last executing test programs: 11m30.773510438s ago: executing program 1 (id=185): syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) socket(0x10, 0x3, 0x0) socket$l2tp(0x2, 0x2, 0x73) socket$inet(0xa, 0x1, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) socket$inet6_icmp(0xa, 0x2, 0x3a) syz_open_procfs(0x0, &(0x7f00000002c0)='net/ip_tables_targets\x00') socket(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @loopback}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 11m30.602005099s ago: executing program 1 (id=188): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffffff, 0x0, 0xa) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000012c0)) r2 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f0000000100)=r3, 0x4) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r4 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r4, 0x80047c05, &(0x7f0000000080)) syz_open_dev$radio(0x0, 0x1, 0x2) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, 0x0, 0x0) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r6, 0x4008af00, &(0x7f00000001c0)=0x304008000) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f00000003c0)={0x1}) capget(&(0x7f0000000080)={0x19980330}, &(0x7f00000003c0)={0x9, 0x3, 0x6, 0x4, 0xfffffffd, 0x7fff}) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000001a00010026bd70000000000002002000", @ANYRES32=0x0, @ANYBLOB="b15d0000080002000c00000014000100fc0200000000000000000000000000008aa0895ed9c36e6ddbf8b873b5e649cea0acf6c70be294a5c6965d99b863d3951d4bd8b8953e7086702ec2fcbf7e795decc8fd34211b6d52de82f837c48731"], 0x38}, 0x1, 0x0, 0x0, 0x20040050}, 0x0) mount(&(0x7f0000000140)=@loop={'/dev/loop', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='omfs\x00', 0x200008, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 11m26.305508639s ago: executing program 1 (id=199): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x80400, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000200)=0x8001100) r2 = socket$inet6(0xa, 0x5, 0x9183) setsockopt$inet6_int(r2, 0x29, 0x35, 0x0, 0x0) bind$inet6(r2, 0x0, 0x0) openat$misdntimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={{0xc0}, [@NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x68, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x58, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x40, 0x3, "3318000058a8056dd9a87f963d140de6993ac869f3a8609133b07523679abf4579f9cd656422a633a39f030000000000000000000000010000000000"}, @NFTA_TARGET_NAME={0xa, 0x1, 'HMARK\x00'}, @NFTA_TARGET_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc0}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000003740)=@newtaction={0xeb8, 0x30, 0xb, 0x0, 0x0, {}, [{0xea4, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80006}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_pedit={0xe58, 0x2, 0x0, 0x0, {{0xa}, {0xe2c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x5, 0xa, 0x4, 0x1, 0x2000000}, 0x5, 0x1}, [{0x9, 0x80000001, 0x1, 0x630, 0x8, 0x1}, {0xdf, 0x4, 0x5, 0x5, 0x10, 0xe}, {0x1, 0x85a, 0x5, 0xe6db, 0x3, 0xfffffffc}, {0x6, 0x400, 0x9321, 0x9, 0x6, 0x7}, {0x5, 0x5, 0xffffffc0, 0x80, 0x3}, {0xe, 0xf5, 0x3, 0x9, 0xffffbff8, 0x3}, {0x0, 0x7, 0xfff, 0x2, 0x9163ef6c, 0x80003}, {0x3, 0x3, 0x80, 0x0, 0xacc4, 0x2}, {0x8001, 0xffb, 0x9, 0xffff, 0xfffffffe, 0x81}, {0x8, 0xfff, 0x6, 0xeb84, 0x8, 0x30c4}, {0x7, 0x9, 0xfffffffc, 0x100, 0x4}, {0x8004, 0x80000001, 0xfffffeff, 0xdf, 0x4, 0x5}, {0x7, 0x80000001, 0x9, 0x7, 0x1000, 0x7}, {0x5, 0x2, 0xfffffffd, 0x9, 0x474, 0x594}, {0x7fffffff, 0x1, 0x8, 0xfffffff9, 0x6, 0xffffffff}, {0x24, 0x5, 0xf, 0x6, 0x6, 0x8000003}, {0xbb, 0x5, 0x2, 0x310, 0xf}, {0x9b7d, 0x52fc, 0x3, 0x3, 0x48, 0x9}, {0xbd, 0x8, 0x10, 0xe4d, 0x7f, 0x3}, {0x8, 0x8, 0x9, 0x27, 0x2, 0x5}, {0x4, 0x1000, 0x5, 0x6, 0x93e, 0x6}, {0x1, 0x7, 0x0, 0x1, 0xff, 0x3}, {0xb, 0x7f, 0xfffff419, 0x1, 0x3ff, 0x9}, {0x4, 0x8, 0x7, 0xb, 0x8, 0x80004d}, {0x34db, 0xffff, 0x0, 0x3ff, 0x1, 0x400}, {0xf, 0xcb1d, 0x8, 0x1, 0x0, 0x4}, {0x5, 0x3, 0x7, 0x8, 0x3, 0x984}, {0x2, 0xffffffff, 0x3, 0x2, 0x9, 0x40}, {0x7, 0x281, 0x7fffffff, 0x381, 0x3, 0x8}, {0x5, 0x4, 0x1, 0x8, 0x4, 0x2f}, {0x6, 0x3, 0x4, 0xd1a1, 0x9, 0x7}, {0x5, 0x3, 0x8, 0x4, 0x16, 0x2}, {0x8001, 0x87, 0x6, 0x1, 0x3, 0x4}, {0x6, 0x9e4, 0x8b7f, 0x11, 0x3, 0x7}, {0x7, 0x1, 0x800, 0x70f, 0x8001, 0x3}, {0x4, 0x10, 0x6, 0x1, 0x4, 0x22ff}, {0x5, 0x10001, 0x9, 0x0, 0x10001, 0x7}, {0xf85, 0x2e, 0x100, 0x3, 0x100, 0xe60c}, {0x2, 0x5, 0x1, 0xe000000}, {0x4e2, 0x6b0, 0x2, 0x100, 0x4, 0xd}, {0x1, 0xcad, 0xa5, 0x2, 0x4d800, 0x33}, {0x20, 0x7f, 0x33, 0x2, 0x400, 0x4}, {0x4, 0x62e, 0xb, 0x219c, 0x0, 0x5}, {0x0, 0x4, 0x0, 0x1, 0x1, 0x1}, {0x7f, 0x945a, 0x0, 0x0, 0x8, 0x3}, {0xda1, 0x893, 0x2, 0x9, 0xfffffa2e, 0x6}, {0x1, 0xfffffff3, 0x7fffffff, 0x8, 0x0, 0x1}, {0x2, 0x8, 0x2, 0xe, 0x2, 0x2}, {0x6, 0x100, 0xe, 0x10000, 0x5, 0x7}, {0x0, 0x6, 0x7, 0x4, 0xc, 0x800}, {0x8, 0x10000, 0x1, 0x1, 0x7}, {0x7d5, 0x2, 0x4, 0x800, 0xf}, {0x1, 0x5, 0x6, 0x2, 0x8, 0xc}, {0x2, 0x1, 0x3, 0xc, 0x1, 0x2c3}, {0x1000, 0x3, 0xbc, 0x8001, 0xfa, 0x8}, {0x2, 0x3, 0x9, 0x50e, 0x55ac, 0xa5e2}, {0x0, 0x196680, 0xffffff91, 0x100, 0x3, 0x7}, {0x4, 0x4, 0x2, 0x1, 0x0, 0xe}, {0xfffffff5, 0x8, 0x7023, 0x8, 0x5, 0x851}, {0x3, 0x78, 0x7, 0xa, 0x5dec4cac, 0x6}, {0x4, 0x9, 0x3a, 0x2, 0x8, 0x602}, {0x4, 0x7fffffff, 0x0, 0x8, 0x8, 0xff}, {0x7, 0xfffffff1, 0x2f2c, 0x400, 0x6, 0x6}, {0x10001, 0x81, 0x40, 0x2, 0x89, 0x2}, {0x2, 0x8550, 0x4c, 0x3, 0xfffffffa, 0x736d}, {0x7f, 0x199, 0x5, 0x9, 0x7, 0x2}, {0x7, 0x1, 0x9, 0x7, 0x2, 0x7}, {0x9, 0x3f1, 0x4, 0x5, 0x5, 0x8}, {0x100, 0x3ff, 0x4, 0x7f53, 0x7, 0x1}, {0x3ff, 0xc, 0x4, 0x1, 0x4, 0x4}, {0x9, 0x381, 0xfff, 0x5d7c, 0x0, 0x8001}, {0x8, 0x0, 0x7, 0xfffffffb, 0x3ee, 0x4}, {0xbfffffe, 0x6, 0x101, 0x5, 0x400, 0x400}, {0x7fff, 0xb3, 0x2, 0x10000, 0x6, 0x14}, {0x0, 0x1, 0x4c90, 0x4, 0x7f, 0x8}, {0x5, 0x25b, 0xe9, 0x3, 0x2, 0x2}, {0x29dbdf0, 0xd, 0xfffffffd, 0x7, 0x6, 0x3}, {0x7, 0x1, 0xa, 0x8, 0x5, 0x5}, {0x473, 0x8, 0x2, 0x400, 0x4000000, 0x69b3d6e6}, {0x1, 0xb7bb, 0x22800000, 0x3, 0x10, 0x9}, {0x7f, 0x4, 0x6, 0xffffffff, 0x3, 0x8}, {0xfffffff7, 0x80000000, 0xa, 0x40, 0x863, 0x2}, {0xb, 0x9, 0xc, 0x3c1, 0x6e, 0x40}, {0x6, 0xd, 0x6, 0xfb0000, 0x1, 0x7}, {0xe0, 0x100, 0x1, 0x7, 0x8, 0x7}, {0xfff, 0x1, 0x0, 0x38, 0x0, 0x9}, {0x82, 0x10, 0x401, 0x0, 0x4, 0xef}, {0x7, 0x2, 0x200, 0x8, 0x9, 0x2}, {0x54, 0x5, 0xa33f, 0x101, 0x2, 0x10001}, {0x1, 0x4, 0x800004, 0x10001, 0x2, 0xce}, {0x4, 0x8, 0x8, 0x3, 0xf, 0x9}, {0x6, 0x5, 0x8, 0xffffffff, 0x405b9, 0x6}, {0x9, 0x0, 0x9, 0x2, 0x9}, {0x0, 0x2, 0xb, 0x7fffffff, 0xfc0, 0x7f1b4893}, {0x4, 0xd, 0xc, 0x4, 0x7, 0x4}, {0x4, 0x5, 0xe, 0x3, 0x3dcb, 0x9}, {0x200, 0x0, 0xe8, 0x1, 0x800000d4, 0x1}, {0xc651, 0x5f83, 0x2, 0x1, 0xd, 0x8}, {0xfff, 0x5, 0x1, 0x0, 0x49, 0x5}, {0x5, 0x3, 0x7, 0x97fd, 0xef, 0x202}, {0x2, 0xa, 0x1000, 0x1, 0x6, 0xe0}, {0x800, 0x4c, 0x7, 0x0, 0xfffffff7, 0x9}, {0x6, 0xffff, 0xffff8001, 0xa, 0xae36, 0x8}, {0xcfb7, 0x0, 0x101, 0x2, 0x1, 0x1aca}, {0x6, 0x800, 0xec3d, 0xffffffff, 0xea5, 0x3}, {0x9, 0x5, 0x2, 0x0, 0x0, 0xdd}, {0x6, 0x6, 0x0, 0x1e9, 0x6, 0x1}, {0x3, 0x7, 0x7, 0x3, 0x400, 0x81}, {0x970, 0x100, 0xb2eb, 0x2, 0x3, 0x9}, {0x3, 0x6, 0x8, 0x7, 0xd, 0x474c}, {0xf, 0x101, 0x9a, 0x1000, 0x2, 0xfffffffc}, {0x3, 0x98e, 0x1a5e666b, 0x10, 0x7, 0x9}, {0xfffffffb, 0x3, 0x3, 0x2ee8000, 0x8}, {0x3, 0x2, 0x2, 0x3, 0x3, 0x2}, {0x7, 0x4, 0x1, 0x7, 0x101, 0xef}, {0x709e, 0x9, 0x425b597f, 0x1, 0x2, 0x7}, {0x6, 0xc000000, 0x3ff, 0x4, 0x8, 0x5}, {0x3, 0x6, 0x7, 0xfffffff9, 0x0, 0xffffffff}, {0x7, 0x9, 0x8, 0x0, 0x9, 0xd6}, {0x24, 0x10001, 0x6, 0x1, 0x39d6}, {0x401, 0x7d4, 0x9, 0x8000, 0xffff, 0x7}, {0x6, 0x92e4, 0x130, 0x0, 0x4, 0x9}, {0x1, 0x7fff, 0x7, 0x8001, 0x8, 0x5}, {0x7e, 0x800, 0xfffffff9, 0xa, 0x4b64, 0x80000001}, {0x2ad78a25, 0x2, 0x6, 0x6, 0x4, 0x8}, {0x2, 0x9, 0x0, 0x8a7, 0x129, 0xc}, {0x7, 0x2, 0x8, 0x3, 0xe01, 0xf933271}, {0x4a3, 0x0, 0x3, 0x514c, 0xf8b, 0x19}], [{0x5}, {0x4, 0x1}, {}, {0x1}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x1}, {0x2}, {0x0, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x4}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x5}, {0x3}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x4}, {0x5}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x1}, {}, {0x3, 0x1}, {0x4}, {0x1}, {0x1, 0x1}, {0x4}, {0x5}, {0x3, 0x1}, {0x1}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x4, 0x1}, {0x2}, {0x3}, {0x5, 0x1}, {0x1}, {0x1}, {0x3}, {0x5, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x4}, {0x5}, {0x1, 0x1}, {}, {0x3}, {0x0, 0x1}, {0x5}, {0x4}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x5}, {0x9, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x1}, {0x1}, {0x2, 0x1}, {0x6, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3, 0x1}, {0x1}, {0x2}, {0x2}, {0x5}, {0x3, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2}, {0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x5}, {0x4}, {0x2, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x0, 0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x4}, {0x5, 0x1}, {0x1, 0x1}, {0x4}, {0x1, 0x1}, {0x4, 0x1}, {0x6, 0x1}, {0x5, 0x1}]}}, @TCA_PEDIT_KEYS_EX={0x8, 0x5, 0x0, 0x1, [{0x4}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xeb8}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) connect$can_j1939(r6, &(0x7f0000000140)={0x1d, r7}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000300)={'ip6gre0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x81, 0xc, 0x1, @remote, @rand_addr=' \x01\x00', 0x1, 0x8000, 0xb78, 0x6be0db0a}}) close_range(r0, 0xffffffffffffffff, 0x0) 11m25.186554754s ago: executing program 1 (id=206): mkdir(&(0x7f0000000080)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000180)="a1", 0x1}], 0x1) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r3 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f00000000c0)) r4 = fsmount(r3, 0x0, 0x0) r5 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_QBUF(r5, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x2, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) fchdir(r4) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x9, 0x1d, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0xfca804a0, 0x8, 0xc, &(0x7f0000000400)="b800000500000000", &(0x7f00000001c0)=""/12, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x4}, 0x50) 11m23.756546713s ago: executing program 1 (id=208): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000020ef17ee600000000000010902240001000000000904000901030022000921010000012205000905810300"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) unshare(0x24020400) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000002c0)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x149002, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) connect$rxrpc(r1, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x24) sendmsg$inet(r1, &(0x7f0000000180)={0x0, 0xfffffffffffffd6b, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x18, 0x110}}], 0x18, 0x4c00}, 0x0) r2 = socket(0x40000000015, 0x5, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) bind$inet(r2, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x40, &(0x7f00000000c0)=0x3, 0x4) sendto$inet(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000d80), 0x36f, 0x20102, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) 11m21.958779928s ago: executing program 1 (id=214): socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x40) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f0000000180), 0x400008a, 0x0) sendmsg$key(r1, &(0x7f0000000000)={0x9, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x2, 0x9, 0x0, 0x9, 0x2, 0x0, 0xffffffff, 0x25dfdbfe}, 0x10}}, 0x0) 11m21.615002718s ago: executing program 32 (id=214): socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x40) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f0000000180), 0x400008a, 0x0) sendmsg$key(r1, &(0x7f0000000000)={0x9, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x2, 0x9, 0x0, 0x9, 0x2, 0x0, 0xffffffff, 0x25dfdbfe}, 0x10}}, 0x0) 11.999956915s ago: executing program 0 (id=2505): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x14) mkdir(&(0x7f0000000380)='./file1\x00', 0xa) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000003c0)='./file1\x00', &(0x7f0000000040)='befs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x100, 0x0) r2 = open(&(0x7f0000000140)='./file1\x00', 0x0, 0x367) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r1, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r3, {0x1}}, './file0\x00'}) r4 = socket(0x1e, 0x4, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000080)={'bridge0\x00', 0x2}) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) r5 = socket(0x1e, 0x4, 0x0) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r6, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000000)=ANY=[@ANYBLOB="10000000151401"], 0x10}}, 0x40) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000180)=@req3={0x8355, 0x4, 0x5, 0xfffffff3, 0xc8, 0xd, 0x1}, 0x1c) socket(0x2b, 0x80000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_usb_connect(0x2, 0x3f, &(0x7f0000000640)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20", @ANYBLOB="74a542f90d7a859dce9121cebb2b0c95f496885067a558fe07296cbf61bda60e7aae378b321c1c9c98ce1dd4c8583814fd9cf69d39c15136e9fcfa1abd09ebdc8a91bee628c20b6d007fb46f68f63cdd31ceb9f7516a5a9edf20f2db65e8e1001f03f47dcc7403c073b62f71e9e6635a9e493a28872cf4075b55c133094fd292845b327cd585b24c4e3c1571a42fdc6848247a51bfa6bcfe8138a7ccda2ecb77ec242ae4ee1b5e6f9e9357ca9308746cc1c4c5908f050181f9b1f88e1097a25740a492a5563c3878200cc8ba5e7a8c1a5010dcba999c7a3efe7d4a2fe0f4d1a01889bd420bb59a2f5cab26e2fa10f53447689ac63df64e"], 0x0) syz_usb_control_io$printer(r7, 0x0, &(0x7f0000000280)={0x34, &(0x7f00000001c0)=ANY=[@ANYBLOB="208ec855df3891e1a026911a8cc72baf3958c9ab995d190dd8df586fa702c5d4dcf84df2faab7ed5718f329b1209f4a9013f658ee592d4e0ba49671978"], 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r9, 0x5b02, 0x0) close(r4) write$char_usb(r8, 0x0, 0x0) syz_usb_disconnect(r7) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) 6.43282607s ago: executing program 0 (id=2518): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_vlan\x00'}) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x1000)=nil, 0x1000, &(0x7f0000000080)='\x00\x00\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x3, 0x0, 0xe, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r3 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x7) socket$kcm(0x11, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$igmp(0x2, 0x3, 0x2) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000100)={0x0, 0x3, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r5, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0xfffe, 0x7, @mcast2}, {0xa, 0x0, 0xb, @loopback={0xffffffffffffff9d}}, r6}}, 0x48) write$RDMA_USER_CM_CMD_GET_EVENT(r5, &(0x7f0000000280)={0xc, 0x8, 0xfa00, {&(0x7f0000000600)}}, 0x10) setsockopt$MRT_INIT(r4, 0x0, 0xc8, &(0x7f0000000000), 0x4) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f00000002c0)={0x1, 0x4, 0x10, 0x0, @vifc_lcl_addr=@multicast2, @remote}, 0x10) setsockopt$MRT_FLUSH(r4, 0x0, 0xd4, &(0x7f0000000040)=0x5, 0x4) socket$inet_sctp(0x2, 0x5, 0x84) 5.672192904s ago: executing program 2 (id=2520): accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000280)={0x28, 0x0, 0x1, @local}, 0x10, 0x800) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x8000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000000)=""/162, 0xa2) read$FUSE(0xffffffffffffffff, &(0x7f0000000680)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ptrace$PTRACE_GETSIGMASK(0x420a, r0, 0x8, &(0x7f0000000200)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'macvtap0\x00', 0x0}) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000000e0c0)=""/102400, 0x19000) keyctl$clear(0x3, 0xfffffffffffffffd) mkdir(&(0x7f0000000200)='./file0\x00', 0x56) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000380)='devtmpfs\x00', 0x10, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) r6 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @private=0xa010501, 0x0, 0x0, 'none\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000000)={0x11, @loopback, 0x0, 0x0, 'lblc\x00', 0x32, 0x0, 0xffffffff}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r6, 0x0, 0x485, 0x0, 0x0) getdents64(r5, &(0x7f0000002440)=""/4100, 0x1004) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000016c0)=@newqdisc={0x30, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8042, 0x0) 5.001021567s ago: executing program 2 (id=2523): socket$inet6_tcp(0xa, 0x1, 0x0) (async) openat$binfmt_format(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_SEC_TRIM_FILE(r1, 0x4018f514, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x4, 0x8, 0x8001, 0x0, 0xa, 0x0, 0xfffffe0000000003, 0xfa11, 0xffffffff}, 0x0) (async) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000000)={@in6={{0xa, 0x4e24, 0x5, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x9}}, 0x0, 0x0, 0x46, 0x0, "2431d0edd9b36cc84d7df7671eacf04be3b08353efa3641776f56c7556fd3713097bd0072577bc6fefb4cdc9e94e420b0ea4fbc5b07a32056eff5e6c42784b46ddab72b1b8fc87f208ad6db80d8dfe25"}, 0xd8) (async) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0xce24, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}, 0x4c93}}, 0x0, 0x0, 0x2e, 0x0, "aeb81d8ee3a82d67eea9e5bdf2247481041a5b9ccfbc936efc471c56ae3d5f6945d2962285858a891a3b4e7bff572ef69992da867f406182d70f47773434b8349435f2ad628d62a3b45bb98872fb1900"}, 0xd8) (async) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x18) (async) ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, 0x0) (async) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="300200007d00000005bf000000000000000000000000000000000000000000000000000000000000000000000000000000001b00046e6f6465767b65766f6f7e0539c60005000037d93a8b920000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500002b595fcb14034354b9fd9ef196a51cd5157adc8103b494e11400cfc26dd7c500f04cd85f2a70f5e9930e3c5db45a5500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cc280e8e289da649a37002c016f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e439"], 0x230) (async) r3 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x2) (async) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs\x00') (async) r5 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r5, &(0x7f0000000140)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e23, @rand_addr=0x64010100}}, 0x24) (async) listen(r5, 0x4) (async) r6 = epoll_create(0xd) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r3, &(0x7f0000000040)={0x1000000d}) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e21, @loopback}}, 0x8, 0x9, 0x7, 0xb, 0x2, 0x3, 0xcd}, 0x9c) (async) r7 = socket$inet(0x2, 0x1, 0x100) setsockopt$inet_tcp_int(r7, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_opts(r7, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000180)='vlan1\x00', 0xc) 4.573357955s ago: executing program 2 (id=2526): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000fbffffdf00000000000000008500000041000000850000001100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0xc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 4.525636973s ago: executing program 2 (id=2527): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18080000ff0700000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8000000b70300000000000085000000720000009500"/96], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r1}, 0x8) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="14e99038d1b512528c12415f", @ANYRES32=r0], &(0x7f0000000040)='syzkaller\x00', 0x1000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 4.415978166s ago: executing program 3 (id=2528): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@ccm_128={{0x304}, "b39625e03be22ead", "8da0640c9e8f6b81143f1a1a6d81ee2b", "3b0e7088", "19a4216dfdbf6602"}, 0x28) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7bdad446b6ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af9219a1e18c488e827c1bbec", 0x89}], 0x1}, 0x0) 4.296578411s ago: executing program 3 (id=2529): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000280)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000180)=[{0x1, 0x3, {0x0, 0xf0, 0x1}, {0x2, 0x0, 0x4}, 0xff}, {0x2, 0x2, {0x0, 0x0, 0x1}, {0x1, 0x1, 0x2}, 0x0, 0x1}, {0x2, 0x1, {0x2, 0x1, 0x4}, {0x0, 0xf0, 0x3}, 0xfe, 0xff}, {0x1, 0x3, {0x2}, {0x1, 0x0, 0x2}, 0xfd, 0xfd}], 0x80) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xb, 0xfff2}, {0xfff1, 0x9}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0xe0ffff, 0x4012}, 0x20000050) 4.296264138s ago: executing program 2 (id=2530): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r1, &(0x7f0000000580)='1\x00', 0x2) r2 = memfd_create(&(0x7f0000000140)='\x103q}2\x9a\xce\xaf\x03\x86\xe7\xc0\x14\x8f^\xd5\xfd\xa9\r\xac7A\x94\xeb\xcd\t\x00\x90k\xd6\x05\r\x84\x87\x1c\b\x8c`\xea\x13A\x90m\xb6&\xd0\x9daA\xc5\xb8_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2_\xdb\xc0\x8b\x19\x17\xb7Rvd\xcb:\b\xeeC0\xa3\xa6\xcf\x00\x00\xac\xc5h&+\t\x98\'\xfd|\x11\x99\xa2*6{\xd2C>2\x0e\"\xbc\xda\xee\xb0\xd8\xbf\xaf)\xf58c\x189K\x82\xd1(\xceY*\xcb\x9b\xbdn\x8e\x98m\x10L\xec\xfdWF\x7fj\x19\xb8<\xd2\x9d\xf0\xe9Qy\xe32\xed\x04f\xfe&\x1a\xdb\xeb\xad\xaaE\b\xa9\xf8\xa9s\xc4d\xd4\x03\xf1\xb7xO\x99\x804m[A\x00\x80\x02\xf0\x84c2s\xd5P\t`\x9b\x12&\x8cx\x8eg\x9d\xe6g`\xc2L\xed\xdc\xc5\rPe\xaa@wu\xe5\xa7\x1aM\x1f\xb43\n\xbb\x02J\xce_\xcc\x13?