last executing test programs: 16m9.024055347s ago: executing program 3 (id=1334): syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000100)={0x18, 0x0, {0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x38}, 'vlan0\x00'}}, 0x1e) sendmmsg$unix(r1, &(0x7f0000002b00)=[{{&(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x8000010}}, {{&(0x7f00000005c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x24000040}}], 0x2, 0x4884) sendmmsg$sock(r4, &(0x7f0000001dc0), 0x213, 0x0) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000640)={0x108, r5, 0x2, 0x70bd29, 0x25dfdbfe, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x108}, 0x1, 0x0, 0x0, 0x200008d4}, 0x80) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000140)={0x0, &(0x7f00000001c0)}, 0x8) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000300)='highspeed\x00', 0xa) sendto$inet(r3, 0x0, 0x0, 0x11, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x14, 0x15, 0xa, 0x201, 0x0, 0x0, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x24040808) 16m7.85620005s ago: executing program 3 (id=1337): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) recvmsg(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x100) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e24, 0x2, @dev={0xfe, 0x80, '\x00', 0x35}}, 0x1c) add_key$user(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) listen(r1, 0xc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg(r2, &(0x7f0000002840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20044000) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0a00000004000000070000000600000000000000", @ANYRES32=0x1, @ANYBLOB="00000000000000000000000046b5a8a60dc5f3ffffff00000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000300"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB="0900000000000000000007000000140001800500020001000000080006001d000000f7bf655bfdf5cc300c9553f43167c3f0a6ca08359e50fa422de703a9804bebce4919b3799c8bae585eeaf9e3f1af906355a59c78a4f256b3d83633c4deaf6c2d8bedbe8d32f2ef7bec7c888c3e12e56765e960b650799845ea67ffb406a44ccd94759512c6be339fd7f79d"], 0x28}}, 0x4000040) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) write$nbd(r4, &(0x7f0000000280)={0x67446698, 0x1, 0x4, 0x3, 0x2}, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x5, 0xa) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYRES16=r5, @ANYRESHEX=r3, @ANYRES8=0x0], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000075f84c1071042703a461000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r6, 0x0, 0x0) 16m3.511866869s ago: executing program 3 (id=1352): mkdir(&(0x7f0000000440)='./file1\x00', 0xc) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x408200, 0x0) ioctl$SNDCTL_SEQ_RESETSAMPLES(r0, 0x40045109, &(0x7f0000000400)=0x7) chdir(&(0x7f0000000100)='./file1\x00') r1 = open(&(0x7f0000000480)='./file1\x00', 0x400460442, 0x0) quotactl_fd$Q_SETINFO(r1, 0xffffffff80000600, 0x0, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSBRKP(r2, 0x5425, 0x5) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32, @ANYRES16=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x62, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) r4 = getpid() sched_setaffinity(r4, 0x8, &(0x7f0000000040)=0x5) r5 = socket(0x1, 0x803, 0x0) getsockopt$SO_COOKIE(r5, 0x1, 0x47, &(0x7f0000000080), &(0x7f0000000180)=0x8) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201110100000008d90481a000000000000109022400010000b00009040100010300010009210000000122050009058103"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, &(0x7f0000000380)={0x2c, &(0x7f0000000440)=ANY=[@ANYBLOB="20222104000000a0"], 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$netlink(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000022000106"], 0x1c}], 0x1}, 0x0) mkdirat(r1, &(0x7f0000000340)='./file1\x00', 0x20) syz_io_uring_setup(0x1fc, &(0x7f0000000080)={0x0, 0x6c0a, 0x800}, &(0x7f0000000440), &(0x7f0000000100)=0x0) syz_io_uring_setup(0x5e7, &(0x7f00000017c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f0000000840)) syz_io_uring_submit(r8, r7, &(0x7f00000001c0)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x2007, @fd=r1, 0xd, 0x0, 0x0, 0x1, 0x1}) io_uring_enter(r1, 0xb15, 0x1, 0x56, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_GETFSSYSFSPATH(r2, 0x80811501, &(0x7f0000000280)={0x80}) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000000)={0x305, 0x0, 0x0, 0x40, 0x0, "7a58beca39ed2d5a99bbc4bff0ebd3e9bd5a8e"}) ioctl$TIOCSBRK(r2, 0x5427) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000580)=0x19) 15m59.766728323s ago: executing program 3 (id=1369): socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000780)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200004}) mkdir(&(0x7f0000000280)='./bus\x00', 0xc7) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f0000000500)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r3, &(0x7f00000077c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000004200)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x207645a, 0x2000, 0x0, 0x0, 0x9, 0x0, 0x0, 0x64}}, 0x50) syz_fuse_handle_req(r3, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000090c400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000542d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea8286a2fba523440000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000633956a1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d6ab715107fa1820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffffffffffff0000000000000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000286071480000000000b13bc1e6d970884f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff00", 0x2000, 0x0) socket$nl_route(0x10, 0x3, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) syz_fuse_handle_req(r3, 0x0, 0x0, &(0x7f0000000f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x10, 0x0, 0x6}, 0x0, 0x0, 0x0}) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) ioctl$PIO_CMAP(r6, 0x4b71, &(0x7f0000000380)={0x400, 0x4, 0x10001, 0x5, 0x4, 0x8}) 15m57.131850062s ago: executing program 3 (id=1373): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000080)=0x0) bind$nfc_llcp(r0, &(0x7f0000000000)={0x27, r1, 0xffffffffffffffff, 0x6, 0x0, 0x0, "0f03c8c7e8da000000000000ffffff017f000000cce67e1d0000e565aa9a9d32c7627ffe7a8e79bd8bc6fd069e000000000000060000000000000000deff00", 0x1}, 0x60) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000002c0)=0x20) r3 = openat(r2, &(0x7f00000007c0)='./bus\x00', 0x0, 0x1d5) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) ioctl$BTRFS_IOC_DEV_INFO(r3, 0xd000941e, &(0x7f0000000a40)={0x0, "1e9c8c95bc719750487cfa786fe313e9"}) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000380)={r7, 0x7, 0x1, [0x4, 0x7df0dcd7, 0x9, 0x2, 0x5], [0x1, 0x5, 0x87e, 0xe2c5, 0x73, 0x8, 0x6, 0x80, 0xb, 0x8, 0x9, 0x4, 0x8000, 0x2, 0x1, 0xda84, 0x10, 0x6, 0x5, 0x9, 0x100, 0x4, 0x80000001, 0xfff, 0xdf, 0xc98, 0x100000000, 0x5, 0x100000001, 0x1, 0x8, 0x8000, 0x14000000000, 0x3, 0x7e1, 0x100000001, 0x2, 0x1, 0x3, 0x8000000100000, 0x9, 0xa, 0x0, 0x7, 0x4, 0x7ff, 0x7, 0x9, 0x5, 0x5, 0xc60, 0x63, 0x10000, 0x5, 0x8, 0x3, 0x3, 0xfffffffffffffff7, 0x1cbd, 0x6, 0x1, 0xa1d, 0x2, 0x5, 0xd, 0xb, 0xc95, 0x0, 0x1bbd5579, 0x5, 0x0, 0x2, 0x5, 0x0, 0x4, 0x80000001, 0xc6, 0xed6d, 0x9d, 0x400, 0xf6, 0x7, 0xfffffffffffffff8, 0x4, 0x2, 0xdc1, 0x6, 0x3, 0x6, 0xc, 0x60, 0x6, 0x9, 0x4, 0x8, 0x4, 0xfffffffffffffff8, 0x1, 0xfd4b, 0x10001, 0x3, 0x2, 0x7, 0x100000001, 0x0, 0x400, 0xc00000, 0xf, 0x9, 0x0, 0x7ff, 0x5, 0xd95, 0xfffffffffffffff9, 0x1, 0x5, 0x6, 0x5, 0x7, 0xe24b, 0x7]}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$uac1(0x2, 0x0, 0x0, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0xffffffffffffffa5, 0x1a, {0x2, 0x19, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000ffdbdf250200000008000300", @ANYRES32=r6, @ANYBLOB="edff250080170000"], 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x0) getsockopt$nfc_llcp(r0, 0x118, 0x4, &(0x7f0000000140)=""/192, 0x20000057) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r3) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4084040}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x24, r11, 0x10, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x712}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40850}, 0x1) 15m52.056654123s ago: executing program 3 (id=1383): socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'syz_tun\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000010000000000fddbdf2500000000", @ANYRESHEX, @ANYBLOB="062300005a110140000000200000009d1e"], 0x40}, 0x1, 0x0, 0x0, 0x24000001}, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mkdir(0x0, 0x0) pipe2$9p(0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = fsopen(&(0x7f0000000100)='binder\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x17, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x18) fsmount(r3, 0x0, 0x1) fsconfig$FSCONFIG_SET_FLAG(r3, 0x0, &(0x7f0000000040)='dirsync\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r3, 0x7, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="2b40000048009125745c7388641f9c060ab1"], 0xfe33) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mlock(&(0x7f0000ffb000/0x1000)=nil, 0x1000) mlock2(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x0) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f00000001c0)={0x5, 0x0, [{0xc0000001, 0x100, 0x7, 0x7, 0x24a1da04, 0x10001}, {0x4, 0x1, 0x7, 0xe8, 0x3, 0x8c, 0x3ff}, {0xd, 0x0, 0xb, 0x0, 0x6, 0x1f, 0x8}, {0x6, 0xffff, 0x5, 0x20000006, 0x5, 0x1, 0x6}, {0x6, 0x100080, 0x1, 0xfffffffd, 0x7fff, 0x0, 0x2}]}) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'}) 15m36.732340515s ago: executing program 32 (id=1383): socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'syz_tun\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000010000000000fddbdf2500000000", @ANYRESHEX, @ANYBLOB="062300005a110140000000200000009d1e"], 0x40}, 0x1, 0x0, 0x0, 0x24000001}, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mkdir(0x0, 0x0) pipe2$9p(0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = fsopen(&(0x7f0000000100)='binder\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x17, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x18) fsmount(r3, 0x0, 0x1) fsconfig$FSCONFIG_SET_FLAG(r3, 0x0, &(0x7f0000000040)='dirsync\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r3, 0x7, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="2b40000048009125745c7388641f9c060ab1"], 0xfe33) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mlock(&(0x7f0000ffb000/0x1000)=nil, 0x1000) mlock2(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x0) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f00000001c0)={0x5, 0x0, [{0xc0000001, 0x100, 0x7, 0x7, 0x24a1da04, 0x10001}, {0x4, 0x1, 0x7, 0xe8, 0x3, 0x8c, 0x3ff}, {0xd, 0x0, 0xb, 0x0, 0x6, 0x1f, 0x8}, {0x6, 0xffff, 0x5, 0x20000006, 0x5, 0x1, 0x6}, {0x6, 0x100080, 0x1, 0xfffffffd, 0x7fff, 0x0, 0x2}]}) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'}) 15m1.733248313s ago: executing program 2 (id=1562): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x7) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0xff) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000003c0)) 15m0.758428307s ago: executing program 2 (id=1565): r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000340)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x2, 0x1, {{0x3a, 0x4, 0x0, 0x0, 0xe8, 0x64, 0x0, 0x0, 0x0, 0x0, @broadcast, @local, {[@ssrr={0x89, 0xf, 0xa3, [@dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast2]}, @timestamp_addr={0x44, 0x4c, 0x60, 0x1, 0xf, [{@rand_addr=0x64010100, 0x5a8a}, {@rand_addr=0x64010102, 0x7360f12c}, {@loopback, 0x4}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@loopback, 0x9}, {@private=0xa010100, 0x8001}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}, {@rand_addr=0x64010100, 0x9}]}, @end, @timestamp={0x44, 0x20, 0x46, 0x0, 0x2, [0x10000, 0x2, 0x1, 0x0, 0x8, 0x48, 0x4]}, @ra={0x94, 0x4, 0x1}, @ra={0x94, 0x4}, @timestamp_addr={0x44, 0x3c, 0x51, 0x1, 0x9, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x80000000}, {@broadcast, 0x7}, {@multicast1, 0x3}, {@loopback, 0x8}, {@dev={0xac, 0x14, 0x14, 0x44}, 0x9}, {@multicast1, 0x5bb4}, {@loopback, 0x2b}]}, @timestamp_prespec={0x44, 0xc, 0x2c, 0x3, 0xb, [{@dev={0xac, 0x14, 0x14, 0xf}, 0x4}]}, @lsrr={0x83, 0x7, 0xf, [@multicast1]}]}}}}}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYRESHEX=r0], 0x210}, 0x1, 0x0, 0x0, 0x41090}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="340000000007010200000000000000000100000308000540000000020900010073797a30000800000900010073797a3100000000"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x44acc14474f16fbe) mknod$loop(0x0, 0x20, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r3}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x4000010, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000001300)='jffs2\x00', 0x0) fcntl$setstatus(r4, 0x4, 0x400) r6 = socket(0x2a, 0x4, 0xf) r7 = socket$rds(0x15, 0x5, 0x0) bind$rds(r7, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r7, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) sendmsg$rds(r7, &(0x7f0000000680)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r7, 0x114, 0x1, &(0x7f0000000100)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c0000005e0021a5553f8c6b23cbff070000e5373526a01edb"], 0x1c}, 0x1, 0x0, 0x0, 0x48050}, 0x0) setreuid(0x0, 0xee01) fanotify_init(0xc2912c796e8aad64, 0x1000) 14m59.374053006s ago: executing program 2 (id=1567): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) (async) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) unshare(0x400) signalfd4(r2, &(0x7f0000000140), 0x8, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x19, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xea5e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8020}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {}, {0x85, 0x0, 0x0, 0xb3}}]}, &(0x7f00000000c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x1c, r3, 0x11, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}}, 0x4) 14m59.110058282s ago: executing program 2 (id=1571): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$bind(&(0x7f00000000c0)='.\x00', &(0x7f0000000640)='./file0\x00', 0x0, 0x94701a, 0x0) umount2(&(0x7f00000002c0)='./file0/file0\x00', 0x8) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x28a100, 0x0) ioctl$PTP_EXTTS_REQUEST2(r0, 0x40043d0d, 0x0) 14m58.852570898s ago: executing program 2 (id=1574): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0xfe}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x2004cb], 0x0, 0x202}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000002c0)={[{0x0, 0x4, 0x80, 0x0, 0x5a, 0x2, 0x2, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, {0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}], 0x9}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r8 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x40c500, 0x80) renameat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', r8, 0x0) r9 = syz_open_dev$usbmon(&(0x7f00000000c0), 0x0, 0x8200) ioctl$MON_IOCX_MFETCH(r9, 0xc0109207, &(0x7f0000000140)={&(0x7f0000000100), 0x0, 0x81}) listen(r7, 0x4000000) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r10, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) 14m58.392474504s ago: executing program 2 (id=1575): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x7) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0xff) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000003c0)) 14m57.85924016s ago: executing program 33 (id=1575): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x7) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0xff) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000003c0)) 3m37.993158025s ago: executing program 0 (id=3519): openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/slabinfo\x00', 0x41, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40101) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue0\x00', 0x100}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r3, 0x40bc5311, &(0x7f00000001c0)={0x80, 0x1, 'client1\x00', 0xffffffff80000006, "d62e980da99179cf", "20e48560999fd132c0e3a23bce4464ece6499136f0003336f794d24352346f8f"}) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x8}, {0x4, 0x1, 0xb, 0x9, 0x0, 0x8}}, {{0x6, 0x0, 0xb, 0xa}, {0xf}}, [@printk={@lu, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x2, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x15}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000080)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) 3m36.701102383s ago: executing program 0 (id=3521): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r1, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="0100"}) ioctl$PPPIOCSACTIVE(r0, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={0x2, 0x4, 0x0, 0x3, 0x7, 0x0, 0x700, 0x0, [@sadb_sa={0x2, 0x1, 0x4d3, 0x0, 0x0, 0x0, 0xd}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @rand_addr=0x64010100}}]}, 0x38}, 0x1, 0x7}, 0x0) read(r0, 0x0, 0x2) pwrite64(r0, &(0x7f0000000240)='@j', 0x2, 0x0) 3m36.260574114s ago: executing program 0 (id=3526): r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) r1 = syz_io_uring_setup(0x1f8, &(0x7f0000000080)={0x0, 0x6c0e, 0x10100}, &(0x7f0000000440), &(0x7f0000000100)=0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r4, 0x9, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x24, 0x3d, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}]}, 0x24}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x20, 0x1, 0x9, 0x3, 0x0, 0x0, {0x3, 0x0, 0x4}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x8040}, 0x4040080) syz_io_uring_setup(0x5e9, &(0x7f00000017c0), &(0x7f0000000040)=0x0, &(0x7f0000000840)) syz_io_uring_submit(r10, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) io_uring_enter(r1, 0xb15, 0x0, 0x0, 0x0, 0x0) r11 = dup2(r0, r0) ioctl$VHOST_VSOCK_SET_RUNNING(r11, 0x4004af61, &(0x7f00000003c0)=0x5) 3m33.868714907s ago: executing program 0 (id=3534): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) socket$inet(0x2, 0x1, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000540)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000380)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x9101a, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$bind(&(0x7f0000000280)='./file0\x00', &(0x7f0000002100)='./file0/file0\x00', 0x0, 0x2187017, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000002100), 0x1004003, &(0x7f00000013c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}]}}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r2, &(0x7f0000002140)={0x2020}, 0x2020) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r3, 0x4068aea3, &(0x7f0000000200)={0xc4, 0x0, 0x4}) 3m33.499464727s ago: executing program 0 (id=3540): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x6d, 0x44, 0xdf, 0x20, 0xf3d, 0x68a3, 0xc3e8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xcf, 0x0, 0x0, 0xff, 0xff, 0xff}}]}}]}}, 0x0) 3m31.847908856s ago: executing program 0 (id=3544): r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) r1 = syz_io_uring_setup(0x1f8, &(0x7f0000000080)={0x0, 0x6c0e, 0x10100}, &(0x7f0000000440), &(0x7f0000000100)=0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r4, 0x9, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x24, 0x3d, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}]}, 0x24}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x20, 0x1, 0x9, 0x3, 0x0, 0x0, {0x3, 0x0, 0x4}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x8040}, 0x4040080) syz_io_uring_setup(0x5e9, &(0x7f00000017c0), &(0x7f0000000040)=0x0, &(0x7f0000000840)) syz_io_uring_submit(r10, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) io_uring_enter(r1, 0xb15, 0x0, 0x0, 0x0, 0x0) r11 = dup2(r0, r0) ioctl$VHOST_VSOCK_SET_RUNNING(r11, 0x4004af61, &(0x7f00000003c0)=0x5) 3m31.310329575s ago: executing program 34 (id=3544): r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) r1 = syz_io_uring_setup(0x1f8, &(0x7f0000000080)={0x0, 0x6c0e, 0x10100}, &(0x7f0000000440), &(0x7f0000000100)=0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r4, 0x9, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x24, 0x3d, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}]}, 0x24}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x20, 0x1, 0x9, 0x3, 0x0, 0x0, {0x3, 0x0, 0x4}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x8040}, 0x4040080) syz_io_uring_setup(0x5e9, &(0x7f00000017c0), &(0x7f0000000040)=0x0, &(0x7f0000000840)) syz_io_uring_submit(r10, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) io_uring_enter(r1, 0xb15, 0x0, 0x0, 0x0, 0x0) r11 = dup2(r0, r0) ioctl$VHOST_VSOCK_SET_RUNNING(r11, 0x4004af61, &(0x7f00000003c0)=0x5) 12.666899559s ago: executing program 5 (id=4131): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x10, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="60000000020601010000000000000000eb7af834050005000a000000050004000000000014000780080006400000000008000840000000f00900020073797a3000000000050001000600000011000300686173683a6e65742c6e6574"], 0x60}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x1f00000000000000) 11.79043133s ago: executing program 1 (id=4134): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) remap_file_pages(&(0x7f00000a1000/0x2000)=nil, 0x2000, 0x0, 0xc685, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) getpid() r3 = socket(0x10, 0x80002, 0xfffffffe) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) 11.600159737s ago: executing program 5 (id=4136): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000240)='spmi_cmd\x00', 0xffffffffffffffff, 0x0, 0xe1f8}, 0x18) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000840)=@raw={'raw\x00', 0x9, 0x3, 0x2c0, 0x268, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x4e0, 0xffffffff, 0xffffffff, 0x4e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast1, @remote, [0xffffff00, 0xffffffff, 0xff000000, 0x80], [0xff, 0xffffff00, 0xffffff00, 0xffffffff], 'pimreg\x00', 'veth0_to_team\x00', {0xff}, {0xff}, 0x3b, 0x7, 0x7, 0x88}, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@dev={0xac, 0x14, 0x14, 0x3e}, [0x0, 0xff000000, 0xff, 0xffffffff], 0x4e24, 0x4e22, 0x4e24, 0x4e21, 0x4, 0x4, 0x200, 0x2, 0x40}}}, {{@ipv6={@local, @mcast1, [0x0, 0xffffffff], [0x0, 0xffffff00, 0xffffffff, 0xffffffff], 'ip6tnl0\x00', 'veth1_macvtap\x00', {}, {0xff}, 0x3c, 0x9e, 0x4, 0x7c}, 0x0, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x2, 0x2, {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x320) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x3, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000001800000000000000000000001801000020207025000000000020"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, @void, @value}, 0x94) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a00000014000780050015000000000008001240"], 0x60}}, 0x0) 10.97737935s ago: executing program 5 (id=4137): bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f00000002c0)=ANY=[@ANYRESOCT=r0], 0x0) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffff"], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = landlock_create_ruleset(&(0x7f0000000140)={0x8b28, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) mlockall(0x5) setuid(0xee00) setpriority(0x1, 0x0, 0xff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000327000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0xc, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) ioctl$KVM_RUN(r5, 0xae80, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x6a) 8.516290996s ago: executing program 1 (id=4143): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="638773dfcc3e0ed18af7f17cb60bddd4e6c0372de1328c6d7450cb0c0668060bb42330136367d5e7154e9faac96b241d6c47a16bca1e58f76b91afffbcd3c414989305ca1fa5710b72068cf332be4d89919c32323f0104258620b7ed751d3b7252434c7eee207f62cda805c9ef385f2bfe9cbed1bc1a82414ad5f4145f086d08a1eeec70f0d0399b8df2"], 0x10}, 0x1, 0x0, 0x0, 0x8800}, 0x8000) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) syz_80211_join_ibss(&(0x7f00000000c0)='wlan0\x00', &(0x7f0000000140)=@random="6705d04bf1e8c865eff0a33e6083dda9a9a56257251c5e", 0x17, 0x2) 8.353370301s ago: executing program 1 (id=4145): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000190c0)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) getpid() connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x800, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TCXONC(r2, 0x540a, 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000340)=ANY=[]) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000180)) getsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x12, 0x2, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r3, 0x5607, 