last executing test programs: 26m25.10210261s ago: executing program 32 (id=43): syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f"], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, r0) sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c050057d78d00", @ANYRES16=r1, @ANYBLOB="050000000000000000006c00000008000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000000080)=0x7) mount(0x0, 0x0, 0x0, 0x1214040, 0x0) mount$bind(0x0, 0x0, 0x0, 0x3a09007, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r6 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r6, 0x65, 0x1, &(0x7f00000002c0)=[{{0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}, {{0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}], 0x10) setsockopt$CAN_RAW_FILTER(r6, 0x65, 0x1, &(0x7f0000000100), 0x0) syz_open_dev$tty1(0xc, 0x4, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1e9) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) 16m46.713238502s ago: executing program 33 (id=1251): socket$nl_route(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x200, 0x7, 0x4}) bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) gettid() r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r0, 0x0, 0x2, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r1, 0x0, 0x2, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_mptcp(0x2, 0x1, 0x106) syz_emit_ethernet(0x3e, &(0x7f0000003e40)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00\x00x', 0x8, 0x0, 0x0, @local, @local, {[@routing={0x84, 0x0, 0x0, 0x0, 0x3100}]}}}}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x480, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x1, &(0x7f0000000700)=0x8, 0x4) 10m29.763475291s ago: executing program 0 (id=1890): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1a7) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r0 = open$dir(&(0x7f0000000040)='./mnt\x00', 0x0, 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f00000003c0)={@desc={0x1, 0x0, @desc3}, 0x10, 0x0, '\x00', @d}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000001c0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x6e}, 0x94) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) write$6lowpan_control(r3, &(0x7f0000000380)='disconnect aa:aa:aa:aa:aa:11 1', 0x1e) ioctl$TCXONC(r3, 0x540a, 0x3) sendmsg$kcm(r3, &(0x7f0000001080)={&(0x7f0000000180)=@hci={0x1f, 0x4, 0x2}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000200)="4b2d0da418c166ea8ae7a06395235bd47680a20fcc1869a85a4639026b071ea7430f2970853d7782360aa3df744d75cb4ef20cbd64f312bc8c0c087a9bfda63955a438aba6d5fa404c157bfb66ad8b03c6d7b6910966caff7be78da6f505ad302c2f2a31560ee32cb306c905da0e97e27c09491d40cb72c0daeb022aa91e6aa8cc88d7266e7a1b6c3752a57bb78ee6c2533d06d28a3b2a16f81286bba463a2ea7cbb58ac4197ee2f8cbbf940ff00113d5a9788fe3e7b7d871e66ccdd9be097b3fdaa9efd8e98f47ecbad22d3509437ec447be985462baa34d05c0899949928266698e4e0d2529c5c8866cf480641435fa45fd2b4cfca2384158f910f", 0xfc}, {&(0x7f0000000300)}], 0x2, &(0x7f0000000d00)=[{0x70, 0x118, 0x5, "ef269bc31381343d98c759da7d7617b788bdf26bc3dede3a7748367caad92babb642849c8e30b4935a7109af765b581a36a5de32477cc0e21917530a09cd02698ee0b4e9ac41249528669f82585eae02787124ac264a85e6e2b3dc"}, {0xe8, 0x10e, 0x0, "9140747fcd80f109e733fb1286c0c76e3a7cbb83246a50623b543b9216cc769bdb76a324f691a46345e29f1e3a38045d59b5cff3091ea1e96d36c872d18f7691063da0ba08c44cebc1135a2a2fb380f5f78d01c38104423313b585eb8475aa5a0c5e4138c14ecb8049a1c45d958593d5bc93934e5a4523551071aafcdfbc3cf7d622f20c215b558c6220ee5d654cd4a74d3f99f65eb08cd752785f26654a8546a6883309b1432c58dce020084d979e8428de1edff7edc1c0a0cf5392f012773c48b9eff60312fb79f606394fce04eb86181754f7f0946483"}, {0xf8, 0x29, 0xf5, "841f72b24ddd2cda141e2c6be34bc8759db4144ea650bbbfdc653669b2578d607db083d178f6a58b9e03b27a25a6bb70e57b0bf4d0bee98d1cec8bc6e9210962782a18808e6a7f6de824b0a24ee140a8fe042887e04e2bbc5e05aac43845b8fa9d27894ab6f50deee04cabe2c859e31b7196ab0e3eff192cb46bde96ed0914bd68e5a62dafcf0e312d1c63d9e6c8578237c16008dae12ac29c11031af3236071e93bdcd753bb10a88b78b0bac28344c55cb59341d0dd0974a390f70878a947338af7d8b33eea5d3ff8b7e6e2cf0d577c0ff2868bfd3bb2d5d817bb229ab76f2e65ce114e"}, {0xf8, 0x181, 0xffff, "910abbcc4d756e15a9572ab55b6190c43622412071c20099a9cc5275d731ada020e38fce77318a655ed978b248281547edced597fa5a5cfd23ace7103a91e32eb8012d7995f2674debf58e6c4e340886cc3b21b68334e583f7f96022d2d1f2c7e40aa647815d8736e2c79de00b2bf5491e286bd6344adab796ed3ba61a243c223dd8b19c63a092423a11a0ed7bd91813a88d3928b847e282eb6124fda3b73f5089ec4e14dc25a5eb7aff64fba06f5cd0c31769908b24490d1b2de2380109b7f8633d4c8aa8a054542a0739272485ee96796cc937cd2beb69c3d5e2b4a311f34011"}], 0x348}, 0xc050) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r1, 0x2000000, 0xfe7f, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 10m27.602262354s ago: executing program 0 (id=1892): socket(0xa, 0x801, 0x0) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x8, 0x3, 0x1f0, 0x0, 0x11, 0x148, 0x0, 0x0, 0x440, 0x2a8, 0x2a8, 0x440, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x250) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f00000000c0)=ANY=[@ANYRES8=r0, @ANYBLOB="c8898fd38c1596faa92bcc5c3d2e8a90108bcaaaa275e9e113ee6f8108facc8d79598c86ebadae9675fd4f70eb7e119a653f4043d8baac412cf21c28f035b0fa3604ce7325df0f0f9cfee6ef39"], 0x0) 10m26.048526074s ago: executing program 0 (id=1896): gettid() timer_settime(0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x4c8080, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$9p_tcp(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000004e24,afid=0x0000000080000001,access=client,debug=0x000']) r3 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='select \n', 0x10) ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04) write(r4, &(0x7f0000000100)='file read /etc/passwd 0ask.ui!=0 exec.argv[0]=\"sh\" exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000a40)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x9, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc4c85513, &(0x7f0000000540)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x0, 0x3, 0x6c4ba42, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xb4, 0x0, 0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xcd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x3, 0x7fffffffffffffff, 0x2, 0x0, 0x8e665f0, 0x0, 0x92c, 0x3, 0x7f, 0x0, 0x1000, 0x4, 0x0, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x800, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c8e, 0x0, 0x2, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x9, 0x0, 0xfffffffffffffffb, 0x1, 0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x80003, 0x0, 0x0, 0x400000, 0x200, 0x0, 0x81, 0x2000007ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000000, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2, 0xfffffffffffffffe, 0x2, 0x1, 0x3, 0x10, 0x4000100000001]}) 10m22.738880262s ago: executing program 34 (id=1873): socket$nl_route(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x200, 0x7, 0x4}) bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) r0 = gettid() r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_mptcp(0x2, 0x1, 0x106) syz_emit_ethernet(0x3e, &(0x7f0000003e40)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00\x00x', 0x8, 0x0, 0x0, @local, @local, {[@routing={0x84, 0x0, 0x0, 0x0, 0x3100}]}}}}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x480, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x1, &(0x7f0000000700)=0x8, 0x4) 10m22.712101504s ago: executing program 0 (id=1899): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xff, 0xfdfffffffffffffc}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x3, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(0x0, 0x1ff) sched_setaffinity(r3, 0x2, &(0x7f0000000000)=0x80000000000003) munmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000) mincore(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="d55e6d0443133d395c73f07ad79446ff0a51799dcab2d35f81fa4a3ebfed65c2e6cbca6d993f98df0283b5b2d4a9c1e21c6209600051c239f652c30961233ec158f6cac2dff416ea6acce909d0a08cf113cea5677c11eda04e87", @ANYRESOCT], 0xb8}}, 0x408d4) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4004055) sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x80) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0x6, &(0x7f0000006680)) fsopen(&(0x7f0000000000)='proc\x00', 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bind$nfc_llcp(r0, &(0x7f00000000c0)={0x27, 0x0, 0x1, 0x4, 0x0, 0xff, "bac5115c7dad488702b535116fad55baf63cdd52fc30106310abb622a1c3c01c13c04df6b906288e64e96754059e65c39c5759b069d6e6d9589e5f2348878c", 0x24}, 0x60) 10m21.006727384s ago: executing program 0 (id=1902): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0xfe, 0x7fff0006}]}) syslog(0x3, &(0x7f0000000200)=""/88, 0x58) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000080)=ANY=[], 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x48890}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x28, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_OIF={0x8, 0x5, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x50, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x3}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}, @NHA_RES_GROUP={0x14, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0xe0b}, @NHA_RES_GROUP_IDLE_TIMER={0x8, 0x2, 0x64}]}]}, 0x50}}, 0x0) 10m19.36969768s ago: executing program 0 (id=1906): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0b000000080000000700000003"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01"], 0x50) syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x6, 0x1000, 0x1, 0x1ba}, &(0x7f0000000880), &(0x7f0000000100), &(0x7f0000000140)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000003c0)) setresuid(0xee01, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@mpls_getnetconf={0x14, 0x52, 0x801, 0x70bd2a, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20000034}, 0x40) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102400, 0x19000) mount(0x0, 0x0, &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000400)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp,nolock,rsize=1024,wsize=1024\x00') openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0xc024, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000019300)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000003c0)={@map=r0, 0x20, 0x1, 0x3, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000540), 0x80081, 0x0) r6 = fcntl$dupfd(r3, 0x0, r3) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000500)={@cgroup=r5, r3, 0x30, 0x200c, 0x0, @value=r6, @void, @void, @void, r4}, 0x20) creat(0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x42841, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) syz_emit_ethernet(0x205, &(0x7f0000000580)={@empty, @remote, @void, {@mpls_mc={0x8848, {[{0x2, 0x0, 0x1}], @ipv6=@gre_packet={0x7, 0x6, 'Sa}', 0x1cb, 0x2f, 0xfe, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, {[@hopopts={0x32, 0x2, '\x00', [@calipso={0x7, 0x10, {0x2, 0x2, 0x95, 0x7, [0x7fffffffffffffff]}}]}], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x28, 0x0, [0x7], "b47e8126901fe09aa349ed1466181f39e899ec953dae8068a0bf0bd7a3cdc33771f66de6376afeb2"}, {0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [], "5872d984f898ebe52a5d79"}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x2f], "6810041afeacd9ca5a97a64aecba417762030e8f38eefbab3937bba566dd39eb43e1d195dc698689a9db49f0d3b7f9a20c9725b2059322a3789200a9a86edd39891f31e30375af25a199a00457321dd5f9a5a4cc5bd61c98e40e80f3dcfb0698e2cf6f4b52102f251d4e3a66b77a021387ecc69eba13a7b010ea1025425211c93996f66c"}, {0x8, 0x88be, 0x3, {{0xc, 0x1, 0x8, 0x1, 0x1, 0x3, 0x7, 0xc2}, 0x1, {0xe}}}, {0x8, 0x22eb, 0x3, {{0x2, 0x2, 0x1, 0x1, 0x1, 0x3, 0x1, 0x8}, 0x2, {0x3, 0x6, 0x1, 0x1c, 0x0, 0x1, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x4, "760a81c23b5c99376c234a30bc3f3b9bcd255bd44cccaca6da38f41927db3f91304ec1928f785872296c6d27810f30789d3398ba1238200b8d0bb9c7a144f251283a44f376abbbe52864d385a8ce543707dff4bc941b10940d200cb5ea4bebeb3e6be2ca1f424273f9127e09ab9dbb3b7ce761d7ee37ba6260a464c5acfb9a7509710f91b1692a07a95b838d49c80841fdf0c14ba8a406c3e55d894f39857883e0d38115b9a917ec254633ff"}}}}}}}}, &(0x7f00000007c0)={0x1, 0x2, [0x42d, 0xb7c, 0x5b9, 0x83a]}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r7, &(0x7f0000000000)='3', 0x4e) setsockopt$SO_J1939_FILTER(0xffffffffffffffff, 0x6b, 0x1, &(0x7f0000000080)=[{0x2, 0x3, {0x2, 0x1, 0x1}, {0x2, 0xff, 0x3}, 0xfe, 0x2}, {0x2, 0x3, {0x1, 0x0, 0x1}, {0x0, 0x0, 0x4}, 0x1, 0xfd}, {0x2, 0x3, {0x1, 0x1, 0x1}, {0x0, 0xff}, 0xfd, 0x2}], 0x60) 10m4.161805018s ago: executing program 35 (id=1906): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0b000000080000000700000003"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01"], 0x50) syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x6, 0x1000, 0x1, 0x1ba}, &(0x7f0000000880), &(0x7f0000000100), &(0x7f0000000140)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000003c0)) setresuid(0xee01, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@mpls_getnetconf={0x14, 0x52, 0x801, 0x70bd2a, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20000034}, 0x40) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102400, 0x19000) mount(0x0, 0x0, &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000400)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp,nolock,rsize=1024,wsize=1024\x00') openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0xc024, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000019300)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000003c0)={@map=r0, 0x20, 0x1, 0x3, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000540), 0x80081, 0x0) r6 = fcntl$dupfd(r3, 0x0, r3) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000500)={@cgroup=r5, r3, 0x30, 0x200c, 0x0, @value=r6, @void, @void, @void, r4}, 0x20) creat(0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x42841, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) syz_emit_ethernet(0x205, &(0x7f0000000580)={@empty, @remote, @void, {@mpls_mc={0x8848, {[{0x2, 0x0, 0x1}], @ipv6=@gre_packet={0x7, 0x6, 'Sa}', 0x1cb, 0x2f, 0xfe, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, {[@hopopts={0x32, 0x2, '\x00', [@calipso={0x7, 0x10, {0x2, 0x2, 0x95, 0x7, [0x7fffffffffffffff]}}]}], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x28, 0x0, [0x7], "b47e8126901fe09aa349ed1466181f39e899ec953dae8068a0bf0bd7a3cdc33771f66de6376afeb2"}, {0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [], "5872d984f898ebe52a5d79"}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x2f], "6810041afeacd9ca5a97a64aecba417762030e8f38eefbab3937bba566dd39eb43e1d195dc698689a9db49f0d3b7f9a20c9725b2059322a3789200a9a86edd39891f31e30375af25a199a00457321dd5f9a5a4cc5bd61c98e40e80f3dcfb0698e2cf6f4b52102f251d4e3a66b77a021387ecc69eba13a7b010ea1025425211c93996f66c"}, {0x8, 0x88be, 0x3, {{0xc, 0x1, 0x8, 0x1, 0x1, 0x3, 0x7, 0xc2}, 0x1, {0xe}}}, {0x8, 0x22eb, 0x3, {{0x2, 0x2, 0x1, 0x1, 0x1, 0x3, 0x1, 0x8}, 0x2, {0x3, 0x6, 0x1, 0x1c, 0x0, 0x1, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x4, "760a81c23b5c99376c234a30bc3f3b9bcd255bd44cccaca6da38f41927db3f91304ec1928f785872296c6d27810f30789d3398ba1238200b8d0bb9c7a144f251283a44f376abbbe52864d385a8ce543707dff4bc941b10940d200cb5ea4bebeb3e6be2ca1f424273f9127e09ab9dbb3b7ce761d7ee37ba6260a464c5acfb9a7509710f91b1692a07a95b838d49c80841fdf0c14ba8a406c3e55d894f39857883e0d38115b9a917ec254633ff"}}}}}}}}, &(0x7f00000007c0)={0x1, 0x2, [0x42d, 0xb7c, 0x5b9, 0x83a]}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r7, &(0x7f0000000000)='3', 0x4e) setsockopt$SO_J1939_FILTER(0xffffffffffffffff, 0x6b, 0x1, &(0x7f0000000080)=[{0x2, 0x3, {0x2, 0x1, 0x1}, {0x2, 0xff, 0x3}, 0xfe, 0x2}, {0x2, 0x3, {0x1, 0x0, 0x1}, {0x0, 0x0, 0x4}, 0x1, 0xfd}, {0x2, 0x3, {0x1, 0x1, 0x1}, {0x0, 0xff}, 0xfd, 0x2}], 0x60) 8m37.518272884s ago: executing program 4 (id=2036): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x40) recvmmsg(r0, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x1}], 0x2, 0x20000020, 0x0) 8m35.2475807s ago: executing program 4 (id=2042): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = syz_clone3(&(0x7f0000001180)={0x100240000, 0x0, &(0x7f0000000f80), &(0x7f0000000fc0), {0x7}, 0x0, 0x0, &(0x7f0000001040)=""/241, &(0x7f0000001140)}, 0x58) r1 = getpgrp(r0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f00000002c0)=0x80000000000003) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r4, &(0x7f00000001c0)='\\', 0x1) r5 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r5, 0x40045532, &(0x7f0000000040)) r6 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r6, 0xc0884123, &(0x7f0000000340)={0x0, "72a59baeb6c10b67b134a5f267418d0000000000000000000000820f2cf9ff6c8d2600", {0x800000000000004, 0x50000000000}}) 8m34.213667861s ago: executing program 4 (id=2044): socket$nl_netfilter(0x10, 0x3, 0xc) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x200008c0, 0x0, 0xfffffffffffffe76) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80}, 0x28) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x20, &(0x7f0000000080)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x2}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x85}, @cb_func={0x18, 0x2, 0x4, 0x0, 0xfffffffffffffffc}, @ldst={0x0, 0x3, 0x6, 0x9, 0x0, 0xfffffffffffffff8, 0xfffffffffffffff0}, @map_val={0x18, 0x5, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x40}, @exit], &(0x7f00000001c0)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x1, 0x3}, 0x8, 0x10, &(0x7f0000000280)={0x5, 0x3, 0x6, 0x80000000}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f00000002c0)=[{0x1, 0x1, 0x8, 0x5}], 0x10, 0xfffffffa}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000740)={r1, 0xe0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f00000003c0)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x2, &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000500)=[0x0, 0x0], 0x0, 0x7a, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000000580), &(0x7f00000005c0), 0x8, 0x5f, 0x8, 0x8, &(0x7f0000000600)}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x2, 0x4, 0x8, 0x40001, 0x18, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0, 0x1, 0x3}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) pipe(&(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) unshare(0x4000400) pselect6(0x40, &(0x7f0000000100), &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x9}, 0x0, 0x0, 0x0) syz_emit_ethernet(0xd81, 0x0, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000740), 0x0, 0x40008) syz_open_dev$evdev(0x0, 0x40, 0xc000) 8m32.751178645s ago: executing program 4 (id=2045): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x8001) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x11, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) 8m27.576432369s ago: executing program 4 (id=2052): r0 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB=',:'], 0x1e0) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000140)=0x80000001, 0x4) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x8, 0x80, 0x8, 0x986, {{0xb, 0x4, 0x0, 0x4, 0x2c, 0x65, 0x0, 0xff, 0x29, 0x0, @private=0xa010102, @multicast2, {[@timestamp={0x44, 0x10, 0x4a, 0x0, 0x7, [0x5db, 0x400, 0x893]}, @ra={0x94, 0x4, 0x1}, @end]}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000240)={'sit0\x00', &(0x7f0000000180)={'sit0\x00', r3, 0x20, 0x8, 0x1, 0x8, {{0x20, 0x4, 0x2, 0x4, 0x80, 0x66, 0x0, 0x9, 0x0, 0x0, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@lsrr={0x83, 0x2b, 0x15, [@local, @local, @multicast2, @loopback, @broadcast, @loopback, @remote, @remote, @rand_addr=0x64010102, @loopback]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x6, 0x3}, @timestamp={0x44, 0xc, 0xa5, 0x0, 0xe, [0x0, 0x9]}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0x1f, 0xf, [@dev={0xac, 0x14, 0x14, 0x1c}, @broadcast, @dev={0xac, 0x14, 0x14, 0x22}, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, @broadcast]}, @timestamp_prespec={0x44, 0x4, 0x3c, 0x3, 0x4}, @end]}}}}}) 8m22.446467204s ago: executing program 4 (id=2057): ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x200, 0x7, 0x4}) bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r0 = gettid() r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_mptcp(0x2, 0x1, 0x106) syz_emit_ethernet(0x3e, &(0x7f0000003e40)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00\x00x', 0x8, 0x0, 0x0, @local, @local, {[@routing={0x84, 0x0, 0x0, 0x0, 0x3100}]}}}}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x480, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x1, &(0x7f0000000700)=0x8, 0x4) 8m7.221190335s ago: executing program 36 (id=2057): ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000080)={0x200, 0x7, 0x4}) bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r0 = gettid() r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_mptcp(0x2, 0x1, 0x106) syz_emit_ethernet(0x3e, &(0x7f0000003e40)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00\x00x', 0x8, 0x0, 0x0, @local, @local, {[@routing={0x84, 0x0, 0x0, 0x0, 0x3100}]}}}}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x480, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x1, &(0x7f0000000700)=0x8, 0x4) 6m7.363601347s ago: executing program 1 (id=2285): r0 = socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f00000000c0)={0x1f, 0xffff}, 0x6) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x6, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) write(r3, &(0x7f0000000000)="5a000300010003", 0x7) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00'}, 0x1c) r4 = gettid() r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r5, 0x4040534e, &(0x7f0000000180)={0x335, @time={0x101, 0x10001}, 0x1b, {}, 0x2, 0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0x40045304, &(0x7f0000000000)) tkill(r4, 0x7) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYRESOCT=r2, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x1c}, 0x1, 0x0, 0x0, 0x4040040}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8040}, 0x0) 5m53.324201715s ago: executing program 1 (id=2304): gettid() timer_settime(0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x4c8080, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$9p_tcp(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000004e24,afid=0x0000000080000001,access=client,debug=0x000']) r3 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='select \n', 0x10) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04) mmap$KVM_VCPU(&(0x7f000055f000/0x2000)=nil, r5, 0x1, 0x10, r4, 0x0) write(r4, &(0x7f0000000100)='file read /etc/passwd 0ask.ui!