last executing test programs: 25.609058394s ago: executing program 0 (id=150): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0082, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000140)="280320000a00140000007ef506be00000000000000000000000000143baa111f1f858ce632f47042195eb3cf545a41b6d78839980700e67bee78895e16f37fe8", 0xffa9, 0x400c010, &(0x7f0000000080)={0x11, 0x3, r2, 0x1, 0xe5, 0x6, @random="76caa646ae4c"}, 0x14) recvmmsg(r1, &(0x7f0000003c80)=[{{0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000001740)=""/234, 0xea}], 0x1}, 0x5}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="080088a2"], 0x4a) 24.897123326s ago: executing program 0 (id=154): prlimit64(0x0, 0xe, 0x0, 0x0) time(0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000f00)=""/102400, 0x19000) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140012"], 0x48}}, 0x400400c0) sendmmsg$alg(r2, &(0x7f00000000c0), 0x492492492492627, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000b80)=@filter={'filter\x00', 0x42, 0x4, 0x2f8, 0xffffffff, 0x98, 0x98, 0x98, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'netpci0\x00', 'nr0\x00', {}, {0xff}, 0x0, 0x2}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@ip={@empty, @remote, 0xff, 0x0, 'veth0_to_batadv\x00', 'bridge_slave_1\x00', {0xff}}, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x9}}, @common=@unspec=@limit={{0x48}, {0xfffffffe, 0x7, 0x0, 0x0, 0xfffffffc, 0x0, 0x3}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@inet=@socket1={{0x28}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x1ff, 0x2, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) 22.431445766s ago: executing program 0 (id=165): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(twofish)\x00'}, 0x58) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$kcm(0x11, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newtfilter={0x6c, 0x2c, 0xf3f, 0x70bd2c, 0x25dddbbd, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0x3da48c8682330ab8}, {}, {0x7, 0xfffa}}, [@filter_kind_options=@f_basic={{0xa}, {0x3c, 0x2, [@TCA_BASIC_EMATCHES={0x38, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0xd80, 0x1, 0x1000}, {0x9a, 0xf, 0x8, 0x0, 0x2, 0x1}}}, @TCF_EM_NBYTE={0x10, 0x2, 0x0, 0x0, {{0x1, 0x2, 0x1}, {0x7, 0x0, 0x1}}}]}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20045080}, 0x4880) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x448, 0x190, 0x0, 0xffffffff, 0x2e0, 0x238, 0x3b0, 0x3b0, 0xffffffff, 0x3b0, 0x3b0, 0x5, 0x0, {[{{@uncond, 0x0, 0x158, 0x190, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'bm\x00', "0d01d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x76, 0x2, {0x1}}}, @common=@unspec=@addrtype1={{0x28}, {0x4, 0x400, 0xf}}]}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @rand_addr=0x64010102, @loopback, @gre_key=0x3, @port=0x4e20}}}}, {{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x64}, 0xff, 0xff000000, 'veth1_to_bridge\x00', 'ip6erspan0\x00', {0xff}, {}, 0x11, 0x2, 0x78}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @remote, @local, @port=0x4e20, @gre_key=0x6}}}}, {{@ip={@loopback, @private=0xa010102, 0xff, 0x0, 'veth1_to_hsr\x00', 'batadv_slave_1\x00', {}, {}, 0x6e, 0x0, 0x4}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @remote, @icmp_id=0x67, @port=0x4e23}}}}, {{@ip={@multicast1, @broadcast, 0xff000000, 0xff, 'veth1_macvtap\x00', 'bridge0\x00', {}, {0xff}, 0x73, 0x2, 0x20}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0xc, "1542", 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x26}, @port=0x4e23, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4a8) syz_ublk_setup_io_uring(0x73c1, &(0x7f00000003c0)={0x0, 0xcd3b, 0x2, 0x2, 0x297}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) munmap$IORING_OFF_SQES(r2, 0xc5059c) 22.189243535s ago: executing program 0 (id=167): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x141) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x1004000, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r2}}) vmsplice(r2, &(0x7f0000000180)=[{&(0x7f0000000100)="b4", 0x1}], 0x1, 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) bind$inet(r2, &(0x7f0000000140)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)={0x1c, r1, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) 22.108107038s ago: executing program 0 (id=168): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}, 0x1, 0x0, 0x0, 0x24008810}, 0x8010) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=@newlink={0x50, 0x10, 0xffffff1f, 0x4, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4000, 0x400}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x488c5}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=@setlink={0x2c, 0x13, 0x5, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, 0x312}, [@IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18010000000000000000000000000000850000007500000095"], 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) sendmsg$inet(r8, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5], 0x4c}}, 0x884) r9 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r9, {0x6}}, './file0\x00'}) ioctl$PPPIOCGCHAN(r10, 0x80047437, &(0x7f0000000040)) r11 = fcntl$dupfd(r9, 0x0, r9) ioctl$SG_GET_REQUEST_TABLE(r11, 0x2275, &(0x7f00000018c0)) 21.884350179s ago: executing program 2 (id=169): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000580)={0x48, r1, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0xe}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x2c9}, @NL80211_ATTR_STA_WME={0xc, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0xfd}]}]}, 0x48}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7000000002060500000000000000000000000000120003006269746d61703a69702c6d6163000000050004000000000009000200f3797a3000000000240007800c0002800800014000008e020c0001800800014000000000080008400000001005000500020000000500010006"], 0x70}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x3, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 21.738340685s ago: executing program 2 (id=171): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x1, @remote}, 0xa}}, 0x26) sendmmsg$inet(r1, &(0x7f0000005f80)=[{{0x0, 0x0, &(0x7f0000005dc0)}}], 0x1a000, 0x8040) close(0x3) syz_emit_ethernet(0x0, 0x0, 0x0) r2 = syz_usb_connect$hid(0x1, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000008701700ff00000000000109082400010000000009040043090300000009210000fe01222900090581030000000800"], 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x305000) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) io_setup(0x2, &(0x7f0000000500)=0x0) syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x763, 0x2081, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x82, 0x70, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x10}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x3, 0xa, 0xb}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x2, {0xa, 0x25, 0x25, 0x401, 0x5, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x6, 0x29, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x6, 0xbdd}}}}}}}}]}}, 0x0) io_submit(r6, 0x1, &(0x7f0000000940)=[&(0x7f0000000400)={0x0, 0x4, 0x0, 0x5, 0x9, r5, 0x0}]) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), r3) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f00000000c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001640)=ANY=[@ANYBLOB='D\n\x00\x00', @ANYRES16=r7, @ANYBLOB="05002abd7000fddbdf2501000000060006004e240000fc0908802804008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0004098070000080060001000a00000014000200fe80000000000000000000000000000a0500030000000000060001000a00000014000200fe8000000000000000000000000000aa0500030001000000060001000a00000014000200fe8000000000000000000000000000aa0500030003000000a0000080060001000a0000001400020000000000000000000000ffff640101010500030000000000060001000a00000014000200fe8000000000000000000000000000bb0500030002000000060001000200000008000200ac1414aa0500030002000000060001000a00000014000200fc00000000000000000000000000000105000300020000000600010002000000080002000a0101020500030001000000d0000080060001000200000008000200ac1e01010500030000000000060001000a00000014000200000000000000000000000000000000000500030000000000060001000200000008000200ac1414bb0500030006000000060001000a00000014000200fe8000000000000000000000000000420500030001000000060001000a00000014000200fc02000000000000000000000000000105000300020000000600010002000000080002007f0000010500030002000000060001000200000008000200000000000500030002000000ac000080060001000200000008000200ac1414aa0500030001000000060001000a00000014000200fc00000000000000000000000000000005000300020000000600010002000000080002000a01010105000300000000000600010002000000080002007f0000010500030001000000060001000200000008000200e00000010500030001000000060001000a0000001400020020010000000000000000000000000001050003000200000064000080060001000a00000014000200fe8000000000000000000000000000bb0500030001000000060001000a00000014000200ff0100000000000000000000000000010500030002000000060001000200000008000200ac1414aa05000300000000000c010080060001000200000008000200000000000500030001000000060001000a00000014000200fe8000000000000000000000000000410500030003000000060001000a00000014000200ff0100000000000000000000000000010500030000000000060001000a00000014000200fc0100000000000000000000000000010500030000000000060001000a00000014000200fc0200000000000000000000000000000500030003000000060001000200000008000200ac1414aa0500030003000000060001000a00000014000200fc0200000000000000000000000000010500030001000000060001000a00000014000200fe80000000000000000000000000002b050003000200000040000080080003000000000008000a000100000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b392208000300030000008c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c24000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b392208000a000100000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b1400040002004e22000000000000000000000000040500807002098094000080060001000a00000014000200000000000000000000000000000000000500030002000000060001000200000008000200ffffffff0500030000000000060001000200000008000200e000000105000300020000000600010002000000080002007f0000010500030002000000060001000a000000140002000000000000000000000000000000000105000300010000004c000080060001000200000008000200ac1414bb0500030002000000060001000200000008000200640100fe0500030001000000060001000200000008000200ac1414bb0500030002000000e8000080060001000a00000014000200200100000000000000000000000000010500030000000000060001000200000008000200e000000205000300020000000600010002000000080002006401010005000300020000000600010002000000080002007f00000105000300010000000600010002000000080002007f0000010500030001000000060001000a00000014000200fe8000000000000000000000000000bb0500030002000000060001000200000008000200e00000010500030003000000060001000a00000014000200200100000000000000000000000000020500030001000000880000800600010002000000080002000000000005000300000000000600010002000000080002006401010205000300000000000600010002000000080002007f0000010500030003000000060001000a00000014000200200100000000000000000000000000000500030001000000060001000200000008000200ac14142d05000300010000001c000080060001000200000008000200ffffffff0500030003000000080003000200000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39221c02098058000080060001000200000008000200000000000500030003000000060001000200000008000200ac1414aa0500030001000000060001000a00000014000200fe880000000000000000000000000101050003000100000040000080060001000200000008000200ac1e00010500030001000000060001000a0000001400020000000000000000000000ffff0a010102050003000300000000010080060001000200000008000200ac1e00010500030000000000060001000a00000014000200fe8800000000000000000000000000010500030003000000060001000200000008000200000000000500030002000000060001000200000008000200ffffffff0500030000000000060001000a00000014000200ff0200000000000000000000000000010500030000000000060001000a00000014000200200100000000000000000000000000010500030003000000060001000200000008000200e000000105000300000000000600010002000000080002007f00000105000300020000000600010002000000080002000a010100050003000000000064000080060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000a000000140002002001000000000000000000000000000205000300010000001c000080060001000200000008000200ac141416050003000100000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b240002000f1b8b82264208ab1a2dce776c03b9f348f500ef8e7606466943f5ba2ae2881e08000100", @ANYRES32=r8, @ANYBLOB="240003"], 0xa44}, 0x1, 0x0, 0x0, 0x4000}, 0x40) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f00000045c0), 0x2183, 0x0) fadvise64(r9, 0x10400015905572, 0x100, 0x3) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0xfe}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 21.564418234s ago: executing program 0 (id=173): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101482, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x3, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="f951830c6b278000000000000020dd4e5c37cf37a4a47a5e382329be000000000085006528747fa356"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0x14, 0xe80, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r1, &(0x7f0000000340)=[{&(0x7f0000000200)="2e1221b23bb601c477d3df163e75963d88a8", 0x12}, {&(0x7f0000000880)='kteX', 0x4}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095", @ANYRES32=r0, @ANYBLOB="1800000010000000000000000000000018110000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6(0xa, 0x80002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000480), 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) fsmount(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xf) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r8, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r9 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r9, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e22d991000000000000a80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 21.28755502s ago: executing program 32 (id=173): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101482, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x3, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="f951830c6b278000000000000020dd4e5c37cf37a4a47a5e382329be000000000085006528747fa356"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0x14, 0xe80, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r1, &(0x7f0000000340)=[{&(0x7f0000000200)="2e1221b23bb601c477d3df163e75963d88a8", 0x12}, {&(0x7f0000000880)='kteX', 0x4}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095", @ANYRES32=r0, @ANYBLOB="1800000010000000000000000000000018110000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6(0xa, 0x80002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000480), 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) fsmount(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xf) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r8, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r9 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r9, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e22d991000000000000a80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 18.478587469s ago: executing program 2 (id=187): msgctl$IPC_STAT(0x0, 0x2, 0x0) syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080320904"], 0x0) mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat(r0, &(0x7f0000000040)='mnt\x00', 0x440002, 0xd) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xc2900, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002a40)=@delchain={0x600, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x1, 0x2}, {0x0, 0x1}, {0x5}}, [@filter_kind_options=@f_bpf={{0x8}, {0x5d4, 0x2, [@TCA_BPF_ACT={0x5d0, 0x1, [@m_bpf={0xfc, 0x11, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_NAME={0x5, 0x6, '\x00'}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x6}}]}, {0x9d, 0x6, "a41f25d22b1bae1b6bfb4a42ad5ba9db462fca41280c331f630e2c9f0be1093117392575082305ebc27660464ef802792ce06133244235023f0f4882fc0a47f4d5e499a8857cd81b0e6fda422cbc53ad098872214190756df6bbd0e760248aa97e200702fd569bd27d4a70df1d4a123ffc42d2592c81751e15e260622f14aeaaca5dc8acab93651fdd1d5614d98f28fc76d402e1028d910282"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_xt={0x144, 0x5, 0x0, 0x0, {{0x7}, {0x30, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x2a, 0x6, {0x7, 'raw\x00', 0x7, 0x100}}]}, {0xed, 0x6, "a5fd64840366fd7ad44f3f053221ded9ced495590e2bc8690a2765e56ded8425cb3eb0e04bbcfec50e639bf373167e617b24eccd260f28bb850873b1e2154b158987d6e585e10ffeaba32641bae47de041e1169d8e4a65b8ce3633a4469c93c5228320c572237d92a9ae6bbc2d2bd3a2d1e27de283017ecf9fca6b2cd8a119dee59702830717b694625f60f5c81f688775c5e292f76a0ffa39e1d2cabd639d1c111c01e0d2f9faa220154db33399242bca9f4fac65c74cb6264c28ac7a50037564c7b417fb61d617d212ab3243c30e0e82d9a12651b74553d539b991a302489af94626e5aac41c53b2"}, {0xc, 0x7, {0x0, 0xeb0757422c733451}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_bpf={0xbc, 0x8, 0x0, 0x0, {{0x8}, {0x14, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}]}, {0x81, 0x6, "5d3aee85a6264cff4a2163adaec321e008985cfa435b8922eeb16f1932265618158a3fe72c442a68b182e8f673f9251a03dc831c5947be17ca906c3dcb99adb55bc5f0ad8886f235f45d7e29bb727715f2e7a3200ac63eb79f7a023835874514b60b0177c40370157c0c21b37875e7e4a2e75b3cc54be7d719fa695469"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_tunnel_key={0xbc, 0x8, 0x0, 0x0, {{0xf}, {0x48, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @mcast1}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @private0}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @local}]}, {0x45, 0x6, "51719d53a2b05eda58a80a40d29b01394b8749d7d9ef9f47cce75187b6f333f4bfe797fa4227bf38cf0b71e1b4888d8d1ed410a788c182ba498076ca9ab3d63a8f"}, {0xc}, {0xc, 0x8, {0x3, 0xddc47d017e85c037}}}}, @m_xt={0x214, 0x13, 0x0, 0x0, {{0x7}, {0xc0, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x6c, 0x6, {0x9, 'nat\x00', 0xef, 0x7, "859b467c76be5255b2d4f6101cf6d6cb72c6b46512ecba82df24523b07075e859fd68154d7171a2ca3415ec79cc8ff85b058dae9f1d49e867787957d80637320c037"}}, @TCA_IPT_TABLE={0x24, 0x1, 'security\x00'}, @TCA_IPT_TARG={0x2a, 0x6, {0x8, 'filter\x00', 0xd, 0x6ccd}}]}, {0x12d, 0x6, "3f664d65ad79178dad4d7815e4c50308bf9a3f35e2b90387936ecd06a67777e4d51dfa578f9f5021013f0c9a057b8f82000000000000000000000000007f81188b2cda51230f1a7c6035500fcba2a0c1e8df61c1a24ebdf1b89f29be8825795496195eb50cd86bf94eb7c2f2f3cd2a74145b5e23908868d084fa1aeb5cf35b1d008b539cc91d0cb1e1304dc65d40df4446cb4725e42a047c2fc7ba3b1e387f5628b3c86a55e4972d016f00000378526b1797e51bbca47fa852a731a6d7b7678b453e7c5c4642b54dcee1032681e6853f7c2f7f8aa5667dceac0f2e9f55d94a322ff7f926c35a7b8745989c4b1c88fbc02fb1d34f0dc8917bc6a1b7ffa0d4bbddada56c96a3f61363e90cdb6db84cab4aff681e54e5af5ebafd066309a6e03c9bdba1eb03c25e75d04d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}]}]}}]}, 0x600}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) ioprio_set$pid(0x2, 0x0, 0x1000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="38010000000101040000000000000000020000002c0001801400018008000100ac14143208000200ac1414000c00028005000100000000000600034000020000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000000000cc0006"], 0x138}}, 0x4) sendfile(r1, r2, 0x0, 0x201f00) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000000)={0x13, 0x5, 0x1, 0x1, 0x9, "020000006800006dce8d052b7ff20000f5ff00", 0x10007, 0x8}) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f00000000c0)=0xf66, &(0x7f0000000180)=0x4) 15.204127972s ago: executing program 2 (id=193): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x141) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x1004000, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r1}}) vmsplice(r1, &(0x7f0000000180)=[{&(0x7f0000000100)="b4", 0x1}], 0x1, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) 14.603702871s ago: executing program 4 (id=196): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x2}, 0x8) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000380)={'syz', 0x1}, &(0x7f0000000200)='q\xa9', 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000000100)='X', 0x1, 0x48000, &(0x7f000005ffe4)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000040)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x88, 0x1, 0x0, 0x3}, 0xe) shutdown(r5, 0x1) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000000)=0x41dc, 0x4) recvmmsg(r5, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x406, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@ifindex, r4, 0x26}, 0x20) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8923, &(0x7f00000000c0)={'bond_slave_0\x00', @remote}) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) 14.574039053s ago: executing program 2 (id=197): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e24, @remote}, 0x10) (async) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) (async) sendmsg$inet_sctp(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000000c0)="c8", 0x1}], 0x1, 0x0, 0x0, 0x20000855}, 0x40041) syz_io_uring_setup(0xf00, &(0x7f0000000000)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) (async) r7 = fsopen(&(0x7f0000000040)='debugfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x1, 0x3) fchdir(r8) (async) r9 