0x2c) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x2) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(0xffffffffffffffff, 0x4008941a, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_io_uring_setup(0x4169, 0x0, 0x0, 0x0) migrate_pages(0x0, 0x197, &(0x7f0000000040)=0x521, &(0x7f0000000080)=0x1) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000280), 0x800, 0x0) ioctl$SNDCTL_DSP_GETTRIGGER(r5, 0x80045010, &(0x7f00000002c0)) r6 = dup(r4) ioctl$TIOCL_SETVESABLANK(r6, 0x560e, &(0x7f0000000140)) openat$fb0(0xffffffffffffff9c, 0x0, 0x100, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 8.236183671s ago: executing program 5 (id=4146): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bd2) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x53cb1000) syz_clone(0x0, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[], 0x48) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a85320, &(0x7f0000000180)={{0x80, 0x80}, 'port1\x00', 0x172, 0x80808, 0x10000, 0x0, 0x0, 0x39b5, 0x0, 0x0, 0x5}) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x28, 0x3, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x40040) 8.235764698s ago: executing program 7 (id=4147): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000003c00)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003a80)="f5214f77da9f", 0x6}, 0x68) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f0000001480)=ANY=[@ANYRES64=r0], &(0x7f0000001380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r1}, 0x10) r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000003c0)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="00000102", 0xfffff, r2) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000000)) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000000c0)={0x8000, 0x6, {0x0}, {0xee00}, 0x122, 0x4}) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_int(r6, 0x0, 0x21, 0x0, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x1e, 0xd, &(0x7f0000001500)=ANY=[@ANYRESDEC=r7, @ANYRES32=r7, @ANYRES8=r5], &(0x7f00000014c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001300)={r8, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) wait4(r4, &(0x7f0000000200), 0x1, &(0x7f00000013c0)) r9 = syz_usb_connect(0x0, 0x24, &(0x7f0000001440)=ANY=[@ANYBLOB="12010000bdf7130870270c936a8d010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r9, 0x0, &(0x7f00000003c0)={0x24, &(0x7f00000000c0)={0x0, 0x13, 0x6, "fc19d02303f6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r9, 0x0, 0x0) syz_usb_control_io$printer(r9, 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f0000000180)=0x6f) r10 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) rt_sigqueueinfo(r4, 0x14, &(0x7f0000000240)={0x18, 0x19, 0x7}) read$dsp(r10, &(0x7f00000002c0)=""/4096, 0x1000) write$dsp(r3, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5afc559f00"/32, 0x20) socket$nl_route(0x10, 0x3, 0x0) 6.768549787s ago: executing program 5 (id=4148): symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) modify_ldt$read(0x0, 0x0, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0x40, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r1, &(0x7f0000000080)={0x40002011}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x47, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, @void, @value}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xc, 0x13, &(0x7f0000000740)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1f}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1, {0x8001}}, './file1\x00'}) remap_file_pages(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r6 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000002640)=""/4096, 0x1000}, {&(0x7f0000000600)=""/235, 0xeb}, {&(0x7f0000000540)=""/167, 0xa7}], 0x3}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) fsopen(&(0x7f00000003c0)='jfs\x00', 0x1) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x44, &(0x7f0000000000)={0x0, 0x0}, 0x10) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r7, 0x89e3, &(0x7f0000000100)={0x34, 0x0, 0x9, 0xc, 0x0, 0x81}) listen(r0, 0x8) accept4(r5, 0x0, 0x0, 0x80000) r8 = syz_open_dev$cec(&(0x7f00000004c0), 0xffffffffffffffff, 0x0) ioctl$CEC_DQEVENT(r8, 0x40046109, &(0x7f0000000340)) 5.068358332s ago: executing program 6 (id=4151): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000980)='sys_exit\x00', r0}, 0x10) r1 = timerfd_create(0x7, 0x0) timerfd_settime(r1, 0x0, &(0x7f0000007000)={{0x0, 0x4}, {0x0, 0x989680}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$sndmidi(&(0x7f0000000000), 0x8, 0x2) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000940)=@ipv4_delroute={0x34, 0x19, 0x901, 0x70bd25, 0x0, {0x2, 0x18, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @private=0xa010102}, @RTA_FLOW={0x8, 0xb, 0x5}]}, 0x34}}, 0x0) 5.068084341s ago: executing program 1 (id=4152): r0 = socket(0x15, 0x5, 0x20010) getsockopt$inet6_mreq(r0, 0x29, 0x15, 0x0, &(0x7f0000000180)) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000300)=[{0x0}], 0x1) socket$inet(0x2, 0x2, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$int_in(r2, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000140)=0x200000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x301a00, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r0, r5, 0x0, 0x20000023896) r6 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$TCSETSF(r6, 0x5404, &(0x7f0000000000)={0xc3, 0x28000, 0xe21c, 0x200000, 0xfd, "7a58beca39ed2d5a99bbc4bff0ebd3e9bd5a8e"}) close_range(r4, r6, 0x0) 5.006955851s ago: executing program 7 (id=4153): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x9, 0x5, 0x2, 0x4, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={0x0, r1}, 0x18) setsockopt(0xffffffffffffffff, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) sendmsg$NFC_CMD_DISABLE_SE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x54}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bind$netlink(0xffffffffffffffff, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000380)='net/wireless\x00') kexec_load(0xfffffffffffffffe, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2008400, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r3 = open(&(0x7f0000000100)='.\x00', 0x0, 0x20) ioctl$AUTOFS_IOC_PROTOSUBVER(r3, 0xc0049364, &(0x7f0000000180)) 4.922958411s ago: executing program 4 (id=4154): bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) write$UHID_CREATE(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sysvipc/shm\x00', 0x0, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) syz_open_dev$usbmon(0x0, 0xfffffffffffffffd, 0x400040) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './bus'}}]}) 4.907817769s ago: executing program 6 (id=4155): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x7a917000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000040), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000000)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000100)={0x0, 0x13, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f00000001c0)={r5, 0x2, 0x22540000, 0x0, 0x0, [0x0], [], [0x0, 0x0, 0x100, 0xd], [0x0, 0x0, 0xfffffffffffffffd]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000080)={r6, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000004, 0x13, r7, 0x80000000000000) 4.106825148s ago: executing program 4 (id=4156): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) readv(r1, &(0x7f0000002380)=[{&(0x7f0000002180)=""/117, 0x75}], 0x1) r2 = epoll_create1(0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@weak_binder={0x77622a85, 0xa, 0x1}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000bc0)={0x44, 0x0, &(0x7f0000000a00)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4, 0x800000000000000, &(0x7f0000000b00)="90c015cc"}) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000fe0000000000000000000000000a28000000000a0101000000005e1affd5022000000900010073797a300000000008000240000000032c004af08ece01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001ebcff6c435ec8d9a2d34d045dd8a"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000010000100000000000000000000000a68000000060a01040000000000000000020000003c000480380001800e000100627974656f726465720000002400028008000140000000120800024000000000080004400000000008000540000000080900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a00"], 0x90}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)={0x40002006}) connect$unix(r0, &(0x7f0000000140)=@abs, 0x6e) io_uring_register$IORING_REGISTER_PBUF_STATUS(0xffffffffffffffff, 0x1a, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) getpid() mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) 3.877105319s ago: executing program 7 (id=4157): r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1a3c82) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x3, 0x9, 0x8e, 0x8001}, {0x5, 0x7, 0x4, 0x7}]}) 3.108364673s ago: executing program 6 (id=4158): openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), r2) sendmsg$NLBL_UNLABEL_C_ACCEPT(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x1c, r4, 0x6da413bdae9c6093, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000880}, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) close_range(r1, r5, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000001100)={r0, 0x0, {0x0, 0x0, 0x0, 0x5, 0x1000, 0x0, 0x0, 0x0, 0x10, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "244333791f045158d974050000000000000400000001081800", [0x1ff]}}) r6 = dup(r0) write$UHID_INPUT(r6, &(0x7f00000000c0)={0x8, {"4ee81482ade746204cbe5efcc81aff8caf5b093bd36acdac991d7ba56848b36ec1037d5dbd4f92c25d8e1cba8c04d897105cf4d3b788d171a786567bc9398c4cbcca697a3b6f5e770c06d75733276088fa06a72b365f58e42650c0fd2312c62fe9498599ffc755063622c0bef952ba7c2c1fdc43bd6c55ef5182f6aa526ca90327c480793e89415bc90499a8911a33850b45d94406eff6ad946010ee2bbb77aa2fa83e7b63ae4004cbeb32f3d65c25672cf04318435d4ab207d06c1a9b5e82a963eadca405f261ea754a4977d1de8cd3857dfeca6b8de5ed675a8045be600210d2853572e505f5800f811005f97fac8a915748fa206eee0f8e09ebff47612070f86b76f0c29d03a762f9759aa90b66c8b1c40382f0a7d7664288fa1bdb2574b53a6713f7d89f749cbf54ab703e137cb4ff1e7b495fd33c04610b67390074c2e06b0a5b2779923ec0445df829ab11566d7f7693a4e9886f1661ad7aec75daa4bd31917c7d0e03608c65623485c3ba83b22e8f2bc179b0d2098eb8594b1dfef0dfe8dc89709e7ad9b5fe1e9a55bc44f6f221e22daed917fdc7b80379df5f66f3035876292a7c4e636e981e8cb37bc38973b37f7cd39fe072212473a04b3c73262565dc6d2e6555434ed06cb170f1d17f733176e74f5fee54ea2127b4c08c901c5c572d1b786f173f458490f022abae2f34d3d16d21700d463ae2ff4acce06ab35dc291a8afec8cb335e25b9678d87a5ee25422f1879f96c82f8bcce3af2b6e49be5251451fa899144de8579c0a9f4566c1f49020c11d4e7aa1b953bbd58546b76668b34bc55479f2dc61392037a510655fa71b33ba8911a80941dea0362e1adda45694f9418b2fa8bcd5bfaa4207746753193acc4fe8dbb0f9aae1079dcd762944b6abede8100b733097aa72e54ff595013cddaf40f96feb813c5599648e4891b3bc8a5c691e388f0acd905aad06c0efee0affa16089d43289be581cafc541f272bd39187c9af5e6a844e432999df7ef534441202a9bba4495d0c61703dc9ad5a637b1ef26d8a1491defbacf46dac01528a13171216766c4d4a6957e1cdd23585edc114dd0cfb111112514f2212805d2e04d06aaec0c373eba054e7531d65a24c2cc30c6f77a00813d7ad444b58eb741cf3b511bb1ac8d867ca8689c5a6ba2563947290206c713cf8a23c958b55431d148bdb1ae6b33438980e54c396899c6815eca1e0bf6588db80a02b679494194e28e685916eae86396ea44cfda85677b2aa1bb2c32a5ee5c786f4e555146b14a2b296332f44cbc4c10d43bffe4735a12d5010b970429d338302fde347f4575e4b6102a4f2f46f18e4ef0b7477dcf88ab7d207f877daf63ea6198ecf3dde06a49f42002e8fa922d6dfe75619e2f4f988ed6d82fceb2bea5746f43b36b1bd448d38df6886560c83dd6680220699a2fadcec46e9ecb5bee70cbd45cf33248f9df66970bde59e4edb042d33585c65f2e944f2b37bdbb340f414f850e27b7bf670255cd5538b48025e5ceeba2642f94d045aa1498fc57c98bc8ecd30b0c988a48089ad7290ab54b73130d4db1896e95381f088f94da66609bf8e6796bdc7bc511e3f8a8d680bca6aa8c20bc43d7e566a4b78b5234dfae78be84fdb07f41e1da7acbcd3d1e32dbee4ff469fe31c2092bd78d68b193dcaef749c6af29710e5c368a84c0727d1c3f528d3a7b41710e7e6aad5f52890ca42491ba769a4a24b0628a8444f0fe975a4cd6658b13e40b79f490ab57948eaaccefd10a9ea09d9620d4837f452d8f12b6df0fab2e91f5ac994dcfaa1cd9874981e5ce7e01cce035927a17a1ef9cbcce6d3f2be5c3a25493b50fe20e3bd1d95444f7d57fe297eb1719b85ffd2684a27079dde6d0c986e456d53fbb9c02d7fc050728da59c72eebda5d34766f915ad2b5c96e7931f18dc179a08bb5686c61f9b43b58851b24251f72c57b8fbe3ef1e8dc9a84526cd236a17fba51ad9c6b07ba750747b321ab0e5e37181b9af55cf85a8e85fb5f254c0a7958e7de3b451d2106854834e2b562c3f422fa1abf7f095eb06e458a1a2a8d4f300ebe47c5d050061e3c9b2736aa1af386432887c8ac4241e1f165bb0e791e0d848ff48be7f1ff6f92bac38df1c5c103833261cb3a42f682bdf1dcc13c8e57ae74d9950448de921b2e9baaba08e2e35fc1d4e01892448fd3eab199b02cc00c4fbd987d104a9f4c6cbc3c55eaef8fd0243a418693f04c582ff2dc3d3f8902ece00c4db54908f78bfc5dd23e2c9c8c4439ca98c2f013036f8fce856a67f1182f2f300c44f864243e55c97080255ce9fcc6eab4ace98594cf036cd70e2045365df75aa53825aa240d6929a598ce9394bc5845c93679b8aff2395cf32a876d99f097b0c367adece09f709157e54f862811201686f1722644e0f54b113a93a7f6c3af747d909053de8798f28ad4a525131107bb0c8a8359a8c8f9dc9ff942d2c2cbd7375d298f2c80389576c0a0de7a9277ce8cc670ce05b3bf3d8ec496b2dce52fc034453c8ca2c8aaa7169aa0d30b023e81208335cc8ecc9e04994bdbfc48425d25d0cf534bc6f29718df8fd62a6ba25a56746efa07948f8f4b0417882c507aa2b52fb435173f47e1e6d9bfcb0f4a27a389772c2139c84d251b0f13b14ed8ca1d3ae563e6919b30ddf7d94f6a39e5f2e41065c3875b9953c0fb2436b0ac0a1f8b5159a0c48ef8c066a857b1cfe39f27ce490f745d9823d1a9b0daa3837e9e5d1ba1af1a09f215bb86ee3e631c05e134c8db720df8de1d7d3a72265bc55e8078b5d399b711a6db92a5d9a9876ac0aecc1be3223af9204e92d070758d0f2712f84ab386755e371fc5af836fe3e6ad637ed02a0f4f78c48488799323fcbcff04c69df02773a5ac1423d4c6c2d7f978683ea823e22f60fb0bac265b165b24bbfe98526e90decafa9cdfd3bd40347211a76335e468f9561cf70834780a454ae4a489afdfe668f9e1f994ff2105c7a47af2127d26e7907f6f5936ca9ed7b681089da2d518620c3169175a6954b6b9cdb931bc29de0ec57c79d62a03c7a9730096f9f142a2a8e2d3d2fbe6c07d377a219f3bdb43c692e033b5db50f0598495f158e68c08da96c5bd6590aecd068218cf1f0ae396e53a710b1df5854a5573a9ca0e1d1063f9e8b6065c025bd303e2a78121487c3f9f8845a0973baa9612b1b7a7b0f60cc376885a60a4445bfcfa160d5ca2bbcf518f7dbdee17e712fe0c77996b5346531581ed76fd64a424f90bea094b422816e6b37618e6ccf0f41820d8fd6aa16f2cee1da172bfb4da934419e6ea004ace0f9f0e7b1b6224a365d9af5c3a7645d4733a6c419289829c309daa39aa24c4761c583ca55637fe94b9d18de69c7a815f21d2b26b241c223704dee03877898c0bdb23f59b98d8bf36b55f029f91b516fc8fe1faad6210426b6e43e3567f9e6b395448b610a2ea68618b31c495c0a77219de90737ac7f873fcbc36c91950a43b7f89167f07b7fe86b3b6c9dc193467a7ea281e7c492002a64ed27c24a4dee2b0010221c8bc6f129fafc256f83a93538b41d4ce993f4cd49957a253edc4809b47d8c456d3eae6f38375ed0bd69d9a8cfbffd67000aa86af04d26e003d70949f4c870e2f878fe5551ae2df961f66b068cbbbdde9806b88bfc15f96cec2a743bd196d8a0f10579a930d46ab04b9a6f511134318c32683d95282e952e9489343e7dac3a59d4abcba560d0b16c3c0a6f5aa288b140c7faf4b024b22697f9464df15e2bf0844b4e1cc2028ce5e5ff43b5d3388255e4ab3d46593759f0972a03712a35c79327349f4047e084b9fe64d28a06342f5e9332e1f0984e3fc61ac378c3a3a998497047804fa3752a9c65b0e809a5942dd55a1798c382116e11c0a8096e7ee986313062d42c69ad9d1519a2597a475dca244a4c9ab90410d866f408e725c328e66859b60797301afe947fbd883b5d982d3e09fec98a84c833143f48eef6db997de96bcab71b5a3a4891cc374e63ba2bc5deb08173e95425775b5e379c7e7d1b048fa7d71c60b1ffa6bf5a8807a4ff3b3263100986bb73fd86942a61bc70398cde294a840e372f03a94e75f61e2fe972e2dd8268ac1b91ffb310421aecaf138d23f71c783989617f33f3a8a5891cf80840eae26e527a180fbbc127845de3ca80197c56cc5ce368a36db78b9cfdaae5777cfb39fb4dc7d861b38e84920f74c65da5e4d25d9855608199dceee93d406bb99bb564a709c211c6f5787a794860a27651d004b3d1164f757cc401eaa124bfeeb27440eb48f530805471435f0a43510ae30eafab56b95f8a398b834d54e1ace4c6cf6f8152872e7fe6c2011142827f0590cea60a6a4972fff39fb200ec35614a4bffd1306cb745cf17705416752c9eba4be7eb4c4875035f11accad1e0c1a7313841693bdbe9aa5779cbee36d001596cb787c04eb7e5e3bb5c6751843b553fe98a4539452c69276c2a89424cff5814b1f3d5c60b57016d301dac724885e32bdf3b028f2320c5857768a0efc319b4ee9ee0e1ebe7d80bbafc7a7c0cc1f3bf04feb195aebef9e21b97389c5c14c12c2881b1c6dfe5b6f328b9231fca9f015a275f0ee6bcdd42488a12a831d625372e9e97ba2ff0b2b3cbd49ebceb67ce2f1b9924cc367b41fa3a5da97603ee055bdb5a8771d9a8e03b80d5b53a42e625d910878069764191abff079f50445f0c00f88b352e4716efd1060c491c5c72f91af8269cdaeae63ecdfc5ad111c447bb6f6b1ee78b8c62a55cc664e2e43112bd80cc7a68ee863485f55c95dbb615a5a207a3fa9da9820760d31c04a8fbf98966622da986aac18699d93cae16df8ba0408b06febdc2e60fe06086937ffdf6b090b0a983ea80a45749f4bb36d49b7bd41ec7030e205ed2e9ab83e2c53c36b338e77808e020f1f0fb62935bf9318094ddb9322d3bd317fc19bcf628f5b4d5ae826a44baaf0b5f443f8bf158e2dbd9752ab73e24e75b462b6ef656b3b7ce1650d75f423f36df729c9e533ccbdb806fd46fc5a1e99ba2a122f2d82562ddcb60f190ebb03152c782bbc4f6b803f28943cee4e5aaaf7e2d753bc3d9f70c70917c3f3d8c4c6ca226ea92ee10b1e2ccf1c196c5bb59bd6e787cefaeb7551d71d79523aef8d02f49c15bdc67abaa8d56b95437802cf0e1d76d778e319b4f54e6cf573952fa93b498c16d191359f7f18bfb6afd1adbf8d1233a4540cbe0d34c3ca1b6818c8c75ec513aada4267ca7b645baf0520d35bd4f63cfc27be0afbef80a5871665dc4d06e443671b81eb5953e3a3ef824ea08f8d175a7b8c24fb35877075598d229091e7206b618414146162d85203e27fb81c2596c92e1254f968d5e9900885bbdb0aa59f4125dd54e9fbbdc2b206ef623e11430de17c16e84665ee7b845fc7ca66374b6d85d485fe1fcca30fa0657bd166217d8c3049e52918be9d0cd15a91e6df64fc1fe7d0422191612812f28c3426474aadaf46c56eb45a1dc868179ed2954f4d6f2e22aaef821a8e1a2c6e7db83390ac43ab6bbab04cc932c8042910c4a5d693d786230d3b92fdd8a46f44713b63563f31ee9c7087408e45ff44aa847ddf635c42f7dfe253b7f99dd3e2d4e660e4cebf794d3ecb7104973330c9939ec030f9df237b8424606f1e60c54d3b06e27186568cb0bfdc87928e1d199d72638819b5c26925810693f5c18fff69dd6d14922a4100d2fd9ac2821b1ccb9ad8326eeb8bc3b4633fd37487f3441c433247c6c6a74c3a88a52f53770d272710851d397ed9bfa0461d008ccc117c2581948dada25d880b08", 0x1000}}, 0x1006) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)={0x68, r10, 0x1, 0x270bd25, 0x25dfdbff, {{}, {0x0, 0x4107}, {0x4c, 0x18, {0x401, @link='broadcast-link\x00'}}}}, 0x68}, 0x1, 0x0, 0x0, 0x4090}, 0x20000000) r11 = socket$alg(0x26, 0x5, 0x0) bind$alg(r11, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r11, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100004b028e000000000000000004850000007b00000095"], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r12}, 0x10) r13 = accept4(r11, 0x0, 0x0, 0x80000) sendmmsg$alg(r13, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x4924924924924b9, 0x0) recvmsg(r13, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x20000253) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x17, 0x4, &(0x7f0000001280)=ANY=[@ANYBLOB="b4000000000000006911060000000000160000000000000095007400000000009c529b9459565a29d0e5f1be09e6cf667dea4d9e98f350d3adc78fa9a278e9c8f59c60f7a522ef89e5d713e9ab5ff688e06c1560a911f6c85863a6f32b980d7834c383020d35d0e17b308f2090528397e124f255fe31a1c94d51e6c78c23bd9b3325e2b360af2406112f9a91ed8dea0f8bf0dd3d17f75577a330"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001380)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="050000000000000000004400000008000300670313e8bd1ef7c32c351eecb4470a76da180284384f271a9976cb2ac9b87b0cf933e0d4a93e68f2376707d947fbebafab338d6c11020000000000000011f18c6dac2899cf24984cc47b7ab1632afd0032d80e544a7201748a16d302c7c6a4eb9636f24bf9d8d9887a207c932de77342e5ef62e6f3bda83a2b264e1a84c6f01b530851fe19c6ab8e18deda658b", @ANYRES32=r14, @ANYBLOB="0000a1002c000000000022017302000010007000d6fd050005000800ec0000000a0018000303030303030000"], 0x44}}, 0x40010) write(r6, &(0x7f0000001240)="cc37e8f2f3778e07017c08c678afe52ae5932fd354", 0x15) 2.835365895s ago: executing program 4 (id=4159): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x4) (async) r1 = socket$unix(0x1, 0x1, 0x0) (async) r2 = landlock_create_ruleset(&(0x7f0000000140)={0x895}, 0x10, 0x0) landlock_restrict_self(r2, 0x0) (async) connect$unix(r1, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) r3 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback, 0x580d5476}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0xfffffeffffff7f7e, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) (async) sendmsg$inet(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000480)="98dae96f7c0a60076862304bbbe8", 0xe}], 0x1}, 0x8001) r4 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000340)=ANY=[@ANYBLOB="da376f9f02000057ffcb346d473b60003d000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async, rerun: 64) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 64) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000100), 0x4) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r4, &(0x7f0000000100), &(0x7f0000000240)=@tcp6=r5}, 0x20) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r6, 0xc0285629, &(0x7f0000000080)={0x3, @win={{0x2}, 0x7, 0x0, &(0x7f0000000040), 0x0, 0x0}}) (async, rerun: 32) sendto(r3, &(0x7f0000000640)="a8", 0x1, 0x20000800, 0x0, 0x0) (rerun: 32) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000440)={&(0x7f0000c24000/0xc000)=nil, 0xc000, 0x0, 0x0, 0x0, &(0x7f0000005380)=""/231, 0xe7, 0x0, 0x0}, &(0x7f00000064c0)=0x6d) (async, rerun: 32) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$NFULNL_MSG_CONFIG(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x2000004) (async) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xb8}}, 0x10) (async) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f00000002c0)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x4}}, 0x10) (async) ioctl$BTRFS_IOC_SET_FEATURES(0xffffffffffffffff, 0x40309439, &(0x7f0000000300)={0x1, 0x1, 0xa}) getsockopt$IP_VS_SO_GET_TIMEOUT(r7, 0x0, 0x486, &(0x7f0000000180), &(0x7f00000001c0)=0xc) r8 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="540000001200010000fdffffff000400004e224e23000000000580000000000000005a0ea6c7338d28fb971833a400040100000000000000", @ANYRES32=0x0, @ANYBLOB="070000000000000080fffff0000000000800030011"], 0x54}, 0x1, 0x0, 0x0, 0x240408c9}, 0x8010) memfd_secret(0x0) 2.695853247s ago: executing program 4 (id=4160): mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}], [], 0x2c}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000004c0)={'batadv_slave_1\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000ec0)=@raw={'raw\x00', 0x3c1, 0x3, 0x428, 0x248, 0x5c, 0x160, 0x0, 0x3e0, 0x358, 0x228, 0x25a, 0x358, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @remote, [], [], 'veth0_to_batadv\x00', 'batadv_slave_0\x00'}, 0x5002, 0x208, 0x248, 0x52020000, {0x0, 0x6802000000000000}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x10, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @local, @private1, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @empty, @mcast1, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, @empty, @rand_addr=' \x01\x00']}}]}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@ipv6={@dev, @empty, [], [], 'bridge_slave_0\x00', 'dummy0\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x488) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x17, 0x3, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @cgroup_sysctl=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket(0x1e, 0x1, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000600)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000600000000000000"], 0x48) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NODES(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)={0x1c, r7, 0x1, 0x0, 0x0, {{}, {0x0, 0x6}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000980)='sys_exit\x00', r8}, 0x10) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000003c0)={{r4, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000380)='%pK \x00'}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r9, @ANYBLOB="0400"/20, @ANYRES32=r1, @ANYRES32=r4, @ANYBLOB="01000000010000000100000000000000000007000000000000000000"], 0x50) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r10 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r10, 0x4048ae9b, &(0x7f0000000300)={0x70001, 0x0, [0x0, 0x9, 0xfffffffffffffffd, 0x0, 0xfffffffffffffffc, 0x0, 0x29]}) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f0000000580)="66b9381001c066b800a0ffff66baffffffff0f3065260f0d210f23c80f21f866350c0080000f23f80f01fc0f20e06635000010000f22e00f20c06635000000400f1c9700000f01c566b9a001000066b80400000066ba000000000f30c0dbb6660f3adf932700de", 0x67}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) 2.325800774s ago: executing program 1 (id=4161): r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000000100000044000180060001000200000008000500000000000c00070000000000000000000800090000000000090006006e6f6e6500120000080008"], 0x58}}, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380), 0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x1187, 0x2, 0x7fff, 0xa0000000, 0x5, 0x1}) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r4, &(0x7f0000000000)={0x1f, @none}, 