last executing test programs: 5m41.159399987s ago: executing program 1 (id=3338): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) io_setup(0x2, &(0x7f0000000000)) r3 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) add_key$keyring(&(0x7f0000000280), &(0x7f0000000300)={'syz', 0x2}, 0x0, 0x0, r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r4, &(0x7f00000000c0)={0x0, 0x4b, &(0x7f0000000040)={&(0x7f0000000180)={0x58, 0x1, 0x2, 0x201, 0x0, 0x0, {0xa}, [@CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_MASTER={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}]}, 0x58}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001980)=@newchain={0x24, 0x1e, 0x101, 0x0, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {0x4, 0x1}, {0x10, 0xb}}}, 0x24}}, 0x44004) r6 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e) syz_open_dev$vbi(0x0, 0x0, 0x2) openat$sequencer(0xffffff9c, &(0x7f0000000100), 0x8ec02, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="3f00000021010000300012800b0001006272696467650000000700080000000c002e00030000000300000006002700"/56], 0x50}}, 0x0) 5m40.073944331s ago: executing program 1 (id=3343): socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2800000041000901feffffff00000000027c0000040042800c000180060006008035"], 0x28}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371c00000069bd6efb2502eaf60d000100020400bf050005001201", 0x2e}], 0x1}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x800) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xd}}, 0x10) connect$inet(r3, &(0x7f0000000140)={0x2, 0x3, @multicast2}, 0x22) r4 = syz_open_dev$sndpcmc(&(0x7f0000000b40), 0x5, 0x200000) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r4, 0x4112, 0x0) set_mempolicy(0x3, &(0x7f0000000100)=0x2, 0x7fff) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, 0x0, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0xac, 0x0, 0x1, 0xfffffffc}, {0x6, 0x0, 0x0, 0x7fff0000}]}) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r6 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r6, &(0x7f0000000e80)=[{{&(0x7f0000000280)={0xa, 0x4e20, 0x9, @private0={0xfc, 0x0, '\x00', 0x1}, 0x5}, 0x1c, &(0x7f0000000600)=[{&(0x7f0000000380)='^', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000400)='!', 0x1}], 0x1}}], 0x2, 0x20040055) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r6, 0x84, 0x18, &(0x7f00000001c0)={0x0, 0xfffc}, 0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8040}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a140000001100010000000000000040000000000ad84f964414afbc5ccaf83a5af603"], 0x28}}, 0x0) syz_usb_connect$lan78xx(0x6, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) r7 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920001000109021b1901000000f30904150001da40df000905"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r8, 0xaf01, 0x0) eventfd(0xfffffff9) 5m35.507593957s ago: executing program 1 (id=3358): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0xa0}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000004c0)={0x0, 0xbd, 0x800, 0x1, 0x1c9}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x80, 0x0, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x3, 0x26d}}], 0x1, 0x0, 0x0) 5m35.257360571s ago: executing program 1 (id=3360): r0 = fsopen(&(0x7f0000000040)='fusectl\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x180) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x38b1012, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) umount2(&(0x7f0000000140)='./file0/file0\x00', 0x0) fsmount(r0, 0x1, 0x8b) fsconfig$FSCONFIG_SET_FLAG(r0, 0x5, &(0x7f00000020c0)='ro\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) r2 = socket(0xa, 0x80805, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000100)={'sit0\x00', &(0x7f00000021c0)={'syztnl2\x00', 0x0, 0x80, 0x7, 0xffffffff, 0x2, {{0x5, 0x4, 0x0, 0x3d, 0x14, 0x69, 0x0, 0x0, 0x29, 0x0, @local, @broadcast}}}}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e23, 0x9, @private2, 0x7da8}, 0x1c) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x80, 0x1}, &(0x7f0000000080)=0x10) ioctl$VIDIOC_S_SELECTION(0xffffffffffffffff, 0xc040565f, &(0x7f0000000940)={0xa, 0x0, 0x7, {0x3, 0xa, 0xfc, 0x4}}) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000007c0)={0x2, @win={{0x5, 0x5, 0x8, 0x3}, 0x6, 0x17d, 0x0, 0x80000000, 0x0, 0x2}}) 5m34.964648389s ago: executing program 1 (id=3362): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0xc, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8192, 0x2000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x1308711, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000100)=0x12419f, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x100, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_G_FMT(r3, 0xc0d05604, &(0x7f0000000640)={0xd, @raw_data="88cd93d0c793eeef7bd04466d69fca48f979f405307003dfb5f4448129d22ecf09187e6ca692b3a3c08e47d71ccc2fe8ceba6b01e9990300000000000000a850404b1bbabefbbda01d50aedacffb8573789363f3722d67f3e64b468118aa61e4c89dea2c9f55de37a8ea4546ef459a5b935b77f32ce133036656d1c858225dec9aab11a7eaf2babaf2caedefe3621afae562788dda3fe1a9d20ba6add109bb82369e9d6a0db70c85e35706fc255502891024df20f27d90e5d71caa8b866595782b8ed742d205cf7f"}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) bind$xdp(r0, &(0x7f00000003c0)={0x2c, 0x2, r4, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x28482, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0xf) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000040)={0x12}) ioctl$FS_IOC_FSGETXATTR(r6, 0x400455c8, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), r5) sendmsg$IPVS_CMD_GET_DEST(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x4008091}, 0x0) lsetxattr$trusted_overlay_redirect(0x0, &(0x7f0000000040), 0x0, 0x0, 0x3) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d00000524060800052c0000000d240f015018d2994e2c1d240006241a"], 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200000, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x18) socket$nl_xfrm(0x10, 0x3, 0x6) r9 = socket(0x11, 0x3, 0x0) setsockopt$packet_tx_ring(r9, 0x107, 0xd, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r9) 5m34.669176025s ago: executing program 1 (id=3365): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = userfaultfd(0x1) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) readv(r1, &(0x7f0000000600)=[{&(0x7f00000000c0)=""/114, 0x72}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f00000003c0)=@file={0x1, './file0\x00'}, 0x6e) r8 = userfaultfd(0x801) mremap(&(0x7f00008cc000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f000046d000/0x2000)=nil) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r8, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x6e, 0x2) r9 = dup(r7) syz_ublk_setup_queues(r9, r6, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x1, 0x10000004, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x200, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1d3, 0x0, 0x0, 0x1f0, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x2367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) 5m34.344191009s ago: executing program 32 (id=3365): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = userfaultfd(0x1) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) readv(r1, &(0x7f0000000600)=[{&(0x7f00000000c0)=""/114, 0x72}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f00000003c0)=@file={0x1, './file0\x00'}, 0x6e) r8 = userfaultfd(0x801) mremap(&(0x7f00008cc000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f000046d000/0x2000)=nil) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r8, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x6e, 0x2) r9 = dup(r7) syz_ublk_setup_queues(r9, r6, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x1, 0x10000004, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x200, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1d3, 0x0, 0x0, 0x1f0, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x2367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) 1m34.005191838s ago: executing program 4 (id=4553): r0 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r0, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x3, 0x0, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) ioctl$BTRFS_IOC_DEFRAG_RANGE(r0, 0x40309410, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x85) r2 = open(&(0x7f00009e1000)='./file0\x00', 0x48141, 0x8) fcntl$setlease(r2, 0x400, 0x1) write(r1, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff7ffc}]}) r4 = openat$kvm(0x0, &(0x7f00000002c0), 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r5, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) r6 = eventfd2(0x8, 0x1) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000080)={r6, 0x4}) write$eventfd(r6, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) 1m33.748297681s ago: executing program 4 (id=4554): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2282, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = inotify_init() r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000100)='./file0\x00') timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) r5 = socket$inet6(0xa, 0x3, 0x4) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000000)='wg2\x00', 0x10) bind$inet6(r5, &(0x7f0000000140)={0xa, 0xe22, 0x0, @loopback={0xff00000000000000}}, 0x1c) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) r6 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$lock(r6, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) utime(&(0x7f0000000140)='./file0\x00', 0x0) close_range(r3, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000340)=[@text64={0x40, 0x0}], 0x1, 0x32, 0x0, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000380)={0x6, 0x0, [{0x2ae, 0x0, 0x24}, {0x343}, {0x0, 0x0, 0x6}, {0x407, 0x0, 0x5}, {0x399, 0x0, 0x1ff}, {0xb60, 0x0, 0xb51}]}) r7 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r7, &(0x7f0000000200)='m', 0x1) r8 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r8, 0x40045532, &(0x7f0000000100)) ioctl$KVM_KVMCLOCK_CTRL(r2, 0xaead) r9 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(r9, 0x40184150, &(0x7f0000000440)={0x0, 0x0}) r10 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r10, 0x89f1, &(0x7f0000000440)={'syztnl1\x00', &(0x7f0000000000)={'gretap0\x00', 0x0, 0x20, 0x8000, 0x1, 0x5, {{0x24, 0x4, 0x0, 0x0, 0x90, 0x3, 0x0, 0x1, 0x4, 0x0, @local, @loopback, {[@generic={0x89, 0x5, "88de55"}, @lsrr={0x83, 0x7, 0x3f, [@local]}, @timestamp_prespec={0x44, 0x2c, 0x2a, 0x3, 0x6, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x101}, {@multicast1, 0x2}, {@remote, 0x8000}, {@broadcast, 0x3}, {@multicast2, 0x8}]}, @rr={0x7, 0x13, 0xb0, [@multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @private=0xa010102]}, @timestamp_addr={0x44, 0x24, 0xb3, 0x1, 0x5, [{@remote, 0xc}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x101}, {@local, 0x10000}, {@private=0xa010102, 0xf862}]}, @rr={0x7, 0xb, 0xd7, [@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast]}, @noop]}}}}}) 1m32.942235695s ago: executing program 4 (id=4557): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c450}, 0x0) nanosleep(0x0, 0x0) syz_80211_inject_frame(0x0, 0x0, 0x0) syz_80211_inject_frame(0x0, 0x0, 0x0) syz_80211_inject_frame(0x0, 0x0, 0x0) 1m32.100543318s ago: executing program 4 (id=4563): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000100)='autofs\x00', 0x0, &(0x7f0000000400)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000), 0x13f, 0x3}}, 0x20) setpgid(r1, r1) setpgid(0x0, r1) setuid(0xee00) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0x9362, 0x0) 1m32.057113119s ago: executing program 4 (id=4564): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x106, 0x5}}, 0x20) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x12, 0x10, 0xfa00, {0x0, r0}}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f0000000280)="1a0000", 0x3) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f00000000c0), 0x1) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r4) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r5], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) (async) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r5], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmsg$nl_route(r3, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c000000130005002cbd70000000000000000300", @ANYRES32=r5, @ANYBLOB="12030000000000000a000100aaaaaaaaaabb0000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) (async) sendmsg$nl_route(r3, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c000000130005002cbd70000000000000000300", @ANYRES32=r5, @ANYBLOB="12030000000000000a000100aaaaaaaaaabb0000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) (async) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000040), 0x0, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 1m31.427421284s ago: executing program 4 (id=4568): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x8482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0xfffffffc, 0xb, 0x6, 0xfffffffc, 0x7d, "db8f2d2b3b7596160c6981acf8805944823a7f"}) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0x5eaa) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000200)={0x2c754362, 0x4, 0x9, 0xd, 0x9, "0100000000e409878000000040000000000018"}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000001c0)={0x0, 0x80000, 0x8000000, 0x2, 0x9, "00000000000700000000fffe00"}) r1 = syz_open_pts(r0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r2, &(0x7f0000000280)="7325fa173c3aba1f28468848a30f776ff8e5065b9441b50af0cdb300b6e7ce2f24eb5cef29c97190b38d528709fbc727e8d2cb571bd56062dbe1c505a7728c94f5a235b2beac35c183a49318ec813aabbe215d51cc823a522460ec7434c268e143ba1489db0ab01f7f639058c9a7ab9322fa985ee06516e34fde341a86b8e68775f5ada1a51ecff42b15f4d5abc4e0463760a5ae849a9c51582c07e0ec18fbdef34f41026cb8bafc49", 0xa9, 0x20049800, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @local, 0x2}, 0x1c) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000240)=0x1) setns(0xc9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2649baca85309be96d5a45bbbdb5ff7ffffffd075b3eee14473f51be98db7efbb059842badcfc81364470e8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c11071adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eb47efb7b3f19046c6f1bd1bf56e5853ed96137f95b3a11954ed1c8a8676468cf2405e48723d4b1ff"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r3, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r3, 0x0, 0x0) read(r3, &(0x7f0000000b00), 0x100) read(r3, &(0x7f0000000d00), 0x100) read(r3, &(0x7f0000000f00), 0x100) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r3, &(0x7f0000000a00), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r6 = syz_usb_connect$hid(0x3, 0x3f, 0x0, 0x0) socket(0xf, 0x6, 0x3) syz_usb_control_io$hid(r6, 0x0, 0x0) 1m30.918489715s ago: executing program 33 (id=4568): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x8482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0xfffffffc, 0xb, 0x6, 0xfffffffc, 0x7d, "db8f2d2b3b7596160c6981acf8805944823a7f"}) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0x5eaa) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000200)={0x2c754362, 0x4, 0x9, 0xd, 0x9, "0100000000e409878000000040000000000018"}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000001c0)={0x0, 0x80000, 0x8000000, 0x2, 0x9, "00000000000700000000fffe00"}) r1 = syz_open_pts(r0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r2, &(0x7f0000000280)="7325fa173c3aba1f28468848a30f776ff8e5065b9441b50af0cdb300b6e7ce2f24eb5cef29c97190b38d528709fbc727e8d2cb571bd56062dbe1c505a7728c94f5a235b2beac35c183a49318ec813aabbe215d51cc823a522460ec7434c268e143ba1489db0ab01f7f639058c9a7ab9322fa985ee06516e34fde341a86b8e68775f5ada1a51ecff42b15f4d5abc4e0463760a5ae849a9c51582c07e0ec18fbdef34f41026cb8bafc49", 0xa9, 0x20049800, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @local, 0x2}, 0x1c) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000240)=0x1) setns(0xc9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2649baca85309be96d5a45bbbdb5ff7ffffffd075b3eee14473f51be98db7efbb059842badcfc81364470e8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c11071adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eb47efb7b3f19046c6f1bd1bf56e5853ed96137f95b3a11954ed1c8a8676468cf2405e48723d4b1ff"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r3, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r3, 0x0, 0x0) read(r3, &(0x7f0000000b00), 0x100) read(r3, &(0x7f0000000d00), 0x100) read(r3, &(0x7f0000000f00), 0x100) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r3, &(0x7f0000000a00), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r6 = syz_usb_connect$hid(0x3, 0x3f, 0x0, 0x0) socket(0xf, 0x6, 0x3) syz_usb_control_io$hid(r6, 0x0, 0x0) 8.603222762s ago: executing program 3 (id=4965): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), r0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r0) recvmmsg(r0, &(0x7f00000064c0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000001500)=""/4112, 0x1010}, {0x0}, {&(0x7f0000000300)=""/27, 0x1b}], 0x3}, 0x400000}], 0x1, 0x20000, 0x0) 8.570272443s ago: executing program 3 (id=4966): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873", 0x3f}, {&(0x7f0000000340)}, {&(0x7f0000000440)}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) accept4(r1, &(0x7f0000000500)=@vsock={0x28, 0x0, 0x0, @hyper}, &(0x7f0000000600)=0x80, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 8.478692144s ago: executing program 3 (id=4967): r0 = syz_open_dev$mtd(&(0x7f0000000100), 0x0, 0x101000) ioctl$MEMGETREGIONINFO(r0, 0xc0104d08, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) syz_open_dev$MSR(&(0x7f0000000200), 0xbf, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000016c0)='./file0\x00', 0x63) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r3}, 0x68) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000240)={'\x00', 0x7, 0x1, 0x1ff, 0x8000000000000001, 0x4, 0xffffffffffffffff}) sched_setscheduler(r4, 0x5, &(0x7f0000000380)=0x400) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001ac0)=@newtfilter={0x24, 0x2c, 0x8, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x10, 0xa}, {0x9, 0x5}, {0x1, 0x3}}}, 0x24}}, 0x800) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0xff2b}], 0x2) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') 7.911114054s ago: executing program 0 (id=4975): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x6) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getpgid(r0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) listen(r3, 0x0) clock_gettime(0x3, 0x0) accept4(r3, 0x0, 0x0, 0x80800) syz_open_dev$video4linux(&(0x7f0000000000), 0x4, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x6) r5 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000000)=0x800, 0x4) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) listen(r4, 0x5) connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) r6 = accept$inet(r4, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000180), 0x4) setsockopt$inet_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000200)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) setsockopt$inet_tcp_TLS_RX(r6, 0x11a, 0x2, &(0x7f0000000200)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) sendto$inet(r5, &(0x7f0000000300)='\x00', 0x1000, 0x40, 0x0, 0x0) recvfrom$inet(r6, &(0x7f0000000400), 0x4000, 0x0, 0x0, 0x0) 7.003485046s ago: executing program 3 (id=4982): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0xffe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000000c0)=@mmap={0x1, 0x1, 0x4, 0x0, 0xffffffff, {0x77359400}, {0x0, 0x1, 0xf1, 0x5, 0x0, 0x1, "bf231e4b"}}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000400)=0x1) 6.91067562s ago: executing program 0 (id=4983): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x8482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0xfffffffc, 0xb, 0x6, 0xfffffffc, 0x7d, "db8f2d2b3b7596160c6981acf8805944823a7f"}) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0x5eaa) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000200)={0x2c754362, 0x4, 0x9, 0xd, 0x9, "0100000000e409878000000040000000000018"}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000001c0)={0x0, 0x80000, 0x8000000, 0x2, 0x9, "00000000000700000000fffe00"}) r1 = syz_open_pts(r0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r2, &(0x7f0000000280)="7325fa173c3aba1f28468848a30f776ff8e5065b9441b50af0cdb300b6e7ce2f24eb5cef29c97190b38d528709fbc727e8d2cb571bd56062dbe1c505a7728c94f5a235b2beac35c183a49318ec813aabbe215d51cc823a522460ec7434c268e143ba1489db0ab01f7f639058c9a7ab9322fa985ee06516e34fde341a86b8e68775f5ada1a51ecff42b15f4d5abc4e0463760a5ae849a9c51582c07e0ec18fbdef34f41026cb8bafc49", 0xa9, 0x20049800, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @local, 0x2}, 0x1c) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000240)=0x1) setns(0xc9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2649baca85309be96d5a45bbbdb5ff7ffffffd075b3eee14473f51be98db7efbb059842badcfc81364470e8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c11071adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eb47efb7b3f19046c6f1bd1bf56e5853ed96137f95b3a11954ed1c8a8676468cf2405e48723d4b1ff"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) read(r3, &(0x7f0000000b00), 0x100) read(r3, &(0x7f0000000f00), 0x100) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 5.770316616s ago: executing program 2 (id=4986): munmap(&(0x7f0000ff3000/0xb000)=nil, 0xb000) personality(0x87bf5ac905ea0f7f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) move_pages(r0, 0x8, &(0x7f0000000180)=[&(0x7f0000005000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000002000/0x3000)=nil, &(0x7f0000008000/0x3000)=nil, &(0x7f0000002000/0x1000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000fed000/0xb000)=nil, &(0x7f0000ffb000/0x2000)=nil], 0x0, &(0x7f0000000080)=[0x0, 0x0], 0x2) brk(0x200000ffc000) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0xfffffffd, @rand_addr=' \x01\x00', 0x4000004}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x6, @mcast1}, 0x1c) sendto$inet6(r1, &(0x7f0000000040)="052872", 0x3, 0x4048000, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000240), 0xffffffffffffffff) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r3, 0x3ba0, &(0x7f0000000b80)={0x48}) syz_open_dev$ndb(&(0x7f0000000200), 0x0, 0x80000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x1c, r2, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0xe256610c62001369}, 0x600000c0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0xffffffffffffffff, 0x70bd26, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1, 0x2021}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x4}}}, @IFLA_ADDRESS={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) recvfrom(r1, &(0x7f0000001a80)=""/4050, 0xfd2, 0x0, 0x0, 0x0) 5.620991389s ago: executing program 3 (id=4987): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fanotify_init(0x0, 0x400) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@newtaction={0xb4, 0x30, 0x48b, 0x0, 0x0, {}, [{0xa0, 0x1, [@m_ctinfo={0x48, 0x2, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x0, 0xa, 0x20000001, 0x6, 0x101}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}, @m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x400, 0x0, 0x0, 0x2}, @multicast2, @empty}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4048000}, 0xc000) fanotify_mark(r1, 0x201, 0x4000003e, 0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000000)=0x200, 0x4) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e27, 0x0, @private0}, 0x1c) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) write(r4, &(0x7f0000000100)="88a96c864653156bc81f0d51131cf90d056c26f9bc6dbea9cf3e8933cd9550e8fae9e4688070d97f50f7e1e959b6411e171bd9708386cb030000c17b510db0c6a3eba3786c75c953f5b5fbe4847f46eb3ef68724a912000000372a360060e3fd5bd34c18f74b2a3b19da94b50e639c957e1d45faeb182e192dfcf93a57cc1da493981dba1639551626185e1546e26a10157fdb825f5ff6ab936e560749b021b1d4e52345c9029b3016c78835f2f8d8249c1e0c2f22372836cb1d4cd2c602750616f99b31315d34", 0xc7) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000002840)={r5, &(0x7f0000001780), &(0x7f0000002780)=""/135}, 0x20) open_by_handle_at(r4, &(0x7f0000000340)=@FILEID_INO32_GEN_PARENT={0x10, 0x2, {{0x6, 0x400}, 0x5, 0x1}}, 0x800) sendmsg$inet6(r3, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001c00)=[{&(0x7f0000000200)="78974b7cf764d1dbebd9b9dee561accb1cd5c4af2b734f1e5712671b57fad249f5f908f48c540888bd56233e3798b596df098f8bbe3d667a28c74804711107cfa721eb05dca5b4bd525993e7212099cdb7688041f8e9401a771590f54d56868177c083cb5ece03ac4fd79b33b131f051f1a25eb6ed94a8ac0e88f1a5fc21c511d5da964f13d323a982ae78fa370d762b2c545194b9a4b0d75b8d7750d6880c1dc96a09db134827f0fb1c0b6001c326c5e5bc2c2b0e5ae1818c74d75c6106055d598df632c0bee46b57c3ea3940bc703d46ceecaea2e5c92eceeb3e80e28329653fa4c663d96beff42e0284272463b03b708debf5eccae91427618c4c15f5d53074980ebf9e98d35bbb392db3683068cc", 0x110}, {&(0x7f00000009c0)="64774edd2b66243fb4e432bd5ea6f6894371f6e352f7af8717caf4f64f3f79401a38fb10017ee16409da3522b00535267aafd7d4ef08a465c61d3f93ee197d05f5dcdfd5d6f7bd1fb54a324baef49e7865ba97222c60e07eaf61a765d459deac9bc150611f9c82cc209c02980044e7b9ccbd4a754a8bbe483747c40db8144c69e71a869f045493cdb486de6007a1ba36333ea364160dc27487eff08d08fbd65513aee5b5727ef39a7f056675234d29af8f237fd5fd09b405235c4a0ce8ac431c6a6ed8eec5a48f37ec6470619b63388413b4e14bb77ddaf5c274aabfd55562273d4edf9abb0d8548f8feb2ea5661f71f27466deb172be1c4e4b003c112274b68e225d73c952e74a383a8e454f63e792b5686103f6ae19444f9b7113d6a8aecea843ba79dacb42bbf37e810b6049fe8747e5990367abf8375acd2564b7db0c83004d5d6779399ea1a44b1bf732cd2e668c83150953e0e60ea6c3cd79d5657579cd6e9ce078a35475d6900c6ba8dfcba758dccc1f7da032f2202b28adabf9dba89e305e3acdb0d519265af22a6572c266e3154caff585f7e9afb39a2a9f3fe1155ffd575e1338eb1e6fe339a81c97f49bc337f7ce796166392356014ced308f3eb1177e49baa98074383a28081a5c5cd7af773e0d1b72ab92fa67bdd66cf105017e89e2eaa1c458daebf9444e15605fd7699cf6e36d96c6fe59ce226167c046d582d623dd6358875acce1b8d78ec5b0677db24bba7b64af25d13fdeb12d626a4eb4bc33c8fb2be60cea51e069154f81e72ae5040ce823f1302091e16b71d30a994ee10ff7ca43ea4937ab6ed8ded2675e9334481956f707f844cdcefd42420214adf160f7cfb634d15cf9ffa35434ce19b0dcccd21ff39bc5e275ef716fa073dd5ad89dcc276bb6839fc37d43adff5c43438bad9d3b57f7317b0a54210bfd4321c", 0x2a0}], 0x2}, 0x8000) close_range(r0, 0xffffffffffffffff, 0x0) 5.430385547s ago: executing program 2 (id=4991): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xe, &(0x7f0000000400)=ANY=[@ANYBLOB="b702000003460200bfa30000000000001702000000feffff7a0a00fe14ffffff79a4f0ff00000000b7060000ff0800007e640200000000005502faff037202000404000001007d60a604feff001000006a0a58fe39000f00850000005b000000bc600000000000009500000000000000a81bbfa32d51a7d0679fd43041097666ab982de7b0efc5"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x2, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_conn_param_update_req={{0x12, 0x5, 0x8}, {0x8, 0x7, 0x7fff, 0x101}}}}, 0x15) 5.316174065s ago: executing program 2 (id=4992): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000000), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000001c0)={0x34, r2, 0x1, 0x70bd2d, 0x0, {{0x2}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9da}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0xd}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x34}, 0x1, 0x0, 0x0, 0x4000019}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00800025001e00060000e1fef6a13a8c31e2869bfbfd2a1234ce0a00000000000200cdc38beed3707c95fc857cd71053a3a34e81fe6514bf53b4424182a4e3624738f2252383b3dd8a28f6423741bf3c6b5b7014", @ANYRES32=0x0, @ANYBLOB="17880400030104001c0016801800018014000b0000000030000000"], 0x3c}, 0x1, 0x0, 0x0, 0x48840}, 0x70) socket$kcm(0x29, 0x5, 0x0) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) acct(&(0x7f0000000040)='./file0\x00') r5 = socket$inet_smc(0x2b, 0x1, 0x0) r6 = socket$inet_smc(0x2b, 0x1, 0x0) bind(r6, &(0x7f0000000400)=@in={0x2, 0x1f90, @loopback}, 0x10) listen(r6, 0x5) socket$unix(0x1, 0x5, 0x0) connect(r5, &(0x7f0000000500)=@in={0x2, 0x1f90, @loopback}, 0x10) 5.172405901s ago: executing program 2 (id=4993): r0 = syz_open_dev$mtd(&(0x7f0000000100), 0x0, 0x101000) ioctl$MEMGETREGIONINFO(r0, 0xc0104d08, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) syz_open_dev$MSR(&(0x7f0000000200), 0xbf, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f00000016c0)='./file0\x00', 0x63) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r3}, 0x68) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000240)={'\x00', 0x7, 0x1, 0x1ff, 0x8000000000000001, 0x4, 0xffffffffffffffff}) sched_setscheduler(r4, 0x5, &(0x7f0000000380)=0x400) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001ac0)=@newtfilter={0x24, 0x2c, 0x8, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x10, 0xa}, {0x9, 0x5}, {0x1, 0x3}}}, 0x24}}, 0x800) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0xff2b}], 0x2) 4.803703076s ago: executing program 6 (id=4999): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYRESHEX=0x0], 0x0, 0x52, 0x0, 0x1, 0x20080000}, 0x28) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$netlink(0x10, 0x3, 0x0) socket$inet6(0xa, 0x80002, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS32(0xffffffffffffffff, 0x806c4120, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000025300)=""/102392, 0x18ff8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x14e203, 0x0) ioctl$SNDCTL_SEQ_PANIC(0xffffffffffffffff, 0x5111) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff2e) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) sendto$inet6(r1, &(0x7f0000000040)="800037bbfa9ba1ce", 0xffe9, 0x0, 0x0, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) setpriority(0x1, 0x0, 0x8) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPP(r4, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x40, 0x0, 0x8, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x40040}, 0x40058) syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_ecred_conn_rsp={{0x18, 0xd, 0x8}, {0x8, 0xa6, 0x10, 0x5}}}}, 0x15) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x28000, 0x0) sendto$inet6(r0, &(0x7f0000000380)="ee", 0x1, 0x4091, 0x0, 0x0) 4.553480587s ago: executing program 3 (id=5001): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000014f000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x17) r3 = syz_usb_connect(0x0, 0x24, &(0x7f00000012c0)=ANY=[@ANYBLOB="12010000c6700610f71400058544010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r3, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000240)={0x40, 0xe}, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) fspick(0xffffffffffffff9c, 0x0, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', 0x0}) syz_usb_control_io$uac2(r3, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0003b4000000b403461eee3b312db0708faa51583fba73017f2620a440e46f0b675e09183fde30724cd727fe1f478985ed31530881e6472a22bf936bf041667b03600e290dac896b9c6963265748b81f157b449dd1102db474446357571ef444c4ddb4e4036f2cdf4accfd292d141456f4971612b7f5cca05e59694410d5261781f488bd6969908068ef0f1e6bcd21d8e7bf135f1df4d17833c535a1968bac394edecd24804740a7894fc2fbba0097906dc501ec2b4369bddfc17ae21f0a7b3d3305930ad457d21fdc720e5c7145522d02509132bfbb501455a0f4b6a883bc5dc9b9dbf84a1d34e777568262954ef2f592c31e77e048baacff85d42b2e04bfb18e5b79ba56010a9bec6ed3b7d9366cc95f1c7be94c4c52a88478"]}, &(0x7f00000004c0)={0x44, &(0x7f0000000180)={0x20, 0x3}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000340)={0x20, 0x81, 0x3, "a2d252"}, &(0x7f00000003c0)={0x20, 0x82, 0x3, "decc26"}, &(0x7f0000000400)={0x20, 0x83, 0x3, "499903"}, &(0x7f0000000080)={0x20, 0x84, 0x4, "b0d5b689"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "320dc1"}}) ioctl$KVM_GET_NESTED_STATE(r2, 0xc080aebe, 0x0) 4.331939966s ago: executing program 0 (id=5002): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xe, &(0x7f0000000400)=ANY=[@ANYBLOB="b702000003460200bfa30000000000001702000000feffff7a0a00fe14ffffff79a4f0ff00000000b7060000ff0800007e640200000000005502faff037202000404000001007d60a604feff001000006a0a58fe39000f00850000005b000000bc600000000000009500000000000000a81bbfa32d51a7d0679fd43041097666ab982de7b0efc5"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x2, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_conn_param_update_req={{0x12, 0x5, 0x8}, {0x8, 0x7, 0x7fff, 0x101}}}}, 0x15) 4.246375562s ago: executing program 6 (id=5004): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002c0300"/18, @ANYRES32=r2, @ANYBLOB="1400c70005030005fe020907979cfdc0ce313210"], 0x30}, 0x1, 0x0, 0x0, 0xb5fe1cda142e291}, 0x14) 4.168456453s ago: executing program 0 (id=5005): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x1c, 0x1, 0x2, 0x201, 0x0, 0x0, {0xa}, [@CTA_EXPECT_ZONE={0x6}]}, 0x1c}}, 0x0) 4.090723602s ago: executing program 6 (id=5006): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873", 0x3f}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae", 0x37}, {&(0x7f0000000440)}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) accept4(r1, &(0x7f0000000500)=@vsock={0x28, 0x0, 0x0, @hyper}, &(0x7f0000000600)=0x80, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 3.954722088s ago: executing program 0 (id=5007): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) io_setup(0x2, &(0x7f0000000000)) r3 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) add_key$keyring(&(0x7f0000000280), &(0x7f0000000300)={'syz', 0x2}, 0x0, 0x0, r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r4, &(0x7f00000000c0)={0x0, 0x4b, &(0x7f0000000040)={&(0x7f0000000180)={0x58, 0x1, 0x2, 0x201, 0x0, 0x0, {0xa}, [@CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_MASTER={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}]}, 0x58}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, 0x0, 0x44004) r6 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e) syz_open_dev$vbi(0x0, 0x0, 0x2) openat$sequencer(0xffffff9c, &(0x7f0000000100), 0x8ec02, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="3f00000021010000300012800b0001006272696467650000000700080000000c002e00030000000300000006002700"/56], 0x50}}, 0x0) 3.88437739s ago: executing program 6 (id=5008): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000080)={[0x10000, 0xd, 0x2, 0x4, 0x38, 0x2, 0x7fff, 0x7fffffff, 0x2, 0x7ff, 0x7, 0xffffffff, 0x2, 0x472f, 0x100, 0x4], 0x58ad29489c2a7d0a, 0x30201}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4000006d, 0x0, 0x6}]}) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB="042b0000000000"], 0x7) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) r3 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) shmctl$IPC_RMID(r3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="34050000000000007210940000020069a32416a6", @ANYRES32=0x1, @ANYBLOB="00000000000400009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x4e292c3354344830, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x1, 0x0, 0x8, 0xfffffffe}, 0x10}, 0x94) socket$netlink(0x10, 0x3, 0x4) syz_emit_vhci(&(0x7f0000000040)=@HCI_VENDOR_PKT, 0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8b07, &(0x7f0000000080)={'virt_wifi0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}) io_submit(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x224}) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r5 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) keyctl$link(0x8, r5, r6) mremap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) 3.68207569s ago: executing program 5 (id=5010): r0 = syz_open_dev$dri(0x0, 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000080)={0x0, 0xfffffffffffffff0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x80000}) 3.635570997s ago: executing program 6 (id=5011): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'netdevsim0\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) 3.586810246s ago: executing program 0 (id=5012): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = userfaultfd(0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f00000000c0)={0x0, 0x5a4}, 0x8) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='0\x00', 0x1) write(r4, &(0x7f0000000400)='1\x00', 0x1) write$FUSE_POLL(r3, &(0x7f0000000040)={0x18, 0xfffffffffffffff5, 0x0, {0x6}}, 0x18) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_POISON(r1, 0xc020aa08, &(0x7f0000000380)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}}) 3.524874473s ago: executing program 5 (id=5013): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0xa8740, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x66960000) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000580)=@raw=[@ringbuf_query, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x5}, @map_idx={0x18, 0x5, 0x5, 0x0, 0xb}, @cb_func={0x18, 0x9, 0x4, 0x0, 0x3}, @exit, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}], 0x0, 0x1, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_BEACONS(r1, &(0x7f0000003900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8c4}, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000640)=0x10) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0xd0f, 0xfffffffd, 0x25dfdbfd, {0x60, 0x0, 0x0, 0x0, {0xffff, 0x2}, {0xfff2, 0xe}, {0xfff3, 0xfff2}}, [@TCA_RATE={0x6, 0x5, {0x4, 0x1}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000050}, 0x2000c8d1) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18020000ff070000000000000300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) ioctl$VHOST_GET_VRING_BASE(r2, 0xc008af12, &(0x7f0000000140)) close(r2) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r3, &(0x7f0000000080)={0x1f, @none}, 0x8) getsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, &(0x7f0000000100), &(0x7f0000001200)=0x4) ioctl$SIOCSIFHWADDR(r2, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) 3.523949369s ago: executing program 6 (id=5014): syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r0 = socket$rxrpc(0x21, 0x2, 0xa) r1 = socket$rxrpc(0x21, 0x2, 0xa) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'wp256\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) eventfd(0xfffffff9) fsopen(&(0x7f0000000100)='erofs\x00', 0x1) getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019c80)=""/102384, 0x18ff0) recvmmsg$unix(r3, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000040)=0x2, 0x4) connect$rxrpc(r1, &(0x7f0000000080)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x24) sendmsg$inet(r1, &(0x7f0000000180)={0x0, 0xfffffffffffffd6b, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x18, 0x110}}], 0x18, 0x4c00}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="140000000400000004"], 0x50) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0xfffffffffffffd6b, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x18, 0x110}}], 0x18, 0x4c00}, 0x0) 3.414226189s ago: executing program 5 (id=5015): openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6(0xa, 0x3, 0x5) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000080)=0x200000000) r2 = dup2(r1, r1) read$FUSE(r2, &(0x7f0000000440)={0x2020}, 0x2020) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r2, 0x0, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1f00000000100000040000000200000000000000", @ANYRES32, @ANYBLOB="0600"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="80000000ffffffff040000000000000000000000000000000000000088366414d1aa6abe33b21864d3b3363ad6564efbd20feca2e28bd874b12b922b91594a"], 0x50) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_create_resource$binfmt(0x0) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffdcd}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f0000000200)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a497090000009b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e80c00000000000000e9c6ad7d2a8103ef2f4f93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef5911cee26d7b48241847bf9e343ef4674c45e2a085060f1119b0527fe5ff48fea9860fe68aa12fbc2e4212fade0ce1bbe83cd44a1f4bbe", 