last executing test programs: 23.914136423s ago: executing program 1 (id=52): timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x1, 0x6, 0x4}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$vim2m(0x0, 0x3, 0x2) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x4048804) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40050}, 0x8084) r4 = socket$alg(0x26, 0x5, 0x0) r5 = accept$alg(r4, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) recvmmsg(r5, &(0x7f0000006100), 0x49f, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000000580)=[{{&(0x7f0000004440)={0xa, 0x4e22, 0xfffffffc, @private1, 0x20000}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000800)='P', 0x1}], 0x1}}, {{&(0x7f0000000200)={0xa, 0x4e21, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000540)=[{&(0x7f0000000b40)}], 0x1}}], 0x2, 0x814) getdents(0xffffffffffffffff, &(0x7f0000000380)=""/200, 0x1d) ioctl$VIDIOC_QUERYBUF_DMABUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000480)={0x2, 0x5, 0x4, 0x40, 0x9, {0x77359400}, {0x1, 0x8, 0x57, 0x3, 0x2, 0x9, "18d3a00f"}, 0x6e876759, 0x4, {}, 0x3}) 22.738987059s ago: executing program 1 (id=55): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x38, r1, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x2}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x38}}, 0x0) (fail_nth: 2) 22.136273927s ago: executing program 1 (id=59): syz_emit_ethernet(0x16, &(0x7f0000000180)={@local, @link_local, @void, {@llc={0x4, {@snap={0xaa, 0x0, "13", "7ddc03"}}}}}, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x16b601, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = userfaultfd(0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) 20.945569208s ago: executing program 1 (id=63): r0 = syz_open_dev$usbfs(0x0, 0x70, 0x20002) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs={0x1, 0x0, 0x4e22}, 0x6e) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x8020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xf, 0x89, 0x40000, {r5}}, 0x20) sched_setattr(r4, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$video4linux(&(0x7f0000000080), 0x100000008, 0x0) r6 = socket$inet(0x2, 0x2, 0x7) setsockopt$inet_opts(r6, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) getsockopt$inet_opts(r6, 0x0, 0x4, 0xfffffffffffffffe, &(0x7f0000000200)) socket(0x2, 0x80805, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@bloom_filter={0x1e, 0x1, 0x7, 0x3, 0xc080, r3, 0x2, '\x00', 0x0, r1, 0x1, 0x3, 0x1, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xc, 0x14, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000012008500000015000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000003000000850000000600000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 20.156522207s ago: executing program 1 (id=64): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x61, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010002"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0xc0a2) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) r6 = accept$inet6(r2, &(0x7f00000004c0), &(0x7f0000000500)=0x1c) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000940)={{0x1, 0x1, 0x18, r6, {0x5}}, './file0\x00'}) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="4b00000a000000ddff00d82800"/25, @ANYRES32=0x1, @ANYBLOB="47b100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000000000000200"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x1f, 0x17, &(0x7f0000000c00)=ANY=[@ANYBLOB="180000000700080000000000334108000000985400000200000000000000000000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ff00008500000006000000181100000000000400000000000000000000000080c7985ce74cc676fc9d79d6f3611d065e434bb14b14bba895ef9f45a5dd881c3aa9bf5c4704a5240901e2bd58f7e3b32f4e923bf513b0796746109bd14a81bde57f54", @ANYRES32, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000dd3a5000f0ffffff9500000000000000"], &(0x7f00000007c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41100, 0x16, '\x00', r4, @fallback=0xb, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x0, 0x1, 0x2, 0x9}, 0x10, 0x0, 0xffffffffffffffff, 0x2, &(0x7f0000000a00)=[0xffffffffffffffff, r7, r8], &(0x7f0000000a40)=[{0x0, 0x1, 0xf, 0x8}, {0x1, 0x4, 0xc, 0x9}], 0x10, 0x7}, 0x94) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001640)={0x1b, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5}, 0x50) r10 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r10, @ANYBLOB="05"], 0x0) epoll_pwait(r10, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001740)={0x6, 0x12, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffff2}, [@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffff}, @call={0x85, 0x0, 0x0, 0x2f}, @ldst={0x2, 0x3, 0x4, 0x0, 0x0, 0x10, 0x4}, @map_idx_val={0x18, 0x8, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x100}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xec0}}]}, &(0x7f0000000380)='syzkaller\x00', 0x1, 0x1000, &(0x7f00000005c0)=""/4096, 0x41000, 0xc, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000480)={0x1, 0x6, 0x7}, 0x10, 0x0, 0x0, 0x4, &(0x7f00000016c0)=[r1, 0xffffffffffffffff, 0xffffffffffffffff, r8, r9, r10], &(0x7f0000001700)=[{0x4, 0x2, 0x10, 0x3}, {0x4, 0x4, 0xc, 0x7}, {0x0, 0x3, 0x9, 0x2}, {0x3, 0x2, 0xb, 0xc}], 0x10, 0xe0}, 0x94) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r11, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x2c, 0x7, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4001}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20044810}, 0x4004014) 19.922741399s ago: executing program 1 (id=66): timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x1, 0x6, 0x4}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$vim2m(0x0, 0x3, 0x2) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x4048804) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40050}, 0x8084) r4 = socket$alg(0x26, 0x5, 0x0) r5 = accept$alg(r4, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) recvmmsg(r5, &(0x7f0000006100), 0x49f, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000000580)=[{{&(0x7f0000004440)={0xa, 0x4e22, 0xfffffffc, @private1, 0x20000}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000800)='P', 0x1}], 0x1}}, {{&(0x7f0000000200)={0xa, 0x4e21, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000540)=[{&(0x7f0000000b40)}], 0x1}}], 0x2, 0x814) getdents(0xffffffffffffffff, &(0x7f0000000380)=""/200, 0x1d) ioctl$VIDIOC_QUERYBUF_DMABUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000480)={0x2, 0x5, 0x4, 0x40, 0x9, {0x77359400}, {0x1, 0x8, 0x57, 0x3, 0x2, 0x9, "18d3a00f"}, 0x6e876759, 0x4, {}, 0x3}) 9.069115815s ago: executing program 3 (id=98): sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x24}}, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000240)={[&(0x7f00000000c0)='=\x8d5\x10\xe4\x00\bj\xfb']}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wg2\x00'}) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) preadv(r4, &(0x7f0000001b00)=[{&(0x7f00000009c0)=""/239, 0xef}], 0x1, 0x2, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="4000000066001fff0000000000000000"], 0x40}}, 0x4000800) syz_usb_connect(0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000001b40)={0x2020}, 0x2020) ioctl$BTRFS_IOC_ADD_DEV(r3, 0xff08, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000001800ffffffff7bfbfcdbdf250a148000ff01fd07"], 0x1c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@dellink={0x20, 0x11, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, 0x1480, 0x2104}}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x28, r12, 0x1, 0x0, 0x10, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x28}}, 0x0) ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) 7.951814829s ago: executing program 2 (id=102): r0 = socket$kcm(0x2b, 0x1, 0x0) shutdown(r0, 0x1) (fail_nth: 1) 7.802595491s ago: executing program 2 (id=103): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYRESDEC=0x0, @ANYRESOCT=0x0], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xd2, &(0x7f0000000240)=""/210, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x800}, 0x94) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0xca) getsockopt$ax25_int(r1, 0x101, 0x9, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af25, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) socketpair$unix(0x1, 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a1121710950b2a17f4f7010203010902240001000000000904fb00026c5d650009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_usb_control_io$lan78xx(r3, &(0x7f0000000000)={0x14, &(0x7f0000000100)={0x0, 0xf, 0x2, {0x2, 0x1}}, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}}, &(0x7f0000000440)={0x34, &(0x7f0000000280)={0x20, 0x1, 0x18, "30e207f50a18d4daee41e4fab2ef073a373514de69e09663"}, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x40, 0xa0, 0x4, 0x10}, 0x0}) syz_usb_control_io$uac1(r3, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x2, {0x2, 0x3}}, 0x0}, &(0x7f0000000740)={0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="400f030000005249f784333b67c700ce988e624eda75d4d44a6efd6fa871320624cc2c78f58ee5c110ad9a868c324bb3a87cb362f4cbf159618134ce0a67fb926cefb469cf6d835b9567b001b0d2dfb76cce8393b96ca93019a3c36a930f1b1a6094711eee7862f4f752182b53126a424b41b6ad12db7e7795be80a9666b29ebad1a0bcd5ff9da06b47eeefbe384c365f9d64af9231289791c127ad0bc67082e3774df0b7d3848d42c9f066a8936d92bfd72b1ea198b1733f21945e71778688d4981dbfe820cd77616d9075330609c871d0ce09166d329abfa42428cfac231391117217e84bb71eaaabddda4b1fb41f1d20400329d1dfaf84e10edf13e7a03cb4cf74ec8f63970ae58a8c938c3ac7dff007768360cd31e15"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r2, 0x8982, &(0x7f0000000080)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000009c0)=ANY=[]) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000640)=ANY=[@ANYBLOB="1806000000000087abb8a42ae46ab500000000000000000018120000", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7070000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f00000001c0)={0x60, 0x3, &(0x7f00003b7000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x24}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f00000001c0)={0x48, 0x4}) 6.461082855s ago: executing program 0 (id=104): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/uevent_helper', 0x882, 0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0xe, 0x43, 0x3, 0x41, r1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140), &(0x7f0000000540), 0x1003, r2}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000380)={r2, &(0x7f0000000300), 0x0}, 0x20) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x6}, 0x1c) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c01000016000100fcfffffffc0100"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000100ffffffffffffffff00000000000000000000000000000000e58d0000000000000000000000000210000000000000000008000000ffffffff240009"], 0x11c}}, 0x0) listen(r0, 0x3) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_LINK_CREATE(0x15, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7ff}}, 0x40) sendmsg$IEEE802154_ASSOCIATE_REQ(r4, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000980)={0x38, 0x0, 0x8dfa8172db80e591, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x14}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x6}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x200440d0}, 0x40000) r5 = syz_genetlink_get_family_id$gtp(&(0x7f00000001c0), r1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000240)={'vxcan0\x00', 0x0}) sendmsg$GTP_CMD_ECHOREQ(r1, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x5c, r5, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_MS_ADDR6={0x14, 0xc, @mcast2}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_LINK={0x8, 0x1, r6}, @GTPA_PEER_ADDR6={0x14, 0xb, @private1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20040054}, 0x8000) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x3c, &(0x7f0000000000)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@llc={0x4, {@llc={0x4, 0xff, "3088", "3de1c51a27c89c65d5bcb3240c049a8ca76c84654301987cf7a82896dc9d96399c7e436e2098855f1567"}}}}}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000180)=ANY=[], 0x0) 6.329235937s ago: executing program 0 (id=105): r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) (async) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x9}) (async) ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r1, 0x5501) (async) r2 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000500)={0x50, 0x26, 0x19, {0x2, 0xcac}, {0x8000, 0x7}, @ramp={0x400, 0x7, {0x8, 0x6, 0xeb4d, 0xfff3}}}) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x64}}, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updsa={0xf0, 0x1a, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x4, 0x0, 0x0, 0xa0}, {@in=@empty, 0x0, 0x3c}, @in=@loopback, {}, {0x0, 0x0, 0x5}, {0x0, 0x9}, 0x0, 0x3504, 0xa}}, 0xf0}}, 0x0) (async) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0xa8) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r4, 0xc02064b9, &(0x7f0000000280)={&(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000280), 0x2, r5}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000400)={{0x0, 0x3}}) syz_open_procfs(0x0, &(0x7f00000002c0)='cmdline\x00') (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) (async) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)={0x34, 0xd, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4800}, 0x48000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r10, &(0x7f0000000000), 0x651, 0x0) (rerun: 64) 6.30115182s ago: executing program 4 (id=106): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdir(&(0x7f0000000040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc0) r0 = socket(0x3, 0x2, 0x5) ioctl$IMGETCOUNT(r0, 0x80044943, &(0x7f0000000000)) r1 = syz_open_dev$sndpcmp(&(0x7f0000001040), 0x101, 0xa000) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) r5 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f0000000240)=r5) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000040)={0x1, r5}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000001180)={0x4, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}, {0x8008000, 0x1000, &(0x7f0000001600)=""/4096}, {0xffff1000, 0x43, &(0x7f00000010c0)=""/67}, {0x0, 0x23, &(0x7f0000001140)=""/35}]}) ioctl$VHOST_SET_VRING_ERR(r4, 0x4008af22, &(0x7f00000002c0)={0x1, r5}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x1) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000f}, 0x94) r7 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r8 = socket$inet(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f000000b280)=[{{&(0x7f0000004800)=@file={0x1, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e, &(0x7f00000059c0), 0x0, &(0x7f0000006b40)=ANY=[@ANYBLOB="1c0000000000", @ANYRES32=r7, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000280000000000000001000000010000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="14000000000000000100000001000000", @ANYBLOB="000000001c00000000000000010000000200", @ANYRES32=r7, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c00000000000000010000000200", @ANYRES32=r7, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=r7, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=r6, @ANYRES32=r6, @ANYRES32, @ANYBLOB="000000001c000000000000", @ANYRES32=r7, @ANYRES32=0x0, @ANYBLOB="00000000141b72df3cbf00000100000001000000"], 