=0 exec.argv[0]=\"sh\" exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000a40)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x9, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc4c85513, &(0x7f0000000540)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x0, 0x3, 0x6c4ba42, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xb4, 0x0, 0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xcd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x3, 0x7fffffffffffffff, 0x2, 0x0, 0x8e665f0, 0x0, 0x92c, 0x3, 0x7f, 0x0, 0x1000, 0x4, 0x0, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x800, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c8e, 0x0, 0x2, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x9, 0x0, 0xfffffffffffffffb, 0x1, 0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x80003, 0x0, 0x0, 0x400000, 0x200, 0x0, 0x81, 0x2000007ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000000, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2, 0xfffffffffffffffe, 0x2, 0x1, 0x3, 0x10, 0x4000100000001]}) 5m41.940608258s ago: executing program 1 (id=2316): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0x33, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000680)={0x48, 0x2, r1, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000400)={0x28, 0x2, r1, 0x0, &(0x7f0000000000/0x400000)=nil, 0x400000, 0x7ffffffe}) ioctl$IOMMU_IOAS_UNMAP$ALL(r0, 0x3b86, &(0x7f0000000100)={0x18}) syz_open_dev$hidraw(&(0x7f00000000c0), 0x0, 0x101a41) syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a0100001905818255"], 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x6, 0x500) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r3, 0xc1205531, &(0x7f0000001c80)=""/4078) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x7fd) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="2395ff9a88b3e5", @ANYRES8=r4, @ANYRESHEX=r1, @ANYRESOCT=r0, @ANYRES16=r2, @ANYBLOB="b263c92d6ab13161e500000000400000000000000000", @ANYRES16, @ANYRES8=r2, @ANYRESDEC=r4], 0x48) r5 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r5, &(0x7f0000000440)={0x28, 0x0, 0x0, @hyper}, 0x10) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000900)=0x14) ioctl(r6, 0x404c4701, &(0x7f0000000a00)="01000000000000000000000001000000010000000a0000000000000040000000400000000100000001") ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000c00)=0xf9) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000c10)=0x3) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000c20)=0x3f) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000c30)=0x1) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000c40)=0x1c) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000c50)=0xf9) listen(r5, 0xff) r7 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_linger(r7, 0x1, 0xd, &(0x7f0000000180)={0x2, 0x2}, 0x8) connect$vsock_stream(r7, &(0x7f0000000100)={0x28, 0x0, 0x2710, @host}, 0x10) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x4, 0x7fff0000}]}) close_range(r8, 0xffffffffffffffff, 0x0) 5m36.713525254s ago: executing program 1 (id=2323): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x7000000, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 5m33.138492762s ago: executing program 1 (id=2325): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xff, 0xfdfffffffffffffc}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x3, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(r3, 0x2, &(0x7f0000000000)=0x80000000000003) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4004055) sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x80) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0x6, &(0x7f0000006680)) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bind$nfc_llcp(r0, &(0x7f00000000c0)={0x27, 0x0, 0x1, 0x4, 0x0, 0xff, "bac5115c7dad488702b535116fad55baf63cdd52fc30106310abb622a1c3c01c13c04df6b906288e64e96754059e65c39c5759b069d6e6d9589e5f2348878c", 0x24}, 0x60) 5m32.240355064s ago: executing program 1 (id=2326): r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) pwrite64(r1, &(0x7f00000001c0)='2', 0x1, 0xe7c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) ioctl$KVM_RESET_DIRTY_RINGS(r1, 0xaec7) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) socket(0x11, 0x5, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'bridge_slave_1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'veth0_virt_wifi\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="5400000010000104000000000200000000000000", @ANYRES32=r3, @ANYBLOB="0000faffffff000034001280110001006272696467655f736c617665000000001c000580050021000000000006001f0000000000080022"], 0x54}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r6 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r7, &(0x7f0000000000)='3', 0x4e) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCGIDLE(r8, 0x8010743f, &(0x7f0000000000)) r9 = syz_genetlink_get_family_id$SEG6(&(0x7f0000003e40), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r10, &(0x7f0000004440)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x1c, r9, 0x20d, 0x70bd2b, 0x25dfdbfe, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc051}, 0x4000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) write(0xffffffffffffffff, &(0x7f0000005c00), 0x0) 5m16.793970346s ago: executing program 37 (id=2326): r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) pwrite64(r1, &(0x7f00000001c0)='2', 0x1, 0xe7c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) ioctl$KVM_RESET_DIRTY_RINGS(r1, 0xaec7) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) socket(0x11, 0x5, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'bridge_slave_1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'veth0_virt_wifi\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="5400000010000104000000000200000000000000", @ANYRES32=r3, @ANYBLOB="0000faffffff000034001280110001006272696467655f736c617665000000001c000580050021000000000006001f0000000000080022"], 0x54}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r6 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r7, &(0x7f0000000000)='3', 0x4e) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCGIDLE(r8, 0x8010743f, &(0x7f0000000000)) r9 = syz_genetlink_get_family_id$SEG6(&(0x7f0000003e40), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r10, &(0x7f0000004440)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x1c, r9, 0x20d, 0x70bd2b, 0x25dfdbfe, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc051}, 0x4000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) write(0xffffffffffffffff, &(0x7f0000005c00), 0x0) 4m50.665676055s ago: executing program 9 (id=2392): bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000240)={0x27, 0x0, 0x0, 0x3, 0x0, 0x4, "e88509de7f1939e8abff005597c8ef039a5be42200", 0x80000000010}, 0x60) openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) sched_setattr(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) syz_open_procfs(0x0, &(0x7f0000000000)='personality\x00') recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) userfaultfd(0x80001) fsopen(0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000000)={0x1, 0x8, 0x6a40, 0x5, 0xbcd}) ioctl$VT_RELDISP(r3, 0x5605) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a1c000000030a010300000000000000000200000608000b400000000228010000160a01010000000000000000000000050c00054000000000000000020900010073797a31000000000900010073797a31000000000c00054000000000000000020900010073797a30000000000900020073797a3000000000c4000380b800db0ddc21a24db7ca27169821b703801400010073797a6b616c6c657231000000000000140001006d61637674"], 0x454}, 0x1, 0x0, 0x0, 0x4000000}, 0x405c001) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfffd, 0xfffd, 0x24c, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa98, 0xa2b9, 0x100, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x6f23, 0x5, 0x401, 0x1, 0x405, 0x9f, 0xb69b, 0x9, 0x1000, 0x1, 0xff, 0x0, 0x5, 0x5a7, 0x2, 0x1000000, 0x489, 0x7, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xffffffff, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xa9, 0x6, 0x80a, 0x40, 0xa6, 0x1000, 0x2, 0x200b398, 0x8001, 0x1, 0x2004, 0x1c, 0x80000000, 0x6, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d6, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1f9, 0x80000001, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x0, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0xffd, 0x2, 0xc], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0xffffffff, 0x8000048d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000006, 0x1, 0x10, 0x5, 0x9, 0x5, 0x10, 0x800009, 0x3, 0xc7, 0x1, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0xa, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0xfc33, 0x55, 0x7ff, 0x7ffffff8, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d86, 0x8, 0x8, 0x4, 0x140f1, 0xd, 0x3, 0x6, 0x80008001, 0x0, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000804, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x0, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffffa, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f00000001c0)={0xa, 0x0, 0x1, @mcast2}, 0x1c, 0x0}}], 0x1, 0x800) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000440), 0x1000) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000140), 0x400000, 0x0) 4m45.598735385s ago: executing program 9 (id=2395): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000640)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x59, 0x88, 0xfe, 0x0, 0x2a}, 0xe) shutdown(r0, 0x1) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x2e, &(0x7f0000000000)=0x21ea, 0x4) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}, 0x2100}], 0x414, 0x406, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000840)={'syztnl2\x00', &(0x7f0000000780)={'syztnl0\x00', 0x0, 0x7, 0x1, 0x400, 0x0, {{0x1c, 0x4, 0x2, 0x2, 0x70, 0x64, 0x0, 0x5, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, {[@timestamp={0x44, 0x8, 0x24, 0x0, 0x1, [0x4]}, @ssrr={0x89, 0x1b, 0x2a, [@multicast2, @private=0xa010100, @loopback, @rand_addr=0x64010102, @loopback, @private=0xa010102]}, @generic={0x86, 0x10, "e2292250418ac33eba3d1fbb76a3"}, @ssrr={0x89, 0x13, 0x9e, [@dev={0xac, 0x14, 0x14, 0x38}, @broadcast, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @rr={0x7, 0x13, 0x72, [@broadcast, @loopback, @loopback, @loopback]}]}}}}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000010c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000dc0)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, &(0x7f0000000e00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000e40)=[0x0], 0x0, 0xdb, &(0x7f0000000e80)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000f00), &(0x7f0000000f40), 0x8, 0xa1, 0x8, 0x8, &(0x7f0000000f80)}}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001180)={0x1, 0x58, &(0x7f0000001100)}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x34, r2, 0x1, 0x70bd26, 0x25dfdbff, {}, [@ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_LINKMODES_OURS={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2e8}]}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4048044}, 0x404c094) r5 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r6 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r7 = dup2(r6, r6) r8 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f0000000200)={0x2e, 0x0, 0x0, r7, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, &(0x7f0000002e80)) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=@newsa={0x158, 0x10, 0x713, 0x0, 0x0, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in=@rand_addr=0x64010102}, {@in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4d5, 0x33}, @in=@multicast1, {0x3}, {}, {0x4, 0x22}, 0x0, 0x0, 0x2}, [@algo_auth_trunc={0x5c, 0x14, {{'cmac(aes)\x00'}, 0x80, 0x0, "3509fe8fd57fd44aa5074c50bc700e53"}}, @offload={0xc, 0x1c, {0x0, 0x2}}]}, 0x158}}, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r5, 0x400442c9, &(0x7f00000000c0)={0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) 4m43.602572612s ago: executing program 9 (id=2399): socket$inet_udp(0x2, 0x2, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/51, 0x0, 0xe000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001840)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000740)=""/183, 0x0, 0x9000}) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0xe0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4c0142, 0x161) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) setrlimit(0xd, &(0x7f0000000040)={0x3, 0x7}) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r2, r2, 0x0, 0x200000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x58, 0x24, 0xe0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x1, 0x6, 0xa00, 0x3, 0xffffffff, 0x20102}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0x7fffffff, 0x155}}]}}}]}, 0x58}}, 0x4000080) bind$packet(r3, &(0x7f0000000040)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r3, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/1/root/var\x00', 0x1ff) 4m38.21752354s ago: executing program 9 (id=2403): add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400"/359, 0x167, 0xfffffffffffffffd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x47, &(0x7f0000000200)=0x7) r3 = inotify_init() inotify_add_watch(r3, &(0x7f0000000340)='.\x00', 0xa50003d1) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha256\x00'}}) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000080), &(0x7f0000000100)={'enc=', 'raw', ' hash=', {'sha3-224\x00'}}, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x124) keyctl$set_reqkey_keyring(0xf, 0xfffffffb) 4m34.924254649s ago: executing program 9 (id=2406): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x10) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4400000010000104fcffffff8000000000000000", @ANYRES32=0x0, @ANYBLOB="031500000000000024001280000100626f6e6400000000140002800500010004000000009d38237811832b0523b0df0000e2ff000000007a2f5c81f479a27c988f9f94a907e19d305d3921e498de1f8de30914babf231361caa265ac79a1ea4cc0ea058e7e3276d1e1e979679cc61d403c723ce6a6983604119823da590a38a8cde56b5e25695bd313569f7963e07445fe6cf8ba7e5e05c9f6f3fad83a40415a6975cfe48eeb01c1ff2efb24cca18288d5837dd143259a23538d0cfd2bdb53dcdf376e76652cbd83454f46c3d46f3b9812097796d1f5e29ba974b8853b9529333587cb0a25638d148928fe44e2a3f105935628325ba0d05aad37eb64cef0607adb6a036b1e1f5e8988f10ba348d6d515b3ac8e51a3f85093e3e3193f"], 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 4m30.924074021s ago: executing program 9 (id=2416): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f600020301090212"], 0x0) syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x101042, 0x15) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioprio_get$uid(0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) 4m13.948209453s ago: executing program 38 (id=2416): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f600020301090212"], 0x0) syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x101042, 0x15) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioprio_get$uid(0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) 3m37.528027855s ago: executing program 7 (id=2482): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWCHAIN={0x20, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0x9}]}}}, {0x28, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x17}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc0}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) recvmmsg(r1, &(0x7f0000002a80)=[{{0x0, 0x0, 0x0}, 0x263b}], 0x1, 0x40004000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x30, 0x41, 0x107, 0xfffffffe, 0xfffffffe, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x18, 0x0, 0x0, @fd=r3}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0x4000000) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="38000000d96a83f0147a4d03d8da56edf781bdbcd856c36b620125af77407d9886afe64f097f491c18ecfe95e39ef6010afada02328e5f9022f2ae2bf5085cdc00fab3cd6bb4eb11992b22fb9da353bd492bb9eb408b846b7810ffda2fea0d42b04fb3cc20f6e3f1515456b3cf89b357", @ANYRES16=r2, @ANYBLOB="8b3300000000fffff0000500000008000300", @ANYRES32=r2, @ANYBLOB="0c009900000000000000000006001d800c0000800500040000000000", @ANYRESOCT=r2, @ANYRESHEX=r1], 0x38}}, 0x0) socket$unix(0x1, 0x1, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r4, 0x29, 0x3b, &(0x7f0000000100)=ANY=[], 0x8) setsockopt$inet6_opts(r4, 0x29, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="67000400014004000c9930d8d36103cc35290c7b3921743355d7e206be6ca5a057029b6d006c93eb64534afc7567b41349449e8ef6121a624565db77e72c044b221503a1ba2df8f65c79d0a6e71028bad9960c53ebf68b9eaffb148b6b644f41b2d0a121019ee3c5016c6886"], 0x8) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r5, 0x6, 0x3, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r5, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r5, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1}}], 0x1, 0x20008000) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x43c37000) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r6, 0xfffffffc) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b"], 0x28}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) 3m32.818265999s ago: executing program 7 (id=2487): listen(0xffffffffffffffff, 0x5) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600034e23590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'ip6_vti0\x00', r2, 0x4, 0x0, 0x3c, 0x4, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x33}, 0x80, 0x40, 0xffffffff, 0x2}}) socket$inet6_tcp(0xa, 0x1, 0x0) 3m32.229895852s ago: executing program 7 (id=2489): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000c00)={0xe9, [[0x4, 0xffffffff, 0xffffffff, 0xefffffff, 0x7fffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0x6, 0x0, 0x8, 0x2, 0xffffffff, 0x81, 0x3], [0xffffffff, 0x55, 0xffffffff, 0x3, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffefff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x4020, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x801388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x6, 0x1000, 0x0, 0x0, 0x1}, {0x4, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4004, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) socket$inet_mptcp(0x2, 0x1, 0x106) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000110)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/block/zram0/disksize\x00', 0x1, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = fsopen(&(0x7f0000000100)='ext3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='test_dummy_encryption', &(0x7f0000000180)='vuto_da_alloc', 0x0) r2 = socket$kcm(0x29, 0x6, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r6 = socket$netlink(0x10, 0x3, 0x0) write(r6, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db80000000000000000", 0x2c) syz_emit_ethernet(0x86, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa2e08004500007800000000001190780000000000000000004b1b59006490780200000003000000000000000002000000753904030405a024f0dd00000000000000080000000000000000009384bbeb77694c875d9dfb1be5d2a0057a62022a1564a329d3a14a1d8c6900000000000000000000000000000000000028ceb1df52900ef2d590cd97795158507f3e1610"], 0x0) 3m30.759966645s ago: executing program 7 (id=2492): r0 = socket$kcm(0xa, 0x1, 0x0) socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000000e8ffffffffffff05000000", @ANYRES32=r0], 0x48) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x8936, &(0x7f0000000000)) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000200), 0x20c81, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000002c0), 0x1, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000340)={0x40003, "da02791d2a166f6100000011000100"}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={r2, 0x6, 0x2}) setregid(0xee00, 0xffffffffffffffff) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000002140)={r2, 0xffff, 0x2}) getsockopt(0xffffffffffffffff, 0xff, 0x1, 0x0, 0x0) r3 = gettid() r4 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffffb]}, 0x8, 0x0) read$FUSE(r4, &(0x7f0000000100)={0x2020}, 0x2020) rt_sigqueueinfo(r3, 0x21, &(0x7f0000000040)={0x2c, 0x0, 0xfffffffb}) 3m29.702714924s ago: executing program 7 (id=2495): socket$nl_rdma(0x10, 0x3, 0x14) r0 = socket$inet6_udp(0xa, 0x2, 0x0) fremovexattr(r0, &(0x7f0000000400)=@known='security.apparmor\x00') r1 = socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000000)='./tracefs\x00', 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x10) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1000}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./mnt\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x109042, 0x15) pwrite64(r6, &(0x7f0000000000)="ff", 0x1, 0x1000000) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000500)) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4000000010000d04010000000000000b00000000", @ANYRES32=0x0, @ANYBLOB="04240000090000000a0001004af29c3ff0490000140035006d6163766c616e300000000000000000"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x8000) socket$kcm(0xa, 0x5, 0x0) 3m26.060299815s ago: executing program 7 (id=2498): syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000564404204e080110f9330102030109021b00010000000009040000010000c2000905", @ANYBLOB="4c371105"], 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x20800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv4/conf/all/forwarding\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) read$FUSE(r1, &(0x7f00000006c0)={0x2020}, 0x2020) r2 = socket(0x400000000010, 0x3, 0x0) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r3, 0x10c000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@mpls_delroute={0x1c, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x100000}}, 0x1c}}, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) recvfrom(r2, &(0x7f0000000180)=""/100, 0x64, 0x2000, &(0x7f0000000280)=@vsock={0x28, 0x0, 0x2710, @host}, 0x80) syz_clone(0x40842300, 0x0, 0x1e, 0x0, 0x0, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56549, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xa, 0x6}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x5, 0x6, 0x3, 0x7, 0x7, 0x40, 0x2, 0x3, 0xe}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x5}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r6, {0xf000, 0xfff3}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0xfff2, 0x7}}]}}]}, 0x3c}}, 0x20000800) 3m10.070322155s ago: executing program 39 (id=2498): syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000564404204e080110f9330102030109021b00010000000009040000010000c2000905", @ANYBLOB="4c371105"], 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x20800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv4/conf/all/forwarding\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) read$FUSE(r1, &(0x7f00000006c0)={0x2020}, 0x2020) r2 = socket(0x400000000010, 0x3, 0x0) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r3, 0x10c000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@mpls_delroute={0x1c, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x100000}}, 0x1c}}, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) recvfrom(r2, &(0x7f0000000180)=""/100, 0x64, 0x2000, &(0x7f0000000280)=@vsock={0x28, 0x0, 0x2710, @host}, 0x80) syz_clone(0x40842300, 0x0, 0x1e, 0x0, 0x0, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56549, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xa, 0x6}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x5, 0x6, 0x3, 0x7, 0x7, 0x40, 0x2, 0x3, 0xe}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x5}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r6, {0xf000, 0xfff3}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0xfff2, 0x7}}]}}]}, 0x3c}}, 0x20000800) 2m9.181488959s ago: executing program 8 (id=2583): creat(&(0x7f00000000c0)='./file0\x00', 0xc9028ba210c11fa8) creat(&(0x7f00000000c0)='./file0\x00', 0x15) 2m8.736734061s ago: executing program 8 (id=2585): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x800, 0x70bd29, 0x25dfdc00, {0x60, 0x0, 0x0, 0x0, {0x8, 0xfff2}, {0x1, 0xc}, {0x8, 0x8}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x80000000}, @TCA_CAKE_INGRESS={0x8, 0xf, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x44045}, 0x10) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000001000)={0x2, 0x4e21, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f0000000a40)={&(0x7f00000000c0)={0x2, 0x4e24, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="100000000000f9d8a2d731fb85508cb4d88cf816daa89fb11b1051d1968fd82d5e80"], 0x10}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x4000000) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.idle_time\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x4844c1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) write(r2, &(0x7f0000000580)="636f6d6d6f6e5f706964203e201148b2526e36903541c803fd8b9101b242f57efd9262327c8f358a0c85249b975bd66d739884506dc24cc900588a3dd86f3ec5ae31fae4310455d2b9eb3aafb5d588ba86cc2d1dcb08c50a643c09eb35d02b7222a386fbf03b1a65623d7edcefcd2f65bb7b2e69a3f5eeaf055b607bef043f3116b808b2eb616aa8423d6a73a5f6bf032cd33e285f060b6253e21883bb202ddc9fbf4cf8fb8f80f5ae14836c5c9aeec5a0311947e4c39b9daed06a823c1444dcacd40174e60566ba", 0xc8) socket$kcm(0x2, 0x7, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) 2m6.749332403s ago: executing program 8 (id=2588): mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$getownex(r1, 0x10, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x20141, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f00000021c0)={0x2020}, 0x2020) 2m2.908063013s ago: executing program 8 (id=2590): socket$pppl2tp(0x18, 0x1, 0x1) syz_emit_ethernet(0x4a, 0x0, 0x0) r0 = memfd_create(0x0, 0x6) ftruncate(r0, 0x2000000) fcntl$addseals(r0, 0x409, 0x7) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x8080, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x1f30}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000340), 0x4000, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001c00070c2bbd30000000000002000000", @ANYRES32=r3, @ANYBLOB="4000100a140001"], 0x30}, 0x1, 0x0, 0x0, 0x20004044}, 0x4000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_JOIN_FILTERS(r5, 0x65, 0x2, 0x0, &(0x7f0000000000)=0x45) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x1c}}, 0x0) sendmsg$NFC_CMD_START_POLL(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)={0x34, r6, 0x200, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x20}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xa6}, @NFC_ATTR_TM_PROTOCOLS={0x8, 0xe, 0x8a}]}, 0x34}}, 0x0) 1m50.859819398s ago: executing program 8 (id=2602): socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000500)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f00000000c0)={0x1f, 0xffff}, 0x6) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) write(r3, &(0x7f0000000000)="5a000300010003", 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000180)={0x335, @time={0x101, 0x10001}, 0x1b, {}, 0x2, 0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r4, 0x40045304, &(0x7f0000000000)) mount(0x0, &(0x7f0000000000)='./tracing\x00', 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYRESOCT=r2, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x1c}, 0x1, 0x0, 0x0, 0x4040040}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8040}, 0x0) 1m47.638346241s ago: executing program 8 (id=2606): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0x2, 0x3b}, 0x1c) setsockopt$packet_buf(r0, 0x107, 0x5, &(0x7f0000000d80)="f51e3f8dc29d44feb389add5f3bfa356", 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x100, 0xe3, 0x8f, 0x7, 0x10, 0xa5c, 0x2033, 0x3b3, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0xbd, 0x50, 0x3, "", [{{0x9, 0x4, 0xc1, 0x6, 0x0, 0x50, 0xbf, 0x4b, 0x3}}]}}]}}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) syz_usb_connect$uac2(0x2, 0xcd, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x499, 