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r9, 0x402, 0x44) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="08000000b2aa2d32397e916a92d1ccde58127b9a50da9438ebf74e1860417082328aa0cdd5d1767bc925e365f791efc8b1353300a86e816811dd10745ba5b72e6e", @ANYRES16=r5, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r6, @ANYBLOB="0800050009000000"], 0x24}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) r10 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r10}, &(0x7f0000bbdffc)=0x0) (async) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f00000050c0), 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r12, 0x8004e500, 0xffffffffffffffff) (async) r13 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) write$dsp(r13, &(0x7f0000000080)="cd", 0x1) (async) setsockopt$inet6_buf(r4, 0x29, 0xd2, &(0x7f00000002c0)="f520ea1cfa6db68768b591a8a8da493aebfa430f9afd295564b647eeb2614d4d3bdecb0790fb8bbed6e83b8011131fb0d6af30f5be474a6245f8cbc339d7c49118d5924c29627ae5187598f87625a40ab19bf466820c870b7eb77266f9dd70b39707e20c8c658d11b0ebf82066f5f9d77c14e838cd423118165297a654f79005ca1ca5a3b782b8f43b77fa97b170fdd1b28990ade78625764c42b42cf943d421b943dc4790deb94b584c8bd84e277806f9fbcf00cdc5e545c8263b46358876510a7cc34a56c6", 0xc6) (async) ioctl$SNDCTL_DSP_SYNC(r13, 0x5001, 0x0) (async) timer_settime(r11, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) (async) sendmsg$NL80211_CMD_VENDOR(r8, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x48, r5, 0x8, 0x8070bd2f, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x6}, @void, @val={0xffffffffffffff93, 0x99, {0x7fffffff, 0x7e}}}}, [@NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x58}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x4}, @NL80211_ATTR_VENDOR_SUBCMD={0xffffffb1, 0xc4, 0x7f}]}, 0x48}, 0x1, 0x0, 0x0, 0x44080}, 0x4800) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) 13.530929522s ago: executing program 4 (id=199): openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_QUERYSTD(r0, 0x8008563f, 0x0) 13.207718662s ago: executing program 4 (id=200): socket$pppl2tp(0x18, 0x1, 0x1) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000100001002abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="ad21000000000000140003006e657464657673696d30000000000000080004000e04000034001680300001802c000c"], 0x70}, 0x1, 0x0, 0x0, 0x4048000}, 0x800) ptrace(0x10, r0) ptrace$getregset(0x4204, r0, 0x202, &(0x7f0000000580)={0x0}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000ac0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'dummy0\x00'}) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000240)={'multiq3\x00', [0xfc, 0x4, 0x0, 0x2, 0x44, 0xf3, 0x7a, 0x4, 0x80008, 0x5, 0x2, 0x64, 0x401, 0x1, 0x80006, 0xfd, 0x6, 0x3, 0x2, 0x80000002, 0xb740, 0xca9d, 0xd9, 0x20001e58, 0x8, 0xf39c, 0x8003, 0x1539b804, 0x5, 0x1, 0x2]}) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000140)=ANY=[], 0x0, 0x3c, 0x0, 0x40}, 0x28) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1d0000000400000008000000000000000100"/48, @ANYRES32=r3, @ANYBLOB="0100000002"], 0x40) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000003c0)={r4, &(0x7f0000000300)}, 0x20) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r6, &(0x7f0000001840)=ANY=[@ANYBLOB="0800080006000600080014000000450a0946006600000b29907864010101ffffffff3297e3ba0fa8a2e71bd9fe1a399b5110420b70460c0dad392d66248a43540df968e7fcaab34569c0e36170578c0d3c546a98b26295e2592f360905866eb4720fed03a977a3df4224895629fd6ccec64f13a999f18f518e3ee28798381975e862f1db9dccdb2f1c1fb60f5ffc7a339d40a8bd1f24cede8a32f186f142e194d4fb48224759faf813ea80e6a853e79b4fe27fe3e1aec5897b314a7f0d515b07b1835986b4885e9826d902c40f16cd77c58b6433ab039955ce9db11f36f459e7114ace6c9989eecea80a81fd39f339356c7c3391af83da2486503a7973f6db4806cf3e5ca94cf7e1f79fd00decd76100c18251a59d1474caabf4d3ca6a9a9885df710e68c5b0dc11832dbb5eecb5c88c2f8f02bdbd88569ad4a740359cbca8c378118220d73bdd1e661c3a74f77aa931b11cd38119b0f084bb96e84803fca6566c33ee1e4e34ab0253fbf24f9f5974af5e1fc2a43a4ec9dd9928a8f38a128ea27c429300ae5a6bd7740471f973d8224b2b07879f4fbe7dcbed776a72ebdc713bcf1d7aa45b01c32a1003e6670d58510bd79ba2fde5cb2b82cef2cc315648f4e9d96d848ba327949b8926253cbdef6888a8982108b6ac7a1108533dd3fe125002e2e286362d1055082a9d73ec5ac3080f2a501ff27250b62c8965f371cf92b32d6422d79f66261eb08a2f8fe50049e102c69ce703d116d0834208cc957d0f1376457a90245816d7642412897fdd2f982fdfbc3af65aa0446b00c767b79aec40e460887ea02188e3a0960eea39b144859467b881978378c9fd593259e0f63148179fe2c2f6d40987b63a6e384e63027f03d8039d707522942d5dc88fd842524d006290b6a65e9cc86cc5b401a60ec4aedfb3bf4d0447bb681810a16b9684b72c2f4593ef834a0203e78cd1d9dbc978e9ae8f3ab62c07f1e41d59470decee7b0cc41ac49e4b7589ab6da65849f62ec217bb39ed161e7d337822d96badbd74d66451ea9a74bed591dc9631bf639dcf7846ee428a9fa55bfceedf3b1c23642f3b58dd0a7273664c6c49c9160a4b9cc5b72d0210e305b94e2cb09ae1d4af9d365b5093851f229c8c30aef75d45ccdbab4b86d801a9ad3b27f26ba601d531c0743717aa7aae29d37f496fec7682c5a1abd321ad61941a2d23fcac6af1d1875e308c8d8c64a5152be47b59c09d293f46b857310a99f1885f0a49d432aa0d39a3e8fc885e75e66b63215133175a19267c8d0adf7d8f644e742ed5369d1405e99e63b78727f135e0243f24d9ce354a1562102ee8de4c191508343b86bf7e7519ddd770ce55e17e590561b2f437194c97ad46622a6ae3dd68d9993e6744954f4cd308bd6594fdccedc578e80aed274a65219697229059723ac37d535cca0e9c314e7941b4160bbd2ffba71f26ffe3228431bc81463078ad70583277ef18bce23ca2e5b9a00670956ea8e0e2c739c006106c8c9ee3f92ba728d8490742b74a9a18cbedfc4e69bb87e0da4c7dfb964374c28c837d4641fb99a19b233675f8526af395335e0185cf3934805442ac379980b687a7128e53284ba9e741b5fe9bc969bfbd55cbce76842915e076e2adf844338d16d3802c681bafdcc60465bd34dfc2d1c069ceee40060e0570fc1275ccabfe3f9be3e84ceedf72cd649c082232008e2b0c94594588c00e0fe911bbf1c12eb6c37ce05674a7597feecf27f5e051ffa824d9ff93638dfa9a84c77562aa2cf897f55a97b79c18544ad03480e1011b8f93e0ead9c2c6672448f585c5803ae99be777fbc662ef4450c1e936ed8b3c8047f00e72adc84561f417f8e5e1dde4967005d96a64fc75d9f486b3ebdb5904a0a56ec48542f0efce939f66fd69259e7376ad37e84434ea90f35b2d3bd63b5c36b267d8f2c7dc5a50b46e00ed086dff8b039e07b84c60611269d4f282ad04dc8e0b481eece2f8a614734be73617f0ad5be195446b09dca4cf1f32653dd3e188aece76f3014deb2ba61744835c0f735234b6a4637c948a7b4fd4203b286ca87d669e325d70277075b094f59eb1dff6c9c05c40d5e464c563df79486e1a32e6ed9bcf675aac7968b4e98dc4e210215b0d3b6a2525b2e3df11f3f1490eb39cabffbe32e23659121fde8e4e346e0f595aaf3666a5f6f118c1a1128039502ac04c40b85eb4c54e6c95b8d1c2aac74ae9e1c355ccde9d54d5d833293f5df09224482179e5bcd8e227c99172a6e14c2cd4e6462ceb0a905a1d64804840ce62e350c6efac10a7fcb029f84af64e2256d45afd3b3f59379895740e0cd2fd24c63264f785bb6e3f40ec72ed67d1a7d87dd264743d9c951cb5aa8bc6f1d1bc9b23303d5aa7f8f6f961326757456057000cb2bacf78cc229002777e932c2640b8dfa793846ca49fa93996db95104a8808a1906b19df17e754b90582b6c49efb3ddce067dd9292291cfd2bb0323ce8098f29e4fce0de31cf5c7e2e2da5d0d0996a8be776de8fecfd3ce68e80d21f1701f6b90ac51278abbd727d19415e0ebe001b990b177b8db0c592b18a4b5e4a6221902362e5b20e6e6f2131a5a5e03c1150b179ef40c933c2fef1b79de738652ec4c32565f5cf751a11db177099c4e2e5bd7616cd0dd501d5bfccf5691de3cca590365328648baf8a9487a3c212193c9bb837594460967e823067a9465eba7001eaf609a810488ef5c147aaa5e9e8c75b585ac3582b6915e20b5aa2f79b7a94857122988c56dbce1ea52de1a56652e839bb853be3ee16052b33fb83ca54d8e4e19440a5e81492107043a66286f63ca87a1f7b8a4e9547a7eb6005419cfd28cb37e9e374f4d0143973286e87070754025c1a6fccfdc6858eaca8c35ecb19584ce7141cc79a5bc813469161b87a19fc21f3373d1f25b3427916dd1be2a589b70ea3b39fcc7801e13beaf19b76164faf3dc4ab8faa5648d24eddd6caceaa0d5ac9cad633c19a4a4d059ee823a49b7cf82c5777d376c111f58ea8fd473429907852301a2c856f27bd0c687ab5be0e2bbef64ddee1601375a4440e3f59d60f57caebfe457f82432523ec4a61cdbb7f1e91e4b05fda892df131c274b19929d26f7a5a6d3ca487983f729601ed9bb4bf5c1cc3d453d406e9534688dec6a2dd0b9db149365c125a95e129565e62cc91f7d960abe1055b730ae0994e7eb08392d5745d0e4f529c4defc3d3e43d0815b0cc63effa88d20c13b14e780c2f6c89a1ee5e4db45a5c272186cc3e51b13dab3add5f467e8ca0f4c45a1fc76db2f0cbf794102946aafcd8cd8a3e935a606b9721645c4d550ae0907f345593736506efc626498c974753d474a73626041d3a54f8fb50de2a6335611a3779da3a02daceb2256d9b102d4d30dd3cd389a04b1a7a6076879f36534bb3379debb46ed1fa2c40096c752017dd024345c58313b43070ff7bef94dc3cafbe6ec20d59e5ea3c196ba3b783bfa87384407efc664cd350c80ac397516018e35371956e414755cde304d2a228c1540ba6fd6a7402d11c666964f024da4c016eb556ba2c5fab86c60c12efb1496295d80f0383526e8e0fc55a287bbd3cb966a916f57958d8b6ef97aa0c4b47f7746bab6b99698c1c96b25c4e2e084147866fe0970b109dd26984adc0758eb6442712cc46dcd8ed3038b0595252eed1b8a46525862662d1e6d1ba66ac341f8d27853eed54854f488f079bd48df6ce7a4be8b1b61fd23a2dc4d3ade0992011539cc63f80fcfc75008c20cb639348cb218f8f476a6d56917f4ca07e67fc20ea2e9642eaf2182b397e279f5f6c70438fb8aa39cba788588c181461ea7efe1a0dd5b95eb26f7158b91012f7ce0ee1b4e79ce4da377bea4551738a0f491a84f19b3be9827b4469c299527aa9c20b8bf12f919976a0356bba720fb91010763c79bcbb10d89280f0f97cdd19aa0d54828b308195fac170613cf4b515e340a9ef2c97f618a9f50b30ae34ebeed9a38b4c6969680accc740b154ecb014fb5d543a59ccb98a7de2823a2dec39f331cb503eb74fef61262c6d4050bc723caee834eb28c64ce007f6027375e936b62387cf1778970e88b0574a0106d4c855be7425767c551b2fa644d9d8a59f787e7610581b768057d229673344571c3d6e3f10975b2859f568398b1f38f89524d9ad0c1588617c3883a1227b714c81cdf28da54f33968c1c50f28da01c308eb31d319b3e77f96bec001c9300000000000000009cc0062283ac112868592619db14d629c47bfb793a723dcd2f7b07ae4ec14ca3ef4b955ea5b2b153a279b080f6236d418075b86850974c8850efb306d5c304e726bf2643b4403e6d46b0e0395b02e93308b4b2c3e957308d497dc51c753344a7878f1f0c91295fd76e3d1cc9ef813161c6b92b7ea6068ceb97d8f45a4ce57af7d7632d699951f7fe3c71c3a32b014c74425c67e5030546b10cf7edcec2eca5ba31dc62c08f83f35bc2e36b93f15f071bc2537ebe9ca19f86dce4e84272e10323d0ceaa2cc47fe4f6ad101d454c761f9863e94af91199ce5f12469bca7ba39314b84aa7efa4bdc18f7700c19511d48d6132450111d70401a8ac73565d5386ca12345e884d08b23f9c901000a95eb4167865e58c28b112f47c96beeaa6657c923e25e56529107c5c30e65bb485d5ed21b91332db4e09df7e59dcfa05c994570deb3f9b838e22ae4abbf9a9a8c319cc9112c8dba7c2278f78b9578b0254c46a4c04b8fa4fedad6bd275f70b1618971ef6503379bfb0a508c9944328af2c820091a89e3f75e68e7f980ddc9154d273f7f2ce7a6294aefe93136860786679b80e41f6636ff45efeacfb52e2ba2bd9bd9c9030079a46caca5c4b340c17d01ba8ecbc5c561b2038481a8321c009d12136a3ad5461881d998eeaac5236fdcd8f81fb5e53848bb096d9198fd0d38830d1809f2a632b31e2b67754140c907ed58aead048b2d8af9a1c407e48db815212cfdcca97222dabdfe01f311a73e1e82c3e189ec5add48d3f8190eb9e14b58e540f7f1388a7c687629eadb19fd8a133dc8177629270ecaabff79efb6c1f750d89b9e6c5f34c6238066f8e3e425e46a27b3c0d2e9e2ed3cffe2a6f39b8e0137ea5de689b94107fb4748a5feb3902f0feba64dae4c2e69bc8d86463575c6b0ef4a8a64fef41121e57a8c67eda07e9fc8f98299677de198ea0a649ef3c00591940b2c27ba1414aaa1633deb52e3a44cfa8d7a00d014317c026a7d7f42a34b97128e1bf9cda4d8315819ac73ed5061bf9b5631d07b09b85b78ff1b6eb86e9e8c4faa0f991cd6fa0b0eb71b39c20ca9bc7c156f3bd255a5b408df172396bafd7f0fb11c6eaf1eb0a06576d37bee00424bf699584b1dfed68f0d8d8a35f0427c783fe2d79b4373628971e87501a5e4bb05b5058d0b2132741f26e76065b6f4017d963c8ee5605c4c5b6eebb96fca0a41893cb6add3fb0d728abeb860f22cedbd36e464bdaf124a7041460f7af3d64b54e9ffd240b5afad9baf6e5dd8406bc1b205da5848f51fc9dd5197716e144e1b0386614bd3cfd5ddb80ada1e5ca74c8960093a553b1f6288aa7f53663cdd867f658e51b95772dc7a6fa45fa03e14988a33250e6c16fbf0351769080d64ddfbdbf77e1215563bf2e82ecc38a682846d7e2e2ac4e87d715f97f15e84c3df04affee49612a735907d3c4d310a54a6f609873ad56f29a138f4d5661f6865e03048796e4284c5d6d072d572fea190b1c366262296697bfffbc33251a84c7a1c0fb3e6afcc315abec64f12454360db8b392c75b87205a8cbed2e0b2c8988d019ac2b53e7f62e1a98f36c755197e87ead8f50c5599"], 0xfce) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r5, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r8 = syz_open_dev$dri(0x0, 0x0, 0x80001) ioctl$DRM_IOCTL_GET_STATS(r8, 0x80f86406, &(0x7f0000000780)=""/4096) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) 12.993504653s ago: executing program 2 (id=201): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4001}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000180)={'syzkaller1\x00', {0x2, 0x0, @rand_addr=0x64010101}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_inet_SIOCSIFBRDADDR(r2, 0x891a, &(0x7f0000000000)={'pim6reg\x00', {0x2, 0x4e24, @broadcast}}) getpid() bind(r2, &(0x7f00000000c0)=@in={0x2, 0x270f, @rand_addr=0x64010101}, 0x10) listen(r2, 0x5) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="0000080001031400e803140008004500005c000000004084b019640101026401010104d2270f000000000000000002"], 0x6a) 12.6582781s ago: executing program 33 (id=201): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4001}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000180)={'syzkaller1\x00', {0x2, 0x0, @rand_addr=0x64010101}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_inet_SIOCSIFBRDADDR(r2, 0x891a, &(0x7f0000000000)={'pim6reg\x00', {0x2, 0x4e24, @broadcast}}) getpid() bind(r2, &(0x7f00000000c0)=@in={0x2, 0x270f, @rand_addr=0x64010101}, 0x10) listen(r2, 0x5) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="0000080001031400e803140008004500005c000000004084b019640101026401010104d2270f000000000000000002"], 0x6a) 10.241674783s ago: executing program 4 (id=206): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x141) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x1004000, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r1}}) vmsplice(r1, &(0x7f0000000180)=[{&(0x7f0000000100)="b4", 0x1}], 0x1, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) 9.82280441s ago: executing program 4 (id=209): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000002b7030000000000008500000083000000bf09000000000000550901000000000095000000000000006100fcff00000000bf91000000000000b7020000000000008500000000000000b70000000000000095"], &(0x7f0000000100)='GPL\x00', 0x8, 0x103, &(0x7f0000000140)=""/259, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'dummy0\x00', 0x0}) r3 = gettid() r4 = socket(0x10, 0x803, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4400000010000304f9fff2ffbedbdf2500007400", @ANYRES32=r2, @ANYBLOB="089805000750050008001300", @ANYRES32=r3, @ANYBLOB="08002c000500000014000300"], 0x44}, 0x1, 0x0, 0x0, 0x44882}, 0x4000010) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x10c2062, &(0x7f00000004c0)=ANY=[@ANYBLOB="66643d54ad57f87bcfd1d03d854e3dc3a8a69d339f88adee45d8117df3a31e2bb9082d5ddeb2a0a2401213f88279106bfad0dc24194c99ca7e3e20bb6822f3b296dc4a93909d478429c97f537f58563c73deabea8397bedfdf39686ac98d79f5003734925bc6a1c3d510f2d12c601f997bbb79930c06a24ceab722e66140baf717b79c555670342db61a96287bc1df292feeeed4b8f35ab80ca46b85eb82facf683b675a2c572ca939fbd1fabe920bb0d07a4dcb6f2a7c07e17f9dce345b75dbded4afadd922ce158f67bc27c7f490945de40de1bf43653c38d07b6178a3a13c60b277db2958f3d705db4eb92f99bb9079335c0a6403fb4eb900ffd7a6c0d798bef2c12c82e61da1f0c33f2fc3922567d13e7460f5b0d67d06dbaedfb7767d4f7a586d8f99118e43e9ac5b4d015060c6acd54115ac6ed1", @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000040)={0xffffffffffffff01, 0x0, r6, {0x7, 0x1f, 0x0, 0x490420, 0xfffc, 0x4, 0x6}}, 0x50) syz_fuse_handle_req(r5, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) syz_fuse_handle_req(r5, 0x0, 0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x200000005c831, 0xffffffffffffffff, 0xd85fd000) fallocate(r7, 0x100000000000000, 0x460e, 0x3) arch_prctl$ARCH_GET_UNTAG_MASK(0x4001, &(0x7f0000000040)) 8.949277991s ago: executing program 4 (id=210): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000005780)={0x0, 0x0, &(0x7f0000005740)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000070000040900010073797a300000000014000000020a010100000000000000000000000320000000000a01010000000000000000070000090900010073797a300000000024000000160a01020000000000000000020000080800074000000002080007400000000110020000160a01040000000000000000070000020900020073797a32000000000800074000000001480103800800024000000008080002400002000908000240000000080800024000000a1108000140000000000800014000000000900003801400010069703665727370616e30000000000000140001007663616e3000000000000000000000001400010076657468315f746f5f7465616d000000140001006272696467653000000000000000000014000100766972745f7769666930000000007a412b200100766c616e3000000000000000000000001400010064766d7270310000000000000000000008000240000000047c000380140001006d6163766c616e3100000000000000001400010076657468305f746f5f626f6e64000000140001007465616d5f736c6176655f30000000001400010076657404315f766972745f77696669001400010076657468305f746f5f7465616d0000001400010069703665727370616e300000000000000900010073797a30"], 0x2b0}}, 0x4000) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000001a0001000000000400"/28, @ANYRESHEX], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x29, 0xfffffffe, 0x0, 0x0, 0x0, 0x1, 0x1}}) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x5, 0x0, 0x0, 0x1000}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001600)=ANY=[@ANYBLOB="280c00001a000100000000000000000002dc4a"], 0xc28}}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r4, &(0x7f0000000840)=[{0x0}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000004, 0x42031, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x88) r6 = dup2(r5, r5) ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0x40000a, 0x3, 0x40000000, 0x10}) ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r8, 0x0, 0x2, 0x6) write$cgroup_pid(r8, &(0x7f0000000000), 0xffffff98) 8.588855679s ago: executing program 34 (id=210): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000005780)={0x0, 0x0, &(0x7f0000005740)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000070000040900010073797a300000000014000000020a010100000000000000000000000320000000000a01010000000000000000070000090900010073797a300000000024000000160a01020000000000000000020000080800074000000002080007400000000110020000160a01040000000000000000070000020900020073797a32000000000800074000000001480103800800024000000008080002400002000908000240000000080800024000000a1108000140000000000800014000000000900003801400010069703665727370616e30000000000000140001007663616e3000000000000000000000001400010076657468315f746f5f7465616d000000140001006272696467653000000000000000000014000100766972745f7769666930000000007a412b200100766c616e3000000000000000000000001400010064766d7270310000000000000000000008000240000000047c000380140001006d6163766c616e3100000000000000001400010076657468305f746f5f626f6e64000000140001007465616d5f736c6176655f30000000001400010076657404315f766972745f77696669001400010076657468305f746f5f7465616d0000001400010069703665727370616e300000000000000900010073797a30"], 0x2b0}}, 0x4000) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000001a0001000000000400"/28, @ANYRESHEX], 0x1c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x29, 0xfffffffe, 0x0, 0x0, 0x0, 0x1, 0x1}}) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x5, 0x0, 0x0, 0x1000}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001600)=ANY=[@ANYBLOB="280c00001a000100000000000000000002dc4a"], 0xc28}}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r4, &(0x7f0000000840)=[{0x0}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000004, 0x42031, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x88) r6 = dup2(r5, r5) ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0x40000a, 0x3, 0x40000000, 0x10}) ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r8, 0x0, 0x2, 0x6) write$cgroup_pid(r8, &(0x7f0000000000), 0xffffff98) 8.579050587s ago: executing program 1 (id=212): mkdir(&(0x7f0000000bc0)='./bus\x00', 0x109) setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x400261f3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000000206010100000000000000000100000005000100070000000900020073797a30000000000c00078008001240fffffffe05000400080000000d000300686173683a6e657400000000e8d4003c4695c4daa1bdc4e25ad7b2d9a23f62e094d787ca55ee244a42cc2b6e93e2706673794a1cc19d58a5"], 0x4c}, 0x1, 0x0, 0x0, 0x4028055}, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000009000000000000e8ff7f000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000850000000f000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x48811}, 0x4000000) sendmsg$NFT_BATCH(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0xfc, 0x6, 0xa, 0x403, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0xd0, 0x4, 0x0, 0x1, [{0xcc, 0x1, 0x0, 0x1, @match={{0xa}, @val={0xbc, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_MATCH_INFO={0xa0, 0x3, "06275c852770226714b06026799504d26462d0f7a66ead44d6899e1445d97832ad457d06138b69af69d529be95f1911eab1846eb51bda151a6b0736302fdfb9f2c903fa06bb26b5a1ce76b17878e8174d345499079f1da597f0326854d62b1f5d97f2de35a9cb60da0764d08dbaf74939de34af914a3ea3f02ca57df07e9ed10aecb90bdbabcfcdd62e3ef6913b29a63fd42d9276dc54b68f9bc26a0"}, @NFTA_MATCH_NAME={0xe, 0x1, 'conntrack\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20, 0x0, 0x0, {0xa}}}, 0x124}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000003f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x15) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c0005"], 0x48}, 0x1, 0x0, 0x0, 0x4044850}, 0xc040) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x7, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x7d}, @exit], &(0x7f0000000200)='GPL\x00'}, 