0xed}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) 3.394602486s ago: executing program 2 (id=5016): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)=ANY=[@ANYBLOB="240000001600010a000000000000000003000000b6fefd000c000a"], 0x24}}, 0x8000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_procfs(0x0, 0x0) r2 = open_tree(r1, &(0x7f0000000300)='./cgroup\x00', 0x89801) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x89101) move_mount(r2, 0x0, r3, 0x0, 0x46) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r7 = memfd_create(&(0x7f0000000140)='\xe9`\x10\x98[\x82?O3#\xfa\x02\xdc\x96\xa1\xbc\x80\x00+\xb6O', 0x2) fcntl$setpipe(r5, 0x407, 0x8001a0) write$FUSE_INIT(r6, &(0x7f0000000580)={0x50, 0x0, 0x0, {0x7, 0x28, 0xfffd, 0x41201882, 0xfffc, 0x0, 0x1e0, 0x2, 0x0, 0x0, 0x24522716a989086f, 0x400080}}, 0x50) splice(r5, 0x0, r7, 0x0, 0x200002, 0xa) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/partitions\x00', 0x0, 0x0) r9 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) io_setup(0x5, &(0x7f00000003c0)=0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x62081, 0x0) io_submit(r10, 0x0, &(0x7f0000000540)) sendfile(r9, r8, &(0x7f00000000c0)=0x58, 0xa) r11 = semget$private(0x0, 0x207, 0x0) semtimedop(r11, 0x0, 0x0, 0x0) semop(r11, &(0x7f0000000100)=[{0x0, 0x4}, {0x6, 0xffff, 0x800}, {0x2, 0x8000, 0x1000}], 0x3) 2.616691441s ago: executing program 5 (id=5017): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x1c, 0x1, 0x2, 0x201, 0x0, 0x0, {0xa}, [@CTA_EXPECT_ZONE={0x6}]}, 0x1c}}, 0x0) 117.793418ms ago: executing program 5 (id=5018): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0xffe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000000c0)=@mmap={0x1, 0x1, 0x4, 0x0, 0xffffffff, {0x77359400}, {0x0, 0x1, 0xf1, 0x5, 0x0, 0x1, "bf231e4b"}}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000400)=0x1) 5.123517ms ago: executing program 2 (id=5019): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) io_setup(0x2, &(0x7f0000000000)) r3 = add_key$keyring(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffff9) add_key$keyring(&(0x7f0000000280), &(0x7f0000000300)={'syz', 0x2}, 0x0, 0x0, r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r4, 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001980)=@newchain={0x24, 0x1e, 0x101, 0x0, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {0x4, 0x1}, {0x10, 0xb}}}, 0x24}}, 0x44004) r6 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e) syz_open_dev$vbi(0x0, 0x0, 0x2) openat$sequencer(0xffffff9c, &(0x7f0000000100), 0x8ec02, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="3f00000021010000300012800b0001006272696467650000000700080000000c002e00030000000300000006002700"/56], 0x50}}, 0x0) 0s ago: executing program 5 (id=5020): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x19, 0x0, &(0x7f0000000280)) socket$nl_generic(0x10, 0x3, 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) writev(r1, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$char_usb(r1, &(0x7f00000001c0)="64e9", 0x2) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000700)=[0x2], 0x0, 0x0, 0x200000000000022f}}, 0x40) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) setns(0xc9, 0x0) r3 = socket(0x2d, 0x2, 0x0) setsockopt(r3, 0x11d, 0x1, &(0x7f0000000200)="01000000", 0x4) sendmsg(r3, &(0x7f0000000400)={&(0x7f0000000500)=@generic={0x2d, "00000000000008011800020000000600"}, 0x80, 0x0}, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x2000, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280), &(0x7f00000005c0)) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@newtfilter={0x44, 0x2c, 0xd27, 0x10, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x8, 0xa}}, [@filter_kind_options=@f_u32={{0x8}, {0x18, 0x2, [@TCA_U32_SEL={0x14, 0x5, {0x5, 0x7, 0x1, 0xfffb, 0x8, 0x5, 0xffff, 0x5}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000001}, 0xc004) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="640000001000010429bd700000000000e0000000", @ANYRES32=r4, @ANYBLOB="00010000316f0600300012800b00010067656e657665000020000280080011"], 0x64}}, 0x20000000) syslog(0x2, &(0x7f0000000bc0)=""/27, 0x1b) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) kernel console output (not intermixed with test programs): 5][T22040] R13: 00007fb53fe26038 R14: 00007fb53fe25fa0 R15: 00007ffff6fb9638 [ 1069.575309][T22040] [ 1069.802338][T22043] FAULT_INJECTION: forcing a failure. [ 1069.802338][T22043] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1069.815783][T22043] CPU: 0 UID: 0 PID: 22043 Comm: syz.4.4499 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1069.815804][T22043] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1069.815809][T22043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1069.815816][T22043] Call Trace: [ 1069.815820][T22043] [ 1069.815824][T22043] dump_stack_lvl+0x100/0x190 [ 1069.815843][T22043] should_fail_ex.cold+0x5/0xa [ 1069.815858][T22043] _copy_to_user+0x32/0xd0 [ 1069.815874][T22043] simple_read_from_buffer+0xcb/0x170 [ 1069.815888][T22043] proc_fail_nth_read+0x1af/0x230 [ 1069.815905][T22043] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1069.815922][T22043] ? rw_verify_area+0xce/0x6d0 [ 1069.815937][T22043] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1069.815954][T22043] vfs_read+0x1e4/0xb40 [ 1069.815972][T22043] ? __pfx_vfs_read+0x10/0x10 [ 1069.815988][T22043] ? __fget_files+0x215/0x3d0 [ 1069.816002][T22043] ? __fget_files+0x21f/0x3d0 [ 1069.816017][T22043] ksys_read+0x12a/0x250 [ 1069.816033][T22043] ? __pfx_ksys_read+0x10/0x10 [ 1069.816053][T22043] do_syscall_64+0x115/0x870 [ 1069.816067][T22043] ? clear_bhb_loop+0x40/0x90 [ 1069.816080][T22043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1069.816092][T22043] RIP: 0033:0x7fa2db95e84e [ 1069.816102][T22043] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1069.816112][T22043] RSP: 002b:00007fa2dc8c2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1069.816123][T22043] RAX: ffffffffffffffda RBX: 00007fa2dc8c36c0 RCX: 00007fa2db95e84e [ 1069.816130][T22043] RDX: 000000000000000f RSI: 00007fa2dc8c30a0 RDI: 0000000000000005 [ 1069.816136][T22043] RBP: 00007fa2dc8c3090 R08: 0000000000000000 R09: 0000000000000000 [ 1069.816142][T22043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1069.816149][T22043] R13: 00007fa2dbc26128 R14: 00007fa2dbc26090 R15: 00007ffdea8274c8 [ 1069.816162][T22043] [ 1070.021328][T22040] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1070.033781][T22025] vhci_hcd vhci_hcd.0: Device attached [ 1070.395116][T10096] usb 40-1: SetAddress Request (54) to port 0 [ 1070.401968][T10096] usb 40-1: new SuperSpeed USB device number 54 using vhci_hcd [ 1070.634491][T22061] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4504'. [ 1070.656469][T22061] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4504'. [ 1071.145866][T10092] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 1071.335137][T22053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1071.396530][T10092] usb 5-1: Using ep0 maxpacket: 16 [ 1071.402079][T22053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1071.414299][T10092] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1071.442713][T10092] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1071.459516][T10092] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1071.473251][T10092] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1071.482590][T10092] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1071.748645][T10097] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1071.784686][T10092] usb 5-1: config 0 descriptor?? [ 1071.925009][T10097] usb 6-1: Using ep0 maxpacket: 32 [ 1071.937649][T22026] vhci_hcd: connection reset by peer [ 1071.943217][T17371] vhci_hcd vhci_hcd.3: stop threads [ 1071.949375][T17371] vhci_hcd vhci_hcd.3: release socket [ 1071.956432][T10097] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1071.957046][T17371] vhci_hcd vhci_hcd.3: disconnect device [ 1071.965167][T10097] usb 6-1: config 0 has no interface number 0 [ 1071.979064][T10097] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1071.990360][T10097] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1071.998749][T10097] usb 6-1: Product: syz [ 1072.003014][T10097] usb 6-1: Manufacturer: syz [ 1072.008842][T10097] usb 6-1: SerialNumber: syz [ 1072.028997][T10097] usb 6-1: config 0 descriptor?? [ 1072.061320][T10097] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1072.073416][T10097] usb 6-1: selecting invalid altsetting 1 [ 1072.087801][T10097] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1072.126573][T10097] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1072.137228][T10097] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1072.147538][T10097] usb 6-1: media controller created [ 1072.209001][T10097] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1072.345027][T15485] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 1072.446242][T10092] usbhid 5-1:0.0: can't add hid device: -71 [ 1072.452610][T10092] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1072.465596][T10092] usb 5-1: USB disconnect, device number 24 [ 1072.505001][T15485] usb 3-1: Using ep0 maxpacket: 32 [ 1072.519799][T15485] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1072.539503][T15485] usb 3-1: config 0 has no interface number 0 [ 1072.554646][T15485] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1072.569814][T15485] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1072.578188][T15485] usb 3-1: Product: syz [ 1072.582455][T15485] usb 3-1: Manufacturer: syz [ 1072.587565][T15485] usb 3-1: SerialNumber: syz [ 1072.604242][T15485] usb 3-1: config 0 descriptor?? [ 1072.622287][T15485] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1072.631943][T15485] usb 3-1: selecting invalid altsetting 1 [ 1072.641850][T15485] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1072.681638][T15485] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1072.692887][T15485] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1072.701947][T15485] usb 3-1: media controller created [ 1072.735020][T15485] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1072.828835][T15135] block nbd3: Receive control failed (result -107) [ 1073.009519][T22081] nbd3: detected capacity change from 0 to 8589934592 [ 1073.061811][T22084] Unsupported ieee802154 address type: 0 [ 1073.070226][ T29] audit: type=1400 audit(1785810039.200:3925): avc: denied { bind } for pid=22071 comm="syz.2.4508" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1073.109757][ T2204] block nbd3: Dead connection, failed to find a fallback [ 1073.118289][ T2204] block nbd3: shutting down sockets [ 1073.149057][ T2204] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1073.165548][ T2204] buffer_io_error: 1234 callbacks suppressed [ 1073.165585][ T2204] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1073.185961][ T2204] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1073.203458][ T2204] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1073.218240][ T2204] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1073.228282][ T2204] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1073.237187][ T2204] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1073.250855][ T2204] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1073.259546][ T2204] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1073.269880][ T2204] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1073.278565][ T2204] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1073.288496][ T2204] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1073.297188][ T2204] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1073.307537][ T2204] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1073.316284][ T2204] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1073.325335][T10097] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1073.326489][ T2204] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1073.336395][T10097] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1073.343874][T21482] ldm_validate_partition_table(): Disk read failed. [ 1073.438892][T15135] Bluetooth: hci0: unexpected event for opcode 0x0004 [ 1073.447780][ T1705] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1073.447812][ T1705] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1073.447930][ T1705] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1073.447953][ T1705] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1073.448139][T21482] Dev nbd3: unable to read RDB block 0 [ 1073.451600][T21482] nbd3: unable to read partition table [ 1073.528729][T15135] Bluetooth: hci5: unexpected event for opcode 0x0004 [ 1073.549191][T21482] ldm_validate_partition_table(): Disk read failed. [ 1073.556512][T21482] Dev nbd3: unable to read RDB block 0 [ 1073.564877][T21482] nbd3: unable to read partition table [ 1073.679349][ T29] audit: type=1400 audit(1785810039.820:3926): avc: denied { connect } for pid=22092 comm="syz.3.4515" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1073.877509][T15485] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1073.894405][T15485] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1073.989888][ T29] audit: type=1400 audit(1785810040.130:3927): avc: denied { write } for pid=22101 comm="syz.5.4518" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1074.021925][T22102] netlink: 'syz.5.4518': attribute type 10 has an invalid length. [ 1074.035351][ T5728] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 1074.195101][ T5728] usb 4-1: config index 0 descriptor too short (expected 63186, got 210) [ 1074.206626][ T5728] usb 4-1: config 0 has an invalid interface number: 106 but max is 0 [ 1074.215538][ T5728] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1074.237411][ T5728] usb 4-1: config 0 has no interface number 0 [ 1074.292878][ T5728] usb 4-1: config 0 interface 106 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 1074.303412][ T5728] usb 4-1: config 0 interface 106 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 1074.335966][ T5728] usb 4-1: config 0 interface 106 altsetting 0 endpoint 0x1 has invalid maxpacket 12398, setting to 1023 [ 1074.362270][ T5728] usb 4-1: config 0 interface 106 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 1074.377677][ T5728] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=df.bb [ 1074.388142][ T5728] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1074.461142][ T5728] usb 4-1: config 0 descriptor?? [ 1074.574313][ T5728] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1074.672291][T10092] usb 4-1: USB disconnect, device number 30 [ 1074.678375][ T12] usb 4-1: Failed to submit usb control message: -71 [ 1074.718750][ T12] usb 4-1: unable to send the bmi data to the device: -71 [ 1074.756111][ T12] usb 4-1: unable to get target info from device [ 1074.766982][ T12] usb 4-1: could not get target info (-71) [ 1074.776599][ T12] usb 4-1: could not probe fw (-71) [ 1075.100505][T10097] usb 6-1: USB disconnect, device number 12 [ 1075.196872][T22128] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4524'. [ 1075.231538][T22128] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4524'. [ 1075.619273][T10092] usb 3-1: USB disconnect, device number 26 [ 1075.639841][T10096] usb 40-1: device descriptor read/8, error -110 [ 1076.046059][T10096] usb usb40-port1: attempt power cycle [ 1076.534678][ T29] audit: type=1400 audit(1785810041.648:3928): avc: denied { listen } for pid=22148 comm="syz.4.4529" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1076.837756][T10096] usb usb40-port1: unable to enumerate USB device [ 1076.851751][ T29] audit: type=1400 audit(1785810041.648:3929): avc: denied { accept } for pid=22148 comm="syz.4.4529" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1077.455363][T22157] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1077.512718][T22165] kvm: kvm [22155]: vcpu0, guest rIP: 0x58ad29489c2a7d0a Unhandled WRMSR(0x4000006d) = 0x6 [ 1078.335942][T15239] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1078.526015][T15239] usb 6-1: Using ep0 maxpacket: 16 [ 1078.551664][T15239] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1078.620767][T15239] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1078.658419][T15239] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1078.721105][T15239] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1078.770618][T15239] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1078.821646][T15239] usb 6-1: config 0 descriptor?? [ 1079.172310][T22191] sctp: [Deprecated]: syz.0.4536 (pid 22191) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1079.172310][T22191] Use struct sctp_sack_info instead [ 1079.266247][T22194] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 1079.306054][T10096] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 1079.312101][T22194] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 1079.417927][T22198] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4537'. [ 1079.495273][T10096] usb 3-1: Using ep0 maxpacket: 8 [ 1079.497577][T10096] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 1079.499280][T10096] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 1079.499306][T10096] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 1079.499325][T10096] usb 3-1: Product: syz [ 1079.499339][T10096] usb 3-1: Manufacturer: syz [ 1079.499351][T10096] usb 3-1: SerialNumber: syz [ 1079.502894][T15239] usbhid 6-1:0.0: can't add hid device: -71 [ 1079.502978][T15239] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1079.524300][T15239] usb 6-1: USB disconnect, device number 13 [ 1079.568402][ T29] audit: type=1400 audit(1785810044.708:3930): avc: denied { write } for pid=22197 comm="syz.4.4537" path="socket:[89695]" dev="sockfs" ino=89695 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1079.655051][T10092] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1079.728203][T10096] usb 3-1: Handspring Visor / Palm OS: No valid connect info available [ 1079.736652][T10096] usb 3-1: Handspring Visor / Palm OS: port 0, is for Generic use [ 1079.744761][T10096] usb 3-1: Handspring Visor / Palm OS: port 0, is for Generic use [ 1079.758730][T10096] usb 3-1: Handspring Visor / Palm OS: Number of ports: 2 [ 1079.937265][T10096] visor 3-1:1.0: Handspring Visor / Palm OS converter detected [ 1079.960154][T10096] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 1079.990663][T10096] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 1080.169545][ T29] audit: type=1400 audit(1785810045.318:3931): avc: denied { read } for pid=22212 comm="syz.5.4542" name="mice" dev="devtmpfs" ino=917 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1080.195304][ T29] audit: type=1400 audit(1785810045.338:3932): avc: denied { open } for pid=22212 comm="syz.5.4542" path="/dev/input/mice" dev="devtmpfs" ino=917 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1080.264828][ T29] audit: type=1400 audit(1785810045.408:3933): avc: denied { write } for pid=22208 comm="syz.0.4541" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1080.904612][T15135] Bluetooth: hci1: unexpected subevent 0x0c length: 30 > 5 [ 1080.922973][ T29] audit: type=1400 audit(1785810046.068:3934): avc: denied { create } for pid=22233 comm="syz.5.4548" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1080.965268][T22238] FAULT_INJECTION: forcing a failure. [ 1080.965268][T22238] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1081.025426][T22238] CPU: 1 UID: 0 PID: 22238 Comm: syz.0.4547 