\x8a\xc2\x18u\xf8H\xd1@\x8aO\xddA^\xc2\x15\xbe\"\xfb\x81\xb7\xf2\f\xae\x83\x0era\x9c9\xdc\xa4T\x03\x15\xeda\x1cW\x84O9\xbe\x9ee\x05\xaa\xd1\xd4\xe39\xaa\\\x9d\xa9\x02\xbct\xca\xcd\xee\x8e\xd4p\xa1G\xfap\xad\xff\x83\xecsd\x13)\xdc\xc2V\x01\xaer~F\x9e9+Z\xfch\xb3\xf80xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x50) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCNOTTY(r7, 0x5422) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) lseek(0xffffffffffffffff, 0xffffffffffffffff, 0x1) r8 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0xb, &(0x7f0000000840)=@framed={{}, [@printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x39}}]}, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendfile(r8, r6, 0x0, 0x3a) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001200010a000000000000000011000000f52a82fe1cf2f3e381eae5a3b301f77d51b23cac53956d15dcfcb7a97289e9bc7db7e77108ee18730564f5e1df5ef9883f6d"], 0x14}, 0x1, 0x0, 0x0, 0x4080}, 0x0) userfaultfd(0x80001) 4.295951434s ago: executing program 5 (id=2531): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f00000002c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000010, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, 0x0, 0x2a, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20004882) r4 = socket(0x10, 0x803, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x700000000000000}, 0x0) 4.117955241s ago: executing program 0 (id=2532): openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/mdstat\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140), 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000000c0)={0x1, [0x0]}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000001c0)={r1, @in6={{0xa, 0x4e23, 0x9e0, @empty, 0x1}}, 0x7dd3, 0x0, 0x400, 0x7, 0x3b0, 0x81, 0x6}, 0x9c) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000000)={r1, 0x1000}, 0x8) r2 = fsopen(&(0x7f0000000180)='gfs2meta\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) epoll_create1(0x0) r3 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) r4 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) r6 = socket$kcm(0x21, 0x6, 0x2) sendmsg$kcm(r6, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x2000, 0x2, 0x10, {0x2, 0x1, @private}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x20000800) syz_usb_connect(0x6, 0x0, 0x0, 0x0) read$FUSE(r6, &(0x7f0000000b00)={0x2020}, 0x2020) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0xfffffffffffffdb5, &(0x7f0000000200)=0x400000bce) r7 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r7, &(0x7f0000000680)=""/102392, 0x18ff8) tkill(r4, 0xb) 3.745376209s ago: executing program 5 (id=2533): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x38, 0x10, 0x503, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x50307, 0x2a2e3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_ROLE={0x8, 0x4, 0x10}]}}}]}, 0x38}, 0x1, 0xfeff0000, 0x0, 0x1}, 0x0) 3.55274364s ago: executing program 5 (id=2534): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x2, 0x3, 0x2) recvmsg$kcm(r1, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x18000) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000340), 0x20200, 0x0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff}, 0x0) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a80)={0x6, 0x1e, &(0x7f0000000ec0)=ANY=[@ANYBLOB="1800000008000000000000000200000018110000", @ANYRESDEC=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018310000030000000000000000000000180000ef0500000000000000020000001844000004000000000000000000000085200000050000009500000000000000851000000300000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f00000003c0)='GPL\x00', 0x20021, 0x9b, &(0x7f0000000980)=""/155, 0x41100, 0x18, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000400)={0x7, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[{0x2, 0x4, 0xc}, {0x1, 0x5, 0x2, 0x1}, {0x0, 0x5, 0x6, 0x3}, {0x0, 0x3, 0x2, 0x5}, {0x0, 0x2, 0x5, 0xa}, {0x0, 0x1, 0x3, 0x8}, {0x0, 0x4, 0x2, 0x7}, {0x1, 0x4, 0xa, 0xc}], 0x10, 0x3}, 0x94) r6 = geteuid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000dc0)={{{@in=@initdev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@private}}, &(0x7f0000000b80)=0xffffffffffffff71) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000012c0)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001280)={&(0x7f0000001300)={0x2440, 0x2d, 0x200, 0x70bd2a, 0x25dfdbfd, {0x8}, [@generic="9ec7c73c8908ebed0aa2bfcd5943ca7a35b15d2f016d22c9fe9d76df274360d82f781843af369a0e8910597a63ffa9b6fb499dbbd39bb725b942d3f0607748becdf7be7837fabeefd5c363a0e5be266ea438d4e0e4a45764c82b1a4d0a42005b08c41bba5e74bc59076c4eb275d5fb6b8038ec3417cfe90fe898dbae4f798e161cf5ad892ac6e09e4e38774800bbdaa59325fcfeb40e44c8f68845319a38f6ffbccaac80e35e4d8ceae3ba0f89ecb4fde31df8f79eb97a371059dd89fc621de925bf43", @nested={0x4, 0xa1}, @typed={0xae, 0x75, 0x0, 0x0, @binary="e5706e68dbaa9d359c3656ee33b229dffe9556a14c73ba2b0cb0eb25e7d7517c90c54860ef4f484cf71dcb098f45195c739bbb35d94fe532497744158de5e90bac73395e6eb7369c43ebf581cfe842df43fbc4f264db1128f06edc42bc6ad2d358e8b1d515ff9464f8a4b233305591330bbb2d0ce6ca7c7a521fd16bcc795aab362206053f3758076a6516564832e8b72cc06b2440fa11b8bd24f1fe4c2eb84dda44ce31f77ca41ea121"}, @typed={0x1004, 0xd0, 0x0, 0x0, @binary="2615d4d1ff57c2ec338b5a606e34ba79ad2353d0663432561504bc0244377d96ee82a103b5593b242f0d88322e529bd381941f996b75542c9112d811e6064a4529ba5bd6d693ce2a011b807d603dc5b3d6656c49e7a8e864be838529447b0b3a17dcd8b092a4b94026c3fdbe63c7cca65266e97d1fe283daf0f8789f65dcd12281091bc62b027fca9486d0fc3c4a1b55a29669cd4e54a21a054bf47cb4cc0449305449ecba0014fc7ca77136fcf9b9a0d06c0f368c1dd549673b01dc986a6c91869fa31c16dac6d5560d5454d3d078bacec45fefb2b234bd26403b33ec02b04bccacf6ff8378f18f6570fdf82981a4c1149642ee0877052337d7d6310252b83b7d62bd1b955cde1c32ddb57c8dff85a381b39cd37db11809a31c725bdb5b1a669bf5792dd0b7114d1051709bfb04a5d135388882cb200a7b98925321526e89cf5e9ff86fd20ceaa095b112a76257f15e7ee4686824a800746d06a6e852a5fb3c337064e87b98151715c51336c7aa9dfac65d112215b953b0033a19d5a63b113ca82795fb6f638f496476b2abc099fcce3cccf359e365e3c644238eae8e628b77a5b80cbc6e516972badf64598c81d5f30ea47334231a1a7ced9dd83e868de25e9a02164e6531918b0a74477829618d12080314e43e475446a4f660cea3ed030d64d255b44a1fb1da73870567db621f002316de21f6c8480866d088a2007679448526b2d6db145366d05d47cf8bed977ef91347538a451afba2df9b5303123eb591e4a3fad14b7507732dfda31c008e9414d4583abdb7407dbd05c2fdfeb0729cb683f789fbaa86fc25bd76306f453b61af824e10b2ec4ba7c880a39f7beea6177352b667bfe79434ffc766151c0c1fa8608641ca1dadef2b1bd1c8586d44408c7c6860c77b50dd83bd8c6c4827410f93d1c8c10171c38f205b3c8899b20ade268898a3caedb190e5e2c4a1efeb541661dc1202f36457b627f54009a9d597bbedd0e65505d8dd5b403fea5c3b06523334c483803631e90b82848314ac55fb830f1c24ca40e6be11e9cc75f39c18be43a5a4cea0a308ed3ab6256804b934e0ab4f556d0399210ac4c5b0d807859bb9174ab1945d3ff4b05dbba2d23ae03af87f1e1d9d305e2e511b7109f6346f247bcc0c79f0d455ac06089b47ae61e9a6cd4c5b400ad4dcb3af47a5edbbfeec7ea3728732f972ff0101cdbdd3fcef79822881b9c46d9ee36c91097d857efc319f009127cb0f253319d8f13850722241703673ba9dd9b411822ffa007c8b6cc45c121576c404eb2be786cb761511adbfb6b1116d32c938930d5c6325d16de4ebf0a4685d0af000c772ed26fdeb88adf495e79149d141fb7d8c796ecbed0976d0537391824ae2086abf2b8d5f7a59c00276178fdc5c5a7ff099c0326ff9362ed44652c9c0dc107eada6ca84560c5b2382ffa336e95eb08a0ff57260f5968ac2903a0ad4baf4c8a127b43c87b26288168d137e17b14dc7e2c370863b6830e94b6341c80b872132816ea58297c06869c4d75d278931dfcfa41f755ee07c234c163d4cc6cd6f721f2bcaa5fcb8ad75765dfe62f8e7f7aee5d04d1455679e1b1acb7b661aa77acd0cc12929878dab5d21d1ff44ddb5220c6e0af77f8edf64654e163f42ffcb888ff61471c8c2acb8053e896b74cfafccf9bc8ee6d66d83f1348b411d05f213c1f080d9ea7f58042ca5750c5fd997bcdcb0c158c0af062125c5519eca01b48ff1cf120c182a7ba48a9db661e31593ff0eeaaaa984ba9cae4bebe7a1e84385aa60a51d5bf1b329e08eac81cfe1de247952587fda6b5f36af661aae4b0ed6150513fb60a4ee66ab9956359f339728f6f7a4a049ce79040f7cc69cbec31ce046b3dc35cdfe13ad7c08bfeb4496a15ec5d727abec73672cb76b64355b06dd96a0cc2eff7f73ad0caf1506e427064b1df81522dc75b84dd56ac168857cfcf9b87a42998c0b24c4fd7211097155fb0573e538c417fd6aef7a44f896a19190f57a11ea2f13e0c4b7fd872a2612c637bc0c8e5a0c9263d3c72110689a73042b080ee756e2c66bbb8fe7a42b56ed2305c34586abd82e8e64467b89d689aaa2a7ac606abf87ecd5f57198a03f7198e7930f00746e2dca84248e48257b2116097abef62b09c313d5d6910b8612c45c98a7589955f3dd2addb0684d174fb2fb906cc0854782844259474c5985349aefc8a2e0f6685ed654f7de3168d577875fab70870ab9784187a8b38da5926ef7205dc03a3470230f36b5bd97d4dfec01f61a18dcf32785b33829991932b10e78c059de0581cd892bdf898e681f6da4ab90a7b84155f1b20aeb7d9d6c895c1c23f09c0a0f77cf2c8f606ece954a39da41f2bcb83ccd7f6d5af7996c1072120560ff6669ed1c0442c9ffb8ff3915de044d7329038482dafdcc2bbe2d78c3d9bedd11d1038d00f6de05c796b9d0e54e424671b99f6bdeed0178e4efb78ecd083433ab7ba1eb89168dcbf6f6cd74007804a4bfaf26d50eccfcfd24dff6ed50f5de815f9f75ef8da5f8037fa1bcacff8e77464f9eb6ac4bad16e45e03c730c15143f42808f04558412332459b19f6537aabf9ec8d92a39585592ee9601008ad0d5f143dc08f861b0ac863ec302d6d2a54de5adfc24504c0dfd1c82c91a671c1b56d9882c5fbf6016c79de321295f950e11728260b68b41a86e0848c8378f513b9c3d94bc43fe0374c965353baf7a17b0623b9e2b4b9eb562aac615d5e827b1153f9c685895d1601a5a718466a0099c8de763bbc0543ff8ee932424972660ce92ae4e9747974217d98fcda42e30b02e28541435a0ecbbb07438f6a10ec5bb742f657b49b6cbf135116b119764fdf32d3c69ed6c53c711cfc7446a1acbaadcbfb2a9e176bf76b336469d88f61f8a617fdb88f51868aa784d6e488be6f3b31a3502ae4656a5562fc33f6854573c34a43b997dbee96cfb451b017c90f083a0cb29793ec44e0809c931803b324b30eef582e292e751eb77e85b225cedb38c2c238f43c183af2861ade5ab4bcfba5ddfaf48910686929ee86813e83f0bc37795fee7e847c06f1c9ec5e1d785d357b6ab5e1ca8a402285bb4c4a9aaf8d1dfb07479d34eafe4316a3eeed5b793ae2171bf6575bfd54efe09d65513e8758df42e084334ad65736949a0ac5cd171511ccd8db85798ed675902cbbc9122fa3e858df50955fffa931e0651d428b33d3f0d9df81a6f01d374a7054a98c92be70a9b2e2605244d8269e3c2e298e213f3d455aacf4c3a9ff7712406f7cee0d6236034d8e706af1bb96a1238918a77bb5e94f55280b16f29371561f09c040e9356f69352b51174ceecb876a38bb3e673de2bf06d5ae0c2a9c37acf30756ab5f1501d803a9fb404d0caa8e1493a70c2baa284e7cf56fc1c66c8368d9a833658b70981bff6d0dbc45cd0590711933dec362b536575070b3682a7d6993836c81e476a747968b7362ee299f7ee2144267546212794e297571f21244dd055ba8aecc2d416674be8db70cc995d6b5dc9467beb8658bf2d7d9d41461ff7e42fd4f254bad9ca19545cdee3e3c68213acf0cf215a882f6a25081cb9b83b88be59950746d3795304f5c5b93f9e9e3bdd3ce6baa3239d7b614b37c2830bb13e3a4802eb878538187b8c0b8ddee8ee8ec8cb490f9870a3d78e7599153ef32fff1afee4420eb0a20fa3cb0e04e0d49470dc3de1c11569a4ee6b8145d24ddebc490c3db55b8b2aedf8e7ab4a1aa36c9b3a3a45f3bba1438a462d0aac1f9f9dd5e3119bc177df1b3699889ad98bfecabd1eebd3ba4665c10b60bde49b1c75321bb9b60266be4f68c71be7064020746556e5ee930168484979b5a5585e4a18b1d9fbd36619af48c223d4b3b106169ae0b4d3764203a02628929e7446eb216c87432bfc53c5dd2eaaf759c0452c658589167f1472e5b6c9ea9e3180b4a2697797f5feddd8619a6a2a2c57efee9eeb6b699c7ce2fd486aceda719ad4c46b4b6904dd9c35a3920a9318a181a9698e6c6ff87f1a87eae46fbcf8d644e5f9345326bc4047919477da3292af2955837eef1539964df56cd31cf54befbfad9bd56d06b4594b8626c6baed0c64401c91867a2fd048901bfed6a76f7f0f3393a6e774aaaaedbf413214d481c4b3cf1f14015b2b48f7e81ba32649233db03bec195c48a535e02f0f87e7b8d9ccc7aeb363061fdb51fa825d41b65d221d84b78931f712da37e0261663fdc769a866f9f0450c531ad36acb450dd6ec59eb570ba41aad228d5327326e09786c572faa42855512bf8e4cd05a4d8f91a2135a0e5cdec74052f82d6fafb74b4af40e345f079a47eac15c118fd42021fed6e09b51c14a7735be0c9fb76cc2ad78253da2f0e8d6bd9fec07f26248e9fefa0de6296160bf2706cfb28ff0634a5ced491a96b2ef9932c82836fd3e63e49263a934cac2194e6da0389740b244a79a7419f06eaef4b5734504fba4f026887cd179de8a77d58b44541975d11e82d82eda5e2ca7977acf9f34c66d9939a68a9a41ad4525ac4234a839405e5b4812e70fe534f9d53d53f6ea1e4d1d49b6bc5ce1490d128eab3330094553ee87aaf6c012ad318800167c62c34c9a8f65722a6c0a1faf1ae3ee94049c549be0e0c67c670685b5f79074dfa68d96abfd3a720316284fee3d62806837206197e199f6966cb44dd10ada75e5531ef7c4c84f134e32c8b3934d87fa045ff8820383361d534a39c147a914701582409dc0aeb1632daed64d9e5dd031752fc1df0c635b2e5e9cafdc28b8ed7331a5db8c8c58c8ff04d62013b723a8d833a44bac4fc03cec1c4c462cddd35112a1f7ed490ba223bda531e00542f471f973b910bebe19c93125da1a877492801c213f09b0c411f4fb966dcc8e974702ec7d73f3e25b72bdd0cb4af274744ff45ef1c5b3974e79e4994d7fba1cea70d994daefdc57150166854ce323ac360986deb7c4c67365243727c6e596ba1cb09743aa134a47f7356d24b35c80eea163cea30db805f78fe4e8d8d21f8d5fb8e3a7cc60e902c64be1dd69818afdd129ab051143db3d303cf9dc2c53d823016ffe9f91ff274a21c1fcb87539a230801d3bb481ea496c5b9ce6ee01526111162b32f02014203f731b23d5f3d1272742a4ce0822c6ca42715d4943b57bee2e51ff72b73a41f8f63e74b9b878b650211421eb82b0628b9f1cf86150111c3e4b2d1d6925225d292dab459b59908042ba1532e5f55ad03158fcc6b07c022b24c4287d9e03e0cb4835d97344125835f34b05a92e09f285b04c2c2958b111b55daeaba93f020d9d6f65fc2e9f3c3940d7f3d40d492fce4a4e34d152b9f18d1db9b49d7ac0815c5a0c28efe94632b9fff5cfe4e6b4480213395800a5906f13af5d9e3e33d70000e7b5e15645db3cfbbfe204c2499e10fbb35af75fe3859899b672d40ae3b85638414d10812ec4a4d2ec6685648970050bf4b273e4a1377ed2d143c1dfab011a488676adf83c8dad6a6868f6d71dbbb7dfc691c6db605595e90a09771570174e6059f73bea62f74fda12202bff6cc9e8ac9d60f0cb06c3ccf6ab8f03b451a9d587006b0d92903e7eb35b55ff82c621d94aa4adc6fe59f70e874f6690486313176a8aa200656021decaaecb00fcd15b01359696c4c2223c43173e5617023951f64d96d15c8bec6644cd5e0b8a7c7f0a51b3f58aa8719e424cd16b20dd36c88f4293876afce2eb1bfb27673841292ffadca29b63ccecf1ee31d927cc74573bf9a0c586072bb38353613a5ea1c2127e282601d6ab4d3fd02a747a7b7a0eef332322fbeb8"}, @nested={0x1008, 0xb3, 0x0, 0x1, [@nested={0x4, 0x5f}, @generic, @generic="08e8be47e934850240cfa2d143ceb7e0bd18a35a1a526dd6096827d765ca7b59f4bef50cd6d013d0ee1fa1216b471a0a58e397c822d2520c47aedaa18d62695ae2ce85372b57ab6760274e351da09ba4e00ffe5e68a0db26c8c47303e14f0d156610667f1f88a80d065e092ca3ac8fb824ccd0e1cc582091b29eb2353834eb025316b9138995bc7c98e7141241af7cadcac8669278c9a8c438332da075192eed4679ba230407918481d6366069ad80004e62c66ba56ce1a696c8e37188ab87e77097e667eae9df89184f38c7df9a7292d80a2a8536b011df3482ae07d85b9df5c5e5b0c1e83482ab1435c438b4a084c15eda386f18252a241294eb2171934666ac88705e021697c2cd44d4c0ddfa4c9d3cfc85cf41ec47cd0c6cf9b8395b0529f74d6c1763abc4e265f96f344f104f66e3494e6b76cdf3fc1d4af3fd156c8db05e714752b2fa9573893e057d0412f71635c1af5c180d58ae951342ee0d5185b3960a7098d79d01c6b617d4f135871a5434072418ce1639afea74d3987cc550258625fe0614a8000e2408a7afa1c8c7a444544680292b1f73c72b6d07ede299de3b8ffb3adab18fd074347c625290c601f3f332580e948fc947a9505c265d605fb559c61258d8a3c54092b9fde85e8b54c2782a65a67a5ef8e1ed34e8d8806ef066038d29ca3d52d8e94ccc893f03b1c9e3d1b218cc80a2de5014a3648c3313d8cd1058299a31a5cc6a8797d7ace7c8c4287f1a072a39983aa48bec00cbf1f006b0355955863a4a7ab193d7231b3f624c2afb79770c9bb709ac68d1be2ddaab1082478009124b428a0d28a7183223ab9e298714cbb9368a1593275ac241589afffff30999909e10987e38e586bcc43142cb3a658aeb45740b2fdeef3abcb1e00f132a14fae8e1e628ce8c963fdf97cfa8081ded21d966b548bdffaa34120b23a972c98c72d7d593809b15608aa888877aed3aed64dbb6d85795e7375eb260a62c12597351e1b7a2952850d5f409b615842c863a936a796a5663f2c8f232d460de6b7b8cb3fa63f6f7dff6007598542d38b8cc9605f272028a0c17ec42a36ef0f7439ef4b6205d0524b587750d120d34623a947bfd967bd73b944ef81f8234ce385c0ee705f109c3b089dc53cb9a3d84c810dbbb900598197ffd5f9baf7eb9342832dbbd62ab8f46cb3e70a1865eb19c0aeabab7982e3c6f551ef94a18ac788a572699e516e151f8575967e737bc8df5d6fc84c34a85d76b1c0578f11ee2c2ee288f3851c836b028da049f123e4a0b18c45861958ac8dcde0372c289acab6c482e1a5070a01b6eda3e86c27dae470921586a2225a5802f842993dd046edc2d3c1e845dd3c501dc7d8f6f6ad96de5cdb4da34367242671a668d0afbe852b95adb9ca92a8c4f3c6b888f5f0ba26abaf978a433b2fbb6df19d7be224cfeed58313269c7b30770b7814377bf89793ed36970e4eb75f6034baf274ccd05e39b6a726deabb01a6d4d63a4118ce4e4ce17e0e8991b186738e7f5001a59ebdc52b4b082eebcb9d0486cd577002cbc9e9dab22f8218f9e4f389e34e6e96dfe2d52eba7289691b42e451cad309dadcb6d0f7ff743cb2d741a110507a8b9ce34667b229ac93a60c55da4985d0521cb0dc9b0c5d440f192409af5e63eeb9d443d65d3f19f61b9a0bd86aa8d50b66eb2c19dabccf570a72b52e1b29d6a6836d66e085be06e109204c74bbb54390c802617864c1320d6f0858e9e8be0a76e8ac6d5ea4951fc6dcc70548315a244e433519a03bc8ea8902e4b9974b65b6f1b3468e093fb475dda3eb6ec024d38b739972d482d7a776dfac20a4b517e32690d9d85ff6e72c9e7996823d5fc7d8baed444f9da3f9ed5280f69970f694114d4090a50a96407eb5dfecf40d3d3a6df17647e19c9e335d807940e7b761a3f7f8d0e27d19b80c8c49a327c6b6ee9b14e6e872231d54efe73beed4c3fd963f7bcca10f9e29d5d6532bceac98c0bf469319142b1579361102f0ae75a481c8e6e0e19e504f7b4b8b1ac6926d41f4e16b5beea9b9f844e45dbbf1b5010655c27199e4456085e5773286345aae310b9b45fd7acffdddd54d18414cfcb805a50fbe418daeadcd7b529746832136ff40aab11f6f3250ed4b7f9defa0378a35299ad2fa360252b5f8a34ce73532b71d342a3767d3903039080cb787be97360e0d9365a4020f9c2d50d8f0b3d4b3fd317e777a19c0a31f48423864cdfa5354cab9afa12ef3217a4f4b86f6b3472e1ca0c4fd46d07cd5d0efb0ad00fb782e8420a709f31987c8346a2e9b8c8c8fb2e3089abfd25a783c47a10693f7dff6ba87133badf1e6c30d35402901f05a5aa9d890c5a46a16b50ebaddec75b65461b4605e1f344dc5e31bbac9d33e625d0a1e994041864eb43852a11c1964263d4a48aa6625e86a4eaa5c4099db1912172e7a1f1c483a133b6cee1f3d3bb56e31fb710c8672adab9677066ce1233dff42eee0a2c55b7f594312e0ca5ea9165ff48a923b5a08f009150d280693c3a8bfb7e6bcd2960d9443a8059dee7ecfd25f1c3e40a46d4c50530d0d57fe961a8ecabe69c7b78282c949a934ca12fda6b49923c144bb561a6636848fa8508ca7e7cd8494d61b5912eb0ac57d365794ef864ee03c4a12d6370f63fcc22f1b5ef9f06176d91c1af2e1cbdc7f8d203b09ed0542036c3bd387bdb2a2f9eb5214a698eec096588d3dc5730285acd4085cd3e423ef43db514248865ab6b75746b3c4742df36b344ea96d9b59a23e3c2afd5768079ce2d64b0551a2e47d47841ad0bbd425f170e1720f6154c0fc51371c805eeeca014e05033e1db388b5e0dd7c8c481211099900a80acd45b840c5aaa31be517343ff0f06384238e41603ae2632f46aa34302586f7d4303b744cf7bfc7204a782064b06ce7c228587e2d27ed6622d3f501599376ed71b009914dcedd0b34d3e432cf17ba22cd5d92410bd758e2978d503dfa1d45f744fc01cc86a5b6e0959b0c45d66ebb1f0b45f4e5e541c7cfec4f373c6d8313f46746006f77378cf369246ab077200d102b28864670df8e294e8be2ddb917b66a6c51fe38cb639d0a9b56defdbcbae9ad57f675143179ce4e57a859dad63671f7f10746cc2a328d2736647175296c9ab86f50778f73290771942bf3f4932b95b953a010753ff683cbbcd74fcc05e82a68854a0e46a7c05e6d5da960de255bf8dd9303c11d9e6bef975978bec8666a4e60062902927e23e1656cee2479924a0f89a4c6a9dcf5988d848049abd0727b6e315ef918a6c3f6540060fb648a38932a8c040b626cba9a150da45e89643354058373e45db527c5d549ec5711e375bdf75ce728ddeb851eb7234040a4af3185b081524ded0ae193cdbc735944cbfcbc2a8eb519d9378debdeb64ebc229659acc3b762b396547d848f8b8983b2356ee1e7c493adf1d0f0a4a9a127f4407c017a5b71c087b834bd5b0bed97423eab81509105066ae17fdaaeaf26e3472ea7bb138083cd2916aac9ed62a9852f55d3eb0388b4ab501b530e004a427a823135f8ff6768411153b36f2a48987154c50f625e75672df94d94f27bc8bb4041cc4f2100ad3b261a5d78d5f6b2a35ccda6b2349ab9f7cea183a4d1ba4edebdd5f5c05b689615da47aa26247ab25d40556f9d4153ed7d93b3ba15f7fa13d45e4ec666d93d9669a9b793184d9716a255b77092fe34fc0f51b99d9d7ad268f02e048c51d465217b80756a3d266881e769ea75d4d4b87d84b18ec13902a15bee07eb7aa87c68a4edb60e98075f7a51018944be7c2ad09935686b45e4225a90c35e6db6824c2903b42225effda74887412e77313a994772a06ec2543eda733ba089a487141a3d6f9d4bfa4fc7c0a27e9c751a849c2bce08e8cacd988ee255e0cccdf0e0cdf4f813b3dc31978b329d2a98ce5c5fea4dae69d4b93f4a1e160c35e3ef505182ca4c0bcd5ea30d7f0ec1ca20639a1ca38593f89e426de688aa631de807cd42d01ece5328474531f7cdd92ce309b0ca89ecf022eab5ebbcea1da7456f348f2174856cbb73c8a2f962d55668707ebf2decc2d11a296d6bd532843c2e701a147fd7fc4c940339534c1bc15b38d5df537d1e9be3eec542295260d5b4ec013115bbe75042eadb7ec934842f56a1bbea6c76b23ba7f4a9f8197a52a17587f55f12a8f2d12f530c19c5206daaf8a37d1b6f512b404486eaddff11751b5f6cc782d22663c04ac8c4ed5bcd36d2a730aefacd7083d144cb25b62431dcb29f58cc5898b1dd48ef856a9c6121151371e06a5080264faedbbda661ce018730dc3e518c0ed86165a9202a5c7274077a22facd262dfcd3d35b5111374022e82ebde7ad679242d7b60616c6c75917af750d0ca3185da12ed3a783fe7863983ff8171ba6653be5c288535963fc089f2b14653fb7c3fa9f83d2fbd4e96c1636ecde9e11a9b24b0e4fed6f0c4143cae3aa2836e08a3ec1c6b471b54362a5bdf71dd60f3af5aad413d98732f8c90cec5077da88122c56a0b2fc3b3dc07d8e39de2c7f432bff0ab1d250efd2109e608b32c8e9b817ddadcfa4a626ce3fa5c6b6639b4012e8d181a8c1269161c00660473d37dd9c47d6b1f7a7fa1c3dce7953ae94cfd72d96389a7476ecec763182334e2c905703a1e2101614dbade124edd6e2464470a3343fd806027378b190e0cc51cba9d0b71d6dc8bd4972a9d7498eecb0b14f7bb5c38371ad42161042f89c0b8707e38aac5a5dc8ec2e6da6bfefe19360e7f90556d9da94f82a9526e75b5f2f0fefcbdc22afea03c5263370f22713a34627b6384a492e07157d69cfddc9328c799544aea9be7543cfee94e2e50e4fae2a538e0d451fe7588191e583c5de8ba8d6b5c5f702f344a5755e00caaa1cadb4c8d66e1f20f747bc77153869f7b0881f889bb482e7b4a9be389e95210afb7d0935beb605182832f12ca6a1f2bbd179f812d225f778e8c725ffc75d097f260230b3a812ebc99e78eb6cdff73d06194d438833c42678e980a41026b294e11f299caea0cd05dff900f4b809e60b01ee3db3f64ff03c132050af2a3243b7fe9c6ddfddc6e6093c7f9f3fef210abc719c36e9b9e683f7ab64bd51e231135bdc68aec13d64b983e379b2f579c9775c2c298c42b576fa6ae6c0295aba47d871e48ebd2d319720a71b743bf9db278bdc901d8485184da1d832176f5c03e950c421ef0073af62c3029556260785a7a59bf9abd6a8c5dac99b19e93745faaf658d06c356ee4016addc12a9587f8b37e653230e18b653f4ebd35ed7bb415bfbe7333de11c9e56757a52939066f5cd878b042e4b3f48ece0e7ede5a366f3b8e11857361e7636ef30a935316d939c38d94e8f014932ef812a839afef6f5199e691a34fd83a88722b4b2075178f33277611684a47f80b5ce768a851cbca6d0995f2fb44aa6b5f417928f0325e5a2f87050c4a47705fdb51c15a38350123097e7ea3d478bebf0e47e89beb18de4ff32c7cf1d8a8c5e9bfdedcdbcbd24c589c90a547659811a006e88fae69d9f2699305d2ec08a01c45a0ef9db67d8c5883cf9434dd063251e0a343667c8579cb5891d9e1af993bcbefa887a93ec705df31f1236f34d648ada3f368fbfdf1f74f47d2f6f8fd64ce865f365de0cf3d08cfdac1ea5bea8d97b37b15ede0a2c361d8ddfd1bec4cbc5fc706e96339b23231109d436e3616971127dfa699c7aed2d0ccdfbe7859e64de35c1c64debb527ac28751308fa39a3f9acaffdfbc6ef49a39245b26d2ed6d212e586a23023d6369abbfb372bd00d8221802288b573"]}, @nested={0x4, 0x143}, @typed={0x8, 0x14d, 0x0, 0x0, @fd=r4}, @nested={0x20e, 0x11e, 0x0, 0x1, [@nested={0x4, 0x101}, @generic="b2b0ffe2312518b42d8e14180393045eb76b7d374bc465d3695389ce4dccd05b73e55ab877c9798183b99c0ff4eacb7cd63162d7ff21102c23d1f949c0ab469401171b6bb4e7388f543a352183bcae8a91ad75fb9717fb406ab08297b5d28ca0", @generic="b3f3e19e47dc81d28d0339dd3b019a17514a741ac5e5175be3cbe433eeabd43667b800a5a8d50bfab487df30cb9215be800fd6fd8017c41ed77ab4fb37231dc43c6361e9e44d4f8b2dd3291109be418aeb55b1f01fd506ef585f338d95081c3372554761a8b3e54f2a16fb6d0fed123c73ba82e00c5b0c9e32fa7c1569c1ef4b75a354367c42b7935965855a5d63a549b6", @generic="1b07015ce9d0cc3a7001bec9bdff48ae06a53e1beea05cd2120471a288d51db7ad909bcce353b154d8cc4b247089e93c8bdb53b6297113a740d9e6863144572598f0cea71533f1358f95708cc35335ef6251d1aa0ad1ef25993248c51fb762a9dc038c03b8f3410ca69e5ca148768d43d1e62b0c1e746a49b08addf7e6449b02f3218d919a72b217328d86feabb2c146b7e8e7017aece6ac22", @nested={0x4, 0x57}, @nested={0x4, 0x9}, @nested={0x4, 0x65}, @generic="20ffcf5170ea1439baad0d4ed26da642058a68d545be777f9aff7c31b06d2eb00790b09d6522ef8c45354a6427aef6c31356d8e7d84a7002d52f12f243acc58986b932203420fc1a4bea3e1c39e146798e08dd9225405c50167552a00315cf9fda19650fcd08efc5", @typed={0x8, 0x8c, 0x0, 0x0, @fd=r3}]}, @typed={0x4, 0x21}, @generic="0e76adbb2d3fb27c7aa63bb58753f67e2b281f4c4872aeb6e67a2f2d032e30ed51d18e21d022730b438e1ea7c1f40a9e22d1ddea32ff3f53e3208ab157141f383d2ead1462d67486a48505b5019cd56757b280612e90fab6a3eaec5da049f008946ab754c2d6d7b87fec478974ef5437a0d72b18a0fe350524741dbb983f0a8dcb6c6416f221"]}, 0x2440}, 0x1, 0x0, 0x0, 0xc0011}, 0x40004) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0x50, &(0x7f0000000c80)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB=',wfdno=', @ANYRESHEX=r5, @ANYBLOB=',cachetag=,aname=NFQUEUE\x00,privport,msize=0x0000000000000006,cache=readahead,euid=', @ANYRESDEC=r6, @ANYBLOB=',func=FILE_MMAP,permitodirectio,measure,euid>', @ANYRESDEC=r7, @ANYBLOB=',\x00']) ioctl$SOUND_MIXER_READ_DEVMASK(r3, 0x80044dfe, &(0x7f0000000380)) r8 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0x0, 0xff], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0x8, 0x10001, 0x84e, 0x401, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @loopback, [0x0, 0x0, 0x0, 0xffffffff], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xffff, 0x1000, 0x6, 0x400003}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000c00)=ANY=[@ANYRESDEC=r8], 0xb4}, 0x1, 0x0, 0x0, 0x854}, 0x4000011) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="3c0000000d0a010800000000000000000a0000010900020073797a3100000000090073797a3100000000100003800c0000800800034000000002"], 0x3c}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) close_range(r2, 0xffffffffffffffff, 0x0) r11 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r11, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="4c000000150097f87059ae08060c040002ff0f020000000000000187ac1414aaa69d35a2cca84708f7abca1bac1414aabd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x4800) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r12 = socket$inet(0x2, 0x2, 0x0) r13 = dup(r12) setsockopt$inet_MCAST_LEAVE_GROUP(r13, 