0x120, 0x44000}}, {{0x0, 0x0, &(0x7f0000006fc0)=[{&(0x7f0000006c80)}, {&(0x7f0000006d00)="d375fefa549c98378528be1b1f1edcf39d106ff289ef695d4b97a1ff915516c221e764606f5eac50584c1d610e8bf6059f3e7af3e6bad1ff52cdbb9d581476bfc3cb97b6c386f864260c2580b39468452b6c24c6cebca6b1dd602702ab3fbedf1ee054c0e1e6efcac3e61c7609c9fc530708e933696ba49d7ced82c586098447be0dff1262d8f76bb71131e81c0be8088a199de1f30ab641e0578da64fb1276e037206a76303266f3998093941806d583ae5937a904d07ad02a13ec469", 0xbd}, {&(0x7f0000006e00)}, {&(0x7f0000001500)="c6e1d48e3d50c44dac9bf731e0005eed155d4214ac4c33ff1c64208b1ef0b267aba9ae346af33703d67ead17d1e6004b7d82ac1838b146660b28c3d395b77f87cb67d2c05a4eeda17c2ea982", 0x4c}, {&(0x7f0000006f80)="eaddb7c75cf95cca2790331ce1a0bde0fb1a895eb04d2b4da0", 0x19}], 0x5, 0x0, 0x0, 0x20000080}}, {{0x0, 0x0, &(0x7f00000074c0)=[{&(0x7f0000007340)="c1e3617709f864d8e62ff44eff79c7d76ea4cc36917a7c3db5126b6709dbfbff1afc2d1cbdb34a000ed6b06bc571d4bb0610b3619a82114e101bc981", 0x3c}, {0x0}], 0x2, &(0x7f00000077c0)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, r0]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {r7}}}, @cred={{0x1c}}, @rights={{0x10}}, @cred={{0x1c}}], 0xa8, 0x20000000}}, {{&(0x7f0000007900)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000007bc0)=[{&(0x7f0000007980)="dc1057bf79f825a04446ce588c3a5c9483922a57e2689fe0daebd5e2739ed8c35b1ed646083bcc9b79821f552fbf75ae6fc6666246bfb6984c4b734949a5b04872a4941fc9087d21d0", 0x49}, {&(0x7f0000007a00)="ce335b9d181d6bd49f11737a4ac132b9e29db34a2a06f72ba2f22ab20541982dfbf249be6c6e495378fc3f32498a53fbe32cd9a45d3f6345e3ae39794aeb461a02007676df773b1adbd1e233b1745c401b121abcc3f2f8820b7d614f189a49718ea58f8d8221ecbd1d99a59b404578d4ecdc804f43c79b59ae1ce52813bb12febd0b2fe3a62d9cb41145e2573f34a0f04a003060fa74fed8eeec92053341091ae3c4af74e8b547d2eb2bd3b9610b28", 0xaf}, {&(0x7f0000007ac0)="ba501331d608511c6f201019b0047bc8015d8e13dcaeb7c4fabf943bc03beed09b18660406c11e224c113f530f58d149dcf47fa884172359255e169db58cbba521e109de7f273b2329780eb52533e555ebed71f45530afb8a6e5c06711820c41ddb12b1efd008308e2bc5ebde7f7c90c730cdd011df426696d31a554a2de72", 0x7f}, {&(0x7f0000007b40)="c6cb2a886268422652a8991840ece1a18a", 0x11}, {&(0x7f0000007b80)="8cb7a0581f6a37c359", 0x9}], 0x5, &(0x7f0000008d80)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r3, r0]}}, @rights={{0x14, 0x1, 0x1, [r1]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r7}}}, @rights={{0x10}}], 0xc8, 0x4090}}, {{0x0, 0x0, &(0x7f0000008f80)=[{&(0x7f0000008e80)}, {&(0x7f0000008ec0)="86c1b9a944f0d597cb804673e8daea21d85776b412eca69f887f1d58813c2b9341a8d71ed32b79e78280a07e3e020d1442fcc61edf81485417f875354e4b02f3b521fb02fa02e57802a5c142f9cdb8ac720f94efd0fb8ce592a548efbe9a05c560dc047fc0358f9a0599052fec717a8dfe7b30e1", 0x74}], 0x2, &(0x7f00000090c0), 0x0, 0x24024800}}, {{&(0x7f0000009180)=@file={0x1, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e, &(0x7f0000009440)=[{&(0x7f0000009200)}, {&(0x7f0000009280)="f85916", 0x3}, {&(0x7f00000092c0)}, {&(0x7f0000009380)="5d88a7fc3d7e03b264d28e4e95725d94a17b12fe0cf9ef30841dfe48", 0x1c}, {&(0x7f0000003700)=':\a$', 0x3}, {&(0x7f0000009400)="4abcc49cbf51cfdc5df0dd3cfd332122e864c0126d840d363a5c5d590bf81d67aa9f0b9316f879de1d", 0x29}], 0x6, &(0x7f0000009640)=[@rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, r0]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, r0]}}], 0xf8, 0x10}}, {{0x0, 0x0, &(0x7f000000a7c0)=[{&(0x7f0000009780)="9da288118be6d42c92f316678078761c10a56b7fe88c74", 0x17}, {&(0x7f00000097c0)="015855ff4055f0e0cd73b9727ce8ec3182210ead0375efe7a9690779a62baecae8c0d604f0d13836f0f0369b9524187e2f9936acce9992747b4f970e1406e72b4c30897f157ae5dcd7d1a07480db73e1ee79b1193901456fc1f62a1a31efb2d518286e294bb36a9a43313fd425d60b33d821fc678ea022c7e02b834f926e0ee79f231dfc8157743659cfb7048bc38e22c5ffd19920fdcf6b4bd0eeaefb7c5c2ba938b48a1ba6c3965da0c83e6f567044c25491521e9ddc0ade522f676d3442be0fb71f4561db7ccaf3ed6f1a4688bfd893f6101a2a9f8f495d4cfbf066500133870b6d5d6472894d9e71f61dc96625796b9999a999bf54e6eed9e30c46212439712947276fbd0fdd75887d9286233a1f5d00539943757d433b936c662400afb8264c00268786b7fd81a5d1998907b9999d5d36949930b07310b2c8f604aa23abe11b6a7bf8fdd3ffccc7eda6f265c34e72c4b0ac0fb9f6b3667805287f36ebf0ccbe1ca639b8bfedf5b23405553153d2d51e2b1e559c91bcd2e18ed801d33fdbba5ce1d0ea6e591f5b461b3931d762b37fcf661553a1cd6c2f2cb7e5b316d79e4c837d27bff553c0cf8edcd7ce1b1701490a6c8ccc275cf15082dfb8785595fa51191e2003517084cc4d2c73457d0e06b5d300f0c07438df140d65a3cd06a88aa6c9e9dd3496d48485089ba976b303fb4885001650ef4241797f9c347b7c784aa4cc20a689ee307381300bddfbb2db0a87f165469174fe3204ce16b19759719e1950bea3168faec26b55b111104d005e5399cd277c8f35140c0e5008b998156200d29474ab37d238859c989c23969e39136294e09708a23e7fb553617811c0c5a6c8c4f002ff99c4271fea81116b686d12da6c201c28a06957fd2cdb3104fb3c92ac221bf08dd282ac097c24fc19516f74f009af6a7de3d56ff25530401902aee4094f7b90397da53dd0a137c026f8c618fd9cb628046515b6f9a80ec780f12f29b734b84036c2a0238f56048e84886e1c4e80adc1261851b04f9dbfe15364ae2ad2d0824735aa91aecc11f1665c296e8a77630ada03021f5474b69625d2dfad33fd0f1bbd13859fe241be0c8bebc13a9f361e3e4465f80ec6b09778123e70ebc1a636c6220d3ef22073e85d3a573104952a6ae843a5d80c0f6646176212818869c0f6329905dcd485022c196fdf1181fb997b2e34001dc01169a9dfbe48d00f625a89039ea7e618c6fd48da85b2311dc6fa6208658043d45893850f81c0248eba1201f3a7d326210e2996b6e3ea9d9899c840bc4ba001e33474ff80cf20c5338bde6c01ac3d7daf9c5c9947950467757395b55e3487ede31e43f8206dab17c58534a3d56fe7f25ac8ebfefe3f1b52c74d54d68954d1f39481b16857d7ce5f43cafd1e6b1c1a457497cc89cf964407e47d90e8232315a2dabe66b1c5073dfa75f2079e22002ec4d1ad314c84b23cd328b79f8adc431a05d521c1fa376121e61353be57218fb4eac55cf224dcf6214425bec296f73b5bec53ff8616b664e3e1d7ce7f089f7f17295e14aa10bdcb660dca0e6ad74721db4756532236a796e72ab64d1b40051d64749ff11d46a4919a525700c8a01b779cdaeae6ddaedf34f6514b6e849e78971443af2a09a4965d821e7727883a7d83dce732305e32504ef94d9d6b2e3debf31ed88780cd1123176d59d8951fbf030a4f7bfc65f0bd115955ca0e3e3786b85ece4b140208c40a8cd519299ff155c0fe0f514a58f4c72f023a57e5746f70c6172753a09dfdd66571293ed334d3ac88e9ffefb567edfcc9e898f3ecedcc0b795da0bbdfaa5f9e72ec000412728fbec72665437bca563f1305a46bfddfeb58ca1305ba296578c689bbea8f0261d46c1848a8059a14fab106305bcf6ef88f45de2de6ec9b1f11777d128d516c4f3189e3a281377ed2cb41358faa1340c71e85955aa67b2997122fc2935722caed6c5a846b16733a50899559e3028514fe378fc328b68ffa5ecf3ae93666fbe776d96ce11e70205216712107a9de0b88381dbad3825fb06d345c78a1305f7b4837e65c71eb11deeaf029adcf6ce87dbc321f235dabf16742f9adca43c38a739009a03fec38a1a2a3a8881846cab064d43ca1e4fc9324315f73eeabab1a9fd3f0aeb42cbc66190b88159d7ea585375dc9b2a0d459c666af8b11003592ce500e6682a32b40004b84d923a3800b1d03c5894716642eaf19c00c67c9557f2e586cb952b575ad9c069a3cdbced09e581a2d59ff804088328e1d9d669ec9484a383f4dffe1b269f4cfc0ab01d1d67fbb0c024374ee538a116752e5b01e50f37263d2cbe052fac8af607c9ceb924990e37a6a7688448eea3955dbd02d74668c7a272844d7952fca1e15098f8174859ecc183ec9667e78ebf948ce34fc262eec6db6a81af30f64dcafcab6038f6b040e895a16c96477ec79d560b0d00737cd3f6abf407e84d33a9afa85db4e1fa88dff3915d6e115a719d7007b51cdad4d1f75c9e9288b5c761e67d87b5661bda53ff9a4673d3e1eeba01fda3fa08b5626c19612de0ff2e872a4dfa84163147bcf128ee8985f4c9e085b890e4b5f87e2e7ad0ce1372c657a9cd6633e006318012ef957ba863de029c27c8dd4f0a73839b13342c796ee612dac0929872243848b6368b2e13d252d190b5a100ab0af6b0b9f43c27fbf1f75d233b57aef55e21d3cef325598de61b2b6391c0ece6a89e215b11b047b727ccc4af45cd6923ff0f0cade7a97e74a9621d31d745db00bb029a0f8f2972c1d848dfaf0611b6d31c6a0ff3d5cbe9780f7703878a5bf832bf34d16be2d9865ab240335befc578f499a00599d90b141efd43eb5139662518980391d5a92c36535fc4cbb8289374720cd673fce54c853d57260a9174aa1c788e88bbe36476f591fb074257b5c8c31b82991b403f62d7e8f9a42110ccf4fd00f845dc24612d5195b2968eddef5942bb1ef080ffb2e78bd450b69065f986a87705fd607acd913f78e76eb94557ee2a6df78bcd6b856b879245fa1010205cf9036ad5485c0f53602efa4a7d1454b5a5b8e8ad20f8bab61c64548668c37616493b06149e6916f61ad0497b3682ce6b81568a664b0e54f731fa8cc7c4c8a7c8f64afdd578e9327c5cf279795028686682c71b6b1fb7777ada42e61f97b4e7a7382bf1676bf5031ce226a4bd7c233415420ffc7dee0604f1012d021ad47c3a835ad6a19c774c0290bd96a33abd3e5deb5785b1801aea3f95edca3fe63ca336e827f1555ca8e6dbbc27ffcf0656f0df3fa6b7d8c77f6c244d0ca6fe814ec12f532ece18930c8824260edbe0e1f154ca7c9d5ac5ea3064f454cebef3d3f0f06b5f50f7c7e9c562f70f862e5d168df25c770e6ded11d7c47a57e7b34cc95d634755821476acfe2974e699788174813a5e1ae11f44a2923974edece623c43b02dce5aa6bb156dbabc988d98f3aac302639ba065f6c96278dfe929e7ebe4c176e4b9bba8bca0e015e327170a0e09f92955b404b1a73468baf6450803f454b1a05d969019dcdcc1513e3af76cc3a4342c30c86ac865dd5366f2a5c9ac831c0210df420fbeaae2dc90fc65ca838f9c6ca2a4993a759d5be3a6ef5710566f8b07c947428ec02885b9faa03b257b6130f9532c4edbb346b65508ea2c5242766d28de14cd76255fcba236245aa97bef731dd2e969857b86e2e3cd59338450c1fdc333acaff85356e67cfe9813aa81e73bf8c1993dfc16dce3be6aaaf8c4cdd4457a7f29c68ff8ce698f53c3b6fe9e2ba9f21133c0a6114bd81fd3d9c5cdf932ca2954e2f5b2be95510c70366d673af8cb2921a5c1f90b95c32568e93555d3a45cb1239acd2310c5cdd00e52f3e0b75ed67816f4c75f9b217876986c9ca03c69af0afb2f25453a5ffbb928b02c48f7a79c26f6ecb7f11fa3afeb4dfca0003cb529306b8e955c1b2aaec4e4d65353cd4436852ef7975778650e92c2df708472500be8f61f34fdea52f5e977cdb42737ed058e8d4fb06fff76d98030724ddf54dd5aac47ce9fd19bcabc76a53ab84ebc8e4e2f5c2069ed76ec3eac0385356d799c9cbbe17b1e17f0944e57a3f7650cef846cd1a9116127546b58941ff7f6ef4e804a052c301bbc126ca7712b266c78c1bd3ab5887323320d854660529894806e873f96040665ad889b7ca1a1163ab28b0751e075fbaccb5e1c38585cb58258567837db2fd69ad0758a321955d8e1973aa40c3bd6ea0bb301e2e24a17b4d06e1584f4adad8c4de9a706f15b0ee6d5342853b1c2b0dddd363985891f50778ffbaa34ea4c53c5465eac351169a8e58a39f3e7792c93062efb53e48d26a3ce003b3fb205ac69e8b3401318452476e9f77a927b49343eab23e6a41ebab0e0bcd5b71b8c9fa6eb23e0c94bdc382bbf6a69baa3f81187dd10386836791d23684b0365d2d9915f0e9e30289758c9cea86850b8fc16083f5f7ab693b54b78f446fb07bb7c7a8b3619ec9f214fd92552355a1d72507f799e317a0bcf02c9c1af5c5878afee2ee618ca55ea4992d9287c84ad410f6fe1a4127f6e8be1336a7e4afad49b8a7389cb848c25f30021449837f06f6003409270f9746cd3b1ad59489dc44d9daf6c801e8b659d7904826b72360eceb36f99bf7706e16e325f347f25c435d3b4ce66f37d05a5a58f9bcb8b92f955bedfc9f4755d0bf114be51f4705a7953de3a5ddd4f989cc661293fc021b59b7997aeb799152a1ca131474e628b8fdd91138a33e34186456363f05e45a0d8e3610d05cd5eb7b39692a315006dfac785275f6aa66fcd297d15726c5392e43d02f9bb9fd1a9085ec056a6f5a88da6eb8cad18edc20807ffff5e9477a0e6aa35efc2fa223fa981091985c95b9f98295955c4833a7150ab2bc16cd14ba79abf3f67e914a6353e3c5e433933426036d0852b02b91abbac0c9c858e9e867b7682c222415fe18a0fe05a7496ee4c476c7ad9b72ee75eaf838b979c298f29e61d55cb74c331c55e6da635a7ff89cf8789c8ccc4cea24f21f6d9567c0d471bbafab020c7db6f863fd5b8d3f3015271edb704e3eeafd81635412b518ce28ce534dc268aaf5234757502e98b6e86d1142b21a36bcd504905c43c8ec3d8a8ef1aef5453e79dc46647b38795043622419a2ae3cebf285af009b0014903065bd802c2357e64706ab1985e8de8f9bc84446ebf381f0be1d0f9f6de83afb5c8a809e709c0d3cb6175a5927f3e523c3dab827a1cbfa15a15ab97b13dcc4827f53c6693a77bd05418c02e3ddd6a613208d2a5398120b8e3a7b2ed7a780ed09c6ce2695cdab9ff9e2e94527216d2b54bfc0044323bc7ee76081d491a5d049a16736036109c2191cd0e124b5aaf2efd29c917355f2cafdf0427cc3ce1b48c54bf00fce9d26260b145507110b2bf029becd6eb99284f2578fa1b9c76faf9c8a03c6018f4529231503bd45d10db57c8b224c5f9b53d938d24c34ffcefe4e2f62175f00b00d6979794d97a9b03b99f84b494a446da4e4f6e7a181c707835ada6049ba9dcb1dc66b575c815e73abafd255f55f51b192af6338ff8b74ea50f75ad2585c01dae832ee0edbb84787fb190f4aecb57f9f05849954fb05c7500d876c1c497a0a19ce0bfbc9784bb22b16510f57fdeba98526601a243557c782ad4adaa93df487b3ef9cb665dbadd6352bf23816d90f213d811ea81a58c4c4681157b1ed1b5aa9077e518e5fcdd39033f89c3df0eb49c3dbcd5a8c57ae691914cbcaa5b5abf969a63dcf9ecef46ee3c737120f1ea98f8333f4a0832e6dd470a8bcc5fcc9f217a", 0x1000}], 0x2, &(0x7f000000a800)=[@rights={{0x18, 0x1, 0x1, [r5, 0xffffffffffffffff]}}], 0x18, 0x10}}, {{&(0x7f000000a840)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f000000af80)=[{&(0x7f000000a8c0)="7479db885f5f6358a81ceb24af79da31a1eb619548ff8f41f38cf7b80a657af79cfc4d9e946a986377edfd70fb2876eb3881004e071cbe3f4aecc41b115f38940b9232d9a5d14cba0bce7e44ee1eb786734614dfac9c7cec75c2bcb35f0cc6fbb9e13bc6c48e7bc0dfac2b61675af98639939a159c8006b3c02e10896296a44f638ce9fe31eb723f8bd75a3043d2373639fcfae1d1bd4c0602f1d90153cd5a0e612d0b94a4b9401189d1b57d560c0703f103d16451791a93a7c0cf29270c8d62913bd4e5fdb2d096", 0xc8}, {0x0}, {&(0x7f000000aa80)="482b78be02653d8636871b646d111018df1ea6f7b70a89ea24f19e8f302a544376216ea87b02ca50c31865fbb0fd0dcb503c3efb343a36c572d5eac19c436ad20694cf970bd1947dd4", 0x49}, {&(0x7f000000ac40)="af960f34f403c61a7e2bef382d4979d2e9f352a8746465c1174a90a5972f81e26bde2c7a9099cd54abaede98af5d600dd17ab773c4b574f51dbaa2f01dac5d41e360863cf823428e638c9fcc3b2b3fca9312bbbb357035bc3b377e8a762b5ec7f405c63fe7358643c1641f4559d55569b52a2bf27562cb7869bea6efb97dd9ce895c0db2eb5b81fc54f08f5bdf9f9d5d894613ac4527ae72b06cd5bb04da36b3805e5548f9c1109f3a98d62f367df18e14a7fc7c6d9281b998bc345f6a5cf096f22fc04e53171abd3745606aa75929958c6bd163a2108e04f9ea8a9a8e3f0cb0", 0xe0}, {0x0}, {&(0x7f000000ae40)="94ec9b52aa7edc49c171da2017b9ca", 0xf}, {&(0x7f000000ae80)="76a89d8d7711765388019b56d4174b2acada5de27c885185487c495d0a99f0d3899e7489fb644e04e2402f4bf21aeccf5d4982d5767ec9278f529674d7e9e601caab0cdf3f940bb70bde5e088e514d79c3ba53c43f1f4232fad7c9b1f2ee415aa19f05886e734739fbd3113740c8528e049fed9c9f2f7d2f7ab19bd8dab5018d13206f74601afbd3ce012951c41fdedd53a3e051fce4c616e9d246c55bb9dffaa26b30284184abb522f185797c46ba0a4d2cd50b4f6bd7ee72cd08a6676558ce27b9aa278be7c3d3f8741b735b10fa359f1c67df21961be6", 0xd8}], 0x7, &(0x7f000000b1c0)=[@cred={{0x1c, 0x1, 0x2, {r7}}}, @rights={{0x30, 0x1, 0x1, [r8, r6, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee01}}}], 0x70, 0x20}}], 0x8, 0x0) 4.990727376s ago: executing program 2 (id=107): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x5, &(0x7f0000000040)=0x100000001, 0x4) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000380)=0x80000000001, 0xfffffffffffffdc8) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) syz_usb_connect(0x2, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf9, 0x15, 0x1d, 0x8, 0xb48, 0x1009, 0x87f7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x32, 0x0, 0x0, 0x25, 0x3, 0xaa}}]}}]}}, 0x0) sendto$inet6(r0, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e28c08645ca8d1b230e105614396838da832770c754887e7bea2f7ccf3d9ed3f33935d4eae67817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961c9df4be57ec30480918f99bf9c2cd9146e42327f178dc2b3d4936e7f7f0a79f74ba4b2d839fc5e50f8801a0a3ab41742d1186776dc1779b50fa818080907964669be539791e3e98687ee0598533ff1fc22385dd70b8291a3bf4de4101257aee1564ad6caf114c0d7f02e71cc0731d7c15cce239af34a5a76efe0209528e189f800cb2a6a518686e8234e18918100000000374d361f7eec8d6661634b4332d6451d75e3bc2ea63e065619a5d4769cf4f4f24d00000000996f7eae1a9e92b0913f6ee30b2d52fe18052b25e63b187bd1cfe4f663657f23749da7393fdf11300a0bda3bc45635ab1678e890bc0fd07fa4b1a944b49d52d95514727b76cd4c9f8ca444a6acbf3c404361132ba559f9bb5cfb8470507b7b26e5bf2712cc32ec1d8067ec3509ca85344f6e1f014c913679e0c3fc076d6fc7110a07acbd71e3f27816d65e745e4cc9dfc27d24ea554c15db1e84", 