last executing test programs: 7m29.953562139s ago: executing program 0 (id=1): r0 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x9, 0x1) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r0, 0x541b, 0x0) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x80, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000080)=0xd10, 0x4) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e20, @local}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r1, 0x0, 0x6, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x703440, 0x29) fanotify_init(0xf00, 0x0) fallocate(r3, 0x0, 0x1000000, 0x3) bpf$ITER_CREATE(0x21, 0x0, 0x0) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x0) close(r4) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) listen(r5, 0xffffffff) r6 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100, 0x400, 0x80000213, 0x0, r4}, &(0x7f0000000380)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r7, r8, &(0x7f00000003c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x3, r4, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r6, 0x27e2, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000040), &(0x7f0000000080)=0x8) 7m25.774363568s ago: executing program 0 (id=19): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001500)=ANY=[], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r6, &(0x7f0000000000)={0x20002015}) close_range(r5, r6, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x120) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRESHEX=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000005900000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000000050005000a00000012000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) 7m23.757789246s ago: executing program 0 (id=24): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="1201000000000040ef17476000000000000109022400010000000009040000010300020009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00W'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000001c0)={'gre0\x00', &(0x7f00000002c0)={'ip_vti0\x00', 0x0, 0x80, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14}}}}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) semop(0x0, &(0x7f00000000c0)=[{}, {}], 0x2) syz_usb_control_io$uac1(r0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x2000004) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x9c, 0x32, 0x3f, 0x8, 0x4a5, 0x3003, 0x3ab2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x2, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x28, 0xf0, 0xf6}}]}}]}}, 0x0) syz_usb_control_io(r4, &(0x7f0000000000)={0x2c, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x416}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) 7m18.25218124s ago: executing program 0 (id=37): bind$rxrpc(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x8, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, 0x0) listen(0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_type(r3, &(0x7f00000001c0), 0x2, 0x0) mkdirat$cgroup(r3, &(0x7f0000000040)='syz0\x00', 0x1ff) write$cgroup_type(r4, &(0x7f0000000280), 0x9) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0xfffffffffffffe91, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000080000000900000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00P\x00'], 0x48) socket$inet_tcp(0x2, 0x1, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000340)={0x1383, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-blowfish-asm\x00'}, 0x58) r7 = accept$alg(r6, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000080)="ad060000", 0x4) sendmsg$alg(r7, &(0x7f0000002280)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x90}, 0x2000) recvmmsg(r7, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)=""/120, 0x78}], 0x1}, 0x5}], 0x3fffe7d, 0x0, 0x0) setsockopt$sock_linger(r5, 0x1, 0xd, &(0x7f0000000100)={0x1, 0x80000001}, 0x8) 7m3.079958859s ago: executing program 32 (id=37): bind$rxrpc(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x8, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, 