0x102a, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xbb, 0x3, 0x1, 0x9, 0x0, 0xd, {0x8, 0xb, 0x2, 0x0, 0x1, 0x8, 0x20, 0x4}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x8000, 0x7, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x3, 0x2, 0xfb, 0x8, "34122c", '44$'}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x6, 0x4, 0xb8, "731311eae886e7"}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x7, 0x1, 0x2, {0x8, 0x25, 0x1, 0x3, 0x3, 0x8, 0x81}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x2c, 0xb684, 0x3, "83043693daa739b0"}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0xaa0, 0x7f, 0x2, "dc"}, @as_header={0x10, 0x24, 0x1, 0x7, 0x7, 0x3, 0x2, 0x41, 0xffffffb7, 0x8}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x81, 0x3, 0x4, 0xff, "", '\''}]}, {{0x9, 0x5, 0x82, 0x9, 0x278, 0x40, 0x80, 0x2, {0x8, 0x25, 0x1, 0x82, 0x0, 0x5, 0x2}}}}}}}}]}}, &(0x7f0000000500)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x9, 0xa, 0x9, 0x40, 0x1}, 0x19, &(0x7f0000000200)=ANY=[@ANYBLOB="050000000000dfed299bad9644bb00"/25], 0x9, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x41a}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x455}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x414}}, {0x3, &(0x7f0000000300)=@string={0x3, 0x3, '\''}}, {0x2, &(0x7f0000000340)=@string={0x2}}, {0x49, &(0x7f0000000380)=@string={0x49, 0x3, "0b732c14af10843c61557ee28ff5778b80acb7b909cf5cb351d79ccf36c5f543af4c7662365a02a704eb111e3c035bbb3243e29a480ca99c3a8472710eb154c915fdf496cdc39b"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x2c09}}, {0x6e, &(0x7f0000000440)=@string={0x6e, 0x3, "5580931636702c0fc6008150dfc89b7906b357c5373dfbfe926c38fb699a5dc96057289d34f1af45b42b4395a51b8b6b5d5d28d83806e58168cbc71f1b39949cbe2d79cb937c5e5231585e7ddce7c89a2949468db8a98f7b20a2843780253efdd1de7a512db955742e5c13a5"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0xf4ff}}]}) syz_usb_connect(0x0, 0x5a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e010000084101", @ANYBLOB="32d33cd83c2d"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000000)='3', 0x4e) unshare(0x40000000) ioctl$PPPIOCUNBRIDGECHAN(r1, 0x7434) syz_emit_vhci(&(0x7f0000000080)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x0, 0xc}, @l2cap_cid_le_signaling={{0x1}, @l2cap_disconn_rsp={{0x7, 0x5, 0x4}, {0x1, 0x9842}}}}, 0x11) 1m31.021829061s ago: executing program 40 (id=2606): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0x2, 0x3b}, 0x1c) setsockopt$packet_buf(r0, 0x107, 0x5, &(0x7f0000000d80)="f51e3f8dc29d44feb389add5f3bfa356", 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x100, 0xe3, 0x8f, 0x7, 0x10, 0xa5c, 0x2033, 0x3b3, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0xbd, 0x50, 0x3, "", [{{0x9, 0x4, 0xc1, 0x6, 0x0, 0x50, 0xbf, 0x4b, 0x3}}]}}]}}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) syz_usb_connect$uac2(0x2, 0xcd, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x499, 0x102a, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xbb, 0x3, 0x1, 0x9, 0x0, 0xd, {0x8, 0xb, 0x2, 0x0, 0x1, 0x8, 0x20, 0x4}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x8000, 0x7, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x3, 0x2, 0xfb, 0x8, "34122c", '44$'}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x6, 0x4, 0xb8, "731311eae886e7"}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x7, 0x1, 0x2, {0x8, 0x25, 0x1, 0x3, 0x3, 0x8, 0x81}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x2c, 0xb684, 0x3, "83043693daa739b0"}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0xaa0, 0x7f, 0x2, "dc"}, @as_header={0x10, 0x24, 0x1, 0x7, 0x7, 0x3, 0x2, 0x41, 0xffffffb7, 0x8}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x81, 0x3, 0x4, 0xff, "", '\''}]}, {{0x9, 0x5, 0x82, 0x9, 0x278, 0x40, 0x80, 0x2, {0x8, 0x25, 0x1, 0x82, 0x0, 0x5, 0x2}}}}}}}}]}}, &(0x7f0000000500)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x9, 0xa, 0x9, 0x40, 0x1}, 0x19, &(0x7f0000000200)=ANY=[@ANYBLOB="050000000000dfed299bad9644bb00"/25], 0x9, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x41a}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x455}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x414}}, {0x3, &(0x7f0000000300)=@string={0x3, 0x3, '\''}}, {0x2, &(0x7f0000000340)=@string={0x2}}, {0x49, &(0x7f0000000380)=@string={0x49, 0x3, "0b732c14af10843c61557ee28ff5778b80acb7b909cf5cb351d79ccf36c5f543af4c7662365a02a704eb111e3c035bbb3243e29a480ca99c3a8472710eb154c915fdf496cdc39b"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x2c09}}, {0x6e, &(0x7f0000000440)=@string={0x6e, 0x3, "5580931636702c0fc6008150dfc89b7906b357c5373dfbfe926c38fb699a5dc96057289d34f1af45b42b4395a51b8b6b5d5d28d83806e58168cbc71f1b39949cbe2d79cb937c5e5231585e7ddce7c89a2949468db8a98f7b20a2843780253efdd1de7a512db955742e5c13a5"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0xf4ff}}]}) syz_usb_connect(0x0, 0x5a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e010000084101", @ANYBLOB="32d33cd83c2d"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000000)='3', 0x4e) unshare(0x40000000) ioctl$PPPIOCUNBRIDGECHAN(r1, 0x7434) syz_emit_vhci(&(0x7f0000000080)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x0, 0xc}, @l2cap_cid_le_signaling={{0x1}, @l2cap_disconn_rsp={{0x7, 0x5, 0x4}, {0x1, 0x9842}}}}, 0x11) 24.48993086s ago: executing program 2 (id=2696): gettid() timer_settime(0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x4c8080, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) sched_setscheduler(r0, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$9p_tcp(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000004e24,afid=0x0000000080000001,access=client,debug=0x000']) r3 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='select \n', 0x10) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04) mmap$KVM_VCPU(&(0x7f000055f000/0x2000)=nil, r5, 0x1, 0x10, r4, 0x0) write(r4, &(0x7f0000000100)='file read /etc/passwd 0ask.ui!=0 exec.argv[0]=\"sh\" exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000a40)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x9, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc4c85513, &(0x7f0000000540)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x0, 0x3, 0x6c4ba42, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xb4, 0x0, 0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xcd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x3, 0x7fffffffffffffff, 0x2, 0x0, 0x8e665f0, 0x0, 0x92c, 0x3, 0x7f, 0x0, 0x1000, 0x4, 0x0, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x800, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c8e, 0x0, 0x2, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x9, 0x0, 0xfffffffffffffffb, 0x1, 0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x80003, 0x0, 0x0, 0x400000, 0x200, 0x0, 0x81, 0x2000007ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000000, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2, 0xfffffffffffffffe, 0x2, 0x1, 0x3, 0x10, 0x4000100000001]}) 22.312211323s ago: executing program 6 (id=2697): socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f00000000c0)={0x1f, 0xffff}, 0x6) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x6, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) write(r3, &(0x7f0000000000)="5a000300", 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00'}, 0x1c) r4 = gettid() r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r5, 0x4040534e, &(0x7f0000000180)={0x335, @time={0x101, 0x10001}, 0x1b, {}, 0x2, 0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0x40045304, &(0x7f0000000000)) tkill(r4, 0x7) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYRESOCT=r2, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x1c}, 0x1, 0x0, 0x0, 0x4040040}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8040}, 0x0) 20.305969529s ago: executing program 5 (id=2698): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/class/udc/dummy_udc.0/soft_connect\x00', 0x1, 0x10) write$FUSE_OPEN(r2, &(0x7f0000004b00)={0x20, 0x0, 0x0, {0x0, 0x1}}, 0x20) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=0x64010100, 0x1c, 0x18}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r6 = socket$kcm(0x23, 0x2, 0x0) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x10) r7 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) r8 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2}}) r9 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x4, 0x2, 0x1}}) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000003c0)={0x1, @sliced={0x5, [0xa46, 0x7e, 0x4, 0x23, 0xd, 0x401, 0x9, 0xcf, 0x8000, 0x3, 0xfffb, 0x101, 0x9, 0x9, 0xfffa, 0xfffa, 0xc85c, 0x4, 0x101, 0x7, 0x8, 0xa, 0x8, 0x80, 0x2, 0x7, 0x81, 0x94b, 0x17, 0x7, 0x7, 0x2, 0xffff, 0x8, 0x5, 0x2, 0x3, 0x7ff, 0x7, 0x5, 0x0, 0x1, 0x200, 0x98, 0x2, 0x4, 0x8, 0x7], 0xe}}) setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f00000000c0)=0xd, 0x4) socket$kcm(0x2, 0xa, 0x2) 18.284862748s ago: executing program 2 (id=2702): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)) syslog(0x3, &(0x7f0000000200)=""/88, 0x58) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000080)=ANY=[], 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x48890}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x28, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_OIF={0x8, 0x5, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x50, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x3}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}, @NHA_RES_GROUP={0x14, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0xe0b}, @NHA_RES_GROUP_IDLE_TIMER={0x8, 0x2, 0x64}]}]}, 0x50}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x21120, 0x68591}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4000804) 17.820534284s ago: executing program 6 (id=2703): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8200, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f0000000080)="94", 0x1}, {0x0}], 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x4e20, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast1, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x1, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x3, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x0, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f00000003c0)='hfsplus\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv6/conf/default/forwarding\x00', 0x1, 0x54) write(r4, &(0x7f0000000200)='1', 0x1) fspick(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0b0001000000000000000000137100000004000021b4af8a686dd93322c684faddb2e32e8548c42b8550010ada73c5eb472e94e65e5711bc12557b07b3dc6b36a987ed59fca4d3cf091d31fd6c61b84a858c1657a2f71161dfa63b1a5d8820f3fcfe48d8a526ec678955332027a114d5db5ea4b963e93b81e13640af6c594002900f924ab17041c2bb93788af12bae096fcc94158549b00921b254bc440e81d9b131e56f29749f8a9a619d94ce6a490f0739a5e68d26e90fb189334c139ebd4998ebbe7812904bc31ecec1ce1d88142da0387739e1987f730765fed6edf205b9225ace4b6748a5fb93d493453e50382a48ea2f214414d658b46e88d71108c415749a9d", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x400440, 0x0) fstat(r1, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r6, 0xc018937b, 0x0) syz_clone3(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000007200000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) add_key(&(0x7f0000000140)='ceph\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x7fff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1c8}, 0x94) 17.405106694s ago: executing program 2 (id=2704): r0 = openat$vim2m(0xffffff9c, 0x0, 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0cc5605, &(0x7f0000000180)={0x0, @pix_mp={0x4, 0xe4b2, 0x38414262, 0x0, 0x8, [{0x6, 0x4396}, {0xe, 0x3}, {0x4, 0x8}, {0x1, 0x7fffffff}, {0xa5, 0x1}, {0x1, 0x6}, {0xf, 0xffff7fff}, {0x7, 0x1}], 0x7, 0xad, 0x3, 0x0, 0x7}}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0xffffff09, 0x2000007, 0x80010, 0xffffffffffffffff, 0x0) mount$cgroup(0x0, &(0x7f0000001180)='.\x00', &(0x7f00000000c0), 0x10012, &(0x7f00000011c0)={[{}, {@name={'name', 0x3d, 'm'}}]}) setns(0xc9, 0x0) r1 = fsopen(&(0x7f00000000c0)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) r3 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newlink={0x34, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x222, 0x4}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="28000000410007012cbd7000fadbdf25037c00000401cb80100001800c00108008000b8004"], 0x28}, 0x1, 0x0, 0x0, 0x4c084}, 0xc000) ioctl$OCFS2_IOC_UNRESVSP(r3, 0x40305829, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) r6 = fcntl$dupfd(r3, 0x406, r5) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r3, 0x58, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x11a5e4c1fd51c0b5) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r9, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) r10 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r10, 0x29, 0x23, &(0x7f0000000280)={{{@in=@rand_addr=0x64010101, @in6=@empty, 0x0, 0x56, 0x2, 0x0, 0x2}, {0x0, 0x5, 0x1, 0x5, 0xfffffffffffffff6, 0x1fffffc, 0xfffffffffffffffc, 0x8}, {0x4, 0x0, 0x4}, 0xf4, 0x0, 0x1, 0x0, 0x2}, {{@in6=@empty, 0x4d2, 0x33}, 0xa, @in=@loopback, 0x3500, 0x4, 0x0, 0x0, 0xffffffff, 0x8, 0x1}}, 0xe8) connect$inet6(r10, &(0x7f0000000000)={0xa, 0x4000, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xff}}}, 0x1c) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x482, &(0x7f0000000600)=0x0) io_submit(r12, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x7, r11, 0x0}]) sendmmsg$inet6(r8, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}], 0x1, 0x22008805) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl2\x00', r7, 0x2f, 0xf2, 0x4, 0x7fa, 0x2, @empty, @mcast2, 0x20, 0x7800, 0x2, 0x8001}}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000000006e73000000000000", @ANYRES32=r2, @ANYBLOB="06000000000000000000000000000000000000009905e02ca3cd7d5497f13cd5be787a982ee34124640b9410fbea44ec8b7cc1bf382090e1ccfb30b86c201e37361b5d7d71ace6d5e6ea3bbc9c00cae54f7eaf2451cf240b2755c588d2adab4800d69066f7907f46fbcb387e3e3b3dbc720f0ef3", @ANYRES32=r7, @ANYRES32=r5, @ANYBLOB="04000000050000000200"/28], 0x50) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) 16.561664658s ago: executing program 6 (id=2705): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000640)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x59, 0x88, 0xfe, 0x0, 0x2a}, 0xe) shutdown(r0, 0x1) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x2e, &(0x7f0000000000)=0x21ea, 0x4) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}, 0x2100}], 0x414, 0x406, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000840)={'syztnl2\x00', &(0x7f0000000780)={'syztnl0\x00', 0x0, 0x7, 0x1, 0x400, 0x0, {{0x19, 0x4, 0x2, 0x2, 0x64, 0x64, 0x0, 0x5, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, {[@timestamp={0x44, 0x8, 0x24, 0x0, 0x1, [0x4]}, @ssrr={0x89, 0x1b, 0x2a, [@multicast2, @private=0xa010100, @loopback, @rand_addr=0x64010102, @loopback, @private=0xa010102]}, @generic={0x86, 0x2}, @ssrr={0x89, 0x13, 0x9e, [@dev={0xac, 0x14, 0x14, 0x38}, @broadcast, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @rr={0x7, 0x17, 0x72, [@broadcast, @loopback, @loopback, @multicast2, @loopback]}]}}}}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000010c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000dc0)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, &(0x7f0000000e00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000e40)=[0x0], 0x0, 0xdb, &(0x7f0000000e80)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000f00), &(0x7f0000000f40), 0x8, 0xa1, 0x8, 0x8, &(0x7f0000000f80)}}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001180)={0x1, 0x58, &(0x7f0000001100)}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x34, r2, 0x1, 0x70bd26, 0x25dfdbff, {}, [@ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_LINKMODES_OURS={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2e8}]}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4048044}, 0x404c094) r5 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r6 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r7 = dup2(r6, r6) r8 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f0000000200)={0x2e, 0x0, 0x0, r7, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, &(0x7f0000002e80)) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=@newsa={0x158, 0x10, 0x713, 0x0, 0x0, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in=@rand_addr=0x64010102}, {@in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4d5, 0x33}, @in=@multicast1, {0x3}, {}, {0x4, 0x22}, 0x0, 0x0, 0x2}, [@algo_auth_trunc={0x5c, 0x14, {{'cmac(aes)\x00'}, 0x80, 0x0, "3509fe8fd57fd44aa5074c50bc700e53"}}, @offload={0xc, 0x1c, {0x0, 0x2}}]}, 0x158}}, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r5, 0x400442c9, &(0x7f00000000c0)={0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) 16.336512222s ago: executing program 2 (id=2706): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000500)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() setrlimit(0x9, &(0x7f0000000340)={0x8000000000000000, 0x20000000009}) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffff}, 0x6) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x6, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) write(0xffffffffffffffff, &(0x7f0000000000)="5a000300", 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00'}, 0x1c) r2 = gettid() r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) read(r3, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000180)={0x335, @time={0x101, 0x10001}, 0x1b, {}, 0x2, 0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r3, 0x40045304, &(0x7f0000000000)) tkill(r2, 0x7) syz_emit_ethernet(0x4e, &(0x7f0000002540)=ANY=[@ANYBLOB, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="68c200009078000003020000"], 0x0) mount(0x0, &(0x7f0000000000)='./tracing\x00', 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYRESOCT=r1, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x1c}, 0x1, 0x0, 0x0, 0x4040040}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8040}, 0x0) 16.177818791s ago: executing program 3 (id=2707): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000021c0)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa0000000000000000000000004e220005000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000900000000000000000a000000000000000000000080400000000000000000080000000000000000000100000000000044000500fc020000000000000000000000000000000004d36c00000002000000ff0100000000000000000000000000010735000001"], 0xfc}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r1, &(0x7f0000000700)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000200}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x1c, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008000}, 0xb5fa7fa4909287dc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt(r4, 0xff, 0x1, 0x0, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r5, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000000f1401002dbd7000fedbdf250800030000400000080003000000000007004500636d0000080001"], 0x38}, 0x1, 0x0, 0x0, 0x20}, 0x800) mlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x1, 0x3f, 0x40, 0x42}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000100), 0x1003, r6}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r7) sendmsg$IPVS_CMD_GET_INFO(r7, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x1c, r9, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000080) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r10, @ANYBLOB="04005b00070065"], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) io_uring_register$IORING_REGISTER_NAPI(0xffffffffffffffff, 0x1b, 0x0, 0x1) pread64(0xffffffffffffffff, &(0x7f00000001c0)=""/142, 0x8e, 0x5) 14.486618546s ago: executing program 2 (id=2708): mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$getownex(r1, 0x10, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x1f, 0x100000, 0x5691409, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}}, 0x50) syz_fuse_handle_req(r5, &(0x7f0000004200)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000fdff00000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x6, {0x0, 0x3022d6e144aa3ceb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80700, 0x0) 10.947999127s ago: executing program 5 (id=2709): r0 = syz_open_dev$vim2m(0x0, 0xf7f, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000000)={0xf0f006, 0x6}) 10.942353656s ago: executing program 3 (id=2710): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a000000010000000000008a"], 0x0, 0x8e}, 0x28) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, 0x28) 10.91215411s ago: executing program 6 (id=2711): mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$getownex(r1, 0x10, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x20141, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x1f, 0x100000, 0x5691409, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}}, 0x50) syz_fuse_handle_req(r5, &(0x7f0000004200)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000fdff00000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x6, {0x0, 0x3022d6e144aa3ceb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80700, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) futex(0x0, 0xd, 0x1, 0x0, 0x0, 0x400000) fcntl$setpipe(r4, 0x407, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xc, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000004000000000000009aaa0004000000002300000095004100000000000c3236c13508e946581c01fdb543694bbc8ed5d9164a3462b9ac87ec3a1521712b94cb1c37b12a8587a72d9947678b4f51950685831d5a346a971c7428d1fe89f87c08a9caa9497e420e73d43cbad70c40d9935cc793000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 10.661387425s ago: executing program 5 (id=2712): syz_emit_vhci(0x0, 0xd) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000f, 0x50, 0xffffffffffffffff, 0xbd136000) io_uring_register$IORING_REGISTER_ZCRX_IFQ(0xffffffffffffffff, 0x20, 0x0, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@newtaction={0x14, 0x30, 0x200, 0x703d27, 0x1}, 0x14}}, 0x20080) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$nci(0xffffff9c, &(0x7f0000000100), 0x2, 0x0) write$nci(r0, &(0x7f0000000980)=ANY=[@ANYBLOB="03005715e1df496681fb297cb07c75ad1badef79d16e19e7b0a18da2fe61151dcf351e3b4e89320221736ae51e7bb80188920d685a5c47e64bd335e16b66c09d6d1e11d651f43c8a67e7b842e6d44170191004855a5d76fefb02f0435788d2c2d8b66c54c10800311e91a100b2124ec9ed87019441e7df3c356215019006838bd4f8cce45c07b0855ddd5e895cbb170701ffe373ff0320ba3c3ed6b9f7a7ec4a8b1905b924276873327b4ba7adc1ee45082af524c20c7bbf1d343d60383a797e7191bb712fb3f8b964044052aa7938c2afc8d25428960ee241250cd00525fdd90a5503989e881d9cc42340edc1639ba5491d94ffce790db154fec29b5bc7935f46d5c696eb5b1f2579dc61394a809c83745f595120e685a36d28328877ef918ed22a5d64c4151e837d36906f90a562fcdf3fe254f6ae0f5cb3c9178f4dcf68a402341665875e6a9fbc769b259f74c8e086ec0194be656ab19713e9530c1820715880"], 0xec) write$nci(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="e87d1120c34370074c8c3159e585e1e7d9d64a51aed756c6943ef9fd32f2845cbdf2adf9b97e6be3d8dea2bee1471e88037c2ffb589116b46549ed728fa80200000000000000565d0879d80203c98a72320180f58b97c9e7006bc20e6abd9264e308eca7ef78d98a2d6b410d2b15e6e085cca6a169fd5801b79b5e5dd5ca55277a42df43f04fb6a3bcc1a6632b89f49f93df860cfc"], 0x4) mkdir(&(0x7f0000000040)='./my_configfs\x00', 0x176) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write$proc_mixer(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="494d49582027303030303030303030303030303030300a00000000000000007d39bb382df9f4145455404a028c2c6e72c5b9b11d20c8f691c65e451a24d9c99bc14f5bd52c31f7db144ae0594f94e488ea10f39c898c8f82"], 0x1f) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mq_getsetattr(r1, &(0x7f0000000500)={0xd, 0x6, 0x5, 0x7}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r3 = inotify_init() inotify_add_watch(r3, 0x0, 0x850003d1) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/target/dbroot\x00', 0x31) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) socket$nl_route(0x10, 0x3, 0x0) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000680)=""/240) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) syz_usb_connect$uac3(0x3, 0xb3, &(0x7f0000000100)=ANY=[@ANYBLOB="1201100100000040cd0c14004000010203010902a100030101c010080b0002010130070904000000010130000a2401103d0007000000132403050101060250ff07000007000900ff050c240b0701fcffffff08060014240202040405075d"], 0x0) socket$inet_smc(0x2b, 0x1, 0x0) 10.658821665s ago: executing program 3 (id=2713): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0xfe, 0x7fff0006}]}) syslog(0x3, 0x0, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000080)=ANY=[], 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x48890}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x28, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_OIF={0x8, 0x5, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x50, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x3}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}, @NHA_RES_GROUP={0x14, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0xe0b}, @NHA_RES_GROUP_IDLE_TIMER={0x8, 0x2, 0x64}]}]}, 0x50}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x21120, 0x68591}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4000804) 