0x8) shutdown(r4, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_FLUSH(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB="c4000000", @ANYRES16=r2, @ANYBLOB="01000000000000000000020000002c000280060002004e2000000800090010000000060002004e210000080007000101000006000f000700000008000400ff7fffff1400028008000600020000000800090008000000080004000200000060000180080009005600000007000600666f00000c0007002000000002000000080008000100000008000b00736970000600010002000000080005"], 0xc4}}, 0x0) 2.210079412s ago: executing program 7 (id=4162): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) r1 = syz_io_uring_setup(0x239, &(0x7f0000000340)={0x0, 0x0, 0x10100}, &(0x7f00000002c0)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r1, 0x2def, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x6f}}, './file0\x00'}) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000002c0)={r5, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000000)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, &(0x7f0000000040)=[0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0], 0x0, 0x28, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x48, 0x10, &(0x7f00000001c0), &(0x7f0000000200), 0x8, 0xa, 0x8, 0x8, &(0x7f0000000240)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff000000fcdcc1be00000000007b8af0ff001b0000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ff7fffb702001e0800000018230000", @ANYRES64=r7, @ANYBLOB="0000000000000000b705000008000000850000"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r6, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b703000000000000850000007200000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000240)='kfree\x00', r8}, 0x18) pipe(&(0x7f0000000080)={0xffffffffffffffff}) read$FUSE(r9, &(0x7f00000081c0)={0x2020}, 0xfdef) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x2, 0x0, @void, @value, @void, @value}, 0x50) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)={0x1b, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r12 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000440)={0x1b, 0x0, 0x0, 0x2, 0x0, 0x1, 0xfffffffc, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) r14 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000004c0)=@o_path={&(0x7f0000000300)='./file0\x00', 0x0, 0x4000}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x10, 0x5, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ff}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x7ff}]}, &(0x7f0000000080)='GPL\x00', 0x80, 0x13, &(0x7f00000000c0)=""/19, 0x41100, 0x25, '\x00', 0x0, @sk_msg=0x7, r4, 0x8, &(0x7f0000000140)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000180)={0x5, 0x8, 0x8, 0x7}, 0x10, r7, r8, 0x2, &(0x7f0000000500)=[r9, r10, r11, r12, r13, r14], &(0x7f0000000540)=[{0x3, 0x2, 0x1, 0x5}, {0x4, 0x4, 0x5, 0xb}], 0x10, 0x7f, @void, @value}, 0x94) 2.152153549s ago: executing program 6 (id=4163): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001280), 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000180)={{0x0, 0x0, 0x4}, 'syz1\x00', 0x26}) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000180)={0x28, 0x0, 0x0, @local}, 0x10) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) preadv(r2, &(0x7f0000002480)=[{&(0x7f0000000280)=""/4096, 0x1000}], 0x1, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) timer_create(0x2, &(0x7f0000000580)={0x0, 0x10, 0x5, @tid=r3}, &(0x7f00000005c0)) sched_setscheduler(r3, 0x6, &(0x7f0000000000)=0x80000000) 1.963734977s ago: executing program 6 (id=4164): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000f9ffffff0000000000000000850000002c00000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe0d, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$inet6_sctp(0xa, 0x5, 0x84) userfaultfd(0x80001) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x40, &(0x7f0000000600), 0x0, &(0x7f0000000680)={0xff, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffe}, &(0x7f0000000040)={0x0, 0x3938700}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'netdevsim0\x00', 0x0}) r4 = syz_open_procfs(0x0, &(0x7f0000000200)='wchan\x00') read$FUSE(r4, &(0x7f00000031c0)={0x2020}, 0x2020) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r2, r3, 0x25, 0x15, @val=@iter={&(0x7f0000000280)=@cgroup={0x3, r4}, 0x10}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040), 0x13f, 0x5}}, 0x20) r5 = syz_open_dev$audion(&(0x7f0000000240), 0x3, 0x383140) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2a, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r5, 0x54a0) close_range(r0, 0xffffffffffffffff, 0x0) 1.881931901s ago: executing program 1 (id=4165): r0 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) (async) r1 = socket(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'macvlan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', r2, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5ac, 0x244, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2, 0x0, {0x9}}}]}}]}}, 0x0) (async) r3 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) r4 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x400) getsockname$packet(r4, &(0x7f0000000940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000001000370400000000ffdbdf2500000000", @ANYRES32=r5, @ANYBLOB="c945050000000000200012800900010069706970"], 0x40}, 0x1, 0x0, 0x0, 0x20008011}, 0x40080) 1.675973729s ago: executing program 6 (id=4166): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x3, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) syz_open_dev$I2C(&(0x7f0000000ac0), 0x1, 0x0) r2 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000240)={0x1, @pix_mp={0x0, 0x0, 0x59455247, 0x0, 0x3, [{}, {}, {}, {0xd}, {0x7f}]}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000480)=@ethtool_link_settings={0x2, 0x0, 0x8, 0x0, 0x0, 0x7f, 0x10, 0x0, 0x0, 0x0, [0x2, 0x5, 0x11]}}) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) write$dsp(r2, &(0x7f0000002000)='`', 0x88020) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000000000)={0x3}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r7, 0xaf02, 0x0) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000040)={[{0x10, 0x3, 0x4, 0xc, 0x7, 0xfa, 0xfe, 0x3, 0xfe, 0x5, 0x10, 0xf8, 0x5}, {0x6, 0x9, 0x3, 0xd, 0xb1, 0x5, 0x8, 0xc, 0xfe, 0x40, 0x6, 0x18, 0x7}, {0xa20000, 0x0, 0x3, 0x7, 0x2, 0xf7, 0x1, 0x9, 0x2, 0x5, 0x8, 0x54, 0x18bb}], 0xd9}) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000b40)="f30f09ba6100b8c400ef66b9eb0a00000f3266b9830000c066b84700000066ba000000000f30f2a60fc75add650fdabc755ac09af67f0066b98004000066b8532ebe1866ba0bffd3710f3066b9830500000f32", 0x53}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.211254372s ago: executing program 7 (id=4167): creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53048c5) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000140)=ANY=[@ANYRESOCT=r0], 0x15) r1 = dup(r0) write$FUSE_BMAP(r1, &(0x7f0000000100)={0x18}, 0x18) mremap(&(0x7f0000241000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000977000/0x1000)=nil) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305\x00'}, 0x58) accept4(r2, 0x0, 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x4000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000002c0)="f5", 0x30, 0xfffffffffffffffe) r8 = add_key$user(&(0x7f0000000280), &(0x7f0000000440), &(0x7f0000000340)="94c14146f79c29fb4016c9d17e8040b8940ebf9c2db88dbad8af3b5516979a57e80b5f5e73001f8713f6b1c051cb6d08d2d082ac6c01b7e858f2b274a79a870bfa354e6b301c26b9d484ee1c9e28c336d013be7aa5d3edc593293845a375dff3401004440c50360a68b8a16c1f3cfacd9c9b0ee79d30cde69f397089ca03919d41aa483f8891b1c5c038c530f6caf30b1f3c15d4f7c0f7964230aa7199d63b0237f18e5ca8d130516c031f4afacc6576ddacc3ec81898561154adce958145d74", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r7, r8, r7}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r9, 0xffffffff80000801, 0x0, &(0x7f00000000c0)={0x0, 0x5b81, 0x0, 0x0, 0x9, 0x9, 0x0, 0x0, 0xde}) fsopen(&(0x7f0000000000)='sysfs\x00', 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) 1.061316812s ago: executing program 4 (id=4168): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_INFO(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xb0, r1, 0x20, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x6}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xe}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4919}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x800}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x4}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x200}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6c}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}]}, 0xb0}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_EDITDEST(r2, 0x0, 0x489, &(0x7f00000001c0)={{0x84, @loopback, 0x4e21, 0x3, 'lblcr\x00', 0x21, 0x1000, 0x16}, {@broadcast, 0x4e21, 0x0, 0x1, 0x9, 0x8}}, 0x44) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x40, r3, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x8}, @L2TP_ATTR_LNS_MODE={0x5}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x10}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x20048804) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000380)={0x0, 'gre0\x00', 0x1}, 0x18) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000400)=@filter={'filter\x00', 0xe, 0x4, 0x310, 0xffffffff, 0x180, 0x180, 0x180, 0xffffffff, 0xffffffff, 0x278, 0x278, 0x278, 0xffffffff, 0x4, &(0x7f00000003c0), {[{{@ip={@dev={0xac, 0x14, 0x14, 0x17}, @private=0xa010100, 0xff, 0x0, 'team_slave_1\x00', 'vlan0\x00', {0xff}, {}, 0x89, 0x2}, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x7, 0x1, {0x400}}}}, {{@ip={@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0xff, 'sit0\x00', 'vlan1\x00', {}, {0xff}, 0x88, 0x1, 0x50}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @broadcast, 0x3, 0x8, [0x8, 0xf, 0x0, 0x23, 0x23, 0x15, 0x4, 0x1a, 0x16, 0x2c, 0x21, 0xa, 0x29, 0xb, 0xe, 0x3a], 0x5acdb0a17811001c, 0x9, 0x8}}}, {{@uncond, 0x0, 0xc0, 0xf8, 0x0, {}, [@common=@inet=@tos={{0x28}, {0x9, 0x9a, 0x1}}, @common=@inet=@tos={{0x28}, {0x5, 0x7}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x2, 0x1, 0x6}, {0xffffffffffffffff, 0x0, 0x7}, {0x4, 0x2}, 0xc38, 0x4}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x370) r4 = add_key$fscrypt_v1(&(0x7f0000000780), &(0x7f00000007c0)={'fscrypt:', @desc3}, &(0x7f0000000800)={0x0, "eae3d8b17c26a9eeeaaf23a0e86799d24f54a6a3f9569b8bb96de94481168e1fc56981dd3abf86c5bf2a6029bffd296acdbb6d1d2c6f3cd08f2f88b93ed6acef", 0x13}, 0x48, 0xfffffffffffffff9) r5 = add_key$keyring(&(0x7f0000000880), &(0x7f00000008c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r4, 0xfffffffffffffffb, 0x7ff, r5) madvise(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x10) r6 = fanotify_init(0x1, 0x400) r7 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000900)='./file0\x00', &(0x7f0000000940)={0x8000, 0x2, 0x10}, 0x18) fanotify_mark(r6, 0x0, 0x0, r7, &(0x7f0000000980)='./file0\x00') r8 = socket(0x5, 0x800, 0x36a) mount(&(0x7f00000009c0)=@nullb, &(0x7f0000000a00)='./file1\x00', &(0x7f0000000a40)='xfs\x00', 0x2040042, &(0x7f0000000a80)='lblcr\x00') keyctl$link(0x8, r4, r4) keyctl$get_keyring_id(0x0, r5, 0x6) r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000ac0)='/sys/kernel/uevent_seqnum', 0x200000, 0x110) read$msr(r9, &(0x7f0000000b00)=""/254, 0xfe) syz_open_dev$dri(&(0x7f0000000c00), 0x7, 0x583280) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000c40)={r5, 0x62, 0xa6}, 0x0, &(0x7f0000000c80)="d3c41e283884bb97d1cea80fddf77604cb0ff5d26684a17b068cd2eeb2649381a5b8dda97c19c9ffe83e391ccdf8ebf63f740db2c343128fb4a163ab3ec3cec5821611cba1f6f4d12619eba8a3838738d8eeda6dd728d766b29a74f95a635f4efdbc", &(0x7f0000000d00)=""/166) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r9, 0x54) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r9, 0xc0189375, &(0x7f0000000dc0)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) fcntl$dupfd(r10, 0x406, r7) keyctl$negate(0xd, r4, 0x0, r4) syz_open_procfs(0x0, &(0x7f0000000e40)='gid_map\x00') 271.96709ms ago: executing program 7 (id=4169): mkdir(0x0, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x8, 0x3000000000002, 0x0, 0x885}, 0x24000090) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x0) bind$unix(r1, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e22}, 0x6e) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) memfd_create(0x0, 0x2) r2 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000013c0)={r2, &(0x7f0000000380)="2b4dad82e2c8f1ef7c7d816860df96460539a2ee5cad53114d482d120d2e4b8fdc7add591010663e2785d7ff87e7e0b92dfb0acdb99c2adc269816683bd3f0162a63e5866e7954fe885031a78b6d5cb105e5c3c0e082a6d72546dc77fa96499d9cf59725e33a10d2d527cf412a78eb95015fb0da265753be983f8e92628d03164dc3be66f33e55b1064f62b8354952f9f806a5195bdd488104cdb551e06a4c7e04eb505ed86a21d790fd878898d5bacae3aff85da8271ebf6861f2441bc4227926e77b456ea613134cfee18a99cb455d4f84a2e04470d00a74bee419616914eb19acd3a9ef1fc4fb6e97739370f134467ec43fc262302f0d67d4698d92bda1783148a8ab417ff2b6c95b23e2aaccdad5c98e4d7531d32d3d1355b33df663afec1494db34507f5fb19a030a568cfe0af8d51c948548b5afa3ed15224e285b4254a45f7bfb2ac10b7a8248ae68565f3b5757ed55375fe5491318766e63095e1f791958d65d0982e29fb6a4b54b3858ae2de86019dfbd7eb07b5f75f1479d3a444d1b429dd67d2c9917027cc3414364f095044f2fc52955c7e7c66d260c681b46ed75bc6db2c556472d10e89d0e99e4ef0cbc0a23daa5d3add518e0b697a2146e3ee9c1a82e1dee82312591ce995fe77be263c2430856e028fbd5080df58638d527fa862254d674f83f4f7c3c74e952ad4dfe07efcdf8cb13bff4f7a09aeb01edebbbbd49b71d16610dd9407571b85852baf3ac5d1b51894a52816b161f59842f3d66792e0573724c5ad8f3edde53a898d1cf87317f7404e0bef59a5f8e3fb32475de9b9bbfd6e5f6c4f35c2507993ee18c30e374c768d72e71003e66e9e4193f66a5056f37ff50d4c59199dece43a0a525b3bc46330a5c9330e7e4b7c27a83e78aa8c6ba29f023bdd8003775792e7df4714925105672a809bfb018e5fe14347b1af9e9d69d3f7e545037f714b27ac5cd4bd2387c4d356b2e6c73ed6098a5e2828b02532f0615b5a583fce721e10f8ea96f9d999cce8670ad1b70b323302663fec8a621283746ac922e4b38c1423ed931cd2d9f9f7e321ff6fd0c05cd1ddf36d1b1384f66c83719a2a4bc7c7f396fa5cbd09ab41bf1df3bd6c96fcb849036dad178a26ef2cbc2659d975062f6b0eb9fe17fc108597376447dc118bd0c4f486893b17ea230219e38004f56682ed08073f9a3391d5efdf006f25d995de9b7c53bb712d5d98fb5465a8df7cc242010b5beee09f5f37aa10a2d8ee81a45d7d431f28db9ba8ff097b26a0e2e33f13a44c1857cbca63d4c02df9fc7aaee23859ed471d298d1c4213a187e228b085e813b5e508bd2074e21358288916cc6a55b1e119a3ee6a3a99686cf170be411293898f053106aec1b32ed85c63105f9ee2ebf1b54dbc5b23a6f1afb1f88af9733f5679417f90218d5e7528d0e93589c7244295e85c6a68a9b5264d4794c06e6aa146602ce428dbc5c290b9be5efba847313224ddde4b59242e238e0626dfb5b3d64e478b1bd353ae67649abea6172a05e587de8c0c6dc05e45d30e86e83cc3d5531f6a2f5b591b96e6f28ecb2f8f446f70219d16d5fb56183d57b145113cc9d0ecfa11017f6aabf32f5e03f91ad0f63e3447a94e5fc558224f8ee13578867db08232b7dcac45c41eb0e659c932903c8938079f7e6fb5a5842fd22e7d564bb06132b1fdcb6fd027c458c891146f023c96e4765549eb731d777862186574e2306a4749ebeb6bff2a3eadca1e36247f2c8c8ecb31cd8ddb931a6452211429e323c6e675d3d0fc525ebc291e2c204df38c87c320a9b0f31f2ebee7326d0e15ecb4fb124beef2bd198df07e888d002e6c0f44642b949845a44e1ec633fc14169eca2a65422b0f74d814e2e1168a98d7dddae7e6d8b47767a6357621ebdf53e18acaa61a09756198ef47ca5628f4fde6c90d20a73112c74a7eee11f36a7428e56b470c63072bf9d3ef9697c75b5b7ea1b8297229e057ce18f9818b2feb745dc28fe725a932f197664be5ddc976f329118a125e7586b93107b43ff720dad9d9ce27f6bf76300edf0893478b640ed28da32fd19f0cbf15a94c9d3dc0bfad2e49f3ebd47e97efd2343a7ad245218914f153f6968dd79a6914c707a8193828e0cf1917ae4020cad38989484f67da925c2d9ed8d55c20c3cce0fa896ea0cfda961e590e79649b8905b27e239400d24f6af624d2571abcf35582e127441768db79fdbe6f7e92cdf320c59ef466013d9e805f24662dbd16570768cbcffbcbe490c88313c1511a4e502a2407892393eb5abcb8996b51eef8bfe1c1cc0188fcf0a37089be5523be67176df6f01634a0b2ad28d3249da2883e97e50a352d03c4cb4561724e576bffc0717b73917c97f8ffba9a1a64ec85ccad77cefe05269a2ba0c7fdeb65e56f757ddfa6149a234b26e9af95f959129766e11346e4ca5eab84d31543f3ca6d00be891db08513e8806d1ec396391aea1a08c6313e21f992ad11d412ce9d87c1b728b08f67056a8b16690f81e2235f4590d647c049433f2ecc6f49f90fa2694f4a081e1e9f2cc1224db76950ef051085956deae0d2e1258bab0c72fab4efd8553c9e64a8eec1820b55f1e17711ae6ceafc0d5dffb0bea1220eda636eb2ba42483d1422ea37f3cb1a7c24da10b116869049243af8111d4326480ad65858c2a54e66642ad7a2aedb5a01f7857da39ef5bd9997d9fbafa39b4e34fad4aeb13f61eeb817ca699759e25a1ff4eb55ee3950194f52d884e8e319d6e2c9d4df0e7ba53f92afd612d957ed5cf0e05495c5d4a4730606a680a6e09378354e916dd88b54a02efa7e1d0d1ac460f662e03e83e5abe3ef2aaee0ebd98e9573a048831158c9020fc34bb7d8946ddf706698c74be0279a102caf79c07ec9aa823733d96bb04b5605070656af41d686ba206e1c86b2d24ade46c723c7dbba0ee30d64879ae2e0f5043d5dcd151d6c07c0cc9597ec08e66ee31438cdbdb5c92a149e1ac2363ab61b3b1cd831893a06f099d96cbf8c419317a45dd7ffdb228d39cb4bff702f1a150004e4ad40aa8f40d7372a5a314e8da4fc591367806a83c62f716ad2ff6b620e7450578b0ac13ea8015f629964fde5959f9bde7ec1d26329de15f485a3e8f20aa1339db2f2a8f07c4d6ade14819797e6f71e8b5fc7e4a5697649e183c52f8429c8216d1e1477a706d828e7ebba30fd1907286d8253174247d835b1b841a0c24d17e3bf9c2a647d56269e736ae29d86454edebd3b0ab5edcb080b113e86a2b1c5871f8e0c459e6a9204d16be6c9d2c4c2d2bce61a5d3b69a0820b9d45b200512fd2f9676487b8dbb44a7bf1c0fac0b5dd0afdca7e8bef1ea0092994df642563ca9d8793a3afd32840df9324200ce5957056f182ed2174b868c35fe3d27c51f580dd2fb27c771cac44caf1249cee754fafaa6dffc58031d01aebd3ba150f2126d2e19abdbc5641ec9f2c2152d1f4add85cfa81ae573bb96260a6dbb2d14c2f403dc2a3ceb8a6c59d8d95f2e00546ba6f9253c56e85c41fec26b45841267d543ce64d5b4962f276cfff7b7dcf5f37642541c36ffb68cdb812e53bd2fd86ace9a2ebd11ef2c729bcf9ac57cd1117967af0eb9c6acc34850d8e5438f06342796e42c5e7fea4d01462933acbf85fb6f46b4724db9dc60eb33621e2c75362d9bf553764e1dd2b032777ffda96f4ebcbc997bc351f0da8584051477127fac484e25389c7dcce498257205cfe106fb26c2b444d0deaca271d641e9cd2c316c6fd8bbd30eb856e07d98c635b3f22f3cdf0692f34306f13e6e63442c6ab37c855bc37c16634a3e7cbbcea9d9dd7dba8794201080785b5f5c38b7a0c0b16b3ba3c25182f63e3881769efd075b0530a8048626d9db257d2208bbe93c942c748e1f2602460cf6f973872bf205350c36deea27264faf9294f60c2c9cd863cef60d640cecaa97299922aeb063a0c501434ae6c6284828f3287af8db4998cd6d7b24c52c4f09885a21f2a1dbeed8579cbbf0704f4da115539d4634e7cb4b9dc0974ad8c24e688951f4648bbda865a4cfa0bbf3f1d1abc6e3e9d5f5f8e2a79bfd80058ad3d7c9be4c428cea9c2bccda76e1fab55a7127898d8969a09543834fb64f931ae490edd19d41d78d67cabceb0a1a43efd90d0507003a87b885514f613dd4ab0497000ba5f1739d6887eaf100711172999507cfd9e71327e5657abf93d96f17087dd7774d2a51d5999735ea24ceaa9d7da391abdafcae50af48b5498ee83b2ee62b4c4632e8f87949d02db301e1db87d7ed0e5740079dd970df2e0f06e3ca71803a1939bddeab40d1d191baa155900c3b8357ca3067d1b407216cf9c6d06ffe78fb881c4b041e64668248a370a6cdaa251a98f602ae9778dafe1ded9ac3e13f03d824906f7a2951dd640e374b94777440cc3990bca587f41a17982993f78cd0945ebf6bd984f5d8016893b14160795216043b87d87712ee5033ec03b11e06e72edcf15653e80c74b6a1db6db6fb76d58f8a2a455f1e561e38789b2dda187f50708bce607c561e0c37ebfdd04d0aac2367c1317ccff6e14d23ec8cfe6913f0bdbae7ba406b57b3f7bf0bd87f8e75e06b3dcb321c482bd6f44770d91fb750ff160c565e64b992528ece480eebfd8018770eedbe3f8938da37e8ac155a1db45e61e39b6a24ba8b4519943e8807ed849e5106a04b9ab1183e08788972526b0c9134ce8d064d0969e847520529c7fff77873859ed46342c92727204fbfddcfe534ecd02860a5ecfc211fa3cd0352f9d1a1cc672a27d4230470367e793d720642a2dc812d76d0ba56c836a57db75e2bd7427396bca7e75f02ffedb44b01601fbd853f7e660dc3e1f96ab4ca3e0b44a06d0f77377c7e06a9f02e405c81ed792e4e464e98ddf2b4975482e1dbe0de3ffc7bd3734141369544652b1405199298cdcd0f37f63e8aefc81282ccea4eb967754a0da6182c0e44cdf5c0538d038e2736de08fa4fceb803b98a03645c112dc429d293eff01a5b6665f3190b131f986f28d12b1c0f0ff86330fdd642bed29e15cb2f27f7f6eb6b440bceb22b7e0efe1ce15d9ca7cfde1898c402eed8a0ae73972115a90ed85f38e04ab7b99890084fb7b03b265f9fd1e4064b3a4370f74d03c1bfab6c0cdade7fa0ac8ad592fed1dd0a36c34321068163e4b3cf4442081034dec8974ede60d9f7a7378b0acf5711777e2f9ad5ba6e1ed9f2ec7e666670fdee7107ec67aa59175c1072787245b2e72ca60782ad124f5c0cee80d3420ca56ab9380ea6c3861ad16eaf5a1f489cf9740a7137894b67d101ad101a393e2d7c98cbd4f94720263b32c56367db01d2ffd7526a867b323c830983612cd96977f568714423acb497857a13172110a83bdcf73e08dca922047abe7bd7bd830050f610f0e57ad5f593de408bc859124bf92f4bd10729bbece2dfb02bd69bbfc57236568e8d91c1c8da7201fa60c49bf7354879cd2ae8202cb66537c3f1729c4588e19ff34c37c9b3344c5d116e3f26722b1d0ca720751e0c4fa844033a2bf2a369d087d9cb8fd51549c2511b14fdf1d8bdcb7a629feb59cb1c6b6627001020d35cd580d97776a80e5b5843811bbc13a586b52fdbbe563cd938d2babc490c93981512b63a2577a84e153d773130f2f009c185e2ddbf7bb08344b491a228052255ee1ab1d335497afce12478e80c121927f3787df9ea927e879f8d48f5a75cd18fcb110b1bf3d895f269b801102c525b1ac5f8e2e29f9369fa4c75772eaa6ba3f2831cbb373b83b01c6445b054bf3de997056a89a9beb38a0dec", &(0x7f0000001380)=""/48}, 0x20) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x0, 0x2}, 0xe) socket$rxrpc(0x21, 0x2, 0xa) listen(r3, 0xa1) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xc}}, 0x14}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee00}}, './file0\x00'}) sendmsg$nl_xfrm(r5, 0x0, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) shutdown(r3, 0x1) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000000240), 0x4) read$FUSE(r6, &(0x7f0000001840)={0x2020}, 0x2020) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./file0\x00', &(0x7f0000000080)='msdos\x00', 0x1, 0x0) 137.286112ms ago: executing program 5 (id=4170): r0 = socket(0x2b, 0x3, 0x40000) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)={0x28, 0x5a, 0x1, 0x70bd28, 0x0, {}, [@typed={0x14, 0x5, 0x0, 0x0, @ipv6=@local}]}, 0x28}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$gtp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$GTP_CMD_ECHOREQ(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2c, r2, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000840}, 0x24008004) r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r3, 0x0, 0x0, 0x1001f0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000240)={'ip_vti0\x00', &(0x7f0000000100)={'syztnl1\x00', 0x0, 0x40, 0x80, 0x3ff, 0x2, {{0x3c, 0x4, 0x1, 0x35, 0xf0, 0x67, 0x0, 0x7, 0x29, 0x0, @remote, @loopback, {[@timestamp_addr={0x44, 0x24, 0x6e, 0x1, 0xd, [{@private=0xa010100, 0xdc}, {@loopback, 0x4}, {@rand_addr=0x64010101, 0x5c4f}, {@multicast2, 0x7ff}]}, @rr={0x7, 0x23, 0xa1, [@loopback, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @local, @rand_addr=0x64010102]}, @lsrr={0x83, 0x17, 0x70, [@private=0xa010102, @dev={0xac, 0x14, 0x14, 0x31}, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x18}, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp_addr={0x44, 0xc, 0xc, 0x1, 0x6, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x101}]}, @lsrr={0x83, 0xf, 0x6f, [@multicast2, @empty, @broadcast]}, @timestamp_addr={0x44, 0x14, 0x38, 0x1, 0x6, [{@local, 0xa3e93527}, {@private=0xa010102, 0x5}]}, @timestamp={0x44, 0xc, 0xb8, 0x0, 0xd, [0x1, 0x6]}, @rr={0x7, 0x1f, 0xb, [@empty, @private=0xa010100, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, @multicast1, @dev={0xac, 0x14, 0x14, 0x18}]}, @timestamp_prespec={0x44, 0x1c, 0xc5, 0x3, 0xa, [{@empty, 0x2}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@multicast2, 0x7ff}]}, @rr={0x7, 0x7, 0x31, [@remote]}]}}}}}) sendmsg$GTP_CMD_ECHOREQ(r0, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x5c, r2, 0x20, 0x70bd28, 0x25dfdbfc, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r3}, @GTPA_LINK={0x8, 0x1, r4}, @GTPA_MS_ADDR6={0x14, 0xc, @local}, @GTPA_I_TEI={0x8}, @GTPA_TID={0xc}]}, 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x1b, 0xf8, 0xfb, 0x40, 0x45e, 0x2bf, 0x7b41, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xcc, 0xed, 0x1b}}]}}]}}, 0x0) 0s ago: executing program 4 (id=4171): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) splice(r1, 0x0, r2, 0x0, 0x10000000000016, 0x0) open(&(0x7f0000000300)='./bus\x00', 0x14103e, 0x18a) syz_extract_tcp_res(&(0x7f0000000180)={0x41424344}, 0xdf27, 0x7bb) syz_extract_tcp_res(&(0x7f00000001c0)={0x41424344, 0x41424344}, 0x40, 0x5) syz_emit_ethernet(0x206, &(0x7f0000000800)={@broadcast, @broadcast, @val={@val={0x88a8, 0x4, 0x1, 0x4}, {0x8100, 0x5, 0x0, 0x4}}, {@ipv6={0x86dd, @tcp={0x6, 0x6, "077882", 0x1c8, 0x6, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', {[@srh={0x29, 0x10, 0x4, 0x8, 0x2, 0x50, 0x3, [@private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private1, @remote, @local, @rand_addr=' \x01\x00', @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, @fragment={0x5c, 0x0, 0x0, 0x1, 0x0, 0x5, 0x64}, @routing={0x2c, 0x8, 0x1, 0x4, 0x0, [@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @ipv4={'\x00', '\xff\xff', @multicast2}]}], {{0x4e24, 0x4e21, r3, r4, 0x1, 0x0, 0xb, 0x4, 0x4, 0x0, 0x5, {[@fastopen={0x22, 0xd, "868da39a1d3852ecfc71f6"}, @nop, @timestamp={0x8, 0xa, 0xe7, 0xffffff01}]}}, {"6dc8f151c27679e4d0982947f83438517b1884ffe2c8585887c874fc92539977e788d219e784b937e63de3dc5bfd25fe13b7ce997695a639449b9644082bb9e1d5c3bf0f0ba67324e0f156f6bd35e7e6ce894827e4d9a90b5e821fa9dd35b20408ef53dbb12b922951cf9219db78ce92f341cc90fcc807c15bd3dbc675ada93823b13e0e04d6995566b099daaadce73d8a80819504d39068e84c2be6a50a412c40088ef1d61c66b40c79fee8f1684be5027f560c753b1345f67e4809fca64ca19b8bf97f"}}}}}}}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x1}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r8, 