0x0) listen(0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_type(r3, &(0x7f00000001c0), 0x2, 0x0) mkdirat$cgroup(r3, &(0x7f0000000040)='syz0\x00', 0x1ff) write$cgroup_type(r4, &(0x7f0000000280), 0x9) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0xfffffffffffffe91, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000080000000900000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00P\x00'], 0x48) socket$inet_tcp(0x2, 0x1, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000340)={0x1383, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-blowfish-asm\x00'}, 0x58) r7 = accept$alg(r6, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000080)="ad060000", 0x4) sendmsg$alg(r7, &(0x7f0000002280)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x90}, 0x2000) recvmmsg(r7, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)=""/120, 0x78}], 0x1}, 0x5}], 0x3fffe7d, 0x0, 0x0) setsockopt$sock_linger(r5, 0x1, 0xd, &(0x7f0000000100)={0x1, 0x80000001}, 0x8) 9.221797658s ago: executing program 4 (id=1342): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = memfd_create(&(0x7f0000000dc0)='\x01\xfd\xae.+\xa6\x8c\xb6?2\x199\x94S,|x?Ue[\xbd\xe1!\x033\xbc\'#\xff\x17\x9b%\xf3[d \x06\x00\x00\x00\x97A\xc2\xd8\xf0Uq!\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xeb\xe4\x9aR\xe5,\x82\x03\x00\x19\x8d\xe8\xc6\xb9\xe4\xb4\x99\x8a\x19P\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xcc\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\x16\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xef!\x8f\xf6]-\xf1k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7cdv[\t\x00\x8d\xf3\xcc1\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6\xbel\x9b.o\xbe\x80\x9dx\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9k\x83\xfc\xa4\xad4\x03\xa2X\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfcN\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\xaf\xa2\x14]p+\x96\x1ei|n\xda\xee\\\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\xf8\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11Z\xe6:\x03\xce\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xdfY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0\xe1\x86\t\xaf\vi\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xad\x86\xd7\x15&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96?\x00\x00\x00\x00\x00\x00\x00\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKlb\xe5:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcb\xcaXe\xe1\xa2\xaa\x02\x86\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01O\xd3r\xa2\xa9u\x93>m\xd7q\'\xdf\xfajo\xd8n\xa7\xecJi\xde\xdf\x7f\xe3\xc4*Z 4\xe8S$\xa1H=\xdf\x05\xf3\xe3T\xd1\xdd\xc6f\xa4\xb4\x96\\\xa0\xf9\x0f\x17\x11{\xb6\x9d\xd21\xc1\x90Vj\x13r\x00\x00\xde\x03\xab\xff\x8as0\xc6E\xca\"\xd9*\x9a\x15\xb95r\x8f\xaaj\x82\xd6\xd2%\xed\xa2WQ\xec2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xccX\xfdRB\xffU\xe9\xfa\x1f\xf6\xce\b\xde@\x061\xc6z\xe4\xe0\xc9?\xa7\x94>\x9c\xd1\xa5o\x04\xaaim\xae\xfe\xc7f\xa3\x96\xd7\xb4c)r{\r#\xddI&\n\xf2\xec\xd4\xff\x9f\x136zZ-2\x80\xfbH+\x9b8\xf3\xed\xdf\xa2my\xb28c[\xc3\xfe\xb5M\x84\x97\xa5\'s\xe9\xdc=)I\xabLt2\x9c\v\xd9S', 0x6) socket$pppl2tp(0x18, 0x1, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x0, &(0x7f0000000040)}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r1, 0x0, 0xd}, 0x18) socket$vsock_stream(0x28, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x25) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.numa_stat\x00', 0x26e1, 0x0) setresuid(0xee01, 0xee01, 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') sync() chdir(&(0x7f0000000080)='./file1\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000900, 0x0, &(0x7f00000000c0)={0xe, 0x0, 0x80000000, 0x0, 0x0, 0x6, 0x0, 0x3ff, 0x10}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) socket$packet(0x11, 0x2, 0x300) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) r4 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0xbd84, 0x0, 0x1, 0x24b}, &(0x7f0000000100)=0x0, &(0x7f0000000640)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2f, 