0x0, 0x2d, &(0x7f0000000100)={0x7, {{0x2, 0x4e20, @multicast2}}}, 0x88) r14 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x40102, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r14, 0x3ba0, &(0x7f0000000080)={0x48, 0x4, 0x0, 0x0, 0x0, 0x0, 0xd32a}) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73f72cc9f0ba1f848360000005e120602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x4) openat$fb0(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0) 3.459520476s ago: executing program 3 (id=2535): syz_open_dev$cec(&(0x7f0000001140), 0x0, 0x100) r0 = syz_io_uring_setup(0x1f1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100}, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[@ANYBLOB='fV=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRES32=r0, @ANYRES8=r0]) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="400000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="a7ffa88800000000200012800900010069706970000000fa0f000280040013000500090000000008f33a5798cb485f3a9776f093ab3e544599d87862ad961fa67f7215b55c42d37b9a100eb2ec063287898534c013c8f11d376156badd398f094e0e3b0cae09b813a27158392211de2312f2526854a5a004cb08dad59319ee0f21d26b"], 0x40}}, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) r9 = socket(0x400000000010, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') getsockopt$packet_buf(r9, 0x107, 0xd, &(0x7f0000000540)=""/220, &(0x7f00000000c0)=0xdc) read$FUSE(r5, &(0x7f0000006140)={0x2020}, 0x2020) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r8, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e000300"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_xfrm(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) socket$alg(0x26, 0x5, 0x0) 2.695852863s ago: executing program 5 (id=2536): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000000)=0x4, 0x4) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x437, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r2, 0x50561}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @local}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg(r0, &(0x7f0000000340)=[{{&(0x7f00000002c0)=@xdp={0x2c, 0x2, r2, 0x7}, 0x80, 0x0, 0x60}}], 0x1, 0x80) 2.10449254s ago: executing program 4 (id=2537): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e21, 0x83, @private2={0xfc, 0x2, '\x00', 0x2}, 0x4}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1e0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socket$netlink(0x10, 0x3, 0x15) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_io_uring_setup(0x239, &(0x7f0000000980)={0x0, 0x0, 0x10100}, 0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x0, @fd_index=0x3}) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x217) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001b700)=""/102392, 0x18ff8) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x881, 0x0) socket(0x23, 0x5, 0x2) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x3c1, 0x3, 0x460, 0x0, 0x268, 0x300, 0x0, 0x268, 0x390, 0x460, 0x460, 0x390, 0x460, 0x9, 0x0, {[{{@uncond, 0x0, 0x230, 0x258, 0x0, {0x9401}, [@common=@inet=@hashlimit2={{0x150}, {'hsr0\x00', {0x0, 0x9, 0x0, 0x0, 0x0, 0x5, 0x9}}}, @common=@unspec=@time={{0x38}, {0x0, 0x0, 0x10000000}}]}, @common=@unspec=@NFQUEUE2={0x28}}, {{@ipv6={@private2, @remote, [], [], 'ip6gretap0\x00', 'ip6_vti0\x00'}, 0x0, 0xd0, 0x138, 0x0, {}, [@common=@ipv6header={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4c0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x8000000, 0x0, 0x54}, 0x9c) arch_prctl$ARCH_SHSTK_LOCK(0x5003, 0x3) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) pidfd_getfd(r4, r0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) 2.098211927s ago: executing program 3 (id=2538): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f00000000c0)={'dt2814\x00', [0x4f29, 0x0, 0xc13a, 0x4, 0x5, 0xafa0, 0x0, 0x4, 0x54c6cff3, 0xfd, 0x2, 0x1, 0x1, 0x9, 0x6, 0x101, 0xfffffffe, 0xffff, 0x7, 0x40000003, 0x89, 0xcaa3, 0xffe, 0x20001e5b, 0x8000000, 0xe69, 0x3, 0x8, 0x4086, 0x0, 0xfffffff8]}) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x24, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$setopts(0x4200, r1, 0x8, 0x100001) read$msr(r0, &(0x7f000001aa40)=""/102392, 0x18ff8) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000480)={'filter\x00', 0x104, 0x4, 0x3c0, 0x0, 0xe8, 0xe8, 0x2d8, 0x2d8, 0x2d8, 0x4, 0x0, {[{{@arp={@remote, @broadcast, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'macvlan0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28}}, {{@arp={@loopback, @multicast2, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'veth0\x00'}, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xe0}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r3, 0x5412, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000400)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0xf73f728008fec34a}, 0x801) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004002, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) setxattr$trusted_overlay_upper(0x0, &(0x7f0000000180), &(0x7f0000000840)=ANY=[], 0xf2, 0x3) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) fsconfig$FSCONFIG_SET_FD(r4, 0x5, 0x0, 0x0, 0xffffffffffffffff) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r6 = timerfd_create(0x8, 0x0) timerfd_settime(r6, 0x3, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) timerfd_settime(r6, 0x0, &(0x7f00000000c0)={{0x77359400}}, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) 2.062446001s ago: executing program 5 (id=2539): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TIOCGICOUNT(r0, 0x5409, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) ioctl$UFFDIO_WRITEPROTECT(r2, 0xc018aa06, &(0x7f0000000100)={{&(0x7f000040a000/0x800000)=nil, 0x800000}, 0x3}) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000200)=@newlink={0x40, 0x10, 0x403, 0x70bd2b, 0x0, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @vti={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VTI_REMOTE={0x8, 0x5, @loopback}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x40044}, 0x8044) 1.62611407s ago: executing program 0 (id=2540): r0 = syz_open_procfs(0x0, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) munmap(&(0x7f0000c75000/0x4000)=nil, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x10, 0xffffffffffffffff, 0xa690d000) read(r0, &(0x7f0000000300)=""/143, 0x8f) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) ioctl$PTP_PEROUT_REQUEST(r2, 0x40383d03, &(0x7f0000000000)={{0x7f, 0x4}, {0x0, 0x5}, 0x7, 0x1}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom1\x00', 0x800, 0x0) ioctl$UFFDIO_MOVE(r1, 0xc028aa05, &(0x7f0000000140)={&(0x7f00007bd000/0x1000)=nil, &(0x7f0000260000/0x1000)=nil, 0x1000}) setsockopt$inet_int(r2, 0x0, 0x31, 0x0, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x299488, 0x0) pipe(&(0x7f00000002c0)) fsopen(&(0x7f00000003c0)='binfmt_misc\x00', 0x1) mount$overlay(0x0, 0x0, 0x0, 0x40000, 0x0) prlimit64(0x0, 0xf, &(0x7f0000000200)={0x8, 0x8080000000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) socket$netlink(0x10, 0x3, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000240)={'\x00', 0x6, 0x4, 0x0, 0x2, 0x996f, r3}) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8, 0x0) read$msr(r4, &(0x7f000001aa40)=""/102392, 0x18ff8) ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, &(0x7f0000000000)={'hsr0\x00'}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2, 0x0, @empty, 0x7b3}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e23, 0xc, @mcast2, 0x6d}}, 0x0, 0x0, 0x30, 0x0, "ddfd097ed7c5a1c172a987ae5c09000b00e741f0831a5912d606798fb75c16cb15a3c45f9154dfa3a2b9acf80c07fb1a854dad7407ef0887f2304844c29600"}, 0xd8) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000100), 0x2, 0x862b01) 1.565514651s ago: executing program 3 (id=2541): r0 = gettid() r1 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r1, 0x0, 0xe07e872424dfefdb) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r2, 0x0, 0x4080) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0xfe7f0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x5) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x890) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = getpgrp(0xffffffffffffffff) kcmp(r6, r0, 0x4, 0xffffffffffffffff, 0xffffffffffffffff) waitid(0x2, 0x0, &(0x7f0000000600), 0x2, &(0x7f0000000080)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00004b2000/0x400000)=nil) move_mount(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', 0x100) 1.283860269s ago: executing program 5 (id=2542): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000d80)=ANY=[@ANYBLOB="c400000001140112ff05000000000000"], 0x10}, 0x1, 0x0, 0x0, 0x24008000}, 0x20000080) syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x80000, 0x3a) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x4, 0xfffffe0000000001, 0xfa14, 0xffffffff}, 0x0) r4 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) ioctl$IMDELTIMER(r4, 0x80044941, &(0x7f00000000c0)=0x2) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = syz_open_dev$evdev(&(0x7f0000000080), 0xa, 0x300) ioctl$EVIOCGEFFECTS(r6, 0x80044584, &(0x7f0000000200)=""/238) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x8, 0x3, 0x478, 0x1c0, 0xffffffff, 0xffffffff, 0x1c0, 0xffffffff, 0x3a8, 0xffffffff, 0xffffffff, 0x3a8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@remote, @loopback, [0xff, 0x0, 0xff, 0xff], [0xffffffff, 0xff, 0xff], 'team_slave_0\x00', 'netdevsim0\x00', {}, {0xff}, 0x29, 0x3, 0x0, 0x60}, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x9, 0x2, 0x24, 0x0, 'syz0\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x1c8, 0x1e8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x1, 0x1, 'syz0\x00', 0xfe}}, @common=@mh={{0x28}, {"b11c", 0x1}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4d8) quotactl_fd$Q_GETFMT(0xffffffffffffffff, 0xffffffff80000402, 0xffffffffffffffff, 0x0) ioprio_set$pid(0x3, 0x0, 0x0) ioprio_get$uid(0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0xc) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000003640)={0x0, 'hsr0\x00', {0x1}, 0x7}) r7 = open(&(0x7f00000003c0)='./file0\x00', 0x48040, 0x0) finit_module(r7, 0x0, 0x2) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000500)={'hsr0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x3b, 0x2, [{0x9, 0x6}, {0x7, 0x101}]}}) 1.004108994s ago: executing program 2 (id=2543): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./file2\x00', 0xa) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000012c0)) r2 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f0000000100)=r3, 0x4) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r4 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r4, 0x80047c05, &(0x7f0000000080)) syz_open_dev$radio(0x0, 0x1, 0x2) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, 0x0, 0x0) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r6, 0x4008af00, &(0x7f00000001c0)=0x304008000) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f00000003c0)={0x1}) capget(&(0x7f0000000080)={0x19980330}, &(0x7f00000003c0)={0x9, 0x3, 0x6, 0x4, 0xfffffffd, 0x7fff}) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000001a00010026bd70000000000002002000", @ANYBLOB="b15d0000080002000c00000014000100fc0200000000000000000000000000008aa0895ed9c36e6ddbf8b873b5e649cea0acf6c70be294a5c6965d99b863d3951d4bd8b8953e7086702ec2fcbf7e795decc8fd34211b6d52de82f837c48731"], 0x38}, 0x1, 0x0, 0x0, 0x20040050}, 0x0) mount(&(0x7f0000000140)=@loop={'/dev/loop', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='omfs\x00', 0x200008, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 996.976335ms ago: executing program 4 (id=2544): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x30, 0x3e, 0x107, 0x70bd2b, 0x0, {0x1, 0x7c, 0x3f}, [@nested={0x4, 0xfc}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0xe5}]}, @nested={0x8, 0x2, 0x0, 0x1, [@generic="7235ab62"]}, @typed={0x8, 0x7, 0x0, 0x0, @pid}]}, 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 912.227927ms ago: executing program 0 (id=2545): syz_open_dev$sndctrl(0x0, 0x2, 0x60000) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendmmsg$inet(r0, &(0x7f0000000780)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c00000000ffff000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac1414aaffffffff0000000010000000000000000000000007"], 0x30}}], 0x1, 0x2402c004) 859.232711ms ago: executing program 4 (id=2546): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000010000000000000ff030000850000002800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002280)={r1, 0x0, 0xe, 0x0, &(0x7f00000008c0)="e02742e8680d85ff9782762f86dd", 0x0, 0x57af, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xf0}, 0x50) 738.767383ms ago: executing program 0 (id=2547): socket(0x10, 0x80002, 0xfffffffa) socket(0x10, 0x2, 0x40002) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'geneve0\x00'}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4020aeb2, &(0x7f0000000000)={0x1, 0xffffffffffffffff, 0x400}) r2 = socket$igmp6(0xa, 0x3, 0x2) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x5, 0x2010, r2, 0xbfa0c000) socket(0x1, 0x800, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req={0x200, 0x418c, 0x10}, 0x10) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0xa, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa0d, 0xfffbffff}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) fchdir(0xffffffffffffffff) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCMBIC(r5, 0x5417, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89901) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000007, 0x4010, r2, 0x1d6e9000) pselect6(0x40, &(0x7f00000000c0)={0xe, 0x10001, 0x3, 0x0, 0x80000000, 0x4, 0x51}, &(0x7f0000000140)={0x800, 0x7, 0x6, 0x9, 0x15, 0x1, 0x0, 0x1}, &(0x7f0000000180)={0xf, 0x4f6c, 0x1ff, 0x922e, 0x7062, 0xfffffffffffffff1, 0x5, 0xffffffffffffff06}, &(0x7f0000000200)={0x77359400}, &(0x7f0000000300)={&(0x7f0000000240)={[0x83]}, 0x8}) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r6, r6, 0x0, 0x2000fb) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x2000000, @initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, 0x9}]}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 690.128508ms ago: executing program 3 (id=2548): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) capset(&(0x7f0000000980)={0x19980330}, &(0x7f0000000200)={0x200002, 0x200003, 0x9, 0x8000004, 0x7, 0x5}) ioctl$VT_RELDISP(r0, 0x5605) munmap(&(0x7f00008eb000/0x4000)=nil, 0x4000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r3, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r2, 0x3ba0, &(0x7f0000000280)={0x48, 0xa, r4}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f000002eff0)={0x20d, &(0x7f0000000000)=[{0x4, 0xd, 0x8, 0x7fff}, {0x9000, 0x2, 0x12, 0x8}]}, 0x10) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f00000002c0)=0x6, 0x4) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f0000000040)=0x2563, 0x4) sendto$inet(r5, &(0x7f0000000100)="1ce0", 0xffeb, 0x0, &(0x7f0000001100)={0x2, 0x0, @private}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'veth0_to_batadv\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000d40)=@newtfilter={0x2c4, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x3f, r8, {0x5, 0x4}, {0xd}, {0x10, 0x9}}, [@filter_kind_options=@f_matchall={{0xd}, {0x290, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x4}, @TCA_MATCHALL_FLAGS={0x8}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xc, 0xd}}, @TCA_MATCHALL_ACT={0x274, 0x2, [@m_ct={0x70, 0x18, 0x0, 0x0, {{0x7}, {0x4}, {0x47, 0x6, "bec24efd8e721c33114ad265a37fe324d067f117309101cb460363004ef3f5e9595d48aa37abe386f338b598d6d3b7ef17db85855d547ee6a7da87609886aeb439ebe2"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_nat={0x10c, 0x2, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0x0, 0x6, 0x8, 0x4}, @multicast2, @multicast2, 0xff000000, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x1, 0x2, 0x278, 0x40}, @loopback, @remote, 0xffffff00}}]}, {0x92, 0x6, "3cdcdf1dd4f652ea86b229a96aee3e0c43b8f2ba2a4f98820a7a750fe2b90a9e2f7db40094e727a270b3c09c801c0ba6c86ceb767943054ecb198e7b95729a4283af5d8de62db3e48dc576173bd255a5e476cc5df701bc7c233fb95744845e170bd184304090fa5cced86ddac11965dd02fa0c661961ce0352cdd91b07752d0cdef14356a6420d48540b0760bb86"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_skbmod={0xf4, 0x1d, 0x0, 0x0, {{0xb}, {0x64, 0x2, 0x0, 0x1, [@TCA_SKBMOD_ETYPE={0x6, 0x5, 0xf}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x7f}, @TCA_SKBMOD_SMAC={0xa, 0x4, @multicast}, @TCA_SKBMOD_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x2, 0x3, 0x1, 0x649, 0x7}, 0x8000000000000001}}, @TCA_SKBMOD_ETYPE={0x6}, @TCA_SKBMOD_SMAC={0xa}]}, {0x67, 0x6, "fff9ffc7ca22433654687fa4ae49022e68e2b1c6a0a032e4d9fc249e240ef06df102cf6d739b3545167ee782d6ca700dece6afbd8bd0868d1a3c0f6981b6b6d03985f81ed51611a7b38611afe96f370b3d70356d6957d03d8bcd34dda83a4509be6a3c"}, {0xc}, {0xc, 0x8, {0x3, 0x1}}}}]}]}}]}, 0x2c4}}, 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r10, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r9, 0x0}]) 394.757098ms ago: executing program 4 (id=2549): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) msgget$private(0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, 0x0) read$FUSE(r0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x24008004) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000680)={"e2859501099928bfcfb4fde644bcab2c", 0x0, 0x0, {0xc, 0x3ff}, {0xfff, 0x5}, 0x8000000000, [0xffffffff, 0x1, 0x1, 0x7, 0x6, 0x0, 0x5, 0xe99, 0x0, 0x8e, 0x6, 0x9, 0x0, 0xfffffffffffffffa, 0x5, 0x9]}) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r0, 0x5000943f, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x6, @mcast2, 0x6}, 0x1c) sendto$inet6(r2, &(0x7f0000000080)="800037bbfa9ba1ce", 0xffd8, 0x2004000000000000, 0x0, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000001c0)) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$nl_xfrm(0x10, 0x3, 0x6) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x10, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra}}}}}, 0x0) 124.567467ms ago: executing program 4 (id=2550): ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0xc52, '\x00', r0, 0xffffffffffffffff, 0x5, 0x5, 0x3}, 0x50) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) getpeername$netrom(0xffffffffffffffff, &(0x7f0000000240)={{0x3, @default}, [@default, @bcast, @bcast, @remote, @rose, @remote, @rose, @netrom]}, &(0x7f00000002c0)=0x48) readlink(&(0x7f0000000540)='./cgroup\x00', &(0x7f0000000ac0)=""/157, 0x9d) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x6, &(0x7f0000000000)=[{0xbc, 0x1, 0x7, 0x400}, {0x5, 0xcf, 0x7, 0x1}, {0x6, 0x38, 0x3, 0x1}, {0x9, 0xfd, 0x0, 0x8}, {0x1, 0x8, 0x5, 0x9}, {0x1, 0x3, 0xb, 0x96f}]}, 0x10) 0s ago: executing program 4 (id=2551): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x1, 0x5, 0x2, 0x4, 0x0, 0xffffffffffffffff, 0xffffffff}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000010000e1850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0xc03e0000) kernel console output (not intermixed with test programs): kqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 617.793737][T13196] infiniband syz2: Couldn't open port 1 [ 617.944170][T13196] RDS/IB: syz2: added [ 617.949850][T13196] smc: adding ib device syz2 with port count 1 [ 617.956174][T13196] smc: ib device syz2 port 1 has no pnetid [ 619.312411][ T30] audit: type=1400 audit(2000000423.698:1105): avc: denied { create } for pid=13209 comm="syz.3.1895" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 619.407152][T13215] IPVS: set_ctl: invalid protocol: 59 100.1.1.1:20004 [ 619.821458][T13214] 9p: Could not find request transport: rD[}"ldmaport=0x000000000004ex00000000000 [ 619.876814][ T30] audit: type=1400 audit(2000000424.232:1106): avc: denied { setopt } for pid=13209 comm="syz.3.1895" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 620.178339][ T24] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 620.608544][ T6327] net_ratelimit: 40 callbacks suppressed [ 620.608577][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 620.743059][ T24] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 621.025985][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 621.042795][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 621.102561][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 621.112665][ T30] audit: type=1400 audit(2000000425.383:1107): avc: denied { wake_alarm } for pid=13225 comm="syz.2.1898" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 621.238643][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 621.251898][ T24] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 621.261119][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.279196][ T24] usb 4-1: config 0 descriptor?? [ 621.658157][T13229] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1898'. [ 621.722438][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 621.910088][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 622.199405][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 622.227464][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 622.243204][ T24] plantronics 0003:047F:FFFF.0019: ignoring exceeding usage max [ 622.257132][T13238] tipc: Enabling of bearer rejected, failed to enable media [ 622.294410][ T24] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 622.373182][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 622.400757][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 622.693279][ T78] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 622.719294][ T78] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 623.918447][ T5871] usb 4-1: reset high-speed USB device number 59 using dummy_hcd [ 624.900654][ T24] usb 4-1: USB disconnect, device number 59 [ 624.980828][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 626.115980][ T78] net_ratelimit: 43 callbacks suppressed [ 626.115997][ T78] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 626.142258][ T78] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 626.261947][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 626.643252][ T30] audit: type=1400 audit(2000000430.352:1108): avc: denied { firmware_load } for pid=13279 comm="syz.3.1913" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 626.780847][T13280] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1911'. [ 626.873593][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 626.920070][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 626.938954][T13286] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1911'. [ 627.081266][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 627.132105][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 627.273785][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 627.293990][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 627.843863][ T30] audit: type=1400 audit(2000000431.681:1109): avc: denied { bind } for pid=13296 comm="syz.0.1916" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 627.937509][T10843] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 