6000}, 0x24040010) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x1c, 0x1, 0x2, 0x3, 0x0, 0x0, {0x7, 0x0, 0x4}, [@CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4001080) utimes(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={{}, {0x77359400}}) 1m1.285084073s ago: executing program 6 (id=772): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000040000000200"], 0x0, 0x34}, 0x28) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x800008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x494002, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) ptrace$ARCH_SHSTK_ENABLE(0x1e, r1, 0x4, 0x5001) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='syzkaller\x00', 0x8}, 0x94) 59.664591443s ago: executing program 6 (id=777): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x80001, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000400)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000040)="3b000000010002", 0x7) recvmmsg(r1, &(0x7f0000000180), 0x3, 0x60, 0x0) openat$kvm(0x0, &(0x7f0000000540), 0x183302, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x4800, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0xe) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x280000b, 0x11, r3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r8, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sendmmsg$sock(r8, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) 55.201490134s ago: executing program 6 (id=791): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mknodat$loop(0xffffffffffffff9c, 0x0, 0x20, 0x1) syz_open_dev$MSR(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r2 = syz_io_uring_setup(0x2c0, &(0x7f0000000580)={0x0, 0xec1e, 0x8, 0x40000001, 0x40000333}, &(0x7f0000000500)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r1, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x847ba, 0x2000, 0xe, 0x0, 0x0) 53.537365968s ago: executing program 6 (id=794): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffd2a9dc6da626c0e21677ffaaaaaaaaaa2b86dd6700000100513afffe880000000000000000000000000201ff02000000000000000000000000000189009078000000002001000000000000000000000001fe800000000000000000000000000038220560aeb59d3fb13258c6f29dd7eed9c5aaa04a18f74d2a89000000000000"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = mq_open(&(0x7f0000000000)='e_1\x00', 0x8c2, 0x30, &(0x7f0000000080)={0x0, 0x4, 0x4, 0x1}) mq_timedsend(r2, 0x0, 0x0, 0x5, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000000c0)={0x18}) mq_timedreceive(r2, &(0x7f0000000140)=""/139, 0x8b, 0x0, &(0x7f0000000200)={0x77359400}) creat(&(0x7f00000001c0)='./file0\x00', 0x16c) r4 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x1) ioctl$TCSETA(r4, 0x8925, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ZERO(r5, 0x0, 0x48f, &(0x7f0000000740)={0x11, @multicast2, 0x4e24, 0x4, 'wrr\x00', 0x39, 0x7ff, 0x22}, 0x2c) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240), 0x0, 0x0) r6 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) write$UHID_CREATE2(r6, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r6, 0x1000) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read(r1, 0x0, 0x0) add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 51.485924002s ago: executing program 6 (id=799): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b000000000000"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xf, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000900000000000000adb3000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014e16f00b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000840)='virtio_transport_alloc_pkt\x00', r1}, 0x18) r2 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r2, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) bind$vsock_stream(r2, &(0x7f0000000940), 0x10) listen(r2, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) writev(r3, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x20000081}], 0x1) 50.148886891s ago: executing program 6 (id=804): bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[], 0x48) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) getsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000000040), &(0x7f0000000200)=0x4) prlimit64(0x0, 0xe, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) bpf$MAP_CREATE(0x0, 0x0, 0x48) sigaltstack(&(0x7f0000000000)={0x0, 0x1}, &(0x7f0000000140)={&(0x7f0000000100)=""/12, 0x0, 0xc}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{}, &(0x7f0000000880), 0x0, 0x700}, 0x20) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = gettid() timer_create(0x9, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$int_in(r2, 0x5452, 0x0) recvmmsg(r2, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}, 0xffff}], 0x1, 0x2000, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, &(0x7f0000000280)) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f00000000c0)={'comedi_parport\x00', [0x8001, 0x6, 0x1, 0x0, 0x2, 0xcc7, 0x5, 0x7, 0x5, 0x100, 0x2, 0x1, 0x8, 0x4, 0x8006, 0xffffffff, 0x1, 0x1a449, 0x4, 0x40000003, 0x89, 0x22, 0xf27, 0x6, 0xb, 0x8, 0x5, 0x8, 0x4, 0x10000, 0xfffffff8]}) 34.952587778s ago: executing program 34 (id=804): bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[], 0x48) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) getsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000000040), &(0x7f0000000200)=0x4) prlimit64(0x0, 0xe, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) bpf$MAP_CREATE(0x0, 0x0, 0x48) sigaltstack(&(0x7f0000000000)={0x0, 0x1}, &(0x7f0000000140)={&(0x7f0000000100)=""/12, 0x0, 0xc}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{}, &(0x7f0000000880), 0x0, 0x700}, 0x20) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = gettid() timer_create(0x9, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$int_in(r2, 0x5452, 0x0) recvmmsg(r2, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}, 0xffff}], 0x1, 0x2000, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, &(0x7f0000000280)) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f00000000c0)={'comedi_parport\x00', [0x8001, 0x6, 0x1, 0x0, 0x2, 0xcc7, 0x5, 0x7, 0x5, 0x100, 0x2, 0x1, 0x8, 0x4, 0x8006, 0xffffffff, 0x1, 0x1a449, 0x4, 0x40000003, 0x89, 0x22, 0xf27, 0x6, 0xb, 0x8, 0x5, 0x8, 0x4, 0x10000, 0xfffffff8]}) 10.939144248s ago: executing program 4 (id=925): prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r0 = syz_open_dev$sndpcmp(&(0x7f0000000080), 0x1ff, 0x2000) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e21, 0xb, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xff}, 0x1c) ioctl$SNDRV_PCM_IOCTL_RESET(r0, 0x4141, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) socket$nl_generic(0x10, 0x3, 0x10) bind$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_delroute={0x2c, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x80, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @rand_addr=0x64010101}, @RTA_GATEWAY={0x8, 0x5, @empty}]}, 0x2c}}, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x6, &(0x7f0000000240)={0x12, {{0x29, 0x0, 0x36000000, @local}}}, 0x88) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$OSF_MSG_REMOVE(r1, &(0x7f0000000400)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000001680)={0x4bc, 0x1, 0x5, 0x5, 0x0, 0x0, {0x5}, [{{0x254, 0x1, {{0x0, 0xca6}, 0x5, 0x9, 0x8, 0x9, 0x8, 'syz1\x00', "994d2635813721b7a4822055af6dd02eb9b7f7d29249e0805566446e3a427bab", "7411e7ad989958fd4ef886e78677c7c10823efb84ad728fe1f7d376252a14771", [{0x9, 0x5, {0x3, 0x43e1b825}}, {0x5, 0xd29, {0x3, 0x9}}, {0x0, 0x3, {0x0, 0x6}}, {0x4718, 0x400, {0x2, 0xff}}, {0xfff, 0x4, {0x3, 0x5}}, {0x9, 0x58, {0x2, 0x5}}, {0xffff, 0x5, {0x0, 0xac}}, {0xff, 0x0, {0x1, 0xa}}, {0x8, 0x7de, {0x3, 0x5}}, {0x4, 0xa620, {0x3, 0x39d1}}, {0x400, 0x401, {0x2, 0x800}}, {0x8, 0x3, {0x3, 0x7}}, {0x5, 0xe, {0x1, 0x2}}, {0xa, 0x200, {0x3, 0x9}}, {0xcbee, 0xff29, {0x1, 0x800}}, {0x6, 0x8, {0x2, 0x9}}, {0x3, 0xff43, {0x2, 0x7fffffff}}, {0xa, 0x0, {0x1, 0x9}}, {0x6, 0xf, {0x0, 0x80000000}}, {0x8, 0x8000, {0x3, 0x7}}, {0xff6c, 0x5, {0x1}}, {0x7, 0x6, {0x0, 0x5}}, {0xfffd, 0x3, {0x0, 0x66}}, {0xffff, 0x9, {0x0, 0x4}}, {0x765, 0x101, {0x2, 0x81}}, {0x0, 0x75, {0x2, 0x80}}, {0x6, 0x7, {0x2, 0xc962}}, {0x2, 0x7, {0x0, 0x3}}, {0x85b, 0x0, {0x2, 0x8}}, {0xed7, 0x3, {0x1, 0x8}}, {0x0, 0x0, {0x2, 0xe}}, {0x3, 0xf, {0x6, 0x5}}, {0x9, 0x4, {0x1, 0x3}}, {0x8, 0x8, {0x3, 0x4d93f25f}}, {0x7fff, 0x1000, {0x1, 0x1}}, {0x1ff, 0x7f, {0x1, 0x3}}, {0x8, 0x6, {0x2, 0x80}}, {0x0, 0x8, {0x0, 0x8}}, {0x4, 0x0, {0x1, 0x88}}, {0x6, 0x5, {0x0, 0x8}}]}}}, {{0x254, 0x1, {{0x1, 0x3}, 0x7, 0x5, 0x7, 0x9, 0x15, 'syz1\x00', "abe4ef06dfdad29a549e369da5c276c54edf8c1761737db534c34e0fa8353a4c", "9b53a6b2f30aab04d72e727f231718736f4ceb0c923cf6e2afa6841a2ea8d833", [{0xfe01, 0x6, {0x0, 0xfa}}, {0x3, 0xf7, {0x3, 0x6}}, {0x92, 0x6, {0x1, 0x3}}, {0xd, 0x7, {0x1, 0x4}}, {0x8, 0xb38, {0x1, 0x67567156}}, {0x90, 0xb, {0x3, 0x400}}, {0x2, 0x8, {0x2, 0x8}}, {0x7, 0x71, {0x0, 0x9}}, {0x0, 0x2, {0x3, 0xffffffff}}, {0x92, 0x6, {0x3, 0x7}}, {0x2, 0x3, {0x1, 0x5}}, {0xafef, 0x6, {0x3, 0x9}}, {0x4384, 0x8, {0x2, 0xffff}}, {0x5, 0xb, {0x3, 0x141}}, {0xe, 0x400, {0x1, 0xe}}, {0x2, 0x3, {0x0, 0x8}}, {0xffff, 0xb1, {0x1, 0x9}}, {0x2c57, 0x45, {0x0, 0x401}}, {0x4, 0xf, {0x3, 0x80000000}}, {0x0, 0xffff, {0x1, 0x6}}, {0x5c5, 0x9, {0x2, 0x7fff}}, {0x4, 0xfc00, {0x2, 0xc77}}, {0x5, 0x8000, {0x0, 0xa}}, {0x1, 0xab, {0x1, 0x6}}, {0x8, 0x0, {0x3, 0x4}}, {0x7, 0x5, {0x3, 0xf4}}, {0x6, 0x400, {0x3, 0x1}}, {0x5, 0x200, {0x3, 0x80000001}}, {0xacf0, 0x5b, {0x1, 0x10}}, {0x6, 0xd, {0x1, 0x7}}, {0x6ce4, 0x5, {0x3, 0x7f}}, {0xa, 0x0, {0x2, 0xef}}, {0x3, 0xfff, {0x2, 0x1}}, {0x80, 0x5, {0x3, 0x8}}, {0xfffb, 0xe24, {0x3, 0x5}}, {0x1, 0x9, {0x0, 0x8}}, {0x1, 0x8, {0x1, 0x1}}, {0xb, 0x200, {0x2, 0xa}}, {0x4, 0x5, {0xbc83346e91229dc2, 0x40}}, {0xfffa, 0xfa, {0x0, 0xea01}}]}}}]}, 0x4bc}, 0x1, 0x0, 0x0, 0x8004}, 0x4) r5 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x181200) ioctl$CEC_RECEIVE(r5, 0xc0386106, &(0x7f0000000040)={0x4, 0x23e, 0x120ef416, 0x5, 0x10, 0xffffffff, "9002551b9bdf12f27e2f507f18f521bc", 0x8, 0x3, 0x34, 0x9, 0x15, 0x8, 0x4}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3f}]}}}]}, 0x40}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 9.945693757s ago: executing program 4 (id=928): sendto$inet6(0xffffffffffffffff, &(0x7f0000000100)="c10e000018001f06", 0x8, 0x4000000, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setaffinity(0x0, 0xff43, &(0x7f00000002c0)=0x2) r0 = socket$igmp(0x2, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000004340)=""/102376, 0x18fe8) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000001040)=@filter={'filter\x00', 0x42, 0x4, 0x3b8, 0xffffffff, 0x238, 0x98, 0x98, 0xffffffff, 0xffffffff, 0x320, 0x320, 0x320, 0xffffffff, 0x5, 0x0, {[{{@uncond, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 'wg1\x00', 'ip6tnl0\x00', {}, {}, 0x6c}, 0x287, 0x178, 0x1a0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x2, 0x4, 'bm\x00', "17fe85b2e7794dbf95fa4bbcb6a91c1f280c1999b9e9c91aec32acf40242838b14641ee58ffb2807b1455049d59591426d860cbcf1d58ab1ffbb5187b72db33268933cac58623e417fbdbd0b8753f88cb456e7cd9ef85fd6861f486fb7bab7930c4e57def2f1e72aede0b46c35ed67a0549781a3d3fe2b88393de1719bea5584", 0x7e, 0x2, {0xf}}}, @common=@unspec=@limit={{0x48}, {0x7004, 0x80000, 0x0, 0xb}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x8000, 0x3ff, 0x89f0, 0xfeb9, 0x3f, 0x7f, 0x3}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "81d0042c436dbdac8bebde18b54dd11bf035c1d8b6b0e88ef5aee0eccad7"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x418) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETTABLE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000010a"], 0x14}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000058c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002160, 0x0) 8.689550511s ago: executing program 4 (id=932): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000eef76c20c80a01c3650d010203010902120001000010000904"], 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000600)={0x34, &(0x7f0000000080)={0x0, 0x0, 0x3a, "918e9be180f097f9bbe2bdb5ff1714322e9a06e1511a3a11b167215d840c838fe507c070e8dfb53fccfa28c29af48c6c04152b52d37aea770fbd"}, 0x0, &(0x7f0000000500)={0x0, 0x8, 0x1, 0x9}, &(0x7f00000000c0)={0xc0, 0xa1, 0x4, 0x8}, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000400)={0x0, 0x1, 0x96, {0x96, 0x7, "a835297ecf24e0c669767beac5c49fbce300008ec14abc9e2369bb73efce6de07fa2ed5e1df7120c3ac8f63b86c6f62d6bfb8ce0f7e5585424a3173b027dd6ae2b7a9e5eb93e711441a02e93a1e984d5b14b8323c18c3e7927fbb0ad781e4fc35cef542993bbf8e93bb00745df03b24e42175c47dda62ab67bde5ec591c19f302f15bcf41e33210e2dfa295b8632612ced4a24f5"}}, &(0x7f0000000540)=ANY=[@ANYBLOB="000313ffffff04033f04ca1e546b387c09233dab519abc7fa6632b795d8dbf9381755b1af848ee7491aef7f1a59a270f34ea1f9a8bd75c0fe4dc548bb5228bad5924d74266bf1bfbe1ca6d1b7cce7b08fb451495f62dbb156fe489addc307890475f544f48277fd9f00b0000a4a5cd3fa32760f34a48fdfa19eddc2616e7"]}, &(0x7f00000003c0)={0x34, &(0x7f0000000200)={0x0, 0x31, 0x40, "101e0d42a49efadcda7b5e85d1259e9e9a78614ce002ed762f9dc5501a5e1b90a4fd27dcd5684d4b471c0bf8abced1b035d57c8f47cf45cb2e41594d9c915175"}, &(0x7f0000000100)={0x0, 0xa, 0x1, 0x74}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000300)={0xc0, 0xa1, 0x4, 0x5}, &(0x7f0000000340)={0x40, 0xa0, 0x4, 0x4}, &(0x7f0000000380)={0xc0, 0xa2, 0x2f, "90d774964ac0920e953882650d6086d7512d50fc4a0e9434430f0c5d3bb980e85706d48f997b7721e249cbb791c73f"}}) 8.625907407s ago: executing program 5 (id=933): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040), 0x2}}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x4) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) syz_io_uring_submit(0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) open_by_handle_at(0xffffffffffffff9c, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) listen(r5, 0x0) write$binfmt_aout(r3, 0x0, 0xffffffdb) 8.432888965s ago: executing program 2 (id=936): munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(0xffffffffffffffff) socket$kcm(0x2b, 0x1, 0x0) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(0xffffffffffffffff, 0x7af, &(0x7f0000000000)={@hyper, 0x2}) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102392, 0x18ff8) open_tree(0xffffffffffffffff, 0x0, 0x0) r2 = userfaultfd(0x801) mkdirat(0xffffffffffffffff, &(0x7f00000194c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xd1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000019400)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a00000000180000", @ANYRES32=0x0, @ANYBLOB="0000000000003900000000f67fa6220000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) 6.292618329s ago: executing program 2 (id=942): r0 = socket$packet(0x11, 0x2, 0x300) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000004240), 0xa000, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r2, 0x3b87, &(0x7f0000004280)={0x18, 0x0, 0x0, 0x0, 0x0, 0x1}) setreuid(0x0, 0xee00) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, r3}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000000c0)={0x28, 0x4, r3, 0x0, &(0x7f0000ff5000/0x4000)=nil, 0x4000, 0x10000}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg(r4, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) write$selinux_load(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="8cff7cf90800000053452034696e75780116d212a7fabac5da85512e2b41de2b681ced6364faccae1663127e585ef6b1544800873efcb90ff140b12c3887821522c582bf7c82a323f233c4b4e1a73373c7d148f58e3a4cfb105e0ee290827dc1eb81370d"], 0x64) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r7 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="4c000000150097f87059ae08060c040002ff0f020000000000000187ac1414aaa69d35a2cca84708f7abca1bac1414aabd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000005c0)=@newqdisc={0x78, 0x24, 0xf0b, 0x18000020, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x4}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x0, 0x0, 0x0, 0x1, 0x5, 0xf}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0xfffffffffffffff0, 0x0, 0x4, 0x68ab, 0xfffffffffffffffe}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x4048005}, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) 6.03244588s ago: executing program 7 (id=943): sendto$inet6(0xffffffffffffffff, &(0x7f0000000100)="c10e000018001f06", 0x8, 0x4000000, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setaffinity(0x0, 0xff43, &(0x7f00000002c0)=0x2) r0 = socket$igmp(0x2, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000004340)=""/102376, 0x18fe8) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000001040)=@filter={'filter\x00', 0x42, 0x4, 0x3b8, 0xffffffff, 0x238, 0x98, 0x98, 0xffffffff, 0xffffffff, 0x320, 0x320, 0x320, 0xffffffff, 0x5, 0x0, {[{{@uncond, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 'wg1\x00', 'ip6tnl0\x00', {}, {}, 0x6c}, 0x287, 0x178, 0x1a0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x2, 0x4, 'bm\x00', "17fe85b2e7794dbf95fa4bbcb6a91c1f280c1999b9e9c91aec32acf40242838b14641ee58ffb2807b1455049d59591426d860cbcf1d58ab1ffbb5187b72db33268933cac58623e417fbdbd0b8753f88cb456e7cd9ef85fd6861f486fb7bab7930c4e57def2f1e72aede0b46c35ed67a0549781a3d3fe2b88393de1719bea5584", 0x7e, 0x2, {0xf}}}, @common=@unspec=@limit={{0x48}, {0x7004, 0x80000, 0x0, 0xb}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x8000, 0x3ff, 0x89f0, 0xfeb9, 0x3f, 0x7f, 0x3}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "81d0042c436dbdac8bebde18b54dd11bf035c1d8b6b0e88ef5aee0eccad7"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x418) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETTABLE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000010a"], 0x14}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000058c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002160, 0x0) 5.632449808s ago: executing program 4 (id=944): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x80800) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x2, 0x0, 0x0, r2}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (fail_nth: 1) 4.941397797s ago: executing program 7 (id=946): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x20048810) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x38}}, 0x2000018c) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) inotify_init1(0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(0xffffffffffffffff, 0x80847ba, 0x0, 0xe, 0x0, 0x0) 4.892070244s ago: executing program 7 (id=947): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) prctl$PR_GET_TID_ADDRESS(0x28, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x10004, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0xc000, &(0x7f0000000040)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000080)) writev(r2, &(0x7f0000000800)=[{0x0}], 0x1) r3 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r3, &(0x7f0000000000)=[{0x0, 0x47, 0x0, 0x0, @time={0xd9, 0x7}, {0x40, 0xff}, {0x0, 0x9}, @queue={0xee, {0x7, 0xc9a}}}, {0x0, 0x0, 0x0, 0x0, @time={0x367f, 0xfffffffd}, {}, {0x4}, @connect={{0x40, 0x7}, {0x80, 0xf6}}}], 0x38) ioctl$SG_GET_NUM_WAITING(r3, 0x227d, &(0x7f0000000380)) 4.859002431s ago: executing program 2 (id=948): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040), 0x2}}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x4) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) syz_io_uring_submit(0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) open_by_handle_at(0xffffffffffffff9c, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) write$binfmt_aout(r3, 0x0, 0xffffffdb) 4.657941903s ago: executing program 5 (id=949): sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[], 0x34}}, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x40001, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x12}, 0x7}, 0x1c) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000800000000000070000000900010073797a30000000007c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d38001280140001800c000100636f756e7465720004000280200001800e000100636f6e6e6c696d69740000000c000280080001400000000808000340000001"], 0xc4}}, 0x20050890) 4.24018072s ago: executing program 4 (id=950): prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r0 = syz_open_dev$sndpcmp(&(0x7f0000000080), 0x1ff, 0x2000) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e21, 0xb, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xff}, 0x1c) ioctl$SNDRV_PCM_IOCTL_RESET(r0, 0x4141, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) socket$nl_generic(0x10, 0x3, 0x10) bind$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_delroute={0x2c, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x80, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @rand_addr=0x64010101}, @RTA_GATEWAY={0x8, 0x5, @empty}]}, 0x2c}}, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x6, &(0x7f0000000240)={0x12, {{0x29, 0x0, 0x36000000, @local}}}, 0x88) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$OSF_MSG_REMOVE(r1, &(0x7f0000000400)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000001680)={0x4bc, 0x1, 0x5, 0x5, 0x0, 0x0, {0x5}, [{{0x254, 0x1, {{0x0, 0xca6}, 0x5, 0x9, 0x8, 0x9, 0x8, 'syz1\x00', "994d2635813721b7a4822055af6dd02eb9b7f7d29249e0805566446e3a427bab", "7411e7ad989958fd4ef886e78677c7c10823efb84ad728fe1f7d376252a14771", [{0x9, 0x5, {0x3, 0x43e1b825}}, {0x5, 0xd29, {0x3, 0x9}}, {0x0, 0x3, {0x0, 0x6}}, {0x4718, 0x400, {0x2, 0xff}}, {0xfff, 0x4, {0x3, 0x5}}, {0x9, 0x58, {0x2, 0x5}}, {0xffff, 0x5, {0x0, 0xac}}, {0xff, 0x0, {0x1, 0xa}}, {0x8, 0x7de, {0x3, 0x5}}, {0x4, 0xa620, {0x3, 0x39d1}}, {0x400, 0x401, {0x2, 0x800}}, {0x8, 0x3, {0x3, 0x7}}, {0x5, 0xe, {0x1, 0x2}}, {0xa, 0x200, {0x3, 0x9}}, {0xcbee, 0xff29, {0x1, 0x800}}, {0x6, 0x8, {0x2, 0x9}}, {0x3, 0xff43, {0x2, 0x7fffffff}}, {0xa, 0x0, {0x1, 0x9}}, {0x6, 