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1081.025459][T22238] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1081.025466][T22238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1081.025477][T22238] Call Trace: [ 1081.025483][T22238] [ 1081.025490][T22238] dump_stack_lvl+0x100/0x190 [ 1081.025518][T22238] should_fail_ex.cold+0x5/0xa [ 1081.025542][T22238] _copy_from_user+0x2e/0xd0 [ 1081.025568][T22238] copy_msghdr_from_user+0x9f/0x4c0 [ 1081.025587][T22238] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1081.025611][T22238] ? __pfx__kstrtoull+0x10/0x10 [ 1081.025634][T22238] ___sys_sendmsg+0x106/0x1e0 [ 1081.025654][T22238] ? __pfx____sys_sendmsg+0x10/0x10 [ 1081.025684][T22238] ? find_held_lock+0x2b/0x80 [ 1081.025719][T22238] __sys_sendmmsg+0x20c/0x440 [ 1081.025745][T22238] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1081.025767][T22238] ? ksys_write+0x190/0x250 [ 1081.025802][T22238] ? fput+0x79/0x100 [ 1081.025822][T22238] ? ksys_write+0x1ac/0x250 [ 1081.025837][T22238] ? __pfx_ksys_write+0x10/0x10 [ 1081.025857][T22238] __x64_sys_sendmmsg+0x9c/0x100 [ 1081.025880][T22238] ? lockdep_hardirqs_on+0x78/0x100 [ 1081.025902][T22238] do_syscall_64+0x115/0x870 [ 1081.025923][T22238] ? clear_bhb_loop+0x40/0x90 [ 1081.025945][T22238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1081.025964][T22238] RIP: 0033:0x7fb53fb9e019 [ 1081.025979][T22238] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1081.025997][T22238] RSP: 002b:00007fb540b04028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1081.026014][T22238] RAX: ffffffffffffffda RBX: 00007fb53fe25fa0 RCX: 00007fb53fb9e019 [ 1081.026026][T22238] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000003 [ 1081.026036][T22238] RBP: 00007fb540b04090 R08: 0000000000000000 R09: 0000000000000000 [ 1081.026046][T22238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1081.026056][T22238] R13: 00007fb53fe26038 R14: 00007fb53fe25fa0 R15: 00007ffff6fb9638 [ 1081.026079][T22238] [ 1081.292657][T22241] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1081.467275][T22249] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1081.690684][ T29] audit: type=1400 audit(1785810046.818:3935): avc: denied { bind } for pid=22252 comm="syz.4.4553" lport=127 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1081.735645][ T29] audit: type=1400 audit(1785810046.858:3936): avc: denied { connect } for pid=22252 comm="syz.4.4553" lport=127 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1081.951243][ T29] audit: type=1400 audit(1785810047.098:3937): avc: denied { name_bind } for pid=22256 comm="syz.4.4554" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 1081.986052][T10092] usb 3-1: USB disconnect, device number 27 [ 1082.020178][ T29] audit: type=1400 audit(1785810047.098:3938): avc: denied { node_bind } for pid=22256 comm="syz.4.4554" saddr=ff00::1 src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 1082.040141][T10092] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 1082.088843][T10092] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 1082.128588][T10092] visor 3-1:1.0: device disconnected [ 1082.220889][T22262] overlayfs: missing 'lowerdir' [ 1082.736299][ T29] audit: type=1400 audit(1785810047.868:3939): avc: denied { write } for pid=22267 comm="syz.3.4556" name="functions" dev="configfs" ino=9901 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1082.812975][T22269] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1082.864591][T22273] FAULT_INJECTION: forcing a failure. [ 1082.864591][T22273] name failslab, interval 1, probability 0, space 0, times 0 [ 1082.878175][T22273] CPU: 1 UID: 0 PID: 22273 Comm: syz.2.4558 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1082.878207][T22273] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1082.878215][T22273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1082.878225][T22273] Call Trace: [ 1082.878232][T22273] [ 1082.878239][T22273] dump_stack_lvl+0x100/0x190 [ 1082.878267][T22273] should_fail_ex.cold+0x5/0xa [ 1082.878296][T22273] should_failslab+0xc2/0x120 [ 1082.878321][T22273] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1082.878344][T22273] ? do_getname+0x35/0x390 [ 1082.878371][T22273] do_getname+0x35/0x390 [ 1082.878396][T22273] __x64_sys_rmdir+0x36/0x70 [ 1082.878417][T22273] do_syscall_64+0x115/0x870 [ 1082.878439][T22273] ? clear_bhb_loop+0x40/0x90 [ 1082.878460][T22273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1082.878477][T22273] RIP: 0033:0x7f630819e019 [ 1082.878496][T22273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1082.878513][T22273] RSP: 002b:00007f63090c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 1082.878531][T22273] RAX: ffffffffffffffda RBX: 00007f6308425fa0 RCX: 00007f630819e019 [ 1082.878542][T22273] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000200 [ 1082.878552][T22273] RBP: 00007f63090c1090 R08: 0000000000000000 R09: 0000000000000000 [ 1082.878563][T22273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1082.878572][T22273] R13: 00007f6308426038 R14: 00007f6308425fa0 R15: 00007ffc37918858 [ 1082.878595][T22273] [ 1083.298006][T15135] Bluetooth: hci2: unexpected event for opcode 0x0004 [ 1083.634628][T22290] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4562'. [ 1083.656483][T22290] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4562'. [ 1084.678706][T17372] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1084.695055][T15485] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1084.739259][T17372] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1084.865730][T15485] usb 6-1: Using ep0 maxpacket: 16 [ 1084.883627][T22311] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 1084.890172][T22311] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1084.915243][T15485] usb 6-1: config 0 interface 0 altsetting 11 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1084.948425][T15485] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1084.956007][T22311] vhci_hcd vhci_hcd.0: Device attached [ 1084.963602][T15485] usb 6-1: New USB device found, idVendor=1038, idProduct=12c2, bcdDevice= 0.00 [ 1084.977787][ T5622] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1084.992829][ T5622] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1085.005363][ T5622] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1085.015360][ T5622] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1085.022699][ T5622] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1085.034667][T17372] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1085.040737][T15485] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1085.053428][T17372] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1085.064357][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 1085.064372][ T29] audit: type=1400 audit(1785810049.193:3944): avc: denied { mounton } for pid=22314 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 1085.140539][T15485] usb 6-1: config 0 descriptor?? [ 1085.235249][T10097] usb 34-1: SetAddress Request (58) to port 0 [ 1085.281020][T17372] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1085.291484][T10097] usb 34-1: new SuperSpeed USB device number 58 using vhci_hcd [ 1085.299806][T17372] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1085.416500][T22323] FAULT_INJECTION: forcing a failure. [ 1085.416500][T22323] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1085.477479][T22323] CPU: 1 UID: 0 PID: 22323 Comm: syz.3.4573 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1085.477507][T22323] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1085.477517][T22323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1085.477526][T22323] Call Trace: [ 1085.477533][T22323] [ 1085.477541][T22323] dump_stack_lvl+0x100/0x190 [ 1085.477567][T22323] should_fail_ex.cold+0x5/0xa [ 1085.477587][T22323] _copy_from_user+0x2e/0xd0 [ 1085.477612][T22323] do_ipv6_setsockopt+0x73d/0x44a0 [ 1085.477638][T22323] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 1085.477659][T22323] ? avc_has_perm_noaudit+0xf0/0x3b0 [ 1085.477680][T22323] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 1085.477702][T22323] ? avc_has_perm_noaudit+0x145/0x3b0 [ 1085.477723][T22323] ? avc_has_perm+0x135/0x1e0 [ 1085.477743][T22323] ? __pfx_avc_has_perm+0x10/0x10 [ 1085.477764][T22323] ? get_pid_task+0x106/0x250 [ 1085.477786][T22323] ? sock_has_perm+0x25a/0x2f0 [ 1085.477811][T22323] ? __pfx_sock_has_perm+0x10/0x10 [ 1085.477834][T22323] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 1085.477865][T22323] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 1085.477898][T22323] ? ipv6_setsockopt+0xcb/0x170 [ 1085.477918][T22323] ipv6_setsockopt+0xcb/0x170 [ 1085.477942][T22323] tcp_setsockopt+0xa7/0x100 [ 1085.477969][T22323] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1085.477999][T22323] do_sock_setsockopt+0xf3/0x1d0 [ 1085.478030][T22323] __sys_setsockopt+0x195/0x220 [ 1085.478057][T22323] __x64_sys_setsockopt+0xbd/0x160 [ 1085.478078][T22323] ? do_syscall_64+0x90/0x870 [ 1085.478100][T22323] ? lockdep_hardirqs_on+0x78/0x100 [ 1085.478122][T22323] do_syscall_64+0x115/0x870 [ 1085.478141][T22323] ? clear_bhb_loop+0x40/0x90 [ 1085.478164][T22323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1085.478182][T22323] RIP: 0033:0x7f9d4759e019 [ 1085.478198][T22323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1085.478214][T22323] RSP: 002b:00007f9d4851a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1085.478239][T22323] RAX: ffffffffffffffda RBX: 00007f9d47825fa0 RCX: 00007f9d4759e019 [ 1085.478251][T22323] RDX: 0000000000000020 RSI: 0000000000000029 RDI: 0000000000000003 [ 1085.478261][T22323] RBP: 00007f9d4851a090 R08: 0000000000000020 R09: 0000000000000000 [ 1085.478272][T22323] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 1085.478283][T22323] R13: 00007f9d47826038 R14: 00007f9d47825fa0 R15: 00007ffc1f0505a8 [ 1085.478307][T22323] [ 1085.801713][T22312] vhci_hcd: connection reset by peer [ 1085.807581][T17371] vhci_hcd vhci_hcd.0: stop threads [ 1085.825079][T17371] vhci_hcd vhci_hcd.0: release socket [ 1085.851298][T17371] vhci_hcd vhci_hcd.0: disconnect device [ 1085.868566][T17372] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1085.879068][T17372] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1085.995469][ T5861] netdevsim netdevsim4 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.061278][T17372] bridge_slave_1: left allmulticast mode [ 1086.067509][T17372] bridge_slave_1: left promiscuous mode [ 1086.084241][T17372] bridge0: port 2(bridge_slave_1) entered disabled state [ 1086.118161][T17372] bridge_slave_0: left allmulticast mode [ 1086.149895][T17372] bridge_slave_0: left promiscuous mode [ 1086.185275][T17372] bridge0: port 1(bridge_slave_0) entered disabled state [ 1087.014544][ T5622] Bluetooth: hci5: unexpected event for opcode 0x0004 [ 1087.028052][T22347] netlink: 'syz.2.4577': attribute type 10 has an invalid length. [ 1087.052126][T22347] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4577'. [ 1087.077821][T22349] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4577'. [ 1087.112617][T17372] bond4 (unregistering): (slave bridge8): Releasing backup interface [ 1087.121000][T17372] bridge8 (unregistering): left promiscuous mode [ 1087.137644][T17372] bond5 (unregistering): (slave bridge9): Releasing backup interface [ 1087.149220][T17372] bridge9 (unregistering): left promiscuous mode [ 1087.163924][T17372] bond6 (unregistering): (slave bridge11): Releasing backup interface [ 1087.165006][ T5622] Bluetooth: hci0: command tx timeout [ 1087.172434][T17372] bridge11 (unregistering): left promiscuous mode [ 1087.198572][T17372] bond7 (unregistering): (slave bridge13): Releasing backup interface [ 1087.206906][T17372] bridge13 (unregistering): left promiscuous mode [ 1087.234125][T17372] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1087.251237][T17372] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1087.263065][T17372] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 1087.274126][T17372] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 1087.289066][T17372] bond0 (unregistering): Released all slaves [ 1087.299416][T17372] bond1 (unregistering): Released all slaves [ 1087.312981][T17372] bond2 (unregistering): Released all slaves [ 1087.327634][T17372] bond3 (unregistering): Released all slaves [ 1087.342204][T17372] bond4 (unregistering): Released all slaves [ 1087.362969][T17372] bond5 (unregistering): Released all slaves [ 1087.376382][T17372] bond6 (unregistering): Released all slaves [ 1087.389768][T17372] bond7 (unregistering): Released all slaves [ 1087.420861][T15485] usbhid 6-1:0.0: can't add hid device: -71 [ 1087.422992][ T12] netdevsim netdevsim4 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.428149][T15485] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1087.496578][T15485] usb 6-1: USB disconnect, device number 14 [ 1087.507640][T17371] netdevsim netdevsim4 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.529350][T17371] netdevsim netdevsim4 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.584738][T17372] tipc: Disabling bearer [ 1087.635041][T17372] tipc: Left network mode [ 1088.008019][T22373] gadgetfs: bound to dummy_udc driver [ 1088.114506][T17372] hsr_slave_0: left promiscuous mode [ 1088.164219][T17372] hsr_slave_1: left promiscuous mode [ 1088.194127][T17372] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1088.210019][T17372] batadv0: mtu less than device minimum [ 1088.244029][T17372] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1088.256887][T17372] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1088.267747][T17372] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1088.278598][T17372] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1088.289423][T17372] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1088.300250][T17372] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1088.311075][T17372] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1088.321892][T17372] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1088.370011][ T5728] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 1088.384778][ C1] gadgetfs: connected [ 1088.397850][ T5728] gadgetfs: disconnected [ 1088.506471][T17372] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1088.541747][T22390] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4586'. [ 1088.553716][T22390] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4586'. [ 1088.555309][ C1] gadgetfs: connected [ 1088.577925][ T5728] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1088.593999][ T29] audit: type=1400 audit(1785810052.713:3945): avc: denied { write } for pid=22362 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1088.618252][T22365] gadgetfs: suspended from state 3 [ 1088.623758][T22365] gadgetfs: disconnected [ 1088.633810][ T5728] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 1088.657835][T17372] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1088.659402][ T5728] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1088.728426][T17372] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1088.740276][T17372] batman_adv: batadv0: Interface deactivated: dummy0 [ 1088.740839][ T29] audit: type=1400 audit(1785810052.853:3946): avc: denied { read } for pid=22394 comm="syz.2.4587" name="rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1088.756473][T17372] batman_adv: batadv0: Removing interface: dummy0 [ 1088.804800][ T5728] usb 2-1: can't set config #1, error -71 [ 1088.815856][ T5728] usb 2-1: USB disconnect, device number 37 [ 1088.883669][T17372] veth1_macvtap: left promiscuous mode [ 1088.899247][T17372] veth0_macvtap: left promiscuous mode [ 1088.919203][ T29] audit: type=1400 audit(1785810052.853:3947): avc: denied { open } for pid=22394 comm="syz.2.4587" path="/dev/rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1088.921360][T17372] veth1_vlan: left promiscuous mode [ 1088.973087][T17372] veth0_vlan: left promiscuous mode [ 1089.013368][ T29] audit: type=1400 audit(1785810052.943:3948): avc: denied { write } for pid=22397 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1089.081208][ T29] audit: type=1400 audit(1785810052.973:3949): avc: denied { name_bind } for pid=22394 comm="syz.2.4587" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 1089.236074][ T5622] Bluetooth: hci0: command tx timeout [ 1089.259082][T22405] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4589'. [ 1089.558377][ T29] audit: type=1400 audit(1785810053.703:3950): avc: denied { setopt } for pid=22404 comm="syz.3.4589" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 1089.584419][T22408] netlink: 'syz.3.4589': attribute type 1 has an invalid length. [ 1089.681145][T17372] team0 (unregistering): Port device team_slave_1 removed [ 1089.737416][T17372] team0 (unregistering): Port device team_slave_0 removed [ 1090.099331][T17372] smc: removing net device lo with user defined pnetid SYZ0 [ 1090.171403][ T5272] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1090.354600][T22414] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1090.455022][T10097] usb 34-1: device descriptor read/8, error -110 [ 1090.747012][T22421] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1090.884757][T10097] usb usb34-port1: attempt power cycle [ 1091.229811][T22314] bridge0: port 1(bridge_slave_0) entered blocking state [ 1091.268482][T22314] bridge0: port 1(bridge_slave_0) entered disabled state [ 1091.294583][T22314] bridge_slave_0: entered allmulticast mode [ 1091.315300][ T5622] Bluetooth: hci0: command tx timeout [ 1091.318034][T22314] bridge_slave_0: entered promiscuous mode [ 1091.356085][T22314] bridge0: port 2(bridge_slave_1) entered blocking state [ 1091.384893][T22314] bridge0: port 2(bridge_slave_1) entered disabled state [ 1091.414251][T22314] bridge_slave_1: entered allmulticast mode [ 1091.451777][T22314] bridge_slave_1: entered promiscuous mode [ 1091.506164][T10097] usb usb34-port1: unable to enumerate USB device [ 1091.514476][ T29] audit: type=1400 audit(1785810055.653:3951): avc: denied { write } for pid=22419 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1091.583029][T22314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1091.612159][T22314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1091.711505][ T5622] Bluetooth: hci2: unexpected event for opcode 0x0004 [ 1091.721292][T22314] team0: Port device team_slave_0 added [ 1091.743203][ T29] audit: type=1400 audit(1785810055.883:3952): avc: denied { write } for pid=22446 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1091.786815][T22314] team0: Port device team_slave_1 added [ 1091.869136][T22314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1091.897029][T22314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1091.946920][T22314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1091.963943][T22314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1091.980345][T22314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1092.041583][ T29] audit: type=1400 audit(1785810056.183:3953): avc: denied { mount } for pid=22452 comm="syz.2.4596" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 1092.065299][T22314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1092.084350][ T29] audit: type=1400 audit(1785810056.183:3954): avc: denied { search } for pid=22452 comm="syz.2.4596" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 1092.088945][ T5272] 8021q: adding VLAN 0 to HW filter on device eth8 [ 1092.137252][ T29] audit: type=1400 audit(1785810056.183:3955): avc: denied { write } for pid=22452 comm="syz.2.4596" name="versions" dev="nfsd" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 1092.197050][T22314] hsr_slave_0: entered promiscuous mode [ 1092.197944][ T29] audit: type=1400 audit(1785810056.183:3956): avc: denied { open } for pid=22452 comm="syz.2.4596" path="/314/nfsd/versions" dev="nfsd" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 