0x1b6, 0x4004040, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup3(r1, r0, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10012, r2, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001f00)=""/4106, 0xfffffffffffffccb, 0x0, 0x0}, &(0x7f0000000080)=0x40) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth1_vlan\x00'}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001380)=0x40) 4.9148004s ago: executing program 0 (id=108): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000040)=0x16) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f00000000c0)={0xffffffd8, 0x0, 0x4, 0x3, 0xff, "033a920887e8d2b791f19dd026d76d7fcb0f0e", 0x4, 0xb67}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0xff) (fail_nth: 2) 4.750978217s ago: executing program 4 (id=109): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8080) listen(0xffffffffffffffff, 0x5e) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="00000100000022"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000040)={0x0, 0x20000000, 0xffffffffffffffff}, 0x10) modify_ldt$read(0x0, &(0x7f0000001840)=""/4105, 0x1009) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x0, 0x6f, &(0x7f0000000840)={{0x12, 0x1, 0x310, 0x41, 0x50, 0x70, 0x8, 0x413c, 0x81b5, 0xdb3b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5d, 0x1, 0xe, 0xc, 0x80, 0x8, [{{0x9, 0x4, 0x57, 0xff, 0x1, 0x60, 0x33, 0xdd, 0x6, [@uac_as={[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x81, 0x1, 0x1, 0x4, "", "b63f3a"}]}, @cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x0, 0xd, 0xbac, 0x1}, {0x6, 0x24, 0x1a, 0x1, 0x22}}], [{{0x9, 0x5, 0x5, 0x4, 0x400, 0x2, 0xc, 0x9, [@generic={0x1a, 0x31, "85e16910051832aed7b27393af2cd779fc129aece8144413"}]}}]}}]}}]}}, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000640)=ANY=[@ANYBLOB="201104060000000101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8080) (async) listen(0xffffffffffffffff, 0x5e) (async) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="00000100000022"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) (async) modify_ldt$write2(0x11, &(0x7f0000000040)={0x0, 0x20000000, 0xffffffffffffffff}, 0x10) (async) modify_ldt$read(0x0, &(0x7f0000001840)=""/4105, 0x1009) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_connect(0x0, 0x6f, &(0x7f0000000840)={{0x12, 0x1, 0x310, 0x41, 0x50, 0x70, 0x8, 0x413c, 0x81b5, 0xdb3b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5d, 0x1, 0xe, 0xc, 0x80, 0x8, [{{0x9, 0x4, 0x57, 0xff, 0x1, 0x60, 0x33, 0xdd, 0x6, [@uac_as={[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x81, 0x1, 0x1, 0x4, "", "b63f3a"}]}, @cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x0, 0xd, 0xbac, 0x1}, {0x6, 0x24, 0x1a, 0x1, 0x22}}], [{{0x9, 0x5, 0x5, 0x4, 0x400, 0x2, 0xc, 0x9, [@generic={0x1a, 0x31, "85e16910051832aed7b27393af2cd779fc129aece8144413"}]}}]}}]}}]}}, 0x0) (async) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) (async) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000640)=ANY=[@ANYBLOB="201104060000000101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) 4.52262968s ago: executing program 0 (id=110): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='contention_begin\x00', r0}, 0x18) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1400000010"], 0xa4}}, 0x0) 4.480785213s ago: executing program 3 (id=111): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000f40), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f00000001c0)={0x58, r1, 0x1, 0x70bd67, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@remote}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2e, 0x5}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x39}, @IPVS_SVC_ATTR_TIMEOUT={0x8}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20004084}, 0x20008800) fanotify_init(0x8, 0x400) r2 = userfaultfd(0x100000) ioctl$UFFDIO_ZEROPAGE(r2, 0x541b, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x88f, &(0x7f0000002140)={0x0, 0xa74e, 0x0, 0x0, 0xbfdfffbc}, &(0x7f00000000c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}, 0x1}) io_uring_enter(r3, 0x32d7, 0x0, 0x46, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0xc8040) listen(0xffffffffffffffff, 0x5) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) socket$l2tp(0x2, 0x2, 0x73) clock_gettime(0x0, &(0x7f0000004e40)) clock_gettime(0x0, &(0x7f0000004ec0)) 4.169332725s ago: executing program 0 (id=112): sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x24}}, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000240)={[&(0x7f00000000c0)='=\x8d5\x10\xe4\x00\bj\xfb', 0x0]}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wg2\x00'}) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) preadv(r4, &(0x7f0000001b00)=[{&(0x7f00000009c0)=""/239, 0xef}], 0x1, 0x2, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="4000000066001fff0000000000000000"], 0x40}}, 0x4000800) syz_usb_connect(0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000001b40)={0x2020}, 0x2020) ioctl$BTRFS_IOC_ADD_DEV(r3, 0xff08, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000001800ffffffff7bfbfcdbdf250a148000ff01fd07"], 0x1c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@dellink={0x20, 0x11, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, 0x1480, 0x2104}}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x28, r12, 0x1, 0x0, 0x10, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x28}}, 0x0) ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) 3.539962553s ago: executing program 3 (id=113): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) 3.337339483s ago: executing program 3 (id=114): mount$bpf(0x0, 0x0, 0x0, 0x18, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x34, 0x3, 0xffffffffffffffff, 0x0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}, {0x0}, {0x0}], 0x1fc}, 0x0, 0x40000000, 0x1}) r0 = syz_io_uring_setup(0x74d, &(0x7f0000000100)={0x0, 0x59c4, 0x8, 0x1000, 0x5cc}, &(0x7f0000000300)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x30, 0x4, 0x0, 0x2}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_ACCEPT={0xd, 0xc, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x81800, 0x1}) io_uring_enter(r0, 0x749f, 0x4, 0x0, 0x0, 0xfffffffffffffef5) 3.177980756s ago: executing program 2 (id=115): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socket(0xd826dbc5216fa94, 0x2, 0x403e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000080)={0x98f, 0x2, 0x1, 0x7f, r5}, &(0x7f00000000c0)=0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x5, 0x6576, 0x9}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x100000000) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) sendmsg$inet(r0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x2, 0x4e23, @private=0xa010100}, 0x10, &(0x7f0000000180)=[{&(0x7f00000002c0)="6a754ff09d24710d7af5843e0127d16c2613447622adf56725710ecb240ce0d51b53f17548a2afbae4fda4d8518010fab691ebe758dd957618b325d3a71ed21c8ee821b77b472408404951385a45672c9dbe01513244bb71f44e33a1f07056d0ecccaaf7c392f1dd5f9c8a7f2863d16fa22f8a059ffaa9fd63429d6f1af4a02d59f81228a4dad43e83a1982300db2ac4ce8c3cd058adf10056ebd728e6e56d6b9641c546caf766746e2eb3625b084116e0b44baa4f79f173c35fc0daf822052b0fb220db35d090e860133bf273bef52a", 0xd0}], 0x1, &(0x7f00000001c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x10001}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}], 0x30}, 0x840) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x32, 0x0, &(0x7f0000002140)) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x20401, 0x0) ioctl$SNAPSHOT_FREE(r9, 0x3305) r10 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x5) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000140)="a2", 0x1}, {&(0x7f0000000540)="7e8c6dad820a6fafbc84dcac5a4ef84f8d918e836be48623e8b6a577a7c5851aaad4f2f51d0783b94cc64590c9cf4d6dbc0443d2e6ba80dcf6b59a8d6ba3c6e418748aef808c18cf8cfa1a1b05b4b32f", 0x50}], 0x2}, 0x40010) 3.066667332s ago: executing program 4 (id=116): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000003f80), 0x2, 0x0) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f0000000280)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x7, &(0x7f0000004580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 2.689002637s ago: executing program 3 (id=117): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$fuse(0x0, 0x0, 0x0, 0x8, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=0x0]) mount(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000280)='autofs\x00', 0x201000c, &(0x7f0000000040)) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x4b800, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r0, 0xc018937e, &(0x7f0000002400)={{0x1, 0x1, 0x1018, 0xffffffffffffffff, {0x1}}, './file0\x00'}) 2.431510538s ago: executing program 4 (id=118): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) (async) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sendmsg(r2, 0x0, 0x4000040) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb4c, 0x9, 0x6, 0x2, 0x3}, 0x0) (async) add_key(&(0x7f00000000c0)='pkcs7_test\x00', 0x0, &(0x7f0000000000)="100c0681000000ba8b0ad775b31b", 0xe, 0xfffffffffffffffc) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, 0x0) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000021088fe", @ANYRES32=r5, @ANYBLOB="08000800660400000c000200ac141441080001000000000008000a0000ac1414aa1400060006000000040000000500000004000000140006000900000004000000a00f00000900"/88], 0x70}, 0x1, 0x0, 0x0, 0x1}, 0x40) add_key$fscrypt_provisioning(&(0x7f0000000200), &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000380)=ANY=[@ANYBLOB="0100000000000000010203040506076d6cfd1241e558841011121314157b8f674e06aa74e001f215333435"], 0x48, 0xffffffffffffffff) (async) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000140)={0x0, 0xdffffffe, 0x80, 0x0, 0x0, "8100e1c8e80b598c36ff000800"}) (async) r6 = syz_open_pts(r3, 0x141601) fcntl$setstatus(r6, 0x4, 0x102800) (async) write(r6, &(0x7f0000000000)="d5", 0xfffffedf) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}}, 0x0) (async) sendmsg$NFULNL_MSG_CONFIG(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x0, 0x0, 0x400}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) close(0x3) (async) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x582}) 2.412705s ago: executing program 3 (id=119): move_mount(0xffffffffffffffff, &(0x7f0000000880)='./mnt\x00', 0xffffffffffffffff, 0x0, 0x240) socket$nl_route(0x10, 0x3, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x20000000) bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=@base={0x7, 0x9, 0x1, 0x0, 0x40, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0xc14f, 0x1}, 0x50) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r2, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x0, 0x3, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS_OLD(r3, 0x4143, 0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r6, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r7, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_IOAS_UNMAP$ALL(r5, 0x3b86, &(0x7f0000000240)={0x18, r6}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r4, 0x29, 0x41, &(0x7f0000000440)={'filter\x00', 0x4, [{}, {}, {}, {}]}, 0x68) 1.82262467s ago: executing program 4 (id=120): socket$inet6(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=@newtaction={0x14, 0x1e, 0x109, 0x0, 0xfffffffe}, 0x14}, 0x1, 0x2b1e}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = dup(r0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="640000000206030000000000fffff0000000000016000300686173683a6e65742c706f72742c6e6574000000050004000000000005000500020000000900020073797a3200000000050001000700000014000780080013400000000008001240"], 0x64}}, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r4, 0x54a0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r4, 0x54a1) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, 0x3, 0x6, 0x101, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000100)={0x0, 'vlan1\x00', {0x2}}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x8, 0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x7c, 0x1, {0x1e, 0x9, 0x78, 0x3, 0x7fffffff, 0xd, 0x2, 0x2, 0xca9e}}}}]}, 0x58}}, 0x4000010) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'sit0\x00', 0x0}) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x1000, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r9, {0x8}, {0xc, 0x10}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0xe42adb80cfa7e7b7}, 0x0) 1.371093692s ago: executing program 2 (id=121): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='net_prio.prioidx\x00', 0x275a, 0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x80000) r2 = dup2(r1, r0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12, r0, 0x0) ioctl$BTRFS_IOC_RESIZE(r2, 0x50009403, &(0x7f0000000080)=ANY=[@ANYRESDEC, @ANYBLOB=':+00000000']) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000180)=[@timestamp, @timestamp, @mss={0x2, 0x8000}, @window={0x3, 0x2c2, 0x7}], 0x4) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x3, 0x0, 0xd410, 0xf69aa1672a50ebb1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x7}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x10) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x2000000, &(0x7f0000000240)="ab"}) r9 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) 1.244393817s ago: executing program 4 (id=122): syz_usb_connect(0x5, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x29, 0x6f, 0xb6, 0x8, 0x9022, 0xd484, 0xff88, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x95, 0x0, 0x81, [{{0x9, 0x4, 0x1e, 0x80, 0x0, 0x56, 0xa7, 0xf6, 0x2}}]}}]}}, &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x16}) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000080)={&(0x7f00000001c0)=[{0x1900, 0xa10, 0x0, 0x0}], 0x1}) 26.942971ms ago: executing program 2 (id=123): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r1, &(0x7f0000000480)={0xa, 0xfffe, 0x3, @mcast1, 0x5}, 0x1c) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000540)={'\x00', 0x7ff, 0x6, 0xc, 0x0, 0x40000}) prctl$PR_MCE_KILL(0x4e, 0x1, 0x40000000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20044000) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x2, 0x4, 0xfff, 0x5}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000004000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007300000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r4}, 0x10) gettid() r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r5, &(0x7f0000000040)=[{&(0x7f0000001440)=""/4106, 0x100a}], 0x1, 0x300, 0x0) ioctl$BLKTRACETEARDOWN(r5, 0x1276, 0x0) timer_create(0xb, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$sock_proto_private(r5, 