628.929844][ T30] audit: type=1400 audit(2000000432.701:1110): avc: denied { read } for pid=13314 comm="syz.3.1920" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 630.050280][ T30] audit: type=1400 audit(2000000433.749:1111): avc: denied { create } for pid=13342 comm="syz.0.1927" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 631.387884][ T5819] Bluetooth: hci1: command 0x0406 tx timeout [ 631.388231][T13317] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 631.561227][T10843] net_ratelimit: 51 callbacks suppressed [ 631.561245][T10843] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 631.587167][T10843] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 631.718985][T10843] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 631.728642][T10843] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 631.847255][ T78] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 631.856715][ T78] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 631.987994][ T78] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 631.996598][ T78] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 632.043698][T13317] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 632.066583][T13317] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 632.085927][T13317] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 632.100906][T13317] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 632.107483][T13317] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 632.129432][ T78] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 632.137390][ T78] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 633.611270][ T5819] Bluetooth: hci1: command 0x0406 tx timeout [ 633.683571][T13391] input: syz1 as /devices/virtual/input/input21 [ 633.773193][T13394] netlink: 'syz.0.1939': attribute type 1 has an invalid length. [ 634.064526][ T30] audit: type=1400 audit(2000000437.511:1112): avc: denied { bind } for pid=13390 comm="syz.2.1941" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 634.174862][ T30] audit: type=1400 audit(2000000437.511:1113): avc: denied { node_bind } for pid=13390 comm="syz.2.1941" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 634.208872][ T5819] Bluetooth: hci3: command 0x0406 tx timeout [ 634.294315][ T5819] Bluetooth: hci4: command 0x0406 tx timeout [ 636.781936][ T5819] Bluetooth: hci3: command 0x0406 tx timeout [ 636.787996][ T5819] Bluetooth: hci4: command 0x0406 tx timeout [ 637.342513][T11772] net_ratelimit: 52 callbacks suppressed [ 637.342527][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 637.442315][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 637.586047][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 637.596450][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 637.694191][ T30] audit: type=1400 audit(2000000440.908:1114): avc: denied { accept } for pid=13442 comm="syz.5.1953" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 637.715399][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 637.744961][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 637.899418][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 637.916901][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 638.449396][T10843] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 638.473356][T10843] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 639.771538][T13480] bridge3: entered allmulticast mode [ 639.845564][T13485] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 640.027954][T13485] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 640.046065][ T30] audit: type=1400 audit(2000000442.929:1115): avc: denied { watch_sb watch_reads } for pid=13474 comm="syz.2.1961" path="/364/file1" dev="tmpfs" ino=1976 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 640.483422][T13493] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1965'. [ 640.812180][T13503] netlink: 'syz.4.1967': attribute type 29 has an invalid length. [ 640.860009][ T30] audit: type=1400 audit(2000000443.874:1116): avc: denied { map } for pid=13502 comm="syz.3.1969" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 640.885589][T13503] netlink: 'syz.4.1967': attribute type 29 has an invalid length. [ 640.898926][T13503] netlink: 'syz.4.1967': attribute type 29 has an invalid length. [ 640.909564][T13503] netlink: 'syz.4.1967': attribute type 29 has an invalid length. [ 640.921495][T13503] netlink: 'syz.4.1967': attribute type 29 has an invalid length. [ 640.929687][T13503] netlink: 'syz.4.1967': attribute type 29 has an invalid length. [ 640.948979][T13503] netlink: 'syz.4.1967': attribute type 29 has an invalid length. [ 641.034320][T13500] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1967'. [ 641.209035][ T30] audit: type=1400 audit(2000000444.164:1117): avc: denied { create } for pid=13517 comm="syz.0.1972" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 641.219436][T13525] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 641.899165][ T30] audit: type=1400 audit(2000000444.838:1118): avc: denied { create } for pid=13533 comm="syz.0.1975" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 642.590170][ T30] audit: type=1400 audit(2000000444.885:1119): avc: denied { read } for pid=13533 comm="syz.0.1975" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 642.640139][ T24] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 642.725669][ T1144] net_ratelimit: 56 callbacks suppressed [ 642.725688][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 642.763427][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 642.913084][ T24] usb 6-1: New USB device found, idVendor=0e41, idProduct=3020, bcdDevice= 0.40 [ 642.923610][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 642.936521][ T24] usb 6-1: Product: syz [ 642.940807][ T24] usb 6-1: Manufacturer: ࠒ [ 643.007154][T10843] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 643.007820][ T24] usb 6-1: SerialNumber: syz [ 643.041338][T10843] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 643.185335][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 643.193225][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 643.387963][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 643.428435][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 643.455590][ T24] usb 6-1: USB disconnect, device number 33 [ 643.513621][T13367] udevd[13367]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 643.548475][T10843] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 643.559085][T10843] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 643.612397][ T30] audit: type=1400 audit(2000000446.438:1120): avc: denied { mount } for pid=13552 comm="syz.4.1979" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 643.875949][T13557] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1980'. [ 644.718847][T13567] input: syz1 as /devices/virtual/input/input22 [ 645.185971][T13567] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 647.108720][T13599] fuse: Bad value for 'user_id' [ 647.113801][T13599] fuse: Bad value for 'user_id' [ 648.038298][ T30] audit: type=1400 audit(2000000450.593:1121): avc: denied { create } for pid=13602 comm="syz.4.1994" name="file2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 648.346468][ T30] audit: type=1400 audit(2000000450.612:1122): avc: denied { read } for pid=13602 comm="syz.4.1994" name="file2" dev="tmpfs" ino=2214 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 648.368975][ T30] audit: type=1400 audit(2000000450.612:1123): avc: denied { open } for pid=13602 comm="syz.4.1994" path="/405/file2" dev="tmpfs" ino=2214 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 648.372289][T10843] net_ratelimit: 55 callbacks suppressed [ 648.372303][T10843] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 648.478791][ T30] audit: type=1400 audit(2000000450.612:1124): avc: denied { ioctl } for pid=13602 comm="syz.4.1994" path="/405/file2" dev="tmpfs" ino=2214 ioctlcmd=0x583c scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 648.496038][T10843] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 648.632353][T10843] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 648.670978][ T30] audit: type=1400 audit(2000000450.659:1125): avc: denied { create } for pid=13602 comm="syz.4.1994" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 649.039154][T10843] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 649.062524][ T30] audit: type=1400 audit(2000000450.715:1126): avc: denied { bind } for pid=13602 comm="syz.4.1994" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 649.155601][ T30] audit: type=1400 audit(2000000451.613:1127): avc: denied { unlink } for pid=5803 comm="syz-executor" name="file2" dev="tmpfs" ino=2214 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 649.244088][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 649.253856][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 649.295165][ T30] audit: type=1400 audit(2000000451.632:1128): avc: denied { bind } for pid=13610 comm="syz.0.1996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 649.398830][ T30] audit: type=1400 audit(2000000451.660:1129): avc: denied { setopt } for pid=13610 comm="syz.0.1996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 649.418696][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 649.438610][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 649.488321][ T30] audit: type=1400 audit(2000000451.922:1130): avc: denied { setopt } for pid=13626 comm="syz.5.2002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 649.554327][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 649.562235][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 649.832954][T13640] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2001'. [ 649.928082][T13640] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2001'. [ 649.949838][ T24] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 650.194546][ T24] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 650.203955][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.227778][ T24] usb 6-1: Product: syz [ 650.231988][ T24] usb 6-1: Manufacturer: syz [ 650.266094][ T24] usb 6-1: SerialNumber: syz [ 650.290587][ T24] usb 6-1: config 0 descriptor?? [ 651.885479][T13652] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2008'. [ 651.895940][T13657] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2009'. [ 653.167357][T13686] No control pipe specified [ 653.260155][T13686] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2017'. [ 653.347252][T13686] hsr_slave_0: left promiscuous mode [ 653.393403][T13686] hsr_slave_1: left promiscuous mode [ 653.687217][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 653.687234][ T30] audit: type=1400 audit(2000000455.834:1134): avc: denied { ioctl } for pid=13694 comm="syz.2.2019" path="socket:[45154]" dev="sockfs" ino=45154 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 653.834898][ T6327] net_ratelimit: 79 callbacks suppressed [ 653.837094][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 653.855661][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 653.994196][ T24] usb 6-1: USB disconnect, device number 34 [ 654.010919][ T78] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 654.019447][ T78] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 654.159832][ T78] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 654.170489][ T78] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 654.447500][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 654.456692][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 654.609521][ T78] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 654.609592][ T78] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 654.619465][ T30] audit: type=1400 audit(2000000456.732:1135): avc: denied { write } for pid=13708 comm="syz.2.2023" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 654.761288][T13713] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2023'. [ 654.979474][T13713] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 655.786862][T13726] netlink: 'syz.0.2028': attribute type 7 has an invalid length. [ 655.996086][ T30] audit: type=1400 audit(2000000458.033:1136): avc: denied { open } for pid=13731 comm="syz.3.2030" path="/dev/ttyqa" dev="devtmpfs" ino=385 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 656.000339][T13732] netlink: 'syz.3.2030': attribute type 1 has an invalid length. [ 656.054672][T13732] bond2: entered promiscuous mode [ 656.059944][T13732] 8021q: adding VLAN 0 to HW filter on device bond2 [ 656.195908][T13739] 8021q: adding VLAN 0 to HW filter on device bond2 [ 656.216138][T13739] bond2: (slave vcan1): The slave device specified does not support setting the MAC address [ 656.281197][ T30] audit: type=1400 audit(2000000458.304:1137): avc: denied { ioctl } for pid=13742 comm="syz.4.2033" path="socket:[45009]" dev="sockfs" ino=45009 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 656.307231][T13739] bond2: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 656.335156][T13739] bond2: (slave vcan1): making interface the new active one [ 656.366104][T13739] vcan1: entered promiscuous mode [ 656.401655][T13739] bond2: (slave vcan1): Enslaving as an active interface with an up link [ 656.534605][ T30] audit: type=1400 audit(2000000458.538:1138): avc: denied { ioctl } for pid=13755 comm="syz.3.2038" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 656.659740][T13760] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 656.827539][T13763] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2036'. [ 657.018249][T13765] nbd: couldn't find a device at index 71 [ 657.153508][T13767] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2040'. [ 657.942025][T13779] 9p: Bad value for 'rfdno' [ 657.989031][T13784] netlink: 112 bytes leftover after parsing attributes in process `syz.0.2044'. [ 658.045579][ T30] audit: type=1400 audit(2000000459.951:1139): avc: denied { map } for pid=13771 comm="syz.2.2042" path="socket:[45045]" dev="sockfs" ino=45045 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 658.124814][ T30] audit: type=1400 audit(2000000459.951:1140): avc: denied { read accept } for pid=13771 comm="syz.2.2042" path="socket:[45045]" dev="sockfs" ino=45045 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 658.158705][ T24] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 658.200124][T13775] orangefs_mount: mount request failed with -4 [ 658.260566][ T30] audit: type=1400 audit(2000000459.979:1141): avc: denied { shutdown } for pid=13771 comm="syz.2.2042" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 658.533784][T13799] tipc: Started in network mode [ 658.538710][T13799] tipc: Node identity aaaaaaaaaa38, cluster identity 4711 [ 658.546161][T13799] tipc: Enabled bearer , priority 0 [ 659.627954][T10843] net_ratelimit: 79 callbacks suppressed [ 659.627971][T10843] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 659.641404][T10843] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 659.684197][ T30] audit: type=1400 audit(2000000461.486:1142): avc: denied { setopt } for pid=13811 comm="syz.4.2053" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 659.769909][ T85] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 659.777806][ T85] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 659.795483][ T24] tipc: Node number set to 9611946 [ 659.892391][ T30] audit: type=1400 audit(2000000461.682:1143): avc: denied { bind } for pid=13816 comm="syz.5.2055" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 659.919442][ T85] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 659.989414][ T85] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 659.999156][ T30] audit: type=1400 audit(2000000461.682:1144): avc: denied { setopt } for pid=13816 comm="syz.5.2055" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 660.037269][ T85] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 660.045100][ T85] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 660.176010][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 660.198218][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 660.249397][T13830] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2058'. [ 662.121667][T13849] all (unregistering): Released all slaves [ 662.480067][T13864] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2065'. [ 662.536678][ T30] audit: type=1400 audit(2000000464.143:1145): avc: denied { setopt } for pid=13866 comm="syz.0.2066" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 664.260230][T13916] /dev/nullb0: Can't open blockdev [ 664.297167][ T30] audit: type=1400 audit(2000000465.781:1146): avc: denied { read write } for pid=13918 comm="syz.5.2079" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 664.410831][ T30] audit: type=1400 audit(2000000465.790:1147): avc: denied { open } for pid=13918 comm="syz.5.2079" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 664.458507][ T30] audit: type=1400 audit(2000000465.790:1148): avc: denied { ioctl } for pid=13918 comm="syz.5.2079" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 664.545787][ T30] audit: type=1400 audit(2000000465.828:1149): avc: denied { read } for pid=13918 comm="syz.5.2079" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 664.989023][T13938] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2082'. [ 665.327037][ T6327] net_ratelimit: 75 callbacks suppressed [ 665.327055][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 665.383502][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 665.649790][ T85] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 665.657560][ T85] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 665.665020][ T30] audit: type=1400 audit(2000000467.044:1150): avc: denied { listen } for pid=13941 comm="syz.5.2085" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 665.706968][ T30] audit: type=1400 audit(2000000467.044:1151): avc: denied { accept } for pid=13941 comm="syz.5.2085" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 666.122970][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 666.140963][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 666.301290][T10843] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 666.314409][T10843] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 666.446795][ T85] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 666.454704][ T85] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 667.147123][T13962] libceph: resolve 'cϐ' (ret=-3): failed [ 667.298626][ T5878] kernel write not supported for file /vcs (pid: 5878 comm: kworker/0:4) [ 668.427004][T13991] erspan1: entered allmulticast mode [ 669.249678][T14010] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 669.549238][T14011] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14011 comm=syz.5.2102 [ 669.600904][T14011] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2102'. [ 669.738467][T14013] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2101'. [ 670.282199][T14024] libceph: resolve 'cϐ' (ret=-3): failed [ 670.755514][ T78] net_ratelimit: 63 callbacks suppressed [ 670.755530][ T78] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 670.808673][ T78] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 670.866091][T14038] x_tables: ip_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 670.959475][ T30] audit: type=1400 audit(2000000472.042:1152): avc: denied { connect } for pid=14039 comm="syz.5.2113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 670.969073][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 671.101838][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 671.246352][ T85] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 671.255787][ T85] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 671.748436][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 671.756227][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 671.758797][ T30] audit: type=1400 audit(2000000472.772:1153): avc: denied { shutdown } for pid=14039 comm="syz.5.2113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 671.887822][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 672.047085][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 672.209183][T14053] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2116'. [ 672.525701][ T30] audit: type=1400 audit(2000000473.483:1154): avc: denied { connect } for pid=14055 comm="syz.4.2117" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 673.502171][T14060] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2115'. [ 673.502266][T14060] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 674.000824][T14060] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 674.052313][T14064] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2118'. [ 674.626258][T14079] nfs: Unknown parameter 'ac' [ 674.800949][T14079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2123'. [ 674.908929][ T30] audit: type=1326 audit(2000000475.701:1155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14070 comm="syz.5.2122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f945119c799 code=0x7ffc0000 [ 674.941226][ T30] audit: type=1326 audit(2000000475.701:1156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14070 comm="syz.5.2122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f945119c799 code=0x7ffc0000 [ 675.133401][ T30] audit: type=1326 audit(2000000475.701:1157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14070 comm="syz.5.2122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f945119c799 code=0x7ffc0000 [ 675.220438][ T30] audit: type=1326 audit(2000000475.701:1158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14070 comm="syz.5.2122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f945119c799 code=0x7ffc0000 [ 675.277215][ T5878] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 675.297201][ T30] audit: type=1326 audit(2000000475.701:1159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14070 comm="syz.5.2122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f945119c799 code=0x7ffc0000 [ 675.360809][ T30] audit: type=1326 audit(2000000475.701:1160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14070 comm="syz.5.2122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f945119c799 code=0x7ffc0000 [ 675.443482][ T30] audit: type=1326 audit(2000000475.701:1161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14070 comm="syz.5.2122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f945119c799 code=0x7ffc0000 [ 675.498652][ T30] audit: type=1326 audit(2000000475.701:1162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14070 comm="syz.5.2122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f945119c799 code=0x7ffc0000 [ 675.500213][ T5878] usb 4-1: too many configurations: 53, using maximum allowed: 8 [ 675.635650][ T5878] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 675.664955][ T5878] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.704738][ T5878] usb 4-1: Product: syz [ 675.727538][ T5878] usb 4-1: Manufacturer: syz [ 675.951208][ T5878] usb 4-1: SerialNumber: syz [ 