1092.203577][T22314] hsr_slave_1: entered promiscuous mode [ 1092.252299][T22314] debugfs: 'hsr0' already exists in 'hsr' [ 1092.258564][T22314] Cannot create hsr debugfs directory [ 1092.315219][ T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1092.446231][ T9] usb 3-1: device descriptor read/64, error -71 [ 1092.695035][ T9] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 1092.754049][T22314] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1092.770496][T22314] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1092.778626][T22314] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1092.789741][T22314] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1092.798324][T22314] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1092.879496][T22468] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4597'. [ 1092.914852][T22468] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4597'. [ 1093.109333][T22314] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1093.237225][ T9] usb 3-1: device descriptor read/64, error -71 [ 1093.266833][ T29] audit: type=1400 audit(1785810056.401:3957): avc: denied { write } for pid=22456 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1093.294338][T22314] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1093.312094][T22314] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1093.355729][ T9] usb usb3-port1: attempt power cycle [ 1093.395001][ T5622] Bluetooth: hci0: command tx timeout [ 1093.428923][T22314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1093.521192][ T29] audit: type=1400 audit(1785810056.661:3958): avc: denied { write } for pid=22477 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1093.546133][T22314] 8021q: adding VLAN 0 to HW filter on device team0 [ 1093.602133][T17372] bridge0: port 1(bridge_slave_0) entered blocking state [ 1093.609333][T17372] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1093.669005][T17372] bridge0: port 2(bridge_slave_1) entered blocking state [ 1093.676182][T17372] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1093.727364][ T9] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1093.761218][ T5272] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1093.779049][ T9] usb 3-1: device descriptor read/8, error -71 [ 1093.860989][ T29] audit: type=1400 audit(1785810057.001:3959): avc: denied { watch } for pid=22481 comm="syz.3.4600" path="/306" dev="tmpfs" ino=1660 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1094.025188][T22482] nvme_fabrics: missing parameter 'transport=%s' [ 1094.040512][ T9] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 1094.085769][ T9] usb 3-1: device descriptor read/8, error -71 [ 1094.095866][T22482] nvme_fabrics: missing parameter 'nqn=%s' [ 1094.183695][ T5728] IPVS: starting estimator thread 0... [ 1094.255206][ T9] usb usb3-port1: unable to enumerate USB device [ 1094.289716][T22504] IPVS: using max 78 ests per chain, 187200 per kthread [ 1094.694148][ T29] audit: type=1400 audit(1785810057.831:3960): avc: denied { write } for pid=22494 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1094.768041][T22314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1094.888517][T22508] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1094.936349][ T5272] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1095.060110][T22508] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4603'. [ 1095.591406][T22314] veth0_vlan: entered promiscuous mode [ 1095.598245][T22544] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1095.622618][T22314] veth1_vlan: entered promiscuous mode [ 1095.676266][ T5622] Bluetooth: hci5: unexpected event for opcode 0x0004 [ 1095.720459][T22314] veth0_macvtap: entered promiscuous mode [ 1095.778726][T22314] veth1_macvtap: entered promiscuous mode [ 1095.837761][T22538] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 1095.844315][T22538] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1095.894666][T22314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1095.908078][T22552] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1095.920929][T22538] vhci_hcd vhci_hcd.0: Device attached [ 1095.952415][T22314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1096.185076][ T5728] usb 38-1: SetAddress Request (50) to port 0 [ 1096.275669][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1096.302193][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1096.345040][ T5861] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1096.363888][ T5728] usb 38-1: new SuperSpeed USB device number 50 using vhci_hcd [ 1096.363998][ T5861] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1097.299946][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1097.317931][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1097.350555][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1097.360213][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1098.009968][T22588] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4615'. [ 1098.019360][T22588] bridge_slave_1: left allmulticast mode [ 1098.025127][T22588] bridge_slave_1: left promiscuous mode [ 1098.031848][T22588] bridge0: port 2(bridge_slave_1) entered disabled state [ 1098.233219][T22588] bridge_slave_0: left allmulticast mode [ 1098.239084][T22588] bridge_slave_0: left promiscuous mode [ 1098.245490][T22588] bridge0: port 1(bridge_slave_0) entered disabled state [ 1098.423800][T22548] vhci_hcd: connection reset by peer [ 1098.553018][T17371] vhci_hcd vhci_hcd.2: stop threads [ 1098.575690][T17371] vhci_hcd vhci_hcd.2: release socket [ 1098.627404][T17371] vhci_hcd vhci_hcd.2: disconnect device [ 1099.510690][T22596] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1099.519608][T22596] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1099.718327][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 1099.718343][ T29] audit: type=1400 audit(1785810062.861:3965): avc: denied { write } for pid=22599 comm="syz.5.4620" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1099.784299][ T29] audit: type=1400 audit(1785810062.891:3966): avc: denied { read } for pid=22599 comm="syz.5.4620" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1099.999976][T22606] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4622'. [ 1100.039134][T22606] netlink: 'syz.6.4622': attribute type 10 has an invalid length. [ 1100.055329][T22610] xt_hashlimit: max too large, truncated to 1048576 [ 1100.073367][T22610] xt_hashlimit: overflow, rate too high: 0 [ 1100.083742][T22606] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4622'. [ 1100.106235][T22612] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1100.453138][T22622] net_ratelimit: 31 callbacks suppressed [ 1100.453152][T22622] openvswitch: netlink: nsh attr 1 has unexpected len 16 expected 8 [ 1100.691976][ T29] audit: type=1400 audit(1785810063.831:3967): avc: denied { append } for pid=22621 comm="syz.6.4628" name="sg0" dev="devtmpfs" ino=778 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1100.812831][ T29] audit: type=1400 audit(1785810063.861:3968): avc: denied { open } for pid=22621 comm="syz.6.4628" path="/dev/sg0" dev="devtmpfs" ino=778 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1101.150285][T22643] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1101.172086][T22643] kvm: kvm [22642]: vcpu0, guest rIP: 0x58ad29489c2a7d0a Unhandled WRMSR(0x4000006d) = 0x6 [ 1101.759051][ T5728] usb 38-1: device descriptor read/8, error -110 [ 1102.619434][ T5728] usb usb38-port1: attempt power cycle [ 1102.645846][T22658] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 1102.652393][T22658] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1102.721502][T22658] vhci_hcd vhci_hcd.0: Device attached [ 1102.899408][T22668] netlink: 'syz.5.4638': attribute type 1 has an invalid length. [ 1102.943368][T22668] bond4: entered promiscuous mode [ 1102.956975][T22668] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1103.017110][T17472] usb 34-1: SetAddress Request (62) to port 0 [ 1103.023783][T17472] usb 34-1: new SuperSpeed USB device number 62 using vhci_hcd [ 1103.099696][T22668] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4638'. [ 1103.182723][T22668] netlink: 'syz.5.4638': attribute type 9 has an invalid length. [ 1103.201027][T22679] veth0: entered promiscuous mode [ 1103.219440][ T29] audit: type=1400 audit(1785810066.361:3969): avc: denied { write } for pid=22657 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1103.246239][ T5728] usb usb38-port1: unable to enumerate USB device [ 1103.511676][ T29] audit: type=1400 audit(1785810066.651:3970): avc: denied { transfer } for pid=22685 comm="syz.5.4642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 1103.759387][ T29] audit: type=1400 audit(1785810066.891:3971): avc: denied { write } for pid=22682 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1103.840157][T22692] netlink: 15 bytes leftover after parsing attributes in process `syz.6.4645'. [ 1104.145056][T10096] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1104.335093][T10096] usb 6-1: Using ep0 maxpacket: 16 [ 1104.407747][T10096] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1104.472620][T10096] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1104.522252][T10096] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1104.551352][T22710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4649'. [ 1104.560437][T22710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4649'. [ 1104.569356][T22710] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Add Mapping response ret = -22) [ 1104.587083][T22660] vhci_hcd: connection reset by peer [ 1104.597610][T17372] vhci_hcd vhci_hcd.0: stop threads [ 1104.606185][T17372] vhci_hcd vhci_hcd.0: release socket [ 1104.615616][T17372] vhci_hcd vhci_hcd.0: disconnect device [ 1104.630669][T10096] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1104.662967][T10096] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1104.680151][T10096] usb 6-1: config 0 descriptor?? [ 1105.195428][T22718] gadgetfs: bound to dummy_udc driver [ 1105.231693][T10096] usbhid 6-1:0.0: can't add hid device: -71 [ 1105.267591][T10096] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1105.318245][T10096] usb 6-1: USB disconnect, device number 15 [ 1105.402062][T22724] netlink: 'syz.3.4652': attribute type 1 has an invalid length. [ 1105.444993][T15239] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 1105.453039][ C0] gadgetfs: connected [ 1105.465013][T10092] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 1105.476454][T15239] gadgetfs: disconnected [ 1105.520672][T22729] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1105.557754][T22724] bond9: entered promiscuous mode [ 1105.593805][T22724] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1105.627624][T22730] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4652'. [ 1105.642661][ C0] gadgetfs: connected [ 1105.655923][T15239] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1105.658717][T22730] netlink: 'syz.3.4652': attribute type 9 has an invalid length. [ 1105.685615][T10092] usb 3-1: not running at top speed; connect to a high speed hub [ 1105.705036][T15239] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 1105.727113][T10092] usb 3-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 1105.737029][T15239] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1105.746872][T10092] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1105.758844][ C0] gadgetfs: configuration #1 [ 1105.771036][T10092] usb 3-1: Product: syz [ 1105.780044][T10092] usb 3-1: Manufacturer: syz [ 1105.787291][T10092] usb 3-1: SerialNumber: syz [ 1105.899177][T22715] gadgetfs: suspended from state 3 [ 1105.904414][T15239] usb 2-1: can't set config #1, error -71 [ 1105.922257][T22715] gadgetfs: disconnected [ 1105.935858][T15239] usb 2-1: USB disconnect, device number 38 [ 1105.962638][T22733] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4654'. [ 1105.975150][T22733] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4654'. [ 1106.089355][T10092] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1106.100139][T10092] usb 3-1: unit 2 not found! [ 1106.105723][T10092] usb 3-1: unit 6 not found! [ 1106.209298][T10092] usb 3-1: USB disconnect, device number 32 [ 1106.321951][T15500] udevd[15500]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1106.997339][T22758] FAULT_INJECTION: forcing a failure. [ 1106.997339][T22758] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1107.042840][T22758] CPU: 0 UID: 0 PID: 22758 Comm: syz.5.4662 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1107.042861][T22758] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1107.042865][T22758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1107.042872][T22758] Call Trace: [ 1107.042876][T22758] [ 1107.042881][T22758] dump_stack_lvl+0x100/0x190 [ 1107.042899][T22758] should_fail_ex.cold+0x5/0xa [ 1107.042913][T22758] _copy_from_user+0x2e/0xd0 [ 1107.042930][T22758] copy_msghdr_from_user+0x9f/0x4c0 [ 1107.042943][T22758] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1107.042961][T22758] ___sys_sendmsg+0x106/0x1e0 [ 1107.042972][T22758] ? __pfx____sys_sendmsg+0x10/0x10 [ 1107.042982][T22758] ? __lock_acquire+0x49f/0x1a40 [ 1107.042996][T22758] ? get_pid_task+0x106/0x250 [ 1107.043021][T22758] __sys_sendmsg+0x160/0x210 [ 1107.043036][T22758] ? __pfx___sys_sendmsg+0x10/0x10 [ 1107.043057][T22758] do_syscall_64+0x115/0x870 [ 1107.043070][T22758] ? clear_bhb_loop+0x40/0x90 [ 1107.043085][T22758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1107.043096][T22758] RIP: 0033:0x7f902079e019 [ 1107.043106][T22758] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1107.043117][T22758] RSP: 002b:00007f902171a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1107.043129][T22758] RAX: ffffffffffffffda RBX: 00007f9020a25fa0 RCX: 00007f902079e019 [ 1107.043135][T22758] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 1107.043142][T22758] RBP: 00007f902171a090 R08: 0000000000000000 R09: 0000000000000000 [ 1107.043148][T22758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1107.043154][T22758] R13: 00007f9020a26038 R14: 00007f9020a25fa0 R15: 00007ffe650a30a8 [ 1107.043168][T22758] [ 1107.436011][T22765] netlink: 'syz.3.4664': attribute type 1 has an invalid length. [ 1107.518698][T22765] bond10: entered promiscuous mode [ 1107.534219][T22765] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1107.582929][T22765] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4664'. [ 1107.617972][T22765] netlink: 'syz.3.4664': attribute type 9 has an invalid length. [ 1108.071685][T22711] veth0: left promiscuous mode [ 1108.116243][T17472] usb 34-1: device descriptor read/8, error -110 [ 1108.125297][T10096] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 1108.295208][T10096] usb 4-1: Using ep0 maxpacket: 16 [ 1108.421353][ T29] audit: type=1400 audit(1785810071.521:3972): avc: denied { write } for pid=22784 comm="syz.0.4669" name="rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1108.482970][T10096] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1108.580145][T17472] usb usb34-port1: attempt power cycle [ 1108.587578][T10096] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1108.605920][T10096] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1108.625739][ T29] audit: type=1400 audit(1785810071.521:3973): avc: denied { ioctl } for pid=22784 comm="syz.0.4669" path="/dev/rtc0" dev="devtmpfs" ino=922 ioctlcmd=0x7013 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1108.699298][T10096] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1108.730433][T10096] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1108.786967][T10096] usb 4-1: config 0 descriptor?? [ 1109.207322][T17472] usb usb34-port1: unable to enumerate USB device [ 1109.235501][ T29] audit: type=1400 audit(1785810072.371:3974): avc: denied { write } for pid=22780 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1109.462552][ T29] audit: type=1400 audit(1785810072.601:3975): avc: denied { write } for pid=22818 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1109.574446][T10096] usbhid 4-1:0.0: can't add hid device: -71 [ 1109.604765][T10096] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1109.644625][T10096] usb 4-1: USB disconnect, device number 31 [ 1109.929934][T22833] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1110.357669][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1110.367102][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1110.418124][T22843] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4681'. [ 1110.433657][ T29] audit: type=1400 audit(1785810073.561:3976): avc: denied { write } for pid=22827 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1110.463907][T22843] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4681'. [ 1110.606647][ T29] audit: type=1400 audit(1785810073.751:3977): avc: denied { write } for pid=22852 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1110.795004][T10092] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 1110.945472][T10092] usb 6-1: Using ep0 maxpacket: 32 [ 1110.954029][T10092] usb 6-1: config 0 has an invalid interface number: 196 but max is 0 [ 1110.973211][T10092] usb 6-1: config 0 has no interface number 0 [ 1110.995636][T10092] usb 6-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 1111.018196][T10092] usb 6-1: config 0 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1111.067911][T10092] usb 6-1: config 0 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 1111.104613][T10092] usb 6-1: config 0 interface 196 has no altsetting 0 [ 1111.126191][T10092] usb 6-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 1111.144552][T10092] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1111.164960][T10092] usb 6-1: Product: syz [ 1111.184130][T10092] usb 6-1: Manufacturer: syz [ 1111.207444][T22878] FAULT_INJECTION: forcing a failure. [ 1111.207444][T22878] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1111.224091][T10092] usb 6-1: SerialNumber: syz [ 1111.244640][T10092] usb 6-1: config 0 descriptor?? [ 1111.250275][T22878] CPU: 1 UID: 0 PID: 22878 Comm: syz.3.4687 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1111.250304][T22878] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1111.250312][T22878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1111.250322][T22878] Call Trace: [ 1111.250329][T22878] [ 1111.250336][T22878] dump_stack_lvl+0x100/0x190 [ 1111.250365][T22878] should_fail_ex.cold+0x5/0xa [ 1111.250388][T22878] _copy_to_user+0x32/0xd0 [ 1111.250413][T22878] simple_read_from_buffer+0xcb/0x170 [ 1111.250435][T22878] proc_fail_nth_read+0x1af/0x230 [ 1111.250462][T22878] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1111.250490][T22878] ? rw_verify_area+0xce/0x6d0 [ 1111.250513][T22878] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1111.250537][T22878] vfs_read+0x1e4/0xb40 [ 1111.250566][T22878] ? __pfx_vfs_read+0x10/0x10 [ 1111.250589][T22878] ? __fget_files+0x215/0x3d0 [ 1111.250613][T22878] ? __fget_files+0x21f/0x3d0 [ 1111.250636][T22878] ksys_read+0x12a/0x250 [ 1111.250660][T22878] ? __pfx_ksys_read+0x10/0x10 [ 1111.250691][T22878] do_syscall_64+0x115/0x870 [ 1111.250712][T22878] ? clear_bhb_loop+0x40/0x90 [ 1111.250736][T22878] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1111.250754][T22878] RIP: 0033:0x7f9d4755e84e [ 1111.250768][T22878] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1111.250785][T22878] RSP: 002b:00007f9d484f8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1111.250802][T22878] RAX: ffffffffffffffda RBX: 00007f9d484f96c0 RCX: 00007f9d4755e84e [ 1111.250813][T22878] RDX: 000000000000000f RSI: 00007f9d484f90a0 RDI: 0000000000000004 [ 1111.250825][T22878] RBP: 00007f9d484f9090 R08: 0000000000000000 R09: 0000000000000000 [ 