0x94) sendmsg$unix(r2, &(0x7f0000000740)={&(0x7f0000000340)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000640)=[{&(0x7f00000003c0)="97b64260dffd4f7e98118b1da9632a2885f2da295f5f2a12f7c82d9951a019a5c7d87a57b91d02f998b2b9c4b30e1737d5692062e8e1287d7fbd86f8ca52bf1e5c6856fa9e91d2fef640424191c24bc226fdad8bfa64a6ad8d302308a2e9d242d4de3e33fc24a6b47a37ca7596bf4006a8e0a50e3127481ea0870b1edf4f47a08ae5c1d232735a3760cc7ded84ba530b75e9", 0x92}, {&(0x7f0000000540)="afff5eacc90e1f93065d7942e0716ca6f04cc8e93b9bbce0e1fddbff82ef3c66995dbbbb8e1eb385267576d30164f93ce956dd82c907d28c68895e4a575818e47e90440b81275813f561300b191f4d7a1c85b18c0d27d2742cb2ab41a6523a41dac74fd8680330ecfdebcf8e2c2c456bccc0bbf3338af459da9336449a6afbacdb7f992edc8fb1d4dd73c609de43512bbf9b22320bf75c749c55e62f", 0x9c}], 0x2, &(0x7f0000000680)=[@rights={{0x24, 0x1, 0x1, [r5, r0, r0, r5, r3]}}, @rights={{0x18, 0x1, 0x1, [r1, r2]}}, @rights={{0x1c, 0x1, 0x1, [r2, r1, r1]}}], 0x60, 0x24004010}, 0x4801) landlock_create_ruleset(0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000240)={'bond_slave_1\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="1c0000005e000100000000000000000002000000", @ANYRES32=r8, @ANYRES32=r7], 0x1c}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x8031, r5, 0x3a8bc000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 6.713403366s ago: executing program 1 (id=215): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0}, 0x10) r4 = landlock_create_ruleset(&(0x7f0000000040)={0xc015, 0x3}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r4, 0x2, &(0x7f0000000240)={0x3, 0x3}, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r4, 0x2, &(0x7f00000000c0)={0x1, 0x2}, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r5, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x48, 0x24, 0xf0b, 0x70bd2e, 0x400000, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x298c, 0x2, 0x0, 0x401}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x3c000001}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newtaction={0x60, 0x30, 0x727, 0x7ffffc, 0x2000000, {}, [{0x4c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x3, 0x10000, 0x2, 0x7}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r10 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000001bc0)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r9, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="d5efd4"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x48008) sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@getqdisc={0x2c, 0x26, 0x400, 0x1000, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {0xa, 0xfff1}, {0xffff, 0xfff1}, {0x7, 0xe}}, [{0x4}, {0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x10000084) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000070e367f1c3040008000400440000000800da366ce3aa8bfc25469f228c3c94be2e9a8e67a67234cc6c4756e0b83d985e4bc9599cb92fb4fea8beb6852637e2b4bb84cdd119697eddccd7457eb54fe1b17a95ac59c062790b818455065b4debffd97ee0f531767d0eec005504b54d26de4ec16a1465aedcde2394810605b6f8ed995084ab97ec65bc55e7c8957b12786857b8b80a7bae1b11881f14f678c749a163965a80e891f1de5e2bb46ddf76cb1ae54422a98723190c8516097e49c2978b1ecc8d7bd597f0952669af3c0a64d881620ff3f638e8c116213ec464dae157ab198c40a2d4d43d592dc6ee0567a21831"], 0x30}}, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000840)={r2, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) 6.254231913s ago: executing program 1 (id=216): ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(0xffffffffffffffff, 0xc0305602, &(0x7f00000003c0)={0x0, 0x6, 0x3004}) 6.129384838s ago: executing program 1 (id=217): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x141) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x1004000, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r1}}) vmsplice(r1, &(0x7f0000000180)=[{&(0x7f0000000100)="b4", 0x1}], 0x1, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) 5.98273562s ago: executing program 1 (id=218): syz_emit_ethernet(0x4e, &(0x7f0000000440)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x18, 0x6, 0x0, @private1={0xfc, 0x1, '\x00', 0x2}, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@generic={0x3, 0x2}]}}}}}}}}, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r0, @ANYBLOB="05000000000000397c", @ANYRES32], 0x21c}, 0x1, 0x0, 0x0, 0x90}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={&(0x7f0000000140)="31576953b4321720e715a6e230f51c383c654858eb97c3270706d228ab8ed508171701527615eed6d3034fd23c9a80de073d0aa9e65752414b8454a09453a3645abcabf3eeac3678a33099c01b5919c4d9127f0229ce5d153183fc4dae6182a933463db5cf62556d60935d564c5263af", &(0x7f00000001c0)="0df6b4fb333a3498b89fdeb26e04e13bd8e9f28321bd2a47cf41419dc2d9db62cf7db56914951906e702a301285c58"}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r3 = socket$igmp6(0xa, 0x3, 0x3a) getsockopt$MRT6(r3, 0x29, 0xce, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) timer_gettime(r2, &(0x7f0000000000)) syz_emit_ethernet(0x7e, &(0x7f0000000280)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f81fcb", 0x48, 0x3a, 0x0, @private0, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "4aa1d3", 0x3, 0x0, 0x0, @private1, @ipv4={'\x00', '\xff\xff', @loopback}, [@routing={0x3c}, @srh={0x87}, @dstopts]}}}}}}}, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newtfilter={0x54, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x1, 0x4}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x18, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x14, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_MPLS_OPT_LSE_DEPTH={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_MPLS_OPT_LSE_LABEL={0x8, 0x5, {0xa90a}}]}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) sendmsg$can_bcm(r4, &(0x7f00000004c0)={&(0x7f0000000240)={0x1d, r6}, 0x10, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="0500000040050000060000b8324c0470d79026f4a63a04907929ad4862d1fac99334fb88cb002651e280eae2063af1a72c8ef754d6eb010000000000000046d33b4fe23408de1517cba4915cd85b47512dcbcc2939", @ANYRES64=r7, @ANYRES64=r8/1000+60000, @ANYRES64=0x0, @ANYRES64=0xea60, @ANYBLOB="010000e001000000030000a00203000077b6ca98c952aa3f"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='fd\x00') exit(0x7) fchdir(r9) statx(r9, 0x0, 0x1000, 0x10, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2, &(0x7f0000000100)=0x0) io_submit(r11, 0x1, &(0x7f0000000040)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r10, 0x0, 0x0, 0x80000000}]) 5.333038135s ago: executing program 1 (id=219): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r1, r1, 0x0, 0x200000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={0xffffffffffffffff, 0x2000012, 0xe, 0x0, &(0x7f00000006c0)="63ec33c9e9b98600000000000000", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) 5.186041455s ago: executing program 35 (id=219): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r1, r1, 0x0, 0x200000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={0xffffffffffffffff, 0x2000012, 0xe, 0x0, &(0x7f00000006c0)="63ec33c9e9b98600000000000000", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) 3.205567326s ago: executing program 3 (id=225): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x141) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x1004000, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r1}}) vmsplice(r1, &(0x7f0000000180)=[{&(0x7f0000000100)="b4", 0x1}], 0x1, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)={0x1c, r0, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) 2.9745129s ago: executing program 3 (id=226): timer_create(0x6, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x84) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x7}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x6}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x0, 0x3c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x6, 0x4, 0x3, 0x0, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) (async) r2 = socket$inet6(0xa, 0x3, 0x2) (async, rerun: 64) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 64) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) (async) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) (async) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) (async) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0xffd8) (async) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@initdev}}, &(0x7f0000000440)=0xe8) quotactl_fd$Q_GETQUOTA(r0, 0xffffffff80000702, r4, &(0x7f0000000480)) r5 = gettid() process_vm_writev(r5, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) (async) poll(0x0, 0x0, 0x9) r6 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r6, 0x0) (async) r7 = socket(0x10, 0x6, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r7, 0x84, 0xf, 0x0, &(0x7f0000003740)) (async) r8 = socket$kcm(0x10, 0x400000002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/lru_gen\x00', 0x2, 0x0) write(r9, &(0x7f0000000800)='+ 1 0 0 1', 0x9) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@bloom_filter={0x1e, 0x9, 0x9, 0x8001, 0x66901, 0xffffffffffffffff, 0x40, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x5}, 0x50) write$cgroup_subtree(r8, &(0x7f00000004c0)=ANY=[@ANYBLOB="24000000660091ef"], 0xfe33) (async) socket(0x2, 0x80805, 0x0) 2.751019555s ago: executing program 3 (id=227): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000005c0)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x40}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xe0004000}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2002, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x1000000, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8, 0x1, 0x1, 0x0, 0x4000000}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.952937236s ago: executing program 3 (id=228): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x44c20, 0xffffffffffffffff, 0xffff, '\x00', 0x0, 0xffffffffffffffff, 0x3}, 0x50) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) openat$sysfs(0xffffffffffffff9c, 0x0, 0x1, 0x20) io_submit(0x0, 0x0, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x81) sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r4, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14}, 0x0) socket$packet(0x11, 0x2, 0x300) socket(0x80000000000000a, 0x2, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x8, &(0x7f0000000080)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r5, &(0x7f0000000bc0)={0x2020}, 0x2020) socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d074af6e8dafe09"}}}}}}}, 0x0) recvmsg(r6, &(0x7f0000002700)={0x0, 0x0, &(0x7f00000025c0)=[{&(0x7f00000015c0)=""/4096, 0x10f4}], 0x1}, 0x1) 1.006925033s ago: executing program 3 (id=229): r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x161d02) writev(r0, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=@newtaction={0x20c, 0x30, 0x1, 0x0, 0x0, {}, [{0x1f8, 0x1, [@m_mirred={0x1bc, 0x0, 0x0, 0x0, {{0xb}, {0xa4, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0x6, 0x7, 0x3, 0xfffffff9}, 0x3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x6e36d104, 0x2, 0x7, 0x637, 0x4}, 0x3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x4, 0x1, 0x20000000, 0x1}, 0x2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0x800, 0x10000000, 0x40, 0x6}, 0x3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x401, 0x3, 0x7, 0xfffffffd}, 0x1}}]}, {0xf0, 0x6, "80e96ab807f78b8c5ebb3f8947c89a2dc9ad3d529bc3339c2f7a7f92b53bd3a8fb32775e85c3231f94f40525d7e127caa952a6bb7564e763a402fbcb21ab8523563e8e44c25766c6859eed1631b22ba49a0af485d82752d53b1764f7798da527784a904253211564a0348caca18c1c49fcecceb3c8745c7b45cb8e3bdcdf57bf4646b4cda10ff6bd712e9119e3fc6aa50ef6198c1e8fac6c92fd383bdcb2837bb9ec4382c6864901b28bdaafaa0bc2de00176d92061de386cb51a3651591bf4d4f6483a01c10dbd65032962206e00e9b1187dbc73f28d222d7cc9dfafa77c9a0e854b63c14f348a2f3456219"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_ife={0x38, 0x1, 0x0, 0x0, {{0x8}, {0x10, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x20c}}, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, 0x0, 0x0) setsockopt$packet_fanout_data(r1, 0x107, 0x16, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, 0x0, &(0x7f0000000300)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_4ADDR={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040}, 0x0) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="d4000000", @ANYRES16=r3, @ANYRES64=r0, @ANYRES16=r2, @ANYBLOB="44000e0080000000ffffffffffff08021100000008021100000000000000000000000000030000442d1a0c0010070000000000000081000200080000000100ff0f0000080400800004002a0054009100c8818dbdb18f281ec8e200ac40841de626f29c6aa159e311d6dc3964e08bd7d43e93d43b55a64e11461d988233da5719c083430b0a84db7b49e89a041ff88a83021c3536b9d4575ffc364e9e84484de5080026006c09000008000c00bc00000008000d0000000000"], 0xd4}}, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/mdstat\x00', 0x0, 0x0) socket(0x1b, 0x6, 0x36) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc_mnt\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/conf/all/forwarding\x00', 0x1, 0x0) write$sysctl(r6, &(0x7f0000000280)='1\x00', 0x1) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x1, 0x0) 0s ago: executing program 3 (id=230): openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000d80), 0x0, 0x0) ioctl$I2C_PEC(r0, 0x708, 0x10) r1 = io_uring_setup(0x178e, &(0x7f0000000140)={0x0, 0x5281, 0x800, 0xffffffee, 0xc}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r5, r4, &(0x7f0000002080)=0x64, 0x12) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e25, 0x0, @loopback}, {0xa, 0x0, 0xfffffffe, @empty}}}, 0x48) write$RDMA_USER_CM_CMD_QUERY(r6, 0x0, 0x0) r7 = dup(r3) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd2c) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, 0x0, 0x1, 0x70bd2a, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r9, 0x84, 0x7, 0x0, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r7, 0x0, 0x44840) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x8, 0x2, 0xfffffffffffffffd, 0x3}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x4, 0x0, 0x1136f858, 0x0, 0xffffffffffffffff}, 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400fb0160291d00090509a9143c27c70ce6125797e7a869c6d70443c03e53b5abd92c5080e1b2d865abd50649c3be1410f3deb9", @ANYRES32=0x0], 0x0) r10 = syz_open_dev$audion(&(0x7f0000000000), 0x3, 0x1) write$P9_RVERSION(r10, 0x0, 0x0) syz_usb_connect$hid(0x1, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0xff, 0x5ac, 0x216, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x1, 0xa0, 0x1}}]}}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) r11 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040501d4d610000000000010902190001010080fa0904000001ff00000007050202"], 0x0) syz_usb_control_io(r11, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="40011e0000004d61501d0100000000000000000050000000500000005000000050"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r11, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): t permissive=1 [ 58.626747][ T29] audit: type=1400 audit(1786282052.085:134): avc: denied { write } for pid=5580 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 58.647437][ T29] audit: type=1400 audit(1786282052.085:135): avc: denied { read } for pid=5580 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 58.672354][ T29] audit: type=1400 audit(1786282052.085:136): avc: denied { mounton } for pid=5580 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 58.691392][ T5583] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 58.697524][ T29] audit: type=1400 audit(1786282052.085:137): avc: denied { mount } for pid=5580 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 58.729261][ T29] audit: type=1400 audit(1786282052.235:138): avc: denied { relabelto } for pid=5583 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 59.685209][ T5580] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 61.846022][ T5594] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 61.856411][ T5594] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 61.869158][ T5596] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 61.877849][ T5596] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 61.885729][ T5596] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 61.886195][ T5600] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 61.894310][ T5596] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 61.903832][ T5600] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 61.908907][ T5596] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 61.921446][ T5600] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 61.922548][ T5596] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 61.929849][ T5600] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 61.937444][ T5596] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 61.945287][ T5600] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 61.955626][ T5605] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 61.975744][ T50] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 61.985338][ T50] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 61.998771][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 62.007282][ T5594] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 62.015051][ T5594] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 62.056389][ T5596] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 62.066908][ T5596] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 62.078079][ T5596] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 62.087732][ T5596] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 62.095710][ T5596] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 63.248931][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.256875][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.264529][ T5593] bridge_slave_0: entered allmulticast mode [ 63.271464][ T5593] bridge_slave_0: entered promiscuous mode [ 63.307447][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.314602][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.322060][ T5593] bridge_slave_1: entered allmulticast mode [ 63.328891][ T5593] bridge_slave_1: entered promiscuous mode [ 63.339527][ T5592] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.346982][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.355157][ T5592] bridge_slave_0: entered allmulticast mode [ 63.362540][ T5592] bridge_slave_0: entered promiscuous mode [ 63.369384][ T5601] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.378716][ T5601] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.386099][ T5601] bridge_slave_0: entered allmulticast mode [ 63.392781][ T5601] bridge_slave_0: entered promiscuous mode [ 63.420083][ T5592] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.427332][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.434500][ T5592] bridge_slave_1: entered allmulticast mode [ 63.441669][ T5592] bridge_slave_1: entered promiscuous mode [ 63.448307][ T5601] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.455411][ T5601] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.462637][ T5601] bridge_slave_1: entered allmulticast mode [ 63.469616][ T5601] bridge_slave_1: entered promiscuous mode [ 63.496092][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.527410][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.565720][ T5592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.576851][ T5601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.595902][ T5601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.620301][ T5592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.649801][ T5593] team0: Port device team_slave_0 added [ 63.672569][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.679893][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.687185][ T5603] bridge_slave_0: entered allmulticast mode [ 63.693835][ T5603] bridge_slave_0: entered promiscuous mode [ 63.702819][ T5593] team0: Port device team_slave_1 added [ 63.719398][ T5601] team0: Port device team_slave_0 added [ 63.725169][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.732375][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.739739][ T5603] bridge_slave_1: entered allmulticast mode [ 63.746414][ T5603] bridge_slave_1: entered promiscuous mode [ 63.760233][ T5592] team0: Port device team_slave_0 added [ 63.771099][ T5601] team0: Port device team_slave_1 added [ 63.790331][ T5592] team0: Port device team_slave_1 added [ 63.815763][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.822761][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.848896][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.881273][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.891025][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.898207][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.924150][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.941085][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.948312][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.955421][ T5610] bridge_slave_0: entered allmulticast mode [ 63.962308][ T5610] bridge_slave_0: entered promiscuous mode [ 63.969574][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.976707][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.003667][ T5596] Bluetooth: hci1: command tx timeout [ 64.003769][ T5601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.021586][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 64.040022][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.047049][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.065571][ T5596] Bluetooth: hci0: command tx timeout [ 64.073725][ T5594] Bluetooth: hci3: command tx timeout [ 64.079111][ T5600] Bluetooth: hci2: command tx timeout [ 64.085405][ T5592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.101270][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.108614][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.115901][ T5610] bridge_slave_1: entered allmulticast mode [ 64.122653][ T5610] bridge_slave_1: entered promiscuous mode [ 64.129859][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.137041][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.163417][ T5600] Bluetooth: hci4: command tx timeout [ 64.171487][ T5601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 64.195331][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.202347][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.228384][ T5592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 64.269666][ T5603] team0: Port device team_slave_0 added [ 64.277549][ T5603] team0: Port device team_slave_1 added [ 64.299400][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 64.319629][ T5593] hsr_slave_0: entered promiscuous mode [ 64.326475][ T5593] hsr_slave_1: entered promiscuous mode [ 64.335240][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.342654][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.368601][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.381213][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 64.409432][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.416481][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.442780][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 64.493188][ T5601] hsr_slave_0: entered promiscuous mode [ 64.499571][ T5601] hsr_slave_1: entered promiscuous mode [ 64.505562][ T5601] debugfs: 'hsr0' already exists in 'hsr' [ 64.511369][ T5601] Cannot create hsr debugfs directory [ 64.520392][ T5592] hsr_slave_0: entered promiscuous mode [ 64.526857][ T5592] hsr_slave_1: entered promiscuous mode [ 64.532752][ T5592] debugfs: 'hsr0' already exists in 'hsr' [ 64.538580][ T5592] Cannot create hsr debugfs directory [ 64.556581][ T5610] team0: Port device team_slave_0 added [ 64.564156][ T5610] team0: Port device team_slave_1 added [ 64.621388][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.629234][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.655431][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.670213][ T5603] hsr_slave_0: entered promiscuous mode [ 64.676389][ T5603] hsr_slave_1: entered promiscuous mode [ 64.682325][ T5603] debugfs: 'hsr0' already exists in 'hsr' [ 64.688082][ T5603] Cannot create hsr debugfs directory [ 64.707252][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.714273][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.740338][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 64.866217][ T5610] hsr_slave_0: entered promiscuous mode [ 64.872591][ T5610] hsr_slave_1: entered promiscuous mode [ 64.878854][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 64.884600][ T5610] Cannot create hsr debugfs directory [ 65.104886][ T5593] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 65.117455][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 65.136714][ T5593] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 65.146756][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 65.155946][ T5593] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 65.164275][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 65.178096][ T5593] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 65.189343][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 65.221211][ T5592] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 65.232433][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 65.240928][ T5592] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 65.249797][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 65.262082][ T5592] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 65.271322][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 65.285076][ T5592] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 65.293500][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 65.343290][ T5603] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 65.353148][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 65.361042][ T5603] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 65.370047][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 65.378064][ T5603] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 65.386584][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 65.401139][ T5603] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 65.409758][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 65.486164][ T5601] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 65.495135][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 65.512747][ T5601] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 65.523856][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 65.539620][ T5601] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 65.548847][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 65.571255][ T5601] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 65.580779][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 65.645193][ T5592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.672900][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.684572][ T5610] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 65.693434][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 65.701803][ T5610] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 65.710701][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 65.727258][ T5610] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 65.736183][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 65.743869][ T5610] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 65.753289][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 65.773317][ T5592] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.792763][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.815249][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.822752][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.833205][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.840310][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.866680][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.873771][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.882950][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.890070][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.907791][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 65.912487][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.915872][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 65.991203][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.003017][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.024697][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.031795][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.064246][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.071666][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.081019][ T5600] Bluetooth: hci1: command tx timeout [ 66.087674][ T29] kauditd_printk_skb: 13 callbacks suppressed [ 66.087689][ T29] audit: type=1400 audit(1786282059.615:152): avc: denied { sys_module } for pid=5592 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 66.102859][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.128219][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.145944][ T5600] Bluetooth: hci2: command tx timeout [ 66.152129][ T5600] Bluetooth: hci0: command tx timeout [ 66.155932][ T5596] Bluetooth: hci3: command tx timeout [ 66.168849][ T5593] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 66.186869][ T3295] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.194036][ T3295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.220436][ T3295] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.227770][ T3295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.235666][ T5596] Bluetooth: hci4: command tx timeout [ 66.272676][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.322826][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.330044][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.358180][ T3295] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.365369][ T3295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.660825][ T5592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.869262][ T5592] veth0_vlan: entered promiscuous mode [ 66.910001][ T5592] veth1_vlan: entered promiscuous mode [ 67.012826][ T5592] veth0_macvtap: entered promiscuous mode [ 67.055835][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.089344][ T5592] veth1_macvtap: entered promiscuous mode [ 67.153904][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.180926][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.221689][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.257295][ T35] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.283466][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.302545][ T1029] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.319389][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.332311][ T5593] veth0_vlan: entered promiscuous mode [ 67.349689][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.391352][ T5593] veth1_vlan: entered promiscuous mode [ 67.418531][ T35] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.492255][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.501360][ T5601] veth0_vlan: entered promiscuous mode [ 67.524546][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.571511][ T5601] veth1_vlan: entered promiscuous mode [ 67.588061][ T137] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.597931][ T5610] veth0_vlan: entered promiscuous mode [ 67.599271][ T137] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.615513][ T5593] veth0_macvtap: entered promiscuous mode [ 67.636124][ T29] audit: type=1400 audit(1786282061.155:153): avc: denied { mounton } for pid=5592 comm="syz-executor" path="/root/syzkaller.crn4lV/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 67.660828][ T29] audit: type=1400 audit(1786282061.155:154): avc: denied { mount } for pid=5592 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 67.664543][ T5610] veth1_vlan: entered promiscuous mode [ 67.686827][ T29] audit: type=1400 audit(1786282061.165:155): avc: denied { mounton } for pid=5592 comm="syz-executor" path="/root/syzkaller.crn4lV/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 67.704992][ T5593] veth1_macvtap: entered promiscuous mode [ 67.713728][ T29] audit: type=1400 audit(1786282061.165:156): avc: denied { mount } for pid=5592 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 67.742340][ T29] audit: type=1400 audit(1786282061.165:157): avc: denied { mounton } for pid=5592 comm="syz-executor" path="/root/syzkaller.crn4lV/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 67.755733][ T5601] veth0_macvtap: entered promiscuous mode [ 67.775075][ T29] audit: type=1400 audit(1786282061.165:158): avc: denied { mounton } for pid=5592 comm="syz-executor" path="/root/syzkaller.crn4lV/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=8226 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 67.804190][ T29] audit: type=1400 audit(1786282061.165:159): avc: denied { unmount } for pid=5592 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 67.823513][ T5603] veth0_vlan: entered promiscuous mode [ 67.825590][ T29] audit: type=1400 audit(1786282061.215:160): avc: denied { mounton } for pid=5592 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2780 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 67.852967][ T29] audit: type=1400 audit(1786282061.215:161): avc: denied { mount } for pid=5592 comm="syz-executor" name="/" dev="gadgetfs" ino=8230 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 67.890997][ T5592] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 67.908037][ T5601] veth1_macvtap: entered promiscuous mode [ 67.921367][ T5603] veth1_vlan: entered promiscuous mode [ 67.959400][ T5610] veth0_macvtap: entered promiscuous mode [ 67.993745][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.004981][ T5610] veth1_macvtap: entered promiscuous mode [ 68.029766][ T5603] veth0_macvtap: entered promiscuous mode [ 68.057835][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.073488][ T5603] veth1_macvtap: entered promiscuous mode [ 68.103734][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.113019][ T5783] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4'. [ 68.123690][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.134071][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.147723][ T5596] Bluetooth: hci1: command tx timeout [ 68.158516][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.171942][ T5783] Zero length message leads to an empty skb [ 68.215656][ T1029] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.226533][ T5594] Bluetooth: hci3: command tx timeout [ 68.226539][ T5600] Bluetooth: hci2: command tx timeout [ 68.237523][ T5596] Bluetooth: hci0: command tx timeout [ 68.259806][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.282508][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.318034][ T5596] Bluetooth: hci4: command tx timeout [ 68.368110][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.404355][ T3295] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.414741][ T3295] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.546371][ T3295] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.554919][ T3295] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.564208][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.617530][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.632655][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.656750][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.715895][ T1029] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.724195][ T1029] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.801539][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.810264][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.822628][ T35] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.911332][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.934694][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.074593][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.087572][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.104457][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.117388][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.141365][ T5786] input: syz1 as /devices/virtual/input/input5 [ 69.167760][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.177471][ T1029] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.191135][ T1029] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.199822][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.213015][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.249494][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.348495][ T3295] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.381770][ T3295] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.418778][ T3295] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.454935][ T3295] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.486680][ T35] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.676111][ T5722] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 69.875935][ T5722] usb 2-1: Using ep0 maxpacket: 8 [ 69.889743][ T5722] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 70.236557][ T5722] usb 2-1: config 0 has an invalid interface number: 143 but max is 0 [ 70.245380][ T5722] usb 2-1: config 0 has no interface number 0 [ 70.251851][ T5722] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.260083][ T5596] Bluetooth: hci1: command tx timeout [ 70.284581][ T5722] usb 2-1: config 0 descriptor?? [ 70.290922][ T982] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 70.308180][ T5594] Bluetooth: hci3: command tx timeout [ 70.313778][ T5596] Bluetooth: hci0: command tx timeout [ 70.317825][ T5600] Bluetooth: hci2: command tx timeout [ 70.355667][ T189] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 70.388705][ T5600] Bluetooth: hci4: command tx timeout [ 70.447135][ T5722] viperboard 2-1:0.143: version 0.00 found at bus 002 address 002 [ 70.510820][ T982] usb 4-1: not running at top speed; connect to a high speed hub [ 70.527368][ T5789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.528745][ T5722] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 70.556093][ T982] usb 4-1: New USB device found, idVendor=05ac, idProduct=0221, bcdDevice= 0.40 [ 70.569984][ T189] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 70.572228][ T5789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.589066][ T982] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 70.601479][ T5722] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 70.616726][ T189] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.642420][ T189] usb 5-1: Product: syz [ 70.646894][ T982] usb 4-1: config 1 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 70.664974][ T189] usb 5-1: Manufacturer: syz [ 70.683270][ T5789] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2'. [ 70.684706][ T189] usb 5-1: SerialNumber: syz [ 70.707013][ T982] usb 4-1: config 1 interface 0 has no altsetting 0 [ 70.746352][ T982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.763160][ T5803] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8'. [ 70.764481][ T982] usb 4-1: Product: 窌鼝΅ [ 70.806400][ T982] usb 4-1: SerialNumber: Є [ 70.827486][ T5806] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8'. [ 70.867748][ T5800] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 70.958322][ T1211] usb 2-1: USB disconnect, device number 2 [ 71.140239][ T982] usbhid 4-1:1.0: can't add hid device: -71 [ 71.153448][ T982] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 71.177193][ T189] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 71.194683][ T982] usb 4-1: USB disconnect, device number 2 [ 71.214959][ T189] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 71.306956][ T5821] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10'. [ 71.928494][ T5823] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11'. [ 71.953648][ T5823] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11'. [ 71.971881][ T29] kauditd_printk_skb: 44 callbacks suppressed [ 71.971896][ T29] audit: type=1400 audit(1786282065.495:206): avc: denied { prog_run } for pid=5828 comm="syz.1.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 72.036637][ T29] audit: type=1400 audit(1786282065.525:207): avc: denied { map_read map_write } for pid=5828 comm="syz.1.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 72.121871][ T29] audit: type=1400 audit(1786282065.525:208): avc: denied { append } for pid=5828 comm="syz.1.13" name="v4l-subdev4" dev="devtmpfs" ino=945 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 72.210037][ T29] audit: type=1400 audit(1786282065.715:209): avc: denied { read } for pid=5826 comm="syz.0.12" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 72.243392][ T29] audit: type=1400 audit(1786282065.715:210): avc: denied { open } for pid=5826 comm="syz.0.12" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 72.857853][ T29] audit: type=1400 audit(1786282065.985:211): avc: denied { bind } for pid=5796 comm="syz.4.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 72.876911][ T29] audit: type=1400 audit(1786282066.115:212): avc: denied { ioctl } for pid=5796 comm="syz.4.6" path="socket:[7919]" dev="sockfs" ino=7919 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 72.903352][ T5840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.935976][ T5840] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.956070][ T29] audit: type=1400 audit(1786282066.215:213): avc: denied { ioctl } for pid=5796 comm="syz.4.6" path="socket:[8856]" dev="sockfs" ino=8856 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 72.990627][ T5798] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6'. [ 73.019347][ T29] audit: type=1400 audit(1786282066.235:214): avc: denied { setopt } for pid=5796 comm="syz.4.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 73.166421][ T189] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000118. ret = -EPROTO [ 73.203099][ T189] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 73.224575][ T29] audit: type=1400 audit(1786282066.745:215): avc: denied { bind } for pid=5843 comm="syz.3.