9.045927509s ago: executing program 6 (id=2714): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x0) (fail_nth: 3) 4.348810233s ago: executing program 2 (id=2715): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a000000010000000000008a"], 0x0, 0x8e}, 0x28) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x28) 4.345009178s ago: executing program 5 (id=2716): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0xfd) mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/clear_refs\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x20000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = syz_clone(0x102480, &(0x7f0000000140)="5b8681865b8cb60e264df4df0601448ed718606b4fe8a652c3643acc6e8160cf7fd2bef4159ec12f1814a8dddb93c3f2938c35c33ff7b92d2fde30dc8f261b4fb367a6977b549857215947f945eb6ff332878ab70864d5ffc1541db2f1", 0x5d, 0x0, &(0x7f0000000200), &(0x7f0000000240)="343394a5f90320f0204af3893a63987078c5e9810b9270176b1b") prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c41, 0x0) unshare(0x8000000) r3 = semget$private(0x0, 0x1, 0x3) semctl$SETALL(r3, 0x0, 0x11, &(0x7f0000000100)=[0x1]) semtimedop(r3, &(0x7f0000000040), 0x0, 0x0) unshare(0x8000000) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) read(r4, &(0x7f0000000100)=""/9, 0xfffffd87) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYRESOCT=0x0, @ANYRES64=r3, @ANYBLOB="9d00"/20, @ANYRES64, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) splice(r5, 0x0, r6, 0x0, 0x7c1c, 0x8) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./security/ima/policy\x00', 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) 4.282528081s ago: executing program 3 (id=2717): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x30, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@mon_options=[@NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x30}}, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000002940)={&(0x7f0000001500)=ANY=[@ANYBLOB="34140000", @ANYRES16=r2, @ANYBLOB="adab27bd7000fddbdf250b"], 0x1434}, 0x1, 0x0, 0x0, 0x80}, 0x14) r6 = accept4$alg(r0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000080)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x200) sendmmsg$alg(r6, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000140)="a92e85d0991808e33c2330162af023dffeac769b13de75529dc1109d9ef10b4fe1485eb1c93ced729dcb311306b4d774f2737e94bca6ab4537c068c9ba8889f4989f1cc1f9491ee86a289a2f4a8dc5b3fb3dcf199c45c5ce07e8c7d99a94b78b9c092cc3872c2d9cfd02eda17b7d7d7aa16337b9543642b7406d7f7b2572cd144a4ff6e444047152c0ca0796bfb5bd71ca4411efe7adb30d5f9e93dddc7dc59ec9a2823311deeddd49c4b1", 0xab}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) landlock_restrict_self(0xffffffffffffffff, 0xc) 2.577618787s ago: executing program 5 (id=2718): r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x60, 0x0) read$midi(r0, 0x0, 0x3b) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) syz_usb_connect(0x6, 0x24, &(0x7f0000000200)=ANY=[@ANYRES64=0x0, @ANYRES64=r0, @ANYRES16=r0], 0x0) r2 = socket$inet(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='veth1_virt_wifi\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x2, 0x4e26, @multicast1}, 0x10) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) add_key(&(0x7f0000000100)='cifs.idmap\x00', 0x0, &(0x7f0000000300)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a0698083d2737fba7c202303a3138303606035504030c2f4360727469664963617465207665084f6d9cc37003576f6e2045434453412073656c662d74657374696e67206b65793020170d32bf303431333232313632365a180f32020034303332303232313632365a30000038303606035504030c2f43657274696669636174652076657269666963617428a2e0861e1ae90d413273656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0a01070342000407e56b51af", 0xe9, 0xfffffffffffffffd) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() r4 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000780)='asymmetric\x00', 0x0, 0x0, 0x0, r4) sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xb635773f04ebbeeb, 0x10, 0xffffffffffffffff, 0xd6d1c000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x0, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000800)='GPL\x00', 0x4, 0xb5, &(0x7f00000004c0)=""/181, 0x0, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc}, 0x94) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x289c2, 0x1) mount(&(0x7f0000000180)=@filename='./bus\x00', &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x1008c, &(0x7f0000000300)='trans=rdma,') bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) sched_setaffinity(r5, 0x0, 0x0) 652.868501ms ago: executing program 3 (id=2719): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) waitid(0x2, 0x0, 0xfffffffffffffffd, 0x8, 0x0) rmdir(&(0x7f00000002c0)='./file2\x00') chdir(&(0x7f0000000040)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x184) 286.391122ms ago: executing program 3 (id=2720): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000640)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x59, 0x88, 0xfe, 0x0, 0x2a}, 0xe) shutdown(r0, 0x1) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x2e, &(0x7f0000000000)=0x21ea, 0x4) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}, 0x2100}], 0x414, 0x406, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000840)={'syztnl2\x00', &(0x7f0000000780)={'syztnl0\x00', 0x0, 0x7, 0x1, 0x400, 0x0, {{0x19, 0x4, 0x2, 0x2, 0x64, 0x64, 0x0, 0x5, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, {[@timestamp={0x44, 0x8, 0x24, 0x0, 0x1, [0x4]}, @ssrr={0x89, 0x1b, 0x2a, [@multicast2, @private=0xa010100, @loopback, @rand_addr=0x64010102, @loopback, @private=0xa010102]}, @generic={0x86, 0x2}, @ssrr={0x89, 0x13, 0x9e, [@dev={0xac, 0x14, 0x14, 0x38}, @broadcast, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @rr={0x7, 0x17, 0x72, [@broadcast, @loopback, @loopback, @multicast2, @loopback]}]}}}}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000010c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000dc0)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, &(0x7f0000000e00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000e40)=[0x0], 0x0, 0xdb, &(0x7f0000000e80)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000f00), &(0x7f0000000f40), 0x8, 0xa1, 0x8, 0x8, &(0x7f0000000f80)}}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001180)={0x1, 0x58, &(0x7f0000001100)}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x34, r2, 0x1, 0x70bd26, 0x25dfdbff, {}, [@ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_LINKMODES_OURS={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2e8}]}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4048044}, 0x404c094) r5 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r6 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r7 = dup2(r6, r6) r8 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f0000000200)={0x2e, 0x0, 0x0, r7, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, &(0x7f0000002e80)) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=@newsa={0x158, 0x10, 0x713, 0x0, 0x0, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in=@rand_addr=0x64010102}, {@in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4d5, 0x33}, @in=@multicast1, {0x3}, {}, {0x4, 0x22}, 0x0, 0x0, 0x2}, [@algo_auth_trunc={0x5c, 0x14, {{'cmac(aes)\x00'}, 0x80, 0x0, "3509fe8fd57fd44aa5074c50bc700e53"}}, @offload={0xc, 0x1c, {0x0, 0x2}}]}, 0x158}}, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r5, 0x400442c9, &(0x7f00000000c0)={0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) 205.921761ms ago: executing program 5 (id=2721): r0 = syz_open_dev$vim2m(0x0, 0xf7f, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000000)={0xf0f006, 0x6}) 0s ago: executing program 6 (id=2722): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./myproc\x00', 0x1ff) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080060000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5100000000", 0x43}], 0x1) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, 0x0, 0x0) ioctl$sock_bt_hci(r5, 0x400448e6, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mount(0x0, &(0x7f0000000100)='./myproc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r6 = creat(&(0x7f0000000000)='./myproc/interrupts\x00', 0x20) lseek(r6, 0x2000000008, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000280)={{0x1, 0x1, 0x18, r0, {0xffffff64}}, './file0\x00'}) r8 = syz_io_uring_setup(0x2492, &(0x7f0000000100)={0x0, 0x4504, 0x80000, 0x1, 0x3e0, 0x0, r7}, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) setresuid(0x0, 0xee01, 0xffffffffffffffff) setreuid(0xee01, 0xee00) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(r8, 0x1e, &(0x7f0000000240)={r0, 0x1, 0x2, 0x7, 0xb}, 0x1) connect$inet(r0, &(0x7f00000000c0)={0x2, 0xfffa, @empty}, 0x10) socket$nl_route(0x10, 0x3, 0x0) kernel console output (not intermixed with test programs): 7312] Tainted: [L]=SOFTLOCKUP [ 1478.755818][T17312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1478.755831][T17312] Call Trace: [ 1478.755839][T17312] [ 1478.755847][T17312] dump_stack_lvl+0x100/0x190 [ 1478.755885][T17312] should_fail_ex.cold+0x5/0xa [ 1478.755916][T17312] _copy_from_user+0x2e/0xd0 [ 1478.755942][T17312] ctrl_cdev_ioctl+0x147/0x410 [ 1478.755973][T17312] ? __pfx_ctrl_cdev_ioctl+0x10/0x10 [ 1478.756006][T17312] ? selinux_file_ioctl+0x13b/0x290 [ 1478.756030][T17312] ? selinux_file_ioctl+0xb6/0x290 [ 1478.756055][T17312] ? __pfx_ctrl_cdev_ioctl+0x10/0x10 [ 1478.756086][T17312] __x64_sys_ioctl+0x18e/0x210 [ 1478.756112][T17312] do_syscall_64+0x123/0x790 [ 1478.756145][T17312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1478.756166][T17312] RIP: 0033:0x7f06fa19e159 [ 1478.756184][T17312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1478.756204][T17312] RSP: 002b:00007f06f83f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1478.756224][T17312] RAX: ffffffffffffffda RBX: 00007f06fa425fa0 RCX: 00007f06fa19e159 [ 1478.756239][T17312] RDX: 0000200000000300 RSI: 0000000040186f40 RDI: 0000000000000003 [ 1478.756254][T17312] RBP: 00007f06f83f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1478.756266][T17312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1478.756279][T17312] R13: 00007f06fa426038 R14: 00007f06fa425fa0 R15: 00007ffc5cab40d8 [ 1478.756309][T17312] [ 1478.980478][ T30] audit: type=1400 audit(1789919607.810:1766): avc: denied { write } for pid=17315 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1479.097000][T16993] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1479.111966][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 1479.112017][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 1479.162924][T16993] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1479.174261][T16993] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1479.225862][T16993] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1479.231972][T16993] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1479.289186][T16993] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1479.295490][T16993] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1479.445121][T17326] FAULT_INJECTION: forcing a failure. [ 1479.445121][T17326] name failslab, interval 1, probability 0, space 0, times 0 [ 1479.445162][T17326] CPU: 0 UID: 0 PID: 17326 Comm: syz.6.2493 Tainted: G L syzkaller #0 PREEMPT(full) [ 1479.445197][T17326] Tainted: [L]=SOFTLOCKUP [ 1479.445207][T17326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1479.445222][T17326] Call Trace: [ 1479.445230][T17326] [ 1479.445243][T17326] dump_stack_lvl+0x100/0x190 [ 1479.445285][T17326] should_fail_ex.cold+0x5/0xa [ 1479.445318][T17326] should_failslab+0xc2/0x120 [ 1479.445348][T17326] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1479.445371][T17326] ? __pfx_vma_is_special_huge+0x10/0x10 [ 1479.445398][T17326] ? ptlock_alloc+0x1f/0x70 [ 1479.445432][T17326] ptlock_alloc+0x1f/0x70 [ 1479.445460][T17326] pte_alloc_one+0x82/0x3d0 [ 1479.445490][T17326] __do_fault+0x26c/0x440 [ 1479.445513][T17326] do_fault+0x585/0x1830 [ 1479.445537][T17326] ? __pfx_filemap_map_pages+0x10/0x10 [ 1479.445564][T17326] ? __pfx___thp_vma_allowable_orders+0x10/0x10 [ 1479.445596][T17326] ? __pfx_do_fault+0x10/0x10 [ 1479.445620][T17326] ? do_raw_spin_unlock+0x145/0x1e0 [ 1479.445648][T17326] ? _raw_spin_unlock+0x28/0x50 [ 1479.445674][T17326] ? __pmd_alloc+0x3fb/0x950 [ 1479.445702][T17326] __handle_mm_fault+0x150b/0x2f60 [ 1479.445737][T17326] ? __pfx___handle_mm_fault+0x10/0x10 [ 1479.445765][T17326] ? __pfx_mt_find+0x10/0x10 [ 1479.445800][T17326] ? find_vma+0xbf/0x140 [ 1479.445828][T17326] ? __pfx_find_vma+0x10/0x10 [ 1479.445854][T17326] handle_mm_fault+0x363/0xa20 [ 1479.445892][T17326] do_user_addr_fault+0x745/0x12f0 [ 1479.445930][T17326] exc_page_fault+0x6f/0xd0 [ 1479.445962][T17326] asm_exc_page_fault+0x26/0x30 [ 1479.445983][T17326] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 1479.446008][T17326] Code: cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 7f b1 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 1479.446028][T17326] RSP: 0018:ffffc90004cc7cb0 EFLAGS: 00050202 [ 1479.446046][T17326] RAX: 0000000000000001 RBX: 0000000000000078 RCX: 0000000000000078 [ 1479.446060][T17326] RDX: 0000000000000001 RSI: ffffc90004cc7d10 RDI: 0000000000000000 [ 1479.446073][T17326] RBP: 0000000000000000 R08: 0000000000000000 R09: fffff52000998fb0 [ 1479.446086][T17326] R10: ffffc90004cc7d87 R11: 0000000000000000 R12: ffffc90004cc7d10 [ 1479.446099][T17326] R13: 0000000000000078 R14: 00007ffffffff000 R15: 0000000000000000 [ 1479.446125][T17326] _copy_to_user+0xa4/0xd0 [ 1479.446149][T17326] do_statfs_native+0xa2/0x110 [ 1479.446174][T17326] ? __pfx_do_statfs_native+0x10/0x10 [ 1479.446207][T17326] ? simple_statfs+0x13/0x1d0 [ 1479.446230][T17326] ? fput+0x7c/0x100 [ 1479.446262][T17326] __do_sys_fstatfs+0xf4/0x100 [ 1479.446286][T17326] ? __pfx___do_sys_fstatfs+0x10/0x10 [ 1479.446328][T17326] do_syscall_64+0x123/0x790 [ 1479.446361][T17326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1479.446382][T17326] RIP: 0033:0x7f06fa19e159 [ 1479.446398][T17326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1479.446418][T17326] RSP: 002b:00007f06f83b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000008a [ 1479.446437][T17326] RAX: ffffffffffffffda RBX: 00007f06fa426180 RCX: 00007f06fa19e159 [ 1479.446450][T17326] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 1479.446462][T17326] RBP: 00007f06fa23506b R08: 0000000000000000 R09: 0000000000000000 [ 1479.446475][T17326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1479.446487][T17326] R13: 00007f06fa426218 R14: 00007f06fa426180 R15: 00007ffc5cab40d8 [ 1479.446516][T17326] [ 1479.687298][T16993] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1479.759337][ T5789] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 1479.944475][ T5789] usb 3-1: Using ep0 maxpacket: 16 [ 1479.945661][ T5789] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 1479.969033][ T5789] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1479.969064][ T5789] usb 3-1: Product: syz [ 1479.969081][ T5789] usb 3-1: Manufacturer: syz [ 1479.969097][ T5789] usb 3-1: SerialNumber: syz [ 1480.263909][ T5789] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 1480.287424][ T5789] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1480.287796][ T5789] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 1480.287877][ T5789] usb 3-1: media controller created [ 1480.341172][ T5789] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1480.367719][T16993] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1480.447905][T16993] 8021q: adding VLAN 0 to HW filter on device team0 [ 1480.480501][ T6312] bridge0: port 1(bridge_slave_0) entered blocking state [ 1480.480612][ T6312] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1480.503813][ T30] audit: type=1400 audit(1789919609.330:1767): avc: denied { accept } for pid=17322 comm="syz.2.2494" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1480.528850][ T6268] bridge0: port 2(bridge_slave_1) entered blocking state [ 1480.528960][ T6268] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1480.553090][ T5789] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1480.612814][ T5789] dvb_usb_gl861 3-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 1480.630218][ T5789] usb 3-1: USB disconnect, device number 4 [ 1483.576331][ T30] audit: type=1400 audit(1789919612.410:1768): avc: denied { write } for pid=17327 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1486.048753][T17377] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1486.183347][T17377] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1486.193973][T17377] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1486.627431][ T30] audit: type=1400 audit(1789919615.440:1769): avc: denied { write } for pid=17374 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1489.413196][T16993] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1489.658191][T16993] veth0_vlan: entered promiscuous mode [ 1489.717173][T16993] veth1_vlan: entered promiscuous mode [ 1489.811070][T17406] xt_ecn: cannot match TCP bits for non-tcp packets [ 1489.955012][T16993] veth0_macvtap: entered promiscuous mode [ 1489.958815][T16993] veth1_macvtap: entered promiscuous mode [ 1490.058634][T16993] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1490.104351][T16993] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1490.216470][T10842] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1490.216784][T10842] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1490.772738][T17415] xt_HMARK: spi-set and port-set can't be combined [ 1491.315995][T10842] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1491.316754][T10842] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1491.362125][ T30] audit: type=1400 audit(1789919620.190:1770): avc: denied { write } for pid=17394 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1491.681747][T10842] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1491.681803][T10842] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1491.827978][ T30] audit: type=1400 audit(1789919620.660:1771): avc: denied { write } for pid=17417 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1491.869587][ T171] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1491.869610][ T171] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1494.200862][T17439] fuse-io-uring is disabled by module parameter [ 1494.384599][T14967] usb 8-1: new full-speed USB device number 9 using dummy_hcd [ 1494.534724][T14967] usb 8-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=33.f9 [ 1494.535747][T14967] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4C, changing to 0xC [ 1494.535783][T14967] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0xC has an invalid bInterval 0, changing to 10 [ 1494.535813][T14967] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 1297, setting to 64 [ 1494.543686][T14967] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1494.543716][T14967] usb 8-1: Product: syz [ 1494.543732][T14967] usb 8-1: Manufacturer: syz [ 1494.543749][T14967] usb 8-1: SerialNumber: syz [ 1494.549474][T14967] usb 8-1: config 0 descriptor?? [ 1494.595673][T17447] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1496.515726][T17465] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1496.558671][T15707] Bluetooth: hci4: command 0x0406 tx timeout [ 1496.586353][T17465] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1496.595399][T17465] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1497.469763][ T30] audit: type=1400 audit(1789919626.300:1772): avc: denied { write } for pid=17444 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1497.872215][T17474] random: crng reseeded on system resumption [ 1497.942485][ T30] audit: type=1400 audit(1789919626.770:1773): avc: denied { write } for pid=17473 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1498.551111][T17480] fuse: Bad value for 'fd' [ 1499.612261][ T5262] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1499.830447][T15707] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1499.835168][T15707] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1499.844735][T15707] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1499.851103][T15707] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1499.851950][T15707] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1500.616895][T17491] netlink: NAT attribute has 8 unknown bytes [ 1500.616928][T17491] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1502.894910][ T52] Bluetooth: hci2: command tx timeout [ 1503.654949][ T30] audit: type=1400 audit(1789919632.490:1774): avc: denied { write } for pid=17496 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1503.774003][T14957] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 1503.911410][ T30] audit: type=1400 audit(1789919632.740:1775): avc: denied { write } for pid=17528 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1503.966817][T14957] usb 3-1: not running at top speed; connect to a high speed hub [ 1503.966851][T14957] usb 3-1: New USB device found, idVendor=04b4, idProduct=1002, bcdDevice=60.1b [ 1503.968119][T14957] usb 3-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 1503.970710][T14957] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1503.970738][T14957] usb 3-1: Product: syz [ 1503.970756][T14957] usb 3-1: Manufacturer: syz [ 1503.970774][T14957] usb 3-1: SerialNumber: syz [ 1504.267966][ T5262] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1504.424358][T17535] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 32, id = 0 [ 1504.454912][T14957] usb 3-1: USB disconnect, device number 5 [ 1504.655929][ T5781] usb 8-1: USB disconnect, device number 9 [ 1504.945132][T15707] Bluetooth: hci2: command tx timeout [ 1505.468718][T17553] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1505.537057][T17483] bridge0: port 1(bridge_slave_0) entered blocking state [ 1505.541553][T17483] bridge0: port 1(bridge_slave_0) entered disabled state [ 1505.541859][T17483] bridge_slave_0: entered allmulticast mode [ 1505.542358][ T30] audit: type=1400 audit(1789919634.370:1776): avc: denied { bind } for pid=17548 comm="syz.2.2520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1505.542586][ T30] audit: type=1400 audit(1789919634.370:1777): avc: denied { node_bind } for pid=17548 comm="syz.2.2520" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 1505.591630][T17483] bridge_slave_0: entered promiscuous mode [ 1505.598762][ T30] audit: type=1400 audit(1789919634.430:1778): avc: denied { connect } for pid=17548 comm="syz.2.2520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1505.652599][T17483] bridge0: port 2(bridge_slave_1) entered blocking state [ 1505.652727][T17483] bridge0: port 2(bridge_slave_1) entered disabled state [ 1505.652901][T17483] bridge_slave_1: entered allmulticast mode [ 1505.661878][T17483] bridge_slave_1: entered promiscuous mode [ 1505.823118][T17483] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1505.851841][T14957] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1505.860265][T17483] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1505.893306][ T30] audit: type=1400 audit(1789919634.720:1779): avc: denied { write } for pid=17541 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1506.004833][T17483] team0: Port device team_slave_0 added [ 1506.019415][T17483] team0: Port device team_slave_1 added [ 1506.035076][T14957] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1506.035123][T14957] usb 3-1: New USB device found, idVendor=07c0, idProduct=158b, bcdDevice=d9.d2 [ 1506.051969][T14957] usb 3-1: config 64 has an invalid interface number: 44 but max is 0 [ 1506.051989][T14957] usb 3-1: config 64 has no interface number 0 [ 1506.052012][T14957] usb 3-1: config 64 interface 44 altsetting 7 endpoint 0x83 has an invalid bInterval 57, changing to 9 [ 1506.052028][T14957] usb 3-1: config 64 interface 44 has no altsetting 0 [ 1506.063856][T14957] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1506.065973][T14957] usb 3-1: Product: syz [ 1506.065992][T14957] usb 3-1: Manufacturer: syz [ 1506.066009][T14957] usb 3-1: SerialNumber: syz [ 1506.261902][T17483] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1506.261921][T17483] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1506.261945][T17483] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1506.284127][T17483] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1506.284146][T17483] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1506.284170][T17483] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1506.397949][ T30] audit: type=1400 audit(1789919635.230:1780): avc: denied { write } for pid=17565 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1507.848780][T15707] Bluetooth: hci2: command tx timeout [ 1508.084291][ T5262] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1508.102160][T17483] hsr_slave_0: entered promiscuous mode [ 1508.103324][T17483] hsr_slave_1: entered promiscuous mode [ 1508.106182][T17483] debugfs: 'hsr0' already exists in 'hsr' [ 1508.106204][T17483] Cannot create hsr debugfs directory [ 1508.189681][ T30] audit: type=1400 audit(1789919637.020:1781): avc: denied { setopt } for pid=17572 comm="syz.8.2523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1508.201842][T17573] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2523'. [ 1509.904490][T15707] Bluetooth: hci2: command tx timeout [ 1510.070221][T14957] iowarrior 3-1:64.44: no interrupt-out endpoint found [ 1510.096496][T14957] usb 3-1: USB disconnect, device number 6 [ 1510.941045][T17597] netlink: 'syz.8.2527': attribute type 10 has an invalid length. [ 1511.734939][T17610] netlink: 7324 bytes leftover after parsing attributes in process `syz.6.2529'. [ 1512.616377][ T30] audit: type=1400 audit(1789919641.410:1782): avc: denied { ioctl } for pid=17592 comm="syz.8.2527" path="socket:[57946]" dev="sockfs" ino=57946 ioctlcmd=0x89e9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1512.954172][T14977] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 1513.145755][T14977] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1513.158087][T14977] usb 9-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1513.158120][T14977] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1513.158142][T14977] usb 9-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1513.158163][T14977] usb 9-1: config 1 has no interface number 1 [ 1513.158191][T14977] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1513.158212][T14977] usb 9-1: config 1 interface 2 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1513.160744][T14977] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1513.160771][T14977] usb 9-1: Product: syz [ 1513.160787][T14977] usb 9-1: Manufacturer: syz [ 1513.160804][T14977] usb 9-1: SerialNumber: syz [ 1514.605974][T17597] team0: left promiscuous mode [ 1514.608337][T17597] team0: Cannot enslave team device to itself [ 1515.366521][ T30] audit: type=1400 audit(1789919644.200:1783): avc: denied { write } for pid=17581 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1515.369066][T14977] usb 9-1: Failed to set altset [ 1515.369116][T14977] usb 9-1: 0:2: cannot create sequencer device [ 1516.881838][T14977] usb 9-1: Failed to set altset [ 1516.938739][ T30] audit: type=1400 audit(1789919645.760:1784): avc: denied { write } for pid=17629 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1517.042438][T14977] snd-usb-audio 9-1:1.2: probe with driver snd-usb-audio failed with error -71 [ 1517.087231][T14977] usb 9-1: USB disconnect, device number 19 [ 1517.184990][T16342] udevd[16342]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1518.903134][ T5262] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1519.845981][T17657] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1519.875687][T17657] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1519.883805][T17657] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1521.367547][ T30] audit: type=1400 audit(1789919650.200:1785): avc: denied { write } for pid=17642 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1521.625908][T17663] db_root: cannot open: IMIX '0000000000000000 [ 1523.691756][ T30] audit: type=1400 audit(1789919652.520:1786): avc: denied { write } for pid=17669 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1526.345563][T17483] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1526.399761][T17483] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1526.421317][T17483] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1526.454225][T14977] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 1526.455246][T17483] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1526.457073][T17483] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1526.466183][T17483] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1526.466974][T17483] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1526.507792][T17483] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1526.604000][T14977] usb 3-1: Using ep0 maxpacket: 16 [ 1526.604783][T14977] usb 3-1: New USB device found, idVendor=0846, idProduct=1040, bcdDevice=d0.c9 [ 1526.606013][T14977] usb 3-1: config 0 has an invalid interface number: 98 but max is 0 [ 1526.606041][T14977] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1526.606063][T14977] usb 3-1: config 0 has no interface number 0 [ 1526.606102][T14977] usb 3-1: config 0 interface 98 altsetting 2 bulk endpoint 0x8 has invalid maxpacket 16 [ 1526.606138][T14977] usb 3-1: config 0 interface 98 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1526.606164][T14977] usb 3-1: config 0 interface 98 has no altsetting 0 [ 1526.608044][T14977] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1526.608069][T14977] usb 3-1: Product: syz [ 1526.608086][T14977] usb 3-1: Manufacturer: syz [ 1526.608102][T14977] usb 3-1: SerialNumber: syz [ 1526.673973][T14977] usb 3-1: config 0 descriptor?? [ 1526.708271][T17676] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1526.708399][T17676] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1526.951284][T17676] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1526.951416][T17676] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1527.075488][T17483] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1527.079296][ T30] audit: type=1400 audit(1789919655.910:1787): avc: denied { write } for pid=17674 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1527.238830][T17483] 8021q: adding VLAN 0 to HW filter on device team0 [ 1527.297958][T10842] bridge0: port 1(bridge_slave_0) entered blocking state [ 1527.298052][T10842] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1527.340492][T10842] bridge0: port 2(bridge_slave_1) entered blocking state [ 1527.340592][T10842] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1527.406315][ T30] audit: type=1400 audit(1789919656.240:1788): avc: denied { write } for pid=17698 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1527.518402][T14977] asix 3-1:0.98 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 1527.518601][T14977] asix 3-1:0.98: probe with driver asix failed with error -71 [ 1527.552492][T14977] usb 3-1: USB disconnect, device number 7 [ 1529.516347][T17716] fuse-io-uring is disabled by module parameter [ 1529.542093][ T30] audit: type=1400 audit(1789919658.370:1789): avc: denied { write } for pid=17700 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1531.083997][T14976] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 1531.236139][T14976] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1531.257802][T14976] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1531.262869][T14976] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1531.262899][T14976] usb 7-1: SerialNumber: syz [ 1531.408122][ T30] audit: type=1400 audit(1789919660.240:1790): avc: denied { write } for pid=17730 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1531.687409][T17737] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1531.689361][T17737] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1531.689640][T17737] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1532.731997][T14976] cdc_ether 7-1:1.0 usb2: register 'cdc_ether' at usb-dummy_hcd.6-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 1532.767256][T14976] usb 7-1: USB disconnect, device number 28 [ 1532.792937][T14976] cdc_ether 7-1:1.0 usb2: unregister 'cdc_ether' usb-dummy_hcd.6-1, CDC Ethernet Device [ 1533.101435][T17483] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1534.362285][T17753] db_root: cannot open: IMIX '0000000000000000 [ 1537.737458][ T30] audit: type=1400 audit(1789919666.570:1791): avc: denied { read write } for pid=17773 comm="syz.2.2550" name="sg0" dev="devtmpfs" ino=908 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1537.772216][ T30] audit: type=1400 audit(1789919666.570:1792): avc: denied { open } for pid=17773 comm="syz.2.2550" path="/dev/sg0" dev="devtmpfs" ino=908 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1538.103032][T17483] veth0_vlan: entered promiscuous mode [ 1538.201795][T17483] veth1_vlan: entered promiscuous mode [ 1538.270373][T17783] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1538.411736][ T30] audit: type=1400 audit(1789919667.240:1793): avc: denied { write } for pid=17743 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1538.453096][T17483] veth0_macvtap: entered promiscuous mode [ 1538.498622][T17483] veth1_macvtap: entered promiscuous mode [ 1538.592204][ T30] audit: type=1400 audit(1789919667.420:1794): avc: denied { write } for pid=17788 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1538.662950][T17483] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1538.703617][T17483] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1538.754145][ T171] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1538.754615][ T171] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1538.754687][ T171] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1538.754751][ T171] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1539.577448][ T6860] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1539.577471][ T6860] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1541.291167][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 1541.291213][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 1541.392038][T10834] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1541.392062][T10834] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1541.695265][ T30] audit: type=1400 audit(1789919670.530:1795): avc: denied { write } for pid=17790 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1541.844074][T17809] fuse-io-uring is disabled by module parameter [ 1542.143293][ T30] audit: type=1400 audit(1789919670.970:1796): avc: denied { write } for pid=17814 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1543.720228][T17827] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1543.781937][ T30] audit: type=1400 audit(1789919672.610:1797): avc: denied { read write } for pid=17829 comm="syz.5.2560" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1543.815605][ T30] audit: type=1400 audit(1789919672.610:1798): avc: denied { open } for pid=17829 comm="syz.5.2560" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1543.986165][ T30] audit: type=1400 audit(1789919672.820:1799): avc: denied { create } for pid=17829 comm="syz.5.2560" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1543.986893][ T30] audit: type=1400 audit(1789919672.820:1800): avc: denied { connect } for pid=17829 comm="syz.5.2560" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1543.995227][ T30] audit: type=1400 audit(1789919672.830:1801): avc: denied { ioctl } for pid=17829 comm="syz.5.2560" path="socket:[58333]" dev="sockfs" ino=58333 ioctlcmd=0x7459 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1544.454763][T17848] xt_HMARK: spi-set and port-set can't be combined [ 1544.673237][T17836] lo: entered promiscuous mode [ 1545.153644][T17855] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1545.188012][T17855] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1545.188975][T17855] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1545.197098][ T30] audit: type=1400 audit(1789919674.020:1802): avc: denied { write } for pid=17830 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1545.764159][T17836] tunl0: entered promiscuous mode [ 1545.837853][T17836] gre0: entered promiscuous mode [ 1546.123706][T17836] gretap0: entered promiscuous mode [ 1546.142737][T17836] erspan0: entered promiscuous mode [ 1546.538914][T17836] ip_vti0: entered promiscuous mode [ 1546.560984][T17836] ip6_vti0: entered promiscuous mode [ 1546.569374][T17863] FAULT_INJECTION: forcing a failure. [ 1546.569374][T17863] name failslab, interval 1, probability 0, space 0, times 0 [ 1546.569471][T17863] CPU: 1 UID: 0 PID: 17863 Comm: syz.6.2559 Tainted: G L syzkaller #0 PREEMPT(full) [ 1546.569502][T17863] Tainted: [L]=SOFTLOCKUP [ 1546.569510][T17863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1546.569525][T17863] Call Trace: [ 1546.569532][T17863] [ 1546.569540][T17863] dump_stack_lvl+0x100/0x190 [ 1546.569579][T17863] should_fail_ex.cold+0x5/0xa [ 1546.569624][T17863] should_failslab+0xc2/0x120 [ 1546.569655][T17863] __kmalloc_cache_noprof+0x91/0x6d0 [ 1546.569690][T17863] ? alloc_fs_context+0x57/0xf40 [ 1546.569729][T17863] alloc_fs_context+0x57/0xf40 [ 1546.569762][T17863] ? __get_fs_type+0xe3/0x200 [ 1546.569798][T17863] __x64_sys_fsopen+0xed/0x220 [ 1546.569823][T17863] do_syscall_64+0x123/0x790 [ 1546.569859][T17863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1546.569882][T17863] RIP: 0033:0x7f06fa19e159 [ 1546.569902][T17863] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1546.569924][T17863] RSP: 002b:00007f06f83f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1546.569945][T17863] RAX: ffffffffffffffda RBX: 00007f06fa425fa0 RCX: 00007f06fa19e159 [ 1546.569961][T17863] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 1546.569976][T17863] RBP: 00007f06fa23506b R08: 0000000000000000 R09: 0000000000000000 [ 1546.569990][T17863] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1546.570005][T17863] R13: 00007f06fa426038 R14: 00007f06fa425fa0 R15: 00007ffc5cab40d8 [ 1546.570036][T17863] [ 1546.678437][T17836] sit0: entered promiscuous mode [ 1546.688592][T17836] ip6tnl0: entered promiscuous mode [ 1546.693802][T17836] ip6gre0: entered promiscuous mode [ 1546.758100][T17836] syz_tun: entered promiscuous mode [ 1546.871674][T17836] ip6gretap0: entered promiscuous mode [ 1546.884159][T17836] bridge0: port 2(bridge_slave_1) entered disabled state [ 1546.884685][T17836] bridge0: port 1(bridge_slave_0) entered disabled state [ 1546.893503][T17836] bridge0: entered promiscuous mode [ 1546.909605][T17836] vcan0: entered promiscuous mode [ 1546.916913][T17836] bond0: entered promiscuous mode [ 1546.916935][T17836] bond_slave_0: entered promiscuous mode [ 1546.917107][T17836] bond_slave_1: entered promiscuous mode [ 1546.952008][T17836] team0: entered promiscuous mode [ 1546.952033][T17836] team_slave_0: entered promiscuous mode [ 1546.952191][T17836] team_slave_1: entered promiscuous mode [ 1546.964114][T17836] dummy0: entered promiscuous mode [ 1546.989755][T17836] nlmon0: entered promiscuous mode [ 1546.994944][ T30] audit: type=1400 audit(1789919675.820:1803): avc: denied { write } for pid=17864 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1546.998880][T17836] batadv0: entered promiscuous mode [ 1547.093751][T17869] FAULT_INJECTION: forcing a failure. [ 1547.093751][T17869] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1547.093788][T17869] CPU: 0 UID: 0 PID: 17869 Comm: syz.6.2564 Tainted: G L syzkaller #0 PREEMPT(full) [ 1547.093821][T17869] Tainted: [L]=SOFTLOCKUP [ 1547.093830][T17869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1547.093843][T17869] Call Trace: [ 1547.093851][T17869] [ 1547.093860][T17869] dump_stack_lvl+0x100/0x190 [ 1547.093895][T17869] should_fail_ex.cold+0x5/0xa [ 1547.093923][T17869] _copy_from_user+0x2e/0xd0 [ 1547.093946][T17869] copy_msghdr_from_user+0x9f/0x4c0 [ 1547.093979][T17869] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1547.094020][T17869] ? lock_acquire+0x1d1/0x380 [ 1547.094051][T17869] ? get_pid_task+0x2a/0x250 [ 1547.094083][T17869] ___sys_sendmsg+0x106/0x1e0 [ 1547.094106][T17869] ? __pfx____sys_sendmsg+0x10/0x10 [ 1547.094127][T17869] ? get_pid_task+0x106/0x250 [ 1547.094168][T17869] ? find_held_lock+0x2b/0x80 [ 1547.094219][T17869] __sys_sendmsg+0x160/0x210 [ 1547.094264][T17869] ? __pfx___sys_sendmsg+0x10/0x10 [ 1547.094308][T17869] do_syscall_64+0x123/0x790 [ 1547.094344][T17869] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1547.094368][T17869] RIP: 0033:0x7f06fa19e159 [ 1547.094387][T17869] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1547.094409][T17869] RSP: 002b:00007f06f83d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1547.094432][T17869] RAX: ffffffffffffffda RBX: 00007f06fa426090 RCX: 00007f06fa19e159 [ 1547.094447][T17869] RDX: 0000000020004000 RSI: 0000200000000100 RDI: 0000000000000008 [ 1547.094461][T17869] RBP: 00007f06f83d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1547.094476][T17869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1547.094490][T17869] R13: 00007f06fa426128 R14: 00007f06fa426090 R15: 00007ffc5cab40d8 [ 1547.094520][T17869] [ 1547.425143][T17836] vxcan0: entered promiscuous mode [ 1547.661757][T17836] vxcan1: entered promiscuous mode [ 1547.899879][T17836] veth0: entered promiscuous mode [ 1548.025299][T17836] veth1: entered promiscuous mode [ 1548.061839][T17836] wg0: entered promiscuous mode [ 1548.087554][T17836] wg1: entered promiscuous mode [ 1548.101565][T17836] wg2: entered promiscuous mode [ 1548.114534][T17836] veth0_to_bridge: entered promiscuous mode [ 1548.137659][T17836] veth1_to_bridge: entered promiscuous mode [ 1548.167420][T17836] veth0_to_bond: entered promiscuous mode [ 1548.213626][T17836] veth1_to_bond: entered promiscuous mode [ 1548.234191][T17836] veth0_to_team: entered promiscuous mode [ 1548.260697][T17836] veth1_to_team: entered promiscuous mode [ 1548.409303][T17836] veth0_to_batadv: entered promiscuous mode [ 1548.480228][T17836] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1548.480289][T17836] batadv_slave_0: entered promiscuous mode [ 1548.503401][T17836] veth1_to_batadv: entered promiscuous mode [ 1548.515640][T17836] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1548.515695][T17836] batadv_slave_1: entered promiscuous mode [ 1548.522911][T17836] xfrm0: entered promiscuous mode [ 1548.549417][T17836] veth0_to_hsr: entered promiscuous mode [ 1548.564369][T17836] veth1_to_hsr: entered promiscuous mode [ 1548.572568][T17836] hsr0: entered promiscuous mode [ 1548.589030][T17836] veth1_virt_wifi: entered promiscuous mode [ 1548.602386][T17836] veth0_virt_wifi: entered promiscuous mode [ 1548.617429][T17836] virt_wifi0: entered promiscuous mode [ 1548.638022][T17836] vlan0: entered promiscuous mode [ 1548.642086][T17836] vlan1: entered promiscuous mode [ 1548.806658][T17836] macvlan0: entered promiscuous mode [ 1548.813716][T17836] macvlan1: entered promiscuous mode [ 1548.833589][T17836] ipvlan0: entered promiscuous mode [ 1548.833753][T17836] ipvlan1: entered promiscuous mode [ 1548.897318][T17836] macvtap0: entered promiscuous mode [ 1548.903518][T17836] macsec0: entered promiscuous mode [ 1548.920527][T17836] geneve0: entered promiscuous mode [ 1548.934760][T17836] geneve1: entered promiscuous mode [ 1548.952685][T17836] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 1548.972538][T17836] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 1548.978268][T17877] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2567'. [ 1550.464617][ T30] audit: type=1400 audit(1789919679.300:1804): avc: denied { ioctl } for pid=17874 comm="syz.5.2567" path="socket:[58852]" dev="sockfs" ino=58852 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1550.464812][ T30] audit: type=1400 audit(1789919679.300:1805): avc: denied { append } for pid=17876 comm="syz.8.2566" name="cpu_dma_latency" dev="devtmpfs" ino=1312 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pmqos_device_t tclass=chr_file permissive=1 [ 1550.465095][ T30] audit: type=1400 audit(1789919679.300:1806): avc: denied { open } for pid=17876 comm="syz.8.2566" path="/131/dev/cpu_dma_latency" dev="devtmpfs" ino=1312 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pmqos_device_t tclass=chr_file permissive=1 [ 1550.547743][T17836] netdevsim netdevsim3 netdevsim2: entered promiscuous mode [ 1550.670361][T17836] netdevsim netdevsim3 netdevsim3: entered promiscuous mode [ 1550.720141][T17836] mac80211_hwsim hwsim56 wlan0: entered promiscuous mode [ 1550.724163][T14960] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 1550.771585][T17836] mac80211_hwsim hwsim57 wlan1: entered promiscuous mode [ 1550.804737][ T104] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1550.805500][ T104] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1550.805541][ T104] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1550.805577][ T104] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1550.931840][T14960] usb 9-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1550.944060][T14960] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 1550.944128][T14960] usb 9-1: can't read configurations, error -61 [ 1551.074750][T14960] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 1551.230430][T14960] usb 9-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1551.232935][T14960] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 1551.232972][T14960] usb 9-1: can't read configurations, error -61 [ 1551.233352][T14960] usb usb9-port1: attempt power cycle [ 1551.594257][T14960] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 1551.625837][T14960] usb 9-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1551.650053][T14960] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 1551.650095][T14960] usb 9-1: can't read configurations, error -61 [ 1551.810032][T14960] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 1551.850721][T14960] usb 9-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1551.902402][T14960] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 1551.902444][T14960] usb 9-1: can't read configurations, error -61 [ 1551.902896][T14960] usb usb9-port1: unable to enumerate USB device [ 1553.839441][ T30] audit: type=1400 audit(1789919682.620:1807): avc: denied { write } for pid=17887 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1554.372969][ T30] audit: type=1400 audit(1789919683.200:1808): avc: denied { write } for pid=17923 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1554.499013][T10834] bond2: left allmulticast mode [ 1554.499039][T10834] bond2: left promiscuous mode [ 1554.499305][T10834] bridge0: port 4(bond2) entered disabled state [ 1554.531376][T10834] bond1: left allmulticast mode [ 1554.531439][T10834] bond1: left promiscuous mode [ 1554.531679][T10834] bridge0: port 3(bond1) entered disabled state [ 1554.578594][T10834] bridge_slave_1: left allmulticast mode [ 1554.578795][T10834] bridge0: port 2(bridge_slave_1) entered disabled state [ 1554.599687][T10834] bridge_slave_0: left allmulticast mode [ 1554.602677][T10834] bridge0: port 1(bridge_slave_0) entered disabled state [ 1557.335193][T17938] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1557.364046][T17938] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1557.365198][T17938] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1558.894519][T14976] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 1558.973393][T15707] Bluetooth: hci2: unexpected cc 0x2003 length: 8 < 9 [ 1558.985658][ T30] audit: type=1400 audit(1789919687.820:1809): avc: denied { setopt } for pid=17947 comm="syz.5.2581" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1559.509227][T14976] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 1559.526513][T14976] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1559.757824][T10834] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1559.788523][T10834] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1559.798465][T10834] bond0 (unregistering): Released all slaves [ 1559.857654][T10834] bond1 (unregistering): Released all slaves [ 1559.933390][T14976] cdc_acm 3-1:1.0: ttyACM0: USB ACM device [ 1559.979638][ T30] audit: type=1400 audit(1789919688.810:1810): avc: denied { write } for pid=17936 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1560.004927][T10834] bond2 (unregistering): Released all slaves [ 1560.144151][ T30] audit: type=1400 audit(1789919688.970:1811): avc: denied { write } for pid=17959 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1560.463077][T17965] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1560.848312][T10834] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1560.849398][T10834] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1561.680479][ T30] audit: type=1400 audit(1789919690.470:1812): avc: denied { write } for pid=17962 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1562.832160][ T30] audit: type=1400 audit(1789919691.660:1813): avc: denied { write } for pid=17989 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1563.744271][ T52] Bluetooth: hci3: command 0x0406 tx timeout [ 1567.399826][T14973] usb 3-1: USB disconnect, device number 8 [ 1567.732025][T10834] team0 (unregistering): Port device team_slave_1 removed [ 1567.780780][ T30] audit: type=1400 audit(1789919696.610:1814): avc: denied { setopt } for pid=18025 comm="syz.2.2593" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1567.781299][T10834] team0 (unregistering): Port device team_slave_0 removed [ 1567.948781][ T30] audit: type=1326 audit(1789919696.780:1815): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18031 comm="syz.2.2594" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd10919e159 code=0x0 [ 1568.035020][ T30] audit: type=1400 audit(1789919696.870:1816): avc: denied { name_bind } for pid=18031 comm="syz.2.2594" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 1569.582070][ T30] audit: type=1400 audit(1789919698.340:1817): avc: denied { write } for pid=18039 comm="syz.2.2595" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1571.378702][ T30] audit: type=1400 audit(1789919700.210:1818): avc: denied { cmd } for pid=18045 