676.165614][T14105] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2127'. [ 676.196981][ T85] net_ratelimit: 39 callbacks suppressed [ 676.196993][ T85] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 676.626978][ T85] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 676.644355][ T5878] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 676.688467][ T5878] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 676.752434][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 676.761911][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 676.761952][ T5878] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 676.810585][ T5878] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 676.829533][ T5878] usb 4-1: USB disconnect, device number 60 [ 676.921043][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 677.002143][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 677.562521][ T12] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 677.600488][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 677.733085][ T85] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 678.065441][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 678.065455][ T30] audit: type=1400 audit(2000000478.695:1172): avc: denied { call } for pid=14115 comm="syz.3.2130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 678.066683][T14120] 9pnet: p9_errstr2errno: server reported unknown error di3 [ 678.107647][ T30] audit: type=1400 audit(2000000478.733:1173): avc: denied { transfer } for pid=14115 comm="syz.3.2130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 678.300844][T14128] libceph: resolve 'cϐ' (ret=-3): failed [ 678.616881][T14120] binder: 14115:14120 ioctl c0306201 200000000680 returned -14 [ 679.042628][T14137] FAULT_INJECTION: forcing a failure. [ 679.042628][T14137] name failslab, interval 1, probability 0, space 0, times 0 [ 679.108728][T14137] CPU: 0 UID: 0 PID: 14137 Comm: syz.2.2136 Not tainted syzkaller #0 PREEMPT(full) [ 679.108757][T14137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 679.108764][T14137] Call Trace: [ 679.108768][T14137] [ 679.108773][T14137] dump_stack_lvl+0x100/0x190 [ 679.108794][T14137] should_fail_ex.cold+0x5/0xa [ 679.108809][T14137] should_failslab+0xc2/0x120 [ 679.108828][T14137] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 679.108843][T14137] ? ima_inode_get+0x11f/0x580 [ 679.108858][T14137] ima_inode_get+0x11f/0x580 [ 679.108872][T14137] process_measurement+0x1213/0x2350 [ 679.108890][T14137] ? __pfx_process_measurement+0x10/0x10 [ 679.108902][T14137] ? avc_has_perm_noaudit+0x145/0x3b0 [ 679.108922][T14137] ? __pfx_avc_has_perm+0x10/0x10 [ 679.108937][T14137] ? find_held_lock+0x2b/0x80 [ 679.108951][T14137] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 679.108981][T14137] ? file_map_prot_check+0x236/0x3f0 [ 679.109001][T14137] ima_file_mmap+0x1bb/0x1e0 [ 679.109015][T14137] ? __pfx_ima_file_mmap+0x10/0x10 [ 679.109028][T14137] ? lockdep_init_map_type+0x5c/0x250 [ 679.109041][T14137] security_mmap_file+0x278/0x9b0 [ 679.109055][T14137] vm_mmap_pgoff+0xec/0x470 [ 679.109068][T14137] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 679.109078][T14137] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 679.109093][T14137] ? hugetlbfs_get_inode+0x36e/0x750 [ 679.109106][T14137] ? __fget_files+0x215/0x3d0 [ 679.109121][T14137] ksys_mmap_pgoff+0x273/0x650 [ 679.109141][T14137] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 679.109157][T14137] ? fput+0x79/0x100 [ 679.109169][T14137] ? ksys_write+0x1ac/0x250 [ 679.109185][T14137] ? __pfx_ksys_write+0x10/0x10 [ 679.109203][T14137] __x64_sys_mmap+0x125/0x190 [ 679.109216][T14137] do_syscall_64+0x106/0xf80 [ 679.109228][T14137] ? clear_bhb_loop+0x40/0x90 [ 679.109241][T14137] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 679.109253][T14137] RIP: 0033:0x7f482299c799 [ 679.109263][T14137] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 679.109273][T14137] RSP: 002b:00007f4820bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 679.109284][T14137] RAX: ffffffffffffffda RBX: 00007f4822c16090 RCX: 00007f482299c799 [ 679.109291][T14137] RDX: 000000000200003f RSI: 0000000000ff5000 RDI: 0000200000000000 [ 679.109297][T14137] RBP: 00007f4820bf6090 R08: ffffffffffffffff R09: 000000001cbf8000 [ 679.109304][T14137] R10: 000000000004c831 R11: 0000000000000246 R12: 0000000000000001 [ 679.109310][T14137] R13: 00007f4822c16128 R14: 00007f4822c16090 R15: 00007ffc9129d848 [ 679.109324][T14137] [ 680.028334][T14154] comedi: No check for data length of config insn id 7 is implemented [ 680.084147][T14154] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 680.141054][T14154] comedi: Assuming n=20858 is correct [ 680.983184][T14163] block device autoloading is deprecated and will be removed. [ 681.037998][T14165] tmpfs: Bad value for 'mpol' [ 681.115269][T14163] netlink: 'syz.2.2144': attribute type 4 has an invalid length. [ 681.216779][T14165] netlink: 'syz.2.2144': attribute type 4 has an invalid length. [ 681.548987][T11770] net_ratelimit: 55 callbacks suppressed [ 681.548999][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 681.578352][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 681.749500][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 681.758475][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 681.772621][ T5878] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 681.857941][ T5805] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 681.923449][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 681.931184][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 682.018419][ T5878] usb 3-1: Using ep0 maxpacket: 8 [ 682.050306][ T5805] usb 4-1: Using ep0 maxpacket: 32 [ 682.180085][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 682.188296][ T5878] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 682.188337][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 682.269233][ T5805] usb 4-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 682.284939][ T5805] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.301843][ T5878] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 682.320466][ T5805] usb 4-1: Product: syz [ 682.329044][ T5878] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 682.338793][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 682.347881][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 682.358097][ T5805] usb 4-1: Manufacturer: syz [ 682.370584][ T5805] usb 4-1: SerialNumber: syz [ 682.385182][ T5878] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 682.401161][ T5805] usb 4-1: config 0 descriptor?? [ 682.421440][ T5805] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 682.431769][ T5878] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 682.496569][ T5878] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 682.700085][ T5878] hub 3-1:1.0: bad descriptor, ignoring hub [ 682.717244][ T5878] hub 3-1:1.0: probe with driver hub failed with error -5 [ 682.748047][ T5878] cdc_wdm 3-1:1.0: skipping garbage [ 682.775490][ T5878] cdc_wdm 3-1:1.0: skipping garbage [ 682.813232][ T5878] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 682.894993][ T5878] cdc_wdm 3-1:1.0: Unknown control protocol [ 682.904791][T14213] RDS: rds_bind could not find a transport for ::ffff:10.1.1.1, load rds_tcp or rds_rdma? [ 682.940578][ T30] audit: type=1400 audit(2000000483.234:1174): avc: denied { read write } for pid=14159 comm="syz.2.2144" name="cdc-wdm0" dev="devtmpfs" ino=3424 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 683.067289][ T30] audit: type=1400 audit(2000000483.243:1175): avc: denied { open } for pid=14159 comm="syz.2.2144" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3424 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 683.107836][ T30] audit: type=1400 audit(2000000483.393:1176): avc: denied { ioctl } for pid=14194 comm="syz.3.2147" path="/dev/cpu/1/msr" dev="devtmpfs" ino=89 ioctlcmd=0x63a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 684.059121][ T5805] gspca_topro: reg_w err -110 [ 684.142912][ T5805] gspca_topro: Sensor soi763a [ 684.875246][ T5805] usb 3-1: USB disconnect, device number 42 [ 684.983410][T14226] netlink: 'syz.2.2157': attribute type 1 has an invalid length. [ 685.005678][T14226] netlink: 5 bytes leftover after parsing attributes in process `syz.2.2157'. [ 685.170645][ T29] usb 4-1: USB disconnect, device number 61 [ 685.253130][ T30] audit: type=1400 audit(2000000485.414:1177): avc: denied { mounton } for pid=14225 comm="syz.2.2157" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 685.298216][T14226] lo: left allmulticast mode [ 685.303187][T14226] tunl0: left allmulticast mode [ 685.310537][T14226] gre0: left allmulticast mode [ 685.315788][T14226] gretap0: left allmulticast mode [ 685.364641][T14226] ip_vti0: left allmulticast mode [ 685.395654][T14226] ip6_vti0: left allmulticast mode [ 685.406737][ T30] audit: type=1400 audit(2000000485.414:1178): avc: denied { mount } for pid=14225 comm="syz.2.2157" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 685.430260][T14226] sit0: left allmulticast mode [ 685.458261][T14226] ip6tnl0: left allmulticast mode [ 685.513709][T14226] ip6gre0: left allmulticast mode [ 685.539190][T14226] syz_tun: left allmulticast mode [ 685.582754][T14226] ip6gretap0: left allmulticast mode [ 685.614083][T14226] bridge0: left allmulticast mode [ 685.637948][T14226] .`: left allmulticast mode [ 685.983275][T14226] 8021q: adding VLAN 0 to HW filter on device .` [ 685.990122][T14226] team0: left allmulticast mode [ 686.069735][T14226] 8021q: adding VLAN 0 to HW filter on device team0 [ 686.090040][T14226] dummy0: left allmulticast mode [ 686.110597][T14226] nlmon0: left allmulticast mode [ 686.201047][T14226] caif0: left allmulticast mode [ 686.335599][T14242] 0x00000000000a-0x00000002000a : "" [ 686.340919][T14242] mtd: partition "" extends beyond the end of device "mtdram test device" -- size truncated to 0x1fff6 [ 686.408128][T14242] ftl_cs: FTL header corrupt! [ 686.860936][T14257] gfs2: error -5 reading superblock [ 686.967236][ T36] net_ratelimit: 74 callbacks suppressed [ 686.967249][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 686.998532][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 687.126258][ T5805] usb 4-1: new full-speed USB device number 62 using dummy_hcd [ 687.179554][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 687.187560][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 687.259050][ T30] audit: type=1400 audit(2000000487.295:1179): avc: denied { read append } for pid=14261 comm="syz.2.2166" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 687.376008][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 687.376462][ T5805] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 687.384420][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 687.414627][ T5878] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 687.433242][ T5805] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 687.445777][ T30] audit: type=1400 audit(2000000487.295:1180): avc: denied { open } for pid=14261 comm="syz.2.2166" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 687.473381][ T5805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 41420, setting to 64 [ 687.484631][ T5805] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 687.513487][ T5805] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 687.522958][ T5805] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 687.531086][ T5805] usb 4-1: Product: syz [ 687.538628][ T5805] usb 4-1: Manufacturer: syz [ 687.545482][ T5805] usb 4-1: SerialNumber: syz [ 687.545480][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 687.545504][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 687.575434][ T5805] usb 4-1: config 0 descriptor?? [ 687.592120][T14257] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 687.608061][ T5878] usb 6-1: Using ep0 maxpacket: 8 [ 687.615372][ T5878] usb 6-1: config 64 has an invalid interface number: 19 but max is 0 [ 687.633484][ T5878] usb 6-1: config 64 has no interface number 0 [ 687.664044][ T5878] usb 6-1: config 64 interface 19 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 687.687733][ T5878] usb 6-1: config 64 interface 19 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 687.699575][ T5878] usb 6-1: config 64 interface 19 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 687.713178][ T5878] usb 6-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=3f.e0 [ 687.728610][ T5878] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 687.745946][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 687.755919][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 687.765599][T14260] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 687.774646][ T5878] usb 6-1: probing VID:PID(2201:012C) [ 687.790530][ T5878] usb 6-1: vub300 testing UNKNOWN EndPoint(0) 8F [ 687.799324][ T5878] usb 6-1: vub300 ignoring EndPoint(0) 8F [ 687.810311][ T5878] usb 6-1: Could not find two sets of bulk-in/out endpoint pairs [ 687.822574][ T5805] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 687.833359][ T5805] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -5 [ 687.844066][ T5878] vub300 6-1:64.19: probe with driver vub300 failed with error -22 [ 687.864420][ T5805] usb 4-1: USB disconnect, device number 62 [ 687.972896][T14267] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1107 sclass=netlink_xfrm_socket pid=14267 comm=syz.4.2168 [ 688.005524][T14260] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 688.014384][T14260] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 688.023498][ T29] usb 6-1: USB disconnect, device number 35 [ 688.043571][ T30] audit: type=1400 audit(2000000488.025:1181): avc: denied { getopt } for pid=14266 comm="syz.4.2168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 688.100051][ T30] audit: type=1400 audit(2000000488.081:1182): avc: denied { read } for pid=14266 comm="syz.4.2168" lport=45217 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 688.210560][T14272] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1107 sclass=netlink_xfrm_socket pid=14272 comm=syz.2.2169 [ 689.324851][ T30] audit: type=1804 audit(2000000489.223:1183): pid=14286 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.4.2172" name="file1" dev="ramfs" ino=47408 res=1 errno=0 [ 689.398222][ T30] audit: type=1400 audit(2000000489.251:1184): avc: denied { ioctl } for pid=14285 comm="syz.4.2172" path="socket:[47414]" dev="sockfs" ino=47414 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 689.648638][ T30] audit: type=1400 audit(2000000489.532:1185): avc: denied { read write } for pid=14294 comm="syz.2.2175" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 690.170548][ T30] audit: type=1400 audit(2000000489.532:1186): avc: denied { open } for pid=14294 comm="syz.2.2175" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 690.251920][T14313] input: syz1 as /devices/virtual/input/input23 [ 690.350160][T14312] kvm: pic: non byte write [ 690.466712][T14318] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2182'. [ 690.482421][T14318] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2182'. [ 690.543943][T14318] netlink: 'syz.4.2182': attribute type 1 has an invalid length. [ 690.635253][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 690.815367][ T29] usb 6-1: new low-speed USB device number 36 using dummy_hcd [ 690.992372][ T29] usb 6-1: device descriptor read/64, error -71 [ 691.013708][ T30] audit: type=1400 audit(2000000490.795:1187): avc: denied { mount } for pid=14330 comm="syz.4.2187" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 691.172413][T14347] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2191'. [ 691.199669][T14347] input: syz0 as /devices/virtual/input/input24 [ 691.400522][ T29] usb 6-1: new low-speed USB device number 37 using dummy_hcd [ 691.550138][ T29] usb 6-1: device descriptor read/64, error -71 [ 691.668355][ T29] usb usb6-port1: attempt power cycle [ 692.042091][ T29] usb 6-1: new low-speed USB device number 38 using dummy_hcd [ 692.117696][ T29] usb 6-1: device descriptor read/8, error -71 [ 692.331987][ T6327] net_ratelimit: 63 callbacks suppressed [ 692.332001][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 692.374696][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 692.405023][ T29] usb 6-1: new low-speed USB device number 39 using dummy_hcd [ 692.439280][ T29] usb 6-1: device descriptor read/8, error -71 [ 692.534709][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 692.554692][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 692.583344][ T29] usb usb6-port1: unable to enumerate USB device [ 692.720752][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 692.761812][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 692.899626][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 692.931894][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 693.056912][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 693.064708][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 693.368947][T14374] gfs2: error -5 reading superblock [ 693.610691][T14378] netlink: 'syz.4.2201': attribute type 1 has an invalid length. [ 693.787075][ T5805] usb 4-1: new full-speed USB device number 63 using dummy_hcd [ 694.023380][ T5805] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 694.034799][ T5805] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 694.061384][ T5805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 41420, setting to 64 [ 694.073915][ T5805] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 694.094436][ T5805] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 694.103707][ T5805] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 694.114202][ T5805] usb 4-1: Product: syz [ 694.118575][ T5878] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 694.126361][ T5805] usb 4-1: Manufacturer: syz [ 694.132459][ T5805] usb 4-1: SerialNumber: syz [ 694.141377][ T5805] usb 4-1: config 0 descriptor?? [ 694.147189][T14374] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 694.285803][ T5878] usb 3-1: Using ep0 maxpacket: 16 [ 694.293330][ T5878] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 694.726215][ T5805] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 694.734912][ T5805] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -5 [ 694.743868][ T5878] usb 3-1: config 0 has no interface number 0 [ 694.752924][ T5878] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 694.764328][ T5878] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 694.778468][ T5878] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 694.787663][ T5878] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 694.798474][ T5878] usb 3-1: Product: syz [ 694.803564][ T5878] usb 3-1: SerialNumber: syz [ 694.815022][ T5878] usb 3-1: config 0 descriptor?? [ 694.823801][ T5878] cm109 3-1:0.8: invalid payload size 0, expected 4 [ 694.835116][ T5878] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input25 [ 694.977631][T14388] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 695.082070][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 695.082206][ T29] usb 3-1: USB disconnect, device number 43 [ 695.089234][ C0] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 695.107543][ T29] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 695.161720][T14395] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2207'. [ 696.876935][ T5878] usb 4-1: USB disconnect, device number 63 [ 697.694922][ T49] net_ratelimit: 65 callbacks suppressed [ 697.694971][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 697.713465][T14428] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2217'. [ 697.812735][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 698.407970][ T30] audit: type=1400 audit(2000000497.196:1188): avc: denied { ioctl } for pid=14426 comm="syz.5.2217" path="socket:[47701]" dev="sockfs" ino=47701 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 698.705348][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 698.750624][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 698.812773][T14433] netlink: 304 bytes leftover after parsing attributes in process `syz.2.2212'. [ 698.882885][T14438] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 698.897422][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 698.911263][ T30] audit: type=1400 audit(2000000498.197:1189): avc: denied { write } for pid=14440 comm="syz.5.2221" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 698.941606][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 699.163312][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 699.171057][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 699.184653][T14446] netlink: 'syz.3.2218': attribute type 1 has an invalid length. [ 699.292724][ T30] audit: type=1400 audit(2000000498.506:1190): avc: denied { bind } for pid=14440 comm="syz.5.2221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 699.299018][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 699.606192][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 700.510380][ T30] audit: type=1400 audit(2000000499.292:1191): avc: denied { setopt } for pid=14451 comm="syz.2.2222" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 700.948979][ T29] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 701.114929][ T29] usb 3-1: device descriptor read/64, error -71 [ 701.653497][ T29] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 701.833564][T14474] gfs2: error -5 reading superblock [ 701.840865][ T29] usb 3-1: device descriptor read/64, error -71 [ 701.958723][ T29] usb usb3-port1: attempt power cycle [ 702.770692][ T24] usb 6-1: new full-speed USB device number 40 using dummy_hcd [ 702.794027][ T30] audit: type=1400 audit(2000000501.828:1192): avc: denied { bind } for pid=14481 comm="syz.3.2234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 703.230731][ T30] audit: type=1400 audit(2000000501.828:1193): avc: denied { listen } for pid=14481 comm="syz.3.2234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 703.250868][ T30] audit: type=1400 audit(2000000501.828:1194): avc: denied { accept } for pid=14481 comm="syz.3.2234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 703.252568][ T49] net_ratelimit: 24 callbacks suppressed [ 703.252581][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 703.294123][ T29] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 703.312286][ T24] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 703.329008][ T24] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 703.340768][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 703.353711][ T29] usb 3-1: device descriptor read/8, error -71 [ 703.388478][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 41420, setting to 64 [ 703.433044][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 703.459138][ T24] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 703.474585][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 703.477600][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 703.493685][ T24] usb 6-1: Product: syz [ 