1111.250835][T22878] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1111.250846][T22878] R13: 00007f9d47826128 R14: 00007f9d47826090 R15: 00007ffc1f0505a8 [ 1111.250870][T22878] [ 1111.255031][ T29] audit: type=1400 audit(1785810074.391:3978): avc: denied { write } for pid=22858 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1111.485279][T22850] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1111.535186][T17472] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1111.611030][ T29] audit: type=1400 audit(1785810074.721:3979): avc: denied { write } for pid=22886 comm="syz.3.4690" name="msr" dev="devtmpfs" ino=89 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1111.684203][ T29] audit: type=1400 audit(1785810074.761:3980): avc: denied { write } for pid=22885 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1111.706391][T17472] usb 3-1: Using ep0 maxpacket: 16 [ 1111.707866][T17472] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1111.752580][T17472] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1111.784495][T22890] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4691'. [ 1111.795870][T17472] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1111.810321][T22890] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4691'. [ 1111.824445][T17472] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1111.836100][T17472] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1111.856105][T17472] usb 3-1: config 0 descriptor?? [ 1112.078991][T22895] netlink: 88 bytes leftover after parsing attributes in process `syz.3.4693'. [ 1112.124269][T10092] ipheth 6-1:0.196: ipheth_enable_ncm: usb_control_msg: -71 [ 1112.144671][T10092] ipheth 6-1:0.196: Apple iPhone USB Ethernet device attached [ 1112.174275][T10092] usb 6-1: USB disconnect, device number 16 [ 1112.276342][T10092] ipheth 6-1:0.196: Apple iPhone USB Ethernet now disconnected [ 1112.335017][T10096] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 1112.485088][T10096] usb 4-1: Using ep0 maxpacket: 32 [ 1112.491177][T17472] usbhid 3-1:0.0: can't add hid device: -71 [ 1112.500628][T10096] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1112.511445][T10096] usb 4-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 1112.521948][T17472] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1112.534219][T10096] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1112.544463][T17472] usb 3-1: USB disconnect, device number 33 [ 1112.557605][T10096] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1112.567612][T10096] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1112.576767][T10096] usb 4-1: Product: syz [ 1112.587792][T10096] usb 4-1: Manufacturer: syz [ 1112.593360][T10096] usb 4-1: SerialNumber: syz [ 1112.609215][T10096] usb 4-1: config 0 descriptor?? [ 1113.071232][T10096] gs_usb 4-1:0.0: Configuring for 85 interfaces [ 1113.133886][ T5622] Bluetooth: hci5: unexpected event for opcode 0x0004 [ 1113.283785][T10096] gs_usb 4-1:0.0: Couldn't register candev for channel 0 (-EINVAL) [ 1113.297881][T10096] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -22 [ 1113.356580][ T5728] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 1113.588125][T10096] usb 4-1: USB disconnect, device number 32 [ 1113.601403][ T5728] usb 6-1: Using ep0 maxpacket: 16 [ 1113.675232][ T29] audit: type=1400 audit(1785810076.721:3981): avc: denied { getattr } for pid=22894 comm="syz.3.4693" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=92699 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1113.722525][ T5728] usb 6-1: config 0 interface 0 altsetting 11 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1113.848719][ T5728] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1113.920741][ T5728] usb 6-1: New USB device found, idVendor=1038, idProduct=12c2, bcdDevice= 0.00 [ 1114.050189][ T5728] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1114.204784][ T5728] usb 6-1: config 0 descriptor?? [ 1114.366160][ T5622] block nbd0: Receive control failed (result -107) [ 1114.476303][T22917] nbd0: detected capacity change from 0 to 8589934592 [ 1114.494616][ T2204] block nbd0: Dead connection, failed to find a fallback [ 1114.501768][ T2204] block nbd0: shutting down sockets [ 1114.507242][ T2204] blk_print_req_error: 24 callbacks suppressed [ 1114.507258][ T2204] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1114.524997][ T2204] buffer_io_error: 23 callbacks suppressed [ 1114.525016][ T2204] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1114.539773][ T2204] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1114.550785][ T2204] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1114.560598][ T2204] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1114.570449][ T2204] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1114.578949][ T2204] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1114.588555][ T2204] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1114.601411][ T2204] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1114.611767][ T2204] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1114.621319][ T2204] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1114.630919][ T2204] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1114.638870][ T2204] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1114.649772][ T2204] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1114.657769][ T2204] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1114.667895][ T2204] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1114.679566][T21482] ldm_validate_partition_table(): Disk read failed. [ 1114.692898][ T2204] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1114.702509][ T2204] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1114.711079][ T2204] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1114.720633][ T2204] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1114.728752][T21482] Dev nbd0: unable to read RDB block 0 [ 1114.737478][T21482] nbd0: unable to read partition table [ 1114.747248][T21482] ldm_validate_partition_table(): Disk read failed. [ 1114.754211][T21482] Dev nbd0: unable to read RDB block 0 [ 1114.760239][T21482] nbd0: unable to read partition table [ 1114.945599][ T29] audit: type=1400 audit(1785810078.061:3982): avc: denied { watch_reads } for pid=22922 comm="syz.2.4702" path="/331" dev="tmpfs" ino=1774 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1115.178257][ T29] audit: type=1326 audit(1785810078.171:3983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22922 comm="syz.2.4702" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f630819e019 code=0x0 [ 1117.001371][ T5728] usbhid 6-1:0.0: can't add hid device: -71 [ 1117.013252][ T5728] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1117.063887][ T5728] usb 6-1: USB disconnect, device number 17 [ 1117.070255][ T5622] block nbd3: Receive control failed (result -107) [ 1117.109882][ T5622] Bluetooth: hci1: unexpected event for opcode 0x0004 [ 1117.173722][T22941] nbd3: detected capacity change from 0 to 8589934592 [ 1117.209959][ T2204] block nbd3: Dead connection, failed to find a fallback [ 1117.217252][ T2204] block nbd3: shutting down sockets [ 1117.223448][T21482] ldm_validate_partition_table(): Disk read failed. [ 1117.250049][T21482] Dev nbd3: unable to read RDB block 0 [ 1117.280885][T21482] nbd3: unable to read partition table [ 1117.292911][T21482] ldm_validate_partition_table(): Disk read failed. [ 1117.300244][T21482] Dev nbd3: unable to read RDB block 0 [ 1117.306905][T21482] nbd3: unable to read partition table [ 1119.967329][ T5622] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 1119.992977][T22976] netlink: 14640 bytes leftover after parsing attributes in process `syz.0.4718'. [ 1120.054773][T22978] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(7) [ 1120.061366][T22978] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 1120.069443][T22978] vhci_hcd vhci_hcd.0: Device attached [ 1120.104645][ T29] audit: type=1400 audit(1785810083.241:3984): avc: denied { read } for pid=22977 comm="syz.5.4721" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1120.132442][T22978] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=22978 comm=syz.5.4721 [ 1120.156400][ T29] audit: type=1400 audit(1785810083.271:3985): avc: denied { open } for pid=22977 comm="syz.5.4721" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1120.181404][ T29] audit: type=1400 audit(1785810083.271:3986): avc: denied { ioctl } for pid=22977 comm="syz.5.4721" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9375 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1120.215301][T10096] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 1120.227222][T22980] vhci_hcd: connection closed [ 1120.228018][ T12] vhci_hcd vhci_hcd.5: stop threads [ 1120.246836][ T12] vhci_hcd vhci_hcd.5: release socket [ 1120.263288][ T12] vhci_hcd vhci_hcd.5: disconnect device [ 1120.384964][T10096] usb 4-1: Using ep0 maxpacket: 32 [ 1120.409106][T10096] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1120.441037][T10096] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1120.477214][T10096] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 1120.502375][T10096] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1120.534173][T10096] usb 4-1: config 0 descriptor?? [ 1120.757006][T22969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1120.792976][T22969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1120.951032][T22997] FAULT_INJECTION: forcing a failure. [ 1120.951032][T22997] name failslab, interval 1, probability 0, space 0, times 0 [ 1120.964508][T22997] CPU: 1 UID: 0 PID: 22997 Comm: syz.5.4725 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1120.964541][T22997] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1120.964549][T22997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1120.964559][T22997] Call Trace: [ 1120.964565][T22997] [ 1120.964571][T22997] dump_stack_lvl+0x100/0x190 [ 1120.964599][T22997] should_fail_ex.cold+0x5/0xa [ 1120.964621][T22997] should_failslab+0xc2/0x120 [ 1120.964643][T22997] __kmalloc_cache_noprof+0x91/0x6c0 [ 1120.964670][T22997] ? configfs_write_iter+0x388/0x4e0 [ 1120.964694][T22997] configfs_write_iter+0x388/0x4e0 [ 1120.964716][T22997] vfs_write+0x6ac/0x1050 [ 1120.964742][T22997] ? __pfx_configfs_write_iter+0x10/0x10 [ 1120.964764][T22997] ? __pfx_vfs_write+0x10/0x10 [ 1120.964804][T22997] ksys_write+0x12a/0x250 [ 1120.964819][T22997] ? __pfx_ksys_write+0x10/0x10 [ 1120.964840][T22997] do_syscall_64+0x115/0x870 [ 1120.964860][T22997] ? clear_bhb_loop+0x40/0x90 [ 1120.964880][T22997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1120.964897][T22997] RIP: 0033:0x7f902079e019 [ 1120.964912][T22997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1120.964928][T22997] RSP: 002b:00007f902171a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1120.964944][T22997] RAX: ffffffffffffffda RBX: 00007f9020a25fa0 RCX: 00007f902079e019 [ 1120.964955][T22997] RDX: 0000000000000006 RSI: 0000200000000130 RDI: 0000000000000004 [ 1120.964964][T22997] RBP: 00007f902171a090 R08: 0000000000000000 R09: 0000000000000000 [ 1120.964974][T22997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1120.964983][T22997] R13: 00007f9020a26038 R14: 00007f9020a25fa0 R15: 00007ffe650a30a8 [ 1120.965007][T22997] [ 1121.199647][T10096] koneplus 0003:1E7D:2D51.000C: unknown main item tag 0x0 [ 1121.206816][T10096] koneplus 0003:1E7D:2D51.000C: unknown main item tag 0x0 [ 1121.214311][T10096] koneplus 0003:1E7D:2D51.000C: item fetching failed at offset 2/5 [ 1121.222529][T10096] koneplus 0003:1E7D:2D51.000C: parse failed [ 1121.228537][T10096] koneplus 0003:1E7D:2D51.000C: probe with driver koneplus failed with error -22 [ 1121.341307][T23000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1121.391952][T23000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1121.429702][T23002] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1121.452399][T23002] kvm: kvm [23001]: vcpu0, guest rIP: 0x58ad29489c2a7d0a Unhandled WRMSR(0x4000006d) = 0x6 [ 1121.994997][ T5620] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 1123.268051][T10096] usb 4-1: USB disconnect, device number 33 [ 1123.540310][T23024] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1123.549389][T23024] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1123.575080][ T5620] usb 6-1: Using ep0 maxpacket: 16 [ 1123.575728][T23024] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1123.583844][ T5620] usb 6-1: config 0 interface 0 altsetting 11 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1123.603857][ T5620] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1123.616183][ T5620] usb 6-1: New USB device found, idVendor=1038, idProduct=12c2, bcdDevice= 0.00 [ 1123.640773][ T5620] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1123.643834][T23024] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1123.678500][ T5620] usb 6-1: config 0 descriptor?? [ 1123.771136][ T5622] Bluetooth: Wrong link type (-22) [ 1123.978715][T23036] block2mtd: error: cannot open device #! [ 1123.992421][ T29] audit: type=1400 audit(1785810087.131:3987): avc: denied { connect } for pid=23037 comm="syz.2.4739" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1125.467609][ T5622] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 1125.493456][ T29] audit: type=1400 audit(1785810088.591:3988): avc: denied { ioctl } for pid=23037 comm="syz.2.4739" path="socket:[93936]" dev="sockfs" ino=93936 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1127.028597][T23064] netlink: 15 bytes leftover after parsing attributes in process `syz.6.4745'. [ 1127.372586][ T29] audit: type=1400 audit(1785810090.511:3989): avc: denied { remount } for pid=23066 comm="syz.0.4746" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 1127.437240][ T5620] usbhid 6-1:0.0: can't add hid device: -71 [ 1127.444788][ T5620] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1127.489143][ T5620] usb 6-1: USB disconnect, device number 18 [ 1127.738790][T23082] netlink: 'syz.6.4751': attribute type 12 has an invalid length. [ 1127.747669][T23082] netlink: 'syz.6.4751': attribute type 29 has an invalid length. [ 1127.757382][T23082] netlink: 148 bytes leftover after parsing attributes in process `syz.6.4751'. [ 1127.768230][T23082] netlink: 59 bytes leftover after parsing attributes in process `syz.6.4751'. [ 1128.150330][T10096] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 1128.361772][ T29] audit: type=1400 audit(1785810091.501:3990): avc: denied { ioctl } for pid=23098 comm="syz.6.4755" path="/dev/cachefiles" dev="devtmpfs" ino=4 ioctlcmd=0x8932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1128.442655][T23103] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4757'. [ 1128.452643][T23103] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4757'. [ 1128.491662][T23055] faux_driver vgem: [drm] Unknown color mode 3; guessing buffer size. [ 1128.510452][ T29] audit: type=1400 audit(1785810091.651:3991): avc: denied { map } for pid=23053 comm="syz.3.4742" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1128.554873][T23105] gadgetfs: bound to dummy_udc driver [ 1128.815046][ T9] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 1128.843787][ C0] gadgetfs: connected [ 1128.848714][ T9] gadgetfs: disconnected [ 1129.018232][ C0] gadgetfs: connected [ 1129.039270][ T9] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1129.091510][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 1129.259495][T23100] gadgetfs: suspended from state 3 [ 1129.350394][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1129.416957][T23100] gadgetfs: disconnected [ 1129.547851][ T9] usb 2-1: can't set config #1, error -71 [ 1129.594023][ T9] usb 2-1: USB disconnect, device number 39 [ 1129.934967][T23139] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4764'. [ 1129.969786][T23139] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4764'. [ 1130.487616][T15135] block nbd2: Receive control failed (result -107) [ 1130.542089][ T29] audit: type=1400 audit(1785810092.681:3992): avc: denied { bind } for pid=23144 comm="syz.0.4767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1130.566757][ T29] audit: type=1400 audit(1785810092.681:3993): avc: denied { setopt } for pid=23144 comm="syz.0.4767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1130.588355][ T29] audit: type=1400 audit(1785810092.681:3994): avc: denied { listen } for pid=23144 comm="syz.0.4767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1130.608560][ T29] audit: type=1400 audit(1785810092.691:3995): avc: denied { accept } for pid=23144 comm="syz.0.4767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1130.628766][ T29] audit: type=1400 audit(1785810092.691:3996): avc: denied { write } for pid=23144 comm="syz.0.4767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1130.671120][ T29] audit: type=1400 audit(1785810092.811:3997): avc: denied { read } for pid=23144 comm="syz.0.4767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1130.708336][T23146] nbd2: detected capacity change from 0 to 8589934592 [ 1130.729388][ T29] audit: type=1400 audit(1785810092.861:3998): avc: denied { ioctl } for pid=23144 comm="syz.0.4767" path="socket:[94152]" dev="sockfs" ino=94152 ioctlcmd=0x8b32 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1130.768463][T23141] block nbd2: shutting down sockets [ 1131.562683][ T29] audit: type=1400 audit(1785810093.701:3999): avc: denied { getopt } for pid=23164 comm="syz.0.4772" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1131.650018][T23169] netlink: 'syz.0.4772': attribute type 8 has an invalid length. [ 1131.669339][T23169] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4772'. [ 1131.691738][T23169] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4772'. [ 1131.715177][T15135] Bluetooth: hci3: command 0xfc11 tx timeout [ 1131.715247][ T5622] Bluetooth: hci3: Entering manufacturer mode failed (-110) [ 1131.936179][ T5622] Bluetooth: hci5: unexpected event for opcode 0x0004 [ 1133.074588][ T29] audit: type=1400 audit(1785810095.211:4000): avc: denied { read write } for pid=23184 comm="syz.3.4778" name="sg0" dev="devtmpfs" ino=778 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1133.130993][T23187] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4779'. [ 1133.161747][T23187] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4779'. [ 1133.219948][ T29] audit: type=1400 audit(1785810095.281:4001): avc: denied { ioctl } for pid=23184 comm="syz.3.4778" path="/dev/sg0" dev="devtmpfs" ino=778 ioctlcmd=0x2286 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1135.935949][ T5622] Bluetooth: hci4: unexpected event for opcode 0x0004 [ 1135.945136][T23206] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1135.980195][T10096] libceph: connect (1)[c::]:6789 error -101 [ 1135.994689][T10096] libceph: mon0 (1)[c::]:6789 connect error [ 1136.052763][T23228] ceph: No mds server is up or the cluster is laggy [ 1136.478308][ T29] audit: type=1400 audit(1785810098.611:4002): avc: denied { create } for pid=23227 comm="syz.5.4789" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1136.591636][ T29] audit: type=1400 audit(1785810098.641:4003): avc: denied { write } for pid=23227 comm="syz.5.4789" name="file0" dev="tmpfs" ino=1365 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1136.679476][ T29] audit: type=1400 audit(1785810098.651:4004): avc: denied { open } for pid=23227 comm="syz.5.4789" path="/252/file0" dev="tmpfs" ino=1365 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1137.386803][ T29] audit: type=1400 audit(1785810099.531:4005): avc: denied { unlink } for pid=17763 comm="syz-executor" name="file0" dev="tmpfs" ino=1365 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1137.505774][T23250] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4793'. [ 