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 73.296316][ T189] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 73.332215][ T5847] batadv1: entered promiscuous mode [ 73.360426][ T5844] netlink: 44 bytes leftover after parsing attributes in process `syz.3.17'. [ 73.375923][ T189] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 73.766173][ T189] usb 5-1: USB disconnect, device number 2 [ 74.186134][ T5834] blktrace: Concurrent blktraces are not allowed on loop4 [ 75.142914][ T5863] openvswitch: netlink: Actions may not be safe on all matching packets [ 75.975527][ T189] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 76.130989][ T5860] netlink: 36 bytes leftover after parsing attributes in process `syz.1.20'. [ 76.173113][ T5880] ======================================================= [ 76.173113][ T5880] WARNING: The mand mount option has been deprecated and [ 76.173113][ T5880] and is ignored by this kernel. Remove the mand [ 76.173113][ T5880] option from the mount to silence this warning. [ 76.173113][ T5880] ======================================================= [ 76.214884][ T5860] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20'. [ 76.227141][ T189] usb 1-1: Using ep0 maxpacket: 16 [ 76.241797][ T189] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 76.279025][ T189] usb 1-1: config index 0 descriptor too short (expected 51443, got 18) [ 76.404268][ T5886] : renamed from bond_slave_0 (while UP) [ 76.458803][ T189] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.467679][ T189] usb 1-1: Product: syz [ 76.821561][ T189] usb 1-1: Manufacturer: syz [ 76.826540][ T189] usb 1-1: SerialNumber: syz [ 76.847332][ T189] r8152-cfgselector 1-1: Unknown version 0x0000 [ 76.854997][ T189] r8152-cfgselector 1-1: config 0 descriptor?? [ 76.901250][ T5882] netlink: 148 bytes leftover after parsing attributes in process `syz.2.26'. [ 76.989599][ T5889] netlink: 3084 bytes leftover after parsing attributes in process `syz.2.26'. [ 77.194878][ T5895] netlink: 4 bytes leftover after parsing attributes in process `syz.3.28'. [ 77.463077][ T5882] netlink: 148 bytes leftover after parsing attributes in process `syz.2.26'. [ 77.463592][ T189] r8152-cfgselector 1-1: Unknown version 0x0000 [ 77.521363][ T189] r8152-cfgselector 1-1: No union descriptors [ 77.819830][ T5894] blktrace: Concurrent blktraces are not allowed on loop4 [ 78.721307][ T1211] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 78.980692][ T29] kauditd_printk_skb: 31 callbacks suppressed [ 78.980719][ T29] audit: type=1400 audit(1786282072.485:247): avc: denied { write } for pid=5905 comm="syz.3.31" name="rd_mcp_0" dev="configfs" ino=8976 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 79.118769][ T1211] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 79.204100][ T1211] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 79.271001][ T1211] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 79.330391][ T1211] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.373305][ T42] r8152-cfgselector 1-1: USB disconnect, device number 2 [ 79.681617][ T1211] usb 5-1: config 0 descriptor?? [ 79.794409][ T1211] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 79.831932][ T1211] dvb-usb: bulk message failed: -22 (3/0) [ 79.897622][ T29] audit: type=1400 audit(1786282073.425:248): avc: denied { map } for pid=5908 comm="syz.0.32" path="socket:[9043]" dev="sockfs" ino=9043 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 79.926619][ T1211] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 79.962616][ T1211] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 80.008244][ T1211] usb 5-1: media controller created [ 80.045263][ T1211] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 80.053872][ T29] audit: type=1400 audit(1786282073.575:249): avc: denied { create } for pid=5914 comm="syz.3.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 80.061782][ T5915] x_tables: duplicate underflow at hook 4 [ 80.083886][ T5915] sctp: [Deprecated]: syz.3.33 (pid 5915) Use of int in maxseg socket option. [ 80.083886][ T5915] Use struct sctp_assoc_value instead [ 80.206243][ T29] audit: type=1400 audit(1786282073.575:250): avc: denied { connect } for pid=5914 comm="syz.3.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 80.233146][ T1211] dvb-usb: bulk message failed: -22 (6/0) [ 80.265587][ T1211] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 80.307355][ T29] audit: type=1400 audit(1786282073.575:251): avc: denied { name_connect } for pid=5914 comm="syz.3.33" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 80.308864][ T5911] netlink: 16 bytes leftover after parsing attributes in process `syz.0.32'. [ 80.341869][ T29] audit: type=1400 audit(1786282073.585:252): avc: denied { listen } for pid=5914 comm="syz.3.33" lport=32894 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 80.391450][ T1211] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input6 [ 80.417583][ T5922] netlink: 12 bytes leftover after parsing attributes in process `syz.1.34'. [ 80.432370][ T29] audit: type=1400 audit(1786282073.585:253): avc: denied { accept } for pid=5914 comm="syz.3.33" lport=32894 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 80.460450][ T1211] dvb-usb: schedule remote query interval to 150 msecs. [ 80.486669][ T1211] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 80.515545][ T29] audit: type=1400 audit(1786282073.615:254): avc: denied { setopt } for pid=5914 comm="syz.3.33" lport=32894 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 80.561222][ T1211] usb 5-1: USB disconnect, device number 3 [ 80.589107][ T29] audit: type=1400 audit(1786282073.865:255): avc: denied { read } for pid=5920 comm="syz.1.34" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 80.611890][ T42] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 80.668047][ T1211] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 80.679729][ T29] audit: type=1400 audit(1786282073.875:256): avc: denied { open } for pid=5920 comm="syz.1.34" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 80.817357][ T42] usb 1-1: Using ep0 maxpacket: 32 [ 80.826298][ T42] usb 1-1: New USB device found, idVendor=056a, idProduct=0018, bcdDevice= 0.40 [ 80.841291][ T42] usb 1-1: config 1 interface 0 altsetting 109 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 80.885405][ T42] usb 1-1: config 1 interface 0 has no altsetting 0 [ 80.914224][ T42] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.924623][ T42] usb 1-1: Product: 巪噒露醑邏褷ꓓ旸塧鲈䐴䓨碱덇뜾ਇ訌ἀ誉䡆돃㯐㎐블ᗥ䢫軺䐧裛支寊쏏鹪崶찳뿼ڭ擳쒷ꭋ흔탫톊ⲥ [ 80.959030][ T42] usb 1-1: Manufacturer: я [ 80.985151][ T42] usb 1-1: SerialNumber: 瀜[㲄䖀ԇ幛ᴫᕏ滞霂臷還긟乪仩鯺크ࢧ줋쒥⎕窑籪ﻨ琻촾斓솝岡韓职狈ᵉꇁ塨掤쑝뭲䆴遣㥈鎖囝甽蟟筦ḧ䨱㙩迮䅾곛䋖悊䍜鮬㛢䡚ǯᢃ按眦ⴥ⥹㴃츆 [ 81.029688][ T5918] netlink: 8 bytes leftover after parsing attributes in process `syz.3.35'. [ 81.351766][ T10] cfg80211: failed to load regulatory.db [ 82.133836][ T42] usbhid 1-1:1.0: can't add hid device: -71 [ 82.139113][ T5941] netlink: 4 bytes leftover after parsing attributes in process `syz.1.39'. [ 82.149166][ T42] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 82.268591][ T42] usb 1-1: USB disconnect, device number 3 [ 82.701554][ T5946] netlink: 4 bytes leftover after parsing attributes in process `syz.3.41'. [ 83.109896][ T5927] netlink: 8 bytes leftover after parsing attributes in process `syz.2.36'. [ 83.128644][ T1211] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 83.198122][ T5952] netlink: 148 bytes leftover after parsing attributes in process `syz.0.43'. [ 83.336152][ T1211] usb 5-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 83.348063][ T5952] netlink: 148 bytes leftover after parsing attributes in process `syz.0.43'. [ 83.464964][ T1211] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 83.475785][ T1211] usb 5-1: config 0 interface 0 has no altsetting 0 [ 83.485705][ T1211] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.507906][ T1211] usb 5-1: Product: syz [ 83.512235][ T1211] usb 5-1: Manufacturer: syz [ 83.532113][ T1211] usb 5-1: SerialNumber: syz [ 83.551193][ T1211] usb 5-1: config 0 descriptor?? [ 83.577262][ T1211] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 83.610948][ T5956] netlink: 8 bytes leftover after parsing attributes in process `syz.3.44'. [ 83.638943][ T1211] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 83.667921][ T1211] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 83.675543][ T5956] netlink: 8 bytes leftover after parsing attributes in process `syz.3.44'. [ 83.706372][ T1211] usb 5-1: media controller created [ 83.784819][ T1211] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 83.997595][ T1211] DVB: Unable to find symbol tda10046_attach() [ 84.011864][ T1211] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 84.025744][ T1211] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 84.093176][ T29] kauditd_printk_skb: 10 callbacks suppressed [ 84.093213][ T29] audit: type=1400 audit(1786282077.615:267): avc: denied { ioctl } for pid=5965 comm="syz.3.47" path="socket:[8112]" dev="sockfs" ino=8112 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 84.276242][ T29] audit: type=1400 audit(1786282077.795:268): avc: denied { create } for pid=5965 comm="syz.3.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 84.490388][ T29] audit: type=1400 audit(1786282077.795:269): avc: denied { write } for pid=5965 comm="syz.3.47" name="001" dev="devtmpfs" ino=735 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 84.571769][ T29] audit: type=1400 audit(1786282078.055:270): avc: denied { ioctl } for pid=5948 comm="syz.4.42" path="socket:[8118]" dev="sockfs" ino=8118 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 84.612645][ T5971] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=netlink_route_socket pid=5971 comm=syz.2.48 [ 84.835677][ T5971] bridge0: port 3(batadv1) entered blocking state [ 84.862710][ T5971] bridge0: port 3(batadv1) entered disabled state [ 84.973985][ T1211] dvb_usb_m920x 5-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 84.974847][ T5971] batadv1: entered allmulticast mode [ 85.007624][ T1211] usb 5-1: USB disconnect, device number 4 [ 85.097918][ T5971] batadv1: entered promiscuous mode [ 85.123460][ T29] audit: type=1400 audit(1786282078.645:271): avc: denied { getopt } for pid=5975 comm="syz.3.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 85.177092][ T29] audit: type=1400 audit(1786282078.645:272): avc: denied { create } for pid=5975 comm="syz.3.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 85.198693][ T13] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 85.208294][ T13] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 85.219914][ T29] audit: type=1400 audit(1786282078.655:273): avc: denied { bind } for pid=5975 comm="syz.3.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 85.272835][ T29] audit: type=1400 audit(1786282078.655:274): avc: denied { setopt } for pid=5975 comm="syz.3.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 85.331702][ T29] audit: type=1400 audit(1786282078.655:275): avc: denied { listen } for pid=5975 comm="syz.3.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 85.384191][ T29] audit: type=1400 audit(1786282078.655:276): avc: denied { connect } for pid=5975 comm="syz.3.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 85.573453][ T5985] netlink: 'syz.4.53': attribute type 18 has an invalid length. [ 85.856561][ T137] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 85.890531][ T137] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 85.940274][ T137] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 85.967092][ T137] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 87.057828][ T5988] netlink: 8 bytes leftover after parsing attributes in process `syz.1.52'. [ 87.155610][ T189] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 87.317056][ T189] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 87.967595][ T6020] gadgetfs: bound to dummy_udc driver [ 88.617689][ T189] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.631353][ T5722] kernel read not supported for file /dsp1 (pid: 5722 comm: kworker/0:6) [ 88.643908][ T189] usb 5-1: config 0 descriptor?? [ 88.658452][ T189] cp210x 5-1:0.0: cp210x converter detected [ 88.808812][ T6025] process 'syz.0.65' launched '/dev/fd/3' with NULL argv: empty string added [ 89.754971][ T29] kauditd_printk_skb: 16 callbacks suppressed [ 89.754990][ T29] audit: type=1400 audit(1786282082.815:293): avc: denied { read write } for pid=6024 comm="syz.3.66" name="uhid" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 89.843115][ T29] audit: type=1400 audit(1786282082.815:294): avc: denied { open } for pid=6024 comm="syz.3.66" path="/dev/uhid" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 89.876131][ T189] cp210x 5-1:0.0: failed to get vendor val 0x370c size 13: -71 [ 89.915190][ T189] cp210x 5-1:0.0: GPIO initialisation failed: -71 [ 89.931060][ T6034] netlink: 148 bytes leftover after parsing attributes in process `syz.2.67'. [ 89.953425][ T29] audit: type=1400 audit(1786282082.985:295): avc: denied { read write } for pid=6024 comm="syz.3.66" name="usbmon0" dev="devtmpfs" ino=715 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 89.985321][ T189] usb 5-1: cp210x converter now attached to ttyUSB0 [ 90.007841][ T189] usb 5-1: USB disconnect, device number 5 [ 90.015685][ T29] audit: type=1400 audit(1786282082.985:296): avc: denied { open } for pid=6024 comm="syz.3.66" path="/dev/usbmon0" dev="devtmpfs" ino=715 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 90.047631][ T5700] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 90.109292][ T189] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 90.134207][ T29] audit: type=1400 audit(1786282083.025:297): avc: denied { prog_load } for pid=6024 comm="syz.3.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 90.673526][ T189] cp210x 5-1:0.0: device disconnected [ 90.680862][ T29] audit: type=1400 audit(1786282083.275:298): avc: denied { map_create } for pid=6005 comm="syz.4.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 90.820255][ T29] audit: type=1400 audit(1786282083.275:299): avc: denied { map_read map_write } for pid=6005 comm="syz.4.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 90.842295][ T5700] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 90.852637][ T6042] netlink: 4 bytes leftover after parsing attributes in process `syz.0.68'. [ 90.861600][ T29] audit: type=1400 audit(1786282083.355:300): avc: denied { execute_no_trans } for pid=6023 comm="syz.0.65" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=1030 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 90.923437][ T6049] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 91.182238][ T5700] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 91.191291][ T5700] usb 4-1: config 1 has an invalid descriptor of length 47, skipping remainder of the config [ 91.201818][ T29] audit: type=1400 audit(1786282084.445:301): avc: denied { append } for pid=6043 comm="syz.4.69" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 91.228067][ T5700] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 91.266809][ T5700] usb 4-1: config 1 has no interface number 1 [ 91.277352][ T5700] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 91.294503][ T29] audit: type=1400 audit(1786282084.465:302): avc: denied { map } for pid=6043 comm="syz.4.69" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 91.326144][ T5700] usb 4-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 91.423121][ T5700] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.445708][ T5700] usb 4-1: Product: syz [ 91.520717][ T5700] usb 4-1: Manufacturer: syz [ 91.525863][ T6034] netlink: 148 bytes leftover after parsing attributes in process `syz.2.67'. [ 91.550822][ T5700] usb 4-1: SerialNumber: syz [ 91.784894][ T5700] usb 4-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 91.813240][ T5700] usb 4-1: MIDIStreaming interface descriptor not found [ 91.966862][ T5700] usb 4-1: USB disconnect, device number 3 [ 92.068881][ T5615] udevd[5615]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 92.235537][ T5722] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 92.410400][ T5722] usb 2-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 3.00 [ 92.449760][ T5722] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 92.475578][ T5722] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 92.498519][ T5722] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.530809][ T5722] usb 2-1: config 0 descriptor?? [ 92.938075][ T5700] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 93.000732][ T5722] lenovo 0003:17EF:60EE.0001: unknown main item tag 0x0 [ 93.015589][ T5722] lenovo 0003:17EF:60EE.0001: unknown main item tag 0x0 [ 93.178533][ T6069] FAULT_INJECTION: forcing a failure. [ 93.178533][ T6069] name failslab, interval 1, probability 0, space 0, times 1 [ 93.440166][ T6069] CPU: 1 UID: 0 PID: 6069 Comm: syz.2.78 Tainted: G L syzkaller #0 PREEMPT(full) [ 93.440196][ T6069] Tainted: [L]=SOFTLOCKUP [ 93.440202][ T6069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 93.440212][ T6069] Call Trace: [ 93.440217][ T6069] [ 93.440224][ T6069] dump_stack_lvl+0x100/0x190 [ 93.440252][ T6069] should_fail_ex.cold+0x5/0xa [ 93.440275][ T6069] should_failslab+0xc2/0x120 [ 93.440299][ T6069] __kmalloc_noprof+0xfc/0x820 [ 93.440320][ T6069] ? tomoyo_encode2+0xfb/0x3c0 [ 93.440344][ T6069] tomoyo_encode2+0xfb/0x3c0 [ 93.440361][ T6069] ? tomoyo_realpath_from_path+0x438/0x690 [ 93.440381][ T6069] tomoyo_encode+0x29/0x50 [ 93.440396][ T6069] tomoyo_realpath_from_path+0x18c/0x690 [ 93.440419][ T6069] tomoyo_path_number_perm+0x23c/0x580 [ 93.440443][ T6069] ? tomoyo_path_number_perm+0x22e/0x580 [ 93.440468][ T6069] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 93.440515][ T6069] ? __rcu_read_unlock+0x26a/0x5e0 [ 93.440537][ T6069] ? rcu_is_watching+0x12/0xc0 [ 93.440562][ T6069] ? hook_file_ioctl_common+0x140/0x440 [ 93.440584][ T6069] ? __rcu_read_unlock+0x27f/0x5e0 [ 93.440608][ T6069] ? __fget_files+0x21f/0x3d0 [ 93.440631][ T6069] security_file_ioctl+0xd3/0x230 [ 93.440665][ T6069] __x64_sys_ioctl+0xb7/0x210 [ 93.440693][ T6069] do_syscall_64+0x115/0x870 [ 93.440714][ T6069] ? clear_bhb_loop+0x70/0xc0 [ 93.440735][ T6069] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.440753][ T6069] RIP: 0033:0x7faa3d39e0d9 [ 93.440767][ T6069] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.440783][ T6069] RSP: 002b:00007faa3e22a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.440800][ T6069] RAX: ffffffffffffffda RBX: 00007faa3d625fa0 RCX: 00007faa3d39e0d9 [ 93.440810][ T6069] RDX: 0000200000000280 RSI: 00000000c0405668 RDI: 0000000000000003 [ 93.440820][ T6069] RBP: 00007faa3e22a090 R08: 0000000000000000 R09: 0000000000000000 [ 93.440830][ T6069] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 93.440839][ T6069] R13: 00007faa3d626038 R14: 00007faa3d625fa0 R15: 00007fffbac2d648 [ 93.440863][ T6069] [ 93.490470][ T5722] lenovo 0003:17EF:60EE.0001: unknown main item tag 0x0 [ 93.718735][ T6069] ERROR: Out of memory at tomoyo_realpath_from_path. [ 93.770270][ T5722] lenovo 0003:17EF:60EE.0001: unknown main item tag 0x0 [ 93.778715][ T5722] lenovo 0003:17EF:60EE.0001: unknown main item tag 0x0 [ 93.786982][ T5700] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 93.796351][ T5722] lenovo 0003:17EF:60EE.0001: unknown main item tag 0x0 [ 93.832695][ T5722] lenovo 0003:17EF:60EE.0001: unknown main item tag 0x0 [ 93.840802][ T5700] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 93.853874][ T5722] lenovo 0003:17EF:60EE.0001: unknown main item tag 0x0 [ 93.861114][ T5722] lenovo 0003:17EF:60EE.0001: unknown main item tag 0x0 [ 93.870691][ T5722] lenovo 0003:17EF:60EE.0001: unknown main item tag 0x0 [ 93.879446][ T5700] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 93.935560][ T5700] usb 5-1: Product: syz [ 93.948070][ T5700] usb 5-1: Manufacturer: syz [ 93.953645][ T6075] netlink: 4 bytes leftover after parsing attributes in process `syz.0.79'. [ 93.972775][ T5700] usb 5-1: SerialNumber: syz [ 94.014809][ T6078] netlink: 148 bytes leftover after parsing attributes in process `syz.3.74'. [ 94.026128][ T6075] netlink: 'syz.0.79': attribute type 1 has an invalid length. [ 94.051371][ T5722] lenovo 0003:17EF:60EE.0001: hidraw0: USB HID v0.00 Device [HID 17ef:60ee] on usb-dummy_hcd.1-1/input0 [ 94.319099][ T6078] netlink: 148 bytes leftover after parsing attributes in process `syz.3.74'. [ 94.377125][ T5700] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 6 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 94.582691][ T5722] usb 5-1: USB disconnect, device number 6 [ 94.620506][ T5722] usblp0: removed [ 94.981726][ T29] kauditd_printk_skb: 18 callbacks suppressed [ 94.981742][ T29] audit: type=1400 audit(1786282088.505:321): avc: denied { watch } for pid=6092 comm="syz.0.83" path="/15" dev="tmpfs" ino=94 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 95.117517][ T29] audit: type=1400 audit(1786282088.585:322): avc: denied { connect } for pid=6095 comm="syz.2.84" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 95.177636][ T29] audit: type=1400 audit(1786282088.705:323): avc: denied { mmap_zero } for pid=6097 comm="syz.2.85" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 95.215548][ T29] audit: type=1400 audit(1786282088.725:324): avc: denied { allowed } for pid=6097 comm="syz.2.85" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 95.324708][ T6104] can0: slcan on ttyS3. [ 95.382737][ T6104] netlink: 48 bytes leftover after parsing attributes in process `syz.2.87'. [ 95.564648][ T29] audit: type=1400 audit(1786282089.085:325): avc: denied { read } for pid=6111 comm="syz.4.89" name="iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 95.608071][ T6103] can0 (unregistered): slcan off ttyS3. [ 95.631821][ T29] audit: type=1400 audit(1786282089.085:326): avc: denied { open } for pid=6111 comm="syz.4.89" path="/dev/iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 95.703930][ T29] audit: type=1400 audit(1786282089.085:327): avc: denied { ioctl } for pid=6111 comm="syz.4.89" path="/dev/iommu" dev="devtmpfs" ino=624 ioctlcmd=0x3b80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 95.796983][ T6121] netlink: 60 bytes leftover after parsing attributes in process `syz.2.91'. [ 95.906080][ T5722] usb 2-1: USB disconnect, device number 3 [ 96.039454][ T29] audit: type=1400 audit(1786282089.555:328): avc: denied { write } for pid=6108 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 96.122428][ T29] audit: type=1400 audit(1786282089.645:329): avc: denied { firmware_load } for pid=6119 comm="syz.2.91" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 96.191430][ T29] audit: type=1400 audit(1786282089.705:330): avc: denied { write } for pid=6133 comm="syz.1.95" name="vmci" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 96.790498][ T6135] netlink: 8 bytes leftover after parsing attributes in process `syz.1.95'. [ 96.933380][ T6159] FAULT_INJECTION: forcing a failure. [ 96.933380][ T6159] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 97.006158][ T6161] random: crng reseeded on system resumption [ 97.040196][ T6159] CPU: 0 UID: 0 PID: 6159 Comm: syz.4.101 Tainted: G L syzkaller #0 PREEMPT(full) [ 97.040224][ T6159] Tainted: [L]=SOFTLOCKUP [ 97.040229][ T6159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 97.040238][ T6159] Call Trace: [ 97.040244][ T6159] [ 97.040250][ T6159] dump_stack_lvl+0x100/0x190 [ 97.040277][ T6159] should_fail_ex.cold+0x5/0xa [ 97.040299][ T6159] _copy_from_user+0x2e/0xd0 [ 97.040324][ T6159] copy_msghdr_from_user+0x9f/0x4c0 [ 97.040343][ T6159] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 97.040371][ T6159] ___sys_sendmsg+0x106/0x1e0 [ 97.040389][ T6159] ? __pfx____sys_sendmsg+0x10/0x10 [ 97.040405][ T6159] ? __lock_acquire+0x49f/0x1a40 [ 97.040427][ T6159] ? get_pid_task+0x106/0x250 [ 97.040469][ T6159] __sys_sendmsg+0x160/0x210 [ 97.040492][ T6159] ? __pfx___sys_sendmsg+0x10/0x10 [ 97.040526][ T6159] do_syscall_64+0x115/0x870 [ 97.040548][ T6159] ? clear_bhb_loop+0x70/0xc0 [ 97.040570][ T6159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.040587][ T6159] RIP: 0033:0x7fcee419e0d9 [ 97.040600][ T6159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.040615][ T6159] RSP: 002b:00007fcee513b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 97.040637][ T6159] RAX: ffffffffffffffda RBX: 00007fcee4425fa0 RCX: 00007fcee419e0d9 [ 97.040647][ T6159] RDX: 0000000020008840 RSI: 0000200000000080 RDI: 0000000000000003 [ 97.040656][ T6159] RBP: 00007fcee513b090 R08: 0000000000000000 R09: 0000000000000000 [ 97.040665][ T6159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 97.040675][ T6159] R13: 00007fcee4426038 R14: 00007fcee4425fa0 R15: 00007ffc7e24a0d8 [ 97.040698][ T6159] [ 97.225546][ T6164] netlink: 16 bytes leftover after parsing attributes in process `syz.1.102'. [ 97.235796][ T6164] netlink: 16 bytes leftover after parsing attributes in process `syz.1.102'. [ 97.325549][ T5693] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 97.491342][ T5693] usb 1-1: unable to get BOS descriptor or descriptor too short [ 97.524989][ T5693] usb 1-1: not running at top speed; connect to a high speed hub [ 97.559471][ T5693] usb 1-1: New USB device found, idVendor=05ac, idProduct=0221, bcdDevice= 0.40 [ 97.597734][ T5693] usb 1-1: config 1 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 97.616060][ T5693] usb 1-1: config 1 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 97.634537][ T5693] usb 1-1: config 1 interface 0 has no altsetting 0 [ 97.651340][ T5693] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.662435][ T5693] usb 1-1: Product: syz [ 97.668786][ T5693] usb 1-1: SerialNumber: syz [ 97.673102][ T6173] nvme nvme0: failed to connect socket: -111 [ 97.693028][ T6156] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 98.185774][ T5693] usbhid 1-1:1.0: can't add hid device: -71 [ 98.206289][ T5693] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 98.257756][ T5693] usb 1-1: USB disconnect, device number 4 [ 98.387989][ T6187] fuse: Bad value for 'user_id' [ 98.401179][ T6187] fuse: Bad value for 'user_id' [ 98.579462][ T6198] netlink: 'syz.2.112': attribute type 9 has an invalid length. [ 98.596477][ T6198] netlink: 'syz.2.112': attribute type 7 has an invalid length. [ 98.608943][ T6198] netlink: 'syz.2.112': attribute type 8 has an invalid length. [ 98.611900][ T6190] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 98.625925][ T6198] qrtr: Invalid version 8 [ 98.774158][ T6204] trusted_key: encrypted_key: insufficient parameters specified [ 98.808159][ T6210] netlink: 16 bytes leftover after parsing attributes in process `syz.3.116'. [ 98.839832][ T6204] binder_alloc: 6202: pid 6202 spamming oneway? 1 buffers allocated for a total size of 4096 [ 98.863510][ T6201] jffs2: notice: (6201) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 98.882081][ T6204] binder_alloc: 6202: pid 6202 spamming oneway? 2 buffers allocated for a total size of 5120 [ 98.898384][ T6204] nbd: must specify a device to reconfigure [ 99.221585][ T6223] syz.0.120: vmalloc error: size 9007199254740992, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 99.247684][ T6227] binder: Binderfs stats mode cannot be changed during a remount [ 99.275955][ T6223] CPU: 0 UID: 0 PID: 6223 Comm: syz.0.120 Tainted: G L syzkaller #0 PREEMPT(full) [ 99.275991][ T6223] Tainted: [L]=SOFTLOCKUP [ 99.275998][ T6223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 99.276011][ T6223] Call Trace: [ 99.276017][ T6223] [ 99.276024][ T6223] dump_stack_lvl+0x100/0x190 [ 99.276060][ T6223] warn_alloc.cold+0x94/0xa8 [ 99.276083][ T6223] ? __pfx_warn_alloc+0x10/0x10 [ 99.276112][ T6223] ? lockdep_unlock+0x5a/0xc0 [ 99.276131][ T6223] ? __lock_acquire+0xd5b/0x1a40 [ 99.276165][ T6223] __vmalloc_node_range_noprof+0x136c/0x1630 [ 99.276199][ T6223] ? trace_contention_end+0x126/0x160 [ 99.276224][ T6223] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 99.276255][ T6223] ? dvb_demux_do_ioctl+0x929/0x1200 [ 99.276290][ T6223] ? find_held_lock+0x2b/0x80 [ 99.276311][ T6223] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 99.276341][ T6223] ? __pfx___mutex_lock+0x10/0x10 [ 99.276373][ T6223] ? tomoyo_path_number_perm+0x188/0x580 [ 99.276409][ T6223] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 99.276439][ T6223] __vmalloc_node_noprof+0xad/0xf0 [ 99.276467][ T6223] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 99.276499][ T6223] dvb_demux_do_ioctl+0x9e0/0x1200 [ 99.276531][ T6223] ? do_vfs_ioctl+0x226/0x13e0 [ 99.276562][ T6223] dvb_usercopy+0x167/0x340 [ 99.276588][ T6223] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 99.276620][ T6223] ? __pfx_dvb_usercopy+0x10/0x10 [ 99.276658][ T6223] ? selinux_file_ioctl+0x13b/0x290 [ 99.276687][ T6223] ? selinux_file_ioctl+0xb6/0x290 [ 99.276719][ T6223] dvb_demux_ioctl+0x29/0x40 [ 99.276746][ T6223] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 99.276774][ T6223] __x64_sys_ioctl+0x18e/0x210 [ 99.276805][ T6223] do_syscall_64+0x115/0x870 [ 99.276830][ T6223] ? clear_bhb_loop+0x70/0xc0 [ 99.276850][ T6223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.276868][ T6223] RIP: 0033:0x7f671579e0d9 [ 99.276884][ T6223] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.276900][ T6223] RSP: 002b:00007f671669a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 99.276919][ T6223] RAX: ffffffffffffffda RBX: 00007f6715a25fa0 RCX: 00007f671579e0d9 [ 99.276932][ T6223] RDX: 0020000000000000 RSI: 0000000000006f2d RDI: 0000000000000003 [ 99.276942][ T6223] RBP: 00007f6715835024 R08: 0000000000000000 R09: 0000000000000000 [ 99.276953][ T6223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.276963][ T6223] R13: 00007f6715a26038 R14: 00007f6715a25fa0 R15: 00007ffe5ad035f8 [ 99.276987][ T6223] [ 99.277905][ T6223] Mem-Info: [ 99.558148][ T6228] sctp: [Deprecated]: syz.4.119 (pid 6228) Use of struct sctp_assoc_value in delayed_ack socket option. [ 99.558148][ T6228] Use struct sctp_sack_info instead [ 99.633324][ T6225] sctp: [Deprecated]: syz.4.119 (pid 6225) Use of struct sctp_assoc_value in delayed_ack socket option. [ 99.633324][ T6225] Use struct sctp_sack_info instead [ 99.664410][ T6223] active_anon:21621 inactive_anon:0 isolated_anon:0 [ 99.664410][ T6223] active_file:0 inactive_file:60184 isolated_file:0 [ 99.664410][ T6223] unevictable:0 dirty:304 writeback:0 [ 99.664410][ T6223] slab_reclaimable:11451 slab_unreclaimable:95881 [ 99.664410][ T6223] mapped:30315 shmem:12232 pagetables:1299 [ 99.664410][ T6223] sec_pagetables:0 bounce:0 [ 99.664410][ T6223] kernel_misc_reclaimable:0 [ 99.664410][ T6223] free:1278687 free_pcp:24558 free_cma:0 [ 99.782595][ T6223] Node 0 active_anon:76384kB inactive_anon:0kB active_file:0kB inactive_file:240504kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:121224kB dirty:1216kB writeback:0kB shmem:38728kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:4096kB kernel_stack:12268kB pagetables:5160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 99.918875][ T6223] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:232kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:36kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 100.022602][ T29] kauditd_printk_skb: 41 callbacks suppressed [ 100.022618][ T29] audit: type=1400 audit(1786282093.545:372): avc: denied { mount } for pid=6247 comm="syz.3.126" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 100.074187][ T6223] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 100.075100][ T6250] bond1: option xmit_hash_policy: invalid value (6) [ 100.105282][ T6252] netlink: 8 bytes leftover after parsing attributes in process `syz.3.126'. [ 100.105304][ T6252] netlink: 12 bytes leftover after parsing attributes in process `syz.3.126'. [ 100.151678][ T6250] bond1 (unregistering): Released all slaves [ 100.225743][ T5722] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 100.253915][ T6223] lowmem_reserve[]: 0 2472 2473 2473 2473 [ 100.275571][ T6223] Node 0 DMA32 free:1183624kB boost:0kB min:34012kB low:42512kB high:51012kB reserved_highatomic:0KB free_highatomic:0KB active_anon:70684kB inactive_anon:0kB active_file:0kB inactive_file:240504kB unevictable:0kB writepending:1316kB zspages:0kB present:3129332kB managed:2532244kB mlocked:0kB bounce:0kB free_pcp:86688kB local_pcp:20396kB free_cma:0kB [ 100.370650][ T6223] lowmem_reserve[]: 0 0 0 0 0 [ 100.384558][ T6223] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:384kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 100.425359][ T5722] usb 2-1: unable to get BOS descriptor or descriptor too short [ 100.436438][ T6223] lowmem_reserve[]: 0 0 0 0 0 [ 100.462404][ T6223] Node 1 Normal free:3941516kB boost:0kB min:55880kB low:69848kB high:83816kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:232kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:468kB local_pcp:316kB free_cma:0kB [ 100.577193][ T5722] usb 2-1: not running at top speed; connect to a high speed hub [ 100.664176][ T5722] usb 2-1: New USB device found, idVendor=05ac, idProduct=0221, bcdDevice= 0.40 [ 100.812483][ T5722] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 100.902952][ T6223] lowmem_reserve[]: 0 0 0 0 0 [ 100.908462][ T29] audit: type=1400 audit(1786282094.435:373): avc: denied { write } for pid=6239 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 100.937442][ T6223] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 100.950237][ T5722] usb 2-1: config 1 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 101.016405][ T6223] Node 0 DMA32: 3293*4kB (UME) 1548*8kB (UME) 868*16kB (UME) 925*32kB (UM) 547*64kB (UM) 310*128kB (UM) 138*256kB (UME) 53*512kB (UME) 12*1024kB (UME) 8*2048kB (UM) 238*4096kB (UM) = 1209716kB [ 101.042926][ T5722] usb 2-1: config 1 interface 0 has no altsetting 0 [ 101.060094][ T29] audit: type=1400 audit(1786282094.485:374): avc: denied { write } for pid=6264 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.100467][ T6265] netlink: 4 bytes leftover after parsing attributes in process `syz.2.127'. [ 101.114134][ T5722] usb 2-1: string descriptor 0 read error: -22 [ 101.121228][ T5722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.131468][ T6223] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 101.156412][ T6245] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 101.182691][ T6223] Node 1 Normal: 1*4kB (M) 5*8kB (U) 4*16kB (U) 9*32kB (U) 6*64kB (U) 3*128kB (U) 2*256kB (UM) 5*512kB (UM) 1*1024kB (M) 0*2048kB 961*4096kB (M) = 3941516kB [ 101.218561][ T5259] veth1_vlan: left promiscuous mode [ 101.242887][ T29] audit: type=1400 audit(1786282094.765:375): avc: denied { unmount } for pid=5592 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 101.270320][ T6223] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 101.312380][ T6223] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 101.326713][ T6223] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 101.337831][ T6223] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 101.351224][ T6223] 63384 total pagecache pages [ 101.356063][ T6223] 0 pages in swap cache [ 101.360478][ T6223] Free swap = 124996kB [ 101.365629][ T6223] Total swap = 124996kB [ 101.378044][ T6223] 2097051 pages RAM [ 101.382733][ T5722] usbhid 2-1:1.0: can't add hid device: -71 [ 101.391109][ T6223] 0 pages HighMem/MovableOnly [ 101.396296][ T5722] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 101.404492][ T6223] 432279 pages reserved [ 101.427621][ T6223] 0 pages cma reserved [ 101.433102][ T5722] usb 2-1: USB disconnect, device number 4 [ 101.463783][ T6269] netlink: 16 bytes leftover after parsing attributes in process `syz.3.128'. [ 101.651240][ T1211] hid_parser_main: 453 callbacks suppressed [ 101.651259][ T1211] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 101.666887][ T29] audit: type=1400 audit(1786282095.195:376): avc: denied { connect } for pid=6272 comm="syz.0.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 101.721706][ T6279] ip_tables: iptables: counters copy to user failed while replacing table [ 101.743334][ T1211] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 102.671356][ T29] audit: type=1400 audit(1786282096.185:377): avc: denied { write } for pid=6274 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 102.997677][ T29] audit: type=1400 audit(1786282096.515:378): avc: denied { write } for pid=6305 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 103.223170][ T29] audit: type=1400 audit(1786282096.725:379): avc: denied { read write } for pid=6317 comm="syz.4.138" name="nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 103.261812][ T6321] Driver unsupported XDP return value 0 on prog (id 10) dev N/A, expect packet loss! [ 103.352735][ T6315] netlink: 16 bytes leftover after parsing attributes in process `syz.1.137'. [ 103.440071][ T29] audit: type=1400 audit(1786282096.725:380): avc: denied { open } for pid=6317 comm="syz.4.138" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 103.633268][ T29] audit: type=1400 audit(1786282096.795:381): avc: denied { bind } for pid=6297 comm="syz.0.133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 103.746340][ T5600] Bluetooth: hci4: command tx timeout [ 103.836270][ T5722] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 103.999303][ T6331] netlink: 8 bytes leftover after parsing attributes in process `syz.3.139'. [ 104.057290][ T5722] usb 2-1: Using ep0 maxpacket: 32 [ 104.142270][ T5722] usb 2-1: New USB device found, idVendor=056a, idProduct=0018, bcdDevice= 0.40 [ 104.220756][ T5722] usb 2-1: config 1 interface 0 altsetting 109 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 104.277848][ T5722] usb 2-1: config 1 interface 0 has no altsetting 0 [ 104.332859][ T5722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.360137][ T5722] usb 2-1: Product: 巪噒露醑邏褷ꓓ旸塧鲈䐴䓨碱덇뜾ਇ訌ἀ誉䡆돃㯐㎐블ᗥ䢫軺䐧裛支寊쏏鹪崶찳뿼ڭ擳쒷ꭋ흔탫톊ⲥ [ 104.403871][ T5722] usb 2-1: Manufacturer: я [ 104.421951][ T5722] usb 2-1: SerialNumber: 瀜[㲄䖀ԇ幛ᴫᕏ滞霂臷還긟乪仩鯺크ࢧ줋쒥⎕窑籪ﻨ琻촾斓솝岡韓职狈ᵉꇁ塨掤쑝뭲䆴遣㥈鎖囝甽蟟筦ḧ䨱㙩迮䅾곛䋖悊䍜鮬㛢䡚ǯᢃ按眦ⴥ⥹㴃츆 [ 104.925705][ T982] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 104.935064][ T5722] usbhid 2-1:1.0: can't add hid device: -71 [ 104.941910][ T5722] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 104.989447][ T5722] usb 2-1: USB disconnect, device number 5 [ 105.089874][ T29] kauditd_printk_skb: 7 callbacks suppressed [ 105.089890][ T29] audit: type=1400 audit(1786282098.615:389): avc: denied { write } for pid=6345 comm="syz.4.143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 105.107589][ T982] usb 4-1: unable to get BOS descriptor or descriptor too short [ 105.159363][ T29] audit: type=1400 audit(1786282098.645:390): avc: denied { nlmsg_write } for pid=6345 comm="syz.4.143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 105.174107][ T982] usb 4-1: not running at top speed; connect to a high speed hub [ 105.207466][ T982] usb 4-1: New USB device found, idVendor=05ac, idProduct=0221, bcdDevice= 0.40 [ 105.220468][ T982] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 105.233861][ T982] usb 4-1: config 1 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 105.249305][ T982] usb 4-1: config 1 interface 0 has no altsetting 0 [ 105.262688][ T982] usb 4-1: string descriptor 0 read error: -22 [ 105.276003][ T982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.304894][ T6343] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 105.386613][ T42] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 105.534774][ T982] usbhid 4-1:1.0: can't add hid device: -71 [ 105.553366][ T982] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 105.565614][ T42] usb 5-1: Using ep0 maxpacket: 8 [ 105.579854][ T42] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 105.588127][ T982] usb 4-1: USB disconnect, device number 4 [ 105.608988][ T42] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 105.634774][ T42] usb 5-1: config 179 has no interface number 0 [ 105.650243][ T42] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 105.677325][ T42] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 105.698828][ T42] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 105.722190][ T42] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 105.742594][ T42] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 105.794027][ T42] usb 5-1: config 179 interface 65 has no altsetting 0 [ 105.823970][ T42] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.875583][ T42] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input8 [ 105.897217][ T29] audit: type=1400 audit(1786282099.415:391): avc: denied { mount } for pid=6353 comm="syz.1.146" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 106.101380][ T6346] netlink: 20 bytes leftover after parsing attributes in process `syz.4.143'. [ 106.315102][ T42] usb 5-1: USB disconnect, device number 7 [ 106.590352][ T29] audit: type=1400 audit(1786282100.105:392): avc: denied { unmount } for pid=5593 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 106.704628][ T29] audit: type=1400 audit(1786282100.195:393): avc: denied { write } for pid=6360 comm="syz.1.149" name="video4" dev="devtmpfs" ino=937 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 106.792684][ T29] audit: type=1400 audit(1786282100.315:394): avc: denied { setopt } for pid=6364 comm="syz.0.150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 106.957220][ T6369] syz.0.150 uses obsolete (PF_INET,SOCK_PACKET) [ 106.978555][ T29] audit: type=1400 audit(1786282100.365:395): avc: denied { read } for pid=6364 comm="syz.0.150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 107.158183][ T29] audit: type=1400 audit(1786282100.685:396): avc: denied { create } for pid=6379 comm="syz.4.153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 107.527190][ T42] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 107.548390][ T6394] netlink: 4 bytes leftover after parsing attributes in process `syz.0.154'. [ 107.689914][ T6393] 9p: Bad value for 'wfdno' [ 107.716332][ T42] usb 5-1: New USB device found, idVendor=1a86, idProduct=752d, bcdDevice= 0.40 [ 107.751724][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.772845][ T42] usb 5-1: Product: syz [ 107.786008][ T42] usb 5-1: Manufacturer: syz [ 107.799178][ T42] usb 5-1: SerialNumber: syz [ 107.905653][ T29] audit: type=1400 audit(1786282101.425:397): avc: denied { write } for pid=6378 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 108.057723][ T29] audit: type=1400 audit(1786282101.565:398): avc: denied { write } for pid=6406 comm="syz.3.158" name="sg0" dev="devtmpfs" ino=803 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 108.184635][ T42] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 108.220222][ T42] snd-usb-audio 5-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 108.273631][ T42] usb 5-1: USB disconnect, device number 8 [ 109.385568][ T42] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 109.515689][ T42] usb 4-1: device descriptor read/64, error -71 [ 109.546363][ T5722] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 109.716080][ T5722] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 109.732451][ T5722] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 109.752953][ T5722] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 109.768067][ T42] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 109.775518][ T5722] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 109.809352][ T5722] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 109.817618][ T5722] usb 5-1: Product: syz [ 109.821872][ T5722] usb 5-1: Manufacturer: syz [ 109.829815][ T5722] garmin_gps 5-1:1.0: Garmin GPS usb/tty converter detected [ 109.864010][ T5722] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 109.888383][ T5722] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 109.966140][ T42] usb 4-1: device descriptor read/64, error -71 [ 110.060792][ T5722] usb 5-1: USB disconnect, device number 9 [ 110.079724][ T5722] garmin_gps 5-1:1.0: device disconnected [ 110.106467][ T42] usb usb4-port1: attempt power cycle [ 110.158916][ T6445] 9p: Bad value for 'wfdno' [ 110.191155][ T29] kauditd_printk_skb: 7 callbacks suppressed [ 110.191172][ T29] audit: type=1400 audit(1786282103.715:406): avc: denied { create } for pid=5601 comm="syz-executor" name="#7" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 110.230266][ T29] audit: type=1400 audit(1786282103.755:407): avc: denied { link } for pid=5601 comm="syz-executor" name="#7" dev="tmpfs" ino=187 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 110.252801][ T29] audit: type=1400 audit(1786282103.755:408): avc: denied { rename } for pid=5601 comm="syz-executor" name="#8" dev="tmpfs" ino=187 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 110.389926][ T6448] netlink: 364 bytes leftover after parsing attributes in process `syz.1.166'. [ 110.418445][ T29] audit: type=1400 audit(1786282103.945:409): avc: denied { associate } for pid=6447 comm="syz.1.166" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 110.455832][ T42] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 110.515370][ T29] audit: type=1400 audit(1786282104.035:410): avc: denied { create } for pid=6451 comm="syz.2.171" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 110.596908][ T42] usb 4-1: device descriptor read/8, error -71 [ 110.606057][ T29] audit: type=1400 audit(1786282104.105:411): avc: denied { connect } for pid=6451 comm="syz.2.171" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 110.639044][ T29] audit: type=1400 audit(1786282104.105:412): avc: denied { write } for pid=6451 comm="syz.2.171" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 110.659355][ T29] audit: type=1400 audit(1786282104.125:413): avc: denied { read write } for pid=6453 comm="syz.1.170" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 110.684548][ T29] audit: type=1400 audit(1786282104.125:414): avc: denied { open } for pid=6453 comm="syz.1.170" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 110.724609][ T29] audit: type=1400 audit(1786282104.125:415): avc: denied { ioctl } for pid=6453 comm="syz.1.170" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x7040 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 110.806930][ T6001] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.845543][ T42] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 110.890498][ T42] usb 4-1: device descriptor read/8, error -71 [ 110.901437][ T6001] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.927881][ T5701] usb 3-1: new low-speed USB device number 2 using dummy_hcd [ 111.027555][ T42] usb usb4-port1: unable to enumerate USB device [ 111.070158][ T6001] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.086633][ T5701] usb 3-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 111.108761][ T5701] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 111.221886][ T5701] usb 3-1: can't read configurations, error -61 [ 111.254116][ T5596] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 111.255404][ T6001] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.280871][ T5596] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 111.461906][ T5596] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 111.477133][ T5596] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 111.491475][ T5596] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 111.745964][ T5701] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 111.966659][ T5701] usb 3-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 111.996408][ T5701] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 112.007865][ T5701] usb 3-1: can't read configurations, error -61 [ 112.025488][ T5701] usb usb3-port1: attempt power cycle [ 112.066231][ T5596] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 112.076398][ T5596] Bluetooth: hci3: Injecting HCI hardware error event [ 112.085294][ T5600] Bluetooth: hci3: hardware error 0x00 [ 112.107659][ T6485] 9p: Bad value for 'wfdno' [ 112.160951][ T6001] bridge_slave_1: left allmulticast mode [ 112.196846][ T6001] bridge_slave_1: left promiscuous mode [ 112.228041][ T6001] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.318206][ T6001] bridge_slave_0: left allmulticast mode [ 112.339471][ T6001] bridge_slave_0: left promiscuous mode [ 112.361200][ T6001] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.378416][ T5701] usb 3-1: new low-speed USB device number 4 using dummy_hcd [ 112.426369][ T5701] usb 3-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 112.450132][ T5701] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 112.463989][ T5701] usb 3-1: can't read configurations, error -61 [ 112.607797][ T5701] usb 3-1: new low-speed USB device number 5 using dummy_hcd [ 112.647383][ T5701] usb 3-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 112.666084][ T5701] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 112.680792][ T5701] usb 3-1: can't read configurations, error -61 [ 112.681815][ T6512] netlink: 32 bytes leftover after parsing attributes in process `syz.3.182'. [ 112.694097][ T5701] usb usb3-port1: unable to enumerate USB device [ 112.715168][ T6001] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 112.731520][ T6001] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 112.744194][ T6500] FAT-fs (nullb0): bogus number of reserved sectors [ 112.751277][ T6500] FAT-fs (nullb0): Can't find a valid FAT filesystem [ 112.752663][ T6001] bond0 (unregistering): Released all slaves [ 112.788466][ T5259] 8021q: adding VLAN 0 to HW filter on device eth2 [ 113.373785][ T6001] hsr_slave_0: left promiscuous mode [ 113.565788][ T6001] hsr_slave_1: left promiscuous mode [ 113.588030][ T5596] Bluetooth: hci2: command tx timeout [ 113.681395][ T6001] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 113.754276][ T6001] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 113.779154][ T6001] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 113.794627][ T6001] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 113.861703][ T6001] veth1_macvtap: left promiscuous mode [ 113.879847][ T6001] veth0_macvtap: left promiscuous mode [ 113.897733][ T6001] veth1_vlan: left promiscuous mode [ 113.905874][ T6001] veth0_vlan: left promiscuous mode [ 114.017675][ T6538] netlink: 8 bytes leftover after parsing attributes in process `syz.4.186'. [ 114.189121][ T5722] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 114.226876][ T5600] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 114.322214][ T6001] team0 (unregistering): Port device team_slave_1 removed [ 114.357247][ T5722] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 114.368963][ T6001] team0 (unregistering): Port device team_slave_0 removed [ 114.381487][ T5722] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 114.399220][ T5722] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.428918][ T5722] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 114.451010][ T5722] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 81 [ 114.476520][ T5722] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 1 [ 114.493466][ T5722] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 114.510613][ T5722] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 114.530392][ T5722] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 114.556694][ T5722] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 114.564687][ T5722] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 114.600424][ T5722] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 114.825506][ T6556] netlink: 200 bytes leftover after parsing attributes in process `syz.2.187'. [ 115.665509][ T5600] Bluetooth: hci2: command tx timeout [ 115.682443][ T5259] 8021q: adding VLAN 0 to HW filter on device eth1 [ 115.886136][ T5722] usb 3-1: USB disconnect, device number 6 [ 117.159368][ T5722] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 117.222220][ T5722] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 117.280775][ T5722] keyspan 3-1:1.0: device disconnected [ 117.377766][ T29] kauditd_printk_skb: 33 callbacks suppressed [ 117.377782][ T29] audit: type=1400 audit(1786282110.905:449): avc: denied { write } for pid=6561 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.554650][ T6588] 9p: Bad value for 'wfdno' [ 117.645707][ T29] audit: type=1400 audit(1786282111.165:450): avc: denied { write } for pid=6589 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.748903][ T5600] Bluetooth: hci2: command tx timeout [ 118.433918][ T6470] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.444393][ T6470] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.463659][ T6470] bridge_slave_0: entered allmulticast mode [ 118.498565][ T6470] bridge_slave_0: entered promiscuous mode [ 118.517874][ T6470] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.531228][ T6470] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.538863][ T6470] bridge_slave_1: entered allmulticast mode [ 118.559988][ T6470] bridge_slave_1: entered promiscuous mode [ 118.793307][ T6470] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 118.817259][ T6470] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 119.005304][ T29] audit: type=1400 audit(1786282112.525:451): avc: denied { write } for pid=6597 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 119.077351][ T6470] team0: Port device team_slave_0 added [ 119.205766][ T6614] syzkaller0: entered promiscuous mode [ 119.227854][ T29] audit: type=1400 audit(1786282112.755:452): avc: denied { write } for pid=6625 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 119.245499][ T6614] syzkaller0: entered allmulticast mode [ 119.271701][ T6470] team0: Port device team_slave_1 added [ 119.328584][ T6630] comedi comedi3: multiq3: I/O base address not correctly aligned [ 119.335998][ T6627] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 119.358486][ T6627] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 119.841695][ T5600] Bluetooth: hci2: command tx timeout [ 119.851564][ T5600] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 119.863164][ T5600] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 119.878311][ T5600] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 119.891897][ T5600] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 119.918731][ T5600] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 120.964176][ T6575] Set syz1 is full, maxelem 65536 reached [ 121.288470][ T6644] netlink: 56 bytes leftover after parsing attributes in process `syz.1.204'. [ 121.430192][ T29] audit: type=1400 audit(1786282114.955:453): avc: denied { execute } for pid=6642 comm="syz.1.204" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=12310 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 121.477727][ T29] audit: type=1400 audit(1786282114.995:454): avc: denied { write } for pid=6642 comm="syz.1.204" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 121.848131][ T3295] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.880321][ T6470] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 121.887782][ T6470] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.925157][ T6470] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 121.945874][ T6470] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 121.952982][ T6470] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.979955][ T6470] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 121.997994][ T5600] Bluetooth: hci4: command tx timeout [ 122.053218][ T3295] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.121723][ T6470] hsr_slave_0: entered promiscuous mode [ 122.188438][ T6470] hsr_slave_1: entered promiscuous mode [ 122.201692][ T6470] debugfs: 'hsr0' already exists in 'hsr' [ 122.222554][ T6470] Cannot create hsr debugfs directory [ 122.222910][ T6658] 9p: Bad value for 'wfdno' [ 122.298146][ T3295] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.592479][ T3295] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.421688][ T29] audit: type=1400 audit(1786282116.945:455): avc: denied { write } for pid=6670 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 123.629757][ T3295] batadv1: left allmulticast mode [ 123.646854][ T3295] batadv1: left promiscuous mode [ 123.664730][ T29] audit: type=1400 audit(1786282117.185:456): avc: denied { write } for pid=6686 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 123.687926][ T3295] bridge0: port 3(batadv1) entered disabled state [ 123.720131][ T3295] bridge_slave_1: left allmulticast mode [ 123.726138][ T3295] bridge_slave_1: left promiscuous mode [ 123.735720][ T3295] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.767309][ T3295] bridge_slave_0: left allmulticast mode [ 123.775971][ T29] audit: type=1400 audit(1786282117.295:457): avc: denied { ioctl } for pid=6689 comm="syz.1.212" path="socket:[12067]" dev="sockfs" ino=12067 ioctlcmd=0x61f3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 123.805281][ T3295] bridge_slave_0: left promiscuous mode [ 123.816265][ T6690] netlink: Conntrack attr type has unexpected length (type=0, length=1, expected=0) [ 123.835733][ T3295] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.843374][ T6690] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 123.873709][ T5596] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 123.887204][ T5596] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 123.900088][ T5596] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 123.913755][ T5596] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 123.925784][ T5596] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 124.065582][ T5596] Bluetooth: hci4: command tx timeout [ 124.183860][ T3295] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 124.230025][ T3295] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 124.257376][ T3295] bond0 (unregistering): Released all slaves [ 124.292607][ T5259] 8021q: adding VLAN 0 to HW filter on device eth3 [ 125.458522][ T6470] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 125.500749][ T6470] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 125.510225][ T29] audit: type=1400 audit(1786282119.045:458): avc: denied { setopt } for pid=6706 comm="syz.3.214" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 125.536847][ T6470] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 125.565233][ T6470] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 125.655364][ T29] audit: type=1400 audit(1786282119.175:459): avc: denied { bind } for pid=6709 comm="syz.1.215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 125.780220][ T29] audit: type=1400 audit(1786282119.195:460): avc: denied { name_bind } for pid=6709 comm="syz.1.215" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 125.824326][ T29] audit: type=1400 audit(1786282119.195:461): avc: denied { node_bind } for pid=6709 comm="syz.1.215" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 125.853275][ T6470] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 125.869239][ T6470] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 125.876388][ T5701] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 125.889112][ T6470] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 125.917374][ T6470] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 125.986376][ T5596] Bluetooth: hci3: command tx timeout [ 126.007915][ T3295] hsr_slave_0: left promiscuous mode [ 126.018587][ T3295] hsr_slave_1: left promiscuous mode [ 126.024639][ T3295] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 126.039485][ T3295] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 126.051984][ T5701] usb 4-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 126.070054][ T3295] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 126.083883][ T5701] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.084850][ T3295] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 126.093157][ T5701] usb 4-1: Product: syz [ 126.103361][ T5701] usb 4-1: Manufacturer: syz [ 126.109597][ T5701] usb 4-1: SerialNumber: syz [ 126.122946][ T5701] usb 4-1: UAS is ignored for this device, using usb-storage instead [ 126.139648][ T3295] veth1_macvtap: left promiscuous mode [ 126.145802][ T5701] usb 4-1: UAS is ignored for this device, using usb-storage instead [ 126.153926][ T5596] Bluetooth: hci4: command tx timeout [ 126.156697][ T3295] veth0_macvtap: left promiscuous mode [ 126.165518][ T5701] usb-storage 4-1:1.0: USB Mass Storage device detected [ 126.192055][ T3295] veth1_vlan: left promiscuous mode [ 126.203023][ T5701] usb-storage 4-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 126.207983][ T3295] veth0_vlan: left promiscuous mode [ 126.220124][ T5701] scsi host1: usb-storage 4-1:1.0 [ 126.265265][ T6732] 9p: Bad value for 'wfdno' [ 126.423538][ T5701] usb 4-1: USB disconnect, device number 9 [ 126.457808][ T29] audit: type=1400 audit(1786282119.975:462): avc: denied { write } for pid=6725 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 126.557270][ T29] audit: type=1400 audit(1786282120.075:463): avc: denied { write } for pid=6743 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 126.658574][ T3295] team0 (unregistering): Port device team_slave_1 removed [ 126.672370][ T3295] team0 (unregistering): Port device team_slave_0 removed [ 126.774422][ T5259] 8021q: adding VLAN 0 to HW filter on device eth4 [ 126.856342][ T6636] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.863462][ T6636] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.871373][ T6636] bridge_slave_0: entered allmulticast mode [ 126.878232][ T6636] bridge_slave_0: entered promiscuous mode [ 126.904189][ T6636] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.918406][ T6636] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.925917][ T6636] bridge_slave_1: entered allmulticast mode [ 126.934091][ T6636] bridge_slave_1: entered promiscuous mode [ 126.982139][ T6636] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 127.022150][ T6636] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 127.146435][ T6636] team0: Port device team_slave_0 added [ 127.168398][ T6636] team0: Port device team_slave_1 added [ 127.241550][ T5600] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 127.257749][ T5600] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 127.270536][ T5600] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 127.281915][ T5600] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 127.289677][ T5600] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 127.291973][ T6636] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 127.348998][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.364726][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 127.375391][ T6636] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 127.416031][ T6762] FAULT_INJECTION: forcing a failure. [ 127.416031][ T6762] name failslab, interval 1, probability 0, space 0, times 0 [ 127.429711][ T6636] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 127.434335][ T6762] CPU: 0 UID: 0 PID: 6762 Comm: syz.3.221 Tainted: G L syzkaller #0 PREEMPT(full) [ 127.434366][ T6762] Tainted: [L]=SOFTLOCKUP [ 127.434372][ T6762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 127.434381][ T6762] Call Trace: [ 127.434386][ T6762] [ 127.434392][ T6762] dump_stack_lvl+0x100/0x190 [ 127.434417][ T6762] should_fail_ex.cold+0x5/0xa [ 127.434438][ T6762] should_failslab+0xc2/0x120 [ 127.434458][ T6762] __kmalloc_noprof+0xfc/0x820 [ 127.434477][ T6762] ? tomoyo_encode2+0xfb/0x3c0 [ 127.434497][ T6762] tomoyo_encode2+0xfb/0x3c0 [ 127.434515][ T6762] tomoyo_encode+0x29/0x50 [ 127.434529][ T6762] tomoyo_realpath_from_path+0x18c/0x690 [ 127.434551][ T6762] tomoyo_path_number_perm+0x23c/0x580 [ 127.434571][ T6762] ? tomoyo_path_number_perm+0x22e/0x580 [ 127.434594][ T6762] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 127.434637][ T6762] ? find_held_lock+0x2b/0x80 [ 127.434652][ T6762] ? __fget_files+0x215/0x3d0 [ 127.434668][ T6762] ? hook_file_ioctl_common+0x140/0x440 [ 127.434684][ T6762] ? __fget_files+0x215/0x3d0 [ 127.434704][ T6762] ? __fget_files+0x21f/0x3d0 [ 127.434724][ T6762] security_file_ioctl+0xd3/0x230 [ 127.434748][ T6762] __x64_sys_ioctl+0xb7/0x210 [ 127.434773][ T6762] do_syscall_64+0x115/0x870 [ 127.434793][ T6762] ? clear_bhb_loop+0x70/0xc0 [ 127.434812][ T6762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.434828][ T6762] RIP: 0033:0x7f7abd19e0d9 [ 127.434842][ T6762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.434856][ T6762] RSP: 002b:00007f7abdfa8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 127.434872][ T6762] RAX: ffffffffffffffda RBX: 00007f7abd425fa0 RCX: 00007f7abd19e0d9 [ 127.434882][ T6762] RDX: 00002000000006c0 RSI: 000000004030560b RDI: 0000000000000003 [ 127.434891][ T6762] RBP: 00007f7abdfa8090 R08: 0000000000000000 R09: 0000000000000000 [ 127.434901][ T6762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 127.434910][ T6762] R13: 00007f7abd426038 R14: 00007f7abd425fa0 R15: 00007ffc5b333108 [ 127.434931][ T6762] [ 127.434946][ T6762] ERROR: Out of memory at tomoyo_realpath_from_path. [ 127.468510][ T6470] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.714213][ T29] audit: type=1400 audit(1786282121.225:464): avc: denied { write } for pid=6750 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.741395][ T6636] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 127.749715][ T6636] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 127.777463][ T6636] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 127.871898][ T6470] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.964463][ T1029] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.057479][ T5259] 8021q: adding VLAN 0 to HW filter on device eth5 [ 128.067476][ T5600] Bluetooth: hci3: command tx timeout [ 128.178860][ T3295] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.185968][ T3295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.207769][ T6636] hsr_slave_0: entered promiscuous mode [ 128.213955][ T6636] hsr_slave_1: entered promiscuous mode [ 128.225039][ T6636] debugfs: 'hsr0' already exists in 'hsr' [ 128.233308][ T6636] Cannot create hsr debugfs directory [ 128.238977][ T5600] Bluetooth: hci4: command tx timeout [ 128.287790][ T1029] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.336703][ T3295] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.343878][ T3295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.393318][ T6691] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.403461][ T6691] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.423135][ T6691] bridge_slave_0: entered allmulticast mode [ 128.441445][ T6691] bridge_slave_0: entered promiscuous mode [ 128.493784][ T6691] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.504403][ T6691] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.514463][ T6691] bridge_slave_1: entered allmulticast mode [ 128.530043][ T6691] bridge_slave_1: entered promiscuous mode [ 128.562339][ T1029] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.652395][ T6691] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 128.684717][ T6691] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 128.789562][ T1029] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.881791][ T6691] team0: Port device team_slave_0 added [ 128.890610][ T6691] team0: Port device team_slave_1 added [ 128.993659][ T6691] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 129.007711][ T6691] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.055606][ T6691] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 129.106375][ T6691] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 129.119528][ T6801] 9p: Bad value for 'wfdno' [ 129.128956][ T6691] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.155973][ T6691] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 129.168279][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 129.168293][ T29] audit: type=1400 audit(1786282122.685:466): avc: denied { write } for pid=6789 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.240796][ T29] audit: type=1400 audit(1786282122.765:467): avc: denied { write } for pid=6807 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.345821][ T5600] Bluetooth: hci1: command tx timeout [ 129.374914][ T6691] hsr_slave_0: entered promiscuous mode [ 129.387625][ T6691] hsr_slave_1: entered promiscuous mode [ 129.399673][ T6691] debugfs: 'hsr0' already exists in 'hsr' [ 129.405414][ T6691] Cannot create hsr debugfs directory [ 129.456752][ T5259] 8021q: adding VLAN 0 to HW filter on device eth6 [ 129.703754][ T1029] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 129.718379][ T1029] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.821788][ T6636] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 129.835055][ T6636] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 129.844039][ T6636] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 129.864771][ T6636] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 129.948866][ T1029] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 129.959787][ T1029] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.990366][ T6636] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 130.001315][ T6636] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 130.058389][ T6636] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 130.098926][ T6636] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 130.145817][ T5600] Bluetooth: hci3: command tx timeout [ 130.223412][ T1029] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 130.238175][ T1029] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.329545][ T6470] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 130.428438][ T1029] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 130.457063][ T1029] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.645934][ T29] audit: type=1400 audit(1786282124.155:468): avc: denied { write } for pid=6846 comm="syz.3.228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 131.059876][ T29] audit: type=1400 audit(1786282124.575:469): avc: denied { write } for pid=6832 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 131.073116][ T6756] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.090895][ T6756] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.098153][ T6756] bridge_slave_0: entered allmulticast mode [ 131.111039][ T6756] bridge_slave_0: entered promiscuous mode [ 131.148480][ T6756] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.170156][ T6756] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.185049][ T6756] bridge_slave_1: entered allmulticast mode [ 131.238462][ T29] audit: type=1400 audit(1786282124.765:470): avc: denied { write } for pid=6866 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 131.309013][ T6756] bridge_slave_1: entered promiscuous mode [ 131.381920][ T29] audit: type=1400 audit(1786282124.905:471): avc: denied { create } for pid=6868 comm="syz.3.229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 131.418837][ T6756] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 131.430211][ T5259] 8021q: adding VLAN 0 to HW filter on device eth7 [ 131.436855][ T5600] Bluetooth: hci1: command tx timeout [ 131.456203][ T6756] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 132.212280][ T6756] team0: Port device team_slave_0 added [ 132.220021][ T6756] team0: Port device team_slave_1 added [ 132.230283][ T6691] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 132.237053][ T5600] Bluetooth: hci3: command tx timeout [ 132.253611][ T6691] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 132.301111][ T6691] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 132.315894][ T6691] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 132.324019][ T6691] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 132.348819][ T6691] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 132.410421][ T6756] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 132.424089][ T29] audit: type=1400 audit(1786282125.955:472): avc: denied { read write } for pid=6873 comm="syz.3.230" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 132.448429][ T6756] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 132.480889][ T29] audit: type=1400 audit(1786282125.955:473): avc: denied { open } for pid=6873 comm="syz.3.230" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 132.508787][ T29] audit: type=1400 audit(1786282126.035:474): avc: denied { create } for pid=6873 comm="syz.3.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 132.531263][ T29] audit: type=1400 audit(1786282126.055:475): avc: denied { setopt } for pid=6873 comm="syz.3.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 132.551385][ T6756] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 132.567794][ T6691] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 132.585375][ T6691] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 132.635160][ T6756] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 132.644774][ T6756] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 132.679816][ T6756] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 132.720903][ T1029] bridge_slave_1: left allmulticast mode [ 132.734153][ T1029] bridge_slave_1: left promiscuous mode [ 132.745780][ T1029] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.763163][ T1029] bridge_slave_0: left allmulticast mode [ 132.856087][ T42] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 132.871916][ T1029] bridge_slave_0: left promiscuous mode [ 132.988514][ T1029] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.020601][ T1029] bridge_slave_1: left allmulticast mode [ 133.028733][ T1029] bridge_slave_1: left promiscuous mode [ 133.034654][ T1029] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.062971][ T42] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 133.087626][ T42] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 39, changing to 4 [ 133.101066][ T1029] bridge_slave_0: left allmulticast mode [ 133.107446][ T42] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 133.118752][ T1029] bridge_slave_0: left promiscuous mode [ 133.124634][ T1029] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.175661][ T42] usb 4-1: config 0 interface 0 has no altsetting 0 [ 133.188576][ T42] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 133.205501][ T42] usb 4-1: Product: syz [ 133.209715][ T42] usb 4-1: Manufacturer: syz [ 133.224581][ T42] usb 4-1: SerialNumber: syz [ 133.258596][ T42] usb 4-1: config 0 descriptor?? [ 133.298338][ T42] usb 4-1: selecting invalid altsetting 0 [ 133.505687][ T5600] Bluetooth: hci1: command tx timeout [ 133.583709][ T1029] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 133.596481][ T1029] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 133.610927][ T1029] bond0 (unregistering): Released all slaves [ 133.702169][ T1029] bond0 (unregistering): (slave 30): Releasing backup interface [ 133.719170][ T1029] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 133.731413][ T1029] bond0 (unregistering): Released all slaves [ 133.763979][ T5259] 8021q: adding VLAN 0 to HW filter on device eth8 [ 133.857532][ T1029] rxrpc: Leaked peer e1 {1} [0000:0000:0000:0000:0000:0000:0000:0001]:7003 [ 133.887952][ T6878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.897866][ T1029] ================================================================== [ 133.905947][ T1029] BUG: KASAN: slab-use-after-free in rxrpc_destroy_all_peers+0x1ce/0x1d0 [ 133.914344][ T1029] Read of size 8 at addr ffff88803528cc20 by task kworker/u8:6/1029 [ 133.922294][ T1029] [ 133.924594][ T1029] CPU: 0 UID: 0 PID: 1029 Comm: kworker/u8:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 133.924611][ T1029] Tainted: [L]=SOFTLOCKUP [ 133.924615][ T1029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 133.924624][ T1029] Workqueue: netns cleanup_net [ 133.924642][ T1029] Call Trace: [ 133.924647][ T1029] [ 133.924651][ T1029] dump_stack_lvl+0x100/0x190 [ 133.924666][ T1029] print_report+0x13d/0x4b0 [ 133.924683][ T1029] ? __virt_addr_valid+0x239/0x430 [ 133.924699][ T1029] ? rxrpc_destroy_all_peers+0x1ce/0x1d0 [ 133.924714][ T1029] kasan_report+0xdf/0x1c0 [ 133.924730][ T1029] ? rxrpc_destroy_all_peers+0x1ce/0x1d0 [ 133.924747][ T1029] rxrpc_destroy_all_peers+0x1ce/0x1d0 [ 133.924764][ T1029] rxrpc_exit_net+0x83/0xc0 [ 133.924776][ T1029] ? __pfx_rxrpc_exit_net+0x10/0x10 [ 133.924788][ T1029] ops_undo_list+0x2ee/0xab0 [ 133.924809][ T1029] ? __pfx_ops_undo_list+0x10/0x10 [ 133.924824][ T1029] ? idr_destroy+0x62/0x2e0 [ 133.924848][ T1029] cleanup_net+0x499/0x920 [ 133.924865][ T1029] ? __pfx_cleanup_net+0x10/0x10 [ 133.924885][ T1029] ? rcu_is_watching+0x12/0xc0 [ 133.924907][ T1029] process_one_work+0xa23/0x1940 [ 133.924929][ T1029] ? __pfx_process_one_work+0x10/0x10 [ 133.924943][ T1029] ? __pfx_cleanup_net+0x10/0x10 [ 133.924963][ T1029] worker_thread+0x5ef/0xe50 [ 133.924980][ T1029] ? __pfx_worker_thread+0x10/0x10 [ 133.924993][ T1029] ? kthread+0x13a/0x450 [ 133.925007][ T1029] ? __pfx_worker_thread+0x10/0x10 [ 133.925018][ T1029] kthread+0x370/0x450 [ 133.925028][ T1029] ? __pfx_kthread+0x10/0x10 [ 133.925044][ T1029] ret_from_fork+0x72b/0xd50 [ 133.925060][ T1029] ? __pfx_ret_from_fork+0x10/0x10 [ 133.925079][ T1029] ? __switch_to+0x800/0x10f0 [ 133.925098][ T1029] ? __pfx_kthread+0x10/0x10 [ 133.925109][ T1029] ret_from_fork_asm+0x1a/0x30 [ 133.925129][ T1029] [ 133.925133][ T1029] [ 134.046026][ T6878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.049381][ T1029] Allocated by task 5852: [ 134.117821][ T1029] kasan_save_stack+0x30/0x50 [ 134.122491][ T1029] kasan_save_track+0x14/0x30 [ 134.127145][ T1029] __kasan_kmalloc+0xaa/0xb0 [ 134.131722][ T1029] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 134.137072][ T1029] rxrpc_alloc_peer+0xa7/0x400 [ 134.141816][ T1029] rxrpc_lookup_peer+0x168/0x680 [ 134.146730][ T1029] rxrpc_kernel_lookup_peer+0xa8/0xe0 [ 134.152083][ T1029] afs_merge_fs_addr6+0x186/0x460 [ 134.157079][ T1029] afs_parse_text_addrs+0x3f2/0xa10 [ 134.162252][ T1029] afs_lookup_cell+0xbb6/0x1940 [ 134.167087][ T1029] afs_proc_cells_write+0x2a3/0x3a0 [ 134.172262][ T1029] proc_simple_write+0x10e/0x1a0 [ 134.177178][ T1029] proc_reg_write+0x240/0x330 [ 134.181827][ T1029] vfs_write+0x2aa/0x1050 [ 134.186130][ T1029] ksys_write+0x12a/0x250 [ 134.190428][ T1029] do_syscall_64+0x115/0x870 [ 134.195080][ T1029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.200946][ T1029] [ 134.203246][ T1029] Freed by task 15: [ 134.207020][ T1029] kasan_save_stack+0x30/0x50 [ 134.211670][ T1029] kasan_save_track+0x14/0x30 [ 134.216340][ T1029] kasan_save_free_info+0x3b/0x70 [ 134.221354][ T1029] __kasan_slab_free+0x5f/0x80 [ 134.226105][ T1029] __rcu_free_sheaf_prepare+0x5d/0x2f0 [ 134.231562][ T1029] rcu_free_sheaf+0x1a/0xe0 [ 134.236065][ T1029] rcu_core+0x5a2/0x10d0 [ 134.240294][ T1029] handle_softirqs+0x1ea/0x9b0 [ 134.245033][ T1029] run_ksoftirqd+0x38/0x60 [ 134.249425][ T1029] smpboot_thread_fn+0x3d3/0xaa0 [ 134.254344][ T1029] kthread+0x370/0x450 [ 134.258382][ T1029] ret_from_fork+0x72b/0xd50 [ 134.262961][ T1029] ret_from_fork_asm+0x1a/0x30 [ 134.267807][ T1029] [ 134.270120][ T1029] The buggy address belongs to the object at ffff88803528cc00 [ 134.270120][ T1029] which belongs to the cache kmalloc-512 of size 512 [ 134.284231][ T1029] The buggy address is located 32 bytes inside of [ 134.284231][ T1029] freed 512-byte region [ffff88803528cc00, ffff88803528ce00) [ 134.297918][ T1029] [ 134.300215][ T1029] The buggy address belongs to the physical page: [ 134.306594][ T1029] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3528c [ 134.315423][ T1029] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 134.323904][ T1029] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 134.331414][ T1029] page_type: f5(slab) [ 134.335372][ T1029] raw: 00fff00000000040 ffff88813fe21c80 dead000000000100 dead000000000122 [ 134.343932][ T1029] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 134.352488][ T1029] head: 00fff00000000040 ffff88813fe21c80 dead000000000100 dead000000000122 [ 134.361129][ T1029] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 134.369769][ T1029] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 134.378407][ T1029] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 134.387044][ T1029] page dumped because: kasan: bad access detected [ 134.393449][ T1029] page_owner tracks the page as allocated [ 134.399143][ T1029] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16783483369, free_ts 0 [ 134.418825][ T1029] post_alloc_hook+0xfd/0x120 [ 134.423490][ T1029] get_page_from_freelist+0xf48/0x3530 [ 134.428919][ T1029] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 134.434781][ T1029] new_slab+0xa2/0x640 [ 134.438823][ T1029] refill_objects+0xe3/0x410 [ 134.443382][ T1029] __pcs_replace_empty_main+0x376/0x680 [ 134.448905][ T1029] __kmalloc_node_track_caller_noprof+0x679/0x830 [ 134.455292][ T1029] krealloc_node_align_noprof+0x1f9/0x3e0 [ 134.460983][ T1029] add_sysfs_param+0xdb/0x970 [ 134.465635][ T1029] param_sysfs_builtin_init+0x310/0x3f0 [ 134.471157][ T1029] do_one_initcall+0x11d/0x700 [ 134.475906][ T1029] kernel_init_freeable+0x6ea/0x7b0 [ 134.481098][ T1029] kernel_init+0x1f/0x1e0 [ 134.485397][ T1029] ret_from_fork+0x72b/0xd50 [ 134.489981][ T1029] ret_from_fork_asm+0x1a/0x30 [ 134.494722][ T1029] page_owner free stack trace missing [ 134.500054][ T1029] [ 134.502348][ T1029] Memory state around the buggy address: [ 134.507944][ T1029] ffff88803528cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 134.515973][ T1029] ffff88803528cb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 134.524005][ T1029] >ffff88803528cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 134.532031][ T1029] ^ [ 134.537111][ T1029] ffff88803528cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 134.545139][ T1029] ffff88803528cd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 134.553182][ T1029] ================================================================== [ 134.562198][ T5686] usb 4-1: USB disconnect, device number 10 [ 134.658854][ T1029] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 134.666114][ T1029] CPU: 0 UID: 0 PID: 1029 Comm: kworker/u8:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 134.677143][ T1029] Tainted: [L]=SOFTLOCKUP [ 134.681445][ T1029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 134.691479][ T1029] Workqueue: netns cleanup_net [ 134.696246][ T1029] Call Trace: [ 134.699511][ T1029] [ 134.702428][ T1029] dump_stack_lvl+0x100/0x190 [ 134.707102][ T1029] vpanic+0x552/0x970 [ 134.711061][ T1029] ? __pfx_vpanic+0x10/0x10 [ 134.715720][ T1029] ? rxrpc_destroy_all_peers+0x1ce/0x1d0 [ 134.721344][ T1029] panic+0xd1/0xe0 [ 134.725048][ T1029] ? __pfx_panic+0x10/0x10 [ 134.729446][ T1029] ? rxrpc_destroy_all_peers+0x1ce/0x1d0 [ 134.735063][ T1029] ? preempt_schedule_common+0x42/0xc0 [ 134.740520][ T1029] ? check_panic_on_warn+0x1f/0x90 [ 134.745614][ T1029] check_panic_on_warn.cold+0x19/0x34 [ 134.750974][ T1029] end_report.part.0+0x3a/0x90 [ 134.755734][ T1029] kasan_report.cold+0xe/0x18 [ 134.760397][ T1029] ? rxrpc_destroy_all_peers+0x1ce/0x1d0 [ 134.766019][ T1029] rxrpc_destroy_all_peers+0x1ce/0x1d0 [ 134.771462][ T1029] rxrpc_exit_net+0x83/0xc0 [ 134.775946][ T1029] ? __pfx_rxrpc_exit_net+0x10/0x10 [ 134.781126][ T1029] ops_undo_list+0x2ee/0xab0 [ 134.785705][ T1029] ? __pfx_ops_undo_list+0x10/0x10 [ 134.790800][ T1029] ? idr_destroy+0x62/0x2e0 [ 134.795300][ T1029] cleanup_net+0x499/0x920 [ 134.799712][ T1029] ? __pfx_cleanup_net+0x10/0x10 [ 134.804641][ T1029] ? rcu_is_watching+0x12/0xc0 [ 134.809399][ T1029] process_one_work+0xa23/0x1940 [ 134.814322][ T1029] ? __pfx_process_one_work+0x10/0x10 [ 134.819681][ T1029] ? __pfx_cleanup_net+0x10/0x10 [ 134.824608][ T1029] worker_thread+0x5ef/0xe50 [ 134.829193][ T1029] ? __pfx_worker_thread+0x10/0x10 [ 134.834285][ T1029] ? kthread+0x13a/0x450 [ 134.838509][ T1029] ? __pfx_worker_thread+0x10/0x10 [ 134.843618][ T1029] kthread+0x370/0x450 [ 134.847681][ T1029] ? __pfx_kthread+0x10/0x10 [ 134.852252][ T1029] ret_from_fork+0x72b/0xd50 [ 134.856834][ T1029] ? __pfx_ret_from_fork+0x10/0x10 [ 134.861930][ T1029] ? __switch_to+0x800/0x10f0 [ 134.866589][ T1029] ? __pfx_kthread+0x10/0x10 [ 134.871170][ T1029] ret_from_fork_asm+0x1a/0x30 [ 134.875926][ T1029] [ 134.879198][ T1029] Kernel Offset: disabled [ 134.883591][ T1029] Rebooting in 86400 seconds..