0x8, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x7b, 0x0, 0x0, 0x0, &(0x7f0000011000/0x4000)=nil, 0x4000, 0xc}) io_uring_enter(r4, 0x47bc, 0x20, 0x0, 0x0, 0x0) fallocate(r0, 0x0, 0x9, 0x4) mbind(&(0x7f0000195000/0x2000)=nil, 0x2000, 0x4000, &(0x7f0000000400)=0xfb, 0x9, 0x3) 8.496125819s ago: executing program 4 (id=1344): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000280)={0xfefad004, 0x2000}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mknodat$null(r2, &(0x7f00000002c0)='./file0\x00', 0x200, 0x103) syz_open_procfs(0xffffffffffffffff, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x64, 0x3, 0x300, 0x6e, 0xffffffad, 0x190, 0x190, 0x190, 0x268, 0x268, 0x268, 0x268, 0x268, 0x3, 0x0, {[{{@ip={@remote, @local={0xac, 0x14, 0xd}, 0x0, 0x0, 'caif0\x00', 'ip6tnl0\x00'}, 0x0, 0x130, 0x190, 0xffffffc5, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "bdc74c01369df17d17ac76fa5f9b3bfa0c34430d864040bc25b2b73a59aa6ecab6b1d2cc05e3182f64694d7d05fb8b8c8f56627a54f905d564eeeb8334f650ca0f3c44f7fda4d20a55050342ea85ecc8838e7088de33582f36a0a375bb7008adc297a5ece1bb2df53d17bef26bb6f800", 0x7f, 0x2}}]}, @common=@SET={0x60}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, 0x0, 0x0, 'team0\x00', 'team0\x00'}, 0x0, 0x98, 0xd8, 0x0, {}, [@common=@inet=@set1={{0x28}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x360) r7 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_G_FREQUENCY(r7, 0xc02c5638, &(0x7f0000000080)={0x7fffffff, 0x5}) socket$isdn_base(0x22, 0x3, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000700)={{{@in=@remote, @in=@empty}}, {{@in=@multicast1}, 0x0, @in=@empty}}, &(0x7f00000001c0)=0xe8) 7.266535806s ago: executing program 5 (id=1349): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x1000080002, 0x100000000000088) r4 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000280)={'syz_tun\x00'}) sendmsg$sock(r4, &(0x7f0000000600)={&(0x7f00000000c0)=@tipc=@name={0x1e, 0x2, 0x1, {{0x41, 0x1}}}, 0x80, 0x0, 0x0, &(0x7f0000000240)}, 0x50) r5 = socket$inet6(0xa, 0x802, 0x88) sendto$inet6(r5, 0x0, 0x0, 0x4008840, &(0x7f0000000180)={0xa, 0x4e23, 0x8be6, @mcast2}, 0x1c) sendto$inet6(r5, &(0x7f0000000400)="1732", 0x2, 0x40000, 0x0, 0x0) poll(&(0x7f0000000340)=[{r3, 0x440}], 0x1, 0x6) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) 7.127277405s ago: executing program 1 (id=1350): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) keyctl$search(0xa, 0x0, &(0x7f00000005c0)='logon\x00', 0x0, 0xfffffffffffffffe) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) add_key$fscrypt_provisioning(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000740)=ANY=[@ANYBLOB="000000000000000061616161616161f4faf449e5b0a4ae61616161616161613131313131313131313131313131313117c755394d313131313131313131313131313100000000a1ca0000"], 0x48, 0xffffffffffffffff) read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) syz_fuse_handle_req(r3, &(0x7f0000008380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x0, 0x88}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r5 = syz_io_uring_setup(0x24fa, &(0x7f00000004c0)={0x0, 0x0, 0x10100, 0x1, 0xfffefffe}, &(0x7f0000000100), &(0x7f0000000140)) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='8'], 0x38}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r6, &(0x7f0000000740)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r6, 0x0) io_uring_enter(r5, 0x2d3e, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) 6.936626804s ago: executing program 2 (id=1351): r0 = socket$inet(0x10, 0x3, 0xc) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r5, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r6 = socket(0x1, 0x803, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000020002001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r9], 0x4c}}, 0x4000) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 6.144488612s ago: executing program 4 (id=1353): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001500)=ANY=[], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r5, &(0x7f0000000000)={0x20002015}) close_range(r4, r5, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x120) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRESHEX, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000005900000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) 6.08483865s ago: executing program 5 (id=1354): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000700), 0x20840, 0x0) ioctl$PTP_EXTTS_REQUEST2(r1, 0x40043d0d, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000540)={0x2c, &(0x7f0000000280)={0x0, 0xb, 0x2, {0x2, 0x24}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 5.831831298s ago: executing program 2 (id=1355): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000000314230c2abd7000ff05df250900020073797a310000000008004100727865001400330073797a5f7475"], 0x38}, 0x1, 0x0, 0x0, 0x48845}, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) dup(r1) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r2, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}, r3}}, 0x30) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x711, @private1, 0x206}, {0xa, 0x4e20, 0x0, @mcast2, 0x10001}, r3, 0x403}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f00000002c0)={0x4, 0x8, 0xfa00, {r3, 0x5}}, 0x10) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000380)={0x6, 0x118, 0xfa00, {{0x1, 0x1, "4ca4625e00b5aa95a443d782d859cb2df816a3bc9bd3bf1d11d8b4a7ba9fc6dfb72a8a253215874b349abc806123fd11b1d23eb79cf0385a4cd7b494621f0b26b593bbccdfdf13dbc79be9e9f18b5fb46b9d5a74d7a6dd151c0f37b9e89825f2f99217fb0091568ce14c98b5b462555908260a0e7c7c33fc1ba12df6d0d8fc11847c4b29bd4752fa53802767e26e11475a905215a4d1cfb8a8cc88d605e68145d97c3c2836b7935b66b3583d6633efe51a9cb5426092d85d47a8ca52fe5b7c2083596186c5b4e98f1052759d2233c3fb1e62e4333f0898f89b770b6abe57c92ba6f0e1c64a714686c6f22f7c8f6f79ee56c56d09e95001654229a197d0462e6f", 0x0, 0x4, 0x5, 0xf, 0xd, 0x0, 0x6, 0x1}, r3}}, 0x120) 5.125352847s ago: executing program 4 (id=1357): write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) dup(0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2) r4 = memfd_create(&(0x7f0000000300)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecj\x02\xc8\xc4\f\x04\x99\xf6\xfc', 0x3) ftruncate(r4, 0xffff) fcntl$addseals(r4, 0x409, 0x7) r5 = ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f00000002c0)={r4, 0x0, 0x0, 0x1000}) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$FUSE_GETXATTR(r3, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) syz_io_uring_setup(0x4fb0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f0000000180)=0x6f) r8 = fcntl$dupfd(r5, 0x406, r0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000000180)={0x0, 0x0, r8}) clock_gettime(0x0, &(0x7f00000000c0)) close_range(r1, 0xffffffffffffffff, 0x0) socket$key(0xf, 0x3, 0x2) 5.092008199s ago: executing program 1 (id=1358): mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x3, 0x20000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f00000002c0)={0x7, 0x7b, 0x2}, 0x7) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r3}, 0x10) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r5 = dup(r4) connect$bt_rfcomm(r5, &(0x7f00000008c0)={0x1f, @none, 0x6}, 0xa) bind$bt_l2cap(r4, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="000200020000ffff0000001a0000000000000000000000000000000063139448039ff3465a3c1cb954fb9a6fc3e29259dd723959f9"], 0x1c}}, 0x0) 4.964672442s ago: executing program 3 (id=1359): r0 = socket$inet(0x10, 0x3, 0xc) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r5, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r6 = socket(0x1, 0x803, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x20}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000020002001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r9], 0x4c}}, 0x4000) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 4.115614982s ago: executing program 1 (id=1360): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$key(0xf, 0x3, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet(0x2, 