1137.540339][T23250] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4793'. [ 1137.654208][T23249] Can't find ip_set type has [ 1138.364187][ T5622] Bluetooth: hci1: unexpected event for opcode 0x0004 [ 1138.938168][ T29] audit: type=1400 audit(1785810101.081:4006): avc: denied { listen } for pid=23280 comm="syz.2.4804" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 1138.970464][ T29] audit: type=1400 audit(1785810101.111:4007): avc: denied { create } for pid=23280 comm="syz.2.4804" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 1139.013700][T23283] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1139.034509][ T29] audit: type=1400 audit(1785810101.171:4008): avc: denied { sys_admin } for pid=23280 comm="syz.2.4804" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 1139.396596][ T29] audit: type=1400 audit(1785810101.541:4009): avc: denied { read } for pid=23291 comm="syz.2.4807" name="file" dev="configfs" ino=95513 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 1139.473737][ T29] audit: type=1800 audit(1785810101.541:4010): pid=23293 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.4807" name="file" dev="configfs" ino=95513 res=0 errno=0 [ 1139.561152][ T29] audit: type=1400 audit(1785810101.561:4011): avc: denied { create } for pid=23291 comm="syz.2.4807" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 1139.849016][T23296] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 1139.855552][T23296] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1139.984486][T23311] gadgetfs: bound to dummy_udc driver [ 1140.085544][T23313] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4812'. [ 1140.107277][T23313] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4812'. [ 1140.625514][ T9] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 1140.635884][ C0] gadgetfs: connected [ 1140.640153][ T9] gadgetfs: disconnected [ 1140.645247][T23320] netlink: 88 bytes leftover after parsing attributes in process `syz.2.4814'. [ 1140.803896][ C0] gadgetfs: connected [ 1140.818565][ T9] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1140.831503][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 1140.849569][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1140.869111][T23296] vhci_hcd vhci_hcd.0: Device attached [ 1140.876334][ C0] gadgetfs: configuration #1 [ 1141.253754][ T5728] usb 40-1: SetAddress Request (58) to port 0 [ 1141.309727][ T5728] usb 40-1: new SuperSpeed USB device number 58 using vhci_hcd [ 1141.841150][T10097] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1142.551872][T10097] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1142.573432][T10097] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 1142.629916][T10097] usb 7-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 1142.659379][T10097] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1142.694600][T10097] usb 7-1: Product: syz [ 1142.707847][T10097] usb 7-1: Manufacturer: syz [ 1142.724689][T10097] usb 7-1: SerialNumber: syz [ 1142.882645][T23318] gadgetfs: suspended from state 3 [ 1142.888158][ T9] usb 2-1: can't set config #1, error -71 [ 1142.906858][T23318] gadgetfs: disconnected [ 1142.913068][ T9] usb 2-1: USB disconnect, device number 40 [ 1142.974969][T23306] vhci_hcd: connection reset by peer [ 1142.987746][ T12] vhci_hcd vhci_hcd.3: stop threads [ 1143.016453][T10097] usb 7-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1143.023287][ T12] vhci_hcd vhci_hcd.3: release socket [ 1143.042223][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 1143.159215][T10097] usb 7-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 1143.183192][T10097] usb 7-1: found format II with max.bitrate = 4, frame size=7372 [ 1143.224557][T23334] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4819'. [ 1143.303873][T23336] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1143.327397][T23336] kvm: kvm [23335]: vcpu0, guest rIP: 0x58ad29489c2a7d0a Unhandled WRMSR(0x4000006d) = 0x6 [ 1143.377691][T23336] trusted_key: encrypted_key: insufficient parameters specified [ 1143.384785][T23325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1143.395524][T23325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1143.607995][T10097] usb 7-1: invalid uac2 rates [ 1143.627671][T10097] usb 7-1: invalid uac2 rates [ 1143.648310][T10097] usb 7-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 1143.670481][T10097] usb 7-1: found format II with max.bitrate = 4, frame size=7372 [ 1143.771700][T23345] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 1143.802465][T23345] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 1143.816661][ T29] audit: type=1326 audit(1785810104.960:4012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23323 comm="syz.6.4816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f94eed9e019 code=0x7ffc0000 [ 1143.901704][ T29] audit: type=1326 audit(1785810104.960:4013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23323 comm="syz.6.4816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f94eed9e019 code=0x7ffc0000 [ 1143.985267][ T29] audit: type=1326 audit(1785810104.960:4014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23323 comm="syz.6.4816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f94eed9e019 code=0x7ffc0000 [ 1144.092489][ T29] audit: type=1326 audit(1785810104.960:4015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23323 comm="syz.6.4816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f94eed9e019 code=0x7ffc0000 [ 1144.210247][ T5622] Bluetooth: hci5: ACL packet for unknown connection handle 201 [ 1144.222474][ T29] audit: type=1326 audit(1785810104.960:4016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23323 comm="syz.6.4816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7f94eed9e019 code=0x7ffc0000 [ 1144.424397][ T29] audit: type=1326 audit(1785810104.960:4017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23323 comm="syz.6.4816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f94eed9e019 code=0x7ffc0000 [ 1144.425067][T23357] FAULT_INJECTION: forcing a failure. [ 1144.425067][T23357] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1144.547725][T23357] CPU: 1 UID: 0 PID: 23357 Comm: syz.2.4828 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1144.547759][T23357] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1144.547766][T23357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1144.547776][T23357] Call Trace: [ 1144.547783][T23357] [ 1144.547789][T23357] dump_stack_lvl+0x100/0x190 [ 1144.547817][T23357] should_fail_ex.cold+0x5/0xa [ 1144.547838][T23357] _copy_to_user+0x32/0xd0 [ 1144.547865][T23357] simple_read_from_buffer+0xcb/0x170 [ 1144.547886][T23357] proc_fail_nth_read+0x1af/0x230 [ 1144.547913][T23357] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1144.547940][T23357] ? rw_verify_area+0xce/0x6d0 [ 1144.547971][T23357] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1144.547997][T23357] vfs_read+0x1e4/0xb40 [ 1144.548025][T23357] ? __pfx_vfs_read+0x10/0x10 [ 1144.548048][T23357] ? __fget_files+0x215/0x3d0 [ 1144.548072][T23357] ? __fget_files+0x21f/0x3d0 [ 1144.548096][T23357] ksys_read+0x12a/0x250 [ 1144.548122][T23357] ? __pfx_ksys_read+0x10/0x10 [ 1144.548152][T23357] do_syscall_64+0x115/0x870 [ 1144.548174][T23357] ? clear_bhb_loop+0x40/0x90 [ 1144.548195][T23357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1144.548213][T23357] RIP: 0033:0x7f630815e84e [ 1144.548228][T23357] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1144.548243][T23357] RSP: 002b:00007f630909ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1144.548260][T23357] RAX: ffffffffffffffda RBX: 00007f63090a06c0 RCX: 00007f630815e84e [ 1144.548272][T23357] RDX: 000000000000000f RSI: 00007f63090a00a0 RDI: 0000000000000005 [ 1144.548283][T23357] RBP: 00007f63090a0090 R08: 0000000000000000 R09: 0000000000000000 [ 1144.548293][T23357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1144.548303][T23357] R13: 00007f6308426128 R14: 00007f6308426090 R15: 00007ffc37918858 [ 1144.548327][T23357] [ 1144.813554][ T29] audit: type=1326 audit(1785810104.960:4018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23323 comm="syz.6.4816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f94eed9e019 code=0x7ffc0000 [ 1144.939920][ T29] audit: type=1326 audit(1785810104.960:4019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23323 comm="syz.6.4816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f94eed9e019 code=0x7ffc0000 [ 1145.035182][ T29] audit: type=1326 audit(1785810104.960:4020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23323 comm="syz.6.4816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f94eed9e019 code=0x7ffc0000 [ 1145.068638][T23367] FAULT_INJECTION: forcing a failure. [ 1145.068638][T23367] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1145.087072][T23367] CPU: 1 UID: 0 PID: 23367 Comm: syz.2.4831 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1145.087106][T23367] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1145.087114][T23367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1145.087124][T23367] Call Trace: [ 1145.087131][T23367] [ 1145.087138][T23367] dump_stack_lvl+0x100/0x190 [ 1145.087166][T23367] should_fail_ex.cold+0x5/0xa [ 1145.087189][T23367] _copy_to_user+0x32/0xd0 [ 1145.087218][T23367] simple_read_from_buffer+0xcb/0x170 [ 1145.087239][T23367] proc_fail_nth_read+0x1af/0x230 [ 1145.087268][T23367] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1145.087296][T23367] ? rw_verify_area+0xce/0x6d0 [ 1145.087321][T23367] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1145.087348][T23367] vfs_read+0x1e4/0xb40 [ 1145.087387][T23367] ? __pfx_vfs_read+0x10/0x10 [ 1145.087419][T23367] ? do_sys_openat2+0x159/0x1e0 [ 1145.087456][T23367] ksys_read+0x12a/0x250 [ 1145.087483][T23367] ? __pfx_ksys_read+0x10/0x10 [ 1145.087517][T23367] do_syscall_64+0x115/0x870 [ 1145.087539][T23367] ? clear_bhb_loop+0x40/0x90 [ 1145.087562][T23367] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1145.087580][T23367] RIP: 0033:0x7f630815e84e [ 1145.087611][T23367] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1145.087628][T23367] RSP: 002b:00007f630909ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1145.087646][T23367] RAX: ffffffffffffffda RBX: 00007f63090a06c0 RCX: 00007f630815e84e [ 1145.087658][T23367] RDX: 000000000000000f RSI: 00007f63090a00a0 RDI: 0000000000000003 [ 1145.087669][T23367] RBP: 00007f63090a0090 R08: 0000000000000000 R09: 0000000000000000 [ 1145.087680][T23367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1145.087690][T23367] R13: 00007f6308426128 R14: 00007f6308426090 R15: 00007ffc37918858 [ 1145.087713][T23367] [ 1145.106415][ T29] audit: type=1326 audit(1785810104.960:4021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23323 comm="syz.6.4816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f94eed9e019 code=0x7ffc0000 [ 1145.441263][T10097] usb 7-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 1145.705390][T10097] usb 7-1: USB disconnect, device number 3 [ 1145.730843][T23376] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4835'. [ 1145.746093][T23376] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4835'. [ 1145.801691][T21482] udevd[21482]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1146.128748][T23391] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4842'. [ 1146.131933][T23396] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1146.147908][T23396] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1146.165600][T23391] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4842'. [ 1146.234283][T23400] FAULT_INJECTION: forcing a failure. [ 1146.234283][T23400] name failslab, interval 1, probability 0, space 0, times 0 [ 1146.295291][T23400] CPU: 1 UID: 0 PID: 23400 Comm: syz.2.4844 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1146.295324][T23400] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1146.295331][T23400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1146.295340][T23400] Call Trace: [ 1146.295346][T23400] [ 1146.295353][T23400] dump_stack_lvl+0x100/0x190 [ 1146.295381][T23400] should_fail_ex.cold+0x5/0xa [ 1146.295404][T23400] should_failslab+0xc2/0x120 [ 1146.295428][T23400] __kmalloc_noprof+0xfc/0x820 [ 1146.295448][T23400] ? rcu_is_watching+0x12/0xc0 [ 1146.295475][T23400] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1146.295499][T23400] tomoyo_realpath_from_path+0xb6/0x690 [ 1146.295522][T23400] tomoyo_path_number_perm+0x23c/0x580 [ 1146.295547][T23400] ? tomoyo_path_number_perm+0x22e/0x580 [ 1146.295573][T23400] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1146.295625][T23400] ? find_held_lock+0x2b/0x80 [ 1146.295641][T23400] ? __fget_files+0x215/0x3d0 [ 1146.295658][T23400] ? hook_file_ioctl_common+0x140/0x440 [ 1146.295678][T23400] ? __fget_files+0x215/0x3d0 [ 1146.295700][T23400] ? __fget_files+0x21f/0x3d0 [ 1146.295723][T23400] security_file_ioctl+0xd3/0x230 [ 1146.295753][T23400] __x64_sys_ioctl+0xb7/0x210 [ 1146.295782][T23400] do_syscall_64+0x115/0x870 [ 1146.295804][T23400] ? clear_bhb_loop+0x40/0x90 [ 1146.295828][T23400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1146.295850][T23400] RIP: 0033:0x7f630819e019 [ 1146.295866][T23400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1146.295883][T23400] RSP: 002b:00007f63090c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1146.295901][T23400] RAX: ffffffffffffffda RBX: 00007f6308425fa0 RCX: 00007f630819e019 [ 1146.295913][T23400] RDX: 0000000000000000 RSI: 00000000c0045520 RDI: 0000000000000003 [ 1146.295924][T23400] RBP: 00007f63090c1090 R08: 0000000000000000 R09: 0000000000000000 [ 1146.295934][T23400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1146.295944][T23400] R13: 00007f6308426038 R14: 00007f6308425fa0 R15: 00007ffc37918858 [ 1146.295969][T23400] [ 1146.295999][T23400] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1146.434078][T23402] VFS: file-max limit 0 reached [ 1146.445020][ T5728] usb 40-1: device descriptor read/8, error -110 [ 1147.673337][ T5728] usb usb40-port1: attempt power cycle [ 1148.196141][T23450] FAULT_INJECTION: forcing a failure. [ 1148.196141][T23450] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1148.215009][T23450] CPU: 0 UID: 0 PID: 23450 Comm: syz.3.4861 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1148.215040][T23450] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1148.215046][T23450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1148.215054][T23450] Call Trace: [ 1148.215059][T23450] [ 1148.215066][T23450] dump_stack_lvl+0x100/0x190 [ 1148.215091][T23450] should_fail_ex.cold+0x5/0xa [ 1148.215112][T23450] _copy_from_iter+0x1f4/0x1690 [ 1148.215143][T23450] ? __pfx__copy_from_iter+0x10/0x10 [ 1148.215164][T23450] ? _parse_integer_limit+0x1ac/0x220 [ 1148.215186][T23450] ? _kstrtoull+0x13c/0x1f0 [ 1148.215203][T23450] ? __pfx__kstrtoull+0x10/0x10 [ 1148.215221][T23450] tun_get_user+0x265/0x3c20 [ 1148.215244][T23450] ? __lock_acquire+0x49f/0x1a40 [ 1148.215270][T23450] ? __pfx_tun_get_user+0x10/0x10 [ 1148.215290][T23450] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1148.215323][T23450] ? find_held_lock+0x2b/0x80 [ 1148.215337][T23450] ? tun_get+0x191/0x370 [ 1148.215351][T23450] ? tun_get+0x191/0x370 [ 1148.215373][T23450] tun_chr_write_iter+0xdc/0x200 [ 1148.215393][T23450] vfs_write+0x6ac/0x1050 [ 1148.215420][T23450] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 1148.215441][T23450] ? __pfx_vfs_write+0x10/0x10 [ 1148.215464][T23450] ? find_held_lock+0x2b/0x80 [ 1148.215493][T23450] ksys_write+0x12a/0x250 [ 1148.215510][T23450] ? __pfx_ksys_write+0x10/0x10 [ 1148.215531][T23450] do_syscall_64+0x115/0x870 [ 1148.215553][T23450] ? clear_bhb_loop+0x40/0x90 [ 1148.215574][T23450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1148.215592][T23450] RIP: 0033:0x7f9d4759e019 [ 1148.215607][T23450] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1148.215623][T23450] RSP: 002b:00007f9d4851a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1148.215644][T23450] RAX: ffffffffffffffda RBX: 00007f9d47825fa0 RCX: 00007f9d4759e019 [ 1148.215655][T23450] RDX: 000000000000fdef RSI: 0000200000000240 RDI: 0000000000000003 [ 1148.215666][T23450] RBP: 00007f9d4851a090 R08: 0000000000000000 R09: 0000000000000000 [ 1148.215676][T23450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1148.215686][T23450] R13: 00007f9d47826038 R14: 00007f9d47825fa0 R15: 00007ffc1f0505a8 [ 1148.215710][T23450] [ 1148.237326][ T5728] usb usb40-port1: unable to enumerate USB device [ 1148.242699][ T5620] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1149.499928][ T5620] usb 3-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1149.511760][ T5620] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1149.524740][ T5620] usb 3-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40 [ 1149.537854][ T5620] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1149.546115][ T5620] usb 3-1: Product: syz [ 1149.550715][ T5620] usb 3-1: Manufacturer: syz [ 1149.555553][ T5620] usb 3-1: SerialNumber: syz [ 1150.200189][ T5620] usb 3-1: 0:1 : does not exist [ 1150.404271][ T5622] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 1150.653571][ T5620] usb 3-1: USB disconnect, device number 34 [ 1150.775912][T23489] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1150.778431][T21482] udevd[21482]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1150.892214][T23499] kvm: kvm [23488]: vcpu0, guest rIP: 0x58ad29489c2a7d0a Unhandled WRMSR(0x4000006d) = 0x6 [ 1150.942391][T23496] vxcan0: tx address claim with different name [ 1150.967851][T23489] trusted_key: encrypted_key: insufficient parameters specified [ 1151.240079][T23507] netlink: 83 bytes leftover after parsing attributes in process `syz.0.4876'. [ 1151.943587][ T29] kauditd_printk_skb: 64 callbacks suppressed [ 1151.943603][ T29] audit: type=1400 audit(1785810111.085:4086): avc: denied { write } for pid=23504 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1152.200265][T23530] FAULT_INJECTION: forcing a failure. [ 1152.200265][T23530] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1152.215005][ T29] audit: type=1400 audit(1785810111.345:4087): avc: denied { write } for pid=23528 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1152.249601][T23496] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1152.257635][T23530] CPU: 0 UID: 0 PID: 23530 Comm: syz.3.4880 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1152.257657][T23530] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1152.257661][T23530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1152.257668][T23530] Call Trace: [ 1152.257672][T23530] [ 1152.257676][T23530] dump_stack_lvl+0x100/0x190 [ 1152.257695][T23530] should_fail_ex.cold+0x5/0xa [ 1152.257709][T23530] _copy_from_user+0x2e/0xd0 [ 1152.257726][T23530] copy_msghdr_from_user+0x9f/0x4c0 [ 1152.257738][T23530] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1152.257756][T23530] ___sys_sendmsg+0x106/0x1e0 [ 1152.257767][T23530] ? __pfx____sys_sendmsg+0x10/0x10 [ 1152.257777][T23530] ? __lock_acquire+0x49f/0x1a40 [ 1152.257792][T23530] ? get_pid_task+0x106/0x250 [ 1152.257816][T23530] __sys_sendmsg+0x160/0x210 [ 1152.257831][T23530] ? __pfx___sys_sendmsg+0x10/0x10 [ 1152.257852][T23530] do_syscall_64+0x115/0x870 [ 1152.257865][T23530] ? clear_bhb_loop+0x40/0x90 [ 1152.257878][T23530] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.257889][T23530] RIP: 0033:0x7f9d4759e019 [ 1152.257899][T23530] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1152.257909][T23530] RSP: 002b:00007f9d4851a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1152.257921][T23530] RAX: ffffffffffffffda RBX: 00007f9d47825fa0 RCX: 00007f9d4759e019 [ 1152.257928][T23530] RDX: 0000000004008010 RSI: 00002000000001c0 RDI: 0000000000000005 [ 1152.257934][T23530] RBP: 