comm="syz.6.2596" path="/dev/ublk-control" dev="devtmpfs" ino=695 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 1571.407608][ T30] audit: type=1400 audit(1789919700.220:1819): avc: denied { map } for pid=18045 comm="syz.6.2596" path="/dev/ublkc2" dev="devtmpfs" ino=4171 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1573.942559][T18064] xt_HMARK: spi-set and port-set can't be combined [ 1583.038893][ T30] audit: type=1400 audit(1789919711.870:1820): avc: denied { write } for pid=18041 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1583.784921][ T30] audit: type=1400 audit(1789919712.610:1821): avc: denied { ioctl } for pid=18110 comm="syz.5.2608" path="socket:[59673]" dev="sockfs" ino=59673 ioctlcmd=0x891c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1584.372131][ T30] audit: type=1400 audit(1789919713.090:1822): avc: denied { create } for pid=18110 comm="syz.5.2608" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 1586.293464][ T30] audit: type=1400 audit(1789919715.080:1823): avc: denied { write } for pid=18125 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1587.072467][T18132] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 1590.088523][T18162] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1590.117495][T18162] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1590.120820][T18162] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1591.550990][ T30] audit: type=1400 audit(1789919720.380:1824): avc: denied { write } for pid=18134 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1592.864039][ T30] audit: type=1400 audit(1789919721.680:1825): avc: denied { write } for pid=18182 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1592.964363][T14957] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 1593.017820][ T30] audit: type=1400 audit(1789919721.850:1826): avc: denied { mounton } for pid=18171 comm="syz.2.2618" path="/proc/240/task" dev="proc" ino=59752 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 1593.124080][T14957] usb 9-1: Using ep0 maxpacket: 16 [ 1593.125001][T14957] usb 9-1: New USB device found, idVendor=0a5c, idProduct=2033, bcdDevice= 3.b3 [ 1593.126327][T14957] usb 9-1: config 1 has an invalid interface number: 193 but max is 0 [ 1593.126354][T14957] usb 9-1: config 1 has no interface number 0 [ 1593.126381][T14957] usb 9-1: config 1 interface 193 has no altsetting 0 [ 1593.128986][T14957] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1593.129013][T14957] usb 9-1: Product: syz [ 1593.129029][T14957] usb 9-1: Manufacturer: syz [ 1593.129044][T14957] usb 9-1: SerialNumber: syz [ 1593.551036][T18177] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1593.568629][T18177] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1593.596108][T18177] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1593.596502][T18177] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1593.710229][T18177] FAULT_INJECTION: forcing a failure. [ 1593.710229][T18177] name failslab, interval 1, probability 0, space 0, times 0 [ 1593.710270][T18177] CPU: 1 UID: 0 PID: 18177 Comm: syz.8.2606 Tainted: G L syzkaller #0 PREEMPT(full) [ 1593.710304][T18177] Tainted: [L]=SOFTLOCKUP [ 1593.710315][T18177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1593.710331][T18177] Call Trace: [ 1593.710340][T18177] [ 1593.710357][T18177] dump_stack_lvl+0x100/0x190 [ 1593.710400][T18177] should_fail_ex.cold+0x5/0xa [ 1593.710434][T18177] should_failslab+0xc2/0x120 [ 1593.710464][T18177] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1593.710492][T18177] ? __proc_create+0xc1/0x8f0 [ 1593.710514][T18177] ? __proc_create+0x247/0x8f0 [ 1593.710541][T18177] __proc_create+0x247/0x8f0 [ 1593.710566][T18177] ? __pfx___proc_create+0x10/0x10 [ 1593.710613][T18177] _proc_mkdir+0xb9/0x210 [ 1593.710637][T18177] ? __pfx__proc_mkdir+0x10/0x10 [ 1593.710660][T18177] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 1593.710690][T18177] ? proc_net_ns_init+0x42/0x420 [ 1593.710720][T18177] proc_net_ns_init+0x273/0x420 [ 1593.710745][T18177] ? __pfx_proc_net_ns_init+0x10/0x10 [ 1593.710767][T18177] ops_init+0x1e2/0x5f0 [ 1593.710801][T18177] setup_net+0x118/0x3a0 [ 1593.710832][T18177] ? __pfx_setup_net+0x10/0x10 [ 1593.710871][T18177] copy_net_ns+0x345/0x7a0 [ 1593.710906][T18177] create_new_namespaces+0x3ea/0xac0 [ 1593.710943][T18177] unshare_nsproxy_namespaces+0xf2/0x220 [ 1593.710973][T18177] ksys_unshare+0x4a2/0xa70 [ 1593.711002][T18177] ? __pfx_ksys_unshare+0x10/0x10 [ 1593.711043][T18177] __x64_sys_unshare+0x31/0x40 [ 1593.711071][T18177] do_syscall_64+0x123/0x790 [ 1593.711109][T18177] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1593.711133][T18177] RIP: 0033:0x7f71c4b9e159 [ 1593.711153][T18177] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1593.711177][T18177] RSP: 002b:00007f71c59b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 1593.711201][T18177] RAX: ffffffffffffffda RBX: 00007f71c4e25fa0 RCX: 00007f71c4b9e159 [ 1593.711216][T18177] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 1593.711230][T18177] RBP: 00007f71c4c3506b R08: 0000000000000000 R09: 0000000000000000 [ 1593.711244][T18177] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1593.711259][T18177] R13: 00007f71c4e26038 R14: 00007f71c4e25fa0 R15: 00007ffd6fa7e0e8 [ 1593.711291][T18177] [ 1593.796947][ T52] Bluetooth: Frame is too long (len 12, expected len 5) [ 1594.920298][T18207] fuse: fd is not a fuse device [ 1594.994813][T14957] usb 9-1: USB disconnect, device number 24 [ 1596.776388][ T6860] IPVS: starting estimator thread 0... [ 1596.960569][T18213] IPVS: using max 36 ests per chain, 86400 per kthread [ 1598.545483][ T30] audit: type=1400 audit(1789919727.380:1827): avc: denied { write } for pid=18187 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1599.213308][ T30] audit: type=1400 audit(1789919728.040:1828): avc: denied { write } for pid=18228 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1600.173198][T15707] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1600.179633][T15707] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1600.187700][T15707] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1600.202631][T15707] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1600.203419][T15707] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1600.566536][T18245] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2629'. [ 1601.986256][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 1601.986314][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 1602.010358][ T5781] libceph: connect (1)[c::]:6789 error -101 [ 1602.042375][ T5781] libceph: mon0 (1)[c::]:6789 connect error [ 1602.163755][T18246] ceph: No mds server is up or the cluster is laggy [ 1602.324496][T15707] Bluetooth: hci1: command tx timeout [ 1602.406814][ T5781] libceph: connect (1)[c::]:6789 error -101 [ 1602.484849][ T5781] libceph: mon0 (1)[c::]:6789 connect error [ 1603.066291][ T5781] libceph: connect (1)[c::]:6789 error -101 [ 1603.068752][ T5781] libceph: mon0 (1)[c::]:6789 connect error [ 1603.918651][ T30] audit: type=1400 audit(1789919732.750:1829): avc: denied { sys_module } for pid=18235 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 1603.919216][ T30] audit: type=1400 audit(1789919732.750:1830): avc: denied { module_request } for pid=18235 comm="syz-executor" kmod="rose0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 1603.927263][ T30] audit: type=1400 audit(1789919732.760:1831): avc: denied { create } for pid=18251 comm="syz.3.2620" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1603.970430][T18252] syzkaller0: entered promiscuous mode [ 1603.970450][T18252] syzkaller0: entered allmulticast mode [ 1603.975937][ T30] audit: type=1400 audit(1789919732.810:1832): avc: denied { write } for pid=18251 comm="syz.3.2620" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1604.059082][ T30] audit: type=1400 audit(1789919732.880:1833): avc: denied { search } for pid=18247 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1604.060110][ T30] audit: type=1400 audit(1789919732.880:1834): avc: denied { search } for pid=18247 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=1770 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1604.060159][ T30] audit: type=1400 audit(1789919732.880:1835): avc: denied { search } for pid=18247 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1604.060201][ T30] audit: type=1400 audit(1789919732.880:1836): avc: denied { search } for pid=18247 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1604.112921][ T30] audit: type=1400 audit(1789919732.950:1837): avc: denied { read } for pid=18254 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1604.112971][ T30] audit: type=1400 audit(1789919732.950:1838): avc: denied { read open } for pid=18254 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1604.386781][T15707] Bluetooth: hci1: command tx timeout [ 1607.545083][T18293] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1607.561660][T14973] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 1607.643475][T18293] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1607.644409][T18293] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1609.115399][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 1609.115412][ T30] audit: type=1400 audit(1789919737.950:1900): avc: denied { unmount } for pid=11125 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 1609.313287][ T30] audit: type=1400 audit(1789919738.100:1901): avc: denied { bind } for pid=18300 comm="syz.3.2639" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1609.338753][ T30] audit: type=1400 audit(1789919738.110:1902): avc: denied { write } for pid=18300 comm="syz.3.2639" path="socket:[59885]" dev="sockfs" ino=59885 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1609.786690][ T30] audit: type=1400 audit(1789919738.620:1903): avc: denied { unmount } for pid=11125 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 1610.203836][ T30] audit: type=1400 audit(1789919739.030:1904): avc: denied { mount } for pid=18307 comm="syz.3.2641" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 1610.231011][ T30] audit: type=1400 audit(1789919739.060:1905): avc: denied { mount } for pid=18308 comm="syz.6.2640" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 1610.266169][ T30] audit: type=1400 audit(1789919739.100:1906): avc: denied { read write } for pid=18307 comm="syz.3.2641" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 1610.266221][ T30] audit: type=1400 audit(1789919739.100:1907): avc: denied { open } for pid=18307 comm="syz.3.2641" path="/23/dev/mapper/control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 1610.301688][ T30] audit: type=1400 audit(1789919739.100:1908): avc: denied { ioctl } for pid=18307 comm="syz.3.2641" path="/23/dev/mapper/control" dev="devtmpfs" ino=1266 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 1610.604882][T14973] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 1610.628040][ T30] audit: type=1400 audit(1789919739.460:1909): avc: denied { unmount } for pid=16993 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 1610.757335][T14973] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 1610.763028][T14973] usb 7-1: config 0 has an invalid interface number: 50 but max is 0 [ 1610.763057][T14973] usb 7-1: config 0 has no interface number 0 [ 1610.763096][T14973] usb 7-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1610.815486][T14973] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1610.815517][T14973] usb 7-1: Product: syz [ 1610.815534][T14973] usb 7-1: Manufacturer: syz [ 1610.815551][T14973] usb 7-1: SerialNumber: syz [ 1610.847917][T14973] usb 7-1: config 0 descriptor?? [ 1610.883667][T14973] yurex 7-1:0.50: USB YUREX device now attached to Yurex #0 [ 1611.348900][T18325] FAULT_INJECTION: forcing a failure. [ 1611.348900][T18325] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1611.348935][T18325] CPU: 1 UID: 0 PID: 18325 Comm: syz.3.2642 Tainted: G L syzkaller #0 PREEMPT(full) [ 1611.348964][T18325] Tainted: [L]=SOFTLOCKUP [ 1611.348972][T18325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1611.348985][T18325] Call Trace: [ 1611.348995][T18325] [ 1611.349004][T18325] dump_stack_lvl+0x100/0x190 [ 1611.349041][T18325] should_fail_ex.cold+0x5/0xa [ 1611.349073][T18325] _copy_from_user+0x2e/0xd0 [ 1611.349099][T18325] __sys_bpf+0x2f5/0x4a30 [ 1611.349129][T18325] ? __pfx___sys_bpf+0x10/0x10 [ 1611.349150][T18325] ? find_held_lock+0x2b/0x80 [ 1611.349180][T18325] ? get_pid_task+0xfc/0x250 [ 1611.349217][T18325] ? get_pid_task+0xfc/0x250 [ 1611.349255][T18325] ? find_held_lock+0x2b/0x80 [ 1611.349290][T18325] ? rcu_read_lock_any_held+0x6a/0x90 [ 1611.349321][T18325] ? find_held_lock+0x2b/0x80 [ 1611.349350][T18325] ? ksys_write+0x190/0x250 [ 1611.349372][T18325] ? ksys_write+0x190/0x250 [ 1611.349394][T18325] ? lock_acquire+0x1d1/0x380 [ 1611.349434][T18325] ? fput+0x7c/0x100 [ 1611.349458][T18325] ? ksys_write+0x1ac/0x250 [ 1611.349486][T18325] ? __x64_sys_bpf+0xce/0x140 [ 1611.349505][T18325] __x64_sys_bpf+0xce/0x140 [ 1611.349528][T18325] ? do_syscall_64+0xae/0x790 [ 1611.349559][T18325] do_syscall_64+0x123/0x790 [ 1611.349588][T18325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1611.349609][T18325] RIP: 0033:0x7f7856f9e159 [ 1611.349628][T18325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1611.349647][T18325] RSP: 002b:00007f7857eaf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1611.349669][T18325] RAX: ffffffffffffffda RBX: 00007f7857226090 RCX: 00007f7856f9e159 [ 1611.349684][T18325] RDX: 0000000000000038 RSI: 00002000000003c0 RDI: 0000000000000018 [ 1611.349698][T18325] RBP: 00007f7857eaf090 R08: 0000000000000000 R09: 0000000000000000 [ 1611.349711][T18325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1611.349723][T18325] R13: 00007f7857226128 R14: 00007f7857226090 R15: 00007ffe50591378 [ 1611.349747][T18325] [ 1611.705370][T11376] usb 7-1: USB disconnect, device number 29 [ 1611.811835][T11376] yurex 7-1:0.50: USB YUREX #0 now disconnected [ 1612.749970][T18235] bridge0: port 1(bridge_slave_0) entered blocking state [ 1612.750062][T18235] bridge0: port 1(bridge_slave_0) entered disabled state [ 1612.750169][T18235] bridge_slave_0: entered allmulticast mode [ 1612.776685][T18235] bridge_slave_0: entered promiscuous mode [ 1612.790953][T18235] bridge0: port 2(bridge_slave_1) entered blocking state [ 1612.792857][T18235] bridge0: port 2(bridge_slave_1) entered disabled state [ 1612.792966][T18235] bridge_slave_1: entered allmulticast mode [ 1612.817453][T18235] bridge_slave_1: entered promiscuous mode [ 1613.087816][T10842] bridge_slave_1: left allmulticast mode [ 1613.088074][T10842] bridge0: port 2(bridge_slave_1) entered disabled state [ 1613.130569][T10842] bridge_slave_0: left allmulticast mode [ 1613.139879][T10842] bridge0: port 1(bridge_slave_0) entered disabled state [ 1613.328634][T18357] FAULT_INJECTION: forcing a failure. [ 1613.328634][T18357] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1613.328670][T18357] CPU: 1 UID: 0 PID: 18357 Comm: syz.5.2638 Tainted: G L syzkaller #0 PREEMPT(full) [ 1613.328701][T18357] Tainted: [L]=SOFTLOCKUP [ 1613.328709][T18357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1613.328722][T18357] Call Trace: [ 1613.328730][T18357] [ 1613.328740][T18357] dump_stack_lvl+0x100/0x190 [ 1613.328776][T18357] should_fail_ex.cold+0x5/0xa [ 1613.328809][T18357] _copy_from_user+0x2e/0xd0 [ 1613.328834][T18357] copy_msghdr_from_user+0x9f/0x4c0 [ 1613.328871][T18357] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1613.328913][T18357] ? lock_acquire+0x1d1/0x380 [ 1613.328937][T18357] ? get_pid_task+0x2a/0x250 [ 1613.328969][T18357] ___sys_sendmsg+0x106/0x1e0 [ 1613.328992][T18357] ? __pfx____sys_sendmsg+0x10/0x10 [ 1613.329014][T18357] ? get_pid_task+0x106/0x250 [ 1613.329065][T18357] ? find_held_lock+0x2b/0x80 [ 1613.329115][T18357] __sys_sendmsg+0x160/0x210 [ 1613.329144][T18357] ? __pfx___sys_sendmsg+0x10/0x10 [ 1613.329189][T18357] do_syscall_64+0x123/0x790 [ 1613.329222][T18357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1613.329244][T18357] RIP: 0033:0x7f4f06d9e159 [ 1613.329262][T18357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1613.329283][T18357] RSP: 002b:00007f4f07c2d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1613.329305][T18357] RAX: ffffffffffffffda RBX: 00007f4f07025fa0 RCX: 00007f4f06d9e159 [ 1613.329326][T18357] RDX: 0000000000000080 RSI: 0000200000000580 RDI: 0000000000000003 [ 1613.329340][T18357] RBP: 00007f4f07c2d090 R08: 0000000000000000 R09: 0000000000000000 [ 1613.329354][T18357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1613.329367][T18357] R13: 00007f4f07026038 R14: 00007f4f07025fa0 R15: 00007ffc6fac1898 [ 1613.329401][T18357] [ 1616.312487][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 1616.312505][ T30] audit: type=1400 audit(1789919745.140:1925): avc: denied { write } for pid=18337 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1616.379335][ T30] audit: type=1400 audit(1789919745.210:1926): avc: denied { read write } for pid=18363 comm="syz.3.2647" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1616.379622][ T30] audit: type=1400 audit(1789919745.210:1927): avc: denied { open } for pid=18363 comm="syz.3.2647" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1616.702392][T18368] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1616.703120][T18368] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1616.703199][T18368] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1616.763093][ T30] audit: type=1400 audit(1789919745.580:1928): avc: denied { block_suspend } for pid=18363 comm="syz.3.2647" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1616.906524][ T30] audit: type=1400 audit(1789919745.730:1929): avc: denied { create } for pid=18363 comm="syz.3.2647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1616.911200][ T30] audit: type=1400 audit(1789919745.740:1930): avc: denied { bind } for pid=18363 comm="syz.3.2647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1616.973977][ T30] audit: type=1400 audit(1789919745.810:1931): avc: denied { write } for pid=18363 comm="syz.3.2647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1616.974028][ T30] audit: type=1400 audit(1789919745.810:1932): avc: denied { read } for pid=18363 comm="syz.3.2647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1617.032920][T10842] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1617.052453][ T30] audit: type=1400 audit(1789919745.880:1933): avc: denied { write } for pid=18372 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1617.052858][T10842] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1617.097238][T10842] bond0 (unregistering): Released all slaves [ 1617.120271][ T30] audit: type=1400 audit(1789919745.950:1934): avc: denied { ioctl } for pid=18363 comm="syz.3.2647" path="socket:[60081]" dev="sockfs" ino=60081 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1617.253363][T18235] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1617.294610][T18369] mac80211_hwsim hwsim56 wlan0: left promiscuous mode [ 1617.298943][T18235] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1618.902785][T18235] team0: Port device team_slave_0 added [ 1619.572540][T18235] team0: Port device team_slave_1 added [ 1621.882489][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 1621.882509][ T30] audit: type=1400 audit(1789919750.710:1945): avc: denied { write } for pid=18391 comm="syz.3.2651" name="spaces" dev="configfs" ino=55084 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1621.882686][ T30] audit: type=1400 audit(1789919750.710:1946): avc: denied { add_name } for pid=18391 comm="syz.3.2651" name="ls1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1621.882924][ T30] audit: type=1400 audit(1789919750.710:1947): avc: denied { create } for pid=18391 comm="syz.3.2651" name="ls1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 1621.971397][ T30] audit: type=1400 audit(1789919750.800:1948): avc: denied { unmount } for pid=16436 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 1622.020339][ T30] audit: type=1400 audit(1789919750.850:1949): avc: denied { write } for pid=18391 comm="syz.3.2651" name="nodes" dev="configfs" ino=60916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1622.068819][ T30] audit: type=1400 audit(1789919750.900:1950): avc: denied { create } for pid=18399 comm="syz.6.2652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1622.094120][T18235] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1622.094135][T18235] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1622.094158][T18235] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1622.095868][T18235] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1622.095880][T18235] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1622.095903][T18235] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1622.101782][ T30] audit: type=1400 audit(1789919750.940:1951): avc: denied { write } for pid=18399 comm="syz.6.2652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1622.232597][ T30] audit: type=1400 audit(1789919751.060:1952): avc: denied { ioctl } for pid=18399 comm="syz.6.2652" path="socket:[60124]" dev="sockfs" ino=60124 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1622.267869][T18401] loop8: detected capacity change from 0 to 7 [ 1622.289126][T18401] Dev loop8: unable to read RDB block 7 [ 1622.289159][T18401] loop8: unable to read partition table [ 1622.289403][T18401] loop8: partition table beyond EOD, truncated [ 1622.289435][T18401] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 1623.458123][ T30] audit: type=1400 audit(1789919751.620:1953): avc: denied { append } for pid=18408 comm="syz.5.2653" name="001" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 1623.767652][T10842] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1623.788369][T10842] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1625.273063][T15707] Bluetooth: hci2: command 0x0406 tx timeout [ 1627.308725][T18432] xt_HMARK: spi-set and port-set can't be combined [ 1627.390801][ T30] audit: type=1400 audit(1789919756.220:1954): avc: denied { unmount } for pid=16436 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1627.440674][ T30] audit: type=1400 audit(1789919756.270:1955): avc: denied { write } for pid=18389 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1627.565244][ T30] audit: type=1400 audit(1789919756.400:1956): avc: denied { write } for pid=18437 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1627.580034][T10842] team0 (unregistering): Port device team_slave_1 removed [ 1627.659843][T10842] team0 (unregistering): Port device team_slave_0 removed [ 1629.646260][T18235] hsr_slave_0: entered promiscuous mode [ 1629.651278][T18235] hsr_slave_1: entered promiscuous mode [ 1629.830445][ T30] audit: type=1400 audit(1789919758.660:1957): avc: denied { write } for pid=18439 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1629.930512][ T30] audit: type=1400 audit(1789919758.760:1958): avc: denied { write } for pid=18456 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1633.561863][ T30] audit: type=1400 audit(1789919762.390:1959): avc: denied { write } for pid=18459 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1633.878042][ T30] audit: type=1400 audit(1789919762.710:1960): avc: denied { setopt } for pid=18477 comm="syz.3.2664" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1633.883102][ T30] audit: type=1400 audit(1789919762.710:1961): avc: denied { create } for pid=18474 comm="syz.6.2663" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1634.189615][T18487] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1634.215038][T18487] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1634.218023][T18487] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1634.502542][ T30] audit: type=1400 audit(1789919763.330:1962): avc: denied { write } for pid=18482 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1634.834208][T14973] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 1635.004069][T14973] usb 6-1: Using ep0 maxpacket: 32 [ 1635.005655][T14973] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1635.086156][T14973] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 1635.086258][T14973] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1635.086282][T14973] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1635.086530][T14973] usb 6-1: config 1 has no interface number 0 [ 1635.086655][T14973] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1635.086761][T14973] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 1635.086802][T14973] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1635.271587][ T30] audit: type=1400 audit(1789919763.560:1963): avc: denied { search } for pid=18492 comm="rm" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1635.271649][ T30] audit: type=1400 audit(1789919763.560:1964): avc: denied { search } for pid=18492 comm="rm" name="dhcpcd" dev="tmpfs" ino=1770 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1635.271724][ T30] audit: type=1400 audit(1789919763.560:1965): avc: denied { search } for pid=18492 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1635.271767][ T30] audit: type=1400 audit(1789919763.570:1966): avc: denied { prog_load } for pid=18474 comm="syz.6.2663" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1635.271806][ T30] audit: type=1400 audit(1789919763.570:1967): avc: denied { bpf } for pid=18474 comm="syz.6.2663" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1635.271880][ T30] audit: type=1400 audit(1789919763.570:1968): avc: denied { perfmon } for pid=18474 comm="syz.6.2663" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1635.512450][T14973] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 1635.527789][T14973] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now attached [ 1635.529257][T18475] FAULT_INJECTION: forcing a failure. [ 1635.529257][T18475] name failslab, interval 1, probability 0, space 0, times 0 [ 1635.529293][T18475] CPU: 0 UID: 0 PID: 18475 Comm: syz.6.2663 Tainted: G L syzkaller #0 PREEMPT(full) [ 1635.529323][T18475] Tainted: [L]=SOFTLOCKUP [ 1635.529333][T18475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1635.529346][T18475] Call Trace: [ 1635.529353][T18475] [ 1635.529366][T18475] dump_stack_lvl+0x100/0x190 [ 1635.529406][T18475] should_fail_ex.cold+0x5/0xa [ 1635.529438][T18475] should_failslab+0xc2/0x120 [ 1635.529466][T18475] __kmalloc_cache_noprof+0x91/0x6d0 [ 1635.529500][T18475] ? tcf_block_get_ext+0x94d/0x1950 [ 1635.529530][T18475] tcf_block_get_ext+0x94d/0x1950 [ 1635.529563][T18475] clsact_init+0x45d/0xda0 [ 1635.529602][T18475] ? __pfx_clsact_init+0x10/0x10 [ 1635.529632][T18475] qdisc_create+0x47b/0x1060 [ 1635.529666][T18475] tc_modify_qdisc+0x1350/0x2120 [ 1635.529703][T18475] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1635.529760][T18475] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1635.529790][T18475] rtnetlink_rcv_msg+0x3c9/0xe90 [ 1635.529825][T18475] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1635.529861][T18475] ? __lock_acquire+0x5c0/0x1f40 [ 1635.529888][T18475] ? __netlink_lookup+0xa9/0x900 [ 1635.529916][T18475] netlink_rcv_skb+0x159/0x420 [ 1635.529943][T18475] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1635.529977][T18475] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1635.530016][T18475] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1635.530048][T18475] netlink_unicast+0x585/0x850 [ 1635.530078][T18475] ? __pfx_netlink_unicast+0x10/0x10 [ 1635.530114][T18475] netlink_sendmsg+0x8b0/0xda0 [ 1635.530147][T18475] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1635.530177][T18475] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1635.530209][T18475] ____sys_sendmsg+0xa4d/0xbe0 [ 1635.530242][T18475] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1635.530272][T18475] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1635.530322][T18475] ___sys_sendmsg+0x190/0x1e0 [ 1635.530347][T18475] ? __pfx____sys_sendmsg+0x10/0x10 [ 1635.530370][T18475] ? futex_wait+0x11e/0x370 [ 1635.530405][T18475] ? find_held_lock+0x2b/0x80 [ 1635.530458][T18475] __sys_sendmsg+0x160/0x210 [ 1635.530488][T18475] ? __pfx___sys_sendmsg+0x10/0x10 [ 1635.530536][T18475] do_syscall_64+0x123/0x790 [ 1635.530580][T18475] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1635.530606][T18475] RIP: 0033:0x7f06fa19e159 [ 1635.530627][T18475] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1635.530649][T18475] RSP: 002b:00007f06f83f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1635.530673][T18475] RAX: ffffffffffffffda RBX: 00007f06fa425fa0 RCX: 00007f06fa19e159 [ 1635.530689][T18475] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 1635.530703][T18475] RBP: 00007f06fa23506b R08: 0000000000000000 R09: 0000000000000000 [ 1635.530717][T18475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1635.530731][T18475] R13: 00007f06fa426038 R14: 00007f06fa425fa0 R15: 00007ffc5cab40d8 [ 1635.530765][T18475] [ 1635.607717][T18480] bridge0: port 3(syz_tun) entered blocking state [ 1635.607841][T18480] bridge0: port 3(syz_tun) entered disabled state [ 1635.608014][T18480] syz_tun: entered allmulticast mode [ 1635.619506][T18480] syz_tun: entered promiscuous mode [ 1635.620253][T18480] bridge0: port 3(syz_tun) entered blocking state [ 1635.620388][T18480] bridge0: port 3(syz_tun) entered forwarding state [ 1636.761579][T14977] snd_usb_pod 6-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 1636.921870][T18480] bridge0: port 3(syz_tun) entered disabled state [ 1637.043732][T18480] syz_tun (unregistering): left allmulticast mode [ 1637.043760][T18480] syz_tun (unregistering): left promiscuous mode [ 1637.043857][T18480] bridge0: port 3(syz_tun) entered disabled state [ 1637.268283][T14973] usb 6-1: USB disconnect, device number 57 [ 1637.269429][T14973] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 1637.660225][T18512] lo: entered promiscuous mode [ 1637.713145][T18504] fuse: Bad value for 'fd' [ 1638.105993][T18523] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 1638.279964][T18512] tunl0: entered promiscuous mode [ 1638.291937][T18512] gre0: entered promiscuous mode [ 1639.026412][T18512] gretap0: entered promiscuous mode [ 1639.050844][T18512] erspan0: entered promiscuous mode [ 1639.090407][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 1639.090424][ T30] audit: type=1400 audit(1789919767.920:2005): avc: denied { create } for pid=18527 comm="syz.3.2670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1639.092578][ T30] audit: type=1400 audit(1789919767.920:2006): avc: denied { bind } for pid=18527 comm="syz.3.2670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1639.093243][ T30] audit: type=1400 audit(1789919767.920:2007): avc: denied { write } for pid=18527 comm="syz.3.2670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1639.099282][T18512] ip_vti0: entered promiscuous mode [ 1639.116275][T18512] ip6_vti0: entered promiscuous mode [ 1639.129672][T18512] sit0: entered promiscuous mode [ 1639.167907][ T30] audit: type=1400 audit(1789919768.000:2008): avc: denied { unmount } for pid=11125 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 1639.175249][T18512] ip6tnl0: entered promiscuous mode [ 1639.177594][T18512] ip6gre0: entered promiscuous mode [ 1639.227918][T18512] syz_tun: entered promiscuous mode [ 1639.443549][ T30] audit: type=1400 audit(1789919768.270:2009): avc: denied { mounton } for pid=18530 comm="syz.5.2669" path="/27/file1/file0" dev="tmpfs" ino=174 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1639.602489][T18542] xt_HMARK: spi-set and port-set can't be combined [ 1639.700242][ T30] audit: type=1400 audit(1789919768.320:2010): avc: denied { mount } for pid=18527 comm="syz.3.2670" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 1639.700623][ T30] audit: type=1400 audit(1789919768.320:2011): avc: denied { search } for pid=18527 comm="syz.3.2670" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1639.700943][ T30] audit: type=1400 audit(1789919768.320:2012): avc: denied { search } for pid=18527 comm="syz.3.2670" name="events" dev="tracefs" ino=1591 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1639.701407][ T30] audit: type=1400 audit(1789919768.320:2013): avc: denied { search } for pid=18527 comm="syz.3.2670" name="sched" dev="tracefs" ino=42454 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1639.701940][ T30] audit: type=1400 audit(1789919768.330:2015): avc: denied { write } for pid=18527 comm="syz.3.2670" name="filter" dev="tracefs" ino=19680823 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 1641.037757][T18512] ip6gretap0: entered promiscuous mode [ 1642.210748][T18512] bridge0: port 2(bridge_slave_1) entered disabled state [ 1642.211329][T18512] bridge0: port 1(bridge_slave_0) entered disabled state [ 1642.307928][T18512] bridge0: entered promiscuous mode [ 1642.329205][T18512] vcan0: entered promiscuous mode [ 1642.368698][T18512] bond0: entered promiscuous mode [ 1642.368719][T18512] bond_slave_0: entered promiscuous mode [ 1642.368890][T18512] bond_slave_1: entered promiscuous mode [ 1642.401616][T18512] team0: entered promiscuous mode [ 1642.401635][T18512] team_slave_0: entered promiscuous mode [ 1642.421055][T18550] FAULT_INJECTION: forcing a failure. [ 1642.421055][T18550] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1642.421086][T18550] CPU: 1 UID: 0 PID: 18550 Comm: syz.6.2671 Tainted: G L syzkaller #0 PREEMPT(full) [ 1642.421117][T18550] Tainted: [L]=SOFTLOCKUP [ 1642.421126][T18550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1642.421139][T18550] Call Trace: [ 1642.421147][T18550] [ 1642.421156][T18550] dump_stack_lvl+0x100/0x190 [ 1642.421192][T18550] should_fail_ex.cold+0x5/0xa [ 1642.421225][T18550] _copy_to_user+0x32/0xd0 [ 1642.421252][T18550] simple_read_from_buffer+0xcb/0x170 [ 1642.421283][T18550] proc_fail_nth_read+0x1af/0x230 [ 1642.421313][T18550] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1642.421346][T18550] ? rw_verify_area+0xce/0x6d0 [ 1642.421379][T18550] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1642.421407][T18550] vfs_read+0x1e4/0xb40 [ 1642.421430][T18550] ? lock_acquire+0x1d1/0x380 [ 1642.421452][T18550] ? __fget_files+0x34/0x3d0 [ 1642.421479][T18550] ? __pfx_vfs_read+0x10/0x10 [ 1642.421499][T18550] ? find_held_lock+0x2b/0x80 [ 1642.421529][T18550] ? __fget_files+0x215/0x3d0 [ 1642.421569][T18550] ? __fget_files+0x21f/0x3d0 [ 1642.421605][T18550] ksys_read+0x12a/0x250 [ 1642.421628][T18550] ? __pfx_ksys_read+0x10/0x10 [ 1642.421660][T18550] do_syscall_64+0x123/0x790 [ 1642.421694][T18550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1642.421717][T18550] RIP: 0033:0x7f06fa15e98e [ 1642.421735][T18550] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1642.421757][T18550] RSP: 002b:00007f06f83d4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1642.421780][T18550] RAX: ffffffffffffffda RBX: 00007f06f83d56c0 RCX: 00007f06fa15e98e [ 1642.421795][T18550] RDX: 000000000000000f RSI: 00007f06f83d50a0 RDI: 0000000000000003 [ 1642.421810][T18550] RBP: 00007f06f83d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1642.421825][T18550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1642.421838][T18550] R13: 00007f06fa426128 R14: 00007f06fa426090 R15: 00007ffc5cab40d8 [ 1642.421870][T18550] [ 1642.429515][T18512] team_slave_1: entered promiscuous mode [ 1642.464665][T18512] dummy0: entered promiscuous mode [ 1642.606967][T18512] nlmon0: entered promiscuous mode [ 1642.608287][T18512] batadv0: entered promiscuous mode [ 1642.646156][T18512] vxcan0: entered promiscuous mode [ 1642.646866][T18512] vxcan1: entered promiscuous mode [ 1642.669211][T18512] veth0: entered promiscuous mode [ 1642.702715][T18512] veth1: entered promiscuous mode [ 1642.746896][T18512] wg0: entered promiscuous mode [ 1642.776099][T18512] wg1: entered promiscuous mode [ 1642.802968][T18512] wg2: entered promiscuous mode [ 1642.807376][T18512] veth0_to_bridge: entered promiscuous mode [ 1644.163154][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 1644.163174][ T30] audit: type=1400 audit(1789919771.850:2025): avc: denied { watch watch_reads } for pid=18553 comm="syz.6.2674" path="/293" dev="tmpfs" ino=1722 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1644.163225][ T30] audit: type=1400 audit(1789919771.920:2026): avc: denied { setattr } for pid=18553 comm="syz.6.2674" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 1644.221752][T18512] veth1_to_bridge: entered promiscuous mode [ 1644.299406][T18512] veth0_to_bond: entered promiscuous mode [ 1644.321171][T18512] veth1_to_bond: entered promiscuous mode [ 1644.332841][ T30] audit: type=1400 audit(1789919773.160:2027): avc: denied { read } for pid=18555 comm="syz.3.2673" dev="nsfs" ino=4026532796 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1644.333092][ T30] audit: type=1400 audit(1789919773.160:2028): avc: denied { open } for pid=18555 comm="syz.3.2673" path="net:[4026532796]" dev="nsfs" ino=4026532796 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1644.333502][ T30] audit: type=1400 audit(1789919773.160:2029): avc: denied { create } for pid=18555 comm="syz.3.2673" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1644.346857][T18512] veth0_to_team: entered promiscuous mode [ 1644.357269][T18512] veth1_to_team: entered promiscuous mode [ 1644.372147][T18512] veth0_to_batadv: entered promiscuous mode [ 1644.380921][T18512] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1644.380964][T18512] batadv_slave_0: entered promiscuous mode [ 1644.399921][T18512] veth1_to_batadv: entered promiscuous mode [ 1644.415684][ T30] audit: type=1400 audit(1789919773.220:2030): avc: denied { name_bind } for pid=18555 comm="syz.3.2673" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 1644.415732][ T30] audit: type=1400 audit(1789919773.220:2031): avc: denied { node_bind } for pid=18555 comm="syz.3.2673" saddr=fe80::aa src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 1644.415775][ T30] audit: type=1400 audit(1789919773.220:2032): avc: denied { read write } for pid=18555 comm="syz.3.2673" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 1644.415818][ T30] audit: type=1400 audit(1789919773.220:2033): avc: denied { open } for pid=18555 comm="syz.3.2673" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 1644.415862][ T30] audit: type=1400 audit(1789919773.220:2034): avc: denied { create } for pid=18555 comm="syz.3.2673" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1644.416006][T18512] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1644.416047][T18512] batadv_slave_1: entered promiscuous mode [ 1644.431500][T18512] xfrm0: entered promiscuous mode [ 1644.442754][T18512] veth0_to_hsr: entered promiscuous mode [ 1644.458959][T18512] veth1_to_hsr: entered promiscuous mode [ 1644.486206][T18512] hsr0: entered promiscuous mode [ 1644.498479][T18512] veth1_virt_wifi: entered promiscuous mode [ 1644.508862][T18512] veth0_virt_wifi: entered promiscuous mode [ 1644.512582][T18560] FAULT_INJECTION: forcing a failure. [ 1644.512582][T18560] name failslab, interval 1, probability 0, space 0, times 0 [ 1644.512613][T18560] CPU: 1 UID: 0 PID: 18560 Comm: syz.3.2673 Tainted: G L syzkaller #0 PREEMPT(full) [ 1644.512644][T18560] Tainted: [L]=SOFTLOCKUP [ 1644.512653][T18560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1644.512666][T18560] Call Trace: [ 1644.512674][T18560] [ 1644.512683][T18560] dump_stack_lvl+0x100/0x190 [ 1644.512720][T18560] should_fail_ex.cold+0x5/0xa [ 1644.512752][T18560] should_failslab+0xc2/0x120 [ 1644.512783][T18560] __kmalloc_cache_noprof+0x91/0x6d0 [ 1644.512817][T18560] ? kobject_uevent_env+0x263/0x18b0 [ 1644.512853][T18560] kobject_uevent_env+0x263/0x18b0 [ 1644.512887][T18560] ? rcu_is_watching+0x13/0xc0 [ 1644.512921][T18560] gadget_bind_driver+0x773/0xbf0 [ 1644.512948][T18560] ? urbs_show+0x3c1/0x440 [ 1644.512981][T18560] ? __pfx_gadget_bind_driver+0x10/0x10 [ 1644.513007][T18560] really_probe+0x241/0xa60 [ 1644.513038][T18560] __driver_probe_device+0x210/0x460 [ 1644.513064][T18560] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1644.513097][T18560] driver_probe_device+0x4a/0x140 [ 1644.513124][T18560] __driver_attach+0x21f/0x5b0 [ 1644.513152][T18560] ? __pfx___driver_attach+0x10/0x10 [ 1644.513177][T18560] bus_for_each_dev+0x13e/0x1d0 [ 1644.513212][T18560] ? __pfx_bus_for_each_dev+0x10/0x10 [ 1644.513244][T18560] ? bus_add_driver+0x2b5/0x5b0 [ 1644.513275][T18560] bus_add_driver+0x305/0x5b0 [ 1644.513301][T18560] driver_register+0x1e2/0x360 [ 1644.513329][T18560] ? rcu_is_watching+0x13/0xc0 [ 1644.513360][T18560] usb_gadget_register_driver_owner+0x132/0x210 [ 1644.513395][T18560] raw_ioctl+0x1a85/0x2b80 [ 1644.513426][T18560] ? __pfx_raw_ioctl+0x10/0x10 [ 1644.513447][T18560] ? selinux_file_ioctl+0x13b/0x290 [ 1644.513473][T18560] ? selinux_file_ioctl+0xb6/0x290 [ 1644.513501][T18560] ? __pfx_raw_ioctl+0x10/0x10 [ 1644.513524][T18560] __x64_sys_ioctl+0x18e/0x210 [ 1644.513550][T18560] do_syscall_64+0x123/0x790 [ 1644.513586][T18560] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1644.513610][T18560] RIP: 0033:0x7f7856f9ddeb [ 1644.513628][T18560] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 1644.513650][T18560] RSP: 002b:00007f7857eacf00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1644.513674][T18560] RAX: ffffffffffffffda RBX: 000000000000000e RCX: 00007f7856f9ddeb [ 1644.513689][T18560] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 000000000000000e [ 1644.513704][T18560] RBP: 00007f7857eadfd0 R08: 0000000000000001 R09: 00000000ffffffff [ 1644.513719][T18560] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1644.513734][T18560] R13: 00002000000000c0 R14: 0000000000000003 R15: 0000000000000000 [ 1644.513765][T18560] [ 1644.526016][T18512] virt_wifi0: entered promiscuous mode [ 1644.568901][T18512] vlan0: entered promiscuous mode [ 1644.584848][T18512] vlan1: entered promiscuous mode [ 1644.627888][T18512] macvlan0: entered promiscuous mode [ 1644.764068][T14973] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 1644.795604][T18512] macvlan1: entered promiscuous mode [ 1644.806034][T18512] ipvlan0: entered promiscuous mode [ 1644.806174][T18512] ipvlan1: entered promiscuous mode [ 1644.867268][T18512] macvtap0: entered promiscuous mode [ 1644.873137][T18512] macsec0: entered promiscuous mode [ 1644.883176][T18512] geneve0: entered promiscuous mode [ 1644.894961][T18512] geneve1: entered promiscuous mode [ 1644.920592][T18512] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1644.935575][T14973] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1644.938293][T14973] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1644.938328][T14973] usb 4-1: Product: syz [ 1644.938350][T14973] usb 4-1: Manufacturer: syz [ 1644.938366][T14973] usb 4-1: SerialNumber: syz [ 1644.978678][T18512] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 1645.041687][T18512] netdevsim netdevsim2 netdevsim2: entered promiscuous mode [ 1645.059676][T18512] netdevsim netdevsim2 netdevsim3: entered promiscuous mode [ 1645.091252][T18512] mac80211_hwsim hwsim54 wlan0: entered promiscuous mode [ 1645.132085][T14976] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1645.155644][T18512] mac80211_hwsim hwsim55 wlan1: entered promiscuous mode [ 1645.184586][ T6505] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1645.184693][ T6505] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1645.184730][ T6505] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1645.184765][ T6505] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1646.225848][T14976] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1646.312844][T14976] ath9k_htc: Failed to initialize the device [ 1646.687008][T14976] usb 4-1: ath9k_htc: USB layer deinitialized [ 1647.506528][T18235] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1647.936541][ T5789] usb 4-1: USB disconnect, device number 49 [ 1648.336018][T18235] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1648.358302][T18570] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1648.518625][T18570] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1648.519858][T18570] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1648.661402][T18235] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1649.761808][T18235] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1649.855859][T18235] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1649.938210][T18235] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1649.960388][T18235] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1650.022961][T18235] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1650.861707][T18589] fuse: Bad value for 'fd' [ 1651.871902][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 1651.871914][ T30] audit: type=1400 audit(1789919779.250:2052): avc: denied { append } for pid=18576 comm="syz.5.2678" name="001" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 1652.096201][T18235] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1652.122701][T18235] 8021q: adding VLAN 0 to HW filter on device team0 [ 1652.148131][ T104] bridge0: port 1(bridge_slave_0) entered blocking state [ 1652.148239][ T104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1652.183382][ T104] bridge0: port 2(bridge_slave_1) entered blocking state [ 1652.183485][ T104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1652.938524][ T30] audit: type=1400 audit(1789919781.770:2053): avc: denied { write } for pid=18592 comm="syz.6.2682" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1652.938578][ T30] audit: type=1400 audit(1789919781.770:2054): avc: denied { name_connect } for pid=18592 comm="syz.6.2682" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 1653.053430][ T30] audit: type=1400 audit(1789919781.880:2055): avc: denied { shutdown } for pid=18592 comm="syz.6.2682" lport=35289 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1653.102858][ T30] audit: type=1400 audit(1789919781.930:2056): avc: denied { read } for pid=18592 comm="syz.6.2682" lport=35289 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1653.316714][ T30] audit: type=1400 audit(1789919782.150:2057): avc: denied { allowed } for pid=18592 comm="syz.6.2682" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1653.316767][ T30] audit: type=1400 audit(1789919782.150:2058): avc: denied { create } for pid=18592 comm="syz.6.2682" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1653.316812][ T30] audit: type=1400 audit(1789919782.150:2059): avc: denied { map } for pid=18592 comm="syz.6.2682" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=61497 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1653.404028][ T30] audit: type=1400 audit(1789919782.230:2060): avc: denied { read write } for pid=18592 comm="syz.6.2682" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=61497 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1653.445985][ T30] audit: type=1400 audit(1789919782.280:2061): avc: denied { create } for pid=18592 comm="syz.6.2682" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1656.035335][ T985] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 1656.164492][ T985] usb 6-1: device descriptor read/64, error -71 [ 1656.404031][ T985] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 1656.497809][T18235] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1656.536029][ T985] usb 6-1: device descriptor read/64, error -71 [ 1656.651145][ T985] usb usb6-port1: attempt power cycle [ 1656.666526][T18235] veth0_vlan: entered promiscuous mode [ 1656.682684][T18235] veth1_vlan: entered promiscuous mode [ 1656.723069][T18235] veth0_macvtap: entered promiscuous mode [ 1656.749862][T18235] veth1_macvtap: entered promiscuous mode [ 1656.768888][T18235] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1656.783863][T18235] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1656.790609][T10840] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1656.807596][T10840] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1656.807672][T10840] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1656.807710][T10840] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1657.133095][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 1657.133109][ T30] audit: type=1400 audit(1789919785.940:2069): avc: denied { append } for pid=18641 comm="syz.2.2686" name="comedi3" dev="devtmpfs" ino=1276 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1658.300227][T18647] block nbd2: not configured, cannot reconfigure [ 1660.381456][ T30] audit: type=1400 audit(1789919789.210:2070): avc: denied { setopt } for pid=18655 comm="syz.3.2680" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1660.707663][ T30] audit: type=1400 audit(1789919789.540:2071): avc: denied { write } for pid=18637 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1660.737857][T18667] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2685'. [ 1661.051177][T18671] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1661.084367][T18671] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1661.086407][T18671] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1662.422990][ T30] audit: type=1400 audit(1789919791.250:2072): avc: denied { read write } for pid=18673 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1662.423372][ T30] audit: type=1400 audit(1789919791.250:2073): avc: denied { open } for pid=18673 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1662.550852][ T30] audit: type=1400 audit(1789919791.380:2074): avc: denied { write } for pid=18674 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1662.577317][ T5598] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1662.594405][ T5598] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1662.603466][ T5598] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1662.624877][ T5598] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1662.630929][ T5598] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1662.640602][ T30] audit: type=1400 audit(1789919791.480:2075): avc: denied { mounton } for pid=18673 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 1664.276974][ T30] audit: type=1400 audit(1789919792.590:2076): avc: denied { write } for pid=18676 comm="syz.6.2692" name="001" dev="devtmpfs" ino=741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 