0xf, {0x0, 0x80000000}}, {0x8, 0x8000, {0x3, 0x7}}, {0xff6c, 0x5, {0x1}}, {0x7, 0x6, {0x0, 0x5}}, {0xfffd, 0x3, {0x0, 0x66}}, {0xffff, 0x9, {0x0, 0x4}}, {0x765, 0x101, {0x2, 0x81}}, {0x0, 0x75, {0x2, 0x80}}, {0x6, 0x7, {0x2, 0xc962}}, {0x2, 0x7, {0x0, 0x3}}, {0x85b, 0x0, {0x2, 0x8}}, {0xed7, 0x3, {0x1, 0x8}}, {0x0, 0x0, {0x2, 0xe}}, {0x3, 0xf, {0x6, 0x5}}, {0x9, 0x4, {0x1, 0x3}}, {0x8, 0x8, {0x3, 0x4d93f25f}}, {0x7fff, 0x1000, {0x1, 0x1}}, {0x1ff, 0x7f, {0x1, 0x3}}, {0x8, 0x6, {0x2, 0x80}}, {0x0, 0x8, {0x0, 0x8}}, {0x4, 0x0, {0x1, 0x88}}, {0x6, 0x5, {0x0, 0x8}}]}}}, {{0x254, 0x1, {{0x1, 0x3}, 0x7, 0x5, 0x7, 0x9, 0x15, 'syz1\x00', "abe4ef06dfdad29a549e369da5c276c54edf8c1761737db534c34e0fa8353a4c", "9b53a6b2f30aab04d72e727f231718736f4ceb0c923cf6e2afa6841a2ea8d833", [{0xfe01, 0x6, {0x0, 0xfa}}, {0x3, 0xf7, {0x3, 0x6}}, {0x92, 0x6, {0x1, 0x3}}, {0xd, 0x7, {0x1, 0x4}}, {0x8, 0xb38, {0x1, 0x67567156}}, {0x90, 0xb, {0x3, 0x400}}, {0x2, 0x8, {0x2, 0x8}}, {0x7, 0x71, {0x0, 0x9}}, {0x0, 0x2, {0x3, 0xffffffff}}, {0x92, 0x6, {0x3, 0x7}}, {0x2, 0x3, {0x1, 0x5}}, {0xafef, 0x6, {0x3, 0x9}}, {0x4384, 0x8, {0x2, 0xffff}}, {0x5, 0xb, {0x3, 0x141}}, {0xe, 0x400, {0x1, 0xe}}, {0x2, 0x3, {0x0, 0x8}}, {0xffff, 0xb1, {0x1, 0x9}}, {0x2c57, 0x45, {0x0, 0x401}}, {0x4, 0xf, {0x3, 0x80000000}}, {0x0, 0xffff, {0x1, 0x6}}, {0x5c5, 0x9, {0x2, 0x7fff}}, {0x4, 0xfc00, {0x2, 0xc77}}, {0x5, 0x8000, {0x0, 0xa}}, {0x1, 0xab, {0x1, 0x6}}, {0x8, 0x0, {0x3, 0x4}}, {0x7, 0x5, {0x3, 0xf4}}, {0x6, 0x400, {0x3, 0x1}}, {0x5, 0x200, {0x3, 0x80000001}}, {0xacf0, 0x5b, {0x1, 0x10}}, {0x6, 0xd, {0x1, 0x7}}, {0x6ce4, 0x5, {0x3, 0x7f}}, {0xa, 0x0, {0x2, 0xef}}, {0x3, 0xfff, {0x2, 0x1}}, {0x80, 0x5, {0x3, 0x8}}, {0xfffb, 0xe24, {0x3, 0x5}}, {0x1, 0x9, {0x0, 0x8}}, {0x1, 0x8, {0x1, 0x1}}, {0xb, 0x200, {0x2, 0xa}}, {0x4, 0x5, {0xbc83346e91229dc2, 0x40}}, {0xfffa, 0xfa, {0x0, 0xea01}}]}}}]}, 0x4bc}, 0x1, 0x0, 0x0, 0x8004}, 0x4) r5 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x181200) ioctl$CEC_RECEIVE(r5, 0xc0386106, &(0x7f0000000040)={0x4, 0x23e, 0x120ef416, 0x5, 0x10, 0xffffffff, "9002551b9bdf12f27e2f507f18f521bc", 0x8, 0x3, 0x34, 0x9, 0x15, 0x8, 0x4}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3f}]}}}]}, 0x40}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 4.239350489s ago: executing program 7 (id=951): sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8005, 0x0, 0xe1, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x4080}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x12}, 0x7}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@loopback={0x600}, 0x800, 0x0, 0x1, 0x8, 0x40}, 0x20) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000800000000000070000000900010073797a30000000007c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d38001280140001800c000100636f756e7465720004000280200001800e000100636f6e6e6c696d69740000000c000280080001400000000808000340000001"], 0xc4}}, 0x20050890) 3.896709736s ago: executing program 5 (id=953): ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b4e, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r0, 0x4b52, &(0x7f0000000040)={0x1, &(0x7f00000005c0)=[{}]}) syz_open_dev$MSR(&(0x7f0000000180), 0x4, 0x0) writev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041feff5aff2b0000000000000700"/68, 0x44}, {&(0x7f0000000080)="c1130389", 0x4}], 0x2) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000300)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) semctl$SEM_INFO(0x0, 0x0, 0x13, &(0x7f0000000f00)=""/210) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) 3.764030654s ago: executing program 4 (id=955): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x400, 0x0, 0x379}, &(0x7f00000001c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0xffffffffffffffff, 0x0}) io_uring_enter(r2, 0x47ba, 0x3e82, 0x60, 0x0, 0x3ec0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) syz_open_procfs(0x0, 0x0) 3.737602512s ago: executing program 5 (id=956): openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000000), &(0x7f0000000080)=ANY=[], 0x0, 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x4, 0x45, 0x1488, 0xffffffffffffffff, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000107000000000000000026001811", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000300000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) mount(&(0x7f00000001c0)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000001200)='vfat\x00', 0x0, 0x0) 3.637448238s ago: executing program 2 (id=957): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x20048810) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x38}}, 0x2000018c) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r1, 0x80847ba, 0x0, 0xe, 0x0, 0x0) 3.635759584s ago: executing program 3 (id=958): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d000000000000"], 0x0, 0x34}, 0x28) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x800008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x494002, 0x0) r1 = getpid() ptrace$ARCH_SHSTK_ENABLE(0x1e, r1, 0x4, 0x5001) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) sendto$inet6(0xffffffffffffffff, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='syzkaller\x00', 0x8}, 0x94) 3.628893804s ago: executing program 7 (id=959): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000240)={@in6={{0xa, 0x4e20, 0x2, @private1, 0x994}}, 0x0, 0x0, 0x46, 0x0, "8ab74b459a1df9795128901d80d012c326ad094dace2e76c731cd175ec9ca7558833225537b5a2a5a95f383052a2ae444aa4761bc5c4006a1dbb078d36b10897b92cd66fa12286d8f759cc15d288af93"}, 0xd8) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000480)='yeah', 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280), r4) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r6, 0x303, 0x2, 0x4, {0x6}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}}, 0x0) shutdown(r0, 0x1) r7 = memfd_secret(0x0) ftruncate(r7, 0x581) ftruncate(r7, 0x3) 3.212928054s ago: executing program 2 (id=960): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xf, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000840)='virtio_transport_alloc_pkt\x00', r0}, 0x18) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) bind$vsock_stream(r1, &(0x7f0000000940), 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) writev(r2, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x20000081}], 0x1) 3.203160642s ago: executing program 3 (id=961): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) prctl$PR_GET_TID_ADDRESS(0x28, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x10004, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0xc000, &(0x7f0000000040)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000080)) writev(r2, &(0x7f0000000800)=[{0x0}], 0x1) r3 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r3, &(0x7f0000000000)=[{0x0, 0x47, 0x0, 0x0, @time={0xd9, 0x7}, {0x40, 0xff}, {0x0, 0x9}, @queue={0xee, {0x7, 0xc9a}}}, {0x0, 0x0, 0x0, 0x0, @time={0x367f, 0xfffffffd}, {}, {0x4}, @connect={{0x40, 0x7}, {0x80, 0xf6}}}], 0x38) ioctl$SG_GET_NUM_WAITING(r3, 0x227d, &(0x7f0000000380)) 2.51206526s ago: executing program 7 (id=962): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040), 0x2}}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x4) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) syz_io_uring_submit(0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) open_by_handle_at(0xffffffffffffff9c, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) write$binfmt_aout(r3, 0x0, 0xffffffdb) 2.433415105s ago: executing program 3 (id=963): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) r2 = syz_open_procfs(r0, &(0x7f0000000000)='map_files\x00') fchdir(r2) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x6a) r3 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x400, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r3, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000200)=r1}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000500)={'batadv0\x00', 0x0}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001640)={r1, 0x20, &(0x7f0000001600)={&(0x7f00000005c0)=""/4096, 0x1000, 0x0, &(0x7f00000015c0)=""/58, 0x3a}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001940)={0x18, 0x2f, &(0x7f0000001680)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, [@generic={0x5, 0x5, 0x0, 0x0, 0x2691}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xe5}}, @snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @ringbuf_output, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}}]}, &(0x7f0000001800)='syzkaller\x00', 0x6, 0x27, &(0x7f0000001b00)=""/39, 0x41000, 0x61, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000001880)={0x1, 0x3}, 0x8, 0x10, &(0x7f00000018c0)={0x3, 0xe, 0xfffff287, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000001900)=[r2, r3], 0x0, 0x10, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x4, 0x10, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0xed, 0x0, 0x0, 0x0, 0x9}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @alu={0x7, 0x0, 0x2, 0x6, 0x2, 0xfffffffffffffff8, 0x1}, @call={0x85, 0x0, 0x0, 0x6d}, @tail_call={{0x18, 0x2, 0x1, 0x0, r8}}]}, &(0x7f0000000380)='syzkaller\x00', 0x80000001, 0xec, &(0x7f0000000400)=""/236, 0x41000, 0x20, '\x00', r9, @fallback=0x21, r1, 0x8, &(0x7f0000000540)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000580)={0x4, 0xa, 0x7fff, 0x3ff}, 0x10, r10, r2, 0x2, 0x0, &(0x7f0000001a00)=[{0x1, 0x4, 0x2, 0x4}, {0x3, 0x3, 0xb, 0x3}]}, 0x94) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x8090}}) openat$vsock(0xffffffffffffff9c, &(0x7f0000001840), 0x8200, 0x0) io_uring_enter(r5, 0x47f6, 0x0, 0x2, 0x0, 0x300) getdents64(r3, 0x0, 0x0) 1.729177453s ago: executing program 2 (id=964): r0 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x2, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000ac0)={0x4, r1, 0x1}) r4 = syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x80000) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x80, 0x20203843, 0x3, [0x2, 0x0, r5], [0x80ffff], [0x0, 0x0, 0x0, 0xfffffffd], [0x9]}) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000600)={'vxcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000640)={0x1d, r6, 0x3, {0x2, 0xf0, 0x2}, 0x2}, 0x18) syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f0000000200)={0x14, &(0x7f0000000040)={0x20, 0x8, 0x20, {0x20, 0x5, "9e538c0ba79a6fa8c67c0df495914992fddd1258da1e3c1066837ee448e4"}}, &(0x7f0000000080)={0x0, 0x3, 0x3, @string={0x3, 0x3, '['}}}, &(0x7f00000005c0)={0x34, &(0x7f0000000240)=ANY=[@ANYBLOB="2016000100001ae38fcf79bae4284a4d114252b833781609228aa9b6eee7e8713d5edfbb55918db1b4dfebc02fd226c62e41580b4733b90c5e3d786dd6b88fd84bc6f93052e4a4d952a1a154e4fa3bc09bff11c3262ed480b94742acf911890b96f31fe7932302395a768c7221087f17c8bb2261233636299b7afeb6c94d73f3d85d9294951723651ff1a334a7f08a026863e1a1039300bd773a17dc5ca8aea4282f1f04fa4d38a6c301f279981b504561f211284d82ff817627e751b6d1d701753b54dc4bcda155337e3cdb1a1db6197544fa49f14d7030e8281377f37f726caa3c202d09c04f5d333c6790fe30a0e8d6bb2e50659e090b70e6d78b2821f5b7efc1130d997a"], &(0x7f0000000380)={0x0, 0xa, 0x1}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000440)={0x20, 0x0, 0xc9, {0xc7, "2fe6a1a42c405d3241e6f0fda75f27b3a5e26f1a59ebfe954a7481c5e02ed59f7115ab7361b55641234edfdf94b525d8ca66194d82506752b564684b478f06fe2b662254602c370ca30d381ce94bd5e6a0b6090ef93843bc9ec9c16912fb65e5c4ed596509494531f853c08144b9a01d4d6f8497082b8193bcf5c1feb2287c2b115cfbad8e5f79e9c8dd6b3ccebb0ad4f7bcb3fa6be5a7c0c35ef4bf693bbc709b08b940861f2c5bfd42cd80be7c79e3497eb2f075db35ba49bff877a2cb73d3e6c00183c331e0"}}, &(0x7f0000000540)={0x20, 0x1, 0x1, 0x8}, &(0x7f0000000580)={0x20, 0x0, 0x1, 0x50}}) openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000140)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x1b, {0x0, "f40f08"}}, @nested_vmlaunch={0x12f, 0x18}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @control_area=0x24, 0x0, 0xfffffb}}], 0x9b}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4040aea0, &(0x7f0000000000)=@x86={0x5, 0x5, 0x17, 0x0, 0x4000003, 0xfc, 0x2, 0xc, 0xff, 0x8, 0x6, 0x1, 0x0, 0x7, 0x5, 0x4, 0x72, 0x7, 0xfa, '\x00', 0x3, 0x3}) r10 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r10, 0x1, 0x3e, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r10, &(0x7f0000000000)={0xa, 0x4e22, 0x2, @loopback, 0xffffffff}, 0x1c) write$proc_mixer(r3, &(0x7f0000000680)=[{'IMIX', @void}, {'MIC', @val={' \'', 'Mic'}}, {'DIGITAL3', @void}], 0x2d) ioctl$KVM_RUN(r9, 0xae80, 0x0) 1.098249407s ago: executing program 5 (id=965): sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[], 0x34}}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x4080}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x12}, 0x7}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@loopback={0x600}, 0x800, 0x0, 0x1, 0x8, 0x40}, 0x20) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e7", 0x9b}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000800000000000070000000900010073797a30000000007c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d38001280140001800c000100636f756e7465720004000280200001800e000100636f6e6e6c696d69740000000c000280080001400000000808000340000001"], 0xc4}}, 0x20050890) 1.072250485s ago: executing program 3 (id=966): prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r0 = syz_open_dev$sndpcmp(&(0x7f0000000080), 0x1ff, 0x2000) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e21, 0xb, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xff}, 0x1c) ioctl$SNDRV_PCM_IOCTL_RESET(r0, 0x4141, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x8d8, 0x5, 0x50424752, 0x6, 0x8000002, 0xb, 0x0, 0xffffffff, 0x0, 0x6, 0x0, 0x4}}) socket$nl_generic(0x10, 0x3, 0x10) bind$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_delroute={0x2c, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x80, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @rand_addr=0x64010101}, @RTA_GATEWAY={0x8, 0x5, @empty}]}, 0x2c}}, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x6, &(0x7f0000000240)={0x12, {{0x29, 0x0, 0x36000000, @local}}}, 0x88) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$OSF_MSG_REMOVE(r1, &(0x7f0000000400)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000001680)={0x4bc, 0x1, 0x5, 0x5, 0x0, 0x0, {0x5}, [{{0x254, 0x1, {{0x0, 0xca6}, 0x5, 0x9, 0x8, 0x9, 0x8, 'syz1\x00', "994d2635813721b7a4822055af6dd02eb9b7f7d29249e0805566446e3a427bab", "7411e7ad989958fd4ef886e78677c7c10823efb84ad728fe1f7d376252a14771", [{0x9, 0x5, {0x3, 0x43e1b825}}, {0x5, 0xd29, {0x3, 0x9}}, {0x0, 0x3, {0x0, 0x6}}, {0x4718, 0x400, {0x2, 0xff}}, {0xfff, 0x4, {0x3, 0x5}}, {0x9, 0x58, {0x2, 0x5}}, {0xffff, 0x5, {0x0, 0xac}}, {0xff, 0x0, {0x1, 0xa}}, {0x8, 0x7de, {0x3, 0x5}}, {0x4, 0xa620, {0x3, 0x39d1}}, {0x400, 0x401, {0x2, 0x800}}, {0x8, 0x3, {0x3, 0x7}}, {0x5, 0xe, {0x1, 0x2}}, {0xa, 0x200, {0x3, 0x9}}, {0xcbee, 0xff29, {0x1, 0x800}}, {0x6, 0x8, {0x2, 0x9}}, {0x3, 0xff43, {0x2, 0x7fffffff}}, {0xa, 0x0, {0x1, 0x9}}, {0x6, 0xf, {0x0, 0x80000000}}, {0x8, 0x8000, {0x3, 0x7}}, {0xff6c, 0x5, {0x1}}, {0x7, 0x6, {0x0, 0x5}}, {0xfffd, 0x3, {0x0, 0x66}}, {0xffff, 0x9, {0x0, 0x4}}, {0x765, 0x101, {0x2, 0x81}}, {0x0, 0x75, {0x2, 0x80}}, {0x6, 0x7, {0x2, 0xc962}}, {0x2, 0x7, {0x0, 0x3}}, {0x85b, 0x0, {0x2, 0x8}}, {0xed7, 0x3, {0x1, 0x8}}, {0x0, 0x0, {0x2, 0xe}}, {0x3, 0xf, {0x6, 0x5}}, {0x9, 0x4, {0x1, 0x3}}, {0x8, 0x8, {0x3, 0x4d93f25f}}, {0x7fff, 0x1000, {0x1, 0x1}}, {0x1ff, 0x7f, {0x1, 0x3}}, {0x8, 0x6, {0x2, 0x80}}, {0x0, 0x8, {0x0, 0x8}}, {0x4, 0x0, {0x1, 0x88}}, {0x6, 0x5, {0x0, 0x8}}]}}}, {{0x254, 0x1, {{0x1, 0x3}, 0x7, 0x5, 0x7, 0x9, 0x15, 'syz1\x00', "abe4ef06dfdad29a549e369da5c276c54edf8c1761737db534c34e0fa8353a4c", "9b53a6b2f30aab04d72e727f231718736f4ceb0c923cf6e2afa6841a2ea8d833", [{0xfe01, 0x6, {0x0, 0xfa}}, {0x3, 0xf7, {0x3, 0x6}}, {0x92, 0x6, {0x1, 0x3}}, {0xd, 0x7, {0x1, 0x4}}, {0x8, 0xb38, {0x1, 0x67567156}}, {0x90, 0xb, {0x3, 0x400}}, {0x2, 0x8, {0x2, 0x8}}, {0x7, 0x71, {0x0, 0x9}}, {0x0, 0x2, {0x3, 0xffffffff}}, {0x92, 0x6, {0x3, 0x7}}, {0x2, 0x3, {0x1, 0x5}}, {0xafef, 0x6, {0x3, 0x9}}, {0x4384, 0x8, {0x2, 0xffff}}, {0x5, 0xb, {0x3, 0x141}}, {0xe, 0x400, {0x1, 0xe}}, {0x2, 0x3, {0x0, 0x8}}, {0xffff, 0xb1, {0x1, 0x9}}, {0x2c57, 0x45, {0x0, 0x401}}, {0x4, 0xf, {0x3, 0x80000000}}, {0x0, 0xffff, {0x1, 0x6}}, {0x5c5, 0x9, {0x2, 0x7fff}}, {0x4, 0xfc00, {0x2, 0xc77}}, {0x5, 0x8000, {0x0, 0xa}}, {0x1, 0xab, {0x1, 0x6}}, {0x8, 0x0, {0x3, 0x4}}, {0x7, 0x5, {0x3, 0xf4}}, {0x6, 0x400, {0x3, 0x1}}, {0x5, 0x200, {0x3, 0x80000001}}, {0xacf0, 0x5b, {0x1, 0x10}}, {0x6, 0xd, {0x1, 0x7}}, {0x6ce4, 0x5, {0x3, 0x7f}}, {0xa, 0x0, {0x2, 0xef}}, {0x3, 0xfff, {0x2, 0x1}}, {0x80, 0x5, {0x3, 0x8}}, {0xfffb, 0xe24, {0x3, 0x5}}, {0x1, 0x9, {0x0, 0x8}}, {0x1, 0x8, {0x1, 0x1}}, {0xb, 0x200, {0x2, 0xa}}, {0x4, 0x5, {0xbc83346e91229dc2, 0x40}}, {0xfffa, 0xfa, {0x0, 0xea01}}]}}}]}, 0x4bc}, 0x1, 0x0, 0x0, 0x8004}, 0x4) r5 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x181200) ioctl$CEC_RECEIVE(r5, 0xc0386106, &(0x7f0000000040)={0x4, 0x23e, 0x120ef416, 0x5, 0x10, 0xffffffff, "9002551b9bdf12f27e2f507f18f521bc", 0x8, 0x3, 0x34, 0x9, 0x15, 0x8, 0x4}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3f}]}}}]}, 0x40}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 913.431696ms ago: executing program 3 (id=967): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040), 0x2}}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x4) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) syz_io_uring_submit(0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) open_by_handle_at(0xffffffffffffff9c, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) write$binfmt_aout(r3, 0x0, 0xffffffdb) 824.333578ms ago: executing program 5 (id=968): socket(0x400000000010, 0x3, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffffff, 0x0, 0x22) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000002, 0x31, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) dup(r2) r3 = socket$vsock_stream(0x28, 0x1, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(0xffffffffffffffff) listen(r3, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) sendmmsg(r4, &(0x7f0000000640), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xffdff7e8, 0x0, 0x3}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffffb}, 0x21}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) 0s ago: executing program 3 (id=969): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d07}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0xff, 0x0, 0x8, 0x1, 0xa, 0xb9, 0xb, 0xe, 0x5, 0xcc}, {0x804, 0x2, 0x1, 0x45, 0x7, 0x0, 0x2, 0xff, 0x4, 0x4, 0x6, 0x7f, 0x20c}, {0x40000001, 0x3, 0x38, 0x3, 0x84, 0x7, 0x3, 0x50, 0x8, 0x7, 0x4, 0x9, 0x24ab}], 0xffffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x1fd, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x88800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1000000021) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$kcm(0x29, 0x5, 0x0) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000000)={0x0, 0xea60}, 0x10) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r4, 0x0, 0xf3e, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x181900, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x42, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000280)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000380)=ANY=[]) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x2, &(0x7f0000006680)) r5 = mq_open(&(0x7f0000001600)='eth0\x00#~\x02\x00\x00\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfd\x05\x00\x00\x00\x00\x00\x80\x00\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94uu_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18A\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x05\x00\x00\x000\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xce\x00\x00\x00\xe8\vq+\xbb\xc7\xaf\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) mq_timedsend(r5, 0x0, 0x0, 0x6, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000300)={0xa, 0xffffffffffffffff, 0x1}) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) connect$can_bcm(r6, &(0x7f0000000300)={0x1d, r7}, 0x10) sendmsg$can_bcm(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="b100", @ANYRES32=r1], 0x48}, 0x1, 0x0, 0x0, 0x8040}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) kernel console output (not intermixed with test programs): ompat=0 ip=0x7fad0a38f749 code=0x7ffc0000 [ 164.285172][ T7334] CPU: 1 UID: 0 PID: 7334 Comm: syz.0.337 Not tainted syzkaller #0 PREEMPT(full) [ 164.285197][ T7334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 164.285208][ T7334] Call Trace: [ 164.285214][ T7334] [ 164.285221][ T7334] dump_stack_lvl+0x16c/0x1f0 [ 164.285247][ T7334] should_fail_ex+0x512/0x640 [ 164.285273][ T7334] should_fail_alloc_page+0xe7/0x130 [ 164.285295][ T7334] prepare_alloc_pages+0x3c2/0x610 [ 164.285319][ T7334] __alloc_frozen_pages_noprof+0x18b/0x2470 [ 164.285352][ T7334] ? find_held_lock+0x2b/0x80 [ 164.285376][ T7334] ? is_bpf_text_address+0x8a/0x1a0 [ 164.285397][ T7334] ? bpf_ksym_find+0x127/0x1c0 [ 164.285422][ T7334] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 164.285447][ T7334] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 164.285476][ T7334] ? kernel_text_address+0x8d/0x100 [ 164.285495][ T7334] ? __kernel_text_address+0xd/0x40 [ 164.285523][ T7334] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 164.285548][ T7334] ? policy_nodemask+0xea/0x4e0 [ 164.285570][ T7334] alloc_pages_mpol+0x1fb/0x550 [ 164.285590][ T7334] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 164.285618][ T7334] folio_alloc_mpol_noprof+0x36/0x2f0 [ 164.285641][ T7334] vma_alloc_folio_noprof+0xed/0x1e0 [ 164.285665][ T7334] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 164.285697][ T7334] do_pte_missing+0x2202/0x3ba0 [ 