00007f9d4851a090 R08: 0000000000000000 R09: 0000000000000000 [ 1152.257941][T23530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1152.257947][T23530] R13: 00007f9d47826038 R14: 00007f9d47825fa0 R15: 00007ffc1f0505a8 [ 1152.257960][T23530] [ 1152.259889][T23496] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 1153.012603][T23496] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1153.031408][T23496] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 1153.117679][ T5622] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 1153.256911][T23496] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1153.281709][T23496] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 1153.409815][ T29] audit: type=1400 audit(1785810112.555:4088): avc: denied { write } for pid=23538 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1153.490765][T23496] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1153.529047][T23496] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 1153.603784][T23560] 9p: Bad value for 'wfdno' [ 1153.722125][T23496] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1153.730187][ T29] audit: type=1400 audit(1785810112.855:4089): avc: denied { write } for pid=23561 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1153.759364][T23496] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 1154.294675][ T29] audit: type=1400 audit(1785810113.435:4090): avc: denied { create } for pid=23578 comm="syz.2.4892" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1154.317949][ T29] audit: type=1400 audit(1785810113.465:4091): avc: denied { write } for pid=23578 comm="syz.2.4892" path="socket:[96160]" dev="sockfs" ino=96160 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1154.612069][ T29] audit: type=1326 audit(1785810113.755:4092): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f630819e019 code=0x7ffc0000 [ 1154.691809][ T29] audit: type=1326 audit(1785810113.755:4093): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f630819e019 code=0x7ffc0000 [ 1154.786069][ T29] audit: type=1326 audit(1785810113.815:4094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f630819e019 code=0x7ffc0000 [ 1154.882394][ T29] audit: type=1326 audit(1785810113.815:4095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f630819e019 code=0x7ffc0000 [ 1155.026548][T23599] block nbd3: not configured, cannot reconfigure [ 1155.235529][ T5620] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1155.425027][ T5620] usb 3-1: Using ep0 maxpacket: 32 [ 1155.459814][ T5620] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 1155.504263][ T5620] usb 3-1: config 0 has no interface number 0 [ 1155.553501][ T5620] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1155.593006][ T5620] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1155.626955][ T5620] usb 3-1: Product: syz [ 1155.651028][ T5620] usb 3-1: Manufacturer: syz [ 1155.674068][ T5620] usb 3-1: SerialNumber: syz [ 1155.708043][ T5620] usb 3-1: config 0 descriptor?? [ 1155.755427][ T5620] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1155.820213][T23616] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4901'. [ 1156.170792][T23621] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4902'. [ 1156.181798][T23621] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4902'. [ 1156.204480][ T5620] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1156.329228][ T5620] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1156.945685][T23641] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4907'. [ 1156.952500][ T29] kauditd_printk_skb: 2559 callbacks suppressed [ 1156.952522][ T29] audit: type=1326 audit(1785810114.093:6655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f630815e84e code=0x7ffc0000 [ 1156.991797][T23641] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4907'. [ 1157.020293][ T29] audit: type=1326 audit(1785810114.093:6656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f6308197d97 code=0x7ffc0000 [ 1157.047870][ T29] audit: type=1326 audit(1785810114.093:6657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f630813f399 code=0x7ffc0000 [ 1157.077417][ T29] audit: type=1326 audit(1785810114.093:6658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f6308197d97 code=0x7ffc0000 [ 1157.151011][ T29] audit: type=1326 audit(1785810114.093:6659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f630813f399 code=0x7ffc0000 [ 1157.179150][ T29] audit: type=1326 audit(1785810114.093:6660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f6308197d97 code=0x7ffc0000 [ 1157.217967][ T29] audit: type=1326 audit(1785810114.093:6661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f630813f399 code=0x7ffc0000 [ 1157.245605][ T29] audit: type=1326 audit(1785810114.093:6662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f6308197d97 code=0x7ffc0000 [ 1157.273896][ T29] audit: type=1326 audit(1785810114.133:6663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f630813f399 code=0x7ffc0000 [ 1157.300479][ T29] audit: type=1326 audit(1785810114.133:6664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23589 comm="syz.2.4895" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f6308197d97 code=0x7ffc0000 [ 1157.968686][T23665] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1158.079762][ C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1158.090422][ T5728] usb 3-1: USB disconnect, device number 35 [ 1158.725411][ T5728] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1158.833634][ T5728] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1158.918890][ T5728] quatech2 3-1:0.51: device disconnected [ 1161.047606][T23746] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4933'. [ 1161.059616][T23746] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4933'. [ 1161.282402][T23754] FAULT_INJECTION: forcing a failure. [ 1161.282402][T23754] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1161.334234][T23754] CPU: 0 UID: 0 PID: 23754 Comm: syz.3.4934 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1161.334265][T23754] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1161.334273][T23754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1161.334283][T23754] Call Trace: [ 1161.334290][T23754] [ 1161.334297][T23754] dump_stack_lvl+0x100/0x190 [ 1161.334325][T23754] should_fail_ex.cold+0x5/0xa [ 1161.334349][T23754] _copy_from_user+0x2e/0xd0 [ 1161.334375][T23754] copy_msghdr_from_user+0x9f/0x4c0 [ 1161.334396][T23754] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1161.334426][T23754] ___sys_sendmsg+0x106/0x1e0 [ 1161.334445][T23754] ? __pfx____sys_sendmsg+0x10/0x10 [ 1161.334461][T23754] ? __lock_acquire+0x49f/0x1a40 [ 1161.334490][T23754] ? get_pid_task+0x106/0x250 [ 1161.334533][T23754] __sys_sendmsg+0x160/0x210 [ 1161.334556][T23754] ? __pfx___sys_sendmsg+0x10/0x10 [ 1161.334589][T23754] do_syscall_64+0x115/0x870 [ 1161.334611][T23754] ? clear_bhb_loop+0x40/0x90 [ 1161.334633][T23754] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1161.334651][T23754] RIP: 0033:0x7f9d4759e019 [ 1161.334665][T23754] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1161.334682][T23754] RSP: 002b:00007f9d4851a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1161.334700][T23754] RAX: ffffffffffffffda RBX: 00007f9d47825fa0 RCX: 00007f9d4759e019 [ 1161.334712][T23754] RDX: 0000000000000014 RSI: 0000200000000700 RDI: 0000000000000003 [ 1161.334723][T23754] RBP: 00007f9d4851a090 R08: 0000000000000000 R09: 0000000000000000 [ 1161.334733][T23754] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1161.334744][T23754] R13: 00007f9d47826038 R14: 00007f9d47825fa0 R15: 00007ffc1f0505a8 [ 1161.334768][T23754] [ 1161.769333][T23762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1161.787026][T23762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1162.137105][T23779] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1162.161650][T23779] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1165.059931][ T29] kauditd_printk_skb: 549 callbacks suppressed [ 1165.059956][ T29] audit: type=1326 audit(1785810121.138:7214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23816 comm="syz.0.4951" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb53fb9e019 code=0x7ffc0000 [ 1165.451701][ T29] audit: type=1326 audit(1785810121.138:7215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23816 comm="syz.0.4951" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb53fb9e019 code=0x7ffc0000 [ 1165.535051][ T29] audit: type=1326 audit(1785810121.138:7216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23816 comm="syz.0.4951" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb53fb9e019 code=0x7ffc0000 [ 1165.563024][ T29] audit: type=1326 audit(1785810121.138:7217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23816 comm="syz.0.4951" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb53fb9e019 code=0x7ffc0000 [ 1165.591986][ T29] audit: type=1326 audit(1785810121.148:7218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23816 comm="syz.0.4951" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fb53fb9e019 code=0x7ffc0000 [ 1165.938032][T23839] gadgetfs: bound to dummy_udc driver [ 1166.175636][ T5728] usb 2-1: new full-speed USB device number 41 using dummy_hcd [ 1166.184679][ C1] gadgetfs: connected [ 1166.190666][ T5728] gadgetfs: disconnected [ 1166.465550][ C1] gadgetfs: connected [ 1166.477349][ T5728] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1166.487891][ T5728] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 1166.497911][ T5728] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1166.512493][ C1] gadgetfs: configuration #1 [ 1166.713562][T23835] gadgetfs: suspended from state 3 [ 1166.713714][ T5728] usb 2-1: can't set config #1, error -71 [ 1166.719273][T23835] gadgetfs: disconnected [ 1166.747738][ T5728] usb 2-1: USB disconnect, device number 41 [ 1167.127205][ T29] audit: type=1400 audit(1785810123.278:7219): avc: denied { read } for pid=23865 comm="syz.3.4967" name="mtd0" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 1167.413957][T23870] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4969'. [ 1167.425833][T23870] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4969'. [ 1167.445444][T15485] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 1167.521731][T23875] block nbd0: not configured, cannot reconfigure [ 1167.617314][T15485] usb 4-1: Using ep0 maxpacket: 32 [ 1167.627780][T15485] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1167.640239][T15485] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1167.649597][T15485] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1167.659949][T15485] usb 4-1: Product: syz [ 1167.675441][T15485] usb 4-1: Manufacturer: syz [ 1167.680889][T15485] usb 4-1: SerialNumber: syz [ 1167.705434][T15485] usb 4-1: config 0 descriptor?? [ 1167.728929][T23866] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1167.744551][T15485] hub 4-1:0.0: bad descriptor, ignoring hub [ 1167.766267][T15485] hub 4-1:0.0: probe with driver hub failed with error -5 [ 1167.961255][ T29] audit: type=1400 audit(1785810123.105:7220): avc: denied { checkpoint_restore } for pid=23865 comm="syz.3.4967" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1168.155083][T15485] usb 4-1: USB disconnect, device number 34 [ 1168.654134][T23906] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4979'. [ 1169.826015][T23916] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1170.002802][T23926] block nbd2: not configured, cannot reconfigure [ 1170.414181][T23943] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4990'. [ 1170.426208][T23943] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4990'. [ 1170.647848][T23951] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4994'. [ 1170.724922][ T5620] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 1170.885254][ T5620] usb 3-1: Using ep0 maxpacket: 32 [ 1171.035139][ T5620] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1171.079643][ T5620] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1171.098653][ T5620] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1171.197316][ T5620] usb 3-1: Product: syz [ 1171.203297][ T5620] usb 3-1: Manufacturer: syz [ 1171.210440][ T5620] usb 3-1: SerialNumber: syz [ 1171.231556][ T5620] usb 3-1: config 0 descriptor?? [ 1171.247622][T23949] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1171.266550][ T5620] hub 3-1:0.0: bad descriptor, ignoring hub [ 1171.291311][ T5620] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1171.411210][T23974] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5003'. [ 1171.436543][T23974] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5003'. [ 1171.673975][T15485] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 1171.785124][T10092] usb 3-1: USB disconnect, device number 36 [ 1171.797063][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1171.804976][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1171.841494][T23987] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1171.876040][T23985] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5007'. [ 1171.885767][T23990] kvm: kvm [23986]: vcpu0, guest rIP: 0x58ad29489c2a7d0a Unhandled WRMSR(0x4000006d) = 0x6 [ 1171.925161][T15485] usb 4-1: Using ep0 maxpacket: 16 [ 1171.938773][T15485] usb 4-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 1171.948925][T15485] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1171.957356][T15485] usb 4-1: Product: syz [ 1171.961546][T15485] usb 4-1: Manufacturer: syz [ 1172.042576][T15485] usb 4-1: SerialNumber: syz [ 1172.049382][T15485] usb 4-1: config 0 descriptor?? [ 1172.068624][T15485] usb 4-1: selecting invalid altsetting 1 [ 1172.074541][T15485] technisat-usb2: could not set alternate setting to 0 [ 1172.237777][T23999] smpboot: CPU 1 is now offline [ 1172.335331][T24010] netlink: 'syz.2.5016': attribute type 10 has an invalid length. [ 1172.854035][T15485] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in cold state, will try to load a firmware [ 1174.195931][T15485] usb 4-1: Direct firmware load for dvb-usb-SkyStar_USB_HD_FW_v17_63.HEX.fw failed with error -2 [ 1175.189461][T15485] usb 4-1: Falling back to sysfs fallback for: dvb-usb-SkyStar_USB_HD_FW_v17_63.HEX.fw [ 1175.641420][T24003] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 1175.673309][ T0] Disabled fast string operations [ 1175.678398][ T0] ------------[ cut here ]------------ [ 1175.683858][ T0] alternatives_patched [ 1175.683871][ T0] WARNING: arch/x86/kernel/cpu/cpuid-deps.c:127 at do_clear_cpu_cap+0x356/0x440, CPU#1: swapper/1/0 [ 1175.698700][ T0] Modules linked in: [ 1175.702611][ T0] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1175.713129][ T0] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1175.719281][ T0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1175.729345][ T0] RIP: 0010:do_clear_cpu_cap+0x356/0x440 [ 1175.735003][ T0] Code: 2a 38 d0 7c 08 84 d2 0f 85 ea 00 00 00 8b 2d d1 db 71 0f 31 ff 89 ee e8 88 c9 59 00 85 ed 0f 84 7d fd ff ff e8 0b cf 59 00 90 <0f> 0b 90 e9 6f fd ff ff 48 89 54 24 18 89 14 24 e8 f5 ce 59 00 8b [ 1175.754732][ T0] RSP: 0000:ffffc90000197c98 EFLAGS: 00010093 [ 1175.760809][ T0] RAX: 0000000000000000 RBX: 0000000000000070 RCX: ffffffff81b095c8 [ 1175.768788][ T0] RDX: ffff88801eac2540 RSI: ffffffff81b095d5 RDI: ffff88801eac2540 [ 1175.776773][ T0] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 1175.784762][ T0] R10: 0000000000000001 R11: 000000000000a2b0 R12: 0000000000000070 [ 1175.792751][ T0] R13: 0000000000000601 R14: ffffc90000197ce0 R15: ffffc90000197d80 [ 1175.800745][ T0] FS: 0000000000000000(0000) GS:ffff888123ed8000(0000) knlGS:0000000000000000 [ 1175.809694][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1175.816295][ T0] CR2: 0000000000000000 CR3: 000000000e994000 CR4: 00000000003506b0 [ 1175.824324][ T0] Call Trace: [ 1175.827612][ T0] [ 1175.829651][T24021] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5020'. [ 1175.830549][ T0] ? __pfx_do_clear_cpu_cap+0x10/0x10 [ 1175.839767][T24021] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5020'. [ 1175.844846][ T0] ? _printk+0xcf/0x110 [ 1175.844879][ T0] ? __pfx_cpu_parse_topology+0x10/0x10 [ 1175.844898][ T0] ? early_init_intel.cold+0x129/0x1eb [ 1175.844926][ T0] early_init_intel.cold+0x13f/0x1eb [ 1175.844956][ T0] init_intel+0x1c/0x7b0 [ 1175.869299][T24022] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5019'. [ 1175.874272][ T0] identify_cpu+0x8b0/0x1c30 [ 1175.874307][ T0] ? __pfx_cpu_init+0x10/0x10 [ 1175.882580][T24022] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5019'. [ 1175.887358][ T0] identify_secondary_cpu+0x178/0x270 [ 1175.887390][ T0] start_secondary+0xcf/0x2d0 [ 1175.887412][ T0] ? __pfx_start_secondary+0x10/0x10 [ 1175.887438][ T0] common_startup_64+0x13e/0x158 [ 1175.925858][ T0] [ 1175.928885][ T0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1175.936185][ T0] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G S L syzkaller #0 PREEMPT(full) [ 1175.946670][ T0] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1175.952804][ T0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1175.962859][ T0] Call Trace: [ 1175.966133][ T0] [ 1175.969058][ T0] dump_stack_lvl+0x100/0x190 [ 1175.973724][ T0] vpanic+0x552/0x970 [ 1175.977689][ T0] ? __pfx_vpanic+0x10/0x10 [ 1175.982180][ T0] panic+0xd1/0xe0 [ 1175.985884][ T0] ? __pfx_panic+0x10/0x10 [ 1175.990284][ T0] ? check_panic_on_warn+0x1f/0x90 [ 1175.995380][ T0] check_panic_on_warn.cold+0x19/0x34 [ 1176.000737][ T0] ? do_clear_cpu_cap+0x356/0x440 [ 1176.005766][ T0] __warn.cold+0x191/0x318 [ 1176.010186][ T0] __report_bug+0x30f/0x440 [ 1176.014675][ T0] ? do_clear_cpu_cap+0x356/0x440 [ 1176.019698][ T0] ? __pfx___report_bug+0x10/0x10 [ 1176.024726][ T0] ? prb_read_valid+0x78/0xa0 [ 1176.029391][ T0] ? __pfx_prb_read_valid+0x10/0x10 [ 1176.034576][ T0] ? tick_nohz_tick_stopped+0x6c/0xa0 [ 1176.039956][ T0] ? do_clear_cpu_cap+0x356/0x440 [ 1176.045000][ T0] report_bug+0xb2/0x220 [ 1176.049256][ T0] ? do_clear_cpu_cap+0x356/0x440 [ 1176.054280][ T0] handle_bug+0x16a/0x2a0 [ 1176.058609][ T0] exc_invalid_op+0x17/0x50 [ 1176.063123][ T0] asm_exc_invalid_op+0x1a/0x20 [ 1176.067961][ T0] RIP: 0010:do_clear_cpu_cap+0x356/0x440 [ 1176.073597][ T0] Code: 2a 38 d0 7c 08 84 d2 0f 85 ea 00 00 00 8b 2d d1 db 71 0f 31 ff 89 ee e8 88 c9 59 00 85 ed 0f 84 7d fd ff ff e8 0b cf 59 00 90 <0f> 0b 90 e9 6f fd ff ff 48 89 54 24 18 89 14 24 e8 f5 ce 59 00 8b [ 1176.093194][ T0] RSP: 0000:ffffc90000197c98 EFLAGS: 00010093 [ 1176.099284][ T0] RAX: 0000000000000000 RBX: 0000000000000070 RCX: ffffffff81b095c8 [ 1176.107242][ T0] RDX: ffff88801eac2540 RSI: ffffffff81b095d5 RDI: ffff88801eac2540 [ 1176.115205][ T0] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 1176.123192][ T0] R10: 0000000000000001 R11: 000000000000a2b0 R12: 0000000000000070 [ 1176.131172][ T0] R13: 0000000000000601 R14: ffffc90000197ce0 R15: ffffc90000197d80 [ 1176.139153][ T0] ? do_clear_cpu_cap+0x348/0x440 [ 1176.144180][ T0] ? do_clear_cpu_cap+0x355/0x440 [ 1176.149216][ T0] ? do_clear_cpu_cap+0x355/0x440 [ 1176.154262][ T0] ? __pfx_do_clear_cpu_cap+0x10/0x10 [ 1176.159627][ T0] ? _printk+0xcf/0x110 [ 1176.163775][ T0] ? __pfx_cpu_parse_topology+0x10/0x10 [ 1176.169327][ T0] ? early_init_intel.cold+0x129/0x1eb [ 1176.174794][ T0] early_init_intel.cold+0x13f/0x1eb [ 1176.180096][ T0] init_intel+0x1c/0x7b0 [ 1176.184342][ T0] identify_cpu+0x8b0/0x1c30 [ 1176.188924][ T0] ? __pfx_cpu_init+0x10/0x10 [ 1176.193605][ T0] identify_secondary_cpu+0x178/0x270 [ 1176.198990][ T0] start_secondary+0xcf/0x2d0 [ 1176.203661][ T0] ? __pfx_start_secondary+0x10/0x10 [ 1176.208949][ T0] common_startup_64+0x13e/0x158 [ 1176.213889][ T0] [ 1177.287003][ T0] Shutting down cpus with NMI [ 1177.291946][ T0] Kernel Offset: disabled [ 1177.296260][ T0] Rebooting in 86400 seconds..