703.497216][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 703.504434][ T24] usb 6-1: Manufacturer: syz [ 703.515199][ T24] usb 6-1: SerialNumber: syz [ 703.537108][ T24] usb 6-1: config 0 descriptor?? [ 703.555629][T14474] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 703.626374][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 703.634143][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 703.636054][ T29] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 703.690094][ T29] usb 3-1: device descriptor read/8, error -71 [ 703.764461][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 703.772227][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 703.819053][ T29] usb usb3-port1: unable to enumerate USB device [ 703.958820][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 703.979188][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 704.178794][ T24] radio-si470x 6-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 704.276763][ T24] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -5 [ 705.691609][ T29] usb 6-1: USB disconnect, device number 40 [ 705.874589][ T30] audit: type=1400 audit(2000000504.710:1195): avc: denied { ioctl } for pid=14497 comm="syz.3.2235" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x89f3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 706.023027][T14509] netlink: 'syz.0.2242': attribute type 1 has an invalid length. [ 706.131163][T14509] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2242'. [ 706.518706][T14513] bond0: entered promiscuous mode [ 706.753447][T14522] netlink: 'syz.5.2244': attribute type 1 has an invalid length. [ 706.970103][ T5878] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 707.144310][ T5878] usb 3-1: Using ep0 maxpacket: 8 [ 707.150955][ T5878] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 707.161122][ T5878] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 707.180605][ T5878] usb 3-1: config 0 interface 0 has no altsetting 0 [ 707.188117][ T5878] usb 3-1: New USB device found, idVendor=046d, idProduct=c298, bcdDevice= 0.00 [ 707.204357][ T5878] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 707.213005][T14531] 9p: Bad value for 'rfdno' [ 707.261695][ T5878] usb 3-1: config 0 descriptor?? [ 707.971603][ T5878] usbhid 3-1:0.0: can't add hid device: -71 [ 708.054334][ T5878] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 708.072796][ T5878] usb 3-1: USB disconnect, device number 48 [ 708.718913][T11770] net_ratelimit: 52 callbacks suppressed [ 708.718930][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 708.753269][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 708.894000][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 708.907430][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 709.164151][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.173103][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 709.299727][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.308137][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 709.433423][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.457396][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 709.685691][T14558] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2253'. [ 709.983689][ T5878] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 710.072783][T14560] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2254'. [ 710.154550][ T5878] usb 3-1: Using ep0 maxpacket: 32 [ 710.157378][T14566] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2257'. [ 710.164960][ T5878] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 710.189098][ T5878] usb 3-1: config 0 has no interface number 0 [ 710.196339][ T5878] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 710.331351][T14571] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 710.352150][T14572] 9p: Bad value for 'rfdno' [ 711.116734][ T5878] usb 3-1: config 0 interface 85 has no altsetting 0 [ 711.125630][ T5878] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 711.134832][ T5878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.142983][ T5878] usb 3-1: Product: syz [ 711.147143][ T5878] usb 3-1: Manufacturer: syz [ 711.152029][ T5878] usb 3-1: SerialNumber: syz [ 711.181954][ T5878] usb 3-1: config 0 descriptor?? [ 711.482575][T14582] netlink: 'syz.3.2260': attribute type 1 has an invalid length. [ 712.296160][T14590] xt_TPROXY: Can be used only with -p tcp or -p udp [ 712.800873][ T5878] appletouch 3-1:0.85: Failed to request geyser raw mode [ 712.837602][ T5878] appletouch 3-1:0.85: probe with driver appletouch failed with error -5 [ 712.926923][ T5878] usb 3-1: USB disconnect, device number 49 [ 713.068853][T14602] netdevsim netdevsim5: Firmware load for '..' refused, path contains '..' component [ 713.395635][T14612] 9p: Bad value for 'rfdno' [ 714.120589][ T36] net_ratelimit: 66 callbacks suppressed [ 714.120614][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 714.251003][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 714.450867][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 715.253801][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 715.376630][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 715.397434][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 715.482023][ T30] audit: type=1400 audit(2000000513.704:1196): avc: denied { nlmsg_read } for pid=14628 comm="syz.5.2275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 715.572758][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 715.580519][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 715.744187][ T30] audit: type=1400 audit(2000000513.938:1197): avc: denied { listen } for pid=14631 comm="syz.5.2276" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 715.764628][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 715.765223][ T30] audit: type=1400 audit(2000000513.975:1198): avc: denied { accept } for pid=14631 comm="syz.5.2276" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 715.772492][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 715.861829][T14640] IPVS: set_ctl: invalid protocol: 59 100.1.1.1:20004 [ 716.442212][T14645] : entered promiscuous mode [ 717.540179][T14667] netlink: 'syz.4.2284': attribute type 1 has an invalid length. [ 718.294317][T14676] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2285'. [ 718.929712][T14684] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35856 sclass=netlink_route_socket pid=14684 comm=syz.0.2290 [ 719.526307][ T6327] net_ratelimit: 55 callbacks suppressed [ 719.526344][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 719.730920][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 719.910358][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 719.918563][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 720.102450][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 720.144278][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 720.337583][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 720.349687][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 720.465835][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 720.489563][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 720.805611][T14711] input: syz1 as /devices/virtual/input/input27 [ 721.771389][T14728] netlink: 'syz.4.2303': attribute type 1 has an invalid length. [ 722.061363][T14729] ipvlan2: entered promiscuous mode [ 724.912893][ T1144] net_ratelimit: 66 callbacks suppressed [ 724.912913][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 724.926524][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 725.049577][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 725.057336][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 725.184289][T14768] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2313'. [ 725.199328][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 725.219872][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 725.563093][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 725.571925][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 726.143927][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 726.159394][ T30] audit: type=1800 audit(2000000523.615:1199): pid=14776 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.2314" name="SYSV00000000" dev="hugetlbfs" ino=4 res=0 errno=0 [ 726.329082][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 726.388488][ T30] audit: type=1400 audit(2000000523.905:1200): avc: denied { read write } for pid=14782 comm="syz.3.2316" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 726.432036][T14779] SQUASHFS error: Failed to read block 0x0: -5 [ 726.438318][T14779] unable to read squashfs_super_block [ 726.504327][ T30] audit: type=1400 audit(2000000523.905:1201): avc: denied { open } for pid=14782 comm="syz.3.2316" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 726.684863][T14792] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2322'. [ 726.737747][ T5878] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 726.854679][T14798] gretap1: entered promiscuous mode [ 726.919462][ T5878] usb 4-1: Using ep0 maxpacket: 8 [ 726.926950][ T5878] usb 4-1: unable to get BOS descriptor or descriptor too short [ 726.937561][ T5878] usb 4-1: New USB device found, idVendor=04b4, idProduct=930b, bcdDevice= 0.40 [ 726.946811][ T5878] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 727.058251][ T5878] usb 4-1: Product: syz [ 727.069052][ T5878] usb 4-1: Manufacturer: syz [ 727.073671][ T5878] usb 4-1: SerialNumber: syz [ 728.475718][T14812] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 728.498078][ T30] audit: type=1400 audit(2000000525.880:1202): avc: denied { getopt } for pid=14809 comm="syz.5.2328" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 728.541923][ T29] hid-generic 0000:0000:0000.001A: unknown main item tag 0x0 [ 728.557400][ T29] hid-generic 0000:0000:0000.001A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 729.384755][ T5878] usb 4-1: can't set first interface for hiFace device. [ 729.409034][ T5878] snd-usb-hiface 4-1:1.1: probe with driver snd-usb-hiface failed with error -5 [ 729.435565][ T5878] usb 4-1: can't set first interface for hiFace device. [ 729.459312][ T5878] snd-usb-hiface 4-1:1.2: probe with driver snd-usb-hiface failed with error -5 [ 729.521493][ T5878] usb 4-1: USB disconnect, device number 64 [ 729.586077][T14089] udevd[14089]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 729.825622][ T30] audit: type=1400 audit(2000000527.115:1203): avc: denied { relabelfrom } for pid=14832 comm="syz.5.2335" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 729.932521][ T30] audit: type=1400 audit(2000000527.125:1204): avc: denied { relabelto } for pid=14832 comm="syz.5.2335" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 730.037740][ T30] audit: type=1400 audit(2000000527.321:1205): avc: denied { block_suspend } for pid=14837 comm="syz.2.2330" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 731.218529][ T49] net_ratelimit: 43 callbacks suppressed [ 731.218547][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 731.237381][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 731.433655][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 731.491942][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 731.695640][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 731.733685][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 732.007124][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 732.090485][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 732.192965][ T30] audit: type=1400 audit(2000000529.268:1206): avc: denied { append } for pid=14856 comm="syz.3.2340" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 732.486395][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 732.494363][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 733.011385][T14865] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2340'. [ 733.417770][T14859] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2340'. [ 734.014321][T14879] netlink: 'syz.4.2345': attribute type 1 has an invalid length. [ 734.684378][T14885] input: syz1 as /devices/virtual/input/input28 [ 734.951465][ T30] audit: type=1400 audit(2000000531.926:1207): avc: denied { bind } for pid=14888 comm="syz.0.2347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 738.982602][ T49] net_ratelimit: 51 callbacks suppressed [ 738.982621][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.050555][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 739.181167][T14908] xt_cluster: node mask cannot exceed total number of nodes [ 739.217751][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.246188][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 739.399402][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.407162][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 739.548991][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.580174][T14925] tipc: Can't bind to reserved service type 2 [ 739.607907][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 739.724219][T14926] fuse: Bad value for 'group_id' [ 739.729188][T14926] fuse: Bad value for 'group_id' [ 740.500639][T14929] netlink: 'syz.0.2359': attribute type 12 has an invalid length. [ 740.508523][T14929] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2359'. [ 740.559088][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 740.897457][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 741.409093][T14936] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14936 comm=syz.2.2361 [ 741.434858][T14936] netlink: 'syz.2.2361': attribute type 1 has an invalid length. [ 741.527159][T14939] bond2: (slave gretap2): making interface the new active one [ 741.543916][T14939] bond2: (slave gretap2): Enslaving as an active interface with an up link [ 741.569856][T14936] vlan2: entered allmulticast mode [ 741.683645][T14936] bond2: entered allmulticast mode [ 741.694589][T14936] gretap2: entered allmulticast mode [ 743.412121][T14936] bond2: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 744.239724][ T29] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 744.337582][ T1144] net_ratelimit: 26 callbacks suppressed [ 744.337598][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.435435][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.448793][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 744.527116][T14958] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2366'. [ 744.579989][ T29] usb 3-1: Using ep0 maxpacket: 8 [ 744.592582][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.931336][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 744.965583][ T29] usb 3-1: device descriptor read/all, error -71 [ 744.996095][T14968] netlink: 'syz.0.2365': attribute type 1 has an invalid length. [ 745.087294][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 745.095217][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 745.244021][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 745.255105][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 745.305670][T14980] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2371'. [ 745.372202][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 745.633149][ T30] audit: type=1400 audit(2000000541.921:1208): avc: denied { setopt } for pid=14984 comm="syz.2.2373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 749.745576][ T49] net_ratelimit: 45 callbacks suppressed [ 749.745595][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 749.806617][ T29] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 749.827853][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 749.945367][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 750.087092][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 750.095177][ T29] usb 6-1: Using ep0 maxpacket: 16 [ 750.103943][T13435] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 750.114505][T13435] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 750.125728][T13435] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 750.150137][ T29] usb 6-1: unable to get BOS descriptor or descriptor too short [ 750.240336][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 750.242537][ T29] usb 6-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 750.265289][T13435] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 750.275472][T13435] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 750.286298][ T30] audit: type=1400 audit(2000000546.273:1209): avc: denied { mounton } for pid=15016 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 750.821874][ T29] usb 6-1: New USB device found, idVendor=05da, idProduct=0099, bcdDevice=d4.1f [ 750.831525][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.839761][ T29] usb 6-1: Product: syz [ 750.845173][ T29] usb 6-1: Manufacturer: syz [ 750.850028][ T29] usb 6-1: SerialNumber: syz [ 750.872882][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 750.971264][ T6327] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 750.998725][ T6327] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 751.210921][ T29] microtek usb (rev 0.4.3): expecting 3 got 0 endpoints! Bailing out. [ 751.270282][ T29] usb 6-1: USB disconnect, device number 41 [ 751.302317][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 751.310117][ T30] audit: type=1400 audit(2000000547.209:1210): avc: denied { accept } for pid=15028 comm="syz.2.2385" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 751.370276][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 751.473264][ T24] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 751.655083][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 751.665613][ T24] usb 4-1: config 79 has an invalid descriptor of length 131, skipping remainder of the config [ 751.682847][ T24] usb 4-1: config 79 has 0 interfaces, different from the descriptor's value: 1 [ 752.520467][T13435] Bluetooth: hci5: command tx timeout [ 752.853656][ T24] usb 4-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 752.886482][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.905046][ T24] usb 4-1: Product: syz [ 752.909233][ T24] usb 4-1: Manufacturer: syz [ 752.930563][ T24] usb 4-1: SerialNumber: syz [ 753.023806][T15044] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2388'. [ 753.558428][ T49] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.604329][T15057] netlink: 1760 bytes leftover after parsing attributes in process `syz.5.2393'. [ 753.673331][ T30] audit: type=1400 audit(2000000549.446:1211): avc: denied { map } for pid=15058 comm="syz.5.2395" path="socket:[50138]" dev="sockfs" ino=50138 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 753.706399][ T5878] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 753.749983][T15062] No such timeout policy "syz0" [ 753.843894][ T49] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 754.000098][T15068] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 754.030615][T15069] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2394'. [ 754.225987][T15071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 754.267310][ T49] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 754.281898][T15071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 754.309798][T15016] chnl_net:caif_netlink_parms(): no params data found [ 754.337912][ T5878] usb 3-1: Using ep0 maxpacket: 32 [ 754.344770][ T5878] usb 3-1: config 1 interface 0 altsetting 129 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 754.359619][ T5878] usb 3-1: config 1 interface 0 altsetting 129 endpoint 0x81 has invalid wMaxPacketSize 0 [ 754.361865][ T49] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 754.370489][ T5878] usb 3-1: config 1 interface 0 has no altsetting 0 [ 754.390000][ T5878] usb 3-1: New USB device found, idVendor=05ac, idProduct=029c, bcdDevice= 0.40 [ 754.409099][ T5878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 754.417455][ T5878] usb 3-1: Product: syz [ 754.421746][ T5878] usb 3-1: Manufacturer: syz [ 754.426678][ T5878] usb 3-1: SerialNumber: syz [ 754.464420][T15016] bridge0: port 1(bridge_slave_0) entered blocking state [ 754.471840][T15016] bridge0: port 1(bridge_slave_0) entered disabled state [ 754.479070][T15016] bridge_slave_0: entered allmulticast mode [ 754.486218][T15016] bridge_slave_0: entered promiscuous mode [ 754.494076][T15016] bridge0: port 2(bridge_slave_1) entered blocking state [ 754.501331][T15016] bridge0: port 2(bridge_slave_1) entered disabled state [ 754.509636][T15016] bridge_slave_1: entered allmulticast mode [ 754.516619][T15016] bridge_slave_1: entered promiscuous mode [ 754.627355][T15016] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 754.656892][T15016] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 754.694840][ T5878] usbhid 3-1:1.0: can't add hid device: -71 [ 754.701022][ T5878] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 754.719819][ T5878] usb 3-1: USB disconnect, device number 52 [ 754.742875][T13435] Bluetooth: hci5: command tx timeout [ 754.763347][T15016] team0: Port device team_slave_0 added [ 754.773073][ T49] bridge_slave_1: left allmulticast mode [ 754.779447][ T49] bridge_slave_1: left promiscuous mode [ 754.785218][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 754.794284][T15080] netlink: 'syz.5.2397': attribute type 3 has an invalid length. [ 754.803255][ T49] bridge_slave_0: left allmulticast mode [ 754.809364][ T49] bridge_slave_0: left promiscuous mode [ 754.815046][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 755.023893][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 755.034142][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 755.044159][ T49] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 755.057097][ T49] bond0 (unregistering): Released all slaves [ 755.066848][T15016] team0: Port device team_slave_1 added [ 755.085204][ T5878] usb 3-1: new full-speed USB device number 53 using dummy_hcd [ 755.106382][T11770] net_ratelimit: 84 callbacks suppressed [ 755.106395][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 755.139819][T15016] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 755.159542][T15016] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 755.191752][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 755.210799][T15016] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 755.223867][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 755.227739][T15016] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 755.240573][T15016] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 755.273367][T15016] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 755.284145][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 755.292851][ T49] : left promiscuous mode [ 755.301157][ T5878] usb 3-1: not running at top speed; connect to a high speed hub [ 755.313863][ T30] audit: type=1400 audit(2000000550.981:1212): avc: denied { write } for pid=15089 comm="syz.4.2399" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 755.349768][ T5878] usb 3-1: config 1 interface 0 altsetting 129 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 