164.285722][ T7334] ? find_held_lock+0x2b/0x80 [ 164.285748][ T7334] __handle_mm_fault+0x1556/0x2aa0 [ 164.285778][ T7334] ? __pfx___handle_mm_fault+0x10/0x10 [ 164.285806][ T7334] ? lock_vma_under_rcu+0x176/0x530 [ 164.285839][ T7334] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 164.285871][ T7334] handle_mm_fault+0x589/0xd10 [ 164.285896][ T7334] ? __pkru_allows_pkey+0x21/0xb0 [ 164.285916][ T7334] do_user_addr_fault+0x60c/0x1370 [ 164.285938][ T7334] ? rcu_is_watching+0x12/0xc0 [ 164.285964][ T7334] exc_page_fault+0x64/0xc0 [ 164.285982][ T7334] asm_exc_page_fault+0x26/0x30 [ 164.285999][ T7334] RIP: 0033:0x7fb3f3a5b1a1 [ 164.286013][ T7334] Code: 89 ee 49 89 c0 48 8d 3d 5d 52 19 00 31 c0 e8 e6 2d ff ff eb cb 0f 1f 40 00 41 57 41 56 41 55 41 54 55 53 48 81 ec 78 10 00 00 <48> 89 7c 24 18 48 89 74 24 10 48 89 54 24 08 4c 8b 7c 24 18 48 8b [ 164.286031][ T7334] RSP: 002b:00007fb3f4996f80 EFLAGS: 00010202 [ 164.286046][ T7334] RAX: 00007fb3f3a5b190 RBX: 00007fb3f3de5fa0 RCX: 0000000000000000 [ 164.286056][ T7334] RDX: 0000000000000034 RSI: 0000200000000180 RDI: 00002000000000c0 [ 164.286066][ T7334] RBP: 00007fb3f4998090 R08: 0000000000000000 R09: 0000000000000000 [ 164.286076][ T7334] R10: 00002000000000c0 R11: 0000000000000034 R12: 0000000000000001 [ 164.286086][ T7334] R13: 00007fb3f3de6038 R14: 00007fb3f3de5fa0 R15: 00007ffe5d744078 [ 164.286111][ T7334] [ 164.286271][ T7334] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 164.386437][ T30] audit: type=1326 audit(1764190064.969:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7329 comm="syz.1.335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad0a38f749 code=0x7ffc0000 [ 164.589168][ T7334] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 164.647478][ T7358] fido_id[7358]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 165.167643][ T30] audit: type=1326 audit(1764190064.969:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7329 comm="syz.1.335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fad0a38f749 code=0x7ffc0000 [ 165.435720][ T30] audit: type=1326 audit(1764190064.969:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7329 comm="syz.1.335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad0a38f749 code=0x7ffc0000 [ 165.680991][ T7363] netlink: 12 bytes leftover after parsing attributes in process `syz.2.343'. [ 165.897702][ T7390] CUSE: unknown device info "" [ 165.902568][ T7390] CUSE: zero length info key specified [ 165.924354][ T7390] netlink: 24 bytes leftover after parsing attributes in process `syz.2.350'. [ 166.367725][ T7407] netlink: 'syz.2.352': attribute type 4 has an invalid length. [ 166.469402][ T7415] netlink: 'syz.4.354': attribute type 2 has an invalid length. [ 166.851627][ T7415] !: entered promiscuous mode [ 168.831960][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 168.831981][ T30] audit: type=1400 audit(1764190070.309:548): avc: denied { map } for pid=7443 comm="syz.4.361" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 169.359440][ T7447] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 169.713668][ T7449] tty tty2: ldisc open failed (-12), clearing slot 1 [ 170.825024][ T30] audit: type=1400 audit(1764190073.009:549): avc: denied { setopt } for pid=7466 comm="syz.0.368" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 170.848737][ T7468] netlink: 4 bytes leftover after parsing attributes in process `syz.0.368'. [ 171.561968][ T5809] Bluetooth: hci1: unexpected event 0x2f length: 509 > 260 [ 173.170884][ T7511] fuse: Unknown parameter 'use0000000000000000000000000000000000000000' [ 173.348273][ T7523] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 173.348273][ T7523] program syz.1.379 not setting count and/or reply_len properly [ 173.478155][ T7515] syzkaller1: entered promiscuous mode [ 173.491374][ T7515] syzkaller1: entered allmulticast mode [ 174.042231][ T10] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 174.614267][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 174.623073][ T10] usb 3-1: config 1 has an invalid interface number: 78 but max is 0 [ 174.670562][ T10] usb 3-1: config 1 has no interface number 0 [ 174.703203][ T10] usb 3-1: config 1 interface 78 has no altsetting 0 [ 174.712001][ T10] usb 3-1: New USB device found, idVendor=11ba, idProduct=1001, bcdDevice=ec.57 [ 174.721412][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.732266][ T10] usb 3-1: Product: syz [ 174.756725][ T10] usb 3-1: Manufacturer: syz [ 174.793186][ T10] usb 3-1: SerialNumber: syz [ 175.604222][ T30] audit: type=1400 audit(1764190077.789:550): avc: denied { getopt } for pid=7535 comm="syz.2.383" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 175.657991][ T7561] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.667302][ T7561] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 175.714201][ T10] pvrusb2: Hardware description: OnAir USB2 Hybrid USB tuner [ 175.735239][ T10] usb 3-1: selecting invalid altsetting 0 [ 175.744990][ T2336] pvrusb2: Invalid write control endpoint [ 175.754711][ T7560] fuse: Unknown parameter 'user_id0000000000000000000000000000000000000000' [ 175.820281][ T10] usb 3-1: USB disconnect, device number 10 [ 175.850822][ T7560] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 175.850822][ T7560] program syz.4.386 not setting count and/or reply_len properly [ 175.954571][ T2336] pvrusb2: Invalid write control endpoint [ 176.003582][ T2336] pvrusb2: Invalid write control endpoint [ 176.029152][ T2336] pvrusb2: Invalid write control endpoint [ 176.052788][ T2336] pvrusb2: Invalid write control endpoint [ 176.068739][ T2336] pvrusb2: Invalid write control endpoint [ 176.083275][ T2336] pvrusb2: Invalid write control endpoint [ 176.089187][ T7572] sctp: [Deprecated]: syz.4.389 (pid 7572) Use of struct sctp_assoc_value in delayed_ack socket option. [ 176.089187][ T7572] Use struct sctp_sack_info instead [ 176.099513][ T2336] pvrusb2: Invalid write control endpoint [ 176.111970][ T2336] pvrusb2: Invalid write control endpoint [ 176.118328][ T2336] pvrusb2: Invalid write control endpoint [ 176.124541][ T2336] pvrusb2: Invalid write control endpoint [ 176.130670][ T2336] pvrusb2: Invalid write control endpoint [ 176.140549][ T2336] pvrusb2: Invalid write control endpoint [ 176.179879][ T2336] pvrusb2: Invalid write control endpoint [ 176.186352][ T2336] pvrusb2: Invalid write control endpoint [ 176.193550][ T2336] pvrusb2: Invalid write control endpoint [ 176.220354][ T2336] pvrusb2: Invalid write control endpoint [ 176.236466][ T2336] pvrusb2: Invalid write control endpoint [ 176.281069][ T2336] pvrusb2: Invalid write control endpoint [ 176.334431][ T2336] pvrusb2: Invalid write control endpoint [ 176.360436][ T2336] pvrusb2: Invalid write control endpoint [ 176.380658][ T2336] pvrusb2: Invalid write control endpoint [ 176.401788][ T2336] pvrusb2: Invalid write control endpoint [ 176.421989][ T2336] pvrusb2: Invalid write control endpoint [ 176.432891][ T2336] pvrusb2: Invalid write control endpoint [ 176.439054][ T2336] pvrusb2: Invalid write control endpoint [ 176.453400][ T2336] pvrusb2: Invalid write control endpoint [ 176.463597][ T2336] pvrusb2: Invalid write control endpoint [ 176.482172][ T2336] pvrusb2: Invalid write control endpoint [ 176.501632][ T2336] pvrusb2: Invalid write control endpoint [ 176.540623][ T2336] pvrusb2: Invalid write control endpoint [ 176.561669][ T2336] pvrusb2: Invalid write control endpoint [ 176.562972][ T30] audit: type=1400 audit(1764190078.739:551): avc: denied { create } for pid=7580 comm="syz.4.392" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 176.587286][ T2336] pvrusb2: Invalid write control endpoint [ 176.588844][ T2336] pvrusb2: Module ID 3 (saa7115) for device OnAir USB2 Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 176.633366][ T30] audit: type=1400 audit(1764190078.739:552): avc: denied { ioctl } for pid=7580 comm="syz.4.392" path="socket:[15046]" dev="sockfs" ino=15046 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 176.854607][ T30] audit: type=1400 audit(1764190079.039:553): avc: denied { connect } for pid=7592 comm="syz.4.398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 176.882842][ T7596] fuse: Unknown parameter 'user_id0000000000000000000000000000000000000000' [ 177.205583][ T7599] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 177.205583][ T7599] program syz.2.399 not setting count and/or reply_len properly [ 177.540019][ T2336] cs53l32a 1-0011: chip found @ 0x22 (pvrusb2_a) [ 177.546894][ T2336] pvrusb2: Invalid write control endpoint [ 177.557844][ T2336] pvrusb2: Invalid write control endpoint [ 177.563772][ T2336] pvrusb2: Invalid write control endpoint [ 177.569491][ T2336] pvrusb2: Invalid write control endpoint [ 177.575306][ T2336] pvrusb2: Invalid write control endpoint [ 177.581019][ T2336] pvrusb2: Invalid write control endpoint [ 177.587729][ T2336] pvrusb2: Invalid write control endpoint [ 177.594493][ T2336] pvrusb2: Invalid write control endpoint [ 177.601015][ T2336] pvrusb2: Invalid write control endpoint [ 177.608240][ T2336] pvrusb2: Invalid write control endpoint [ 177.614243][ T2336] pvrusb2: Invalid write control endpoint [ 177.620108][ T2336] pvrusb2: Invalid write control endpoint [ 177.715443][ T2336] pvrusb2: Invalid write control endpoint [ 177.728379][ T2336] pvrusb2: Invalid write control endpoint [ 177.768163][ T2336] pvrusb2: Invalid write control endpoint [ 177.819018][ T2336] pvrusb2: Invalid write control endpoint [ 177.833380][ T2336] pvrusb2: Invalid write control endpoint [ 177.843675][ T2336] pvrusb2: Invalid write control endpoint [ 177.849400][ T2336] pvrusb2: Invalid write control endpoint [ 177.880471][ T2336] pvrusb2: Invalid write control endpoint [ 177.909622][ T30] audit: type=1400 audit(1764190080.089:554): avc: denied { getopt } for pid=7601 comm="syz.4.401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 177.911382][ T2336] pvrusb2: Invalid write control endpoint [ 178.008149][ T30] audit: type=1400 audit(1764190080.179:555): avc: denied { setopt } for pid=7601 comm="syz.4.401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 178.031946][ T2336] pvrusb2: Attached sub-driver cs53l32a [ 178.039369][ T30] audit: type=1400 audit(1764190080.179:556): avc: denied { getopt } for pid=7601 comm="syz.4.401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 178.165384][ T7621] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.172962][ T7621] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.186317][ T30] audit: type=1400 audit(1764190080.349:557): avc: denied { watch watch_reads } for pid=7615 comm="syz.3.406" path="/81" dev="tmpfs" ino=429 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 178.188768][ T2336] pvrusb2: Invalid write control endpoint [ 178.244312][ T2336] pvrusb2: Invalid write control endpoint [ 178.253538][ T7621] bridge0: entered allmulticast mode [ 178.259106][ T2336] pvrusb2: Invalid write control endpoint [ 178.283332][ T5936] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 178.301381][ T2336] pvrusb2: Invalid write control endpoint [ 178.313383][ T2336] pvrusb2: Module ID 4 (tuner) for device OnAir USB2 Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 178.347169][ T2336] pvrusb2: Device being rendered inoperable [ 178.375440][ T7622] bridge_slave_1: left allmulticast mode [ 178.382136][ T2336] pvrusb2: ***WARNING*** pvrusb2 driver initialization failed due to the failure of one or more sub-device kernel modules. [ 178.404692][ T2336] pvrusb2: You need to resolve the failing condition before this driver can function. There should be some earlier messages giving more information about the problem. [ 178.421924][ T7622] bridge_slave_1: left promiscuous mode [ 178.432698][ T7622] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.453478][ T5885] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 178.464271][ T5936] usb 1-1: Using ep0 maxpacket: 16 [ 178.471148][ T7622] bridge_slave_0: left allmulticast mode [ 178.476843][ T7622] bridge_slave_0: left promiscuous mode [ 178.482649][ T7622] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.492678][ T5936] usb 1-1: config 2 has an invalid interface number: 195 but max is 1 [ 178.501780][ T5936] usb 1-1: config 2 has an invalid interface number: 2 but max is 1 [ 178.531681][ T5936] usb 1-1: config 2 contains an unexpected descriptor of type 0x1, skipping [ 178.575254][ T5936] usb 1-1: config 2 has an invalid interface number: 196 but max is 1 [ 178.583218][ T5885] usb 4-1: device descriptor read/64, error -71 [ 178.633143][ T5936] usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 178.695971][ T5936] usb 1-1: config 2 has 3 interfaces, different from the descriptor's value: 2 [ 178.716195][ T5936] usb 1-1: config 2 has no interface number 0 [ 178.729599][ T5936] usb 1-1: config 2 has no interface number 1 [ 178.785669][ T5936] usb 1-1: config 2 interface 195 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 14 [ 178.803181][ T5936] usb 1-1: too many endpoints for config 2 interface 2 altsetting 3: 91, using maximum allowed: 30 [ 178.823213][ T5885] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 178.840937][ T5936] usb 1-1: config 2 interface 2 altsetting 3 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 178.913192][ T5922] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 178.933564][ T5936] usb 1-1: config 2 interface 2 altsetting 3 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 178.953392][ T5936] usb 1-1: config 2 interface 2 altsetting 3 bulk endpoint 0xD has invalid maxpacket 64 [ 178.955453][ T5885] usb 4-1: device descriptor read/64, error -71 [ 178.973357][ T5936] usb 1-1: config 2 interface 2 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 178.990113][ T5936] usb 1-1: config 2 interface 2 altsetting 3 has a duplicate endpoint with address 0x1, skipping [ 179.005301][ T5936] usb 1-1: config 2 interface 2 altsetting 3 has a duplicate endpoint with address 0x9, skipping [ 179.040942][ T5936] usb 1-1: config 2 interface 2 altsetting 3 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 179.066590][ T5936] usb 1-1: config 2 interface 2 altsetting 3 has a duplicate endpoint with address 0xB, skipping [ 179.093207][ T5922] usb 5-1: Using ep0 maxpacket: 16 [ 179.093560][ T5885] usb usb4-port1: attempt power cycle [ 179.098695][ T5936] usb 1-1: config 2 interface 2 altsetting 3 has 12 endpoint descriptors, different from the interface descriptor's value: 91 [ 179.123453][ T5922] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 179.131438][ T5922] usb 5-1: config 0 has no interface number 0 [ 179.138596][ T5922] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 179.150964][ T7627] loop3: detected capacity change from 0 to 2560 [ 179.153318][ T30] audit: type=1400 audit(1764190081.329:558): avc: denied { append } for pid=7626 comm="syz.2.408" name="loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 179.159242][ T7627] Buffer I/O error on dev loop3, logical block 0, async page read [ 179.189631][ T5936] usb 1-1: config 2 interface 196 altsetting 9 has an endpoint descriptor with address 0x63, changing to 0x3 [ 179.201417][ T5922] usb 5-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 179.210700][ T5922] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.218847][ T5936] usb 1-1: config 2 interface 196 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 179.232063][ T7627] Buffer I/O error on dev loop3, logical block 0, async page read [ 179.241036][ T5936] usb 1-1: config 2 interface 196 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 179.253574][ T5922] usb 5-1: config 0 descriptor?? [ 179.262345][ T5922] usbhid 5-1:0.1: couldn't find an input interrupt endpoint [ 179.265812][ T7628] Buffer I/O error on dev loop3, logical block 0, lost async page write [ 179.269873][ T7627] loop3: unable to read partition table [ 179.283865][ T5936] usb 1-1: config 2 interface 196 altsetting 9 has a duplicate endpoint with address 0xB, skipping [ 179.290909][ T7628] Buffer I/O error on dev loop3, logical block 1, lost async page write [ 179.296684][ T5936] usb 1-1: config 2 interface 196 altsetting 9 has a duplicate endpoint with address 0xA, skipping [ 179.323177][ T7627] loop_reread_partitions: partition scan of loop3 (3Ÿ ¾‚³˜) failed (rc=-5) [ 179.325654][ T30] audit: type=1400 audit(1764190081.509:559): avc: denied { execute_no_trans } for pid=7626 comm="syz.2.408" path=2F6D656D66643AA39F6EB4645204693502ACCEE1889D5B4038D7CE1F2039497F151D933DB5E75C274CE6D28EBC294A7454447181CF81BAE531F522C8103EC95C85174CBFCF91DF4DF3025E542A202864656C6574656429 dev="hugetlbfs" ino=15092 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 179.369566][ C0] vkms_vblank_simulate: vblank timer overrun [ 179.373426][ T5936] usb 1-1: config 2 interface 196 altsetting 9 has a duplicate endpoint with address 0xD, skipping [ 179.397732][ T5936] usb 1-1: config 2 interface 196 altsetting 9 has a duplicate endpoint with address 0x6, skipping [ 179.412537][ T7628] Buffer I/O error on dev loop3, logical block 2, lost async page write [ 179.423207][ T5936] usb 1-1: config 2 interface 196 altsetting 9 bulk endpoint 0x7 has invalid maxpacket 1024 [ 179.435605][ T7628] Buffer I/O error on dev loop3, logical block 3, lost async page write [ 179.444314][ T7628] Buffer I/O error on dev loop3, logical block 4, lost async page write [ 179.456906][ T7628] Buffer I/O error on dev loop3, logical block 5, lost async page write [ 179.459116][ T5936] usb 1-1: config 2 interface 195 has no altsetting 0 [ 179.465733][ T5885] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 179.483813][ T5922] usb 5-1: USB disconnect, device number 10 [ 179.514742][ T5885] usb 4-1: device descriptor read/8, error -71 [ 179.526827][ T7628] Buffer I/O error on dev loop3, logical block 6, lost async page write [ 179.537322][ T5936] usb 1-1: config 2 interface 2 has no altsetting 0 [ 179.553040][ T5936] usb 1-1: config 2 interface 196 has no altsetting 0 [ 179.567523][ T7628] Buffer I/O error on dev loop3, logical block 7, lost async page write [ 179.576855][ T5936] usb 1-1: string descriptor 0 read error: -71 [ 179.591469][ T5936] usb 1-1: New USB device found, idVendor=1c9e, idProduct=9603, bcdDevice= 0.8f [ 179.618619][ T5936] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.658027][ T5936] usb 1-1: can't set config #2, error -71 [ 179.678266][ T5936] usb 1-1: USB disconnect, device number 15 [ 179.753234][ T5885] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 179.783662][ T5885] usb 4-1: device descriptor read/8, error -71 [ 179.793172][ T9] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 179.904418][ T5885] usb usb4-port1: unable to enumerate USB device [ 179.954763][ T9] usb 3-1: New USB device found, idVendor=1645, idProduct=0008, bcdDevice=cf.36 [ 179.977102][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.993239][ T5936] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 179.993605][ T9] usb 3-1: config 0 descriptor?? [ 180.369137][ T5936] usb 1-1: device descriptor read/64, error -71 [ 180.633189][ T5936] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 180.922951][ T5936] usb 1-1: device descriptor read/64, error -71 [ 181.059372][ T5936] usb usb1-port1: attempt power cycle [ 181.467520][ T5182] ldm_validate_partition_table(): Disk read failed. [ 181.476571][ T5182] Dev loop3: unable to read RDB block 0 [ 181.482573][ T5182] loop3: unable to read partition table [ 181.520150][ T5936] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 181.566480][ T9] kaweth 3-1:0.0: Firmware present in device. [ 181.592008][ T5936] usb 1-1: device descriptor read/8, error -71 [ 181.618225][ T9] kaweth 3-1:0.0: Error reading configuration (-71), no net device created [ 181.647000][ T9] kaweth 3-1:0.0: probe with driver kaweth failed with error -5 [ 181.654952][ T30] audit: type=1400 audit(1764190083.829:560): avc: denied { read } for pid=7647 comm="syz.3.412" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 181.773374][ T9] usb 3-1: USB disconnect, device number 11 [ 181.843606][ T5936] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 181.844381][ T30] audit: type=1400 audit(1764190084.029:561): avc: denied { getopt } for pid=7647 comm="syz.3.412" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 181.879215][ T7656] fuse: Unknown parameter 'user_id0000000000000000000000000000000000000000' [ 181.894180][ T5936] usb 1-1: device descriptor read/8, error -71 [ 181.903005][ T7656] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 181.903005][ T7656] program syz.4.413 not setting count and/or reply_len properly [ 181.921199][ T30] audit: type=1400 audit(1764190084.049:562): avc: denied { getopt } for pid=7647 comm="syz.3.412" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 181.940892][ C0] vkms_vblank_simulate: vblank timer overrun [ 182.016952][ T5936] usb usb1-port1: unable to enumerate USB device [ 182.046294][ T30] audit: type=1400 audit(1764190084.229:563): avc: denied { map } for pid=7660 comm="syz.4.414" path="socket:[16295]" dev="sockfs" ino=16295 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 182.385979][ T30] audit: type=1400 audit(1764190084.559:564): avc: denied { connect } for pid=7669 comm="syz.4.417" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 182.407833][ T7671] syzkaller1: entered promiscuous mode [ 182.414839][ T7671] syzkaller1: entered allmulticast mode [ 183.437144][ T7679] syzkaller1: entered promiscuous mode [ 183.468583][ T7679] syzkaller1: entered allmulticast mode [ 184.813255][ T7689] netlink: 'syz.4.420': attribute type 4 has an invalid length. [ 184.982082][ T7707] fuse: Bad value for 'fd' [ 185.010106][ T7707] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 185.010106][ T7707] program syz.0.425 not setting