0x89eb, &(0x7f00000002c0)="d8287f62b207340078173905c6e22af91186ebeb7827bfdcdf5709c5ccbd5f6a70fa79e6dccfc913778d721998606b5a645ce579ea30ae3eef1e5801aea1437cb42cddb357cd445a5c29b80a5ae05b5de9b01f3de2589039d4eb5e6f55e2b25cb43fbaff69fd54c1") setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x5, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') 0s ago: executing program 0 (id=124): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.211' (ED25519) to the list of known hosts. [ 64.162030][ T30] audit: type=1400 audit(1756350500.756:62): avc: denied { mounton } for pid=5832 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 64.165649][ T5832] cgroup: Unknown subsys name 'net' [ 64.190155][ T30] audit: type=1400 audit(1756350500.756:63): avc: denied { mount } for pid=5832 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 64.212778][ T30] audit: type=1400 audit(1756350500.786:64): avc: denied { unmount } for pid=5832 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 64.383000][ T5832] cgroup: Unknown subsys name 'cpuset' [ 64.390636][ T5832] cgroup: Unknown subsys name 'rlimit' [ 64.527127][ T30] audit: type=1400 audit(1756350501.116:65): avc: denied { setattr } for pid=5832 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 64.551341][ T30] audit: type=1400 audit(1756350501.116:66): avc: denied { create } for pid=5832 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 64.576062][ T30] audit: type=1400 audit(1756350501.116:67): avc: denied { write } for pid=5832 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 64.597758][ T30] audit: type=1400 audit(1756350501.116:68): avc: denied { read } for pid=5832 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 64.618700][ T30] audit: type=1400 audit(1756350501.146:69): avc: denied { read } for pid=5514 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 64.639713][ T30] audit: type=1400 audit(1756350501.146:70): avc: denied { mounton } for pid=5832 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 64.661969][ T5835] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 64.664607][ T30] audit: type=1400 audit(1756350501.146:71): avc: denied { mount } for pid=5832 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 65.663446][ T5832] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 67.965733][ T5855] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 67.975002][ T5855] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 67.978639][ T5858] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 67.982857][ T5855] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.990196][ T5858] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 67.996977][ T5855] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 68.008992][ T5858] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 68.011119][ T5855] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 68.017832][ T5858] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 68.027622][ T5855] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 68.032209][ T5858] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 68.038988][ T5855] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 68.045788][ T5858] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 68.059290][ T5858] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.060185][ T5855] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 68.081551][ T5855] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 68.091743][ T5860] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 68.111402][ T5860] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 68.120232][ T5858] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 68.128388][ T5854] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.136028][ T5860] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 68.143999][ T5854] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.152654][ T5858] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 68.160226][ T5854] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.160553][ T5170] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 68.391824][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 68.589933][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.597606][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.605499][ T5844] bridge_slave_0: entered allmulticast mode [ 68.612494][ T5844] bridge_slave_0: entered promiscuous mode [ 68.636385][ T5843] chnl_net:caif_netlink_parms(): no params data found [ 68.645779][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.652919][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.660071][ T5844] bridge_slave_1: entered allmulticast mode [ 68.667107][ T5844] bridge_slave_1: entered promiscuous mode [ 68.745926][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.793544][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.811974][ T5846] chnl_net:caif_netlink_parms(): no params data found [ 68.854457][ T5856] chnl_net:caif_netlink_parms(): no params data found [ 68.889721][ T5844] team0: Port device team_slave_0 added [ 68.917600][ T5844] team0: Port device team_slave_1 added [ 68.945972][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.953161][ T5843] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.960247][ T5843] bridge_slave_0: entered allmulticast mode [ 68.967292][ T5843] bridge_slave_0: entered promiscuous mode [ 68.981041][ T5842] chnl_net:caif_netlink_parms(): no params data found [ 69.005054][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.012356][ T5843] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.019586][ T5843] bridge_slave_1: entered allmulticast mode [ 69.026610][ T5843] bridge_slave_1: entered promiscuous mode [ 69.040900][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.047840][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.074103][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.104266][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.111399][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.137652][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.202982][ T5843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.220944][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.228030][ T5846] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.235443][ T5846] bridge_slave_0: entered allmulticast mode [ 69.242710][ T5846] bridge_slave_0: entered promiscuous mode [ 69.272658][ T5843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.297124][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.304454][ T5846] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.312046][ T5846] bridge_slave_1: entered allmulticast mode [ 69.318740][ T5846] bridge_slave_1: entered promiscuous mode [ 69.342424][ T5856] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.349532][ T5856] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.357213][ T5856] bridge_slave_0: entered allmulticast mode [ 69.364525][ T5856] bridge_slave_0: entered promiscuous mode [ 69.380118][ T5843] team0: Port device team_slave_0 added [ 69.402834][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.409984][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.417500][ T5842] bridge_slave_0: entered allmulticast mode [ 69.424980][ T5842] bridge_slave_0: entered promiscuous mode [ 69.436156][ T5856] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.443752][ T5856] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.451067][ T5856] bridge_slave_1: entered allmulticast mode [ 69.457657][ T5856] bridge_slave_1: entered promiscuous mode [ 69.473202][ T5843] team0: Port device team_slave_1 added [ 69.480626][ T5846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.489849][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.497137][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.504399][ T5842] bridge_slave_1: entered allmulticast mode [ 69.512080][ T5842] bridge_slave_1: entered promiscuous mode [ 69.531818][ T5844] hsr_slave_0: entered promiscuous mode [ 69.537858][ T5844] hsr_slave_1: entered promiscuous mode [ 69.567510][ T5846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.594469][ T5856] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.605623][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.612656][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.638771][ T5843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.668170][ T5856] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.694017][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.701352][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.727635][ T5843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.748330][ T5842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.776286][ T5846] team0: Port device team_slave_0 added [ 69.784057][ T5842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.803750][ T5856] team0: Port device team_slave_0 added [ 69.820311][ T5846] team0: Port device team_slave_1 added [ 69.835686][ T5856] team0: Port device team_slave_1 added [ 69.867395][ T5842] team0: Port device team_slave_0 added [ 69.906503][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.913485][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.940091][ T5846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.952398][ T5842] team0: Port device team_slave_1 added [ 69.958519][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.965662][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.991669][ T5856] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.003986][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.010962][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.036871][ T5856] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.060155][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.067151][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.093538][ T5846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.136273][ T5843] hsr_slave_0: entered promiscuous mode [ 70.142313][ T5843] hsr_slave_1: entered promiscuous mode [ 70.148148][ T5843] debugfs: 'hsr0' already exists in 'hsr' [ 70.154322][ T5843] Cannot create hsr debugfs directory [ 70.161133][ T50] Bluetooth: hci3: command tx timeout [ 70.191517][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.198454][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.225066][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.237095][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.242679][ T50] Bluetooth: hci2: command tx timeout [ 70.244271][ T5854] Bluetooth: hci4: command tx timeout [ 70.249735][ T5170] Bluetooth: hci0: command tx timeout [ 70.255206][ T5858] Bluetooth: hci1: command tx timeout [ 70.266202][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.292760][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.349781][ T5856] hsr_slave_0: entered promiscuous mode [ 70.356776][ T5856] hsr_slave_1: entered promiscuous mode [ 70.362773][ T5856] debugfs: 'hsr0' already exists in 'hsr' [ 70.368484][ T5856] Cannot create hsr debugfs directory [ 70.437136][ T5846] hsr_slave_0: entered promiscuous mode [ 70.443201][ T5846] hsr_slave_1: entered promiscuous mode [ 70.449066][ T5846] debugfs: 'hsr0' already exists in 'hsr' [ 70.454969][ T5846] Cannot create hsr debugfs directory [ 70.480225][ T5842] hsr_slave_0: entered promiscuous mode [ 70.486400][ T5842] hsr_slave_1: entered promiscuous mode [ 70.492841][ T5842] debugfs: 'hsr0' already exists in 'hsr' [ 70.498553][ T5842] Cannot create hsr debugfs directory [ 70.728718][ T5844] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 70.740312][ T5844] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 70.759549][ T5844] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 70.783595][ T5844] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 70.845187][ T5856] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 70.854383][ T5856] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 70.867305][ T5856] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 70.885885][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.892375][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.897948][ T5856] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 70.947745][ T5843] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.973656][ T5843] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.986584][ T5843] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 71.001962][ T5843] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 71.079728][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.094262][ T5846] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 71.103976][ T5846] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 71.114666][ T5846] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 71.125405][ T5846] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 71.206337][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.220333][ T5842] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 71.229668][ T5842] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 71.239494][ T5842] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 71.248973][ T5842] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 71.279631][ T1100] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.286814][ T1100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.315634][ T1154] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.322748][ T1154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.353739][ T5856] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.380254][ T5856] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.403736][ T1100] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.410842][ T1100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.428916][ T5843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.453874][ T5844] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.468445][ T5843] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.497934][ T1100] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.505032][ T1100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.516591][ T1100] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.523661][ T1100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.533245][ T1100] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.540291][ T1100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.564943][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.606123][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 71.606139][ T30] audit: type=1400 audit(1756350508.196:86): avc: denied { sys_module } for pid=5844 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 71.620121][ T5843] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 71.644524][ T5843] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.705933][ T5856] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.825207][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.862994][ T5846] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.904689][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.924404][ T1154] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.931566][ T1154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.949404][ T1154] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.956557][ T1154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.974961][ T5842] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.019936][ T1100] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.027093][ T1100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.046918][ T1100] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.054037][ T1100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.094508][ T5856] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.107007][ T5843] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.241344][ T5858] Bluetooth: hci3: command tx timeout [ 72.253578][ T5856] veth0_vlan: entered promiscuous mode [ 72.272736][ T5843] veth0_vlan: entered promiscuous mode [ 72.284190][ T5843] veth1_vlan: entered promiscuous mode [ 72.315038][ T5856] veth1_vlan: entered promiscuous mode [ 72.321669][ T5854] Bluetooth: hci2: command tx timeout [ 72.323616][ T5170] Bluetooth: hci1: command tx timeout [ 72.327051][ T5854] Bluetooth: hci4: command tx timeout [ 72.338454][ T5858] Bluetooth: hci0: command tx timeout [ 72.387051][ T5843] veth0_macvtap: entered promiscuous mode [ 72.433441][ T5856] veth0_macvtap: entered promiscuous mode [ 72.447326][ T5843] veth1_macvtap: entered promiscuous mode [ 72.486915][ T5856] veth1_macvtap: entered promiscuous mode [ 72.534678][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.558766][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.570114][ T5844] veth0_vlan: entered promiscuous mode [ 72.591992][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.598935][ T4439] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.617029][ T4439] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.626097][ T4439] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.638469][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.655657][ T4439] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.675163][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.686618][ T5844] veth1_vlan: entered promiscuous mode [ 72.695900][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.726093][ T1127] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.737190][ T1127] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.766133][ T1127] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.775688][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.808625][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.817826][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.874741][ T5844] veth0_macvtap: entered promiscuous mode [ 72.898844][ T1100] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.911583][ T1100] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.922612][ T5844] veth1_macvtap: entered promiscuous mode [ 72.930811][ T1100] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.938622][ T1100] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.946287][ T5846] veth0_vlan: entered promiscuous mode [ 72.957784][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.966291][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.986540][ T30] audit: type=1400 audit(1756350509.576:87): avc: denied { mounton } for pid=5843 comm="syz-executor" path="/root/syzkaller.puin3Y/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 72.991766][ T5846] veth1_vlan: entered promiscuous mode [ 73.017848][ T30] audit: type=1400 audit(1756350509.606:88): avc: denied { mount } for pid=5843 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 73.046098][ T30] audit: type=1400 audit(1756350509.606:89): avc: denied { mounton } for pid=5843 comm="syz-executor" path="/root/syzkaller.puin3Y/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 73.073391][ T30] audit: type=1400 audit(1756350509.616:90): avc: denied { mount } for pid=5843 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 73.097910][ T30] audit: type=1400 audit(1756350509.616:91): avc: denied { mounton } for pid=5843 comm="syz-executor" path="/root/syzkaller.puin3Y/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 73.105466][ T5843] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 73.133168][ T30] audit: type=1400 audit(1756350509.616:92): avc: denied { mounton } for pid=5843 comm="syz-executor" path="/root/syzkaller.puin3Y/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7732 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 73.143599][ T5842] veth0_vlan: entered promiscuous mode [ 73.178099][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.185984][ T30] audit: type=1400 audit(1756350509.616:93): avc: denied { unmount } for pid=5843 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 73.189913][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.214722][ T30] audit: type=1400 audit(1756350509.636:94): avc: denied { mounton } for pid=5843 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 73.222112][ T5846] veth0_macvtap: entered promiscuous mode [ 73.243414][ T30] audit: type=1400 audit(1756350509.636:95): avc: denied { mount } for pid=5843 comm="syz-executor" name="/" dev="gadgetfs" ino=7735 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 73.257055][ T5842] veth1_vlan: entered promiscuous mode [ 73.281317][ T1100] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.295240][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.316073][ T5846] veth1_macvtap: entered promiscuous mode [ 73.335061][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.361483][ T1154] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.474762][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.516751][ T5965] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.4'. [ 73.565166][ T1154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.583630][ T1154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.600000][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.609520][ T150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.647906][ T150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.047619][ T5842] veth0_macvtap: entered promiscuous mode [ 74.057982][ T73] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.073848][ T5842] veth1_macvtap: entered promiscuous mode [ 74.077021][ T73] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.077084][ T73] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.077115][ T73] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.102658][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.118720][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.146117][ T150] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.148643][ T150] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.148686][ T150] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.148717][ T150] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.299751][ T150] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.331025][ T5858] Bluetooth: hci3: command tx timeout [ 74.387457][ T150] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.400537][ T5858] Bluetooth: hci0: command tx timeout [ 74.405951][ T5858] Bluetooth: hci1: command tx timeout [ 74.411451][ T5854] Bluetooth: hci4: command tx timeout [ 74.416827][ T5854] Bluetooth: hci2: command tx timeout [ 74.790527][ T1127] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.838751][ T1127] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.875274][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.917421][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.065761][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.194278][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.220586][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 75.228962][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 75.237593][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 75.246146][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 75.420682][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 75.690804][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 75.890625][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 75.934710][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 76.036093][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 76.241021][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 76.400613][ T5170] Bluetooth: hci3: command tx timeout [ 76.481141][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 76.505554][ T5170] Bluetooth: hci2: command tx timeout [ 76.505612][ T5854] Bluetooth: hci1: command tx timeout [ 76.511208][ T5170] Bluetooth: hci4: command tx timeout [ 76.516857][ T5854] Bluetooth: hci0: command tx timeout [ 76.740605][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 76.754520][ T9] usb 4-1: config 0 has no interfaces? [ 76.786578][ T9] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 76.946055][ T9] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 77.518787][ T30] kauditd_printk_skb: 60 callbacks suppressed [ 77.518799][ T30] audit: type=1400 audit(1756350514.106:156): avc: denied { create } for pid=6020 comm="syz.0.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 77.582752][ T9] usb 4-1: Manufacturer: syz [ 77.887195][ T30] audit: type=1400 audit(1756350514.466:157): avc: denied { getopt } for pid=6020 comm="syz.0.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 77.925386][ T6025] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 77.954986][ T6025] team0: Port device batadv1 added [ 77.964800][ T30] audit: type=1400 audit(1756350514.466:158): avc: denied { ioctl } for pid=6020 comm="syz.0.16" path="socket:[9281]" dev="sockfs" ino=9281 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 77.989023][ C1] vkms_vblank_simulate: vblank timer overrun [ 78.010476][ T5961] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 78.053386][ T9] usb 4-1: config 0 descriptor?? [ 78.154215][ T30] audit: type=1400 audit(1756350514.466:159): avc: denied { connect } for pid=6020 comm="syz.0.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 78.173836][ T5961] usb 5-1: Using ep0 maxpacket: 16 [ 78.188462][ T5961] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 78.204713][ T5961] usb 5-1: config 0 has no interface number 0 [ 78.224490][ T5961] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 78.550494][ T30] audit: type=1400 audit(1756350514.466:160): avc: denied { name_connect } for pid=6020 comm="syz.0.16" dest=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 78.593786][ T5961] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 78.611824][ T30] audit: type=1400 audit(1756350514.506:161): avc: denied { create } for pid=6020 comm="syz.0.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 78.632130][ T5961] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 78.641605][ T5961] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 78.649790][ T5961] usb 5-1: Product: syz [ 78.654005][ T5961] usb 5-1: SerialNumber: syz [ 78.675988][ T5961] usb 5-1: config 0 descriptor?? [ 78.681402][ T30] audit: type=1400 audit(1756350514.506:162): avc: denied { setopt } for pid=6020 comm="syz.0.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 78.700602][ C1] vkms_vblank_simulate: vblank timer overrun [ 78.724614][ T5961] cm109 5-1:0.8: invalid payload size 0, expected 4 [ 78.735322][ T5961] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input5 [ 78.745586][ T30] audit: type=1400 audit(1756350514.506:163): avc: denied { ioctl } for pid=6020 comm="syz.0.16" path="socket:[9284]" dev="sockfs" ino=9284 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 78.770006][ C1] vkms_vblank_simulate: vblank timer overrun [ 78.853629][ T30] audit: type=1400 audit(1756350514.836:164): avc: denied { setopt } for pid=6020 comm="syz.0.16" laddr=::ffff:172.20.20.32 lport=43693 faddr=::ffff:172.20.20.32 fport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 78.932295][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 78.950624][ T30] audit: type=1400 audit(1756350514.856:165): avc: denied { write } for pid=6020 comm="syz.0.16" name="001" dev="devtmpfs" ino=745 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 79.072164][ T6031] FAULT_INJECTION: forcing a failure. [ 79.072164][ T6031] name failslab, interval 1, probability 0, space 0, times 1 [ 79.366330][ T6031] CPU: 0 UID: 0 PID: 6031 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full) [ 79.366354][ T6031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 79.366363][ T6031] Call Trace: [ 79.366368][ T6031] [ 79.366374][ T6031] dump_stack_lvl+0x16c/0x1f0 [ 79.366397][ T6031] should_fail_ex+0x512/0x640 [ 79.366421][ T6031] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 79.366449][ T6031] should_failslab+0xc2/0x120 [ 79.366468][ T6031] __kmalloc_cache_noprof+0x6a/0x3e0 [ 79.366492][ T6031] ? tcp_sendmsg_fastopen+0x24d/0x750 [ 79.366518][ T6031] tcp_sendmsg_fastopen+0x24d/0x750 [ 79.366542][ T6031] tcp_sendmsg_locked+0x23ff/0x42a0 [ 79.366576][ T6031] ? avc_has_perm+0x144/0x1f0 [ 79.366593][ T6031] ? __lock_acquire+0xb97/0x1ce0 [ 79.366625][ T6031] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 79.366651][ T6031] ? do_raw_spin_lock+0x12c/0x2b0 [ 79.366668][ T6031] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 79.366690][ T6031] ? __local_bh_enable_ip+0xa4/0x120 [ 79.366715][ T6031] tcp_sendmsg+0x2e/0x50 [ 79.366735][ T6031] ? __pfx_tcp_sendmsg+0x10/0x10 [ 79.366758][ T6031] inet6_sendmsg+0xb9/0x140 [ 79.366780][ T6031] __sys_sendto+0x376/0x520 [ 79.366797][ T6031] ? __pfx___sys_sendto+0x10/0x10 [ 79.366826][ T6031] ? ksys_write+0x1ac/0x250 [ 79.366840][ T6031] ? __pfx_ksys_write+0x10/0x10 [ 79.366856][ T6031] __x64_sys_sendto+0xe0/0x1c0 [ 79.366868][ T6031] ? do_syscall_64+0x91/0x4c0 [ 79.366883][ T6031] ? lockdep_hardirqs_on+0x7c/0x110 [ 79.366898][ T6031] do_syscall_64+0xcd/0x4c0 [ 79.366917][ T6031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.366934][ T6031] RIP: 0033:0x7fd49838ebe9 [ 79.366947][ T6031] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 79.366961][ T6031] RSP: 002b:00007fd4991c2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 79.366977][ T6031] RAX: ffffffffffffffda RBX: 00007fd4985b5fa0 RCX: 00007fd49838ebe9 [ 79.366988][ T6031] RDX: fffffffffffffea7 RSI: 0000200000f6f000 RDI: 0000000000000003 [ 79.366998][ T6031] RBP: 00007fd4991c2090 R08: 0000200000b63fe4 R09: 000000000000001c [ 79.367007][ T6031] R10: 0000000020000004 R11: 0000000000000246 R12: 0000000000000001 [ 79.367017][ T6031] R13: 00007fd4985b6038 R14: 00007fd4985b5fa0 R15: 00007ffe4250e098 [ 79.367040][ T6031] [ 79.368616][ T6023] ======================================================= [ 79.368616][ T6023] WARNING: The mand mount option has been deprecated and [ 79.368616][ T6023] and is ignored by this kernel. Remove the mand [ 79.368616][ T6023] option from the mount to silence this warning. [ 79.368616][ T6023] ======================================================= [ 80.318682][ T6048] netlink: 40 bytes leftover after parsing attributes in process `syz.0.24'. [ 80.349873][ T43] usb 4-1: USB disconnect, device number 2 [ 80.910872][ T5917] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 81.130583][ T5917] usb 3-1: Using ep0 maxpacket: 16 [ 81.161289][ T10] cfg80211: failed to load regulatory.db [ 81.194749][ T5917] usb 3-1: config 8 has an invalid interface number: 134 but max is 0 [ 81.219398][ T5917] usb 3-1: config 8 has no interface number 0 [ 81.236593][ T5917] usb 3-1: config 8 interface 134 altsetting 4 bulk endpoint 0x7 has invalid maxpacket 16 [ 81.274926][ T5917] usb 3-1: config 8 interface 134 altsetting 4 endpoint 0xD has invalid maxpacket 951, setting to 64 [ 81.300271][ T5917] usb 3-1: config 8 interface 134 has no altsetting 0 [ 81.326048][ T5917] usb 3-1: New USB device found, idVendor=1a72, idProduct=1005, bcdDevice=6e.99 [ 81.349619][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.408802][ T5917] usb 3-1: Product: syz [ 81.551628][ T5917] usb 3-1: Manufacturer: syz [ 81.556379][ T5917] usb 3-1: SerialNumber: syz [ 81.589087][ T6053] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 81.933436][ T5917] ftdi_sio 3-1:8.134: FTDI USB Serial Device converter detected [ 81.982721][ T5917] ftdi_sio ttyUSB0: unknown device type: 0x6e99 [ 82.056460][ T5904] usb 5-1: USB disconnect, device number 2 [ 82.068250][ T5917] usb 3-1: USB disconnect, device number 2 [ 82.188146][ T5904] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 82.461507][ T5917] ftdi_sio 3-1:8.134: device disconnected [ 82.728483][ T6086] Zero length message leads to an empty skb [ 82.874179][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 82.874190][ T30] audit: type=1400 audit(1756350519.466:191): avc: denied { create } for pid=6087 comm="syz.2.