755.361471][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 755.361498][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 755.398791][ T5878] usb 3-1: config 1 interface 0 altsetting 129 endpoint 0x81 has invalid wMaxPacketSize 0 [ 755.541676][T11768] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 755.554153][ T5878] usb 3-1: config 1 interface 0 has no altsetting 0 [ 755.580956][T11768] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 755.621388][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 755.629391][ T5878] usb 3-1: New USB device found, idVendor=05ac, idProduct=029c, bcdDevice= 0.40 [ 755.644959][ T5878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.655716][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 755.659106][ T5878] usb 3-1: Product: syz [ 755.678115][ T5878] usb 3-1: Manufacturer: syz [ 755.692488][ T5878] usb 3-1: SerialNumber: syz [ 755.809442][ T29] usb 4-1: USB disconnect, device number 65 [ 755.915650][T15047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 755.962356][T15047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 755.972625][T15016] hsr_slave_0: entered promiscuous mode [ 755.979097][T15016] hsr_slave_1: entered promiscuous mode [ 755.985452][T15016] debugfs: 'hsr0' already exists in 'hsr' [ 755.991249][T15016] Cannot create hsr debugfs directory [ 756.292607][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 756.396910][T15117] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2403'. [ 756.411167][ T30] audit: type=1400 audit(2000000551.991:1213): avc: denied { read } for pid=15116 comm="syz.3.2403" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 756.447669][ T30] audit: type=1400 audit(2000000551.991:1214): avc: denied { ioctl } for pid=15116 comm="syz.3.2403" path="socket:[50882]" dev="sockfs" ino=50882 ioctlcmd=0x586b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 756.482873][T15117] syzkaller1: entered promiscuous mode [ 756.488383][T15117] syzkaller1: entered allmulticast mode [ 756.516549][ T5878] usbhid 3-1:1.0: can't add hid device: -71 [ 756.522526][ T5878] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 756.548245][ T5878] usb 3-1: USB disconnect, device number 53 [ 756.606704][ T30] audit: type=1400 audit(2000000552.038:1215): avc: denied { setattr } for pid=15116 comm="syz.3.2403" name="IEEE-802.15.4-MAC" dev="sockfs" ino=50882 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 756.690696][ T30] audit: type=1400 audit(2000000552.094:1216): avc: denied { ioctl } for pid=15116 comm="syz.3.2403" path="socket:[50893]" dev="sockfs" ino=50893 ioctlcmd=0x9429 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 756.723131][T15122] kvm: requested 7542 ns i8254 timer period limited to 200000 ns [ 756.738200][ T30] audit: type=1400 audit(2000000552.094:1217): avc: denied { nlmsg_read } for pid=15116 comm="syz.3.2403" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 756.771223][T15122] kvm: pic: non byte read [ 756.776007][T15122] kvm: pic: non byte read [ 756.780535][T15122] kvm: pic: non byte read [ 756.802988][T15122] kvm: pic: non byte read [ 756.874921][T15122] kvm: pic: non byte read [ 756.895652][T15122] kvm: pic: non byte read [ 756.909122][T15122] kvm: pic: non byte read [ 756.942680][T15122] kvm: pic: non byte read [ 756.946200][ T30] audit: type=1400 audit(2000000552.506:1218): avc: denied { unmount } for pid=6709 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 756.965385][T13435] Bluetooth: hci5: command tx timeout [ 756.976486][T15122] kvm: pic: non byte read [ 756.981075][T15122] kvm: pic: non byte read [ 757.052954][T15132] syzkaller1: entered promiscuous mode [ 757.058555][T15132] syzkaller1: entered allmulticast mode [ 757.303181][T15151] veth0_to_team: entered promiscuous mode [ 758.212087][T15016] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 758.336825][T15016] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 758.377285][T15016] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 758.387761][T15016] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 758.660217][T15016] 8021q: adding VLAN 0 to HW filter on device bond0 [ 758.695522][T15016] 8021q: adding VLAN 0 to HW filter on device team0 [ 758.721731][ T6327] bridge0: port 1(bridge_slave_0) entered blocking state [ 758.728866][ T6327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 758.826554][ T49] hsr_slave_0: left promiscuous mode [ 758.835306][ T49] hsr_slave_1: left promiscuous mode [ 758.846724][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 758.868386][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 758.876618][T15202] netlink: 596 bytes leftover after parsing attributes in process `syz.4.2415'. [ 758.900038][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 758.913243][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 759.097037][ T49] veth1_macvtap: left promiscuous mode [ 759.203692][T13435] Bluetooth: hci5: command tx timeout [ 759.211024][ T49] veth0_macvtap: left promiscuous mode [ 760.054083][T15213] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 760.062785][T15213] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 760.071822][T15213] overlayfs: missing 'lowerdir' [ 760.470182][ T36] net_ratelimit: 126 callbacks suppressed [ 760.470195][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 761.164449][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 761.226159][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 761.271305][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 761.292849][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 761.314191][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 761.356837][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 761.378798][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 761.386825][ T49] team0 (unregistering): Port device team_slave_1 removed [ 761.422731][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 761.466431][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 761.487473][ T49] team0 (unregistering): Port device team_slave_0 removed [ 761.611856][ T30] audit: type=1400 audit(2000000556.858:1219): avc: denied { mount } for pid=15231 comm="syz.2.2421" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 761.720098][ T5878] usb 6-1: new low-speed USB device number 42 using dummy_hcd [ 761.730069][ T6327] bridge0: port 2(bridge_slave_1) entered blocking state [ 761.737164][ T6327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 761.854642][T15240] pimreg: entered allmulticast mode [ 761.987192][ T5878] usb 6-1: Invalid ep0 maxpacket: 16 [ 762.023182][T15249] pimreg: left allmulticast mode [ 762.168943][ T5878] usb 6-1: new low-speed USB device number 43 using dummy_hcd [ 762.283163][T15016] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 762.435813][ T5878] usb 6-1: Invalid ep0 maxpacket: 16 [ 762.441839][ T5878] usb usb6-port1: attempt power cycle [ 762.793269][ T30] audit: type=1400 audit(2000000557.981:1220): avc: denied { read } for pid=15268 comm="syz.3.2424" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 762.852742][ T5878] usb 6-1: new low-speed USB device number 44 using dummy_hcd [ 763.639193][ T5878] usb 6-1: Invalid ep0 maxpacket: 16 [ 763.770774][ T30] audit: type=1400 audit(2000000558.009:1221): avc: denied { open } for pid=15268 comm="syz.3.2424" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 763.795090][ T30] audit: type=1400 audit(2000000558.009:1222): avc: denied { ioctl } for pid=15268 comm="syz.3.2424" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x937e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 763.832469][T15016] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 764.064590][ T30] audit: type=1400 audit(2000000559.170:1223): avc: denied { lock } for pid=15273 comm="syz.3.2426" path="socket:[51453]" dev="sockfs" ino=51453 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 764.196578][ T5878] usb 6-1: new low-speed USB device number 45 using dummy_hcd [ 764.222024][ T5878] usb 6-1: Invalid ep0 maxpacket: 16 [ 764.227534][ T5878] usb usb6-port1: unable to enumerate USB device [ 764.249134][T15016] veth0_vlan: entered promiscuous mode [ 764.279156][T15016] veth1_vlan: entered promiscuous mode [ 764.384828][T15016] veth0_macvtap: entered promiscuous mode [ 764.417228][T15016] veth1_macvtap: entered promiscuous mode [ 764.459913][T15016] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 764.506086][T15016] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 764.527310][ T6326] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.540461][ T6326] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.557707][ T6326] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.579471][ T6326] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.617696][ T49] IPVS: stop unused estimator thread 0... [ 764.680828][ T29] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 764.693759][ T5878] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 765.135693][T15290] nfs: Unknown parameter 'ac' [ 765.764760][T11772] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 765.781218][ T29] usb 4-1: Using ep0 maxpacket: 8 [ 765.782003][ T5878] usb 3-1: Using ep0 maxpacket: 32 [ 765.798458][ T5878] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 765.806666][ T5878] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 765.812039][ T24] hid-generic 0000:0000:0000.001B: unknown main item tag 0x0 [ 765.824467][T11772] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 765.836479][ T49] net_ratelimit: 71 callbacks suppressed [ 765.836493][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 765.874621][ T24] hid-generic 0000:0000:0000.001B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 765.897822][ T5878] usb 3-1: config 0 has no interface number 0 [ 765.922568][ T5878] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 765.944508][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 765.973086][ T6326] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 765.981273][ T5878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 766.008423][ T6326] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 766.015377][ T5878] usb 3-1: Product: syz [ 766.019839][ T5878] usb 3-1: Manufacturer: syz [ 766.024417][ T5878] usb 3-1: SerialNumber: syz [ 766.026867][T11768] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 766.068484][ T30] audit: type=1400 audit(2000000561.042:1224): avc: denied { mounton } for pid=15016 comm="syz-executor" path="/root/syzkaller.AfRYuT/syz-tmp" dev="sda1" ino=2049 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 766.104522][ T6326] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 766.113423][ T5878] usb 3-1: config 0 descriptor?? [ 766.129627][ T6326] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 766.139414][ T5878] cx231xx 3-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 766.171607][ T5878] cx231xx 3-1:0.1: Not found matching IAD interface [ 766.179131][ T30] audit: type=1400 audit(2000000561.042:1225): avc: denied { mounton } for pid=15016 comm="syz-executor" path="/root/syzkaller.AfRYuT/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 766.279634][ T30] audit: type=1400 audit(2000000561.042:1226): avc: denied { mounton } for pid=15016 comm="syz-executor" path="/root/syzkaller.AfRYuT/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=52759 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 766.316333][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 766.324294][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 766.367803][ T5878] usb 3-1: USB disconnect, device number 54 [ 766.396900][ T30] audit: type=1400 audit(2000000561.126:1227): avc: denied { mounton } for pid=15016 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2786 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 766.462088][ T6326] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 766.742081][ T29] usb 4-1: unable to get BOS descriptor or descriptor too short [ 766.755041][ T6326] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 766.775882][ T29] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 766.798019][T15299] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 766.807270][T15299] team0: Port device batadv1 added [ 766.867017][ T30] audit: type=1400 audit(2000000561.126:1228): avc: denied { mounton } for pid=15016 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 766.902304][ T29] usb 4-1: can't read configurations, error -71 [ 766.908755][ T6326] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 767.158051][ T30] audit: type=1400 audit(2000000562.062:1229): avc: denied { mounton } for pid=15301 comm="syz.2.2432" path="/syzcgroup/cpu/syz2/cgroup.procs" dev="cgroup" ino=62 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 767.325564][T15303] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2432'. [ 767.334501][T15303] IPVS: Unknown mcast interface: vcan0 [ 767.872179][T15309] comedi: No check for data length of config insn id 7 is implemented [ 767.895224][T15309] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 767.919043][T15309] comedi: Assuming n=20848 is correct [ 768.238079][ T29] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 768.437358][ T29] usb 4-1: device descriptor read/64, error -71 [ 768.577026][ T29] usb usb4-port1: attempt power cycle [ 769.526198][ T29] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 769.591540][ T29] usb 4-1: device descriptor read/8, error -71 [ 769.786045][T15346] libceph: resolve 'cϐ' (ret=-3): failed [ 769.813018][T15337] futex_wake_op: syz.2.2440 tries to shift op by -1; fix this program [ 770.269521][ T29] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 770.301318][ T29] usb 4-1: device descriptor read/8, error -71 [ 770.433238][ T29] usb usb4-port1: unable to enumerate USB device [ 771.075292][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 771.075308][ T30] audit: type=1400 audit(2000000565.684:1231): avc: denied { listen } for pid=15357 comm="syz.2.2446" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 771.213993][ T1144] net_ratelimit: 49 callbacks suppressed [ 771.214006][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 771.400654][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 771.518711][T11768] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 771.526495][T11768] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 771.596828][T15368] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1107 sclass=netlink_xfrm_socket pid=15368 comm=syz.4.2448 [ 771.646354][T11768] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 771.654613][T11768] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 771.774640][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 771.782441][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 771.913555][T11768] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 771.923115][T11768] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 772.724106][ T30] audit: type=1326 audit(2000000567.275:1232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15387 comm="syz.3.2454" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe14479c799 code=0x0 [ 772.954878][T15397] No source specified [ 772.981240][T15397] binder: 15387:15397 ioctl c0306201 0 returned -14 [ 773.438955][T15402] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 774.373548][T15408] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 776.146280][T15425] ALSA: mixer_oss: invalid OSS volume '' [ 776.501631][ T30] audit: type=1400 audit(2000000570.101:1233): avc: denied { ioctl } for pid=15425 comm="syz.5.2462" path="/dev/ptyqf" dev="devtmpfs" ino=134 ioctlcmd=0x5438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 776.616922][T11770] net_ratelimit: 44 callbacks suppressed [ 776.616941][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 776.686900][ T29] libceph: connect (1)[c::]:6789 error -101 [ 776.722335][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 777.103476][T11768] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 777.133619][ T29] libceph: mon0 (1)[c::]:6789 connect error [ 777.142254][T11768] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 777.150031][T15440] FAULT_INJECTION: forcing a failure. [ 777.150031][T15440] name failslab, interval 1, probability 0, space 0, times 0 [ 777.151935][T15438] comedi: No check for data length of config insn id 7 is implemented [ 777.192135][T15438] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 777.217277][T15429] ceph: No mds server is up or the cluster is laggy [ 777.223485][T15438] comedi: Assuming n=20846 is correct [ 777.266866][T15440] CPU: 1 UID: 0 PID: 15440 Comm: syz.5.2465 Tainted: G L syzkaller #0 PREEMPT(full) [ 777.266893][T15440] Tainted: [L]=SOFTLOCKUP [ 777.266898][T15440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 777.266907][T15440] Call Trace: [ 777.266912][T15440] [ 777.266918][T15440] dump_stack_lvl+0x100/0x190 [ 777.266949][T15440] should_fail_ex.cold+0x5/0xa [ 777.266969][T15440] ? __alloc_workqueue+0xd62/0x1880 [ 777.266992][T15440] should_failslab+0xc2/0x120 [ 777.267016][T15440] __kmalloc_noprof+0xe0/0x850 [ 777.267044][T15440] __alloc_workqueue+0xd62/0x1880 [ 777.267066][T15440] ? __pfx_ovl_other_xattr_get+0x10/0x10 [ 777.267084][T15440] ? __vfs_getxattr+0x145/0x1a0 [ 777.267101][T15440] ? __pfx___vfs_getxattr+0x10/0x10 [ 777.267120][T15440] alloc_workqueue_noprof+0xd2/0x200 [ 777.267144][T15440] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 777.267168][T15440] ? bpf_lsm_inode_need_killpriv+0x9/0x10 [ 777.267192][T15440] ? security_inode_need_killpriv+0x71/0x1e0 [ 777.267213][T15440] ? file_remove_privs_flags+0x251/0x590 [ 777.267236][T15440] ? __pfx_file_remove_privs_flags+0x10/0x10 [ 777.267260][T15440] sb_init_dio_done_wq+0x83/0x140 [ 777.267281][T15440] ? __pfx_sb_init_dio_done_wq+0x10/0x10 [ 777.267308][T15440] backing_file_write_iter+0x657/0x8c0 [ 777.267333][T15440] ? __pfx_ovl_file_end_write+0x10/0x10 [ 777.267357][T15440] ovl_write_iter+0x355/0x430 [ 777.267382][T15440] ? __pfx_ovl_write_iter+0x10/0x10 [ 777.267404][T15440] ? __pfx_ovl_file_end_write+0x10/0x10 [ 777.267423][T15440] ? find_held_lock+0x2b/0x80 [ 777.267444][T15440] ? aio_write+0x6fc/0x920 [ 777.267460][T15440] ? aio_write+0x6fc/0x920 [ 777.267482][T15440] aio_write+0x3ba/0x920 [ 777.267503][T15440] ? __pfx_aio_write+0x10/0x10 [ 777.267522][T15440] ? __lock_acquire+0x4a5/0x2630 [ 777.267564][T15440] ? __might_fault+0xc5/0x140 [ 777.267592][T15440] ? io_submit_one+0x1142/0x1fb0 [ 777.267611][T15440] io_submit_one+0x1142/0x1fb0 [ 777.267635][T15440] ? __lock_acquire+0x4a5/0x2630 [ 777.267665][T15440] ? __pfx_io_submit_one+0x10/0x10 [ 777.267694][T15440] ? __might_fault+0xc5/0x140 [ 777.267729][T15440] ? __x64_sys_io_submit+0x1b1/0x3a0 [ 777.267749][T15440] __x64_sys_io_submit+0x1b1/0x3a0 [ 777.267773][T15440] ? __pfx___x64_sys_io_submit+0x10/0x10 [ 777.267793][T15440] ? fput+0x79/0x100 [ 777.267820][T15440] do_syscall_64+0x106/0xf80 [ 777.267838][T15440] ? clear_bhb_loop+0x40/0x90 [ 777.267859][T15440] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.267876][T15440] RIP: 0033:0x7f945119c799 [ 777.267890][T15440] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 777.267910][T15440] RSP: 002b:00007f94520ff028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 777.267928][T15440] RAX: ffffffffffffffda RBX: 00007f9451415fa0 RCX: 00007f945119c799 [ 777.267938][T15440] RDX: 0000200000000540 RSI: 0000000000000001 RDI: 00007f94520d6000 [ 777.267948][T15440] RBP: 00007f94520ff090 R08: 0000000000000000 R09: 0000000000000000 [ 777.267957][T15440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 777.267967][T15440] R13: 00007f9451416038 R14: 00007f9451415fa0 R15: 00007ffc605f00a8 [ 777.267992][T15440] [ 777.330858][T11772] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 777.354462][T15444] fuse: Unknown parameter '0x0000000000000008' [ 777.606552][ T24] libceph: connect (1)[c::]:6789 error -101 [ 777.612841][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 777.622862][T11772] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 777.751131][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 777.762718][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 777.858197][ T30] audit: type=1400 audit(2000000572.085:1234): avc: denied { write } for pid=15445 comm="syz.5.2468" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 777.893015][T15447] random: crng reseeded on system resumption [ 777.950433][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 777.959754][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 778.963757][T15460] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2471'. [ 779.306173][T15469] xt_l2tp: invalid flags combination: 0 [ 781.164047][T15488] futex_wake_op: syz.0.2480 tries to shift op by -1; fix this program [ 781.286963][ T30] audit: type=1400 audit(2000000575.295:1235): avc: denied { ioctl } for pid=15490 comm="syz.5.2481" path="socket:[53451]" dev="sockfs" ino=53451 ioctlcmd=0x8b32 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 781.577890][ T30] audit: type=1400 audit(2000000575.557:1236): avc: denied { listen } for pid=15500 comm="syz.2.2477" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 781.861207][ T29] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 782.584288][ T49] net_ratelimit: 46 callbacks suppressed [ 782.584300][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 782.608740][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 782.624042][ T29] usb 6-1: Using ep0 maxpacket: 32 [ 782.631775][ T29] usb 6-1: config 0 has an invalid interface number: 85 but max is 0 [ 782.639858][ T29] usb 6-1: config 0 has no interface number 0 [ 782.646149][ T29] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 782.651916][T15081] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 782.657198][ T29] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 782.657223][ T29] usb 6-1: config 0 interface 85 has no altsetting 0 [ 782.658899][ T29] usb 6-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 782.690947][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 782.735158][ T29] usb 6-1: Product: syz [ 782.739460][ T49] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 782.798218][T15521] pimreg: entered allmulticast mode [ 782.810096][T15521] pimreg: left allmulticast mode [ 782.825017][ T29] usb 6-1: Manufacturer: syz [ 782.829670][ T29] usb 6-1: SerialNumber: syz [ 782.856605][ T6326] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 782.864992][ T6326] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 782.875705][ T29] usb 6-1: config 0 descriptor?? [ 782.908974][T15081] usb 3-1: Using ep0 maxpacket: 8 [ 782.920344][T15081] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 782.942200][T15081] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 782.983292][T11768] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 782.983959][T15081] usb 3-1: config 0 interface 0 has no altsetting 0 [ 782.991177][T11768] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 783.021762][T15081] usb 3-1: New USB device found, idVendor=046d, idProduct=c298, bcdDevice= 0.00 [ 