count and/or reply_len properly [ 185.580407][ T7721] netlink: 'syz.4.429': attribute type 4 has an invalid length. [ 185.617443][ T5815] Bluetooth: hci3: command 0x0406 tx timeout [ 185.623449][ T5816] Bluetooth: hci1: command 0x0406 tx timeout [ 185.629415][ T5816] Bluetooth: hci0: command 0x0406 tx timeout [ 185.635524][ T53] Bluetooth: hci2: command 0x0406 tx timeout [ 185.998503][ T30] audit: type=1400 audit(1764190088.179:565): avc: denied { map } for pid=7725 comm="syz.2.431" path="/dev/binderfs/binder1" dev="binder" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 186.022144][ C0] vkms_vblank_simulate: vblank timer overrun [ 186.031164][ T7726] binder_alloc: binder_alloc_mmap_handler: 7725 200000ffc000-200000fff000 already mapped failed -16 [ 186.248512][ T30] audit: type=1400 audit(1764190088.409:566): avc: denied { load_policy } for pid=7723 comm="syz.0.430" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 186.268523][ C0] vkms_vblank_simulate: vblank timer overrun [ 186.330554][ T7724] SELinux: failed to load policy [ 186.434625][ T30] audit: type=1400 audit(1764190088.489:567): avc: denied { ioctl } for pid=7723 comm="syz.0.430" path="socket:[16452]" dev="sockfs" ino=16452 ioctlcmd=0x8934 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 186.537791][ T7739] netlink: 36 bytes leftover after parsing attributes in process `syz.4.433'. [ 187.324515][ T7741] netlink: 32 bytes leftover after parsing attributes in process `syz.2.435'. [ 187.364616][ T7741] FAULT_INJECTION: forcing a failure. [ 187.364616][ T7741] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 187.393526][ T7741] CPU: 1 UID: 0 PID: 7741 Comm: syz.2.435 Not tainted syzkaller #0 PREEMPT(full) [ 187.393547][ T7741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 187.393556][ T7741] Call Trace: [ 187.393562][ T7741] [ 187.393568][ T7741] dump_stack_lvl+0x16c/0x1f0 [ 187.393588][ T7741] should_fail_ex+0x512/0x640 [ 187.393610][ T7741] _copy_to_user+0x32/0xd0 [ 187.393632][ T7741] simple_read_from_buffer+0xcb/0x170 [ 187.393657][ T7741] proc_fail_nth_read+0x197/0x240 [ 187.393677][ T7741] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 187.393696][ T7741] ? rw_verify_area+0xcf/0x6c0 [ 187.393717][ T7741] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 187.393735][ T7741] vfs_read+0x1e4/0xcf0 [ 187.393752][ T7741] ? __pfx___mutex_lock+0x10/0x10 [ 187.393768][ T7741] ? __pfx_vfs_read+0x10/0x10 [ 187.393788][ T7741] ? __fget_files+0x20e/0x3c0 [ 187.393811][ T7741] ksys_read+0x12a/0x250 [ 187.393825][ T7741] ? __pfx_ksys_read+0x10/0x10 [ 187.393846][ T7741] do_syscall_64+0xcd/0xfa0 [ 187.393862][ T7741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.393877][ T7741] RIP: 0033:0x7f0cb498e15c [ 187.393890][ T7741] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 187.393904][ T7741] RSP: 002b:00007f0cb5876030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 187.393919][ T7741] RAX: ffffffffffffffda RBX: 00007f0cb4be5fa0 RCX: 00007f0cb498e15c [ 187.393928][ T7741] RDX: 000000000000000f RSI: 00007f0cb58760a0 RDI: 0000000000000006 [ 187.393937][ T7741] RBP: 00007f0cb5876090 R08: 0000000000000000 R09: 0000000000000000 [ 187.393946][ T7741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 187.393954][ T7741] R13: 00007f0cb4be6038 R14: 00007f0cb4be5fa0 R15: 00007ffc01e01b98 [ 187.393977][ T7741] [ 188.066873][ T7753] fuse: Bad value for 'fd' [ 188.301925][ T7753] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 188.301925][ T7753] program syz.2.438 not setting count and/or reply_len properly [ 188.495458][ T30] audit: type=1400 audit(1764190090.669:568): avc: denied { mounton } for pid=7756 comm="syz.4.440" path="/proc/345/task" dev="proc" ino=16506 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 188.556511][ T30] audit: type=1400 audit(1764190090.669:569): avc: denied { mount } for pid=7756 comm="syz.4.440" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 188.580501][ T30] audit: type=1400 audit(1764190090.679:570): avc: denied { view } for pid=7760 comm="syz.0.443" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 188.734354][ T5936] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 188.742663][ T5936] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 189.853216][ T30] audit: type=1400 audit(1764190092.029:571): avc: denied { read } for pid=7780 comm="syz.0.445" path="socket:[17487]" dev="sockfs" ino=17487 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 189.987069][ T30] audit: type=1400 audit(1764190092.159:572): avc: denied { ioctl } for pid=7789 comm="syz.3.446" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 190.857988][ T7823] fuse: Bad value for 'fd' [ 190.882581][ T7823] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 190.882581][ T7823] program syz.2.452 not setting count and/or reply_len properly [ 191.753165][ T5922] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 193.768529][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.775486][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.422352][ T5936] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 194.524679][ T5936] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 194.566649][ T7864] lo speed is unknown, defaulting to 1000 [ 194.574067][ T7864] lo speed is unknown, defaulting to 1000 [ 194.580954][ T7864] lo speed is unknown, defaulting to 1000 [ 194.588711][ T5821] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 194.597095][ T5821] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 194.608646][ T5821] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 194.616363][ T5821] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 194.623713][ T5821] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 194.637401][ T30] audit: type=1400 audit(1764190096.819:573): avc: denied { mounton } for pid=7865 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 194.658732][ C1] vkms_vblank_simulate: vblank timer overrun [ 195.271039][ T7870] fido_id[7870]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 195.724752][ T5936] lo speed is unknown, defaulting to 1000 [ 195.759310][ T7864] infiniband syz1: set down [ 195.767653][ T7865] chnl_net:caif_netlink_parms(): no params data found [ 195.785583][ T7864] infiniband syz1: added lo [ 195.816017][ T7864] syz1: rxe_create_cq: returned err = -12 [ 195.883699][ T7864] infiniband syz1: Couldn't create ib_mad CQ [ 195.889846][ T7864] infiniband syz1: Couldn't open port 1 [ 196.118067][ T7864] RDS/IB: syz1: added [ 196.122372][ T7864] smc: adding ib device syz1 with port count 1 [ 196.161767][ T7864] smc: ib device syz1 port 1 has no pnetid [ 196.250438][ T7865] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.273294][ T7865] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.300768][ T7865] bridge_slave_0: entered allmulticast mode [ 196.329396][ T7865] bridge_slave_0: entered promiscuous mode [ 196.383935][ T7865] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.407578][ T7865] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.441874][ T7865] bridge_slave_1: entered allmulticast mode [ 196.473476][ T7865] bridge_slave_1: entered promiscuous mode [ 196.576570][ T9] lo speed is unknown, defaulting to 1000 [ 196.724008][ T5133] Bluetooth: hci5: command tx timeout [ 196.861332][ T7865] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 196.924960][ T7865] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 196.964598][ T7864] lo speed is unknown, defaulting to 1000 [ 197.152787][ T7923] tipc: Enabling of bearer rejected, failed to enable media [ 197.170285][ T7919] ./cgroup: Can't lookup blockdev [ 197.195566][ T7865] team0: Port device team_slave_0 added [ 197.204841][ T7865] team0: Port device team_slave_1 added [ 197.231999][ T7865] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 197.238994][ T7865] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 197.244247][ T7917] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 197.264860][ C1] vkms_vblank_simulate: vblank timer overrun [ 197.314929][ T7865] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 197.624682][ T7865] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 197.651260][ T7865] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 197.754128][ T7865] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 197.842972][ T7864] lo speed is unknown, defaulting to 1000 [ 197.908938][ T7865] hsr_slave_0: entered promiscuous mode [ 197.933979][ T7865] hsr_slave_1: entered promiscuous mode [ 197.948779][ T7865] debugfs: 'hsr0' already exists in 'hsr' [ 197.964936][ T7865] Cannot create hsr debugfs directory [ 198.233183][ T30] audit: type=1400 audit(1764190100.409:574): avc: denied { write } for pid=7937 comm="syz.0.472" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 198.255787][ C1] vkms_vblank_simulate: vblank timer overrun [ 198.401440][ T7864] lo speed is unknown, defaulting to 1000 [ 198.631907][ T7865] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 198.671507][ T7865] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 198.695561][ T7865] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 198.737196][ T7865] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 198.804452][ T5133] Bluetooth: hci5: command tx timeout [ 198.926432][ T7950] netlink: 'syz.4.474': attribute type 4 has an invalid length. [ 199.317335][ T7865] 8021q: adding VLAN 0 to HW filter on device bond0 [ 199.359825][ T7864] lo speed is unknown, defaulting to 1000 [ 199.380620][ T7865] 8021q: adding VLAN 0 to HW filter on device team0 [ 199.421169][ T79] bridge0: port 1(bridge_slave_0) entered blocking state [ 199.428283][ T79] bridge0: port 1(bridge_slave_0) entered forwarding state [ 199.452323][ T79] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.459454][ T79] bridge0: port 2(bridge_slave_1) entered forwarding state [ 199.603569][ T5949] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 199.824690][ T5949] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 199.836339][ T5949] usb 5-1: New USB device found, idVendor=056e, idProduct=00fe, bcdDevice= 0.00 [ 199.849933][ T5949] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.875856][ T5949] usb 5-1: config 0 descriptor?? [ 199.975054][ T7864] lo speed is unknown, defaulting to 1000 [ 200.195725][ T7865] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 200.326250][ T5949] elecom 0003:056E:00FE.000D: unknown main item tag 0x0 [ 200.397129][ T5949] elecom 0003:056E:00FE.000D: unknown main item tag 0x0 [ 200.423155][ T5949] elecom 0003:056E:00FE.000D: unknown main item tag 0x0 [ 200.435399][ T7864] lo speed is unknown, defaulting to 1000 [ 200.465450][ T5949] elecom 0003:056E:00FE.000D: unknown main item tag 0x0 [ 200.472417][ T5949] elecom 0003:056E:00FE.000D: unknown main item tag 0x0 [ 200.540187][ T5949] elecom 0003:056E:00FE.000D: unknown main item tag 0x0 [ 200.560368][ T5949] elecom 0003:056E:00FE.000D: unknown main item tag 0x0 [ 200.584677][ T7865] veth0_vlan: entered promiscuous mode [ 200.610910][ T5949] elecom 0003:056E:00FE.000D: hidraw0: USB HID v0.00 Device [HID 056e:00fe] on usb-dummy_hcd.4-1/input0 [ 200.615244][ T7865] veth1_vlan: entered promiscuous mode [ 200.705052][ T5949] usb 5-1: USB disconnect, device number 11 [ 200.778970][ T7975] fido_id[7975]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 200.816161][ T7865] veth0_macvtap: entered promiscuous mode [ 200.858910][ T7865] veth1_macvtap: entered promiscuous mode [ 200.885593][ T5133] Bluetooth: hci5: command tx timeout [ 200.891486][ T7978] netlink: 12 bytes leftover after parsing attributes in process `syz.3.479'. [ 200.935535][ T7865] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 201.113607][ T30] audit: type=1400 audit(1764190103.299:575): avc: denied { bind } for pid=7977 comm="syz.3.479" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 201.602761][ T7983] netlink: 'syz.3.479': attribute type 1 has an invalid length. [ 201.637477][ T7865] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 201.654632][ T7978] netlink: 24 bytes leftover after parsing attributes in process `syz.3.479'. [ 201.785817][ T7986] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.802264][ T30] audit: type=1400 audit(1764190103.979:576): avc: denied { ioctl } for pid=7987 comm="syz.4.481" path="socket:[18273]" dev="sockfs" ino=18273 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 201.827463][ C1] vkms_vblank_simulate: vblank timer overrun [ 201.833826][ T1157] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.863158][ T1157] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.876328][ T1157] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.070370][ T30] audit: type=1400 audit(1764190104.229:577): avc: denied { ioctl } for pid=7992 comm="syz.3.484" path="socket:[16992]" dev="sockfs" ino=16992 ioctlcmd=0x89eb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 202.094772][ C1] vkms_vblank_simulate: vblank timer overrun [ 202.103685][ T30] audit: type=1400 audit(1764190104.249:578): avc: denied { nlmsg_read } for pid=7992 comm="syz.3.484" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 202.123993][ C1] vkms_vblank_simulate: vblank timer overrun [ 202.130633][ T30] audit: type=1400 audit(1764190104.249:579): avc: denied { read } for pid=7992 comm="syz.3.484" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 202.367092][ T5946] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 202.658263][ T5946] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 202.707577][ T5953] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 202.796077][ T5953] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 202.973409][ T5133] Bluetooth: hci5: command tx timeout [ 203.145085][ T30] audit: type=1400 audit(1764190105.309:580): avc: denied { mounton } for pid=7865 comm="syz-executor" path="/root/syzkaller.GtyIGq/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 203.393396][ T30] audit: type=1400 audit(1764190105.309:581): avc: denied { mount } for pid=7865 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 203.551011][ T30] audit: type=1400 audit(1764190105.309:582): avc: denied { mounton } for pid=7865 comm="syz-executor" path="/root/syzkaller.GtyIGq/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 203.577658][ C1] vkms_vblank_simulate: vblank timer overrun [ 203.606560][ T30] audit: type=1400 audit(1764190105.309:583): avc: denied { mounton } for pid=7865 comm="syz-executor" path="/root/syzkaller.GtyIGq/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=17256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 203.690421][ T8015] netlink: 64 bytes leftover after parsing attributes in process `syz.5.458'. [ 203.700406][ T8015] netlink: 64 bytes leftover after parsing attributes in process `syz.5.458'. [ 204.073232][ T30] audit: type=1400 audit(1764190105.349:584): avc: denied { mounton } for pid=7865 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 204.193248][ T5885] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 204.415083][ T5885] usb 4-1: config index 0 descriptor too short (expected 12571, got 27) [ 204.428958][ T5885] usb 4-1: config 52 has too many interfaces: 56, using maximum allowed: 32 [ 204.450962][ T5885] usb 4-1: config 52 has an invalid descriptor of length 52, skipping remainder of the config [ 204.562243][ T5885] usb 4-1: config 52 has 0 interfaces, different from the descriptor's value: 56 [ 204.583589][ T5885] usb 4-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 204.592854][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.046164][ T5885] usb 4-1: Product: syz [ 205.056509][ T5885] usb 4-1: Manufacturer: syz [ 205.063366][ T5885] usb 4-1: SerialNumber: syz [ 208.343917][ T8064] netlink: 'syz.5.500': attribute type 4 has an invalid length. [ 209.080649][ T5885] usb 4-1: USB disconnect, device number 16 [ 209.201511][ T8068] fuse: Bad value for 'fd' [ 209.254166][ T8068] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 209.288787][ T8070] tipc: Started in network mode [ 209.303957][ T8070] tipc: Node identity , cluster identity 4711 [ 209.320581][ T8070] tipc: Failed to set node id, please configure manually [ 209.332023][ T8070] tipc: Enabling of bearer rejected, failed to enable media [ 209.586344][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 209.586361][ T30] audit: type=1400 audit(1764190111.769:591): avc: denied { ioctl } for pid=8069 comm="syz.5.502" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 209.970784][ T30] audit: type=1400 audit(1764190111.769:592): avc: denied { read open } for pid=8069 comm="syz.5.502" path="/" dev="configfs" ino=1138 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 210.514635][ T5885] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 210.557066][ T5885] hid-generic 0000:0000:0000.000E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 211.268450][ T8093] overlayfs: failed to resolve './bus': -2 [ 211.770361][ T8110] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 212.422372][ T30] audit: type=1400 audit(1764190114.549:593): avc: denied { read } for pid=8117 comm="syz.4.513" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 212.668087][ T30] audit: type=1400 audit(1764190114.849:594): avc: denied { write } for pid=8117 comm="syz.4.513" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 215.064848][ T5821] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 215.073348][ T5821] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 215.081305][ T5821] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 215.093297][ T5821] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 215.102564][ T5821] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 215.168648][ T8170] lo speed is unknown, defaulting to 1000 [ 215.733201][ T5885] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 215.954595][ T5885] usb 3-1: config index 0 descriptor too short (expected 12571, got 27) [ 215.963073][ T5885] usb 3-1: config 52 has too many interfaces: 56, using maximum allowed: 32 [ 215.986961][ T5885] usb 3-1: config 52 has an invalid descriptor of length 52, skipping remainder of the config [ 216.032861][ T5885] usb 3-1: config 52 has 0 interfaces, different from the descriptor's value: 56 [ 216.226743][ T5885] usb 3-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 216.242379][ T5885] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.278111][ T5885] usb 3-1: Product: syz [ 216.305922][ T5885] usb 3-1: Manufacturer: syz [ 216.370321][ T5885] usb 3-1: SerialNumber: syz [ 216.443940][ T8190] support for cryptoloop has been removed. Use dm-crypt instead. [ 217.143335][ T5821] Bluetooth: hci6: command tx timeout [ 217.599074][ T8170] chnl_net:caif_netlink_parms(): no params data found [ 218.595168][ T5885] usb 3-1: USB disconnect, device number 12 [ 218.616797][ T8170] bridge0: port 1(bridge_slave_0) entered blocking state [ 218.633318][ T8170] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.670846][ T8170] bridge_slave_0: entered allmulticast mode [ 218.726577][ T8170] bridge_slave_0: entered promiscuous mode [ 218.747165][ T8170] bridge0: port 2(bridge_slave_1) entered blocking state [ 218.776452][ T8170] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.798574][ T8170] bridge_slave_1: entered allmulticast mode [ 218.815441][ T8170] bridge_slave_1: entered promiscuous mode [ 219.133744][ T8170] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 219.180003][ T8170] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 219.213341][ T5821] Bluetooth: hci6: command tx timeout [ 219.686024][ T8247] tipc: Started in network mode [ 219.773260][ T8247] tipc: Node identity eacf5c9a7d68, cluster identity 4711 [ 219.807055][ T8247] tipc: Enabled bearer , priority 0 [ 219.856447][ T8170] team0: Port device team_slave_0 added [ 219.884114][ T8240] tipc: Disabling bearer [ 219.916458][ T8170] team0: Port device team_slave_1 added [ 220.030707][ T8170] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 220.138369][ T8170] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 220.233214][ T8170] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 220.324996][ T8170] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 220.358960][ T8170] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 220.702347][ T8170] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 220.774258][ T8170] hsr_slave_0: entered promiscuous mode [ 220.782368][ T8170] hsr_slave_1: entered promiscuous mode [ 220.792405][ T8170] debugfs: 'hsr0' already exists in 'hsr' [ 220.801667][ T8170] Cannot create hsr debugfs directory [ 221.120980][ T8279] xt_CT: You must specify a L4 protocol and not use inversions on it [ 221.296387][ T5821] Bluetooth: hci6: command tx timeout [ 221.764986][ T8285] netlink: 'syz.4.543': attribute type 4 has an invalid length. [ 222.442032][ T8296] FAULT_INJECTION: forcing a failure. [ 222.442032][ T8296] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 222.493270][ T8296] CPU: 1 UID: 0 PID: 8296 Comm: syz.3.546 Not tainted syzkaller #0 PREEMPT(full) [ 222.493295][ T8296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 222.493305][ T8296] Call Trace: [ 222.493310][ T8296] [ 222.493315][ T8296] dump_stack_lvl+0x16c/0x1f0 [ 222.493331][ T8296] should_fail_ex+0x512/0x640 [ 222.493352][ T8296] _copy_from_user+0x2e/0xd0 [ 222.493366][ T8296] copy_msghdr_from_user+0x98/0x160 [ 222.493381][ T8296] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 222.493397][ T8296] ? kfree+0x252/0x6d0 [ 222.493412][ T8296] ? __lock_acquire+0x622/0x1c90 [ 222.493424][ T8296] ___sys_recvmsg+0xdb/0x1a0 [ 222.493438][ T8296] ? __pfx____sys_recvmsg+0x10/0x10 [ 222.493459][ T8296] ? __pfx___might_resched+0x10/0x10 [ 222.493476][ T8296] do_recvmmsg+0x2fe/0x750 [ 222.493492][ T8296] ? __pfx_do_recvmmsg+0x10/0x10 [ 222.493508][ T8296] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 222.493524][ T8296] ? __fget_files+0x20e/0x3c0 [ 222.493538][ T8296] __x64_sys_recvmmsg+0x22a/0x280 [ 222.493553][ T8296] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 222.493572][ T8296] do_syscall_64+0xcd/0xfa0 [ 222.493583][ T8296] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.493596][ T8296] RIP: 0033:0x7f428558f749 [ 222.493604][ T8296] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 222.493614][ T8296] RSP: 002b:00007f42864f2038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 222.493625][ T8296] RAX: ffffffffffffffda RBX: 00007f42857e5fa0 RCX: 00007f428558f749 [ 222.493631][ T8296] RDX: 0000000000000700 RSI: 0000200000001440 RDI: 0000000000000004 [ 222.493637][ T8296] RBP: 00007f42864f2090 R08: 0000000000000000 R09: 0000000000000000 [ 222.493643][ T8296] R10: 0000000040002002 R11: 0000000000000246 R12: 0000000000000002 [ 222.493649][ T8296] R13: 00007f42857e6038 R14: 00007f42857e5fa0 R15: 00007ffd69668898 [ 222.493663][ T8296] [ 222.899467][ T8170] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 223.064765][ T8170] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 223.187994][ T8170] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 223.366090][ T5821] Bluetooth: hci6: command tx timeout [ 223.723426][ T8170] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 224.536699][ T8170] 8021q: adding VLAN 0 to HW filter on device bond0 [ 224.602777][ T8170] 8021q: adding VLAN 0 to HW filter on device team0 [ 224.695261][ T5946] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.702371][ T5946] bridge0: port 1(bridge_slave_0) entered forwarding state [ 224.801937][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.809131][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 226.056796][ T5870] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 226.218313][ T8170] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 226.274483][ T5870] usb 3-1: config index 0 descriptor too short (expected 12571, got 27) [ 226.304157][ T5870] usb 3-1: config 52 has too many interfaces: 56, using maximum allowed: 32 [ 226.348976][ T5870] usb 3-1: config 52 has an invalid descriptor of length 52, skipping remainder of the config [ 226.443712][ T5870] usb 3-1: config 52 has 0 interfaces, different from the descriptor's value: 56 [ 226.515496][ T5870] usb 3-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 226.567545][ T5870] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.635790][ T5870] usb 3-1: Product: syz [ 226.675100][ T5870] usb 3-1: Manufacturer: syz [ 226.705105][ T5870] usb 3-1: SerialNumber: syz [ 227.402667][ T8170] veth0_vlan: entered promiscuous mode [ 227.451953][ T8170] veth1_vlan: entered promiscuous mode [ 227.619093][ T8170] veth0_macvtap: entered promiscuous mode [ 227.668214][ T8170] veth1_macvtap: entered promiscuous mode [ 227.717771][ T8170] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 227.814630][ T8170] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 227.878692][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.972497][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.090922][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.223773][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 229.099661][ T1157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 229.167022][ T1157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 229.799171][ T7986] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 229.876934][ T7986] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 230.398259][ T30] audit: type=1400 audit(1764190132.579:595): avc: denied { create } for pid=8436 comm="syz.6.516" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 230.404508][ T5870] usb 3-1: USB disconnect, device number 13 [ 230.871463][ T8447] overlayfs: failed to resolve './bus': -2 [ 231.303162][ T5949] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 231.566040][ T5949] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 231.579485][ T5949] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 231.590802][ T5949] usb 3-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 231.601737][ T5949] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.642864][ T5949] usb 3-1: config 0 descriptor?? [ 232.422569][ T5949] usbhid 3-1:0.0: can't add hid device: -71 [ 232.452879][ T5949] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 232.577072][ T5949] usb 3-1: USB disconnect, device number 14 [ 232.875369][ T8499] FAULT_INJECTION: forcing a failure. [ 232.875369][ T8499] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 232.888594][ T42] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 232.924347][ T8499] CPU: 1 UID: 0 PID: 8499 Comm: syz.6.581 Not tainted syzkaller #0 PREEMPT(full) [ 232.924367][ T8499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 232.924377][ T8499] Call Trace: [ 232.924383][ T8499] [ 232.924390][ T8499] dump_stack_lvl+0x16c/0x1f0 [ 232.924411][ T8499] should_fail_ex+0x512/0x640 [ 232.924437][ T8499] _copy_from_user+0x2e/0xd0 [ 232.924460][ T8499] copy_msghdr_from_user+0x98/0x160 [ 232.924484][ T8499] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 232.924519][ T8499] ___sys_sendmsg+0xfe/0x1d0 [ 232.924543][ T8499] ? __pfx____sys_sendmsg+0x10/0x10 [ 232.924564][ T8499] ? __lock_acquire+0x622/0x1c90 [ 232.924610][ T8499] __sys_sendmsg+0x16d/0x220 [ 232.924634][ T8499] ? __pfx___sys_sendmsg+0x10/0x10 [ 232.924673][ T8499] do_syscall_64+0xcd/0xfa0 [ 232.924692][ T8499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.924709][ T8499] RIP: 0033:0x7f9aebd8f749 [ 232.924723][ T8499] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 232.924740][ T8499] RSP: 002b:00007f9ae9ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 232.924757][ T8499] RAX: ffffffffffffffda RBX: 00007f9aebfe5fa0 RCX: 00007f9aebd8f749 [ 232.924769][ T8499] RDX: 0000000004000050 RSI: 0000200000000000 RDI: 0000000000000004 [ 232.924779][ T8499] RBP: 00007f9ae9ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 232.924790][ T8499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 232.924800][ T8499] R13: 00007f9aebfe6038 R14: 00007f9aebfe5fa0 R15: 00007ffcc7c18668 [ 232.924824][ T8499] [ 233.529026][ T42] usb 4-1: config index 0 descriptor too short (expected 12571, got 27) [ 233.570510][ T42] usb 4-1: config 52 has too many interfaces: 56, using maximum allowed: 32 [ 233.615147][ T42] usb 4-1: config 52 has an invalid descriptor of length 52, skipping remainder of the config [ 233.704727][ T42] usb 4-1: config 52 has 0 interfaces, different from the descriptor's value: 56 [ 233.878807][ T42] usb 4-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 233.979803][ T42] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.103209][ T42] usb 4-1: Product: syz [ 234.107399][ T42] usb 4-1: Manufacturer: syz [ 234.567307][ T42] usb 4-1: SerialNumber: syz [ 235.288567][ T8535] netlink: 260 bytes leftover after parsing attributes in process `syz.2.590'. [ 235.816403][ T8546] netlink: 'syz.4.591': attribute type 4 has an invalid length. [ 237.044854][ T9] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 237.203444][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 237.210446][ T9] usb 7-1: unable to get BOS descriptor or descriptor too short [ 237.219962][ T9] usb 7-1: config 128 has an invalid interface number: 127 but max is 3 [ 237.243199][ T9] usb 7-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 237.290354][ T9] usb 7-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 237.307400][ T42] usb 4-1: USB disconnect, device number 17 [ 237.408272][ T9] usb 7-1: config 128 has no interface number 0 [ 237.430297][ T9] usb 7-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 237.444894][ T8573] netlink: 40 bytes leftover after parsing attributes in process `syz.4.597'. [ 237.483471][ T9] usb 7-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid wMaxPacketSize 0 [ 237.523673][ T9] usb 7-1: config 128 interface 127 has no altsetting 0 [ 237.594164][ T9] usb 7-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 237.603642][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.739399][ T9] usb 7-1: Product: syz [ 238.204681][ T9] usb 7-1: Manufacturer: syz [ 238.209396][ T9] usb 7-1: SerialNumber: syz [ 238.432064][ T8563] ecryptfs_validate_options: You must supply at least one valid auth tok signature as a mount parameter; see the eCryptfs README [ 238.452895][ T8563] Error validating options; rc = [-22] [ 239.299951][ T9] usb 7-1: USB disconnect, device number 2 [ 239.418418][ T5806] udevd[5806]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 239.524802][ T5949] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 239.637006][ T30] audit: type=1400 audit(1764190141.809:596): avc: denied { create } for pid=8601 comm="syz.6.602" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 239.656249][ C0] vkms_vblank_simulate: vblank timer overrun [ 239.773193][ T5949] usb 3-1: device descriptor read/64, error -71 [ 239.841741][ T30] audit: type=1400 audit(1764190141.819:597): avc: denied { setopt } for pid=8601 comm="syz.6.602" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 239.873200][ T30] audit: type=1400 audit(1764190141.849:598): avc: denied { lock } for pid=8601 comm="syz.6.602" path="socket:[20902]" dev="sockfs" ino=20902 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 240.172564][ T5949] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 240.238650][ T30] audit: type=1400 audit(1764190141.999:599): avc: denied { write } for pid=8601 comm="syz.6.602" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 240.336103][ T5949] usb 3-1: device descriptor read/64, error -71 [ 240.718858][ T5949] usb usb3-port1: attempt power cycle [ 240.815844][ T8617] netlink: 'syz.3.604': attribute type 4 has an invalid length. [ 241.083226][ T5949] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 241.338250][ T9] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 241.755754][ T9] usb 5-1: config index 0 descriptor too short (expected 12571, got 27) [ 241.783217][ T9] usb 5-1: config 52 has too many interfaces: 56, using maximum allowed: 32 [ 241.833160][ T9] usb 5-1: config 52 has an invalid descriptor of length 52, skipping remainder of the config [ 241.873444][ T9] usb 5-1: config 52 has 0 interfaces, different from the descriptor's value: 56 [ 241.900793][ T9] usb 5-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 241.913342][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 242.083552][ T9] usb 5-1: Product: syz [ 242.243542][ T9] usb 5-1: Manufacturer: syz [ 242.248157][ T9] usb 5-1: SerialNumber: syz [ 242.633831][ T5949] usb 3-1: device descriptor read/8, error -71 [ 243.790279][ T30] audit: type=1400 audit(1764190145.969:600): avc: denied { write } for pid=8648 comm="syz.6.613" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 243.874092][ T30] audit: type=1400 audit(1764190145.999:601): avc: denied { open } for pid=8648 comm="syz.6.613" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 243.992964][ T5885] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 244.158929][ T8656] netlink: 'syz.5.614': attribute type 13 has an invalid length. [ 244.617402][ T30] audit: type=1400 audit(1764190146.009:602): avc: denied { read } for pid=8648 comm="syz.6.613" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 244.806929][ T30] audit: type=1400 audit(1764190146.009:603): avc: denied { ioctl } for pid=8648 comm="syz.6.613" path="/dev/loop-control" dev="devtmpfs" ino=646 ioctlcmd=0x4c81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 245.450947][ T30] audit: type=1400 audit(1764190147.409:604): avc: denied { setcheckreqprot } for pid=8660 comm="syz.6.615" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 245.798811][ T30] audit: type=1400 audit(1764190147.979:605): avc: denied { ioctl } for pid=8665 comm="syz.2.617" path="/dev/usbmon7" dev="devtmpfs" ino=737 ioctlcmd=0x9208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 245.859171][ T8666] trusted_key: encrypted_key: insufficient parameters specified [ 245.929739][ T8671] netlink: 'syz.6.618': attribute type 4 has an invalid length. [ 246.844399][ T9] usb 5-1: USB disconnect, device number 12 [ 247.619003][ T30] audit: type=1400 audit(1764190149.799:606): avc: denied { name_connect } for pid=8694 comm="syz.6.626" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 248.407187][ T30] audit: type=1400 audit(1764190150.549:607): avc: denied { bind } for pid=8684 comm="syz.2.622" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 249.088472][ T8717] netlink: 'syz.5.631': attribute type 4 has an invalid length. [ 249.275956][ T8718] tipc: Started in network mode [ 249.280798][ T8718] tipc: Node identity , cluster identity 4711 [ 249.339928][ T8718] tipc: Failed to set node id, please configure manually [ 249.373257][ T8718] tipc: Enabling of bearer rejected, failed to enable media [ 250.663213][ T9] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 251.303650][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 251.311267][ T9] usb 5-1: config 2 has an invalid interface number: 233 but max is 0 [ 251.327789][ T9] usb 5-1: config 2 has no interface number 0 [ 251.355253][ T9] usb 5-1: config 2 interface 233 has no altsetting 0 [ 251.471044][ T9] usb 5-1: New USB device found, idVendor=1b80, idProduct=e1cc, bcdDevice=6d.b0 [ 251.518941][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.634612][ T9] usb 5-1: Product: syz [ 251.711305][ T9] usb 5-1: Manufacturer: syz [ 251.833181][ T42] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 251.843232][ T9] usb 5-1: SerialNumber: syz [ 251.921230][ T9] em28xx 5-1:2.233: New device syz syz @ 480 Mbps (1b80:e1cc, interface 233, class 233) [ 252.028194][ T9] em28xx 5-1:2.233: Video interface 233 found: bulk [ 252.671629][ T8759] netlink: 'syz.6.644': attribute type 4 has an invalid length. [ 252.957134][ T9] em28xx 5-1:2.233: unknown em28xx chip ID (0) [ 253.004667][ T8764] syz_tun: entered allmulticast mode [ 253.589148][ T9] em28xx 5-1:2.233: read from i2c device at 0xa0 failed with unknown error (status=246) [ 253.603433][ T8762] syz_tun: left allmulticast mode [ 253.668980][ T9] em28xx 5-1:2.233: board has no eeprom [ 253.846542][ T8761] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 253.974777][ T8761] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 254.157590][ T30] audit: type=1400 audit(1764190156.339:608): avc: denied { write } for pid=8731 comm="syz.4.637" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 254.240469][ T8782] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 254.240469][ T8782] program syz.3.650 not setting count and/or reply_len properly [ 254.243321][ T9] em28xx 5-1:2.233: Identified as Delock 61959 (card=89) [ 254.257328][ T5922] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 254.320420][ T9] em28xx 5-1:2.233: Currently, V4L2 is not supported on this model [ 254.394651][ T5949] em28xx 5-1:2.233: Binding DVB extension [ 254.411664][ T5949] em28xx 5-1:2.233: no endpoint for DVB mode and transfer type 0 [ 254.433307][ T5922] usb 6-1: Using ep0 maxpacket: 16 [ 254.440644][ T9] usb 5-1: USB disconnect, device number 13 [ 254.473253][ T5949] em28xx 5-1:2.233: failed to pre-allocate USB transfer buffers for DVB. [ 254.477820][ T5922] usb 6-1: config index 0 descriptor too short (expected 16456, got 72) [ 254.492666][ T9] em28xx 5-1:2.233: Disconnecting em28xx [ 254.520142][ T5949] em28xx 5-1:2.233: Registering input extension [ 254.546447][ T5922] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 254.572336][ T9] em28xx 5-1:2.233: Closing input extension [ 254.599215][ T5922] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 254.657096][ T5922] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 254.680746][ T5922] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 254.684082][ T9] em28xx 5-1:2.233: Freeing device [ 254.708553][ T5922] usb 6-1: config 0 has no interface number 0 [ 254.723473][ T5922] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 254.887730][ T5922] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 254.921252][ T5922] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 254.937442][ T5922] usb 6-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 254.950802][ T5922] usb 6-1: config 0 interface 125 has no altsetting 0 [ 254.958817][ T5922] usb 6-1: config 0 interface 125 has no altsetting 2 [ 254.969205][ T5922] usb 6-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 254.994915][ T5922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.005463][ T5922] usb 6-1: Product: syz [ 255.009657][ T5922] usb 6-1: Manufacturer: syz [ 255.014401][ T5922] usb 6-1: SerialNumber: syz [ 255.036598][ T5922] usb 6-1: config 0 descriptor?? [ 255.077070][ T5922] usb 6-1: selecting invalid altsetting 2 [ 255.206015][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.212413][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.327866][ T9] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 255.381728][ T8799] netlink: 'syz.3.656': attribute type 4 has an invalid length. [ 255.593238][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 255.624227][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 255.661366][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 255.702104][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 255.746562][ T8801] netlink: 32 bytes leftover after parsing attributes in process `syz.3.657'. [ 255.749312][ T9] usb 5-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 255.772971][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.803446][ T9] usb 5-1: config 0 descriptor?? [ 255.818761][ T8804] netlink: 8 bytes leftover after parsing attributes in process `syz.6.658'. [ 256.133336][ T42] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 256.178976][ T5922] get_1284_register timeout [ 256.214021][ C1] usb 6-1: async_complete: urb error -104 [ 256.220562][ T5922] uss720 6-1:0.125: probe with driver uss720 failed with error -5 [ 256.363169][ T42] usb 3-1: device descriptor read/64, error -71 [ 256.606184][ T5922] usb 6-1: USB disconnect, device number 2 [ 256.663326][ T9] input: HID 0955:7214 Haptics as /devices/virtual/input/input10 [ 256.674641][ T8791] random: crng reseeded on system resumption [ 256.696734][ T30] audit: type=1400 audit(1764190158.859:609): avc: denied { read write } for pid=8790 comm="syz.4.654" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 256.757325][ T9] shield 0003:0955:7214.000F: Registered Thunderstrike controller [ 256.773226][ T30] audit: type=1400 audit(1764190158.859:610): avc: denied { ioctl open } for pid=8790 comm="syz.4.654" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 256.814447][ T9] shield 0003:0955:7214.000F: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.4-1/input0 [ 256.891999][ T30] audit: type=1400 audit(1764190158.939:611): avc: denied { read } for pid=5167 comm="acpid" name="event4" dev="devtmpfs" ino=2935 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 256.906064][ T42] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 257.023214][ T30] audit: type=1400 audit(1764190158.939:612): avc: denied { open } for pid=5167 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2935 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 257.058624][ T42] usb 3-1: device descriptor read/64, error -71 [ 257.133504][ T30] audit: type=1400 audit(1764190158.939:613): avc: denied { ioctl } for pid=5167 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2935 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 257.135535][ T5885] usb 5-1: USB disconnect, device number 14 [ 257.173317][ T9] shield 0003:0955:7214.000F: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 257.183694][ T42] usb usb3-port1: attempt power cycle [ 257.209426][ T9] shield 0003:0955:7214.000F: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 257.238142][ T9] shield 0003:0955:7214.000F: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 257.254386][ T9] shield 0003:0955:7214.000F: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 257.550966][ T42] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 257.801538][ T42] usb 3-1: device descriptor read/8, error -71 [ 258.213259][ T42] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 258.249424][ T42] usb 3-1: device descriptor read/8, error -71 [ 258.366269][ T42] usb usb3-port1: unable to enumerate USB device [ 258.401685][ T8854] binder: 8851:8854 unknown command 0 [ 258.414279][ T8854] binder: 8851:8854 ioctl c0306201 200000000080 returned -22 [ 258.431362][ T8854] binder: 8851:8854 ioctl 40a85321 200000000440 returned -22 [ 258.470633][ T8854] binder: 8851:8854 ioctl c018620c 200000000300 returned -1 [ 258.893685][ T5885] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 259.143124][ T5885] usb 6-1: Using ep0 maxpacket: 16 [ 259.156881][ T5885] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 259.171224][ T5885] usb 6-1: config 0 interface 0 has no altsetting 0 [ 259.185486][ T5885] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 259.213316][ T5885] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.247591][ T5885] usb 6-1: config 0 descriptor?? [ 259.421362][ T9] IPVS: starting estimator thread 0... [ 259.513262][ T8873] IPVS: using max 44 ests per chain, 105600 per kthread [ 259.691019][ T5885] nzxt-smart2 0003:1E71:2009.0010: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 260.170434][ T5885] usb 6-1: USB disconnect, device number 3 [ 260.360858][ T9] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 260.773164][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 260.804361][ T9] usb 4-1: config 0 has an invalid interface number: 156 but max is 0 [ 260.840073][ T9] usb 4-1: config 0 has no interface number 0 [ 