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 82.941346][ T30] audit: type=1400 audit(1756350519.506:192): avc: denied { mount } for pid=6087 comm="syz.2.36" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 83.289309][ T6093] overlayfs: conflicting lowerdir path [ 83.359469][ T30] audit: type=1400 audit(1756350519.546:193): avc: denied { read append } for pid=6090 comm="syz.0.35" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 83.401937][ T30] audit: type=1400 audit(1756350519.546:194): avc: denied { open } for pid=6090 comm="syz.0.35" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 83.526096][ T30] audit: type=1400 audit(1756350519.546:195): avc: denied { ioctl } for pid=6090 comm="syz.0.35" path="/dev/cachefiles" dev="devtmpfs" ino=4 ioctlcmd=0x5418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 83.592506][ T30] audit: type=1400 audit(1756350519.556:196): avc: denied { mounton } for pid=6087 comm="syz.2.36" path="/6/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 83.617006][ T30] audit: type=1400 audit(1756350519.566:197): avc: denied { mount } for pid=6087 comm="syz.2.36" name="/" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 83.639001][ T30] audit: type=1400 audit(1756350519.946:198): avc: denied { setopt } for pid=6090 comm="syz.0.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 83.660717][ T30] audit: type=1400 audit(1756350519.946:199): avc: denied { mount } for pid=6087 comm="syz.2.36" name="/" dev="pstore" ino=828 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 83.711253][ T30] audit: type=1400 audit(1756350520.196:200): avc: denied { create } for pid=6097 comm="syz.3.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 85.719556][ T6113] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 85.873344][ T6113] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 87.693260][ T6151] netlink: 28 bytes leftover after parsing attributes in process `syz.4.53'. [ 87.706039][ T6151] netlink: 8 bytes leftover after parsing attributes in process `syz.4.53'. [ 87.931698][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 87.931710][ T30] audit: type=1400 audit(1756350524.526:226): avc: denied { name_bind } for pid=6157 comm="syz.2.54" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 88.283131][ T30] audit: type=1400 audit(1756350524.876:227): avc: denied { mounton } for pid=6150 comm="syz.4.53" path="/11/file0" dev="tmpfs" ino=74 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 88.387867][ T30] audit: type=1400 audit(1756350524.976:228): avc: denied { unmount } for pid=6150 comm="syz.4.53" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 88.671700][ T6162] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 88.880257][ T6165] FAULT_INJECTION: forcing a failure. [ 88.880257][ T6165] name failslab, interval 1, probability 0, space 0, times 0 [ 88.898247][ T6165] CPU: 0 UID: 0 PID: 6165 Comm: syz.1.55 Not tainted syzkaller #0 PREEMPT(full) [ 88.898269][ T6165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 88.898278][ T6165] Call Trace: [ 88.898284][ T6165] [ 88.898291][ T6165] dump_stack_lvl+0x16c/0x1f0 [ 88.898311][ T6165] should_fail_ex+0x512/0x640 [ 88.898324][ T6165] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 88.898337][ T6165] should_failslab+0xc2/0x120 [ 88.898350][ T6165] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 88.898361][ T6165] ? __alloc_skb+0x2b2/0x380 [ 88.898373][ T6165] ? avc_has_perm+0x144/0x1f0 [ 88.898385][ T6165] __alloc_skb+0x2b2/0x380 [ 88.898395][ T6165] ? __pfx___alloc_skb+0x10/0x10 [ 88.898405][ T6165] ? selinux_socket_getpeersec_dgram+0x1a4/0x370 [ 88.898420][ T6165] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 88.898439][ T6165] netlink_alloc_large_skb+0x69/0x130 [ 88.898453][ T6165] netlink_sendmsg+0x6a1/0xdd0 [ 88.898468][ T6165] ? __pfx_netlink_sendmsg+0x10/0x10 [ 88.898486][ T6165] ____sys_sendmsg+0xa98/0xc70 [ 88.898502][ T6165] ? copy_msghdr_from_user+0x10a/0x160 [ 88.898514][ T6165] ? __pfx_____sys_sendmsg+0x10/0x10 [ 88.898535][ T6165] ___sys_sendmsg+0x134/0x1d0 [ 88.898547][ T6165] ? __pfx____sys_sendmsg+0x10/0x10 [ 88.898576][ T6165] __sys_sendmsg+0x16d/0x220 [ 88.898588][ T6165] ? __pfx___sys_sendmsg+0x10/0x10 [ 88.898609][ T6165] do_syscall_64+0xcd/0x4c0 [ 88.898622][ T6165] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.898634][ T6165] RIP: 0033:0x7effbc78ebe9 [ 88.898644][ T6165] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 88.898654][ T6165] RSP: 002b:00007effbd6e3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 88.898665][ T6165] RAX: ffffffffffffffda RBX: 00007effbc9b5fa0 RCX: 00007effbc78ebe9 [ 88.898672][ T6165] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 88.898678][ T6165] RBP: 00007effbd6e3090 R08: 0000000000000000 R09: 0000000000000000 [ 88.898684][ T6165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 88.898690][ T6165] R13: 00007effbc9b6038 R14: 00007effbc9b5fa0 R15: 00007ffc56c3b3d8 [ 88.898704][ T6165] [ 89.125491][ T30] audit: type=1400 audit(1756350525.716:229): avc: denied { shutdown } for pid=6163 comm="syz.2.56" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 89.306279][ T30] audit: type=1400 audit(1756350525.896:230): avc: denied { ioctl } for pid=6150 comm="syz.4.53" path="socket:[9560]" dev="sockfs" ino=9560 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 89.417018][ T30] audit: type=1400 audit(1756350526.006:231): avc: denied { create } for pid=6171 comm="syz.0.57" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 89.439380][ T6173] capability: warning: `syz.0.57' uses deprecated v2 capabilities in a way that may be insecure [ 89.452149][ T5917] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 89.470578][ T30] audit: type=1400 audit(1756350526.036:232): avc: denied { mounton } for pid=6171 comm="syz.0.57" path="/proc/48/task" dev="proc" ino=8860 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 89.704109][ T5917] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 89.713386][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.721609][ T5917] usb 3-1: Product: syz [ 89.725788][ T5917] usb 3-1: Manufacturer: syz [ 89.745849][ T5917] usb 3-1: SerialNumber: syz [ 89.771198][ T5917] usb 3-1: config 0 descriptor?? [ 89.785426][ T5917] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 89.821614][ T5917] usb 3-1: setting power ON [ 89.848901][ T5917] dvb-usb: bulk message failed: -22 (2/0) [ 89.870608][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 89.894991][ T5917] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 89.959781][ T5917] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) error while loading driver (-19) [ 90.019508][ T5917] dvb_usb_cxusb 3-1:0.0: probe with driver dvb_usb_cxusb failed with error -22 [ 90.033653][ T6182] FAULT_INJECTION: forcing a failure. [ 90.033653][ T6182] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 90.049652][ T10] usb 4-1: config 0 has no interfaces? [ 90.060069][ T10] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 90.087282][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.126670][ T10] usb 4-1: Product: syz [ 90.131025][ T10] usb 4-1: Manufacturer: syz [ 90.135712][ T10] usb 4-1: SerialNumber: syz [ 90.153313][ T6182] CPU: 0 UID: 0 PID: 6182 Comm: syz.4.61 Not tainted syzkaller #0 PREEMPT(full) [ 90.153336][ T6182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 90.153346][ T6182] Call Trace: [ 90.153352][ T6182] [ 90.153359][ T6182] dump_stack_lvl+0x16c/0x1f0 [ 90.153385][ T6182] should_fail_ex+0x512/0x640 [ 90.153409][ T6182] _copy_to_user+0x32/0xd0 [ 90.153435][ T6182] simple_read_from_buffer+0xcb/0x170 [ 90.153456][ T6182] proc_fail_nth_read+0x197/0x240 [ 90.153478][ T6182] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 90.153507][ T6182] ? rw_verify_area+0xcf/0x6c0 [ 90.153534][ T6182] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 90.153555][ T6182] vfs_read+0x1e4/0xcf0 [ 90.153576][ T6182] ? __pfx___mutex_lock+0x10/0x10 [ 90.153597][ T6182] ? __pfx_vfs_read+0x10/0x10 [ 90.153621][ T6182] ? __fget_files+0x20e/0x3c0 [ 90.153648][ T6182] ksys_read+0x12a/0x250 [ 90.153666][ T6182] ? __pfx_ksys_read+0x10/0x10 [ 90.153691][ T6182] do_syscall_64+0xcd/0x4c0 [ 90.153714][ T6182] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.153733][ T6182] RIP: 0033:0x7f686238d5fc [ 90.153747][ T6182] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 90.153762][ T6182] RSP: 002b:00007f6863210030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 90.153779][ T6182] RAX: ffffffffffffffda RBX: 00007f68625b5fa0 RCX: 00007f686238d5fc [ 90.153790][ T6182] RDX: 000000000000000f RSI: 00007f68632100a0 RDI: 0000000000000005 [ 90.153801][ T6182] RBP: 00007f6863210090 R08: 0000000000000000 R09: 0000000000000000 [ 90.153811][ T6182] R10: 0000040000000009 R11: 0000000000000246 R12: 0000000000000001 [ 90.153821][ T6182] R13: 00007f68625b6038 R14: 00007f68625b5fa0 R15: 00007ffef89a4288 [ 90.153846][ T6182] [ 90.444671][ T10] usb 4-1: config 0 descriptor?? [ 90.947671][ T30] audit: type=1400 audit(1756350527.536:233): avc: denied { create } for pid=6190 comm="syz.4.62" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 91.822135][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.850483][ T6200] netlink: 4 bytes leftover after parsing attributes in process `syz.4.65'. [ 91.904984][ T43] usb 3-1: USB disconnect, device number 3 [ 91.957362][ T6199] netlink: 40 bytes leftover after parsing attributes in process `syz.4.65'. [ 92.105203][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.202743][ T6205] netlink: 44 bytes leftover after parsing attributes in process `syz.0.67'. [ 92.340534][ T6205] netlink: 44 bytes leftover after parsing attributes in process `syz.0.67'. [ 92.395946][ T5961] usb 4-1: USB disconnect, device number 3 [ 92.520175][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.591611][ T6215] netlink: 28 bytes leftover after parsing attributes in process `syz.3.70'. [ 92.602256][ T6215] netlink: 8 bytes leftover after parsing attributes in process `syz.3.70'. [ 93.069602][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.715444][ T5858] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.725324][ T5858] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.735484][ T5858] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.754264][ T5858] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 93.770974][ T5858] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 93.792428][ T30] audit: type=1400 audit(1756350530.386:234): avc: denied { mounton } for pid=6223 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 93.953406][ T30] audit: type=1400 audit(1756350530.536:235): avc: denied { bind } for pid=6228 comm="syz.4.74" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 94.108012][ T30] audit: type=1400 audit(1756350530.536:236): avc: denied { name_bind } for pid=6228 comm="syz.4.74" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 94.187581][ T30] audit: type=1400 audit(1756350530.546:237): avc: denied { node_bind } for pid=6228 comm="syz.4.74" saddr=::ffff:0.0.0.0 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 94.220840][ T30] audit: type=1400 audit(1756350530.546:238): avc: denied { read } for pid=6228 comm="syz.4.74" laddr=::ffff:127.0.0.1 lport=20001 faddr=::ffff:127.0.0.1 fport=20001 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 94.246924][ T30] audit: type=1400 audit(1756350530.846:239): avc: denied { bind } for pid=6214 comm="syz.3.