1664.308066][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 1664.308116][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 1664.645132][ T30] audit: type=1400 audit(1789919793.480:2077): avc: denied { cmd } for pid=18683 comm="syz.2.2693" path="/dev/cuse" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=io_uring permissive=1 [ 1664.647524][T18684] fuse-io-uring is disabled by module parameter [ 1664.705049][ T5598] Bluetooth: hci5: command tx timeout [ 1665.131677][ T6860] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1667.050195][ T30] audit: type=1400 audit(1789919795.060:2078): avc: denied { mount } for pid=18708 comm="syz.6.2694" name="/" dev="ramfs" ino=61424 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 1667.050256][ T30] audit: type=1400 audit(1789919795.290:2079): avc: denied { mount } for pid=18708 comm="syz.6.2694" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 1667.050351][ T5598] Bluetooth: hci5: command tx timeout [ 1667.152383][ T30] audit: type=1400 audit(1789919795.980:2080): avc: denied { unmount } for pid=11125 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 1667.359993][ T30] audit: type=1400 audit(1789919796.190:2081): avc: denied { write } for pid=18686 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1667.432117][ T6860] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1667.588177][ T6860] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1668.240390][T18723] fuse: Bad value for 'fd' [ 1669.122233][ T5598] Bluetooth: hci5: command tx timeout [ 1669.233438][ T6860] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1669.265724][ T30] audit: type=1400 audit(1789919798.100:2082): avc: denied { write } for pid=18721 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1669.464140][ T30] audit: type=1400 audit(1789919798.290:2083): avc: denied { mount } for pid=18728 comm="syz.3.2700" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 1669.467169][ T30] audit: type=1400 audit(1789919798.300:2084): avc: denied { mount } for pid=18728 comm="syz.3.2700" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1669.550349][ T30] audit: type=1400 audit(1789919798.380:2085): avc: denied { unmount } for pid=16993 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1669.595698][ T30] audit: type=1400 audit(1789919798.430:2086): avc: denied { unmount } for pid=16993 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 1669.703510][T18673] bridge0: port 1(bridge_slave_0) entered blocking state [ 1669.703738][T18673] bridge0: port 1(bridge_slave_0) entered disabled state [ 1669.703851][T18673] bridge_slave_0: entered allmulticast mode [ 1669.716110][T18673] bridge_slave_0: entered promiscuous mode [ 1669.729091][T18673] bridge0: port 2(bridge_slave_1) entered blocking state [ 1669.740651][T18673] bridge0: port 2(bridge_slave_1) entered disabled state [ 1669.740767][T18673] bridge_slave_1: entered allmulticast mode [ 1669.741921][T18673] bridge_slave_1: entered promiscuous mode [ 1669.876033][T18673] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1669.894075][T18673] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1670.270451][T18673] team0: Port device team_slave_0 added [ 1670.339963][T18673] team0: Port device team_slave_1 added [ 1670.365078][ T30] audit: type=1400 audit(1789919799.200:2087): avc: denied { write } for pid=18734 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1670.606860][ T6860] bridge_slave_1: left allmulticast mode [ 1670.606886][ T6860] bridge_slave_1: left promiscuous mode [ 1670.607105][ T6860] bridge0: port 2(bridge_slave_1) entered disabled state [ 1670.643407][ T6860] bridge_slave_0: left allmulticast mode [ 1670.643430][ T6860] bridge_slave_0: left promiscuous mode [ 1670.643647][ T6860] bridge0: port 1(bridge_slave_0) entered disabled state [ 1670.739869][ T30] audit: type=1400 audit(1789919799.570:2088): avc: denied { write } for pid=18747 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1671.185645][ T52] Bluetooth: hci5: command tx timeout [ 1671.550490][ T30] audit: type=1400 audit(1789919800.380:2089): avc: denied { read write } for pid=18767 comm="syz.5.2698" name="nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1671.582529][ T30] audit: type=1400 audit(1789919800.380:2090): avc: denied { open } for pid=18767 comm="syz.5.2698" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1671.582615][ T30] audit: type=1400 audit(1789919800.390:2091): avc: denied { write } for pid=18753 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1671.649336][ T6860] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1671.652190][ T6860] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1671.677872][ T6860] bond0 (unregistering): Released all slaves [ 1671.717233][T18673] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1671.717254][T18673] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1671.717280][T18673] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1671.828106][T18673] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1671.828122][T18673] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1671.828148][T18673] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1672.026176][T18673] hsr_slave_0: entered promiscuous mode [ 1672.030770][T18673] hsr_slave_1: entered promiscuous mode [ 1672.031671][T18673] debugfs: 'hsr0' already exists in 'hsr' [ 1672.031691][T18673] Cannot create hsr debugfs directory [ 1672.442829][T18782] openvswitch: netlink: VXLAN extension 1 has unexpected len 0 expected 4 [ 1672.628490][ T6860] hsr_slave_0: left promiscuous mode [ 1672.640613][ T6860] hsr_slave_1: left promiscuous mode [ 1672.646020][ T6860] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1672.646039][ T6860] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1672.653404][ T6860] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1672.653421][ T6860] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1672.697030][ T6860] veth1_macvtap: left promiscuous mode [ 1672.697064][ T6860] veth0_macvtap: left promiscuous mode [ 1672.697158][ T6860] veth1_vlan: left promiscuous mode [ 1672.697226][ T6860] veth0_vlan: left promiscuous mode [ 1674.167547][T18825] fuse-io-uring is disabled by module parameter [ 1675.064918][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 1675.065010][ T30] audit: type=1400 audit(1789919803.890:2109): avc: denied { mmap_zero } for pid=18824 comm="syz.3.2707" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 1675.226371][ T30] audit: type=1400 audit(1789919804.020:2110): avc: denied { getopt } for pid=18824 comm="syz.3.2707" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1675.226691][ T30] audit: type=1400 audit(1789919804.030:2111): avc: denied { create } for pid=18824 comm="syz.3.2707" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1675.226977][ T30] audit: type=1400 audit(1789919804.050:2112): avc: denied { write } for pid=18824 comm="syz.3.2707" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1675.228310][T18826] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2707'. [ 1676.234209][ T30] audit: type=1400 audit(1789919805.040:2113): avc: denied { ioctl } for pid=18824 comm="syz.3.2707" path="socket:[62607]" dev="sockfs" ino=62607 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1676.494445][T18830] netlink: 'syz.3.2707': attribute type 101 has an invalid length. [ 1677.796801][ T30] audit: type=1400 audit(1789919806.630:2114): avc: denied { write } for pid=18778 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1678.051166][ T6860] team0 (unregistering): Port device team_slave_1 removed [ 1678.089151][ T6860] team0 (unregistering): Port device team_slave_0 removed [ 1678.229406][ T30] audit: type=1400 audit(1789919807.060:2115): avc: denied { write } for pid=18837 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1680.497761][ T30] audit: type=1400 audit(1789919809.330:2116): avc: denied { read } for pid=18853 comm="syz.5.2712" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1680.497815][ T30] audit: type=1400 audit(1789919809.330:2117): avc: denied { open } for pid=18853 comm="syz.5.2712" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1680.584623][T18863] db_root: cannot open: IMIX '0000000000000000 [ 1682.661899][ T5789] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 1682.879756][ T5789] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0014, bcdDevice= 0.40 [ 1682.934200][ T5789] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1682.934369][ T5789] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1683.059477][ T5789] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1683.059633][ T5789] usb 6-1: Product: syz [ 1683.059784][ T5789] usb 6-1: Manufacturer: syz [ 1683.059944][ T5789] usb 6-1: SerialNumber: syz [ 1683.528476][ T5789] usb 6-1: can't set config #1, error -71 [ 1683.563665][ T5789] usb 6-1: USB disconnect, device number 61 [ 1683.640790][T18866] mac80211_hwsim hwsim56 wlan0: entered promiscuous mode [ 1685.227768][ T30] audit: type=1400 audit(1789919814.060:2118): avc: denied { write } for pid=18846 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1685.353756][ T30] audit: type=1400 audit(1789919814.180:2119): avc: denied { create } for pid=18881 comm="syz.3.2717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1685.387844][ T30] audit: type=1400 audit(1789919814.220:2120): avc: denied { bind } for pid=18881 comm="syz.3.2717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1685.390130][ T30] audit: type=1400 audit(1789919814.220:2121): avc: denied { setopt } for pid=18881 comm="syz.3.2717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1686.178051][ T30] audit: type=1400 audit(1789919815.010:2122): avc: denied { accept } for pid=18881 comm="syz.3.2717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1686.308074][T18878] ima: policy update failed [ 1686.312413][ T30] audit: type=1802 audit(1789919815.140:2123): pid=18878 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=failed comm="syz.5.2716" res=0 errno=0 [ 1686.406769][ T30] audit: type=1400 audit(1789919815.240:2124): avc: denied { write } for pid=18883 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1686.579269][ T30] audit: type=1400 audit(1789919815.290:2125): avc: denied { write } for pid=18881 comm="syz.3.2717" name="instances" dev="tracefs" ino=1658 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1686.579321][ T30] audit: type=1400 audit(1789919815.290:2126): avc: denied { add_name } for pid=18881 comm="syz.3.2717" name="foo" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1686.579363][ T30] audit: type=1400 audit(1789919815.290:2127): avc: denied { create } for pid=18881 comm="syz.3.2717" name="foo" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:tracefs_t tclass=dir permissive=1 [ 1686.579405][ T30] audit: type=1400 audit(1789919815.340:2128): avc: denied { write } for pid=18881 comm="syz.3.2717" name="instances" dev="tracefs" ino=1658 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1686.579448][ T30] audit: type=1400 audit(1789919815.340:2129): avc: denied { remove_name } for pid=18881 comm="syz.3.2717" name="foo" dev="tracefs" ino=62088 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1686.579492][ T30] audit: type=1400 audit(1789919815.340:2130): avc: denied { rmdir } for pid=18881 comm="syz.3.2717" name="foo" dev="tracefs" ino=62088 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1686.579535][ T30] audit: type=1400 audit(1789919815.390:2131): avc: denied { write } for pid=18881 comm="syz.3.2717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1688.661815][T18673] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1688.688981][T18673] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1688.689765][T18673] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1688.724253][T18673] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1688.726613][T18673] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1688.753477][T18673] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1688.764574][T18673] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1688.769549][T18673] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1688.998242][T18673] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1689.048497][T18673] 8021q: adding VLAN 0 to HW filter on device team0 [ 1689.067750][ T171] bridge0: port 1(bridge_slave_0) entered blocking state [ 1689.067835][ T171] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1689.097616][ T6312] bridge0: port 2(bridge_slave_1) entered blocking state [ 1689.097709][ T6312] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1689.302291][T18914] FAULT_INJECTION: forcing a failure. [ 1689.302291][T18914] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1689.302326][T18914] CPU: 0 UID: 0 PID: 18914 Comm: syz.6.2714 Tainted: G L syzkaller #0 PREEMPT(full) [ 1689.302359][T18914] Tainted: [L]=SOFTLOCKUP [ 1689.302368][T18914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1689.302381][T18914] Call Trace: [ 1689.302390][T18914] [ 1689.302399][T18914] dump_stack_lvl+0x100/0x190 [ 1689.302437][T18914] should_fail_ex.cold+0x5/0xa [ 1689.302469][T18914] _copy_from_iter+0x1f4/0x1690 [ 1689.302498][T18914] ? __asan_memset+0x23/0x50 [ 1689.302522][T18914] ? __pfx__copy_from_iter+0x10/0x10 [ 1689.302546][T18914] ? __pfx___alloc_skb+0x10/0x10 [ 1689.302584][T18914] netlink_sendmsg+0x808/0xda0 [ 1689.302615][T18914] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1689.302643][T18914] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1689.302671][T18914] ____sys_sendmsg+0xa4d/0xbe0 [ 1689.302700][T18914] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1689.302728][T18914] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1689.302768][T18914] ? lock_acquire+0x1d1/0x380 [ 1689.302790][T18914] ? get_pid_task+0x2a/0x250 [ 1689.302823][T18914] ___sys_sendmsg+0x190/0x1e0 [ 1689.302846][T18914] ? __pfx____sys_sendmsg+0x10/0x10 [ 1689.302875][T18914] ? get_pid_task+0x106/0x250 [ 1689.302917][T18914] ? find_held_lock+0x2b/0x80 [ 1689.302967][T18914] __sys_sendmsg+0x160/0x210 [ 1689.302997][T18914] ? __pfx___sys_sendmsg+0x10/0x10 [ 1689.303042][T18914] do_syscall_64+0x123/0x790 [ 1689.303078][T18914] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.303101][T18914] RIP: 0033:0x7f06fa19e159 [ 1689.303127][T18914] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1689.303149][T18914] RSP: 002b:00007f06f83f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1689.303170][T18914] RAX: ffffffffffffffda RBX: 00007f06fa425fa0 RCX: 00007f06fa19e159 [ 1689.303186][T18914] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1689.303200][T18914] RBP: 00007f06f83f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1689.303215][T18914] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1689.303229][T18914] R13: 00007f06fa426038 R14: 00007f06fa425fa0 R15: 00007ffc5cab40d8 [ 1689.303260][T18914] [ 1689.643141][T18915] fuse-io-uring is disabled by module parameter [ 1689.913443][T18927] ================================================================== [ 1689.913466][T18927] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 1689.913498][T18927] Read of size 1 at addr ffff8880275ad120 by task syz.6.2722/18927 [ 1689.913516][T18927] [ 1689.913530][T18927] CPU: 1 UID: 0 PID: 18927 Comm: syz.6.2722 Tainted: G L syzkaller #0 PREEMPT(full) [ 1689.913562][T18927] Tainted: [L]=SOFTLOCKUP [ 1689.913571][T18927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1689.913586][T18927] Call Trace: [ 1689.913594][T18927] [ 1689.913603][T18927] dump_stack_lvl+0x100/0x190 [ 1689.913639][T18927] print_report+0x13d/0x4b0 [ 1689.913672][T18927] ? __virt_addr_valid+0x239/0x430 [ 1689.913698][T18927] ? string+0x471/0x4d0 [ 1689.913724][T18927] kasan_report+0xdf/0x1c0 [ 1689.913752][T18927] ? string+0x471/0x4d0 [ 1689.913783][T18927] string+0x471/0x4d0 [ 1689.913810][T18927] ? __pfx_string+0x10/0x10 [ 1689.913840][T18927] vsnprintf+0x422/0x1300 [ 1689.913874][T18927] ? __pfx_vsnprintf+0x10/0x10 [ 1689.913904][T18927] ? __lock_acquire+0x5c0/0x1f40 [ 1689.913928][T18927] ? __pfx_num_to_str+0x10/0x10 [ 1689.913958][T18927] seq_printf+0x1a4/0x250 [ 1689.913983][T18927] ? __pfx_num_to_str+0x10/0x10 [ 1689.914012][T18927] ? __pfx_seq_printf+0x10/0x10 [ 1689.914039][T18927] ? do_raw_spin_lock+0x128/0x260 [ 1689.914069][T18927] ? seq_put_decimal_ull_width+0x1db/0x3a0 [ 1689.914099][T18927] irq_seq_show+0x390/0x8b0 [ 1689.914130][T18927] traverse.part.0.constprop.0+0x107/0x650 [ 1689.914161][T18927] seq_lseek+0x2fb/0x430 [ 1689.914190][T18927] proc_reg_llseek+0x208/0x2f0 [ 1689.914224][T18927] ksys_lseek+0xf3/0x1b0 [ 1689.914258][T18927] do_syscall_64+0x123/0x790 [ 1689.914291][T18927] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.914315][T18927] RIP: 0033:0x7f06fa19e159 [ 1689.914341][T18927] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1689.914363][T18927] RSP: 002b:00007f06f83d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000008 [ 1689.914385][T18927] RAX: ffffffffffffffda RBX: 00007f06fa426090 RCX: 00007f06fa19e159 [ 1689.914401][T18927] RDX: 0000000000000000 RSI: 0000002000000008 RDI: 0000000000000007 [ 1689.914416][T18927] RBP: 00007f06fa23506b R08: 0000000000000000 R09: 0000000000000000 [ 1689.914431][T18927] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1689.914446][T18927] R13: 00007f06fa426128 R14: 00007f06fa426090 R15: 00007ffc5cab40d8 [ 1689.914469][T18927] [ 1689.914478][T18927] [ 1689.914483][T18927] Allocated by task 15169: [ 1689.914494][T18927] kasan_save_stack+0x30/0x50 [ 1689.914519][T18927] kasan_save_track+0x14/0x30 [ 1689.914541][T18927] __kasan_kmalloc+0xaa/0xb0 [ 1689.914563][T18927] __kmalloc_node_noprof+0x342/0x880 [ 1689.914585][T18927] __vmalloc_node_range_noprof+0x3d4/0x1420 [ 1689.914614][T18927] __vmalloc_node_noprof+0xad/0xf0 [ 1689.914639][T18927] do_ip6t_get_ctl+0x7e0/0xc30 [ 1689.914663][T18927] nf_getsockopt+0x7c/0xe0 [ 1689.914698][T18927] ipv6_getsockopt+0x207/0x2a0 [ 1689.914724][T18927] tcp_getsockopt+0xa1/0x110 [ 1689.914746][T18927] do_sock_getsockopt+0x50a/0x6e0 [ 1689.914775][T18927] __sys_getsockopt+0x148/0x260 [ 1689.914799][T18927] __x64_sys_getsockopt+0xbd/0x160 [ 1689.914822][T18927] do_syscall_64+0x123/0x790 [ 1689.914850][T18927] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.914872][T18927] [ 1689.914878][T18927] Freed by task 15169: [ 1689.914888][T18927] kasan_save_stack+0x30/0x50 [ 1689.914911][T18927] kasan_save_track+0x14/0x30 [ 1689.914933][T18927] kasan_save_free_info+0x3b/0x70 [ 1689.914964][T18927] __kasan_slab_free+0x5f/0x80 [ 1689.914987][T18927] kfree+0x22b/0x6d0 [ 1689.915014][T18927] vfree+0x11d/0x6d0 [ 1689.915037][T18927] do_ip6t_get_ctl+0xa0b/0xc30 [ 1689.915060][T18927] nf_getsockopt+0x7c/0xe0 [ 1689.915086][T18927] ipv6_getsockopt+0x207/0x2a0 [ 1689.915110][T18927] tcp_getsockopt+0xa1/0x110 [ 1689.915132][T18927] do_sock_getsockopt+0x50a/0x6e0 [ 1689.915161][T18927] __sys_getsockopt+0x148/0x260 [ 1689.915185][T18927] __x64_sys_getsockopt+0xbd/0x160 [ 1689.915209][T18927] do_syscall_64+0x123/0x790 [ 1689.915238][T18927] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.915258][T18927] [ 1689.915263][T18927] The buggy address belongs to the object at ffff8880275ad120 [ 1689.915263][T18927] which belongs to the cache kmalloc-8 of size 8 [ 1689.915280][T18927] The buggy address is located 0 bytes inside of [ 1689.915280][T18927] freed 8-byte region [ffff8880275ad120, ffff8880275ad128) [ 1689.915300][T18927] [ 1689.915306][T18927] The buggy address belongs to the physical page: [ 1689.915332][T18927] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880275ad860 pfn:0x275ad [ 1689.915356][T18927] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 1689.915379][T18927] page_type: f5(slab) [ 1689.915399][T18927] raw: 00fff00000000200 ffff88801c034500 ffffea0001e4dc10 ffffea0001d285d0 [ 1689.915423][T18927] raw: ffff8880275ad860 000000000080005d 00000000f5000000 0000000000000000 [ 1689.915436][T18927] page dumped because: kasan: bad access detected [ 1689.915453][T18927] page_owner tracks the page as allocated [ 1689.915460][T18927] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4305401385 [ 1689.915494][T18927] post_alloc_hook+0xfd/0x120 [ 1689.915524][T18927] get_page_from_freelist+0x110d/0x35d0 [ 1689.915557][T18927] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 1689.915577][T18927] new_slab+0xa9/0x6e0 [ 1689.915606][T18927] refill_objects+0xe3/0x410 [ 1689.915623][T18927] __pcs_replace_empty_main+0x35e/0x650 [ 1689.915654][T18927] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 1689.915678][T18927] kstrdup+0x51/0xe0 [ 1689.915708][T18927] kstrdup_const+0x63/0x80 [ 1689.915738][T18927] kvasprintf_const+0x10f/0x1a0 [ 1689.915762][T18927] kobject_set_name_vargs+0x5a/0x140 [ 1689.915785][T18927] dev_set_name+0xc7/0x100 [ 1689.915814][T18927] tty_register_device_attr+0x2fb/0x7f0 [ 1689.915838][T18927] tty_register_driver+0x769/0xb50 [ 1689.915861][T18927] pty_init+0x65d/0xdc0 [ 1689.915885][T18927] do_one_initcall+0x11c/0x6f0 [ 1689.915907][T18927] page last free pid 159 tgid 159 ts 4304228004 stack trace: [ 1689.915921][T18927] __free_frozen_pages+0x79f/0x10f0 [ 1689.915949][T18927] __kasan_populate_vmalloc+0x1ea/0x210 [ 1689.915970][T18927] alloc_vmap_area+0x95d/0x2bb0 [ 1689.915992][T18927] __get_vm_area_node+0x1ed/0x350 [ 1689.916017][T18927] __vmalloc_node_range_noprof+0x268/0x1420 [ 1689.916044][T18927] __vmalloc_node_noprof+0xad/0xf0 [ 1689.916070][T18927] copy_process+0x803/0x8370 [ 1689.916092][T18927] kernel_clone+0x176/0x9d0 [ 1689.916114][T18927] user_mode_thread+0xd1/0x120 [ 1689.916136][T18927] call_usermodehelper_exec_work+0xcb/0x180 [ 1689.916158][T18927] process_one_work+0xac7/0x1b10 [ 1689.916188][T18927] worker_thread+0x5ef/0xe50 [ 1689.916218][T18927] kthread+0x373/0x450 [ 1689.916245][T18927] ret_from_fork+0x730/0xd60 [ 1689.916267][T18927] ret_from_fork_asm+0x1a/0x30 [ 1689.916288][T18927] [ 1689.916294][T18927] Memory state around the buggy address: [ 1689.916304][T18927] ffff8880275ad000: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 1689.916330][T18927] ffff8880275ad080: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 1689.916346][T18927] >ffff8880275ad100: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 1689.916359][T18927] ^ [ 1689.916371][T18927] ffff8880275ad180: 00 fc fc fc fa fc fc fc 00 fc fc fc fa fc fc fc [ 1689.916387][T18927] ffff8880275ad200: fa fc fc fc 04 fc fc fc 00 fc fc fc 00 fc fc fc [ 1689.916399][T18927] ================================================================== [ 1689.916416][T18927] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1690.653756][T18927] CPU: 1 UID: 0 PID: 18927 Comm: syz.6.2722 Tainted: G L syzkaller #0 PREEMPT(full) [ 1690.664703][T18927] Tainted: [L]=SOFTLOCKUP [ 1690.669015][T18927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1690.679056][T18927] Call Trace: [ 1690.682318][T18927] [ 1690.685235][T18927] dump_stack_lvl+0x100/0x190 [ 1690.689913][T18927] vpanic+0x553/0x970 [ 1690.693882][T18927] ? __pfx_vpanic+0x10/0x10 [ 1690.698374][T18927] ? __pfx_vprintk_emit+0x10/0x10 [ 1690.703396][T18927] ? string+0x471/0x4d0 [ 1690.707545][T18927] panic+0xd1/0xe0 [ 1690.711252][T18927] ? __pfx_panic+0x10/0x10 [ 1690.715658][T18927] ? end_report.part.0+0x23/0x90 [ 1690.720596][T18927] ? rcu_is_watching+0x13/0xc0 [ 1690.725356][T18927] ? end_report.part.0+0x23/0x90 [ 1690.730294][T18927] check_panic_on_warn.cold+0x19/0x34 [ 1690.735659][T18927] end_report.part.0+0x3a/0x90 [ 1690.740420][T18927] kasan_report.cold+0xe/0x18 [ 1690.745095][T18927] ? string+0x471/0x4d0 [ 1690.749244][T18927] string+0x471/0x4d0 [ 1690.753218][T18927] ? __pfx_string+0x10/0x10 [ 1690.757717][T18927] vsnprintf+0x422/0x1300 [ 1690.762056][T18927] ? __pfx_vsnprintf+0x10/0x10 [ 1690.766819][T18927] ? __lock_acquire+0x5c0/0x1f40 [ 1690.771748][T18927] ? __pfx_num_to_str+0x10/0x10 [ 1690.776599][T18927] seq_printf+0x1a4/0x250 [ 1690.780922][T18927] ? __pfx_num_to_str+0x10/0x10 [ 1690.785770][T18927] ? __pfx_seq_printf+0x10/0x10 [ 1690.790612][T18927] ? do_raw_spin_lock+0x128/0x260 [ 1690.795633][T18927] ? seq_put_decimal_ull_width+0x1db/0x3a0 [ 1690.801436][T18927] irq_seq_show+0x390/0x8b0 [ 1690.805935][T18927] traverse.part.0.constprop.0+0x107/0x650 [ 1690.811738][T18927] seq_lseek+0x2fb/0x430 [ 1690.815977][T18927] proc_reg_llseek+0x208/0x2f0 [ 1690.820740][T18927] ksys_lseek+0xf3/0x1b0 [ 1690.824986][T18927] do_syscall_64+0x123/0x790 [ 1690.829578][T18927] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1690.835458][T18927] RIP: 0033:0x7f06fa19e159 [ 1690.839862][T18927] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1690.859455][T18927] RSP: 002b:00007f06f83d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000008 [ 1690.867857][T18927] RAX: ffffffffffffffda RBX: 00007f06fa426090 RCX: 00007f06fa19e159 [ 1690.875818][T18927] RDX: 0000000000000000 RSI: 0000002000000008 RDI: 0000000000000007 [ 1690.883784][T18927] RBP: 00007f06fa23506b R08: 0000000000000000 R09: 0000000000000000 [ 1690.891739][T18927] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1690.899698][T18927] R13: 00007f06fa426128 R14: 00007f06fa426090 R15: 00007ffc5cab40d8 [ 1690.907665][T18927] [ 1690.910881][T18927] Kernel Offset: disabled [ 1690.915193][T18927] Rebooting in 86400 seconds..