0x84, 0x1f, &(0x7f00000000c0)={r9, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x8d, 0x401}, 0x90) r10 = syz_clone(0x800000, &(0x7f0000000280)="245b7a15fa90d8eb3ca76c519583aa16e9c9654824001eb9dc937db6fd36b775df6ed07238ff6f9b4704c7e4a26a45a68500de21db2df41c5b92bb2ed9f5be7ff7f4630986a2faafd58dcfde529fedd70440f1fb6f91845c5fac4d4c9d17462ae2fc622e0c8dd7854e40474854c7962d9c5f7ac30b7f11b494836cc9a1b4ae429a3336d696bb7e93f087149c4070bb933f7aa99a25f89713bd84fe53820ea066f58ed42ef279ab114a280fb27dc5915c4cbafd2bd2573872fa38650ce82527383ecb54ac0bc8ec6f357eb31c3c19b90ccd689d6d4cb1338d4f9f0b3eebbed277bffca17ca5f956f5f47bbd03c1b6f0b01b13212c0c9d95eac85ae0040078", 0xfe, &(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000480)="a65c2b1261145567a73134a1ed6e5712f4c532cf46fb5828d88868bba74c4817dfda1b28be9de5ee5205da75eb3688338e646eb23b9157f764bb0059373ce22c2e5819c5a69565da5a3f6e172cfef4d237c68eda9e2ddb3f4a6bd1d80a0b81c29ac34ffca1e2b5644eb5a20a8185fe15b32a244608b59936076dea257e07cb9f1cef3a2bef9ea86284279d48416f46a28466c3339f9d7dda67cb4d894aeaa8df447e89ae70be4dfdc3565fa82f6a4c2ae77723d80283e1935d750eb5bcbef1d165dbabd448390c44ecf9205675330b29b894d7cae71e0de2ed7e88b0c388bb5498c6e8f2d7f26a") mq_notify(r8, &(0x7f0000000580)={0x0, 0x23, 0x2, @tid=r10}) ioctl$RTC_IRQP_READ(r8, 0x8008700b, &(0x7f0000000240)) sendmsg$NL80211_CMD_DEL_MPATH(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c00a22653", @ANYRES16=r5, @ANYBLOB="010025bd7000fcdbdf251800000008000300", @ANYRES32=r7, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x20000040) kernel console output (not intermixed with test programs): eed USB device number 68 using dummy_hcd [ 1252.649190][T11522] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1252.665809][T11522] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1252.679890][T11522] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1252.704050][T11522] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1252.738926][ T5821] Bluetooth: hci2: command tx timeout [ 1252.750176][T11522] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1252.762769][T11522] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1252.785592][T11522] usb 6-1: config 0 descriptor?? [ 1253.435480][T11522] plantronics 0003:047F:FFFF.0026: ignoring exceeding usage max [ 1253.465070][T11522] plantronics 0003:047F:FFFF.0026: No inputs registered, leaving [ 1253.569158][T11522] plantronics 0003:047F:FFFF.0026: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 1254.078021][T19369] netlink: 252 bytes leftover after parsing attributes in process `syz.5.3556'. [ 1254.826121][ T5821] Bluetooth: hci2: command tx timeout [ 1254.939153][T10816] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1254.962445][T10816] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1254.991654][T10816] bond0 (unregistering): Released all slaves [ 1255.071090][T19362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1255.081886][T19362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1255.096134][T19362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1255.107165][T19362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1255.688505][T19362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1255.700503][ T5869] usb 6-1: USB disconnect, device number 68 [ 1255.710703][T19362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1255.722741][T19362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1255.734210][T19362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1255.744404][T19362] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1255.803707][T19362] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1255.876069][T19385] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1256.019504][T19385] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1256.040562][T19385] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1256.051342][T19385] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1256.061544][T19385] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1256.676293][T19385] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1256.757375][T19385] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1256.769941][T19385] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1256.783310][T19385] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1256.799126][T19385] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1256.907504][ T5821] Bluetooth: hci2: command tx timeout [ 1257.053514][T19407] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3569'. [ 1258.965354][T10816] batman_adv: batadv0: Removing interface: ipvlan2 [ 1258.982831][ T5821] Bluetooth: hci2: command tx timeout [ 1259.132371][T19338] chnl_net:caif_netlink_parms(): no params data found [ 1259.867302][T10816] hsr_slave_0: left promiscuous mode [ 1259.874595][T10816] hsr_slave_1: left promiscuous mode [ 1259.890520][T10816] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1260.493921][T10816] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1260.542204][T10816] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1260.646381][T10816] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1260.749901][T10816] veth1_macvtap: left promiscuous mode [ 1260.761417][T10816] veth0_macvtap: left promiscuous mode [ 1260.767519][T10816] veth1_vlan: left promiscuous mode [ 1260.775198][T10816] veth0_vlan: left promiscuous mode [ 1260.788665][T19443] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3575'. [ 1262.239870][T19450] syz.6.3577: attempt to access beyond end of device [ 1262.239870][T19450] nbd6: rw=0, sector=8, nr_sectors = 8 limit=0 [ 1262.277246][T19453] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3578'. [ 1262.288003][T19450] qnx4: unable to read the superblock [ 1262.288324][T19451] vcan0: tx drop: invalid da for name 0x0000000000000002 [ 1263.069801][T19450] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3577'. [ 1265.941508][T10816] team0 (unregistering): Port device team_slave_1 removed [ 1266.019562][T10816] team0 (unregistering): Port device team_slave_0 removed [ 1266.781832][T19480] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3586'. [ 1266.807482][T19480] IPv6: Can't replace route, no match found [ 1266.813474][T19481] .: renamed from bond0 (while UP) [ 1266.843712][T19338] bridge0: port 1(bridge_slave_0) entered blocking state [ 1266.922485][T19338] bridge0: port 1(bridge_slave_0) entered disabled state [ 1266.946343][T19338] bridge_slave_0: entered allmulticast mode [ 1266.967244][T19338] bridge_slave_0: entered promiscuous mode [ 1267.026835][T19488] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3589'. [ 1267.119331][T19338] bridge0: port 2(bridge_slave_1) entered blocking state [ 1267.928742][T19338] bridge0: port 2(bridge_slave_1) entered disabled state [ 1267.939778][T19338] bridge_slave_1: entered allmulticast mode [ 1267.961818][T19338] bridge_slave_1: entered promiscuous mode [ 1268.381848][T19338] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1268.433083][T19338] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1268.461202][T19501] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1268.471931][T19501] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1268.481918][T19501] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1268.493287][T19501] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1268.503404][T19501] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1268.528299][T19501] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1268.536084][T17350] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 1268.546204][T19501] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1268.606666][T19501] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1269.216829][T17350] usb 5-1: Using ep0 maxpacket: 32 [ 1269.233797][T17350] usb 5-1: config 0 has an invalid interface number: 146 but max is 0 [ 1269.262680][T17350] usb 5-1: config 0 has no interface number 0 [ 1269.270273][T17350] usb 5-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1269.281578][T17350] usb 5-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1269.303040][T17350] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1269.315123][T17350] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1269.327269][T17350] usb 5-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1269.347311][T19338] team0: Port device team_slave_0 added [ 1269.354183][T17350] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1269.384968][T17350] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1269.395800][T19338] team0: Port device team_slave_1 added [ 1269.446988][T17350] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 19968, setting to 1024 [ 1269.649151][T16187] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1269.767015][T17350] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1269.770532][T19338] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1269.846058][T17350] usb 5-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1269.870008][T19338] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1269.873487][T17350] usb 5-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1269.896276][ C0] vkms_vblank_simulate: vblank timer overrun [ 1269.925545][T17350] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1269.926020][T19338] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1269.933867][T17350] usb 5-1: Product: syz [ 1269.960414][T17350] usb 5-1: Manufacturer: syz [ 1269.965061][T17350] usb 5-1: SerialNumber: syz [ 1269.972230][T17350] usb 5-1: config 0 descriptor?? [ 1269.975495][T19338] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1269.987142][T16187] usb 2-1: Using ep0 maxpacket: 32 [ 1269.994236][T16187] usb 2-1: config 0 has an invalid interface number: 207 but max is 0 [ 1269.994687][T19499] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1270.003240][T16187] usb 2-1: config 0 has no interface number 0 [ 1270.016428][T19338] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1270.019801][T16187] usb 2-1: New USB device found, idVendor=0f3d, idProduct=68a3, bcdDevice=c3.e8 [ 1270.052608][T16187] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1270.061537][T19499] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1270.072243][T16187] usb 2-1: Product: syz [ 1270.081525][T16187] usb 2-1: Manufacturer: syz [ 1270.086150][T19338] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1270.101166][T10816] IPVS: stop unused estimator thread 0... [ 1270.108517][T17350] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 1270.126363][T17350] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 1270.146426][T16187] usb 2-1: SerialNumber: syz [ 1270.157318][T17350] scsi host1: microtekX6 [ 1270.164913][T16187] usb 2-1: config 0 descriptor?? [ 1270.198179][T16187] sierra 2-1:0.207: Sierra USB modem converter detected [ 1270.206934][T19338] hsr_slave_0: entered promiscuous mode [ 1270.223814][T19338] hsr_slave_1: entered promiscuous mode [ 1270.249146][T19338] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1270.257693][T19338] Cannot create hsr debugfs directory [ 1270.407585][T16187] usb 2-1: Sierra USB modem converter now attached to ttyUSB0 [ 1270.457048][T16187] usb 2-1: USB disconnect, device number 10 [ 1270.496443][T16187] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 1270.505512][T16187] sierra 2-1:0.207: device disconnected [ 1270.732444][T17350] usb 5-1: USB disconnect, device number 122 [ 1270.774472][T19338] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1271.496747][T19338] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1271.528805][T19338] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1271.584206][T19338] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1271.766695][ T5873] usb 6-1: new low-speed USB device number 69 using dummy_hcd [ 1271.774784][ T29] audit: type=1400 audit(2000001356.969:2315): avc: denied { read } for pid=19535 comm="syz.6.3602" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1271.810817][T19534] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3601'. [ 1271.816629][ T29] audit: type=1400 audit(2000001356.969:2316): avc: denied { open } for pid=19535 comm="syz.6.3602" path="/421/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1272.013948][T11522] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 1272.022254][ T5873] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1272.185745][T16187] usb 7-1: new full-speed USB device number 52 using dummy_hcd [ 1272.199141][T19338] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1272.206947][ T5873] usb 6-1: config 0 has no interface number 0 [ 1272.230734][ T5873] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1272.254650][T19338] 8021q: adding VLAN 0 to HW filter on device team0 [ 1272.261835][ T5873] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1272.276927][ T5873] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1272.289586][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 1272.296248][ T5873] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1272.296747][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1272.317302][ T5873] usb 6-1: config 0 descriptor?? [ 1272.322818][T19528] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1272.340737][T17526] bridge0: port 2(bridge_slave_1) entered blocking state [ 1272.345096][ T5873] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1272.347889][T17526] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1272.388789][T16187] usb 7-1: config 0 has an invalid interface number: 102 but max is 0 [ 1272.397376][T16187] usb 7-1: config 0 has no interface number 0 [ 1272.413955][T16187] usb 7-1: config 0 interface 102 altsetting 0 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 1272.434478][T19338] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1272.445579][T16187] usb 7-1: config 0 interface 102 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1272.457283][T19338] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1272.470069][T16187] usb 7-1: New USB device found, idVendor=3923, idProduct=7825, bcdDevice=c6.57 [ 1272.481504][T16187] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1272.527599][T11522] usb 2-1: Using ep0 maxpacket: 8 [ 1272.529526][T16187] usb 7-1: Product: syz [ 1272.556885][T11522] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 1272.559996][T16187] usb 7-1: Manufacturer: syz [ 1272.570136][T11522] usb 2-1: config 0 has no interface number 0 [ 1273.547677][T11522] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1273.557429][T11522] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1273.565592][T11522] usb 2-1: Product: syz [ 1273.570462][T11522] usb 2-1: Manufacturer: syz [ 1273.575146][T11522] usb 2-1: SerialNumber: syz [ 1273.576189][T16187] usb 7-1: SerialNumber: syz [ 1274.545720][T11522] usb 2-1: config 0 descriptor?? [ 1274.553801][T16187] usb 7-1: config 0 descriptor?? [ 1274.565764][T19536] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 1274.573557][T19536] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 1274.592090][T16187] plusb 7-1:0.102 usb0: register 'plusb' at usb-dummy_hcd.6-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, 9a:bd:d3:6c:bf:10 [ 1274.777966][T11522] usb 2-1: Found UVC 0.04 device syz (046d:08c3) [ 1274.846490][T11522] usb 2-1: No streaming interface found for terminal 6. [ 1274.911183][T11522] usb 2-1: USB disconnect, device number 11 [ 1275.081232][ T5907] usb 6-1: USB disconnect, device number 69 [ 1275.099258][T16187] usb 7-1: USB disconnect, device number 52 [ 1275.107956][T16187] plusb 7-1:0.102 usb0: unregister 'plusb' usb-dummy_hcd.6-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 1275.461840][T19338] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1276.236622][ T5869] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1276.446109][ T5869] usb 2-1: Using ep0 maxpacket: 8 [ 1276.464874][ T5869] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0038, bcdDevice=7d.78 [ 1276.492096][ T5869] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1276.521249][ T5869] usb 2-1: Product: syz [ 1276.535648][ T5869] usb 2-1: Manufacturer: syz [ 1276.557283][ T5869] usb 2-1: SerialNumber: syz [ 1276.562686][T19338] veth0_vlan: entered promiscuous mode [ 1276.578064][ T5869] usb 2-1: config 0 descriptor?? [ 1276.598670][ T5869] dvb-usb: found a 'TerraTec/qanu USB2.0 Highspeed DVB-T Receiver' in warm state. [ 1276.611144][T19338] veth1_vlan: entered promiscuous mode [ 1276.627991][ T5869] dvb-usb: bulk message failed: -22 (2/0) [ 1276.633754][ T5869] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1276.696473][T19338] veth0_macvtap: entered promiscuous mode [ 1276.702497][ T5869] dvbdev: DVB: registering new adapter (TerraTec/qanu USB2.0 Highspeed DVB-T Receiver) [ 1276.749203][T19338] veth1_macvtap: entered promiscuous mode [ 1276.755367][ T5869] usb 2-1: media controller created [ 1277.701434][ T5869] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1277.730945][ T29] audit: type=1400 audit(2000001362.929:2317): avc: denied { setopt } for pid=19594 comm="syz.4.3616" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1277.776730][ T5869] dvb-usb: bulk message failed: -22 (1/0) [ 1278.153954][ T5869] dvb-usb: no frontend was attached by 'TerraTec/qanu USB2.0 Highspeed DVB-T Receiver' [ 1278.216550][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1278.279875][ T5869] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input69 [ 1278.318047][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1278.340383][ T5869] dvb-usb: schedule remote query interval to 50 msecs. [ 1278.359007][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1278.496056][ T5869] dvb-usb: bulk message failed: -22 (2/0) [ 1278.515034][ T5869] dvb-usb: TerraTec/qanu USB2.0 Highspeed DVB-T Receiver successfully initialized and connected. [ 1278.531112][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1279.455013][T17350] dvb-usb: bulk message failed: -22 (1/0) [ 1279.460925][T17350] dvb-usb: error while querying for an remote control event. [ 1279.499720][ T5869] usb 2-1: USB disconnect, device number 12 [ 1279.572089][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1279.606160][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1279.636797][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1279.666253][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1279.686308][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1279.708022][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1279.728780][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1279.746098][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1279.778158][T19338] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1279.852058][ T5869] dvb-usb: TerraTec/qanu USB2.0 Highspeed DVB-T Re successfully deinitialized and disconnected. [ 1279.864877][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1279.889567][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1279.936244][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1279.976982][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1280.010977][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1280.350752][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1280.366242][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1280.392116][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1280.428762][T19338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1280.462316][T19338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1280.484299][T19338] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1280.537657][T19338] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1280.565331][T19338] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1280.610913][T19338] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1280.645408][T19338] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1280.867652][T19623] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=19623 comm=syz.6.3621 [ 1281.170578][T19633] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3626'. [ 1281.177318][T17526] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1281.236077][T17526] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1281.787513][ T5958] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1281.815718][ T5958] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1281.983931][T19643] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3630'. [ 1283.070544][T19654] usb usb7: usbfs: process 19654 (syz.5.3628) did not claim interface 0 before use [ 1283.101110][T19659] netlink: 48 bytes leftover after parsing attributes in process `syz.6.3632'. [ 1284.941415][T19679] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3635'. [ 1284.950398][T19679] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3635'. [ 1284.959878][T19679] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3635'. [ 1285.305402][ T29] audit: type=1400 audit(2000001370.479:2318): avc: denied { mount } for pid=19676 comm="syz.5.3637" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 1285.796311][ T5907] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 1285.976429][ T5907] usb 8-1: Using ep0 maxpacket: 8 [ 1285.988684][ T5907] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1286.009652][ T5907] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1286.024651][ T5907] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1286.046227][ T5907] usb 8-1: config 0 descriptor?? [ 1286.284567][ T5907] iowarrior 8-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 1286.708954][ T5907] usb 8-1: USB disconnect, device number 2 [ 1287.386523][T19687] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3639'. [ 1287.395396][T19687] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3639'. [ 1288.870656][ T29] audit: type=1400 audit(2000001374.069:2319): avc: denied { unmount } for pid=11402 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 1289.070257][T19696] netlink: 348 bytes leftover after parsing attributes in process `syz.4.3642'. [ 1289.321153][T19702] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3645'. [ 1289.336233][T17350] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1289.836303][T17350] usb 6-1: Using ep0 maxpacket: 32 [ 1290.115440][T17350] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1290.137587][T17350] usb 6-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1290.147097][T17350] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1290.160966][T17350] usb 6-1: Product: syz [ 1290.177440][T17350] usb 6-1: Manufacturer: syz [ 1290.184168][T17350] usb 6-1: SerialNumber: syz [ 1290.222198][T17350] usb 6-1: config 0 descriptor?? [ 1290.526438][ T116] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 1290.695999][ T116] usb 7-1: Using ep0 maxpacket: 32 [ 1290.705552][ T116] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 1290.715062][ T116] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1290.742862][ T116] usb 7-1: config 0 has an invalid descriptor of length 130, skipping remainder of the config [ 1290.795885][ T116] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1290.856072][ T116] usb 7-1: config 0 interface 0 altsetting 250 endpoint 0x1 has invalid maxpacket 2763, setting to 1024 [ 1290.895701][ T116] usb 7-1: config 0 interface 0 altsetting 250 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1290.933649][ T116] usb 7-1: config 0 interface 0 altsetting 250 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 1290.955979][ T116] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1290.962627][ T116] usb 7-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 1290.996058][ T116] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1291.016667][ T116] usb 7-1: config 0 descriptor?? [ 1291.026389][T19709] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1291.176331][ T5907] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1291.248800][T19709] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1291.316698][T19709] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1291.336360][ T5907] usb 2-1: Using ep0 maxpacket: 8 [ 1291.343312][ T5907] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 1291.347426][ T116] usb 7-1: USB disconnect, device number 53 [ 1291.352422][ T5907] usb 2-1: config 0 has no interface number 0 [ 1291.392566][ T5907] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1291.402482][ T5907] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1291.410958][ T5907] usb 2-1: Product: syz [ 1291.415367][ T5907] usb 2-1: Manufacturer: syz [ 1291.420579][ T5907] usb 2-1: SerialNumber: syz [ 1291.427927][ T5907] usb 2-1: config 0 