260.866913][ T9] usb 4-1: config 0 interface 156 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 260.927719][ T9] usb 4-1: config 0 interface 156 has no altsetting 0 [ 260.972371][ T9] usb 4-1: New USB device found, idVendor=1234, idProduct=0002, bcdDevice=c8.36 [ 261.001961][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.060144][ T9] usb 4-1: Product: syz [ 261.068416][ T8898] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 261.068416][ T8898] program syz.6.687 not setting count and/or reply_len properly [ 261.085439][ T9] usb 4-1: Manufacturer: syz [ 261.090104][ T9] usb 4-1: SerialNumber: syz [ 261.116504][ T9] usb 4-1: config 0 descriptor?? [ 261.156855][ T8883] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 261.284683][ T10] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 261.305191][ T10] hid-generic 0000:0000:0000.0011: hidraw0: HID v0.00 Device [syz1] on syz0 [ 261.423183][ T30] audit: type=1400 audit(1764190163.589:614): avc: denied { bind } for pid=8882 comm="syz.3.682" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 261.755843][ T9] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.156/input/input12 [ 261.779424][ T30] audit: type=1400 audit(1764190163.929:615): avc: denied { write } for pid=8882 comm="syz.3.682" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 262.103176][ T42] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 262.129679][ T5870] usb 4-1: USB disconnect, device number 20 [ 262.129802][ C0] usbtouchscreen 4-1:0.156: usbtouch_irq - usb_submit_urb failed with result: -19 [ 262.294884][ T42] usb 7-1: config index 0 descriptor too short (expected 12571, got 27) [ 262.324326][ T42] usb 7-1: config 52 has too many interfaces: 56, using maximum allowed: 32 [ 262.338042][ T42] usb 7-1: config 52 has an invalid descriptor of length 52, skipping remainder of the config [ 262.369235][ T42] usb 7-1: config 52 has 0 interfaces, different from the descriptor's value: 56 [ 262.391394][ T42] usb 7-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 262.401107][ T42] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.433589][ T42] usb 7-1: Product: syz [ 262.446977][ T42] usb 7-1: Manufacturer: syz [ 262.461855][ T42] usb 7-1: SerialNumber: syz [ 262.839671][ T30] audit: type=1400 audit(1764190165.019:616): avc: denied { accept } for pid=8931 comm="syz.5.692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 262.982422][ T8935] netlink: 12 bytes leftover after parsing attributes in process `syz.6.690'. [ 263.856567][ T8949] netlink: 4 bytes leftover after parsing attributes in process `syz.2.695'. [ 265.959141][ T8973] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 265.959141][ T8973] program syz.5.700 not setting count and/or reply_len properly [ 266.494215][ T42] usb 7-1: USB disconnect, device number 3 [ 266.512092][ T8981] overlayfs: failed to resolve './file1': -2 [ 266.717515][ T8983] netlink: 8 bytes leftover after parsing attributes in process `syz.5.704'. [ 269.535883][ T30] audit: type=1400 audit(1764190171.719:617): avc: denied { mounton } for pid=9012 comm="syz.3.712" path="/153/file0" dev="tmpfs" ino=813 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 269.559895][ T5922] kernel write not supported for file [eventfd] (pid: 5922 comm: kworker/1:5) [ 269.580436][ T5922] kernel write not supported for file [eventfd] (pid: 5922 comm: kworker/1:5) [ 269.979334][ T30] audit: type=1400 audit(1764190172.159:618): avc: denied { read write } for pid=9025 comm="syz.3.717" name="mouse0" dev="devtmpfs" ino=990 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 270.174225][ T9029] Illegal XDP return value 4294967274 on prog (id 126) dev N/A, expect packet loss! [ 270.257661][ T30] audit: type=1400 audit(1764190172.159:619): avc: denied { open } for pid=9025 comm="syz.3.717" path="/dev/input/mouse0" dev="devtmpfs" ino=990 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 270.281532][ C1] vkms_vblank_simulate: vblank timer overrun [ 270.338046][ T9018] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 270.864625][ T9041] netlink: 'syz.6.721': attribute type 4 has an invalid length. [ 271.615079][ T5821] Bluetooth: hci0: command 0x0406 tx timeout [ 271.763529][ T30] audit: type=1400 audit(1764190173.929:620): avc: denied { ioctl } for pid=9062 comm="syz.4.729" path="socket:[23682]" dev="sockfs" ino=23682 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 271.823306][ T9065] bond1: (slave bond_slave_1): Device is not our slave [ 271.836444][ T9065] bond1: option active_slave: invalid value (bond_slave_1) [ 271.936615][ T10] IPVS: starting estimator thread 0... [ 271.948530][ T9065] bond1 (unregistering): Released all slaves [ 272.303298][ T9070] IPVS: using max 75 ests per chain, 180000 per kthread [ 272.943698][ T10] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 273.143162][ T10] usb 7-1: Using ep0 maxpacket: 8 [ 273.149630][ T10] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 273.178160][ T30] audit: type=1400 audit(1764190175.359:621): avc: denied { setopt } for pid=9080 comm="syz.3.733" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 273.186010][ T10] usb 7-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 273.287491][ T10] usb 7-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 273.594927][ T10] usb 7-1: Product: syz [ 273.599105][ T10] usb 7-1: Manufacturer: syz [ 273.871355][ T10] usb 7-1: SerialNumber: syz [ 273.999217][ T9095] overlayfs: failed to resolve './bus': -2 [ 274.173503][ T42] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 274.199115][ T10] usb 7-1: Invalid connection information received from device [ 274.494266][ T10] usb 7-1: USB disconnect, device number 4 [ 274.577962][ T9106] FAULT_INJECTION: forcing a failure. [ 274.577962][ T9106] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 274.595385][ T9106] CPU: 1 UID: 0 PID: 9106 Comm: syz.2.742 Not tainted syzkaller #0 PREEMPT(full) [ 274.595401][ T9106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 274.595408][ T9106] Call Trace: [ 274.595411][ T9106] [ 274.595416][ T9106] dump_stack_lvl+0x16c/0x1f0 [ 274.595430][ T9106] should_fail_ex+0x512/0x640 [ 274.595446][ T9106] _copy_from_user+0x2e/0xd0 [ 274.595460][ T9106] ____sys_sendmsg+0x607/0xc70 [ 274.595474][ T9106] ? __pfx_____sys_sendmsg+0x10/0x10 [ 274.595490][ T9106] ___sys_sendmsg+0x134/0x1d0 [ 274.595506][ T9106] ? __pfx____sys_sendmsg+0x10/0x10 [ 274.595518][ T9106] ? __lock_acquire+0x622/0x1c90 [ 274.595543][ T9106] __sys_sendmsg+0x16d/0x220 [ 274.595558][ T9106] ? __pfx___sys_sendmsg+0x10/0x10 [ 274.595580][ T9106] do_syscall_64+0xcd/0xfa0 [ 274.595591][ T9106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.595602][ T9106] RIP: 0033:0x7f0cb498f749 [ 274.595611][ T9106] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 274.595621][ T9106] RSP: 002b:00007f0cb5876038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 274.595632][ T9106] RAX: ffffffffffffffda RBX: 00007f0cb4be5fa0 RCX: 00007f0cb498f749 [ 274.595638][ T9106] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000004 [ 274.595644][ T9106] RBP: 00007f0cb5876090 R08: 0000000000000000 R09: 0000000000000000 [ 274.595650][ T9106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 274.595656][ T9106] R13: 00007f0cb4be6038 R14: 00007f0cb4be5fa0 R15: 00007ffc01e01b98 [ 274.595669][ T9106] [ 274.883322][ T42] usb 5-1: Using ep0 maxpacket: 32 [ 274.892781][ T42] usb 5-1: New USB device found, idVendor=0ac8, idProduct=c301, bcdDevice= d.65 [ 274.901907][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.909972][ T42] usb 5-1: Product: syz [ 274.914171][ T42] usb 5-1: Manufacturer: syz [ 274.918753][ T42] usb 5-1: SerialNumber: syz [ 274.926010][ T42] usb 5-1: config 0 descriptor?? [ 274.934683][ T42] gspca_main: vc032x-2.14.0 probing 0ac8:c301 [ 274.993193][ T5922] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 275.094981][ T10] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 275.155169][ T5922] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 275.173178][ T5922] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 275.192656][ T5922] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 275.215657][ T5922] usb 4-1: config 0 descriptor?? [ 275.235152][ T5922] pwc: Askey VC010 type 2 USB webcam detected. [ 275.267236][ T10] usb 3-1: config 49 has an invalid descriptor of length 54, skipping remainder of the config [ 275.299150][ T10] usb 3-1: config 49 has 0 interfaces, different from the descriptor's value: 1 [ 275.321235][ T10] usb 3-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 275.333768][ T30] audit: type=1400 audit(1764190177.519:622): avc: denied { write } for pid=9114 comm="syz.6.746" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 275.340909][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.386331][ T10] usb 3-1: Product: syz [ 275.390535][ T10] usb 3-1: Manufacturer: syz [ 275.403162][ T10] usb 3-1: SerialNumber: syz [ 275.444235][ T30] audit: type=1400 audit(1764190177.629:623): avc: denied { lock } for pid=9114 comm="syz.6.746" path="socket:[23835]" dev="sockfs" ino=23835 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 275.571173][ T9092] sp0: Synchronizing with TNC [ 275.578531][ T9091] [U] è [ 275.625403][ T5922] pwc: recv_control_msg error -32 req 02 val 2b00 [ 275.642803][ T5922] pwc: recv_control_msg error -32 req 02 val 2700 [ 275.675242][ T42] gspca_vc032x: reg_r err -71 [ 275.681600][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.691501][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.698286][ T5922] pwc: recv_control_msg error -32 req 02 val 2c00 [ 275.712104][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.728420][ T5922] pwc: recv_control_msg error -32 req 04 val 1000 [ 275.738084][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.750446][ T5922] pwc: recv_control_msg error -32 req 04 val 1300 [ 275.766542][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.772793][ T5922] pwc: recv_control_msg error -32 req 04 val 1400 [ 275.796672][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.810536][ T5922] pwc: recv_control_msg error -32 req 02 val 2000 [ 275.828640][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.839858][ T5922] pwc: recv_control_msg error -32 req 02 val 2100 [ 275.853242][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.860198][ T5922] pwc: recv_control_msg error -32 req 04 val 1500 [ 275.875833][ T5922] pwc: recv_control_msg error -32 req 02 val 2500 [ 275.887508][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.899511][ T5922] pwc: recv_control_msg error -32 req 02 val 2400 [ 275.910499][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.918627][ T5922] pwc: recv_control_msg error -32 req 02 val 2600 [ 275.936851][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.950890][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.964900][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 275.983343][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 276.001186][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 276.017038][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 276.034695][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 276.051699][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 276.068703][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 276.086062][ T42] gspca_vc032x: Unknown sensor... [ 276.105068][ T42] vc032x 5-1:0.0: probe with driver vc032x failed with error -22 [ 276.132707][ T5922] pwc: recv_control_msg error -71 req 02 val 2800 [ 276.144410][ T5922] pwc: recv_control_msg error -71 req 04 val 1100 [ 276.154753][ T42] usb 5-1: USB disconnect, device number 15 [ 276.182428][ T5922] pwc: recv_control_msg error -71 req 04 val 1200 [ 276.248472][ T5922] pwc: Registered as video103. [ 276.299138][ T5922] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input13 [ 276.545973][ T9112] netlink: 16 bytes leftover after parsing attributes in process `syz.5.745'. [ 276.599554][ T5133] Bluetooth: hci6: unexpected event 0x2f length: 509 > 260 [ 276.633707][ T5922] usb 4-1: USB disconnect, device number 21 [ 277.808322][ T5133] Bluetooth: hci4: command 0x0406 tx timeout [ 278.053167][ T30] audit: type=1400 audit(1764190180.229:624): avc: denied { append } for pid=9137 comm="syz.6.753" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 278.489085][ T10] usb 3-1: USB disconnect, device number 23 [ 279.213463][ T10] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 279.543239][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 279.555097][ T10] usb 6-1: New USB device found, idVendor=0ac8, idProduct=c301, bcdDevice= d.65 [ 279.568969][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.577232][ T10] usb 6-1: Product: syz [ 279.581526][ T10] usb 6-1: Manufacturer: syz [ 279.586285][ T10] usb 6-1: SerialNumber: syz [ 279.600578][ T10] usb 6-1: config 0 descriptor?? [ 280.092710][ T10] gspca_main: vc032x-2.14.0 probing 0ac8:c301 [ 280.801233][ T9154] sp0: Synchronizing with TNC [ 280.813203][ T42] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 280.882078][ T9152] [U] è [ 280.991451][ T42] usb 3-1: Using ep0 maxpacket: 32 [ 281.003208][ T42] usb 3-1: config 0 has an invalid interface number: 154 but max is 0 [ 281.011892][ T42] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 281.024263][ T10] gspca_vc032x: reg_r err -71 [ 281.028961][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.042846][ T42] usb 3-1: config 0 has no interface number 0 [ 281.052879][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.063366][ T5863] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 281.080863][ T42] usb 3-1: config 0 interface 154 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 281.126821][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.137418][ T42] usb 3-1: config 0 interface 154 altsetting 0 has an endpoint descriptor with address 0x99, changing to 0x89 [ 281.149387][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.152969][ T42] usb 3-1: config 0 interface 154 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 281.165970][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.167116][ T42] usb 3-1: config 0 interface 154 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 281.183636][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.222064][ T42] usb 3-1: config 0 interface 154 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 10 [ 281.236218][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.238028][ T5863] usb 5-1: config 49 has an invalid descriptor of length 54, skipping remainder of the config [ 281.251948][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.251962][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.251969][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.251977][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.251984][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.251993][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.252002][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.252010][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.252019][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.252027][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.252035][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.252043][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 281.252052][ T10] gspca_vc032x: Unknown sensor... [ 281.252113][ T10] vc032x 6-1:0.0: probe with driver vc032x failed with error -22 [ 281.273431][ T10] usb 6-1: USB disconnect, device number 4 [ 281.341130][ T42] usb 3-1: New USB device found, idVendor=0856, idProduct=ac22, bcdDevice=3b.d1 [ 281.350265][ T42] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.363202][ T42] usb 3-1: Product: syz [ 281.369173][ T42] usb 3-1: Manufacturer: syz [ 281.377381][ T42] usb 3-1: SerialNumber: syz [ 281.390057][ T42] usb 3-1: config 0 descriptor?? [ 281.395536][ T5863] usb 5-1: config 49 has 0 interfaces, different from the descriptor's value: 1 [ 281.437975][ T5863] usb 5-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 281.448109][ T5863] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.456204][ T5863] usb 5-1: Product: syz [ 281.460361][ T5863] usb 5-1: Manufacturer: syz [ 281.467292][ T5863] usb 5-1: SerialNumber: syz [ 281.747402][ T9184] netlink: 12 bytes leftover after parsing attributes in process `syz.2.765'. [ 282.194002][ T42] mos7840 3-1:0.154: missing endpoints [ 282.242322][ T9193] overlayfs: failed to resolve './file0': -2 [ 282.249745][ T42] usb 3-1: USB disconnect, device number 24 [ 282.284663][ T30] audit: type=1400 audit(1764190184.459:625): avc: denied { connect } for pid=9194 comm="syz.3.771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 282.342494][ T30] audit: type=1400 audit(1764190184.489:626): avc: denied { write } for pid=9194 comm="syz.3.771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 282.361750][ C0] vkms_vblank_simulate: vblank timer overrun [ 282.753418][ T30] audit: type=1400 audit(1764190184.489:627): avc: denied { getopt } for pid=9194 comm="syz.3.771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 282.894865][ T30] audit: type=1400 audit(1764190185.079:628): avc: denied { bind } for pid=9202 comm="syz.5.774" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 283.023700][ T5885] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 283.284136][ T5885] usb 4-1: Using ep0 maxpacket: 8 [ 283.290903][ T5885] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 283.313192][ T5885] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 283.322924][ T5885] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 283.395219][ T5885] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 283.897345][ T5885] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 284.043813][ T5885] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 284.206744][ T5863] usb 5-1: USB disconnect, device number 16 [ 284.213578][ T5885] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 284.607495][ T5821] Bluetooth: hci6: link tx timeout [ 284.612970][ T5821] Bluetooth: hci6: killing stalled connection 10:aa:aa:aa:aa:aa [ 284.623790][ T5821] Bluetooth: hci6: link tx timeout [ 284.628902][ T5821] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 284.636950][ T5821] Bluetooth: hci6: link tx timeout [ 284.642063][ T5821] Bluetooth: hci6: killing stalled connection 10:aa:aa:aa:aa:aa [ 284.650653][ T5821] Bluetooth: hci6: link tx timeout [ 284.655489][ T5885] usb 4-1: usb_control_msg returned -32 [ 284.655802][ T5821] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 284.661778][ T9201] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 284.696445][ T9217] netlink: 'syz.2.779': attribute type 2 has an invalid length. [ 284.713946][ T5885] usbtmc 4-1:16.0: can't read capabilities [ 284.730009][ T9201] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 284.738085][ T9217] netlink: 'syz.2.779': attribute type 1 has an invalid length. [ 285.910537][ T9224] hub 2-0:1.0: USB hub found [ 285.915855][ T9224] hub 2-0:1.0: 1 port detected [ 285.979155][ T30] audit: type=1400 audit(1764190188.109:629): avc: denied { mount } for pid=9220 comm="syz.4.780" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 286.149796][ T30] audit: type=1400 audit(1764190188.109:630): avc: denied { remount } for pid=9220 comm="syz.4.780" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 286.264731][ T30] audit: type=1400 audit(1764190188.439:631): avc: denied { unmount } for pid=5811 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 286.723264][ T5821] Bluetooth: hci6: command 0x0406 tx timeout [ 286.812372][ T9234] hfsplus: unable to find HFS+ superblock [ 287.056556][ T5885] usb 4-1: USB disconnect, device number 22 [ 287.270932][ T9243] overlayfs: failed to resolve './file0': -2 [ 289.065527][ T5821] Bluetooth: hci6: command 0x0406 tx timeout [ 290.424491][ T5863] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 290.483989][ T5863] hid-generic 0000:0000:0000.0012: hidraw0: HID v0.00 Device [syz1] on syz0 [ 290.868019][ T5863] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 290.924716][ T5863] hid-generic 0000:0000:0000.0013: hidraw1: HID v0.00 Device [syz1] on syz0 [ 290.987040][ T9285] fido_id[9285]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 291.183141][ T5885] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 291.293507][ T10] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 291.366625][ T5885] usb 3-1: New USB device found, idVendor=13d8, idProduct=0020, bcdDevice=f7.31 [ 291.453214][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 291.501172][ T10] usb 6-1: New USB device found, idVendor=0ac8, idProduct=c301, bcdDevice= d.65 [ 291.512171][ T5885] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.763169][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.773610][ T5885] usb 3-1: config 0 descriptor?? [ 291.873693][ T10] usb 6-1: Product: syz [ 292.016340][ T10] usb 6-1: Manufacturer: syz [ 292.020958][ T10] usb 6-1: SerialNumber: syz [ 292.071346][ T5885] usb 3-1: selecting invalid altsetting 3 [ 292.116863][ T5885] comedi comedi5: could not set alternate setting 3 in high speed [ 292.139444][ T10] usb 6-1: config 0 descriptor?? [ 292.157520][ T5885] usbduxsigma 3-1:0.0: driver 'usbduxsigma' failed to auto-configure device. [ 292.169977][ T10] gspca_main: vc032x-2.14.0 probing 0ac8:c301 [ 292.259586][ T5885] usbduxsigma 3-1:0.0: probe with driver usbduxsigma failed with error -22 [ 292.331405][ T5885] usb 3-1: USB disconnect, device number 25 [ 292.826648][ T9294] sp0: Synchronizing with TNC [ 292.888437][ T9293] [U] è [ 293.149876][ T10] gspca_vc032x: reg_r err -110 [ 