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 94.434411][ T30] audit: type=1400 audit(1756350531.016:240): avc: denied { search } for pid=5514 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.518247][ T6237] netlink: 72 bytes leftover after parsing attributes in process `syz.4.77'. [ 94.597652][ T6223] chnl_net:caif_netlink_parms(): no params data found [ 94.607501][ T30] audit: type=1400 audit(1756350531.026:241): avc: denied { search } for pid=5514 comm="dhcpcd" name="udev" dev="tmpfs" ino=9 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.677787][ T30] audit: type=1400 audit(1756350531.026:242): avc: denied { search } for pid=5514 comm="dhcpcd" name="data" dev="tmpfs" ino=14 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.840506][ T30] audit: type=1400 audit(1756350531.026:243): avc: denied { read } for pid=5514 comm="dhcpcd" name="n100" dev="tmpfs" ino=2268 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 95.080552][ T5849] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 95.128508][ T13] bridge_slave_1: left allmulticast mode [ 95.139316][ T13] bridge_slave_1: left promiscuous mode [ 95.160081][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.242084][ T5849] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 95.263634][ T13] bridge_slave_0: left allmulticast mode [ 95.269301][ T13] bridge_slave_0: left promiscuous mode [ 95.333714][ T5849] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 95.350888][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.390429][ T5849] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 95.423464][ T5849] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 95.524590][ T5849] usb 4-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 95.584078][ T5849] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.608690][ T6264] FAULT_INJECTION: forcing a failure. [ 95.608690][ T6264] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 95.641345][ T5849] usb 4-1: config 0 descriptor?? [ 95.661071][ T6264] CPU: 1 UID: 0 PID: 6264 Comm: syz.2.79 Not tainted syzkaller #0 PREEMPT(full) [ 95.661094][ T6264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 95.661104][ T6264] Call Trace: [ 95.661110][ T6264] [ 95.661120][ T6264] dump_stack_lvl+0x16c/0x1f0 [ 95.661145][ T6264] should_fail_ex+0x512/0x640 [ 95.661168][ T6264] _copy_to_user+0x32/0xd0 [ 95.661193][ T6264] simple_read_from_buffer+0xcb/0x170 [ 95.661214][ T6264] proc_fail_nth_read+0x197/0x240 [ 95.661236][ T6264] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 95.661258][ T6264] ? rw_verify_area+0xcf/0x6c0 [ 95.661284][ T6264] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 95.661304][ T6264] vfs_read+0x1e4/0xcf0 [ 95.661325][ T6264] ? __pfx___mutex_lock+0x10/0x10 [ 95.661346][ T6264] ? __pfx_vfs_read+0x10/0x10 [ 95.661371][ T6264] ? __fget_files+0x20e/0x3c0 [ 95.661399][ T6264] ksys_read+0x12a/0x250 [ 95.661416][ T6264] ? __pfx_ksys_read+0x10/0x10 [ 95.661440][ T6264] do_syscall_64+0xcd/0x4c0 [ 95.661462][ T6264] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.661488][ T6264] RIP: 0033:0x7f775898d5fc [ 95.661502][ T6264] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 95.661518][ T6264] RSP: 002b:00007f7759722030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 95.661534][ T6264] RAX: ffffffffffffffda RBX: 00007f7758bb5fa0 RCX: 00007f775898d5fc [ 95.661545][ T6264] RDX: 000000000000000f RSI: 00007f77597220a0 RDI: 0000000000000006 [ 95.661554][ T6264] RBP: 00007f7759722090 R08: 0000000000000000 R09: 0000000000000000 [ 95.661564][ T6264] R10: 0000000000010003 R11: 0000000000000246 R12: 0000000000000001 [ 95.661574][ T6264] R13: 00007f7758bb6038 R14: 00007f7758bb5fa0 R15: 00007fff8f424868 [ 95.661598][ T6264] [ 96.067280][ T5849] hdpvr 4-1:0.0: firmware version 0x0 dated [ 96.073917][ T5849] hdpvr 4-1:0.0: untested firmware, the driver might not work. [ 96.091208][ T5854] Bluetooth: hci0: command tx timeout [ 96.900054][ T6279] mmap: syz.4.81 (6279) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 97.926814][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 97.968364][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 97.987697][ T13] bond0 (unregistering): Released all slaves [ 98.176993][ T5854] Bluetooth: hci0: command tx timeout [ 98.234307][ T5849] hdpvr 4-1:0.0: Could not setup controls [ 98.375174][ T5849] hdpvr 4-1:0.0: registering videodev failed [ 98.473198][ T6296] netlink: 28 bytes leftover after parsing attributes in process `syz.3.85'. [ 98.902043][ T5849] hdpvr 4-1:0.0: probe with driver hdpvr failed with error -71 [ 98.952076][ T5849] usb 4-1: USB disconnect, device number 4 [ 99.607180][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 99.607210][ T30] audit: type=1400 audit(1756350536.189:258): avc: denied { mount } for pid=6309 comm="syz.4.89" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 99.869781][ T6223] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.979683][ T6223] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.177683][ T6223] bridge_slave_0: entered allmulticast mode [ 100.382892][ T10] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 100.392236][ T5854] Bluetooth: hci0: command tx timeout [ 100.393286][ T6223] bridge_slave_0: entered promiscuous mode [ 100.497352][ T6223] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.504600][ T6223] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.517711][ T6223] bridge_slave_1: entered allmulticast mode [ 100.602479][ T6223] bridge_slave_1: entered promiscuous mode [ 100.623453][ T6324] FAULT_INJECTION: forcing a failure. [ 100.623453][ T6324] name failslab, interval 1, probability 0, space 0, times 0 [ 100.667757][ T6324] CPU: 0 UID: 0 PID: 6324 Comm: syz.3.90 Not tainted syzkaller #0 PREEMPT(full) [ 100.667782][ T6324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 100.667791][ T6324] Call Trace: [ 100.667797][ T6324] [ 100.667804][ T6324] dump_stack_lvl+0x16c/0x1f0 [ 100.667828][ T6324] should_fail_ex+0x512/0x640 [ 100.667848][ T6324] ? fs_reclaim_acquire+0xae/0x150 [ 100.667873][ T6324] ? tomoyo_encode2+0x100/0x3e0 [ 100.667897][ T6324] should_failslab+0xc2/0x120 [ 100.667917][ T6324] __kmalloc_noprof+0xd2/0x510 [ 100.667939][ T6324] tomoyo_encode2+0x100/0x3e0 [ 100.667966][ T6324] tomoyo_encode+0x29/0x50 [ 100.667990][ T6324] tomoyo_realpath_from_path+0x18f/0x6e0 [ 100.668016][ T6324] ? tomoyo_profile+0x47/0x60 [ 100.668035][ T6324] tomoyo_path_number_perm+0x245/0x580 [ 100.668054][ T6324] ? tomoyo_path_number_perm+0x237/0x580 [ 100.668078][ T6324] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 100.668101][ T6324] ? find_held_lock+0x2b/0x80 [ 100.668147][ T6324] ? find_held_lock+0x2b/0x80 [ 100.668167][ T6324] ? hook_file_ioctl_common+0x145/0x410 [ 100.668191][ T6324] ? __fget_files+0x20e/0x3c0 [ 100.668215][ T6324] security_file_ioctl+0x9b/0x240 [ 100.668242][ T6324] __x64_sys_ioctl+0xb7/0x210 [ 100.668271][ T6324] do_syscall_64+0xcd/0x4c0 [ 100.668293][ T6324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.668311][ T6324] RIP: 0033:0x7f74fdf8ebe9 [ 100.668325][ T6324] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 100.668341][ T6324] RSP: 002b:00007f74fee99038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 100.668358][ T6324] RAX: ffffffffffffffda RBX: 00007f74fe1b6090 RCX: 00007f74fdf8ebe9 [ 100.668369][ T6324] RDX: 0000200000000000 RSI: 000000004040ae79 RDI: 0000000000000004 [ 100.668380][ T6324] RBP: 00007f74fee99090 R08: 0000000000000000 R09: 0000000000000000 [ 100.668390][ T6324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 100.668400][ T6324] R13: 00007f74fe1b6128 R14: 00007f74fe1b6090 R15: 00007ffc2a185858 [ 100.668425][ T6324] [ 100.924278][ T6223] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.934742][ T6223] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.950489][ T6324] ERROR: Out of memory at tomoyo_realpath_from_path. [ 100.965926][ T6223] team0: Port device team_slave_0 added [ 100.974317][ T6223] team0: Port device team_slave_1 added [ 101.004497][ T6223] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.011525][ T6223] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 101.038146][ T6223] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.138100][ T10] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 101.184168][ T10] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 101.203545][ T10] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 101.258401][ T30] audit: type=1400 audit(1756350537.849:259): avc: denied { bind } for pid=6334 comm="syz.3.93" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 101.289479][ T10] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 101.348643][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.393767][ T10] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 101.404493][ T6223] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.441654][ T6223] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 101.798885][ T6223] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.816614][ T30] audit: type=1400 audit(1756350538.379:260): avc: denied { read write } for pid=6307 comm="syz.2.88" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 101.869318][ T30] audit: type=1400 audit(1756350538.379:261): avc: denied { open } for pid=6307 comm="syz.2.88" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 101.915879][ T10] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 101.932928][ T10] usb 3-1: USB disconnect, device number 4 [ 101.958626][ T5853] udevd[5853]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 102.023673][ T6339] netlink: 40 bytes leftover after parsing attributes in process `syz.3.95'. [ 102.034590][ T6339] netlink: 4 bytes leftover after parsing attributes in process `syz.3.95'. [ 102.178318][ T13] hsr_slave_0: left promiscuous mode [ 102.218964][ T13] hsr_slave_1: left promiscuous mode [ 102.227852][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 102.248459][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 102.259955][ T6345] FAULT_INJECTION: forcing a failure. [ 102.259955][ T6345] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 102.278359][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 102.285935][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 102.339817][ T13] veth1_macvtap: left promiscuous mode [ 102.351749][ T6345] CPU: 1 UID: 0 PID: 6345 Comm: syz.3.96 Not tainted syzkaller #0 PREEMPT(full) [ 102.351775][ T6345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 102.351785][ T6345] Call Trace: [ 102.351791][ T6345] [ 102.351798][ T6345] dump_stack_lvl+0x16c/0x1f0 [ 102.351823][ T6345] should_fail_ex+0x512/0x640 [ 102.351846][ T6345] _copy_from_iter+0x29f/0x1720 [ 102.351876][ T6345] ? __pfx__copy_from_iter+0x10/0x10 [ 102.351897][ T6345] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 102.351929][ T6345] copy_page_from_iter+0xde/0x180 [ 102.351954][ T6345] tun_build_skb.constprop.0+0x2e8/0x1500 [ 102.351988][ T6345] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 102.352010][ T6345] ? unwind_get_return_address+0x59/0xa0 [ 102.352031][ T6345] ? arch_stack_walk+0xa6/0x100 [ 102.352067][ T6345] ? _kstrtoull+0x145/0x200 [ 102.352083][ T6345] ? __pfx__kstrtoull+0x10/0x10 [ 102.352104][ T6345] tun_get_user+0x14ae/0x3ce0 [ 102.352139][ T6345] ? __pfx_tun_get_user+0x10/0x10 [ 102.352163][ T6345] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 102.352190][ T6345] ? find_held_lock+0x2b/0x80 [ 102.352212][ T6345] ? tun_get+0x191/0x370 [ 102.352238][ T6345] tun_chr_write_iter+0xdc/0x210 [ 102.352263][ T6345] vfs_write+0x7d0/0x11d0 [ 102.352282][ T6345] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 102.352308][ T6345] ? __pfx_vfs_write+0x10/0x10 [ 102.352324][ T6345] ? find_held_lock+0x2b/0x80 [ 102.352360][ T6345] ksys_write+0x12a/0x250 [ 102.352378][ T6345] ? __pfx_ksys_write+0x10/0x10 [ 102.352402][ T6345] do_syscall_64+0xcd/0x4c0 [ 102.352424][ T6345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.352441][ T6345] RIP: 0033:0x7f74fdf8d69f [ 102.352456][ T6345] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 102.352471][ T6345] RSP: 002b:00007f74feeba000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 102.352488][ T6345] RAX: ffffffffffffffda RBX: 00007f74fe1b5fa0 RCX: 00007f74fdf8d69f [ 102.352499][ T6345] RDX: 0000000000000016 RSI: 00002000000001c0 RDI: 00000000000000c8 [ 102.352509][ T6345] RBP: 00007f74feeba090 R08: 0000000000000000 R09: 0000000000000000 [ 102.352519][ T6345] R10: 0000000000000016 R11: 0000000000000293 R12: 0000000000000001 [ 102.352529][ T6345] R13: 00007f74fe1b6038 R14: 00007f74fe1b5fa0 R15: 00007ffc2a185858 [ 102.352553][ T6345] [ 102.367316][ T13] veth0_macvtap: left promiscuous mode [ 102.420537][ T5854] Bluetooth: hci0: command tx timeout [ 102.833322][ T13] veth1_vlan: left promiscuous mode [ 102.840304][ T13] veth0_vlan: left promiscuous mode [ 103.298696][ T6365] block nbd0: Attempted send on invalid socket [ 103.306154][ T6365] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 103.317556][ T30] audit: type=1400 audit(1756350539.889:262): avc: denied { mounton } for pid=6363 comm="syz.0.101" path="/syzcgroup/unified/syz0" dev="cgroup2" ino=38 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 103.452796][ T30] audit: type=1400 audit(1756350540.009:263): avc: denied { execute } for pid=6363 comm="syz.0.101" path="/21/cpu.stat" dev="tmpfs" ino=127 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 103.584808][ T30] audit: type=1400 audit(1756350540.179:264): avc: denied { shutdown } for pid=6367 comm="syz.2.102" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 103.668630][ T30] audit: type=1400 audit(1756350540.259:265): avc: denied { getopt } for pid=6369 comm="syz.2.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 103.720094][ T30] audit: type=1400 audit(1756350540.309:266): avc: denied { sys_module } for pid=6369 comm="syz.2.103" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 104.197513][ T6359] netlink: 28 bytes leftover after parsing attributes in process `syz.4.100'. [ 104.240598][ T5917] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 104.288728][ T13] team0 (unregistering): Port device team_slave_1 removed [ 104.329995][ T13] team0 (unregistering): Port device team_slave_0 removed [ 104.404180][ T5917] usb 3-1: Using ep0 maxpacket: 16 [ 104.419899][ T5917] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 104.430044][ T5917] usb 3-1: config 0 has no interface number 0 [ 104.444898][ T5917] usb 3-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 104.456993][ T5917] usb 3-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 104.483586][ T5917] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 104.497767][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.512573][ T5917] usb 3-1: Product: syz [ 104.518326][ T5917] usb 3-1: Manufacturer: syz [ 104.527947][ T5917] usb 3-1: SerialNumber: syz [ 104.549191][ T5917] usb 3-1: config 0 descriptor?? [ 104.556185][ T6373] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 104.565991][ T6373] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 104.785838][ T6370] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 104.814306][ T6223] hsr_slave_0: entered promiscuous mode [ 104.830851][ T6370] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 104.833782][ T6223] hsr_slave_1: entered promiscuous mode [ 104.849267][ T6223] debugfs: 'hsr0' already exists in 'hsr' [ 104.858779][ T6223] Cannot create hsr debugfs directory [ 104.872457][ T6360] netlink: 28 bytes leftover after parsing attributes in process `syz.3.98'. [ 104.902164][ T6361] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 104.914915][ T6361] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 104.947893][ T6361] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 104.955389][ T6361] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 105.114876][ T30] audit: type=1400 audit(1756350541.659:267): avc: denied { write } for pid=6381 comm="syz.0.104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 105.176837][ T30] audit: type=1400 audit(1756350541.659:268): avc: denied { nlmsg_write } for pid=6381 comm="syz.0.104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 105.223542][ T6384] input: syz1 as /devices/virtual/input/input6 [ 105.236277][ T30] audit: type=1400 audit(1756350541.809:269): avc: denied { read write } for pid=6383 comm="syz.0.105" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 105.261951][ T30] audit: type=1400 audit(1756350541.809:270): avc: denied { open } for pid=6383 comm="syz.0.105" path="/dev/uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 105.297453][ T30] audit: type=1400 audit(1756350541.809:271): avc: denied { ioctl } for pid=6383 comm="syz.0.105" path="/dev/uinput" dev="devtmpfs" ino=920 ioctlcmd=0x556b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 105.342260][ T30] audit: type=1400 audit(1756350541.919:272): avc: denied { read } for pid=6383 comm="syz.0.105" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 105.486859][ T30] audit: type=1400 audit(1756350541.919:273): avc: denied { open } for pid=6383 comm="syz.0.105" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 