783.046563][T15081] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 783.103977][T15506] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 783.116167][T15506] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 783.119328][T15081] usb 3-1: config 0 descriptor?? [ 783.124040][ T6326] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 783.149512][ T6326] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 783.476545][ T30] audit: type=1400 audit(2000000577.336:1237): avc: denied { bind } for pid=15505 comm="syz.5.2485" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 783.704948][ T6326] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 783.767891][T15081] usbhid 3-1:0.0: can't add hid device: -71 [ 783.783928][T15081] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 783.844611][ T30] audit: type=1400 audit(2000000577.644:1238): avc: denied { getopt } for pid=15525 comm="syz.0.2492" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 783.876893][T15081] usb 3-1: USB disconnect, device number 55 [ 783.968603][T15533] netlink: 'syz.0.2492': attribute type 1 has an invalid length. [ 784.217651][ T30] audit: type=1400 audit(2000000578.028:1239): avc: denied { connect } for pid=15539 comm="syz.3.2493" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 784.865349][T15547] comedi comedi1: dt2817: a I/O base address must be specified [ 785.007392][ T30] audit: type=1326 audit(2000000578.767:1240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15551 comm="syz.2.2497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f482299c799 code=0x7ffc0000 [ 785.080198][ T30] audit: type=1326 audit(2000000578.767:1241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15551 comm="syz.2.2497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f482299c799 code=0x7ffc0000 [ 785.184279][ T29] appletouch 6-1:0.85: Failed to read mode from device. [ 785.201299][ T29] appletouch 6-1:0.85: probe with driver appletouch failed with error -5 [ 785.618194][ T29] usb 6-1: USB disconnect, device number 46 [ 785.737524][ T30] audit: type=1326 audit(2000000578.796:1242): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15551 comm="syz.2.2497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=25 compat=0 ip=0x7f482299c799 code=0x7ffc0000 [ 785.774323][T15558] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2499'. [ 785.835966][ T30] audit: type=1326 audit(2000000578.796:1243): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15551 comm="syz.2.2497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f482299c799 code=0x7ffc0000 [ 785.951309][ T30] audit: type=1326 audit(2000000578.796:1244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15551 comm="syz.2.2497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f482299c799 code=0x7ffc0000 [ 785.975857][T15081] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 786.054666][ T30] audit: type=1326 audit(2000000578.870:1245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15551 comm="syz.2.2497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f482295cfce code=0x7ffc0000 [ 786.095803][T15565] netlink: 'syz.2.2500': attribute type 1 has an invalid length. [ 786.121397][ T30] audit: type=1326 audit(2000000578.870:1246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15551 comm="syz.2.2497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7f482299da97 code=0x7ffc0000 [ 786.167768][T15081] usb 4-1: Using ep0 maxpacket: 8 [ 786.174619][T15081] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 224, changing to 7 [ 786.187575][T15081] usb 4-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 786.211048][T15081] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.241816][T15081] usb 4-1: Product: syz [ 786.254360][T15081] usb 4-1: Manufacturer: syz [ 786.264807][T15081] usb 4-1: SerialNumber: syz [ 786.290827][T15567] kAFS: unable to lookup cell '' [ 786.808007][T15533] kexec: Could not allocate control_code_buffer [ 787.543774][T15081] usb 4-1: unit 2 not found! [ 787.559022][T15581] bridge0: port 2(bridge_slave_1) entered disabled state [ 787.566337][T15581] bridge0: port 1(bridge_slave_0) entered disabled state [ 787.580257][T15081] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 787.590842][T15081] usb 4-1: unit 2 not found! [ 787.601035][T15081] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 787.688125][T15081] usb 4-1: unit 2 not found! [ 787.818309][T15081] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 787.831940][T15585] netlink: 'syz.4.2507': attribute type 10 has an invalid length. [ 787.834514][T14967] udevd[14967]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 787.856747][T15081] usb 4-1: USB disconnect, device number 70 [ 788.019375][ T6326] net_ratelimit: 60 callbacks suppressed [ 788.019394][ T6326] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 788.036981][ T6326] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 788.175944][ T12] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 788.202195][T15594] IPVS: set_ctl: invalid protocol: 59 100.1.1.1:20004 [ 788.553552][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 788.680874][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 788.690038][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 788.706343][T15598] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2511'. [ 788.806457][T11768] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 788.814493][T11768] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 788.934559][ T6326] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 789.233770][T15610] IPVS: sync thread started: state = BACKUP, mcast_ifn = bond0, syncid = 8, id = 0 [ 789.262951][ T6326] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 790.376985][ T29] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 793.443946][ T12] net_ratelimit: 21 callbacks suppressed [ 793.443962][ T12] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 793.597573][T15630] pimreg: entered allmulticast mode [ 793.613882][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 793.668025][T11770] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 793.675823][T15634] pimreg: left allmulticast mode [ 793.787104][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 793.950426][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 793.950475][T11770] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.182029][ T30] audit: type=1400 audit(2000000587.125:1259): avc: denied { mount } for pid=15637 comm="syz.2.2520" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 794.310582][ T30] audit: type=1400 audit(2000000587.125:1260): avc: denied { mounton } for pid=15637 comm="syz.2.2520" path="/474/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 794.333526][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.346046][T15645] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 794.373183][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.407346][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.764223][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 794.793536][ T30] audit: type=1400 audit(2000000587.911:1261): avc: denied { unmount } for pid=5815 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 794.950504][ T6326] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 795.469296][ C0] vcan0: j1939_tp_rxtimer: 0xffff888026e3b800: rx timeout, send abort [ 795.495922][ T30] audit: type=1400 audit(2000000588.585:1262): avc: denied { read } for pid=5159 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 795.663716][T15081] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 795.702309][ T30] audit: type=1400 audit(2000000588.585:1263): avc: denied { search } for pid=5159 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 795.751500][ T30] audit: type=1400 audit(2000000588.585:1264): avc: denied { append } for pid=5159 comm="syslogd" name="messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 795.776380][ T30] audit: type=1400 audit(2000000588.585:1265): avc: denied { open } for pid=5159 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 795.784865][ T5878] libceph: connect (1)[c::]:6789 error -101 [ 795.799744][ T30] audit: type=1400 audit(2000000588.585:1266): avc: denied { getattr } for pid=5159 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 795.846657][ T5878] libceph: mon0 (1)[c::]:6789 connect error [ 795.866646][ T5878] libceph: connect (1)[c::]:6789 error -101 [ 795.881070][ T5878] libceph: mon0 (1)[c::]:6789 connect error [ 795.893072][T15676] ceph: No mds server is up or the cluster is laggy [ 795.923680][T15081] usb 3-1: Using ep0 maxpacket: 32 [ 795.930464][T15081] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 795.982556][T15081] usb 3-1: config 0 has no interface number 0 [ 796.004914][ C0] vcan0: j1939_tp_rxtimer: 0xffff888026e3ac00: rx timeout, send abort [ 796.013131][ C0] vcan0: j1939_tp_rxtimer: 0xffff888026e3b800: abort rx timeout. Force session deactivation [ 796.053391][T15081] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 796.076881][T15081] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 796.087010][T15081] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 796.096128][T15081] usb 3-1: Product: syz [ 796.101822][T15081] usb 3-1: Manufacturer: syz [ 796.107446][T15081] usb 3-1: SerialNumber: syz [ 796.136463][T15081] usb 3-1: config 0 descriptor?? [ 796.142039][T15687] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2535'. [ 796.210272][T15081] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 796.222796][T15081] em28xx 3-1:0.132: Video interface 132 found: [ 796.244218][T15688] xt_hashlimit: size too large, truncated to 1048576 [ 796.300883][T15690] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2534'. [ 796.547367][ C0] vcan0: j1939_tp_rxtimer: 0xffff888026e3ac00: abort rx timeout. Force session deactivation [ 796.657560][T15081] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 797.362077][T15696] gretap1: entered promiscuous mode [ 797.447756][T15698] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 797.901930][T15081] em28xx 3-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 797.916164][T15081] em28xx 3-1:0.132: board has no eeprom [ 797.935222][T15703] vti0: entered promiscuous mode [ 797.983299][T15703] vti0: entered allmulticast mode [ 797.995405][T15081] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 798.004548][T15081] em28xx 3-1:0.132: analog set to bulk mode. [ 798.015090][ T5955] em28xx 3-1:0.132: Registering V4L2 extension [ 798.395715][ T5955] em28xx 3-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 798.408398][ T5955] em28xx 3-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 798.473078][ T29] usb 3-1: USB disconnect, device number 57 [ 798.498596][ T29] em28xx 3-1:0.132: Disconnecting em28xx [ 798.767097][T15730] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2543'. [ 798.786262][ T5955] em28xx 3-1:0.132: Config register raw data: 0xffffffed [ 798.934461][T15732] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 798.961992][ T36] net_ratelimit: 57 callbacks suppressed [ 798.962003][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 798.977783][ T5955] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 798.986822][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 799.001659][ T5955] em28xx 3-1:0.132: No AC97 audio processor [ 799.030066][ T5955] usb 3-1: Decoder not found [ 799.066300][ T30] audit: type=1400 audit(2000000591.936:1267): avc: denied { map } for pid=15734 comm="syz.0.2547" path="socket:[53872]" dev="sockfs" ino=53872 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 799.067101][ T5955] em28xx 3-1:0.132: failed to create media graph [ 799.105062][T15737] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 799.106592][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 799.137119][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 799.464575][ T5955] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 799.491956][T15738] ================================================================== [ 799.492626][ T5955] em28xx 3-1:0.132: Remote control support is not available for this card. [ 799.500029][T15738] BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 [ 799.516027][T15738] Read of size 8 at addr ffff88807d900748 by task v4l_id/15738 [ 799.523559][T15738] [ 799.525875][T15738] CPU: 1 UID: 0 PID: 15738 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 799.525900][T15738] Tainted: [L]=SOFTLOCKUP [ 799.525906][T15738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 799.525916][T15738] Call Trace: [ 799.525922][T15738] [ 799.525928][T15738] dump_stack_lvl+0x100/0x190 [ 799.525957][T15738] print_report+0x156/0x4c9 [ 799.525981][T15738] ? __virt_addr_valid+0x81/0x620 [ 799.526005][T15738] ? __phys_addr+0xe8/0x180 [ 799.526029][T15738] ? v4l2_fh_init+0x27d/0x2c0 [ 799.526057][T15738] kasan_report+0xdf/0x1e0 [ 799.526085][T15738] ? v4l2_fh_init+0x27d/0x2c0 [ 799.526105][T15738] v4l2_fh_init+0x27d/0x2c0 [ 799.526122][T15738] v4l2_fh_open+0x64/0xa0 [ 799.526141][T15738] em28xx_v4l2_open+0x11e/0x570 [ 799.526175][T15738] v4l2_open+0x1d2/0x490 [ 799.526194][T15738] ? __pfx_v4l2_open+0x10/0x10 [ 799.526211][T15738] chrdev_open+0x234/0x6a0 [ 799.526228][T15738] ? __pfx_chrdev_open+0x10/0x10 [ 799.526245][T15738] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 799.526267][T15738] do_dentry_open+0x6d8/0x1660 [ 799.526292][T15738] ? __pfx_chrdev_open+0x10/0x10 [ 799.526311][T15738] vfs_open+0x82/0x3f0 [ 799.526331][T15738] path_openat+0x208c/0x31a0 [ 799.526352][T15738] ? __pfx_path_openat+0x10/0x10 [ 799.526373][T15738] do_file_open+0x20e/0x430 [ 799.526391][T15738] ? __pfx_do_file_open+0x10/0x10 [ 799.526416][T15738] ? alloc_fd+0x476/0x790 [ 799.526434][T15738] ? do_getname+0x191/0x390 [ 799.526455][T15738] do_sys_openat2+0x10d/0x1e0 [ 799.526473][T15738] ? __pfx_do_sys_openat2+0x10/0x10 [ 799.526497][T15738] __x64_sys_openat+0x12d/0x210 [ 799.526517][T15738] ? __pfx___x64_sys_openat+0x10/0x10 [ 799.526536][T15738] ? xfd_validate_state+0x129/0x190 [ 799.526566][T15738] do_syscall_64+0x106/0xf80 [ 799.526584][T15738] ? clear_bhb_loop+0x40/0x90 [ 799.526603][T15738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 799.526621][T15738] RIP: 0033:0x7f0b332a7407 [ 799.526636][T15738] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 799.526652][T15738] RSP: 002b:00007fff23e594d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 799.526669][T15738] RAX: ffffffffffffffda RBX: 00007f0b33962880 RCX: 00007f0b332a7407 [ 799.526680][T15738] RDX: 0000000000000000 RSI: 00007fff23e5af1b RDI: ffffffffffffff9c [ 799.526690][T15738] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 799.526700][T15738] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 799.526710][T15738] R13: 00007fff23e59720 R14: 00007f0b33a67000 R15: 000055603bc224d8 [ 799.526727][T15738] [ 799.526733][T15738] [ 799.786821][T15738] Allocated by task 5955: [ 799.791125][T15738] kasan_save_stack+0x30/0x50 [ 799.795790][T15738] kasan_save_track+0x14/0x30 [ 799.800448][T15738] __kasan_kmalloc+0xaa/0xb0 [ 799.805016][T15738] em28xx_v4l2_init.cold+0x94/0x3503 [ 799.810285][T15738] em28xx_init_extension+0x13a/0x200 [ 799.815552][T15738] request_module_async+0x61/0x80 [ 799.820556][T15738] process_one_work+0x9d7/0x1920 [ 799.825470][T15738] worker_thread+0x5da/0xe40 [ 799.830037][T15738] kthread+0x370/0x450 [ 799.834082][T15738] ret_from_fork+0x754/0xd80 [ 799.838645][T15738] ret_from_fork_asm+0x1a/0x30 [ 799.843385][T15738] [ 799.845684][T15738] Freed by task 5955: [ 799.849636][T15738] kasan_save_stack+0x30/0x50 [ 799.854294][T15738] kasan_save_track+0x14/0x30 [ 799.858951][T15738] kasan_save_free_info+0x3b/0x70 [ 799.863952][T15738] __kasan_slab_free+0x5f/0x80 [ 799.868698][T15738] kfree+0x1f6/0x6b0 [ 799.872573][T15738] kref_put.isra.0+0x56/0x90 [ 799.877145][T15738] em28xx_v4l2_init.cold+0x280/0x3503 [ 799.882504][T15738] em28xx_init_extension+0x13a/0x200 [ 799.887767][T15738] request_module_async+0x61/0x80 [ 799.892769][T15738] process_one_work+0x9d7/0x1920 [ 799.897682][T15738] worker_thread+0x5da/0xe40 [ 799.902247][T15738] kthread+0x370/0x450 [ 799.906291][T15738] ret_from_fork+0x754/0xd80 [ 799.910855][T15738] ret_from_fork_asm+0x1a/0x30 [ 799.915597][T15738] [ 799.917896][T15738] The buggy address belongs to the object at ffff88807d900000 [ 799.917896][T15738] which belongs to the cache kmalloc-8k of size 8192 [ 799.931923][T15738] The buggy address is located 1864 bytes inside of [ 799.931923][T15738] freed 8192-byte region [ffff88807d900000, ffff88807d902000) [ 799.945865][T15738] [ 799.948171][T15738] The buggy address belongs to the physical page: [ 799.954559][T15738] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d900 [ 799.963294][T15738] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 799.971765][T15738] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 799.979282][T15738] page_type: f5(slab) [ 799.983240][T15738] raw: 00fff00000000040 ffff88813fe40280 dead000000000100 dead000000000122 [ 799.991799][T15738] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 800.000357][T15738] head: 00fff00000000040 ffff88813fe40280 dead000000000100 dead000000000122 [ 800.009009][T15738] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 800.017660][T15738] head: 00fff00000000003 ffffea0001f64001 00000000ffffffff 00000000ffffffff [ 800.026307][T15738] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 800.034952][T15738] page dumped because: kasan: bad access detected [ 800.041343][T15738] page_owner tracks the page as allocated [ 800.047031][T15738] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 15210, tgid 15207 (syz.3.2416), ts 759327976446, free_ts 759039401891 [ 800.068539][T15738] post_alloc_hook+0x153/0x170 [ 800.073286][T15738] get_page_from_freelist+0x111d/0x3140 [ 800.078814][T15738] __alloc_frozen_pages_noprof+0x27c/0x2ba0 [ 800.084688][T15738] new_slab+0xa6/0x6d0 [ 800.088734][T15738] refill_objects+0x26b/0x400 [ 800.093390][T15738] __pcs_replace_empty_main+0x19f/0x600 [ 800.098916][T15738] __kmalloc_noprof+0x688/0x850 [ 800.103745][T15738] sock_kmalloc+0x111/0x170 [ 800.108227][T15738] ____sys_sendmsg+0x569/0xc30 [ 800.112971][T15738] ___sys_sendmsg+0x190/0x1e0 [ 800.117626][T15738] __sys_sendmsg+0x170/0x220 [ 800.122188][T15738] do_syscall_64+0x106/0xf80 [ 800.126753][T15738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.132620][T15738] page last free pid 5878 tgid 5878 stack trace: [ 800.138916][T15738] __free_frozen_pages+0x7e1/0x10d0 [ 800.144090][T15738] qlist_free_all+0x47/0xe0 [ 800.148573][T15738] kasan_quarantine_reduce+0x1a0/0x1f0 [ 800.154013][T15738] __kasan_slab_alloc+0x69/0x90 [ 800.158844][T15738] __kmalloc_cache_noprof+0x243/0x6f0 [ 800.164191][T15738] nsim_fib_event_work+0x157b/0x63b0 [ 800.169453][T15738] process_one_work+0x9d7/0x1920 [ 800.174366][T15738] worker_thread+0x5da/0xe40 [ 800.178931][T15738] kthread+0x370/0x450 [ 800.182973][T15738] ret_from_fork+0x754/0xd80 [ 800.187539][T15738] ret_from_fork_asm+0x1a/0x30 [ 800.192286][T15738] [ 800.194593][T15738] Memory state around the buggy address: [ 800.200206][T15738] ffff88807d900600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 800.208247][T15738] ffff88807d900680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 800.216286][T15738] >ffff88807d900700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 800.224325][T15738] ^ [ 800.230717][T15738] ffff88807d900780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 800.238763][T15738] ffff88807d900800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 800.246800][T15738] ================================================================== [ 800.265996][ T36] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 800.284169][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 800.309546][ T29] em28xx 3-1:0.132: Closing input extension [ 800.399399][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 800.407172][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 800.591754][ T1144] bond1: (slave ip6gretap1): link status up, enabling it in 0 ms [ 800.607429][ T1144] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 800.653135][T15738] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 800.660354][T15738] CPU: 1 UID: 0 PID: 15738 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 800.670942][T15738] Tainted: [L]=SOFTLOCKUP [ 800.675251][T15738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 800.685292][T15738] Call Trace: [ 800.688545][T15738] [ 800.691451][T15738] dump_stack_lvl+0x100/0x190 [ 800.696109][T15738] vpanic+0x552/0x970 [ 800.700064][T15738] ? __pfx_vpanic+0x10/0x10 [ 800.704550][T15738] ? v4l2_fh_init+0x27d/0x2c0 [ 800.709210][T15738] panic+0xd1/0xe0 [ 800.712909][T15738] ? __pfx_panic+0x10/0x10 [ 800.717306][T15738] ? v4l2_fh_init+0x27d/0x2c0 [ 800.721964][T15738] ? preempt_schedule_common+0x42/0xc0 [ 800.727404][T15738] ? check_panic_on_warn+0x1f/0x90 [ 800.732507][T15738] check_panic_on_warn.cold+0x19/0x34 [ 800.737862][T15738] end_report.part.0+0x3a/0x90 [ 800.742616][T15738] kasan_report.cold+0xe/0x18 [ 800.747279][T15738] ? v4l2_fh_init+0x27d/0x2c0 [ 800.751938][T15738] v4l2_fh_init+0x27d/0x2c0 [ 800.756432][T15738] v4l2_fh_open+0x64/0xa0 [ 800.760739][T15738] em28xx_v4l2_open+0x11e/0x570 [ 800.765579][T15738] v4l2_open+0x1d2/0x490 [ 800.769800][T15738] ? __pfx_v4l2_open+0x10/0x10 [ 800.774542][T15738] chrdev_open+0x234/0x6a0 [ 800.778935][T15738] ? __pfx_chrdev_open+0x10/0x10 [ 800.783848][T15738] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 800.790158][T15738] do_dentry_open+0x6d8/0x1660 [ 800.794906][T15738] ? __pfx_chrdev_open+0x10/0x10 [ 800.799836][T15738] vfs_open+0x82/0x3f0 [ 800.803889][T15738] path_openat+0x208c/0x31a0 [ 800.808461][T15738] ? __pfx_path_openat+0x10/0x10 [ 800.813380][T15738] do_file_open+0x20e/0x430 [ 800.817863][T15738] ? __pfx_do_file_open+0x10/0x10 [ 800.822872][T15738] ? alloc_fd+0x476/0x790 [ 800.827182][T15738] ? do_getname+0x191/0x390 [ 800.831667][T15738] do_sys_openat2+0x10d/0x1e0 [ 800.836324][T15738] ? __pfx_do_sys_openat2+0x10/0x10 [ 800.841503][T15738] __x64_sys_openat+0x12d/0x210 [ 800.846336][T15738] ? __pfx___x64_sys_openat+0x10/0x10 [ 800.851686][T15738] ? xfd_validate_state+0x129/0x190 [ 800.856872][T15738] do_syscall_64+0x106/0xf80 [ 800.861440][T15738] ? clear_bhb_loop+0x40/0x90 [ 800.866096][T15738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.871969][T15738] RIP: 0033:0x7f0b332a7407 [ 800.876364][T15738] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 800.895948][T15738] RSP: 002b:00007fff23e594d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 800.904339][T15738] RAX: ffffffffffffffda RBX: 00007f0b33962880 RCX: 00007f0b332a7407 [ 800.912292][T15738] RDX: 0000000000000000 RSI: 00007fff23e5af1b RDI: ffffffffffffff9c [ 800.920244][T15738] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 800.928192][T15738] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 800.936139][T15738] R13: 00007fff23e59720 R14: 00007f0b33a67000 R15: 000055603bc224d8 [ 800.944095][T15738] [ 800.947359][T15738] Kernel Offset: disabled [ 800.951655][T15738] Rebooting in 86400 seconds..