descriptor?? [ 1291.441232][ T29] audit: type=1400 audit(2000001376.639:2320): avc: denied { getopt } for pid=19715 comm="syz.4.3650" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1291.698647][T17350] gs_usb 6-1:0.0: Couldn't get device config: (err=-110) [ 1291.731473][ T5907] usb 2-1: Found UVC 0.04 device syz (046d:08c3) [ 1291.818789][ T5907] usb 2-1: No streaming interface found for terminal 6. [ 1291.826079][T17350] gs_usb 6-1:0.0: probe with driver gs_usb failed with error -110 [ 1292.019563][ T5907] usb 2-1: USB disconnect, device number 13 [ 1292.098744][T17350] usb 6-1: USB disconnect, device number 70 [ 1292.996868][T19748] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3659'. [ 1293.033978][ T5907] IPVS: starting estimator thread 0... [ 1293.091910][T19754] program syz.6.3661 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1293.136785][T19753] IPVS: using max 25 ests per chain, 60000 per kthread [ 1293.397921][T19748] input: syz1 as /devices/virtual/input/input70 [ 1293.635050][T19757] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3659'. [ 1293.927765][ T29] audit: type=1400 audit(2000001379.119:2321): avc: denied { execute } for pid=19750 comm="syz.6.3661" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=71791 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 1295.306067][T17350] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 1295.425048][T19772] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1295.472339][T17350] usb 8-1: Using ep0 maxpacket: 16 [ 1295.500449][T17350] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 1295.529398][T17350] usb 8-1: config 0 has no interface number 0 [ 1295.572690][T17350] usb 8-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1295.615874][T17350] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1295.622366][T19166] Bluetooth: hci2: command 0x0405 tx timeout [ 1295.624288][T17350] usb 8-1: Product: syz [ 1295.702766][T19777] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 1296.232071][T17350] usb 8-1: Manufacturer: syz [ 1296.248411][T17350] usb 8-1: SerialNumber: syz [ 1296.344521][T17350] usb 8-1: config 0 descriptor?? [ 1296.416689][T19782] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3669'. [ 1296.496298][T19782] input: syz1 as /devices/virtual/input/input71 [ 1296.642792][T19789] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3669'. [ 1297.104448][T17350] usb 8-1: can't set config #0, error -71 [ 1297.130264][T17350] usb 8-1: USB disconnect, device number 3 [ 1297.277088][T19795] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3671'. [ 1301.996366][T19829] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3680'. [ 1302.005598][T19829] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3680'. [ 1302.746411][ T5876] usb 7-1: new high-speed USB device number 54 using dummy_hcd [ 1302.796409][ T116] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 1302.986162][ T116] usb 2-1: Using ep0 maxpacket: 16 [ 1303.007599][ T116] usb 2-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 1303.016933][ T5876] usb 7-1: Using ep0 maxpacket: 8 [ 1303.025528][T19841] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1303.047074][ T116] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1303.058163][ T5876] usb 7-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 1303.085752][ T116] usb 2-1: Product: syz [ 1303.090255][ T5876] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1303.099207][ T116] usb 2-1: Manufacturer: syz [ 1303.113201][ T5876] usb 7-1: Product: syz [ 1303.118312][ T116] usb 2-1: SerialNumber: syz [ 1303.127476][ T5876] usb 7-1: Manufacturer: syz [ 1303.133188][ T5876] usb 7-1: SerialNumber: syz [ 1303.141032][ T116] usb 2-1: config 0 descriptor?? [ 1303.149026][ T116] ums-onetouch 2-1:0.0: USB Mass Storage device detected [ 1303.162240][T19843] netlink: 196 bytes leftover after parsing attributes in process `syz.5.3686'. [ 1303.178966][ T5876] usb 7-1: config 0 descriptor?? [ 1303.498059][ T5876] gspca_main: sq930x-2.14.0 probing 2770:930c [ 1303.515564][T19834] nbd: must specify a device to reconfigure [ 1303.607828][ T5876] gspca_sq930x: reg_r 001f failed -32 [ 1303.613292][ T5876] sq930x 7-1:0.0: probe with driver sq930x failed with error -32 [ 1303.667870][ T116] usb 2-1: USB disconnect, device number 14 [ 1303.720844][T19856] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3688'. [ 1303.736624][ T5907] IPVS: starting estimator thread 0... [ 1303.752597][T19856] input: syz1 as /devices/virtual/input/input73 [ 1303.944347][T19859] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3688'. [ 1304.100951][T19857] IPVS: using max 27 ests per chain, 64800 per kthread [ 1305.506298][ T5907] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 1305.555994][ T116] usb 7-1: USB disconnect, device number 54 [ 1305.656142][ T5907] usb 2-1: device descriptor read/64, error -71 [ 1306.453629][ T5907] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 1306.746038][ T5907] usb 2-1: device descriptor read/64, error -71 [ 1306.902984][ T5907] usb usb2-port1: attempt power cycle [ 1307.305174][ T5876] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1307.336059][ T5907] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 1307.476115][ T5876] usb 6-1: Using ep0 maxpacket: 16 [ 1307.665493][ T5876] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1307.687540][ T5907] usb 2-1: device descriptor read/8, error -71 [ 1307.731689][ T5876] usb 6-1: config 1 has an invalid descriptor of length 34, skipping remainder of the config [ 1307.786262][ T5876] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1307.833009][ T5876] usb 6-1: New USB device found, idVendor=05ac, idProduct=0225, bcdDevice= 0.40 [ 1307.866295][ T5876] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1307.936075][ T5876] usb 6-1: Product: syz [ 1307.940287][ T5876] usb 6-1: Manufacturer: syz [ 1307.944887][ T5876] usb 6-1: SerialNumber: syz [ 1308.089608][ T5907] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 1308.126629][ T5907] usb 2-1: device descriptor read/8, error -71 [ 1308.236352][ T5907] usb usb2-port1: unable to enumerate USB device [ 1308.936258][ T5876] usb 6-1: USB disconnect, device number 71 [ 1309.277052][T19912] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3702'. [ 1309.327819][T19912] input: syz1 as /devices/virtual/input/input74 [ 1310.584658][T19920] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3702'. [ 1310.946583][T19925] overlayfs: failed to resolve './file1': -2 [ 1311.076355][ T5876] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 1311.188622][T19932] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61968 sclass=netlink_route_socket pid=19932 comm=syz.6.3707 [ 1311.202117][T19933] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61968 sclass=netlink_route_socket pid=19933 comm=syz.6.3707 [ 1311.296270][ T5876] usb 5-1: Using ep0 maxpacket: 16 [ 1311.312501][ T5876] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1311.340172][ T5876] usb 5-1: config 0 has no interface number 0 [ 1311.356297][ T5876] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1311.379528][ T5876] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1311.411998][ T5876] usb 5-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 1311.440668][ T5876] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1311.519110][ T5876] usb 5-1: config 0 descriptor?? [ 1312.227287][ T5821] Bluetooth: hci2: command 0x0405 tx timeout [ 1313.606106][ T5907] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 1313.898514][ T5907] usb 2-1: device descriptor read/64, error -71 [ 1313.992374][ T5876] usbhid 5-1:0.1: can't add hid device: -71 [ 1314.336553][ T5876] usbhid 5-1:0.1: probe with driver usbhid failed with error -71 [ 1314.346849][ T5876] usb 5-1: USB disconnect, device number 123 [ 1314.436346][ T5907] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 1315.136075][ T5907] usb 2-1: device descriptor read/64, error -71 [ 1315.297264][T19980] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3718'. [ 1315.325854][ T5907] usb usb2-port1: attempt power cycle [ 1315.996483][ T116] usb 6-1: new full-speed USB device number 72 using dummy_hcd [ 1316.757129][ T116] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 1316.953343][ T116] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10 [ 1317.199482][ T116] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 99, setting to 64 [ 1317.247941][ T116] usb 6-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 1317.267471][ T116] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1317.291269][ T116] usb 6-1: Product: syz [ 1317.303821][ T116] usb 6-1: Manufacturer: syz [ 1317.312478][ T116] usb 6-1: SerialNumber: syz [ 1317.319208][ T116] usb 6-1: config 0 descriptor?? [ 1317.325883][T19987] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1317.359190][ T116] input: KB Gear Tablet as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input75 [ 1317.448623][ T29] audit: type=1400 audit(2000001402.649:2322): avc: denied { map } for pid=20010 comm="syz.6.3727" path="socket:[72196]" dev="sockfs" ino=72196 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1317.899566][ T29] audit: type=1400 audit(2000001402.729:2323): avc: denied { mount } for pid=20010 comm="syz.6.3727" name="/" dev="rpc_pipefs" ino=72759 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 1317.993695][T19983] sp0: Synchronizing with TNC [ 1318.320432][T19839] usb 6-1: USB disconnect, device number 72 [ 1319.576267][ T5907] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 1319.737375][ T5907] usb 6-1: Using ep0 maxpacket: 8 [ 1319.890978][ T5907] usb 6-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 1320.002368][ T5907] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1320.077712][ T5907] usb 6-1: Product: syz [ 1320.093417][ T5907] usb 6-1: Manufacturer: syz [ 1320.107731][ T5907] usb 6-1: SerialNumber: syz [ 1320.125902][ T5907] usb 6-1: config 0 descriptor?? [ 1320.149253][ T5907] gspca_main: sq930x-2.14.0 probing 2770:930c [ 1320.956135][ T5907] gspca_sq930x: reg_w 0305 fd00 failed -71 [ 1320.964355][ T5907] sq930x 6-1:0.0: probe with driver sq930x failed with error -71 [ 1321.105178][ T5907] usb 6-1: USB disconnect, device number 73 [ 1321.339348][T20057] FAULT_INJECTION: forcing a failure. [ 1321.339348][T20057] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1321.354564][T20057] CPU: 0 UID: 0 PID: 20057 Comm: syz.7.3740 Not tainted 6.13.0-syzkaller #0 [ 1321.363280][T20057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 1321.373619][T20057] Call Trace: [ 1321.376904][T20057] [ 1321.379840][T20057] dump_stack_lvl+0x16c/0x1f0 [ 1321.384536][T20057] should_fail_ex+0x497/0x5b0 [ 1321.389263][T20057] _copy_from_user+0x2e/0xd0 [ 1321.393875][T20057] sg_write+0x776/0xe00 [ 1321.398059][T20057] ? __pfx_sg_write+0x10/0x10 [ 1321.402790][T20057] ? bpf_lsm_file_permission+0x9/0x10 [ 1321.408183][T20057] ? security_file_permission+0x71/0x210 [ 1321.413832][T20057] ? __pfx_sg_write+0x10/0x10 [ 1321.418511][T20057] vfs_writev+0x6da/0xdd0 [ 1321.422832][T20057] ? find_held_lock+0x2d/0x110 [ 1321.427599][T20057] ? __pfx_vfs_writev+0x10/0x10 [ 1321.432441][T20057] ? find_held_lock+0x2d/0x110 [ 1321.437211][T20057] ? __pfx_lock_release+0x10/0x10 [ 1321.442228][T20057] ? trace_lock_acquire+0x14e/0x1f0 [ 1321.447430][T20057] ? __fget_files+0x206/0x3a0 [ 1321.452111][T20057] ? do_writev+0x133/0x340 [ 1321.456517][T20057] do_writev+0x133/0x340 [ 1321.460755][T20057] ? __pfx_do_writev+0x10/0x10 [ 1321.465520][T20057] do_syscall_64+0xcd/0x250 [ 1321.470026][T20057] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1321.475922][T20057] RIP: 0033:0x7fcd7e585d29 [ 1321.480337][T20057] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1321.499935][T20057] RSP: 002b:00007fcd7f393038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1321.508342][T20057] RAX: ffffffffffffffda RBX: 00007fcd7e775fa0 RCX: 00007fcd7e585d29 [ 1321.516305][T20057] RDX: 0000000000000001 RSI: 0000000020000880 RDI: 0000000000000003 [ 1321.524265][T20057] RBP: 00007fcd7f393090 R08: 0000000000000000 R09: 0000000000000000 [ 1321.532227][T20057] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1321.540188][T20057] R13: 0000000000000000 R14: 00007fcd7e775fa0 R15: 00007ffee5ecfb68 [ 1321.548174][T20057] [ 1321.551342][ C0] vkms_vblank_simulate: vblank timer overrun [ 1321.762491][T20060] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3742'. [ 1321.866450][T20060] input: syz1 as /devices/virtual/input/input76 [ 1322.036255][T20063] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3742'. [ 1322.546545][T20073] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3746'. [ 1323.302390][T20087] netlink: 2384 bytes leftover after parsing attributes in process `syz.1.3748'. [ 1323.323775][T20087] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 1323.467868][T20089] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1323.508506][ T5821] Bluetooth: hci3: Malformed Event: 0x02 [ 1323.694684][T20090] netlink: 48 bytes leftover after parsing attributes in process `syz.6.3749'. [ 1324.096473][ T5821] Bluetooth: hci2: command 0x0405 tx timeout [ 1324.122464][ T29] audit: type=1400 audit(2000001409.319:2324): avc: denied { connect } for pid=20058 comm="syz.7.3741" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1325.329719][ T29] audit: type=1400 audit(2000001410.509:2325): avc: denied { append } for pid=20100 comm="syz.1.3753" name="usbmon7" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1325.353332][ C0] vkms_vblank_simulate: vblank timer overrun [ 1325.709556][T20110] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3756'. [ 1326.380983][T20114] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 1326.461841][T20114] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1327.442394][ T116] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 1327.626513][ T116] usb 8-1: Using ep0 maxpacket: 8 [ 1327.628146][T20132] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3760'. [ 1327.633493][ T116] usb 8-1: config 0 has an invalid interface number: 31 but max is 0 [ 1327.838083][T17350] usb 6-1: new full-speed USB device number 74 using dummy_hcd [ 1327.879293][ T116] usb 8-1: config 0 has no interface number 0 [ 1328.307541][T17350] usb 6-1: config 0 has an invalid interface number: 84 but max is 0 [ 1328.315670][T17350] usb 6-1: config 0 has no interface number 0 [ 1328.324703][T17350] usb 6-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=74.17 [ 1328.335501][ T116] usb 8-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1328.359237][ T116] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1328.386119][ T116] usb 8-1: Product: syz [ 1328.403325][ T116] usb 8-1: Manufacturer: syz [ 1328.409130][T17350] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1328.418246][ T116] usb 8-1: SerialNumber: syz [ 1328.437897][ T116] usb 8-1: config 0 descriptor?? [ 1328.453710][T17350] usb 6-1: config 0 descriptor?? [ 1328.469299][T17350] usb 6-1: no audio or video endpoints found [ 1328.660836][ T116] usb 8-1: Found UVC 0.04 device syz (046d:08c3) [ 1328.676521][ T116] usb 8-1: No streaming interface found for terminal 6. [ 1328.681097][T20128] input: syz0 as /devices/virtual/input/input78 [ 1328.693243][ T116] usb 8-1: USB disconnect, device number 4 [ 1328.720870][T17350] usb 6-1: USB disconnect, device number 74 [ 1328.767295][T16187] usb 7-1: new high-speed USB device number 55 using dummy_hcd [ 1328.927508][T16187] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1328.946085][T16187] usb 7-1: config 0 has no interfaces? [ 1328.956697][T16187] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1328.975648][T16187] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1329.107755][T16187] usb 7-1: config 0 descriptor?? [ 1329.384372][T16187] usb 7-1: USB disconnect, device number 55 [ 1329.416060][ T5907] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 1329.631150][ T5907] usb 5-1: Using ep0 maxpacket: 8 [ 1329.686858][ T5907] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1329.698304][ T5907] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1329.776196][ T116] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 1329.776404][ T5907] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1329.997317][ T5907] usb 5-1: config 0 descriptor?? [ 1330.124716][ T116] usb 6-1: Using ep0 maxpacket: 32 [ 1330.194743][ T116] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 1330.207613][ T116] usb 6-1: config 0 descriptor has 1 excess byte, ignoring [ 1330.224103][ T5907] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 1330.225037][ T116] usb 6-1: config 0 has no interface number 0 [ 1330.236790][T20163] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1330.247819][T20163] IPv6: NLM_F_CREATE should be set when creating new route [ 1330.281838][ T116] usb 6-1: config 0 interface 184 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1330.314482][ T116] usb 6-1: config 0 interface 184 has no altsetting 0 [ 1330.326695][ T116] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1330.326725][ T116] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1330.326739][ T116] usb 6-1: Product: syz [ 1330.326749][ T116] usb 6-1: Manufacturer: syz [ 1330.326758][ T116] usb 6-1: SerialNumber: syz [ 1330.327830][ T116] usb 6-1: config 0 descriptor?? [ 1330.570023][T20166] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3771'. [ 1330.637360][T20166] input: syz1 as /devices/virtual/input/input79 [ 1330.698265][T20166] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3771'. [ 1330.764548][ T116] smsc75xx v1.0.0 [ 1330.771499][ T116] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1330.782775][T19839] usb 5-1: USB disconnect, device number 124 [ 1330.801827][ T116] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -22 [ 1331.155542][T20174] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3773'. [ 1331.184172][T20174] input: syz1 as /devices/virtual/input/input80 [ 1331.196118][ T116] usb 6-1: USB disconnect, device number 75 [ 1331.485343][T20175] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3773'. [ 1331.727935][T20185] netlink: 48 bytes leftover after parsing attributes in process `syz.6.3774'. [ 1332.976489][ T5821] Bluetooth: hci2: command 0x0405 tx timeout [ 1333.006139][T20196] delete_channel: no stack [ 1333.405674][T20208] Process accounting resumed [ 1333.486687][T19539] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 1334.947600][T20224] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1334.954909][T20224] IPv6: NLM_F_CREATE should be set when creating new route [ 1335.353209][T20234] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x3 [ 1335.824425][T20232] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3787'. [ 1335.840972][ T29] audit: type=1326 audit(2000001420.519:2326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20228 comm="syz.5.3788" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1336.016302][ T29] audit: type=1326 audit(2000001420.519:2327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20228 comm="syz.5.3788" exe="/root/syz-executor" sig=0 arch=c000003e syscall=4 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1336.104507][ T29] audit: type=1326 audit(2000001420.519:2328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20228 comm="syz.5.3788" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1336.137363][ T29] audit: type=1326 audit(2000001420.519:2329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20228 comm="syz.5.3788" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1336.256033][T20250] FAULT_INJECTION: forcing a failure. [ 1336.256033][T20250] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1336.326547][ T116] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 1336.421486][T20250] CPU: 0 UID: 0 PID: 20250 Comm: syz.6.3792 Not tainted 6.13.0-syzkaller #0 [ 1336.430183][T20250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 1336.440226][T20250] Call Trace: [ 1336.443486][T20250] [ 1336.446401][T20250] dump_stack_lvl+0x16c/0x1f0 [ 1336.451071][T20250] should_fail_ex+0x497/0x5b0 [ 1336.455746][T20250] _copy_from_user+0x2e/0xd0 [ 1336.460317][T20250] kstrtouint_from_user+0xd7/0x1c0 [ 1336.465416][T20250] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1336.471140][T20250] ? hlock_class+0x4e/0x130 [ 1336.475662][T20250] ? 0xffffffff81000000 [ 1336.479798][T20250] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 1336.485418][T20250] proc_fail_nth_write+0x84/0x250 [ 1336.490433][T20250] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1336.496073][T20250] ? ksys_write+0x12b/0x250 [ 1336.500576][T20250] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1336.506222][T20250] vfs_write+0x24c/0x1150 [ 1336.510536][T20250] ? __fget_files+0x1fc/0x3a0 [ 1336.515197][T20250] ? __pfx___mutex_lock+0x10/0x10 [ 1336.520230][T20250] ? __pfx_vfs_write+0x10/0x10 [ 1336.525040][T20250] ? __fget_files+0x206/0x3a0 [ 1336.529727][T20250] ksys_write+0x12b/0x250 [ 1336.534055][T20250] ? __pfx_ksys_write+0x10/0x10 [ 1336.538906][T20250] do_syscall_64+0xcd/0x250 [ 1336.543411][T20250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1336.549314][T20250] RIP: 0033:0x7f55095847df [ 1336.553727][T20250] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1336.573344][T20250] RSP: 002b:00007f550a48b030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1336.581761][T20250] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f55095847df [ 1336.589726][T20250] RDX: 0000000000000001 RSI: 00007f550a48b0a0 RDI: 0000000000000003 [ 1336.597694][T20250] RBP: 00007f550a48b090 R08: 0000000000000000 R09: 0000000000000000 [ 1336.605656][T20250] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 1336.613618][T20250] R13: 0000000000000000 R14: 00007f5509775fa0 R15: 00007ffdb9eb9098 [ 1336.621599][T20250] [ 1336.624731][ C0] vkms_vblank_simulate: vblank timer overrun [ 1336.636289][ T29] audit: type=1326 audit(2000001420.519:2330): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20228 comm="syz.5.3788" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1336.768514][ T116] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1336.815551][ T29] audit: type=1326 audit(2000001420.519:2331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20228 comm="syz.5.3788" exe="/root/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1336.822448][ T116] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1336.839023][ C0] vkms_vblank_simulate: vblank timer overrun [ 1336.843349][ T29] audit: type=1326 audit(2000001420.529:2332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20228 comm="syz.5.3788" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1336.889684][ T29] audit: type=1326 audit(2000001420.529:2333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20228 comm="syz.5.3788" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1336.926345][ T29] audit: type=1326 audit(2000001420.539:2334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20228 comm="syz.5.3788" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1337.031148][T20258] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3796'. [ 1337.051203][ T29] audit: type=1326 audit(2000001420.549:2335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20228 comm="syz.5.3788" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1337.074615][ C0] vkms_vblank_simulate: vblank timer overrun [ 1337.104161][ T116] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1337.156453][T20258] input: syz1 as /devices/virtual/input/input81 [ 1337.287477][T20264] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3796'. [ 1337.530826][ T116] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1337.575343][ T116] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1337.596692][T20267] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3797'. [ 1337.608815][ T116] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1337.625601][ T116] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1337.633813][ T116] usb 6-1: Product: syz [ 1337.673167][T20267] input: syz1 as /devices/virtual/input/input82 [ 1337.837449][T20268] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3797'. [ 1338.045367][ T116] usb 6-1: Manufacturer: syz [ 1338.563618][ T116] cdc_wdm 6-1:1.0: skipping garbage [ 1338.626704][ T116] cdc_wdm 6-1:1.0: skipping garbage [ 1338.657577][ T116] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 1338.663529][ T116] cdc_wdm 6-1:1.0: Unknown control protocol [ 1338.758384][T20276] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=20276 comm=syz.1.3799 [ 1338.771869][T20241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1338.784749][T20241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1338.915363][T20241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1338.924053][T20241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1339.542663][ T5907] usb 6-1: USB disconnect, device number 76 [ 1339.676894][T20290] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3802'. [ 1340.527073][T17350] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 1340.687987][T17350] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1340.723377][T17350] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1340.756493][T17350] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1340.792411][T17350] usb 6-1: Product: syz [ 1340.829215][T17350] usb 6-1: Manufacturer: syz [ 1340.842990][T17350] usb 6-1: SerialNumber: syz [ 1341.944566][T17350] cdc_ncm 6-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 1342.853025][ T5907] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 1343.096505][ T5907] usb 5-1: device descriptor read/64, error -71 [ 1343.407124][ T5907] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 1343.566082][ T5907] usb 5-1: device descriptor read/64, error -71 [ 1343.706071][T19839] usb 7-1: new high-speed USB device number 56 using dummy_hcd [ 1344.548803][T19839] usb 7-1: Using ep0 maxpacket: 8 [ 1344.560097][ T5907] usb usb5-port1: attempt power cycle [ 1344.564900][T19839] usb 7-1: config 0 has an invalid interface number: 31 but max is 0 [ 1344.574208][T19839] usb 7-1: config 0 has no interface number 0 [ 1344.584933][T19839] usb 7-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1344.596198][T19839] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1344.605166][T19839] usb 7-1: Product: syz [ 1344.612313][T19839] usb 7-1: Manufacturer: syz [ 1344.618864][T19839] usb 7-1: SerialNumber: syz [ 1344.674034][T19839] usb 7-1: config 0 descriptor?? [ 1344.885100][T19839] usb 7-1: Found UVC 0.04 device syz (046d:08c3) [ 1344.892940][T19839] usb 7-1: No streaming interface found for terminal 6. [ 1344.906516][ T5907] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 1345.019020][T19839] usb 7-1: USB disconnect, device number 56 [ 1345.357735][ T5907] usb 5-1: device descriptor read/8, error -71 [ 1345.449033][ T29] kauditd_printk_skb: 11 callbacks suppressed [ 1345.449051][ T29] audit: type=1400 audit(2000001430.649:2347): avc: denied { map } for pid=20334 comm="syz.7.3816" path="/dev/vmci" dev="devtmpfs" ino=697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1345.490759][ T29] audit: type=1400 audit(2000001430.649:2348): avc: denied { execute } for pid=20334 comm="syz.7.3816" path="/dev/vmci" dev="devtmpfs" ino=697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1346.980911][T17350] cdc_ncm 6-1:1.0 eth9: register 'cdc_ncm' at usb-dummy_hcd.5-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 1347.810557][ T116] usb 6-1: USB disconnect, device number 77 [ 1347.823956][ T116] cdc_ncm 6-1:1.0 eth9: unregister 'cdc_ncm' usb-dummy_hcd.5-1, CDC NCM (NO ZLP) [ 1351.343644][T20380] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1352.091724][T20394] ipvlan2: entered promiscuous mode [ 1352.101252][T20394] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 1352.114696][T20394] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1352.536591][ T29] audit: type=1400 audit(2000001437.569:2349): avc: denied { ioctl } for pid=20399 comm="syz.1.3837" path="socket:[73390]" dev="sockfs" ino=73390 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1352.575499][ T29] audit: type=1400 audit(2000001437.579:2350): avc: denied { getopt } for pid=20399 comm="syz.1.3837" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1352.608721][T20410] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3837'. [ 1352.649605][T20407] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1352.715196][T20407] bond0: (slave rose0): Enslaving as an active interface with an up link [ 1352.852432][ T29] audit: type=1400 audit(2000001437.989:2351): avc: denied { read } for pid=20405 comm="syz.4.3839" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1353.520797][T20434] syz.7.3843: attempt to access beyond end of device [ 1353.520797][T20434] nbd7: rw=0, sector=1, nr_sectors = 1 limit=0 [ 1353.534132][T20434] qnx4: unable to read the superblock [ 1354.097162][T20437] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3842'. [ 1354.897098][T16187] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 1355.232377][T20451] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3847'. [ 1355.378582][T20451] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 1355.436903][T16187] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1355.446200][T16187] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1355.469427][T16187] usb 8-1: Product: syz [ 1355.473634][T16187] usb 8-1: Manufacturer: syz [ 1355.507101][T20451] 9pnet_fd: p9_fd_create_unix (20451): problem connecting socket: ./cgroup: -111 [ 1355.512978][T16187] usb 8-1: SerialNumber: syz [ 1355.568149][T16187] usb 8-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1355.592629][ T5907] usb 8-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1355.620608][T20459] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3849'. [ 1355.776283][T19839] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 1355.926796][ T116] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 1355.948679][T19839] usb 5-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=c6.98 [ 1355.959389][T19839] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1355.979541][T19839] usb 5-1: config 0 descriptor?? [ 1355.988860][T19839] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 1355.997520][T19839] ftdi_sio ttyUSB0: unknown device type: 0xc698 [ 1356.008154][ T5821] Bluetooth: hci2: unexpected event for opcode 0x0c2d [ 1356.086521][ T116] usb 7-1: Using ep0 maxpacket: 8 [ 1356.093349][ T116] usb 7-1: config 0 has an invalid interface number: 31 but max is 0 [ 1356.102288][ T116] usb 7-1: config 0 has no interface number 0 [ 1356.122778][ T116] usb 7-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1356.132885][ T116] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1356.141323][ T116] usb 7-1: Product: syz [ 1356.146906][ T116] usb 7-1: Manufacturer: syz [ 1356.154275][ T116] usb 7-1: SerialNumber: syz [ 1356.163358][ T116] usb 7-1: config 0 descriptor?? [ 1356.205698][T19839] usb 5-1: USB disconnect, device number 3 [ 1356.222870][T19839] ftdi_sio 5-1:0.0: device disconnected [ 1356.229153][ T5818] usb 8-1: USB disconnect, device number 6 [ 1356.376930][ T116] usb 7-1: Found UVC 0.04 device syz (046d:08c3) [ 1356.383919][ T116] usb 7-1: No streaming interface found for terminal 6. [ 1356.414458][ T116] usb 7-1: USB disconnect, device number 57 [ 1356.656747][ T5907] ath9k_htc 8-1:1.0: ath9k_htc: Target is unresponsive [ 1357.243287][ T5907] ath9k_htc: Failed to initialize the device [ 1357.276147][ T5818] usb 8-1: ath9k_htc: USB layer deinitialized [ 1357.756779][ T5818] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 1357.917351][ T5818] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1357.937439][ T5818] usb 8-1: New USB device found, idVendor=1e7d, idProduct=31ce, bcdDevice= 0.00 [ 1358.046587][ T5818] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1358.182439][T20502] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3858'. [ 1358.182598][ T5818] usb 8-1: config 0 descriptor?? [ 1358.205182][T20505] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3859'. [ 1359.166294][T20486] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1359.418537][T20486] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1359.776423][ T825] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 1359.863440][T20526] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3864'. [ 1359.892870][T20526] netlink: 168 bytes leftover after parsing attributes in process `syz.5.3864'. [ 1359.909620][T20526] netlink: 'syz.5.3864': attribute type 1 has an invalid length. [ 1359.936116][ T825] usb 2-1: Using ep0 maxpacket: 32 [ 1359.942825][ T825] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1359.983572][ T825] usb 2-1: config 0 has no interface number 0 [ 1360.010170][ T825] usb 2-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 1360.029496][ T5821] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 1360.038307][ T5821] Bluetooth: hci2: Injecting HCI hardware error event [ 1360.048232][T19166] Bluetooth: hci2: hardware error 0x00 [ 1360.084127][ T825] usb 2-1: config 0 interface 1 has no altsetting 0 [ 1360.187320][ T825] usb 2-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 1360.319766][ T825] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1360.319798][ T825] usb 2-1: Product: syz [ 1360.319816][ T825] usb 2-1: Manufacturer: syz [ 1360.319833][ T825] usb 2-1: SerialNumber: syz [ 1360.337118][T20533] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3865'. [ 1360.343611][ T825] usb 2-1: config 0 descriptor?? [ 1360.554933][ T825] cx231xx 2-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 1360.567276][ T825] cx231xx 2-1:0.1: Failed to read PCB config [ 1360.567330][ T825] cx231xx 2-1:0.1: probe with driver cx231xx failed with error -71 [ 1360.569953][ T825] usb 2-1: USB disconnect, device number 22 [ 1361.095368][ T825] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1361.257163][ T825] usb 2-1: Using ep0 maxpacket: 32 [ 1361.261627][ T825] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1361.261656][ T825] usb 2-1: config 0 has no interface number 0 [ 1361.261685][ T825] usb 2-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 1361.261699][ T825] usb 2-1: config 0 interface 1 has no altsetting 0 [ 1361.263453][ T825] usb 2-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 1361.263480][ T825] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1361.263504][ T825] usb 2-1: Product: syz [ 1361.263523][ T825] usb 2-1: Manufacturer: syz [ 1361.263541][ T825] usb 2-1: SerialNumber: syz [ 1361.265038][ T825] usb 2-1: config 0 descriptor?? [ 1361.320582][ T5818] usbhid 8-1:0.0: can't add hid device: -71 [ 1361.321556][ T5818] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 1361.334691][ T5818] usb 8-1: USB disconnect, device number 7 [ 1362.496196][T19166] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 1363.678640][T20560] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3871'. [ 1365.725980][ T5876] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 1365.899779][ T5876] usb 8-1: device descriptor read/64, error -71 [ 1366.047200][ T825] cx231xx 2-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 1366.095624][ T825] cx231xx 2-1:0.1: Failed to read PCB config [ 1366.116654][ T825] cx231xx 2-1:0.1: probe with driver cx231xx failed with error -71 [ 1366.137530][ T825] usb 2-1: USB disconnect, device number 23 [ 1366.216265][ T5876] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 1366.231148][T20587] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3879'. [ 1367.151656][ T5876] usb 8-1: device descriptor read/64, error -71 [ 1367.494342][T20596] FAULT_INJECTION: forcing a failure. [ 1367.494342][T20596] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1367.531155][T20596] CPU: 0 UID: 0 PID: 20596 Comm: syz.6.3881 Not tainted 6.13.0-syzkaller #0 [ 1367.539898][T20596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 1367.549975][T20596] Call Trace: [ 1367.553270][T20596] [ 1367.556213][T20596] dump_stack_lvl+0x16c/0x1f0 [ 1367.560922][T20596] should_fail_ex+0x497/0x5b0 [ 1367.565629][T20596] _copy_from_user+0x2e/0xd0 [ 1367.570236][T20596] copy_arg_from_user+0x59/0x90 [ 1367.575108][T20596] ? __pfx_copy_arg_from_user+0x10/0x10 [ 1367.580673][T20596] media_device_ioctl+0x1cd/0x490 [ 1367.585716][T20596] ? __pfx_media_device_ioctl+0x10/0x10 [ 1367.591314][T20596] ? __pfx_media_device_ioctl+0x10/0x10 [ 1367.596864][T20596] media_ioctl+0xf1/0x150 [ 1367.601190][T20596] ? __pfx_media_ioctl+0x10/0x10 [ 1367.606126][T20596] __x64_sys_ioctl+0x190/0x200 [ 1367.610892][T20596] do_syscall_64+0xcd/0x250 [ 1367.615484][T20596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1367.621379][T20596] RIP: 0033:0x7f5509585d29 [ 1367.625786][T20596] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1367.645396][T20596] RSP: 002b:00007f550a48b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1367.653827][T20596] RAX: ffffffffffffffda RBX: 00007f5509775fa0 RCX: 00007f5509585d29 [ 1367.661799][T20596] RDX: 0000000020000b00 RSI: 00000000c0487c04 RDI: 0000000000000003 [ 1367.669771][T20596] RBP: 00007f550a48b090 R08: 0000000000000000 R09: 0000000000000000 [ 1367.677732][T20596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1367.685780][T20596] R13: 0000000000000000 R14: 00007f5509775fa0 R15: 00007ffdb9eb9098 [ 1367.693766][T20596] [ 1367.697522][ T5876] usb usb8-port1: attempt power cycle [ 1368.086019][ T5876] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 1368.127663][ T5876] usb 8-1: device descriptor read/8, error -71 [ 1368.386030][ T5876] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 1368.606824][T20605] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3883'. [ 1368.646530][ T5876] usb 8-1: device not accepting address 11, error -71 [ 1368.653566][ T5876] usb usb8-port1: unable to enumerate USB device [ 1370.048261][ T5876] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 1370.226853][ T5876] usb 8-1: Using ep0 maxpacket: 8 [ 1370.228877][ T5876] usb 8-1: config 0 has an invalid interface number: 31 but max is 0 [ 1370.228908][ T5876] usb 8-1: config 0 has no interface number 0 [ 1370.231309][ T5876] usb 8-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1370.231338][ T5876] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1370.231361][ T5876] usb 8-1: Product: syz [ 1370.231379][ T5876] usb 8-1: Manufacturer: syz [ 1370.231395][ T5876] usb 8-1: SerialNumber: syz [ 1370.233157][ T5876] usb 8-1: config 0 descriptor?? [ 1370.253670][T20629] netlink: 71 bytes leftover after parsing attributes in process `syz.4.3890'. [ 1370.719120][ T5876] usb 8-1: Found UVC 0.04 device syz (046d:08c3) [ 1370.719177][ T5876] usb 8-1: No streaming interface found for terminal 6. [ 1370.721779][ T5876] usb 8-1: USB disconnect, device number 12 [ 1370.857600][ T29] audit: type=1400 audit(2000001456.059:2352): avc: denied { setopt } for pid=20635 comm="syz.1.3891" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1371.084600][T20642] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3892'. [ 1371.984881][T20656] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3896'. [ 1372.666953][ T29] audit: type=1326 audit(2000001457.869:2353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20673 comm="syz.5.3901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1372.706044][ T5876] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1372.756021][ T5869] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 1372.771273][ T29] audit: type=1326 audit(2000001457.889:2354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20673 comm="syz.5.3901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1372.853909][ T29] audit: type=1326 audit(2000001457.889:2355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20673 comm="syz.5.3901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1372.908080][ T29] audit: type=1326 audit(2000001457.899:2356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20673 comm="syz.5.3901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1372.914810][ T5876] usb 2-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1372.944622][ T5869] usb 5-1: Using ep0 maxpacket: 8 [ 1372.957707][ T5869] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1372.982122][ T5869] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1372.988659][ T5876] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1373.003935][ T5876] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1373.016734][ T5876] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1373.017642][ T29] audit: type=1326 audit(2000001457.899:2357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20673 comm="syz.5.3901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1373.026002][ T5876] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1373.049296][ C1] vkms_vblank_simulate: vblank timer overrun [ 1373.084128][ T5907] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 1373.104008][T20659] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1373.138288][ T5869] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1373.171880][ T29] audit: type=1326 audit(2000001457.899:2358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20673 comm="syz.5.3901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=254 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1373.195532][ C1] vkms_vblank_simulate: vblank timer overrun [ 1373.198954][ T5869] usb 5-1: config 0 descriptor?? [ 1373.422080][ T5907] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1373.569833][ T5876] aiptek 2-1:17.0: Aiptek using 400 ms programming speed [ 1373.575366][ T29] audit: type=1326 audit(2000001457.899:2359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20673 comm="syz.5.3901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1373.587232][ T5876] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:17.0/input/input83 [ 1373.601596][ T5907] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1373.621653][ T5907] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1373.630916][ T29] audit: type=1326 audit(2000001457.899:2360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20673 comm="syz.5.3901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=126 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1373.654871][ T5907] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1373.684285][T20681] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1373.706652][ T5907] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1373.714120][ T29] audit: type=1326 audit(2000001457.899:2361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20673 comm="syz.5.3901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18bbb85d29 code=0x7ffc0000 [ 1373.739658][ T5869] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 1373.742251][ T5876] usb 2-1: USB disconnect, device number 24 [ 1373.750471][ C1] aiptek 2-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1373.954551][ T5907] usb 6-1: USB disconnect, device number 78 [ 1374.149490][ T5876] usb 5-1: USB disconnect, device number 4 [ 1374.348419][T20681] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 1374.466124][T20697] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3906'. [ 1374.627837][ T5869] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 1374.660694][T20701] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3906'. [ 1375.006035][ T5869] usb 7-1: Using ep0 maxpacket: 8 [ 1375.015710][ T5869] usb 7-1: config 0 has an invalid interface number: 31 but max is 0 [ 1375.346007][ T5869] usb 7-1: config 0 has no interface number 0 [ 1375.372350][ T5869] usb 7-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1375.392676][ T5869] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1375.433285][ T5869] usb 7-1: Product: syz [ 1375.469352][ T5869] usb 7-1: Manufacturer: syz [ 1375.606078][ T5869] usb 7-1: SerialNumber: syz [ 1375.621738][ T5869] usb 7-1: config 0 descriptor?? [ 1376.002998][ T5869] usb 7-1: Found UVC 0.04 device syz (046d:08c3) [ 1376.066139][ T5869] usb 7-1: No streaming interface found for terminal 6. [ 1376.091766][ T5869] usb 7-1: USB disconnect, device number 58 [ 1376.137124][T20715] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3911'. [ 1376.906387][ T5821] Bluetooth: hci0: command 0x0c1a tx timeout [ 1377.823063][T20732] overlayfs: workdir and upperdir must be separate subtrees [ 1378.619959][T20743] Invalid ELF header magic: != ELF [ 1378.629303][T20743] ntfs3: Unknown parameter '' [ 1378.652510][ T29] kauditd_printk_skb: 10 callbacks suppressed [ 1378.652544][ T29] audit: type=1400 audit(2000001463.819:2372): avc: denied { module_load } for pid=20735 comm="syz.4.3918" path="/sys/kernel/notes" dev="sysfs" ino=1382 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 1379.156055][ T5870] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 1379.356070][ T5870] usb 7-1: Using ep0 maxpacket: 32 [ 1379.365688][ T5870] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1379.720646][ T5870] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1380.206182][ T5870] usb 7-1: New USB device found, idVendor=056a, idProduct=033e, bcdDevice= 0.00 [ 1380.215270][ T5870] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1380.268031][ T5870] usb 7-1: config 0 descriptor?? [ 1380.426201][T20767] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3924'. [ 1380.824514][T20742] syz.6.3916(20742): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 1380.946124][ T5907] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 1381.296368][ T5907] usb 8-1: Using ep0 maxpacket: 8 [ 1381.366357][ T5907] usb 8-1: config 0 has an invalid descriptor of length 236, skipping remainder of the config [ 1381.409268][ T5907] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1381.638063][ T5907] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ee [ 1381.654023][ T5907] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1381.685315][ T5907] usb 8-1: Product: syz [ 1381.707899][ T5907] usb 8-1: Manufacturer: syz [ 1381.712563][ T5907] usb 8-1: SerialNumber: syz [ 1381.744729][ T5907] usb 8-1: config 0 descriptor?? [ 1382.427207][ T5870] usbhid 7-1:0.0: can't add hid device: -71 [ 1382.457474][ T5870] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1382.496430][ T5870] usb 7-1: USB disconnect, device number 59 [ 1383.600781][T16187] usb 8-1: USB disconnect, device number 14 [ 1383.765449][T20790] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3931'. [ 1384.379496][T20799] netdevsim netdevsim6 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 1384.388833][T20799] netdevsim netdevsim6 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 1384.398334][T20799] netdevsim netdevsim6 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 1384.407710][T20799] netdevsim netdevsim6 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 1384.419162][T20799] geneve2: entered promiscuous mode [ 1384.424412][T20799] geneve2: entered allmulticast mode [ 1384.607557][T20795] netlink: 40 bytes leftover after parsing attributes in process `syz.7.3933'. [ 1384.984815][T20803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1385.034612][T20803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1385.087109][T20803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1385.101998][T20803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1385.135215][T20803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1385.146146][T20803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1385.157029][T20803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1385.169331][T20803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1385.180422][T20803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1385.204044][T20803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1386.411122][T20813] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3938'. [ 1387.175378][ T29] audit: type=1400 audit(2000001472.369:2373): avc: denied { getopt } for pid=20820 comm="syz.7.3940" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1387.278386][T20831] netlink: 'syz.6.3942': attribute type 10 has an invalid length. [ 1387.286346][T20831] netlink: 1284 bytes leftover after parsing attributes in process `syz.6.3942'. [ 1387.295511][T20831] openvswitch: netlink: Flow key attr not present in new flow. [ 1389.579661][T20848] tmpfs: Bad value for 'mpol' [ 1390.726050][ T5907] usb 5-1: new low-speed USB device number 5 using dummy_hcd [ 1390.934792][ T5907] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1390.937887][T20854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1390.943224][ T5907] usb 5-1: config 0 has no interface number 0 [ 1390.963700][T20854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1390.997909][T20854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1391.014414][ T5907] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1391.293769][T20854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1391.336087][ T5907] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1391.349307][T20854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1391.386236][ T5907] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1391.393119][T20854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1391.395371][ T5907] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1391.443754][T20854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1391.466493][T20854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1391.479769][T20854] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1391.509279][T20854] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1391.913316][ T5907] usb 5-1: config 0 descriptor?? [ 1391.921090][ T5907] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1392.051029][T20867] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3560516746 (28484133968 ns) > initial count (26428273480 ns). Using initial count to start timer. [ 1392.166458][ T5907] usb 5-1: USB disconnect, device number 5 [ 1392.183170][T20870] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3952'. [ 1392.329136][ T5870] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 1392.447085][ T5818] usb 7-1: new high-speed USB device number 60 using dummy_hcd [ 1392.626889][ T5818] usb 7-1: Using ep0 maxpacket: 16 [ 1392.645325][ T5870] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1392.666166][ T5818] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1392.679393][ T5818] usb 7-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1392.689208][ T5818] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1392.691002][ T5870] usb 8-1: config 0 has no interfaces? [ 1392.697672][ T5818] usb 7-1: Product: syz [ 1392.708564][ T5818] usb 7-1: Manufacturer: syz [ 1392.713185][ T5818] usb 7-1: SerialNumber: syz [ 1392.721300][ T5818] usb 7-1: config 0 descriptor?? [ 1392.746716][ T5818] CoreChips 7-1:0.0: probe with driver CoreChips failed with error -22 [ 1392.756094][ T5870] usb 8-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 1392.765194][ T5870] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1392.819755][ T5870] usb 8-1: config 0 descriptor?? [ 1393.378584][ T29] audit: type=1400 audit(2000001478.579:2374): avc: denied { mounton } for pid=20880 comm="syz.5.3947" path="/503/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 1393.436809][ T5876] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 1393.586107][T20888] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3947'. [ 1393.706917][ T5818] usb 7-1: USB disconnect, device number 60 [ 1393.783050][ T5876] usb 2-1: config 0 has an invalid interface number: 158 but max is 0 [ 1393.792797][ T5876] usb 2-1: config 0 has no interface number 0 [ 1393.802238][ T5876] usb 2-1: config 0 interface 158 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 1393.829772][ T5876] usb 2-1: New USB device found, idVendor=040b, idProduct=6521, bcdDevice=b3.9f [ 1393.871743][ T5876] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1393.968100][ T5876] usb 2-1: Product: syz [ 1393.976569][ T5876] usb 2-1: Manufacturer: syz [ 1393.982250][ T5876] usb 2-1: SerialNumber: syz [ 1393.992990][ T5876] usb 2-1: config 0 descriptor?? [ 1394.001225][ T5876] xbox_remote_probe: Unexpected desc.bNumEndpoints: 2 [ 1394.212938][ T5876] usb 2-1: USB disconnect, device number 25 [ 1395.926202][ T5876] usb 8-1: USB disconnect, device number 15 [ 1396.401696][T20921] input: syz1 as /devices/virtual/input/input85 [ 1396.445714][T20927] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3965'. [ 1396.810584][ T29] audit: type=1400 audit(2000001481.999:2375): avc: denied { read } for pid=20920 comm="syz.5.3964" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1399.336433][ T5870] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1400.216588][ T116] usb 6-1: new full-speed USB device number 79 using dummy_hcd [ 1400.527317][ T5870] usb 5-1: Using ep0 maxpacket: 8 [ 1400.550538][ T5870] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 1400.574139][ T116] usb 6-1: config 2 has an invalid interface number: 45 but max is 0 [ 1400.576097][ T5870] usb 5-1: config 0 has no interface number 0 [ 1401.326597][ T29] audit: type=1400 audit(2000001486.449:2376): avc: denied { map } for pid=20970 comm="syz.1.3978" path="/proc/661/ns" dev="proc" ino=76225 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 1401.353375][ T5870] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1401.359063][ T116] usb 6-1: config 2 has no interface number 0 [ 1401.374323][ T5870] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1401.396452][ T116] usb 6-1: config 2 interface 45 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 10 [ 1401.407520][ T5870] usb 5-1: Product: syz [ 1401.407545][ T5870] usb 5-1: Manufacturer: syz [ 1401.407563][ T5870] usb 5-1: SerialNumber: syz [ 1401.409277][ T5870] usb 5-1: config 0 descriptor?? [ 1401.413978][ T29] audit: type=1400 audit(2000001486.449:2377): avc: denied { execute } for pid=20970 comm="syz.1.3978" path="/proc/661/ns" dev="proc" ino=76225 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 1401.529749][ T116] usb 6-1: New USB device found, idVendor=0d46, idProduct=0078, bcdDevice=82.92 [ 1401.556909][ T116] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1401.573201][ T5870] usb 5-1: can't set config #0, error -71 [ 1401.575955][ T116] usb 6-1: Product: syz [ 1401.583136][ T116] usb 6-1: Manufacturer: syz [ 1401.598592][ T116] usb 6-1: SerialNumber: syz [ 1401.601316][ T5870] usb 5-1: USB disconnect, device number 6 [ 1401.612068][ T116] kobil_sct 6-1:2.45: KOBIL USB smart card terminal converter detected [ 1401.656211][ T116] usb 6-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 1402.063791][ T116] usb 6-1: USB disconnect, device number 79 [ 1402.157361][ T116] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 1402.226093][ T116] kobil_sct 6-1:2.45: device disconnected [ 1402.884824][ T29] audit: type=1400 audit(2000001488.079:2378): avc: denied { setattr } for pid=20988 comm="syz.1.3982" name="vcsa" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 1403.057196][T20997] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 1403.068393][T20997] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 1403.079541][T20997] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 1404.966083][ T5870] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 1405.036173][T16187] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 1405.259727][T21013] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3987'. [ 1405.414262][T21014] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3987'. [ 1405.636648][T16187] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1405.664005][ T5870] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 1405.682508][T21017] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3988'. [ 1405.691799][ T5870] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1405.691830][ T5870] usb 2-1: config 0 has no interface number 0 [ 1405.691865][ T5870] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1405.691890][ T5870] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1405.747158][T16187] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1405.791801][T16187] usb 8-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 1405.948039][T21020] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3988'. [ 1406.165803][T16187] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1406.175657][T21019] FAULT_INJECTION: forcing a failure. [ 1406.175657][T21019] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1406.190178][ T5870] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1406.206168][T21019] CPU: 0 UID: 0 PID: 21019 Comm: syz.4.3989 Not tainted 6.13.0-syzkaller #0 [ 1406.214875][T21019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 1406.224920][T21019] Call Trace: [ 1406.228183][T21019] [ 1406.231097][T21019] dump_stack_lvl+0x16c/0x1f0 [ 1406.235764][T21019] should_fail_ex+0x497/0x5b0 [ 1406.240432][T21019] _copy_from_user+0x2e/0xd0 [ 1406.245003][T21019] iommufd_vfio_ioctl+0x67a/0xe80 [ 1406.250020][T21019] ? __pfx_iommufd_vfio_ioctl+0x10/0x10 [ 1406.255578][T21019] ? tomoyo_path_number_perm+0x190/0x590 [ 1406.261209][T21019] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1406.267107][T21019] ? do_vfs_ioctl+0x513/0x1990 [ 1406.271873][T21019] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1406.276902][T21019] ? ioctl_has_perm.constprop.0.isra.0+0x2f2/0x450 [ 1406.283406][T21019] iommufd_fops_ioctl+0x431/0x4f0 [ 1406.288429][T21019] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1406.293967][T21019] ? __pfx_lock_release+0x10/0x10 [ 1406.298996][T21019] ? selinux_file_ioctl+0x180/0x270 [ 1406.304191][T21019] ? selinux_file_ioctl+0xb4/0x270 [ 1406.309300][T21019] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1406.314901][T21019] __x64_sys_ioctl+0x190/0x200 [ 1406.319687][T21019] do_syscall_64+0xcd/0x250 [ 1406.324217][T21019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1406.330123][T21019] RIP: 0033:0x7f8241185d29 [ 1406.334552][T21019] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1406.354190][T21019] RSP: 002b:00007f8241fcd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1406.362612][T21019] RAX: ffffffffffffffda RBX: 00007f8241375fa0 RCX: 00007f8241185d29 [ 1406.370582][T21019] RDX: 0000000000000000 RSI: 0000000000003b70 RDI: 0000000000000003 [ 1406.378550][T21019] RBP: 00007f8241fcd090 R08: 0000000000000000 R09: 0000000000000000 [ 1406.386513][T21019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1406.394480][T21019] R13: 0000000000000000 R14: 00007f8241375fa0 R15: 00007fff51f1bae8 [ 1406.402459][T21019] [ 1406.426062][ T5870] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1406.436444][T16187] usb 8-1: config 0 descriptor?? [ 1406.486584][ T5870] usb 2-1: config 0 descriptor?? [ 1406.496494][ T5870] usb 2-1: can't set config #0, error -71 [ 1406.507298][ T5870] usb 2-1: USB disconnect, device number 26 [ 1406.555355][T21026] netlink: 232 bytes leftover after parsing attributes in process `syz.4.3991'. [ 1406.574912][T21026] netlink: 7704 bytes leftover after parsing attributes in process `syz.4.3991'. [ 1406.686480][ T116] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 1406.836288][ T116] usb 6-1: Using ep0 maxpacket: 16 [ 1406.848719][ T116] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1407.496131][ T116] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1407.966064][T16187] usbhid 8-1:0.0: can't add hid device: -71 [ 1407.972093][T16187] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 1407.991201][T16187] usb 8-1: USB disconnect, device number 16 [ 1408.006647][ T5821] Bluetooth: hci0: command 0x0c1a tx timeout [ 1408.024741][ T116] usb 6-1: New USB device found, idVendor=054c, idProduct=05c4, bcdDevice= 0.00 [ 1408.056318][ T116] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1408.099903][ T116] usb 6-1: config 0 descriptor?? [ 1408.711633][ T116] usbhid 6-1:0.0: can't add hid device: -32 [ 1408.791881][T21047] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3997'. [ 1409.334926][ T116] usbhid 6-1:0.0: probe with driver usbhid failed with error -32 [ 1409.401952][ T116] usb 6-1: USB disconnect, device number 80 [ 1409.636087][T16187] usb 7-1: new high-speed USB device number 61 using dummy_hcd [ 1409.667115][ T5818] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 1409.703578][ T5818] hid-generic 0000:0000:0000.0027: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1409.786181][T16187] usb 7-1: Using ep0 maxpacket: 8 [ 1409.794095][T16187] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1409.813616][T16187] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1409.824401][T16187] usb 7-1: Product: syz [ 1409.831842][T16187] usb 7-1: Manufacturer: syz [ 1409.839873][T16187] usb 7-1: SerialNumber: syz [ 1409.852461][T16187] usb 7-1: config 0 descriptor?? [ 1409.986482][ T116] usb 6-1: new full-speed USB device number 81 using dummy_hcd [ 1410.073404][T16187] usb 7-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1410.351920][T21058] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1410.392271][T21064] overlayfs: missing 'lowerdir' [ 1410.686152][ T5907] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 1410.883478][ T5821] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 1411.041201][ T5907] usb 8-1: Using ep0 maxpacket: 32 [ 1411.131553][ T5907] usb 8-1: config 0 has an invalid interface number: 126 but max is 0 [ 1411.141629][ T5907] usb 8-1: config 0 has no interface number 0 [ 1411.151960][ T5907] usb 8-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1411.177832][ T5907] usb 8-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 1411.203759][ T5907] usb 8-1: config 0 interface 126 has no altsetting 0 [ 1411.213316][ T5907] usb 8-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 1411.222949][ T5907] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1411.251966][ T5907] usb 8-1: Product: syz [ 1411.265802][ T5907] usb 8-1: Manufacturer: syz [ 1411.271878][ T5907] usb 8-1: SerialNumber: syz [ 1411.295187][ T5907] usb 8-1: config 0 descriptor?? [ 1411.303032][T21068] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 1411.310844][T21068] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 1411.471537][T21081] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1411.592039][ T5907] ir_usb 8-1:0.126: IR Dongle converter detected [ 1411.609711][ T5907] usb 8-1: IRDA class descriptor not found, device not bound [ 1411.636374][ T5907] usb 8-1: USB disconnect, device number 17 [ 1411.690229][T21087] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4008'. [ 1411.814358][T16187] usb write operation failed. (-71) [ 1411.832304][T16187] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1412.216151][T16187] dvbdev: DVB: registering new adapter (Terratec H7) [ 1412.228928][T16187] usb 7-1: media controller created [ 1412.234534][T16187] usb read operation failed. (-71) [ 1412.241876][T16187] usb write operation failed. (-71) [ 1412.252236][T16187] dvb_usb_az6007 7-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1412.314457][T16187] usb 7-1: USB disconnect, device number 61 [ 1412.385872][T21095] netlink: 71 bytes leftover after parsing attributes in process `syz.4.4009'. [ 1412.416046][T21060] Bluetooth: hci0: Opcode 0x080f failed: -110 [ 1412.422705][ T5821] Bluetooth: hci0: command 0x0c1a tx timeout [ 1412.430081][ T116] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1412.438670][ T116] usb 6-1: no configurations [ 1412.443547][ T116] usb 6-1: can't read configurations, error -22 [ 1414.096560][T16187] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 1414.496051][ T5821] Bluetooth: hci0: command 0x0c1a tx timeout [ 1414.688625][T16187] usb 8-1: Using ep0 maxpacket: 32 [ 1414.730679][T16187] usb 8-1: config 0 has an invalid interface number: 146 but max is 0 [ 1414.796107][T16187] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1414.826209][T16187] usb 8-1: config 0 has no interface number 0 [ 1414.846817][T16187] usb 8-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1414.875833][T16187] usb 8-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1415.129998][T16187] usb 8-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1415.187419][T16187] usb 8-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1415.627497][T16187] usb 8-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1415.661573][T16187] usb 8-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1415.689680][T16187] usb 8-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1415.718833][T16187] usb 8-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1415.732617][T16187] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1415.740900][T16187] usb 8-1: Product: syz [ 1415.745164][T16187] usb 8-1: Manufacturer: syz [ 1415.750706][T16187] usb 8-1: SerialNumber: syz [ 1415.757229][T16187] usb 8-1: config 0 descriptor?? [ 1415.762919][T21115] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1415.771714][T16187] microtek usb (rev 0.4.3): expecting 3 got 2 endpoints! Bailing out. [ 1416.257243][T16187] usb 8-1: USB disconnect, device number 18 [ 1416.585983][T19166] Bluetooth: hci0: command 0x0c1a tx timeout [ 1418.048196][T21168] binder: BINDER_SET_CONTEXT_MGR already set [ 1418.054274][T21168] binder: 21142:21168 ioctl 4018620d 20000100 returned -16 [ 1418.066154][T21168] binder: 21142:21168 ioctl c0306201 0 returned -14 [ 1419.309651][T21176] netlink: 40 bytes leftover after parsing attributes in process `syz.6.4031'. [ 1420.403195][ T29] audit: type=1400 audit(2000001505.599:2379): avc: denied { bind } for pid=21188 comm="syz.1.4037" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1420.451470][T21190] netlink: 36 bytes leftover after parsing attributes in process `syz.7.4036'. [ 1420.628803][T21198] netlink: 232 bytes leftover after parsing attributes in process `syz.4.4039'. [ 1420.638289][T21198] netlink: 7704 bytes leftover after parsing attributes in process `syz.4.4039'. [ 1420.676703][ T116] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 1420.735137][T21200] binder: 21196:21200 ioctl c0306201 20000bc0 returned -14 [ 1420.753228][ T29] audit: type=1400 audit(2000001505.929:2380): avc: denied { transfer } for pid=21196 comm="syz.6.4040" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 1420.836260][T19839] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 1420.856650][ T116] usb 2-1: Using ep0 maxpacket: 8 [ 1420.862979][ T116] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1420.877438][ T116] usb 2-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 1420.903381][ T116] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1420.921292][ T116] usb 2-1: config 0 descriptor?? [ 1420.942695][ T116] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 1421.016331][T19839] usb 8-1: Using ep0 maxpacket: 32 [ 1421.022871][T19839] usb 8-1: config 0 has an invalid interface number: 146 but max is 0 [ 1421.040812][T19839] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1421.059073][T19839] usb 8-1: config 0 has no interface number 0 [ 1421.074359][T19839] usb 8-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1421.153777][T19839] usb 8-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1421.245169][T19839] usb 8-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1421.265469][T19839] usb 8-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1421.285664][T19839] usb 8-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1421.594542][T19839] usb 8-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1421.614394][T19839] usb 8-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1421.627901][T19839] usb 8-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1421.637173][T19839] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1421.645513][T19839] usb 8-1: Product: syz [ 1421.650433][T19839] usb 8-1: Manufacturer: syz [ 1421.655074][T19839] usb 8-1: SerialNumber: syz [ 1422.807199][ T116] gspca_vc032x: reg_r err -110 [ 1422.812076][ T116] vc032x 2-1:0.0: probe with driver vc032x failed with error -110 [ 1422.955070][T19839] usb 8-1: config 0 descriptor?? [ 1422.967863][T21195] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1422.994271][T19839] microtek usb (rev 0.4.3): expecting 3 got 2 endpoints! Bailing out. [ 1423.066029][ T29] audit: type=1400 audit(2000001508.249:2381): avc: denied { connect } for pid=21188 comm="syz.1.4037" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1423.177218][T21222] 9pnet_fd: Insufficient options for proto=fd [ 1423.204000][T19839] usb 8-1: USB disconnect, device number 19 [ 1424.286214][ T5870] usb 2-1: USB disconnect, device number 27 [ 1424.766750][T21235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1424.783952][T21235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1424.794927][T21235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1424.806325][T21235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1424.825488][T21235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1424.843883][T21235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1424.867328][T21235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1424.878257][T21235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1424.888987][T21235] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1424.900704][T21235] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1426.031608][T21256] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4055'. [ 1426.103851][T21257] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 0, id = 0 [ 1426.215970][T19839] usb 7-1: new high-speed USB device number 62 using dummy_hcd [ 1426.694938][T21251] netlink: 24 bytes leftover after parsing attributes in process `syz.7.4052'. [ 1426.859764][T21263] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1426.886523][T19839] usb 7-1: Using ep0 maxpacket: 32 [ 1426.917510][T19839] usb 7-1: config 0 has an invalid interface number: 146 but max is 0 [ 1426.925724][T19839] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1426.949411][T19839] usb 7-1: config 0 has no interface number 0 [ 1426.955540][T19839] usb 7-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1426.966867][T19839] usb 7-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1426.994409][T19839] usb 7-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1427.027453][T19839] usb 7-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1427.077360][T19839] usb 7-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1427.135364][T19839] usb 7-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1427.246701][T19839] usb 7-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1427.382543][T19839] usb 7-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1427.454670][T19839] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1427.466164][T21269] netlink: 232 bytes leftover after parsing attributes in process `syz.5.4058'. [ 1427.476657][T19839] usb 7-1: Product: syz [ 1427.480840][T19839] usb 7-1: Manufacturer: syz [ 1427.485438][T19839] usb 7-1: SerialNumber: syz [ 1427.490868][T21269] netlink: 7704 bytes leftover after parsing attributes in process `syz.5.4058'. [ 1427.509993][T19839] usb 7-1: config 0 descriptor?? [ 1427.521203][T21252] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1427.544274][T19839] microtek usb (rev 0.4.3): expecting 3 got 2 endpoints! Bailing out. [ 1427.730167][ T29] audit: type=1400 audit(2000001512.929:2382): avc: denied { setopt } for pid=21281 comm="syz.7.4061" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1427.912724][T21285] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1427.923580][ T116] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 1427.926169][T21285] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1427.942002][ T29] audit: type=1400 audit(2000001512.929:2383): avc: denied { write } for pid=21281 comm="syz.7.4061" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1428.585193][T21285] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1428.614946][T21285] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1428.694655][ T116] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 1428.706211][T21285] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1428.716875][T21285] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1428.725382][ T116] usb 5-1: config 0 has no interface number 0 [ 1428.742684][T21285] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1428.753592][T21285] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1428.764020][T21285] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1428.774975][T21285] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1429.117796][ T116] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1429.133134][ T5895] usb 7-1: USB disconnect, device number 62 [ 1429.141263][ T116] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1429.151781][ T116] usb 5-1: New USB device found, idVendor=0403, idProduct=97c1, bcdDevice= 0.00 [ 1429.161859][ T116] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1429.190279][ T116] usb 5-1: config 0 descriptor?? [ 1431.617035][ T5821] Bluetooth: hci0: command 0x0c1a tx timeout [ 1432.826731][ T116] usbhid 5-1:0.2: can't add hid device: -71 [ 1432.900025][ T116] usbhid 5-1:0.2: probe with driver usbhid failed with error -71 [ 1433.002961][T21316] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4067'. [ 1433.074689][ T116] usb 5-1: USB disconnect, device number 7 [ 1433.861218][ T29] audit: type=1400 audit(2000001519.039:2384): avc: denied { connect } for pid=21314 comm="syz.1.4067" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1434.075370][T21324] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1434.405982][T16187] usb 7-1: new high-speed USB device number 63 using dummy_hcd [ 1434.677328][T16187] usb 7-1: Using ep0 maxpacket: 8 [ 1434.688968][T21334] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4072'. [ 1434.698101][T16187] usb 7-1: config 0 has an invalid interface number: 31 but max is 0 [ 1434.736126][T16187] usb 7-1: config 0 has no interface number 0 [ 1434.849950][T16187] usb 7-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1434.965045][T21337] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4072'. [ 1435.127450][T16187] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1435.144134][T16187] usb 7-1: Product: syz [ 1435.154764][T16187] usb 