0x1, 0x100) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007e8, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r4, &(0x7f00000012c0)="09268a927f1f6588b967481241ba7860fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e755044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0x20c8, 0x11, 0x0, 0x27) sendmsg$key(r1, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="02042a000e000000000000000100000005000600320000000a004e2400000007ff0200000000000000000000000000010d0000000000000002000100000000000000fb020000000005000500320000000a"], 0x70}, 0x1, 0x7}, 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000003fc0), 0x0, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020200600000000000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000010000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x20000) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r7, 0xc0605345, &(0x7f0000000000)={0x80000000, 0x1, {0xffffffffffffffff, 0x0, 0xed74b0be, 0x0, 0x80000001}, 0x4}) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r5, 0xc038943b, &(0x7f00000000c0)={0xb, 0x10, '\x00', 0x0, &(0x7f0000000080)=[0x0, 0x0]}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000006900000000000001000000940000000fad413e850000000700000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r8}, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) 3.944559938s ago: executing program 2 (id=1361): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r0, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='vm_unmapped_area\x00', r1}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='vm_unmapped_area\x00', r2}, 0x10) io_setup(0x3, &(0x7f0000000340)) r3 = socket(0x10, 0x803, 0x0) r4 = gettid() timer_create(0xb, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x80) ioctl$CEC_RECEIVE(r5, 0xc0386106, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x8000000, 0x0, 0x9, '&\x00', 0x0, 0xd3, 0x4a, 0x0, 0x0, 0x0, 0xe}) write(r3, &(0x7f0000000900)="2600000022004701050007008980e8ff02006d20002b1f00c0e9f7094a51f10101033500b088", 0x26) recvfrom$inet6(r3, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x3, @local}, 0x1c) read(r0, 0x0, 0x5d) write$ppp(r0, &(0x7f0000000200)="bc72", 0x2) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000000)=0x2180) 3.926091533s ago: executing program 4 (id=1362): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xc) r2 = open(&(0x7f0000000080)='./file1\x00', 0x64842, 0x22) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYRES8=r2], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4b, @void, @value}, 0x94) r3 = gettid() r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x2000) read(r4, &(0x7f0000000200)=""/208, 0xd0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000080)={0x15, @tick=0x8001, 0x0, {0xab, 0x1}}) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r4, 0xc0a85322, &(0x7f0000000300)) tkill(r3, 0x7) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000361000/0x800000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x0}, 0x68) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r6, 0xf3, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) 3.173398361s ago: executing program 3 (id=1363): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000080)=@v1={0x0, @aes128, 0x1, @desc1}) r1 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x8, 0x2, 0x7}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000003c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a40)=@delchain={0x30, 0x5f, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x5, 0x2}, {0x1, 0xe}}, [@filter_kind_options=@f_bpf={{0x8}, {0x4}}]}, 0x30}}, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r4, 0x4601, &(0x7f0000000240)={0x400, 0x30, 0xf0, 0x0, 0x0, 0x1f, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x7, 0x0, 0x5, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x16, 0x0, 0x0, 0x5}) 2.66235442s ago: executing program 5 (id=1364): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x1000080002, 