105.511898][ T30] audit: type=1400 audit(1756350541.919:274): avc: denied { ioctl } for pid=6383 comm="syz.0.105" path="/dev/dri/card1" dev="devtmpfs" ino=628 ioctlcmd=0x64a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 105.874865][ T5917] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 105.923189][ T5917] asix 3-1:0.251 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 105.957300][ T5917] asix 3-1:0.251: probe with driver asix failed with error -71 [ 105.988176][ T5917] usb 3-1: USB disconnect, device number 5 [ 106.618159][ T6404] FAULT_INJECTION: forcing a failure. [ 106.618159][ T6404] name failslab, interval 1, probability 0, space 0, times 0 [ 106.658272][ T6404] CPU: 0 UID: 0 PID: 6404 Comm: syz.0.108 Not tainted syzkaller #0 PREEMPT(full) [ 106.658295][ T6404] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 106.658303][ T6404] Call Trace: [ 106.658308][ T6404] [ 106.658314][ T6404] dump_stack_lvl+0x16c/0x1f0 [ 106.658334][ T6404] should_fail_ex+0x512/0x640 [ 106.658350][ T6404] ? fs_reclaim_acquire+0xae/0x150 [ 106.658370][ T6404] ? tomoyo_encode2+0x100/0x3e0 [ 106.658390][ T6404] should_failslab+0xc2/0x120 [ 106.658406][ T6404] __kmalloc_noprof+0xd2/0x510 [ 106.658421][ T6404] ? d_absolute_path+0x136/0x1a0 [ 106.658452][ T6404] tomoyo_encode2+0x100/0x3e0 [ 106.658474][ T6404] tomoyo_encode+0x29/0x50 [ 106.658494][ T6404] tomoyo_realpath_from_path+0x18f/0x6e0 [ 106.658521][ T6404] tomoyo_path_number_perm+0x245/0x580 [ 106.658539][ T6404] ? tomoyo_path_number_perm+0x237/0x580 [ 106.658558][ T6404] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 106.658578][ T6404] ? find_held_lock+0x2b/0x80 [ 106.658616][ T6404] ? find_held_lock+0x2b/0x80 [ 106.658632][ T6404] ? hook_file_ioctl_common+0x145/0x410 [ 106.658652][ T6404] ? __fget_files+0x20e/0x3c0 [ 106.658672][ T6404] security_file_ioctl+0x9b/0x240 [ 106.658694][ T6404] __x64_sys_ioctl+0xb7/0x210 [ 106.658718][ T6404] do_syscall_64+0xcd/0x4c0 [ 106.658737][ T6404] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.658752][ T6404] RIP: 0033:0x7fd49838ebe9 [ 106.658765][ T6404] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 106.658779][ T6404] RSP: 002b:00007fd4991c2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 106.658793][ T6404] RAX: ffffffffffffffda RBX: 00007fd4985b5fa0 RCX: 00007fd49838ebe9 [ 106.658802][ T6404] RDX: 0000200000000000 RSI: 0000000000005412 RDI: 0000000000000003 [ 106.658810][ T6404] RBP: 00007fd4991c2090 R08: 0000000000000000 R09: 0000000000000000 [ 106.658818][ T6404] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 106.658827][ T6404] R13: 00007fd4985b6038 R14: 00007fd4985b5fa0 R15: 00007ffe4250e098 [ 106.658847][ T6404] [ 106.658862][ T6404] ERROR: Out of memory at tomoyo_realpath_from_path. [ 106.708198][ T6223] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 106.815976][ C1] vkms_vblank_simulate: vblank timer overrun [ 106.840538][ T5917] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 106.927011][ T6223] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 107.008990][ T6223] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 107.036621][ T6223] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 107.063798][ T5917] usb 3-1: config 0 has an invalid interface number: 50 but max is 0 [ 107.071962][ T5917] usb 3-1: config 0 has no interface number 0 [ 107.093143][ T5917] usb 3-1: New USB device found, idVendor=0b48, idProduct=1009, bcdDevice=87.f7 [ 107.139954][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.180580][ T5917] usb 3-1: Product: syz [ 107.190537][ T5961] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 107.200526][ T5917] usb 3-1: Manufacturer: syz [ 107.223083][ T5917] usb 3-1: SerialNumber: syz [ 107.274273][ T5917] usb 3-1: config 0 descriptor?? [ 107.339271][ T5917] ttusb_dec_send_command: command bulk message failed: error -22 [ 107.352410][ T5961] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 107.363944][ T5917] ttusb-dec 3-1:0.50: probe with driver ttusb-dec failed with error -22 [ 107.375745][ T5961] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.444470][ T5961] usb 5-1: config 0 descriptor?? [ 107.488005][ T5961] cp210x 5-1:0.0: cp210x converter detected [ 107.504733][ T6223] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.566736][ T6223] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.646480][ T30] audit: type=1400 audit(1756350544.229:275): avc: denied { map } for pid=6401 comm="syz.2.107" path="socket:[10628]" dev="sockfs" ino=10628 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 107.648105][ T5917] usb 3-1: USB disconnect, device number 6 [ 107.669388][ C1] vkms_vblank_simulate: vblank timer overrun [ 107.696347][ T6433] netlink: 28 bytes leftover after parsing attributes in process `syz.0.112'. [ 107.761336][ T6435] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 107.876453][ T6435] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 107.889806][ T6410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 107.909227][ T5961] cp210x 5-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 107.949134][ T6410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 108.030496][ T6435] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 108.103086][ T6435] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 108.110793][ T5961] usb 5-1: cp210x converter now attached to ttyUSB0 [ 108.240261][ T1100] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.247508][ T1100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.261774][ T6410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 108.272025][ T6410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 108.342470][ T9] usb 5-1: USB disconnect, device number 3 [ 108.366966][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 108.376974][ T1100] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.384150][ T1100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.589024][ T9] cp210x 5-1:0.0: device disconnected [ 108.609781][ T30] audit: type=1400 audit(1756350545.059:276): avc: denied { map } for pid=6449 comm="syz.2.115" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 108.745849][ T6453] random: crng reseeded on system resumption [ 108.856150][ T6460] 9pnet_fd: Insufficient options for proto=fd [ 109.066271][ T6223] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 109.870476][ T6478] netlink: 40 bytes leftover after parsing attributes in process `syz.4.120'. [ 110.020076][ T6478] netlink: 4 bytes leftover after parsing attributes in process `syz.4.120'. [ 110.149962][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 110.149974][ T30] audit: type=1400 audit(1756350546.739:285): avc: denied { read } for pid=6483 comm="syz.2.121" name="sg0" dev="devtmpfs" ino=770 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 110.251965][ T6484] binder: 6483:6484 ioctl c0306201 200000000140 returned -14 [ 110.261659][ T30] audit: type=1400 audit(1756350546.779:286): avc: denied { open } for pid=6483 comm="syz.2.121" path="/dev/sg0" dev="devtmpfs" ino=770 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 110.285390][ C1] vkms_vblank_simulate: vblank timer overrun [ 110.320870][ T5904] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 110.330023][ T30] audit: type=1400 audit(1756350546.779:287): avc: denied { map } for pid=6483 comm="syz.2.121" path="/dev/sg0" dev="devtmpfs" ino=770 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 110.353673][ C1] vkms_vblank_simulate: vblank timer overrun [ 110.416061][ T30] audit: type=1400 audit(1756350546.789:288): avc: denied { ioctl } for pid=6483 comm="syz.2.121" path="/dev/sg0" dev="devtmpfs" ino=770 ioctlcmd=0x9403 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 110.843279][ T43] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 110.890549][ T5904] usb 4-1: Using ep0 maxpacket: 16 [ 110.904636][ T30] audit: type=1400 audit(1756350546.799:289): avc: denied { read } for pid=6483 comm="syz.2.121" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 110.946330][ T5904] usb 4-1: config 0 has no interfaces? [ 111.043476][ T43] usb 5-1: Using ep0 maxpacket: 8 [ 111.059137][ T43] usb 5-1: unable to get BOS descriptor or descriptor too short [ 111.074518][ T5904] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 111.096245][ T6223] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.103255][ T5904] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 111.124870][ T5904] usb 4-1: Manufacturer: syz [ 111.132576][ T43] usb 5-1: config 4 has an invalid interface number: 30 but max is 0 [ 111.162123][ T30] audit: type=1400 audit(1756350546.799:290): avc: denied { open } for pid=6483 comm="syz.2.121" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 111.191411][ T43] usb 5-1: config 4 has no interface number 0 [ 111.192042][ T5904] usb 4-1: config 0 descriptor?? [ 111.197527][ T43] usb 5-1: config 4 interface 30 has no altsetting 0 [ 111.219589][ T30] audit: type=1400 audit(1756350546.799:291): avc: denied { ioctl } for pid=6483 comm="syz.2.121" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 111.256903][ T43] usb 5-1: string descriptor 0 read error: -22 [ 111.260098][ T6223] veth0_vlan: entered promiscuous mode [ 111.289207][ T43] usb 5-1: New USB device found, idVendor=9022, idProduct=d484, bcdDevice=ff.88 [ 111.312818][ T30] audit: type=1400 audit(1756350546.799:292): avc: denied { set_context_mgr } for pid=6483 comm="syz.2.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 111.334357][ T30] audit: type=1400 audit(1756350546.839:293): avc: denied { write } for pid=6483 comm="syz.2.121" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 111.362880][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.362894][ T30] audit: type=1400 audit(1756350546.839:294): avc: denied { map } for pid=6483 comm="syz.2.121" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 111.401621][ T6223] veth1_vlan: entered promiscuous mode [ 111.416810][ T43] dvb-usb: found a 'TeVii S482 (tuner 2)' in warm state. [ 111.430978][ T43] dw2102: su3000_power_ctrl: 1, initialized 0 [ 111.444543][ T6223] veth0_macvtap: entered promiscuous mode [ 111.478902][ T43] dvb-usb: bulk message failed: -22 (2/0) [ 111.498308][ T6223] veth1_macvtap: entered promiscuous mode [ 111.516195][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 111.565890][ T43] dvbdev: DVB: registering new adapter (TeVii S482 (tuner 2)) [ 111.668839][ T6488] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI [ 111.680918][ T6488] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 111.689303][ T6488] CPU: 0 UID: 0 PID: 6488 Comm: syz.4.122 Not tainted syzkaller #0 PREEMPT(full) [ 111.698468][ T6488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 111.708493][ T6488] RIP: 0010:su3000_i2c_transfer+0x610/0xf30 [ 111.714364][ T6488] Code: e4 bf f9 48 8d 7b 08 48 89 f8 48 c1 e8 03 42 80 3c 38 00 0f 85 1a 08 00 00 48 8b 5b 08 48 89 d8 48 89 da 48 c1 e8 03 83 e2 07 <42> 0f b6 04 38 38 d0 7f 08 84 c0 0f 85 eb 07 00 00 48 8b 44 24 10 [ 111.733953][ T6488] RSP: 0018:ffffc9000531fc40 EFLAGS: 00010246 [ 111.740018][ T6488] RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffffc9000bd69000 [ 111.747983][ T6488] RDX: 0000000000000000 RSI: ffffffff87fba7d9 RDI: ffff888032cc5d88 [ 111.755943][ T6488] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000001a00 [ 111.763902][ T6488] R10: 0000000000001900 R11: 0000000000000001 R12: ffff888058654d00 [ 111.771865][ T6488] R13: 0000000000001900 R14: 0000000000000001 R15: dffffc0000000000 [ 111.779829][ T6488] FS: 00007f68632106c0(0000) GS:ffff8881246b9000(0000) knlGS:0000000000000000 [ 111.788754][ T6488] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 111.795331][ T6488] CR2: 000000110c3ddda4 CR3: 0000000074dda000 CR4: 00000000003526f0 [ 111.803296][ T6488] Call Trace: [ 111.806563][ T6488] [ 111.809484][ T6488] __i2c_transfer+0x6b6/0x2190 [ 111.814254][ T6488] ? lockdep_hardirqs_on+0x7c/0x110 [ 111.819447][ T6488] ? __pfx___i2c_transfer+0x10/0x10 [ 111.824645][ T6488] ? rt_mutex_slowtrylock+0xc9/0x100 [ 111.829926][ T6488] i2c_transfer+0x1da/0x380 [ 111.834408][ T6488] i2cdev_ioctl_rdwr+0x373/0x710 [ 111.839323][ T6488] i2cdev_ioctl+0x5ff/0x820 [ 111.843800][ T6488] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 111.848799][ T6488] ? selinux_file_ioctl+0x180/0x270 [ 111.853971][ T6488] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 111.858971][ T6488] __x64_sys_ioctl+0x18b/0x210 [ 111.863712][ T6488] do_syscall_64+0xcd/0x4c0 [ 111.868187][ T6488] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.874064][ T6488] RIP: 0033:0x7f686238ebe9 [ 111.878450][ T6488] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 111.898029][ T6488] RSP: 002b:00007f6863210038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 111.906422][ T6488] RAX: ffffffffffffffda RBX: 00007f68625b5fa0 RCX: 00007f686238ebe9 [ 111.914366][ T6488] RDX: 0000200000000080 RSI: 0000000000000707 RDI: 0000000000000004 [ 111.922306][ T6488] RBP: 00007f6862411e19 R08: 0000000000000000 R09: 0000000000000000 [ 111.930247][ T6488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 111.938188][ T6488] R13: 00007f68625b6038 R14: 00007f68625b5fa0 R15: 00007ffef89a4288 [ 111.946135][ T6488] [ 111.949124][ T6488] Modules linked in: [ 111.953475][ T6488] ---[ end trace 0000000000000000 ]--- [ 112.109921][ T43] usb 5-1: media controller created [ 112.117663][ T6488] RIP: 0010:su3000_i2c_transfer+0x610/0xf30 [ 112.129605][ T6223] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.161357][ T6488] Code: e4 bf f9 48 8d 7b 08 48 89 f8 48 c1 e8 03 42 80 3c 38 00 0f 85 1a 08 00 00 48 8b 5b 08 48 89 d8 48 89 da 48 c1 e8 03 83 e2 07 <42> 0f b6 04 38 38 d0 7f 08 84 c0 0f 85 eb 07 00 00 48 8b 44 24 10 [ 112.188852][ T6223] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.231413][ T6488] RSP: 0018:ffffc9000531fc40 EFLAGS: 00010246 [ 112.237570][ T1100] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.247561][ T1127] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.256907][ T6488] RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffffc9000bd69000 [ 112.266115][ T6488] RDX: 0000000000000000 RSI: ffffffff87fba7d9 RDI: ffff888032cc5d88 [ 112.275038][ T1127] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.283808][ T1127] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.292758][ T6488] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000001a00 [ 112.301004][ T6488] R10: 0000000000001900 R11: 0000000000000001 R12: ffff888058654d00 [ 112.308996][ T6488] R13: 0000000000001900 R14: 0000000000000001 R15: dffffc0000000000 [ 112.317861][ T6488] FS: 00007f68632106c0(0000) GS:ffff8881247b9000(0000) knlGS:0000000000000000 [ 112.329862][ T6223] ieee80211 phy13: Selected rate control algorithm 'minstrel_ht' [ 112.340037][ T6488] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 112.348787][ T6488] CR2: fffffffffd000000 CR3: 0000000074dda000 CR4: 00000000003526f0 [ 112.357235][ T6488] Kernel panic - not syncing: Fatal exception [ 112.363485][ T6488] Kernel Offset: disabled [ 112.367799][ T6488] Rebooting in 86400 seconds..