7-1: Manufacturer: syz [ 1435.166151][T16187] usb 7-1: SerialNumber: syz [ 1435.177085][T16187] usb 7-1: config 0 descriptor?? [ 1435.373621][T21341] snd_dummy snd_dummy.0: control 2:16:0:syz0:-3 is already present [ 1435.386069][ T5870] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 1435.408722][T16187] usb 7-1: Found UVC 0.04 device syz (046d:08c3) [ 1435.409729][T21341] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4075'. [ 1435.424738][T16187] usb 7-1: No streaming interface found for terminal 6. [ 1435.436036][T17350] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 1435.461426][T16187] usb 7-1: USB disconnect, device number 63 [ 1435.545978][ T5870] usb 2-1: Using ep0 maxpacket: 8 [ 1435.562807][ T5870] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 1435.573926][ T5870] usb 2-1: config 0 has no interface number 0 [ 1435.582563][ T5870] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1435.592642][ T5870] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1435.601211][ T5870] usb 2-1: Product: syz [ 1435.605623][ T5870] usb 2-1: Manufacturer: syz [ 1435.610834][ T5870] usb 2-1: SerialNumber: syz [ 1435.619590][T17350] usb 5-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 1435.634425][ T5870] usb 2-1: config 0 descriptor?? [ 1435.640310][T17350] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1435.649815][T17350] usb 5-1: Product: syz [ 1435.654454][T17350] usb 5-1: Manufacturer: syz [ 1435.661453][T17350] usb 5-1: SerialNumber: syz [ 1435.668342][T17350] usb 5-1: config 0 descriptor?? [ 1435.920691][ T5870] usb 2-1: Found UVC 0.04 device syz (046d:08c3) [ 1435.987106][T17350] gspca_main: sonixb-2.14.0 probing 0c45:6005 [ 1436.006286][ T5870] usb 2-1: No streaming interface found for terminal 6. [ 1436.097034][ T5870] usb 2-1: USB disconnect, device number 28 [ 1436.431958][T17350] input: sonixb as /devices/platform/dummy_hcd.4/usb5/5-1/input/input86 [ 1436.781443][T19839] usb 5-1: USB disconnect, device number 8 [ 1437.533433][T21376] netlink: 48 bytes leftover after parsing attributes in process `syz.5.4086'. [ 1439.021762][ T29] audit: type=1326 audit(2000001524.209:2385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21396 comm="syz.4.4092" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8241185d29 code=0x7ffc0000 [ 1439.115979][ T29] audit: type=1326 audit(2000001524.209:2386): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21396 comm="syz.4.4092" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8241185d29 code=0x7ffc0000 [ 1439.159291][ T29] audit: type=1326 audit(2000001524.209:2387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21396 comm="syz.4.4092" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f8241184690 code=0x7ffc0000 [ 1439.183696][ T29] audit: type=1326 audit(2000001524.209:2388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21396 comm="syz.4.4092" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8241185d29 code=0x7ffc0000 [ 1439.214828][T21400] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 1439.627744][ T29] audit: type=1326 audit(2000001524.209:2389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21396 comm="syz.4.4092" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8241185d29 code=0x7ffc0000 [ 1439.728546][ T29] audit: type=1326 audit(2000001524.209:2390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21396 comm="syz.4.4092" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8241185d29 code=0x7ffc0000 [ 1439.767639][ T29] audit: type=1326 audit(2000001524.209:2391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21396 comm="syz.4.4092" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8241185d29 code=0x7ffc0000 [ 1439.803141][ T29] audit: type=1326 audit(2000001524.209:2392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21396 comm="syz.4.4092" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8241185d29 code=0x7ffc0000 [ 1439.916746][ T29] audit: type=1326 audit(2000001524.209:2393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21396 comm="syz.4.4092" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f8241185d29 code=0x7ffc0000 [ 1439.983556][ T29] audit: type=1326 audit(2000001524.209:2394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21396 comm="syz.4.4092" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8241185d29 code=0x7ffc0000 [ 1441.911458][T21429] netlink: 256 bytes leftover after parsing attributes in process `syz.6.4099'. [ 1442.692264][T21443] overlayfs: workdir and upperdir must be separate subtrees [ 1443.249364][T21451] IPv6: addrconf: prefix option has invalid lifetime [ 1443.337603][T21452] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4105'. [ 1443.502503][T21454] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4108'. [ 1444.547115][T21454] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4108'. [ 1444.936108][ T5876] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 1445.106450][T21476] overlayfs: workdir and upperdir must be separate subtrees [ 1445.166911][ T5876] usb 5-1: Using ep0 maxpacket: 32 [ 1445.197605][ T5876] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1445.337659][ T5876] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1445.384474][ T5876] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1445.421025][ T5876] usb 5-1: Product: syz [ 1445.444887][ T5876] usb 5-1: Manufacturer: syz [ 1445.456203][ T5876] usb 5-1: SerialNumber: syz [ 1445.469185][ T5876] usb 5-1: config 0 descriptor?? [ 1445.483275][ T29] kauditd_printk_skb: 39 callbacks suppressed [ 1445.483291][ T29] audit: type=1400 audit(2000001530.679:2434): avc: denied { read } for pid=21477 comm="syz.7.4116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1445.631906][T21482] IPv6: addrconf: prefix option has invalid lifetime [ 1445.649155][T21478] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4116'. [ 1445.748463][T21472] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1446.057024][T21467] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1446.066077][T17350] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 1446.086649][T21467] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1446.286250][T17350] usb 2-1: device descriptor read/64, error -71 [ 1446.312421][T21467] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1446.323293][T21467] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1446.379621][ T5870] usb 5-1: USB disconnect, device number 9 [ 1446.526197][T17350] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 1446.666129][T17350] usb 2-1: device descriptor read/64, error -71 [ 1446.996089][T17350] usb usb2-port1: attempt power cycle [ 1447.198350][T21512] overlayfs: workdir and upperdir must be separate subtrees [ 1447.443104][T17350] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 1447.506535][T17350] usb 2-1: device descriptor read/8, error -71 [ 1447.851123][T21516] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 1447.896231][T17350] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 1447.996563][T17350] usb 2-1: device descriptor read/8, error -71 [ 1448.183247][ T29] audit: type=1400 audit(2000001533.369:2435): avc: denied { read } for pid=21517 comm="syz.6.4130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1448.206477][T17350] usb usb2-port1: unable to enumerate USB device [ 1448.566221][T17350] usb 7-1: new high-speed USB device number 64 using dummy_hcd [ 1449.246277][T17350] usb 7-1: Using ep0 maxpacket: 8 [ 1449.253553][T17350] usb 7-1: config 0 has an invalid interface number: 31 but max is 0 [ 1449.266366][T17350] usb 7-1: config 0 has no interface number 0 [ 1449.293846][T17350] usb 7-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1449.304476][T17350] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1449.364106][T21538] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4135'. [ 1449.370873][T17350] usb 7-1: Product: syz [ 1449.389042][T17350] usb 7-1: Manufacturer: syz [ 1449.408849][T17350] usb 7-1: SerialNumber: syz [ 1449.687993][T17350] usb 7-1: config 0 descriptor?? [ 1449.924690][T17350] usb 7-1: Found UVC 0.04 device syz (046d:08c3) [ 1449.933250][T17350] usb 7-1: No streaming interface found for terminal 6. [ 1449.954761][T17350] usb 7-1: USB disconnect, device number 64 [ 1450.250854][T21545] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1450.261823][T21545] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1450.272553][T21545] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1450.284575][T21545] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1450.297088][T21545] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1450.311198][T21545] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1450.437224][T21545] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1450.536799][T21545] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1450.710122][T21545] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1451.000154][T21545] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1451.846675][ T5876] usb 7-1: new high-speed USB device number 65 using dummy_hcd [ 1451.968088][T21562] overlayfs: workdir and upperdir must be separate subtrees [ 1452.054300][ T5876] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1452.119835][ T5876] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1452.203309][ T5876] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1452.270369][ T5876] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1452.321931][ T5876] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1452.363315][ T5876] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1452.413198][ T5876] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1452.449979][ T5876] usb 7-1: Product: syz [ 1452.454202][ T5876] usb 7-1: Manufacturer: syz [ 1452.462530][ T5876] cdc_wdm 7-1:1.0: skipping garbage [ 1452.468176][ T5876] cdc_wdm 7-1:1.0: skipping garbage [ 1452.474272][ T5876] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 1452.481068][ T5876] cdc_wdm 7-1:1.0: Unknown control protocol [ 1454.387154][T19839] usb 7-1: USB disconnect, device number 65 [ 1454.726794][ T5870] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 1454.926302][ T5870] usb 8-1: Using ep0 maxpacket: 8 [ 1455.336687][ T5870] usb 8-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 1455.345770][ T5870] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1455.380077][ T5870] usb 8-1: Product: syz [ 1455.384309][ T5870] usb 8-1: Manufacturer: syz [ 1455.756039][ T5870] usb 8-1: SerialNumber: syz [ 1455.787002][ T5870] usb 8-1: config 0 descriptor?? [ 1455.818126][ T5870] gspca_main: sq930x-2.14.0 probing 2770:930c [ 1455.846328][ T5870] gspca_sq930x: reg_r 001f failed -71 [ 1455.851791][ T5870] sq930x 8-1:0.0: probe with driver sq930x failed with error -71 [ 1455.906535][ T5870] usb 8-1: USB disconnect, device number 20 [ 1456.533522][T21604] overlayfs: workdir and upperdir must be separate subtrees [ 1457.705428][T21611] binder: BINDER_SET_CONTEXT_MGR already set [ 1457.712060][T21611] binder: 21607:21611 ioctl 4018620d 20004a80 returned -16 [ 1457.736949][T21611] binder: 21607:21611 ioctl c0306201 20000bc0 returned -14 [ 1457.797726][ T29] audit: type=1326 audit(2000001542.989:2436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21612 comm="syz.7.4157" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fcd7e585d29 code=0x0 [ 1458.010601][T21621] netlink: 16402 bytes leftover after parsing attributes in process `syz.5.4148'. [ 1458.024939][T21619] netlink: 16402 bytes leftover after parsing attributes in process `syz.5.4148'. [ 1458.729706][T21634] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4161'. [ 1458.771147][T21636] input: syz1 as /devices/virtual/input/input87 [ 1458.909531][T21634] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4161'. [ 1459.127722][T21648] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4165'. [ 1459.138843][ T29] audit: type=1400 audit(2000001544.329:2437): avc: denied { append } for pid=21644 comm="syz.1.4165" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1459.360175][ T5895] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 1460.596465][ T5895] usb 2-1: Using ep0 maxpacket: 16 [ 1460.606887][T21660] x_tables: duplicate underflow at hook 2 [ 1460.625685][ T5895] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1460.659354][ T29] audit: type=1400 audit(2000001545.849:2438): avc: denied { create } for pid=21659 comm="syz.4.4168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 1460.692900][ T5895] usb 2-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 1460.702925][ T5895] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1460.719507][ T5895] usb 2-1: config 0 descriptor?? [ 1460.737638][ T5895] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input88 [ 1460.928338][T21670] syz.7.4169: attempt to access beyond end of device [ 1460.928338][T21670] nbd7: rw=0, sector=0, nr_sectors = 1 limit=0 [ 1460.951820][T21670] FAT-fs (nbd7): unable to read boot sector [ 1460.988155][T21669] [ 1460.990505][T21669] ====================================================== [ 1460.997508][T21669] WARNING: possible circular locking dependency detected [ 1461.004515][T21669] 6.13.0-syzkaller #0 Not tainted [ 1461.009519][T21669] ------------------------------------------------------ [ 1461.016520][T21669] syz.4.4171/21669 is trying to acquire lock: [ 1461.022571][T21669] ffff888059bb4468 (&pipe->mutex){+.+.}-{4:4}, at: pipe_lock+0x64/0x80 [ 1461.030853][T21669] [ 1461.030853][T21669] but task is already holding lock: [ 1461.038218][T21669] ffff88805aba4420 (sb_writers#6){.+.+}-{0:0}, at: ovl_splice_write+0x38e/0x630 [ 1461.047386][T21669] [ 1461.047386][T21669] which lock already depends on the new lock. [ 1461.047386][T21669] [ 1461.057781][T21669] [ 1461.057781][T21669] the existing dependency chain (in reverse order) is: [ 1461.066786][T21669] [ 1461.066786][T21669] -> #4 (sb_writers#6){.+.+}-{0:0}: [ 1461.074178][T21669] mnt_want_write+0x6f/0x450 [ 1461.079301][T21669] ovl_create_object+0x12e/0x300 [ 1461.084771][T21669] lookup_open.isra.0+0x1174/0x14c0 [ 1461.090494][T21669] path_openat+0x904/0x2d60 [ 1461.095531][T21669] do_filp_open+0x20c/0x470 [ 1461.100582][T21669] do_sys_openat2+0x17a/0x1e0 [ 1461.105796][T21669] __x64_sys_open+0x154/0x1e0 [ 1461.111004][T21669] do_syscall_64+0xcd/0x250 [ 1461.116036][T21669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1461.122461][T21669] [ 1461.122461][T21669] -> #3 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}: [ 1461.131151][T21669] down_read+0x9a/0x330 [ 1461.135832][T21669] walk_component+0x342/0x5b0 [ 1461.141027][T21669] path_lookupat+0x17f/0x770 [ 1461.146137][T21669] filename_lookup+0x221/0x5f0 [ 1461.151420][T21669] kern_path+0x35/0x50 [ 1461.156007][T21669] lookup_bdev+0xd9/0x280 [ 1461.160867][T21669] resume_store+0x1d8/0x460 [ 1461.165891][T21669] kobj_attr_store+0x55/0x80 [ 1461.171007][T21669] sysfs_kf_write+0x117/0x170 [ 1461.176201][T21669] kernfs_fop_write_iter+0x33d/0x500 [ 1461.182000][T21669] vfs_write+0x5ae/0x1150 [ 1461.186842][T21669] ksys_write+0x12b/0x250 [ 1461.191682][T21669] do_syscall_64+0xcd/0x250 [ 1461.196702][T21669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1461.203112][T21669] [ 1461.203112][T21669] -> #2 (&of->mutex){+.+.}-{4:4}: [ 1461.210320][T21669] __mutex_lock+0x19b/0xa60 [ 1461.215344][T21669] kernfs_seq_start+0x4d/0x240 [ 1461.220620][T21669] seq_read_iter+0x2ab/0x12b0 [ 1461.225814][T21669] kernfs_fop_read_iter+0x414/0x580 [ 1461.231523][T21669] copy_splice_read+0x620/0xb90 [ 1461.236893][T21669] do_splice_read+0x282/0x370 [ 1461.242089][T21669] splice_direct_to_actor+0x2a4/0xa40 [ 1461.247979][T21669] do_splice_direct+0x178/0x250 [ 1461.253349][T21669] do_sendfile+0xaed/0xe30 [ 1461.258275][T21669] __x64_sys_sendfile64+0x1da/0x220 [ 1461.263986][T21669] do_syscall_64+0xcd/0x250 [ 1461.269007][T21669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1461.275415][T21669] [ 1461.275415][T21669] -> #1 (&p->lock){+.+.}-{4:4}: [ 1461.282463][T21669] __mutex_lock+0x19b/0xa60 [ 1461.287500][T21669] seq_read_iter+0xd8/0x12b0 [ 1461.292618][T21669] kernfs_fop_read_iter+0x414/0x580 [ 1461.298336][T21669] copy_splice_read+0x620/0xb90 [ 1461.303705][T21669] do_splice_read+0x282/0x370 [ 1461.308898][T21669] splice_file_to_pipe+0x109/0x120 [ 1461.314529][T21669] do_splice+0x1174/0x1f60 [ 1461.319456][T21669] __do_splice+0x159/0x360 [ 1461.324382][T21669] __x64_sys_splice+0x187/0x250 [ 1461.329742][T21669] do_syscall_64+0xcd/0x250 [ 1461.334760][T21669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1461.341175][T21669] [ 1461.341175][T21669] -> #0 (&pipe->mutex){+.+.}-{4:4}: [ 1461.348560][T21669] __lock_acquire+0x249e/0x3c40 [ 1461.353926][T21669] lock_acquire.part.0+0x11b/0x380 [ 1461.359549][T21669] __mutex_lock+0x19b/0xa60 [ 1461.364575][T21669] pipe_lock+0x64/0x80 [ 1461.369153][T21669] iter_file_splice_write+0x1eb/0x10b0 [ 1461.375130][T21669] backing_file_splice_write+0x277/0x880 [ 1461.381281][T21669] ovl_splice_write+0x38e/0x630 [ 1461.386650][T21669] do_splice+0x145c/0x1f60 [ 1461.391575][T21669] __do_splice+0x327/0x360 [ 1461.396498][T21669] __x64_sys_splice+0x187/0x250 [ 1461.401854][T21669] do_syscall_64+0xcd/0x250 [ 1461.406871][T21669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1461.413280][T21669] [ 1461.413280][T21669] other info that might help us debug this: [ 1461.413280][T21669] [ 1461.423490][T21669] Chain exists of: [ 1461.423490][T21669] &pipe->mutex --> &ovl_i_mutex_dir_key[depth] --> sb_writers#6 [ 1461.423490][T21669] [ 1461.437043][T21669] Possible unsafe locking scenario: [ 1461.437043][T21669] [ 1461.444473][T21669] CPU0 CPU1 [ 1461.449827][T21669] ---- ---- [ 1461.455174][T21669] rlock(sb_writers#6); [ 1461.459413][T21669] lock(&ovl_i_mutex_dir_key[depth]); [ 1461.467380][T21669] lock(sb_writers#6); [ 1461.474049][T21669] lock(&pipe->mutex); [ 1461.478192][T21669] [ 1461.478192][T21669] *** DEADLOCK *** [ 1461.478192][T21669] [ 1461.486315][T21669] 3 locks held by syz.4.4171/21669: [ 1461.491492][T21669] #0: ffff88807b2ec420 (sb_writers#15){.+.+}-{0:0}, at: __do_splice+0x327/0x360 [ 1461.500638][T21669] #1: ffff88805b390168 (&ovl_i_mutex_key[depth]){+.+.}-{4:4}, at: ovl_splice_write+0x194/0x630 [ 1461.511095][T21669] #2: ffff88805aba4420 (sb_writers#6){.+.+}-{0:0}, at: ovl_splice_write+0x38e/0x630 [ 1461.520581][T21669] [ 1461.520581][T21669] stack backtrace: [ 1461.526451][T21669] CPU: 0 UID: 0 PID: 21669 Comm: syz.4.4171 Not tainted 6.13.0-syzkaller #0 [ 1461.535117][T21669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 1461.545162][T21669] Call Trace: [ 1461.548426][T21669] [ 1461.551343][T21669] dump_stack_lvl+0x116/0x1f0 [ 1461.556023][T21669] print_circular_bug+0x419/0x5d0 [ 1461.561050][T21669] check_noncircular+0x31a/0x400 [ 1461.565980][T21669] ? __pfx_check_noncircular+0x10/0x10 [ 1461.571428][T21669] ? bpf_ksym_find+0x127/0x1c0 [ 1461.576187][T21669] ? lockdep_lock+0xc6/0x200 [ 1461.580775][T21669] ? __pfx_lockdep_lock+0x10/0x10 [ 1461.585797][T21669] ? lockdep_hardirqs_on+0x7c/0x110 [ 1461.590992][T21669] __lock_acquire+0x249e/0x3c40 [ 1461.595835][T21669] ? __pfx___lock_acquire+0x10/0x10 [ 1461.601025][T21669] ? iter_file_splice_write+0x1cd/0x10b0 [ 1461.606650][T21669] lock_acquire.part.0+0x11b/0x380 [ 1461.611754][T21669] ? pipe_lock+0x64/0x80 [ 1461.615987][T21669] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 1461.621614][T21669] ? rcu_is_watching+0x12/0xc0 [ 1461.626370][T21669] ? trace_lock_acquire+0x14e/0x1f0 [ 1461.631567][T21669] ? pipe_lock+0x64/0x80 [ 1461.635798][T21669] ? lock_acquire+0x2f/0xb0 [ 1461.640291][T21669] ? pipe_lock+0x64/0x80 [ 1461.644526][T21669] __mutex_lock+0x19b/0xa60 [ 1461.649032][T21669] ? pipe_lock+0x64/0x80 [ 1461.653264][T21669] ? pipe_lock+0x64/0x80 [ 1461.657503][T21669] ? __pfx___mutex_lock+0x10/0x10 [ 1461.662538][T21669] ? rcu_is_watching+0x12/0xc0 [ 1461.667298][T21669] ? trace_kmalloc+0x2d/0xd0 [ 1461.671887][T21669] ? pipe_lock+0x64/0x80 [ 1461.676119][T21669] pipe_lock+0x64/0x80 [ 1461.680179][T21669] iter_file_splice_write+0x1eb/0x10b0 [ 1461.685632][T21669] ? __pfx___lock_acquire+0x10/0x10 [ 1461.690820][T21669] ? __pfx_iter_file_splice_write+0x10/0x10 [ 1461.696706][T21669] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 1461.702332][T21669] ? ovl_splice_write+0x38e/0x630 [ 1461.707352][T21669] backing_file_splice_write+0x277/0x880 [ 1461.712975][T21669] ovl_splice_write+0x38e/0x630 [ 1461.717816][T21669] ? __pfx_ovl_splice_write+0x10/0x10 [ 1461.723178][T21669] ? __pfx_ovl_file_end_write+0x10/0x10 [ 1461.728715][T21669] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 1461.734339][T21669] ? rcu_is_watching+0x12/0xc0 [ 1461.739101][T21669] ? __do_splice+0x327/0x360 [ 1461.743680][T21669] ? __pfx_ovl_splice_write+0x10/0x10 [ 1461.749045][T21669] do_splice+0x145c/0x1f60 [ 1461.753458][T21669] ? __pfx_do_splice+0x10/0x10 [ 1461.758211][T21669] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 1461.763670][T21669] ? __pfx_lock_release+0x10/0x10 [ 1461.768691][T21669] ? trace_lock_acquire+0x14e/0x1f0 [ 1461.773888][T21669] __do_splice+0x327/0x360 [ 1461.778469][T21669] ? __pfx___do_splice+0x10/0x10 [ 1461.783397][T21669] ? __fget_files+0x206/0x3a0 [ 1461.788068][T21669] __x64_sys_splice+0x187/0x250 [ 1461.792913][T21669] do_syscall_64+0xcd/0x250 [ 1461.797423][T21669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1461.803320][T21669] RIP: 0033:0x7f8241185d29 [ 1461.807739][T21669] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1461.827361][T21669] RSP: 002b:00007f8241fcd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 1461.835771][T21669] RAX: ffffffffffffffda RBX: 00007f8241375fa0 RCX: 00007f8241185d29 [ 1461.843730][T21669] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 1461.851694][T21669] RBP: 00007f8241201b08 R08: 0010000000000016 R09: 0000000000000000 [ 1461.859655][T21669] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1461.867617][T21669] R13: 0000000000000000 R14: 00007f8241375fa0 R15: 00007fff51f1bae8 [ 1461.875583][T21669] [ 1461.878754][ T116] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 1462.049486][ T116] usb 6-1: New USB device found, idVendor=045e, idProduct=02bf, bcdDevice=7b.41 [ 1462.061951][ T116] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1462.073565][ T116] usb 6-1: Product: syz [ 1462.084089][ T116] usb 6-1: Manufacturer: syz [ 1462.089634][ T116] usb 6-1: SerialNumber: syz [ 1462.102020][ T116] usb 6-1: config 0 descriptor?? [ 1462.110067][ T116] gspca_main: kinect-2.14.0 probing 045e:02bf [ 1462.311773][ T116] usb 6-1: USB disconnect, device number 83 [ 1462.402220][ T3563] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1462.451881][ T3563] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1462.521400][ T3563] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1462.580601][ T3563] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1462.685909][ T3563] bridge_slave_1: left allmulticast mode [ 1462.691633][ T3563] bridge_slave_1: left promiscuous mode [ 1462.699112][ T3563] bridge0: port 2(bridge_slave_1) entered disabled state [ 1462.711909][ T3563] bridge_slave_0: left allmulticast mode [ 1462.717797][ T3563] bridge_slave_0: left promiscuous mode [ 1462.724183][ T3563] bridge0: port 1(bridge_slave_0) entered disabled state [ 1462.941273][ T3563] . (unregistering): (slave bond_slave_0): Releasing backup interface [ 1462.954955][ T3563] . (unregistering): (slave bond_slave_1): Releasing backup interface [ 1462.964435][ T3563] . (unregistering): Released all slaves [ 1463.258418][ T3563] hsr_slave_0: left promiscuous mode [ 1463.264628][ T3563] hsr_slave_1: left promiscuous mode [ 1463.273176][ T3563] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1463.284428][ T3563] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1463.294719][ T3563] veth1_macvtap: left promiscuous mode [ 1463.303536][ T3563] veth0_macvtap: left promiscuous mode [ 1463.309172][ T3563] veth1_vlan: left promiscuous mode [ 1463.314418][ T3563] veth0_vlan: left promiscuous mode [ 1463.439694][ T3563] team0 (unregistering): Port device team_slave_1 removed [ 1463.480735][ T3563] team0 (unregistering): Port device team_slave_0 removed [ 1463.752901][T17350] infiniband syz2: ib_query_port failed (-19) [ 1463.982349][ T3563] IPVS: stop unused estimator thread 0... [ 1465.776616][ T5176] bcm5974 2-1:0.0: could not read from device [ 1465.782724][ T5176] bcm5974: mode switch failed [ 1465.791613][ T5895] bcm5974 2-1:0.0: could not read from device [ 1465.805915][ T5895] bcm5974: mode switch failed [ 1465.816912][ T5176] bcm5974 2-1:0.0: could not read from device [ 1465.823304][ T5176] bcm5974: mode switch failed [ 1465.842380][ T5895] input: failed to attach handler mousedev to device input88, error: -5 [ 1465.853122][ T5895] usb 2-1: USB disconnect, device number 33