0x100000000000088) r4 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000280)={'syz_tun\x00'}) sendmsg$sock(r4, &(0x7f0000000600)={&(0x7f00000000c0)=@tipc=@name={0x1e, 0x2, 0x1, {{0x41, 0x1}}}, 0x80, 0x0, 0x0, &(0x7f0000000240)}, 0x50) r5 = socket$inet6(0xa, 0x802, 0x88) sendto$inet6(r5, 0x0, 0x0, 0x4008840, &(0x7f0000000180)={0xa, 0x4e23, 0x8be6, @mcast2}, 0x1c) sendto$inet6(r5, &(0x7f0000000400)="1732", 0x2, 0x40000, 0x0, 0x0) poll(&(0x7f0000000340)=[{r3, 0x440}], 0x1, 0x6) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) 2.524697309s ago: executing program 2 (id=1365): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xf, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_device, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) rename(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x19, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000630104000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) fsmount(0xffffffffffffffff, 0x0, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1d, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) (fail_nth: 3) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r1, 0xffffffffffffffff, 0x6, 0x0, @val=@iter={0x0}}, 0x20) r6 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) write$selinux_attr(r6, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004a40)=ANY=[@ANYBLOB="c0260000410007010000000007", @ANYRES32], 0x26c0}}, 0x4010) 2.032009148s ago: executing program 3 (id=1366): kexec_load(0xfffffffffffffffd, 0x1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x41000000}], 0x0) 2.029619919s ago: executing program 4 (id=1367): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) r1 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) r2 = openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$dupfd(r2, 0x406, 0xffffffffffffffff) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x0, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) add_key(&(0x7f00000001c0)='pkcs7_test\x00', &(0x7f0000000240)={'syz', 0x2}, &(0x7f0000000300)="21c7d8b2ea3bdf7ba5784778f0b2fb2909167079dc4c61a65e11b3ab38419b44", 0x20, 0xfffffffffffffffc) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x22) r6 = dup2(r5, r5) ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000480)={'\x00', 0x40, 0xa, 0x1fe, 0x40000004, 0x10}) unlinkat(r5, 0x0, 0x200) ioctl$BLKTRACESETUP(r6, 0x1276, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[], 0x8c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') lseek(r8, 0x2, 0x1) getdents64(r8, 0x0, 0x25) syz_io_uring_setup(0x31c7, 0x0, 0x0, &(0x7f00000005c0)) socket$alg(0x26, 0x5, 0x0) 1.801654917s ago: executing program 1 (id=1368): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, 0x0) (fail_nth: 3) 1.492364148s ago: executing program 5 (id=1369): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r2, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[], 0x2c}}, 0x0) 1.210851883s ago: executing program 1 (id=1370): mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x3, 0x20000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f00000002c0)={0x7, 0x7b, 0x2}, 0x7) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r3}, 0x10) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r5 = dup(r4) connect$bt_rfcomm(r5, &(0x7f00000008c0)={0x1f, @none, 0x6}, 0xa) bind$bt_l2cap(r4, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="000200020000ffff0000001a0000000000000000000000000000000063139448039ff3465a3c1cb954fb9a6fc3e29259dd723959f9"], 0x1c}}, 0x0) 1.210339901s ago: executing program 5 (id=1371): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000000314230c2abd7000ff05df250900020073797a310000000008004100727865001400330073797a5f7475"], 0x38}, 0x1, 0x0, 0x0, 0x48845}, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) dup(r1) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r2, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}, r3}}, 0x30) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x711, @private1, 0x206}, {0xa, 0x4e20, 0x0, @mcast2, 0x10001}, r3, 