293.375515][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.419216][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.434797][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.455693][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.473639][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.510054][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.533131][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.538420][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.623152][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.629976][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.637207][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.642574][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.658843][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.685562][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 293.691155][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 294.123759][ T30] audit: type=1400 audit(1764190195.939:632): avc: denied { getopt } for pid=9324 comm="syz.6.804" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 294.158895][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 294.164662][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 294.169993][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 294.175787][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 294.183154][ T10] gspca_vc032x: Unknown sensor... [ 294.193594][ T10] vc032x 6-1:0.0: probe with driver vc032x failed with error -22 [ 294.231594][ T10] usb 6-1: USB disconnect, device number 5 [ 295.527870][ T30] audit: type=1400 audit(1764190197.709:633): avc: denied { execute } for pid=9357 comm="syz.4.810" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=24635 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 296.628776][ T9383] netlink: 'syz.3.813': attribute type 4 has an invalid length. [ 297.301491][ T30] audit: type=1400 audit(1764190199.479:634): avc: denied { mount } for pid=9389 comm="syz.2.817" name="/" dev="hugetlbfs" ino=25601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 298.263105][ T9399] /dev/nullb0: Can't open blockdev [ 298.898021][ T9406] tipc: Started in network mode [ 298.915735][ T9406] tipc: Node identity 96017b6950e1, cluster identity 4711 [ 298.981720][ T9406] tipc: Enabled bearer , priority 0 [ 299.050764][ T9406] tipc: Resetting bearer [ 299.317863][ T9413] netlink: 'syz.5.823': attribute type 1 has an invalid length. [ 299.475894][ T9413] bond1: (slave geneve2): making interface the new active one [ 299.573969][ T9413] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 299.704954][ T1157] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 299.993253][ T9422] netlink: 'syz.2.825': attribute type 4 has an invalid length. [ 300.133962][ T9401] tipc: Disabling bearer [ 300.155447][ T30] audit: type=1400 audit(1764190202.319:635): avc: denied { write } for pid=9412 comm="syz.5.823" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 300.396272][ T79] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 300.440900][ T42] tipc: Node number set to 3336600425 [ 300.478995][ T79] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 300.503565][ T79] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 301.653272][ T42] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 301.925573][ T5949] hid-generic 0000:0000:0000.0014: unknown main item tag 0x0 [ 301.943007][ T42] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 301.953450][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 301.965423][ T42] usb 6-1: Product: syz [ 301.969560][ T42] usb 6-1: Manufacturer: syz [ 301.975685][ T5949] hid-generic 0000:0000:0000.0014: hidraw0: HID v0.00 Device [syz1] on syz0 [ 302.146410][ T42] usb 6-1: SerialNumber: syz [ 302.576897][ T9437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 302.607959][ T9437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 302.758542][ T9460] netlink: 24 bytes leftover after parsing attributes in process `syz.2.833'. [ 303.216241][ T42] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 303.278846][ T42] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 303.326764][ T42] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 303.409544][ T42] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -32 [ 303.440775][ T42] usb 6-1: USB disconnect, device number 6 [ 303.764299][ T9483] netlink: 'syz.2.837': attribute type 4 has an invalid length. [ 304.536853][ T9500] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 305.557868][ T10] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 305.905202][ T10] usb 3-1: config index 0 descriptor too short (expected 12571, got 27) [ 306.060243][ T10] usb 3-1: config 52 has too many interfaces: 56, using maximum allowed: 32 [ 306.129059][ T10] usb 3-1: config 52 has an invalid descriptor of length 52, skipping remainder of the config [ 306.167743][ T10] usb 3-1: config 52 has 0 interfaces, different from the descriptor's value: 56 [ 306.199779][ T10] usb 3-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 306.232609][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.250230][ T10] usb 3-1: Product: syz [ 306.265307][ T10] usb 3-1: Manufacturer: syz [ 306.275729][ T10] usb 3-1: SerialNumber: syz [ 306.716663][ T9526] netlink: 8 bytes leftover after parsing attributes in process `syz.2.840'. [ 307.377554][ T42] hid-generic 0000:0000:0000.0015: unknown main item tag 0x0 [ 307.397290][ T42] hid-generic 0000:0000:0000.0015: hidraw0: HID v0.00 Device [syz1] on syz0 [ 309.572707][ T10] usb 3-1: USB disconnect, device number 26 [ 309.660171][ T5821] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 309.670042][ T5821] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 309.677647][ T5821] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 309.685778][ T5821] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 309.700028][ T5821] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 310.464754][ T9564] lo speed is unknown, defaulting to 1000 [ 310.948404][ T5863] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 311.512725][ T5863] usb 6-1: device descriptor read/all, error -61 [ 311.711328][ T5863] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 311.843204][ T5821] Bluetooth: hci7: command tx timeout [ 311.994898][ T5863] usb 6-1: device descriptor read/64, error -71 [ 312.476717][ T5863] usb usb6-port1: attempt power cycle [ 312.496978][ T13] Bluetooth: hci8: Frame reassembly failed (-84) [ 313.280792][ T9] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 313.340250][ T9] hid-generic 0000:0000:0000.0016: hidraw0: HID v0.00 Device [syz1] on syz0 [ 313.451902][ T9564] chnl_net:caif_netlink_parms(): no params data found [ 313.490579][ T9618] fido_id[9618]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 313.533511][ T5863] usb usb6-port1: Cannot enable. Maybe the USB cable is bad? [ 313.676426][ T5863] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 313.923903][ T5133] Bluetooth: hci7: command tx timeout [ 313.933143][ T5863] usb 6-1: Using ep0 maxpacket: 32 [ 313.963876][ T5863] usb 6-1: New USB device found, idVendor=0ac8, idProduct=c301, bcdDevice= d.65 [ 313.981755][ T5863] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.000549][ T5863] usb 6-1: Product: syz [ 314.016888][ T5863] usb 6-1: Manufacturer: syz [ 314.022696][ T5863] usb 6-1: SerialNumber: syz [ 314.041015][ T5863] usb 6-1: config 0 descriptor?? [ 314.058849][ T5863] gspca_main: vc032x-2.14.0 probing 0ac8:c301 [ 314.074272][ T9564] bridge0: port 1(bridge_slave_0) entered blocking state [ 314.081404][ T9564] bridge0: port 1(bridge_slave_0) entered disabled state [ 314.090662][ T9564] bridge_slave_0: entered allmulticast mode [ 314.106228][ T9564] bridge_slave_0: entered promiscuous mode [ 314.132074][ T9564] bridge0: port 2(bridge_slave_1) entered blocking state [ 314.160692][ T9564] bridge0: port 2(bridge_slave_1) entered disabled state [ 314.185330][ T9564] bridge_slave_1: entered allmulticast mode [ 314.249846][ T9564] bridge_slave_1: entered promiscuous mode [ 314.323495][ T5821] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 314.510689][ T9564] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 314.571581][ T9564] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 314.758533][ T9564] team0: Port device team_slave_0 added [ 314.809606][ T9564] team0: Port device team_slave_1 added [ 314.861591][ T5863] gspca_vc032x: reg_w err -71 [ 314.868973][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 314.874782][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 314.889873][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 314.904224][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 314.917431][ T9638] bridge1: entered allmulticast mode [ 314.945626][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 314.957675][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 314.973377][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 314.978661][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 314.991030][ T9564] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 315.002435][ T9642] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 315.002435][ T9642] program syz.4.868 not setting count and/or reply_len properly [ 315.019298][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.023295][ T9564] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 315.065664][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.101376][ T9564] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 315.101398][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.171200][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.181455][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.187201][ T9564] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 315.187215][ T9564] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 315.187237][ T9564] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 315.268366][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.292106][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.297618][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.304288][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.309627][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.884698][ T9564] hsr_slave_0: entered promiscuous mode [ 315.892618][ T5863] gspca_vc032x: I2c Bus Busy Wait 10 [ 315.904248][ T9564] hsr_slave_1: entered promiscuous mode [ 315.921176][ T9564] debugfs: 'hsr0' already exists in 'hsr' [ 315.940795][ T5863] gspca_vc032x: Unknown sensor... [ 315.951198][ T9564] Cannot create hsr debugfs directory [ 315.951245][ T5863] vc032x 6-1:0.0: probe with driver vc032x failed with error -22 [ 316.023693][ T5133] Bluetooth: hci7: command tx timeout [ 316.104215][ T5863] usb 6-1: USB disconnect, device number 10 [ 316.712174][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.723232][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.780958][ T30] audit: type=1400 audit(1764190218.959:636): avc: denied { unmount } for pid=5811 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 317.422757][ T9564] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 317.996467][ T9] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 318.107538][ T9675] /dev/nullb0: Can't open blockdev [ 318.129519][ T5821] Bluetooth: hci7: command tx timeout [ 318.196192][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 318.250701][ T9668] team0 (unregistering): Port device team_slave_0 removed [ 318.339189][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 318.374993][ T9668] team0 (unregistering): Port device team_slave_1 removed [ 318.381751][ T9687] FAULT_INJECTION: forcing a failure. [ 318.381751][ T9687] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 318.415885][ T9687] CPU: 1 UID: 0 PID: 9687 Comm: syz.5.880 Not tainted syzkaller #0 PREEMPT(full) [ 318.415908][ T9687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 318.415917][ T9687] Call Trace: [ 318.415921][ T9687] [ 318.415925][ T9687] dump_stack_lvl+0x16c/0x1f0 [ 318.415940][ T9687] should_fail_ex+0x512/0x640 [ 318.415956][ T9687] _copy_to_iter+0x29f/0x1710 [ 318.415971][ T9687] ? chacha_block_generic+0x211/0x330 [ 318.415985][ T9687] ? __pfx__copy_to_iter+0x10/0x10 [ 318.416000][ T9687] ? lockdep_hardirqs_on+0x7c/0x110 [ 318.416011][ T9687] ? crng_make_state+0x48e/0x6d0 [ 318.416024][ T9687] get_random_bytes_user+0x17f/0x3c0 [ 318.416036][ T9687] ? __pfx_get_random_bytes_user+0x10/0x10 [ 318.416054][ T9687] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 318.416069][ T9687] ? import_ubuf+0x1b6/0x220 [ 318.416082][ T9687] __x64_sys_getrandom+0x183/0x290 [ 318.416094][ T9687] ? __pfx___x64_sys_getrandom+0x10/0x10 [ 318.416112][ T9687] do_syscall_64+0xcd/0xfa0 [ 318.416123][ T9687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.416134][ T9687] RIP: 0033:0x7f58d5d8f749 [ 318.416143][ T9687] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 318.416153][ T9687] RSP: 002b:00007f58d6bcc038 EFLAGS: 00000246 ORIG_RAX: 000000000000013e [ 318.416164][ T9687] RAX: ffffffffffffffda RBX: 00007f58d5fe6090 RCX: 00007f58d5d8f749 [ 318.416170][ T9687] RDX: 0000000000000000 RSI: 00000000ffffff9a RDI: 0000200000000240 [ 318.416176][ T9687] RBP: 00007f58d6bcc090 R08: 0000000000000000 R09: 0000000000000000 [ 318.416182][ T9687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 318.416188][ T9687] R13: 00007f58d5fe6128 R14: 00007f58d5fe6090 R15: 00007ffd309d1f48 [ 318.416201][ T9687] [ 318.837466][ T9] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 318.868504][ T9] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 318.879261][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.890556][ T9] usb 5-1: Product: syz [ 318.897317][ T9] usb 5-1: Manufacturer: syz [ 318.901901][ T9] usb 5-1: SerialNumber: syz [ 318.913743][ T9] usb 5-1: config 0 descriptor?? [ 319.065269][ T9564] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 319.144016][ T5870] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 319.171743][ T9564] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 319.221968][ T9564] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 319.314391][ T9691] bridge0: entered allmulticast mode [ 319.347803][ T9695] pim6reg: entered allmulticast mode [ 319.396464][ T5870] usb 3-1: config index 0 descriptor too short (expected 12571, got 27) [ 319.544675][ T5870] usb 3-1: config 52 has too many interfaces: 56, using maximum allowed: 32 [ 319.583158][ T5870] usb 3-1: config 52 has an invalid descriptor of length 52, skipping remainder of the config [ 319.625606][ T5870] usb 3-1: config 52 has 0 interfaces, different from the descriptor's value: 56 [ 319.675911][ T9] usb 5-1: USB disconnect, device number 17 [ 319.690203][ T5870] usb 3-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 319.727928][ T5870] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.773907][ T9564] 8021q: adding VLAN 0 to HW filter on device bond0 [ 319.780628][ T5870] usb 3-1: Product: syz [ 319.795591][ T5870] usb 3-1: Manufacturer: syz [ 319.800221][ T5870] usb 3-1: SerialNumber: syz [ 319.857032][ T9564] 8021q: adding VLAN 0 to HW filter on device team0 [ 319.894003][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 319.901136][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 319.960225][ T1157] bridge0: port 2(bridge_slave_1) entered blocking state [ 319.967328][ T1157] bridge0: port 2(bridge_slave_1) entered forwarding state [ 320.122626][ T9699] netlink: 8 bytes leftover after parsing attributes in process `syz.2.881'. [ 320.828395][ T5870] usb 3-1: USB disconnect, device number 27 [ 320.928237][ T9564] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 321.873016][ T9727] netlink: 4 bytes leftover after parsing attributes in process `syz.2.888'. [ 321.918500][ T9727] netlink: 64 bytes leftover after parsing attributes in process `syz.2.888'. [ 321.994126][ T9727] netlink: 24 bytes leftover after parsing attributes in process `syz.2.888'. [ 322.003002][ T9727] netlink: 152 bytes leftover after parsing attributes in process `syz.2.888'. [ 323.275328][ T9564] veth0_vlan: entered promiscuous mode [ 323.301521][ T9564] veth1_vlan: entered promiscuous mode [ 323.389148][ T9744] netlink: 'syz.3.894': attribute type 4 has an invalid length. [ 323.447820][ T9564] veth0_macvtap: entered promiscuous mode [ 323.464524][ T30] audit: type=1400 audit(1764190225.619:637): avc: denied { read } for pid=9741 comm="syz.2.892" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 323.912021][ T30] audit: type=1400 audit(1764190225.939:638): avc: denied { map } for pid=9746 comm="syz.5.893" path="socket:[27022]" dev="sockfs" ino=27022 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 323.975895][ T9564] veth1_macvtap: entered promiscuous mode [ 324.023660][ T30] audit: type=1400 audit(1764190225.939:639): avc: denied { read } for pid=9746 comm="syz.5.893" path="socket:[27022]" dev="sockfs" ino=27022 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 324.361245][ T9564] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 324.384282][ T9564] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 324.418109][ T5946] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 324.716349][ T5946] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 324.762768][ T9758] rdma_rxe: rxe_newlink: failed to add lo [ 324.799711][ T5946] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 324.833172][ T5946] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 325.298299][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 325.414023][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 326.439483][ T1157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 326.483097][ T1157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 327.627830][ T9782] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 327.893202][ T9782] UDF-fs: Scanning with blocksize 512 failed [ 327.907841][ T9782] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 328.303525][ T9782] UDF-fs: Scanning with blocksize 1024 failed [ 328.310197][ T9782] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 328.877511][ T9782] UDF-fs: Scanning with blocksize 2048 failed [ 328.903922][ T9782] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 328.911806][ T30] audit: type=1400 audit(1764190231.079:640): avc: denied { setopt } for pid=9793 comm="syz.3.908" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 329.176478][ T9799] netlink: 'syz.7.850': attribute type 4 has an invalid length. [ 329.375863][ T9782] UDF-fs: Scanning with blocksize 4096 failed [ 330.084766][ T9807] binder: 9806:9807 ioctl c0306201 200000000040 returned -22 [ 330.463895][ T9812] netlink: 152 bytes leftover after parsing attributes in process `syz.4.911'. [ 330.472853][ T9812] netlink: 20 bytes leftover after parsing attributes in process `syz.4.911'. [ 331.014268][ T30] audit: type=1400 audit(1764190233.189:641): avc: denied { setopt } for pid=9827 comm="syz.4.915" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 331.105790][ T9829] overlayfs: failed to get inode (-116) [ 331.111677][ T9829] overlayfs: failed to get inode (-116) [ 331.120567][ T9829] overlayfs: failed to get inode (-116) [ 331.154976][ T9829] overlayfs: failed to get inode (-116) [ 331.485331][ T9844] batadv_slave_0: entered promiscuous mode [ 331.504405][ T9844] batadv_slave_0: left promiscuous mode [ 331.541144][ T9847] batadv_slave_1: entered promiscuous mode [ 331.590609][ T9846] batadv_slave_1: left promiscuous mode [ 332.037616][ T5863] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 332.300390][ T9862] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 332.307993][ T9862] UDF-fs: Scanning with blocksize 512 failed [ 332.316188][ T5863] usb 3-1: device descriptor read/64, error -71 [ 332.332595][ T9862] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 332.340533][ T9862] UDF-fs: Scanning with blocksize 1024 failed [ 332.350701][ T9862] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 332.358267][ T9862] UDF-fs: Scanning with blocksize 2048 failed [ 332.367702][ T9862] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 332.376045][ T9862] UDF-fs: Scanning with blocksize 4096 failed [ 332.463274][ T9838] comedi comedi0: reset error (fatal) [ 332.827002][ T5863] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 333.103152][ T5863] usb 3-1: device descriptor read/64, error -71 [ 333.743426][ T5863] usb usb3-port1: attempt power cycle [ 334.274367][ T5863] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 334.519246][ T5863] usb 3-1: device descriptor read/8, error -71 [ 335.124090][ T5935] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 335.313307][ T5935] usb 5-1: Using ep0 maxpacket: 32 [ 335.607847][ T5935] usb 5-1: New USB device found, idVendor=0ac8, idProduct=c301, bcdDevice= d.65 [ 335.809690][ T9902] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 335.867449][ T5935] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.911266][ T5935] usb 5-1: Product: syz [ 335.926442][ T5935] usb 5-1: Manufacturer: syz [ 335.931065][ T5935] usb 5-1: SerialNumber: syz [ 335.940036][ T5935] usb 5-1: config 0 descriptor?? [ 335.987452][ T5935] gspca_main: vc032x-2.14.0 probing 0ac8:c301 [ 336.544010][ T5935] gspca_vc032x: reg_w err -110 [ 336.549848][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.556923][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.562433][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.567901][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.573458][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.579191][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.597163][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.626700][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.651619][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.659443][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.670169][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.690459][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.752916][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.772827][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.799877][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.815792][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.821162][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.830312][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.836441][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 336.843671][ T5935] gspca_vc032x: Unknown sensor... [ 336.892595][ T5935] vc032x 5-1:0.0: probe with driver vc032x failed with error -22 [ 337.050973][ T9918] overlayfs: missing 'lowerdir' [ 337.577141][ T9925] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 337.610485][ T9925] SELinux: policydb string SE 4inux does not match my string SE Linux [ 337.624416][ T9925] SELinux: failed to load policy [ 337.909351][ T5885] usb 5-1: USB disconnect, device number 18 [ 338.317340][ T9929] FAULT_INJECTION: forcing a failure. [ 338.317340][ T9929] name failslab, interval 1, probability 0, space 0, times 0 [ 338.330075][ T9929] CPU: 0 UID: 0 PID: 9929 Comm: syz.4.944 Not tainted syzkaller #0 PREEMPT(full) [ 338.330096][ T9929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 338.330106][ T9929] Call Trace: [ 338.330111][ T9929] [ 338.330117][ T9929] dump_stack_lvl+0x16c/0x1f0 [ 338.330139][ T9929] should_fail_ex+0x512/0x640 [ 338.330156][ T9929] ? fs_reclaim_acquire+0xae/0x150 [ 338.330176][ T9929] should_failslab+0xc2/0x120 [ 338.330196][ T9929] __kmalloc_noprof+0xdd/0x880 [ 338.330220][ T9929] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 338.330246][ T9929] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 338.330263][ T9929] tomoyo_realpath_from_path+0xc2/0x6e0 [ 338.330285][ T9929] ? tomoyo_profile+0x47/0x60 [ 338.330309][ T9929] tomoyo_path_number_perm+0x245/0x580 [ 338.330324][ T9929] ? tomoyo_path_number_perm+0x237/0x580 [ 338.330343][ T9929] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 338.330361][ T9929] ? find_held_lock+0x2b/0x80 [ 338.330403][ T9929] ? find_held_lock+0x2b/0x80 [ 338.330421][ T9929] ? hook_file_ioctl_common+0x145/0x410 [ 338.330448][ T9929] ? __fget_files+0x20e/0x3c0 [ 338.330475][ T9929] security_file_ioctl+0x9b/0x240 [ 338.330496][ T9929] __x64_sys_ioctl+0xb7/0x210 [ 338.330521][ T9929] do_syscall_64+0xcd/0xfa0 [ 338.330540][ T9929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 338.330557][ T9929] RIP: 0033:0x7f6db5d8f749 [ 338.330570][ T9929] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 338.330585][ T9929] RSP: 002b:00007f6db6c84038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 338.330601][ T9929] RAX: ffffffffffffffda RBX: 00007f6db5fe5fa0 RCX: 00007f6db5d8f749 [ 338.330611][ T9929] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 338.330621][ T9929] RBP: 00007f6db6c84090 R08: 0000000000000000 R09: 0000000000000000 [ 338.330630][ T9929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 338.330639][ T9929] R13: 00007f6db5fe6038 R14: 00007f6db5fe5fa0 R15: 00007ffdbccbba18 [ 338.330662][ T9929] [ 338.330669][ T9929] ERROR: Out of memory at tomoyo_realpath_from_path. [ 338.867481][ T9942] sg_write: data in/out 181/10 bytes for SCSI command 0xfd-- guessing data in; [ 338.867481][ T9942] program syz.7.947 not setting count and/or reply_len properly [ 339.222188][ T5133] Bluetooth: hci5: command 0x0406 tx timeout [ 340.171644][ T30] audit: type=1400 audit(1764190242.309:642): avc: denied { name_bind } for pid=9968 comm="syz.7.959" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 340.847192][ T9975] overlayfs: failed to clone upperpath [ 340.993497][ T30] audit: type=1400 audit(1764190243.159:643): avc: denied { create } for pid=9959 comm="syz.5.956" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 341.051281][ T9971] FAT-fs (loop11): unable to read boot sector [ 341.082544][ T30] audit: type=1400 audit(1764190243.209:644): avc: denied { mounton } for pid=9959 comm="syz.5.956" path="/105/file0" dev="tmpfs" ino=575 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 342.422103][ T30] audit: type=1400 audit(1764190244.589:645): avc: denied { unlink } for pid=7865 comm="syz-executor" name="file0" dev="tmpfs" ino=575 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 343.553463][ T31] INFO: task syz.0.472:7938 blocked for more than 143 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 343.633161][ T30] audit: type=1400 audit(1764190245.809:646): avc: denied { write } for pid=5795 comm="syz-executor" path="pipe:[3998]" dev="pipefs" ino=3998 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 343.656961][ T31] Not tainted syzkaller #0 [ 343.661890][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 343.755061][ T31] task:syz.0.472 state:D stack:28856 pid:7938 tgid:7937 ppid:5817 task_flags:0x400040 flags:0x00080002 [ 343.813176][ T30] audit: type=1400 audit(1764190245.909:647): avc: denied { read } for pid=10006 comm="syz.3.969" path="socket:[29697]" dev="sockfs" ino=29697 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 343.843142][ T31] Call Trace: [ 343.846472][ T31] [ 343.849401][ T31] __schedule+0x1190/0x5de0 [ 343.963320][ T31] ? check_path.constprop.0+0x24/0x50 [ 343.968724][ T31] ? __lock_acquire+0x622/0x1c90 [ 343.983414][ T31] ? __pfx___schedule+0x10/0x10 [ 343.988303][ T31] ? find_held_lock+0x2b/0x80 [ 344.043584][ T31] ? schedule+0x2d7/0x3a0 [ 344.047937][ T31] ? comedi_open+0xe0/0x5a0 [ 344.052434][ T31] schedule+0xe7/0x3a0 [ 344.073119][ T31] schedule_preempt_disabled+0x13/0x30 [ 344.087309][ T31] __mutex_lock+0x818/0x1060 [ 344.091911][ T31] ? comedi_open+0xe0/0x5a0 [ 344.108974][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 344.114261][ T31] ? __pfx_comedi_open+0x10/0x10 [ 344.119196][ T31] ? comedi_open+0xe0/0x5a0 [ 344.124347][ T31] ? __pfx_comedi_open+0x10/0x10 [ 344.129263][ T31] comedi_open+0xe0/0x5a0 [ 344.143170][ T31] ? __pfx_comedi_open+0x10/0x10 [ 344.148105][ T31] chrdev_open+0x234/0x6a0 [ 344.152512][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 344.157751][ T31] ? fsnotify_open_perm_and_set_mode+0x17c/0xa60 [ 344.166719][ T31] do_dentry_open+0x982/0x1530 [ 344.173283][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 344.178218][ T31] vfs_open+0x82/0x3f0 [ 344.182284][ T31] path_openat+0x1de4/0x2cb0 [ 344.187601][ T31] ? __pfx_path_openat+0x10/0x10 [ 344.192517][ T31] ? __lock_acquire+0xb8a/0x1c90 [ 344.197866][ T31] do_filp_open+0x20b/0x470 [ 344.203738][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 344.208773][ T31] ? alloc_fd+0x471/0x7d0 [ 344.223151][ T31] do_sys_openat2+0x11b/0x1d0 [ 344.227842][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 344.233026][ T31] ? find_held_lock+0x2b/0x80 [ 344.241080][ T31] ? handle_mm_fault+0x2ab/0xd10 [ 344.248106][ T31] __x64_sys_openat+0x174/0x210 [ 344.252965][ T31] ? __pfx___x64_sys_openat+0x10/0x10 [ 344.258604][ T31] ? do_user_addr_fault+0x843/0x1370 [ 344.264069][ T31] do_syscall_64+0xcd/0xfa0 [ 344.268560][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.274697][ T31] RIP: 0033:0x7fb3f3b8f749 [ 344.279094][ T31] RSP: 002b:00007fb3f4998038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 344.287758][ T31] RAX: ffffffffffffffda RBX: 00007fb3f3de5fa0 RCX: 00007fb3f3b8f749 [ 344.296004][ T31] RDX: 0000000000000400 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 344.305694][ T31] RBP: 00007fb3f3c13f91 R08: 0000000000000000 R09: 0000000000000000 [ 344.314507][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 344.322470][ T31] R13: 00007fb3f3de6038 R14: 00007fb3f3de5fa0 R15: 00007ffe5d744078 [ 344.333032][ T31] [ 344.336251][ T31] [ 344.336251][ T31] Showing all locks held in the system: [ 344.439812][ T31] 3 locks held by kworker/0:1/10: [ 344.445594][ T31] #0: ffff88813ff11948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 344.456097][ T31] #1: ffffc900000f7d00 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 344.466129][ T31] #2: ffffffff8e3cfcf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 344.546414][ T31] 2 locks held by kworker/u8:1/13: [ 344.583102][ T31] #0: ffff8880b843a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 344.621279][ T31] #1: ffff8880b8524088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 344.663108][ T31] 1 lock held by khungtaskd/31: [ 344.667958][ T31] #0: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 344.678672][ T31] 2 locks held by getty/5578: [ 344.683691][ T31] #0: ffff8880363cd0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 344.703148][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 344.733189][ T31] 3 locks held by syz.4.247/6964: [ 344.743330][ T31] #0: ffff888079874dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0x90 [ 344.752912][ T31] #1: ffff8880798740b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3ae/0x11d0 [ 344.793256][ T31] #2: ffffffff8e3cfcf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 344.813325][ T31] 1 lock held by syz.1.405/7618: [ 344.818256][ T31] 1 lock held by syz.0.472/7938: [ 344.830409][ T31] #0: ffff8880306770f8 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_open+0xe0/0x5a0 [ 344.839658][ T31] 1 lock held by syz.6.804/9349: [ 344.844727][ T31] #0: ffff8880306770f8 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_open+0xe0/0x5a0 [ 344.853942][ T31] 3 locks held by syz-executor/9564: [ 344.859205][ T31] #0: ffff8880206f8dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0x90 [ 344.868997][ T31] #1: ffff8880206f80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3ae/0x11d0 [ 344.878839][ T31] #2: ffffffff9035bcc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x260 [ 344.889033][ T31] 4 locks held by syz.5.968/10002: [ 344.894336][ T31] #0: ffff88806519cdc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0x90 [ 344.904160][ T31] #1: ffff88806519c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3ae/0x11d0 [ 344.913984][ T31] #2: ffffffff9035bcc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x260 [ 344.924124][ T31] #3: ffff888078650b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x730 [ 344.935310][ T31] [ 344.966738][ T31] ============================================= [ 344.966738][ T31] [ 345.013253][ T31] NMI backtrace for cpu 1 [ 345.013269][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 345.013288][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 345.013298][ T31] Call Trace: [ 345.013304][ T31] [ 345.013310][ T31] dump_stack_lvl+0x116/0x1f0 [ 345.013330][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 345.013348][ T31] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 345.013371][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 345.013394][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 345.013414][ T31] watchdog+0xf3f/0x1170 [ 345.013436][ T31] ? rcu_is_watching+0x12/0xc0 [ 345.013456][ T31] ? __pfx_watchdog+0x10/0x10 [ 345.013473][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 345.013489][ T31] ? __kthread_parkme+0x19e/0x250 [ 345.013514][ T31] ? __pfx_watchdog+0x10/0x10 [ 345.013533][ T31] kthread+0x3c5/0x780 [ 345.013549][ T31] ? __pfx_kthread+0x10/0x10 [ 345.013565][ T31] ? rcu_is_watching+0x12/0xc0 [ 345.013585][ T31] ? __pfx_kthread+0x10/0x10 [ 345.013601][ T31] ret_from_fork+0x675/0x7d0 [ 345.013614][ T31] ? __pfx_kthread+0x10/0x10 [ 345.013629][ T31] ret_from_fork_asm+0x1a/0x30 [ 345.013672][ T31] [ 345.013680][ T31] Sending NMI from CPU 1 to CPUs 0: [ 345.141357][ C0] NMI backtrace for cpu 0 [ 345.141371][ C0] CPU: 0 UID: 0 PID: 10006 Comm: syz.3.969 Not tainted syzkaller #0 PREEMPT(full) [ 345.141388][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 345.141396][ C0] RIP: 0010:find_held_lock+0x75/0x80 [ 345.141455][ C0] Code: 75 19 83 ed 01 48 83 eb 28 83 fd ff 74 0b 0f b6 43 49 32 43 21 a8 60 74 da 31 db 41 89 6d 00 48 89 d8 5b 5d 41 5c 41 5d 41 5e cc cc cc cc 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 [ 345.141468][ C0] RSP: 0018:ffffc9001bcff818 EFLAGS: 00000002 [ 345.141480][ C0] RAX: ffff88804b9f5430 RBX: ffffffff9ad3d238 RCX: ffffc9001bcff82c [ 345.141490][ C0] RDX: 0000000000000001 RSI: ffffffff9ad3d238 RDI: ffff88804b9f5430 [ 345.141499][ C0] RBP: 0000000000000282 R08: 0000000000000001 R09: fffff5200379fefe [ 345.141507][ C0] R10: 0000000000000003 R11: 0000000000000001 R12: ffffffff84acca9f [ 345.141516][ C0] R13: 0000000000000006 R14: ffff88804b9f4900 R15: 0000000000000001 [ 345.141524][ C0] FS: 0000000000000000(0000) GS:ffff888124a05000(0000) knlGS:0000000000000000 [ 345.141538][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 345.141547][ C0] CR2: 0000200000404000 CR3: 0000000066018000 CR4: 00000000003526f0 [ 345.141556][ C0] Call Trace: [ 345.141561][ C0] [ 345.141565][ C0] lock_release+0xe4/0x2f0 [ 345.141579][ C0] _raw_spin_unlock_irqrestore+0x1a/0x80 [ 345.141601][ C0] debug_check_no_obj_freed+0x31f/0x600 [ 345.141617][ C0] ? __pfx_debug_check_no_obj_freed+0x10/0x10 [ 345.141630][ C0] ? find_unlink_vmap_area+0x301/0x3f0 [ 345.141645][ C0] ? _raw_spin_unlock+0x28/0x50 [ 345.141663][ C0] ? find_unlink_vmap_area+0x306/0x3f0 [ 345.141677][ C0] remove_vm_area+0x1ae/0x3f0 [ 345.141692][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 345.141707][ C0] ? __pfx_kcov_close+0x10/0x10 [ 345.141723][ C0] vfree+0x90/0xb50 [ 345.141737][ C0] ? find_held_lock+0x2b/0x80 [ 345.141753][ C0] ? rcu_is_watching+0x12/0xc0 [ 345.141770][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 345.141790][ C0] ? __pfx_kcov_close+0x10/0x10 [ 345.141805][ C0] kcov_close+0x34/0x60 [ 345.141820][ C0] __fput+0x402/0xb70 [ 345.141837][ C0] ? cleanup_mnt+0x26b/0x450 [ 345.141857][ C0] task_work_run+0x150/0x240 [ 345.141872][ C0] ? __pfx_task_work_run+0x10/0x10 [ 345.141888][ C0] do_exit+0x86f/0x2bf0 [ 345.141909][ C0] ? __pfx_do_exit+0x10/0x10 [ 345.141927][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 345.141941][ C0] ? find_held_lock+0x2b/0x80 [ 345.141958][ C0] do_group_exit+0xd3/0x2a0 [ 345.141978][ C0] get_signal+0x2671/0x26d0 [ 345.141994][ C0] ? __call_rcu_common.constprop.0+0x3f0/0xa10 [ 345.142018][ C0] ? __pfx_get_signal+0x10/0x10 [ 345.142036][ C0] arch_do_signal_or_restart+0x8f/0x7c0 [ 345.142054][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 345.142073][ C0] ? __pfx___do_sys_close_range+0x10/0x10 [ 345.142090][ C0] exit_to_user_mode_loop+0x85/0x130 [ 345.142105][ C0] do_syscall_64+0x426/0xfa0 [ 345.142119][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.142132][ C0] RIP: 0033:0x7f428558f749 [ 345.142142][ C0] Code: Unable to access opcode bytes at 0x7f428558f71f. [ 345.142148][ C0] RSP: 002b:00007ffd696689f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 345.142161][ C0] RAX: 0000000000000000 RBX: 00007f42857e7da0 RCX: 00007f428558f749 [ 345.142169][ C0] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 345.142177][ C0] RBP: 00007f42857e7da0 R08: 0000000000000220 R09: 0000001e69668cef [ 345.142186][ C0] R10: 00000000003ffbb8 R11: 0000000000000246 R12: 00000000000541b9 [ 345.142194][ C0] R13: 00007f42857e6090 R14: ffffffffffffffff R15: 00007ffd69668b10 [ 345.142207][ C0] [ 345.498464][ C0] vkms_vblank_simulate: vblank timer overrun [ 346.243352][ T7986] bridge_slave_1: left allmulticast mode [ 346.249137][ T7986] bridge_slave_1: left promiscuous mode [ 346.264314][ T7986] bridge0: port 2(bridge_slave_1) entered disabled state [ 346.294587][ T7986] bridge_slave_0: left allmulticast mode [ 346.300238][ T7986] bridge_slave_0: left promiscuous mode [ 346.313445][ T7986] bridge0: port 1(bridge_slave_0) entered disabled state [ 346.703846][ T7986] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 346.717854][ T7986] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 346.731042][ T7986] bond0 (unregistering): Released all slaves [ 346.744387][ T7986] bond1 (unregistering): Released all slaves [ 346.822170][ T7986] !: left promiscuous mode [ 347.307248][ T7986] hsr_slave_0: left promiscuous mode [ 347.313019][ T7986] hsr_slave_1: left promiscuous mode [ 347.319607][ T7986] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 347.327605][ T7986] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 348.136571][ T7986] IPVS: stop unused estimator thread 0... [ 348.226266][ T7986] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.239480][ T7986] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 348.327742][ T7986] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.338337][ T7986] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 348.427183][ T7986] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.443472][ T7986] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 348.506705][ T7986] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.523756][ T7986] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 348.735862][ T7986] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.810598][ T7986] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.889997][ T7986] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.957151][ T7986] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 349.148745][ T7986] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 349.249882][ T7986] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 349.346415][ T7986] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 349.427921][ T7986] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 349.608149][ T7986] bridge_slave_1: left allmulticast mode [ 349.623403][ T7986] bridge_slave_1: left promiscuous mode [ 349.629132][ T7986] bridge0: port 2(bridge_slave_1) entered disabled state [ 349.657386][ T7986] bridge_slave_0: left allmulticast mode [ 349.663031][ T7986] bridge_slave_0: left promiscuous mode [ 349.680185][ T7986] bridge0: port 1(bridge_slave_0) entered disabled state [ 349.706315][ T7986] bridge_slave_1: left allmulticast mode [ 349.711960][ T7986] bridge_slave_1: left promiscuous mode [ 349.733976][ T7986] bridge0: port 2(bridge_slave_1) entered disabled state [ 349.757248][ T7986] bridge_slave_0: left allmulticast mode [ 349.762889][ T7986] bridge_slave_0: left promiscuous mode [ 349.793258][ T7986] bridge0: port 1(bridge_slave_0) entered disabled state [ 349.806304][ T7986] bridge_slave_1: left allmulticast mode [ 349.811941][ T7986] bridge_slave_1: left promiscuous mode [ 349.818000][ T7986] bridge0: port 2(bridge_slave_1) entered disabled state [ 349.831212][ T7986] bridge_slave_0: left allmulticast mode [ 349.837794][ T7986] bridge_slave_0: left promiscuous mode [ 349.845659][ T7986] bridge0: port 1(bridge_slave_0) entered disabled state [ 350.099678][ T7986] bond1 (unregistering): (slave geneve2): Releasing active interface [ 350.248642][ T7986] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 350.260861][ T7986] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 350.279378][ T7986] bond0 (unregistering): Released all slaves [ 350.292827][ T7986] bond1 (unregistering): Released all slaves [ 350.420162][ T7986] bridge0 (unregistering): left allmulticast mode [ 350.572037][ T7986] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 350.582858][ T7986] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 350.593265][ T7986] bond0 (unregistering): Released all slaves [ 350.673532][ T7986] bond1 (unregistering): Released all slaves [ 350.911016][ T7986] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 350.921630][ T7986] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 350.931373][ T7986] bond0 (unregistering): Released all slaves [ 351.058617][ T7986] tipc: Left network mode [ 351.072082][ T7986] tipc: Left network mode [ 352.173363][ T7986] hsr_slave_0: left promiscuous mode [ 352.183529][ T7986] hsr_slave_1: left promiscuous mode [ 352.191230][ T7986] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 352.221655][ T7986] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 352.231279][ T7986] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 352.238848][ T7986] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 352.249129][ T7986] hsr_slave_0: left promiscuous mode [ 352.255103][ T7986] hsr_slave_1: left promiscuous mode [ 352.260911][ T7986] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 352.268595][ T7986] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 352.276356][ T7986] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 352.284342][ T7986] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 352.301113][ T7986] hsr_slave_0: left promiscuous mode [ 352.307797][ T7986] hsr_slave_1: left promiscuous mode [ 352.314307][ T7986] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 352.321666][ T7986] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 352.329999][ T7986] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 352.337757][ T7986] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 352.376818][ T7986] veth1_macvtap: left promiscuous mode [ 352.382470][ T7986] veth0_macvtap: left promiscuous mode [ 352.389290][ T7986] veth1_vlan: left promiscuous mode [ 352.394898][ T7986] veth0_vlan: left promiscuous mode [ 352.401950][ T7986] veth1_macvtap: left promiscuous mode [ 352.417330][ T7986] veth0_macvtap: left promiscuous mode [ 352.422897][ T7986] veth1_vlan: left promiscuous mode [ 352.429492][ T7986] veth0_vlan: left promiscuous mode [ 352.435719][ T7986] veth1_macvtap: left promiscuous mode [ 352.441195][ T7986] veth0_macvtap: left promiscuous mode [ 352.447587][ T7986] veth1_vlan: left promiscuous mode [ 352.453905][ T7986] veth0_vlan: left promiscuous mode [ 352.983554][ T7986] team0 (unregistering): Port device team_slave_1 removed [ 353.011250][ T7986] team0 (unregistering): Port device team_slave_0 removed [ 353.310846][ T7986] pim6reg (unregistering): left allmulticast mode [ 353.329652][ T7986] pimreg (unregistering): left allmulticast mode