0x403}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f00000002c0)={0x4, 0x8, 0xfa00, {r3, 0x5}}, 0x10) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000380)={0x6, 0x118, 0xfa00, {{0x1, 0x1, "4ca4625e00b5aa95a443d782d859cb2df816a3bc9bd3bf1d11d8b4a7ba9fc6dfb72a8a253215874b349abc806123fd11b1d23eb79cf0385a4cd7b494621f0b26b593bbccdfdf13dbc79be9e9f18b5fb46b9d5a74d7a6dd151c0f37b9e89825f2f99217fb0091568ce14c98b5b462555908260a0e7c7c33fc1ba12df6d0d8fc11847c4b29bd4752fa53802767e26e11475a905215a4d1cfb8a8cc88d605e68145d97c3c2836b7935b66b3583d6633efe51a9cb5426092d85d47a8ca52fe5b7c2083596186c5b4e98f1052759d2233c3fb1e62e4333f0898f89b770b6abe57c92ba6f0e1c64a714686c6f22f7c8f6f79ee56c56d09e95001654229a197d0462e6f", 0x0, 0x4, 0x5, 0xf, 0xd, 0x0, 0x6, 0x1}, r3}}, 0x120) 1.050177867s ago: executing program 2 (id=1372): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-generic\x00'}, 0x58) (async) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$kcm(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000040)="0810", 0x2}, {&(0x7f00000002c0)="a7a1cae3a90871328126b6478091f2c0e21694115902293eefa6ae4edf3266fe84e0be5acf6bef1cb81d045fada9acc025fa3bfeff98", 0x36}], 0x2}, 0x80) (async) pidfd_send_signal(0xffffffffffffffff, 0x2d, 0x0, 0x1000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async, rerun: 32) r2 = getpid() (rerun: 32) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000600)={'veth1_virt_wifi\x00', 0x0}) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xfff7}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x5}}]}}]}, 0x48}}, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async, rerun: 64) ioctl$sock_SIOCSIFBR(r7, 0x8941, &(0x7f00000001c0)=@add_del={0x2, &(0x7f0000000000)='bond0\x00'}) (async, rerun: 64) read$FUSE(r8, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r8, &(0x7f0000000040)={0x50, 0x0, r9, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) syz_fuse_handle_req(r8, &(0x7f0000004200)="a28096c80abf3543ecde7564abff5085d2227ebcb0f164ae92706ad0b083a3f469a3efd15b4921e9c3063b98b3082068e7c31950dde842eac55df0f991453cad62a6956b0b6f7b8cf49b506a3060fe1127eca99663ade8efa89ee189acb5f3b92f6bc4c46621c803eed0d0bb5f32384870ed08f89d4f74445762fb99715e083c4c92a8878be19ffacc30d0f2da64f971cd40563163adc15670ecf25cd3ad96138967c4b53ad9d04b5193ab5fb674aa0030a9d703d1baf810ce897f969121f142161919e583c275671b999e7f363891dfdfdf3556d01b86ee29eca8fccbfeaf1771395148706cc6e6be7ce29fc9ffef061b5420950c1a525bf75ad06edec51538d1c5bbc77da72dc90fd9998936fffdda2427e5a68966c7e2208f76304680182ec73007e482f034195712af922db2726195d997708734db9e7825a864be00b2a4f800881fc0363f5e618398454f35b148b4ccb88d418269fac868a8ba4a2d5b4f06a1ac01b5ad158b842e05adca22c7372585bf4ce95560b6c1e021a3ed2ff7bd3b6b3c7734c3b66d7e4c460096312082f89b16baa6e73814aa60925780cd92cd65087e260ec046fc363264366a9df2c849c0644911303946adad544521ceb469a3e193ecc9a7876403fac461a4a70d6193b2451189a5c5120b3535e9edf619108af7f517b58abd3fa7fb1ab832213430d2e6901076fba9c9e1acc6c6f48ff0e419bbc45589745a176f52a7407ad5e3dd49acb31b47862806f47077dda04905e45a80a12cbcd4d2dd9fe66c2d1f99394fed8ec60961cd2dc7115a96ece432fac86d51bebb08b95f447a83792fe80291fca7b298c9043ef2c26f0f7e42798d3f54c84b94c24c76c555d83ccc53b99bb22d71845e5cf21a5ba7fbeffeb6306e1730db14561b950a3f24bcfd78d4ab0d97de8054bb1a6077ae7cca6e45d846d3df82298d07212922742cb0facac3b77edfbab90e9ee2d4f7b0ee9b17bb11ec5e5721340d84cb6bd93428167e69b47759172557acda313c3decdfc6fe9336bfade459f43b39d0f2289f9142db280f4ee668e650e12858c577e12e2b9a57ee66c834be97979bcbe94747fa5d8d0b7d3a9f8f218df1bf960f828429a1efe838616b18faf6629236ddbded43a093efae163228e5c38fd7714743c2fcca47e3382bcfb1ab893fd7377527b4ec43f3fa60ebd338161d8de7cad65b15579e4af258f5fe3a63c2637a15703207029b0899b5427767647baef11e291358e6e54f6f13d3d2ca7a5e7969e04d2733b3b9ab822c69a3cfac097384de5071a9b74a656136d55eb190df08747b509fd610ff62b4950ef71c934fe21a48a4931d3d9458b415f112cee65c660f5490e982341da1c58634b3967ca6f3596d20cc90f508382156e36f16539093240ef5f2aa6a2c0dff2a67df30dcf50bf6e0b82a3d49f2d532a8dde1b3ceefcf0837190b74186090d1c18b59917d7efce1adfb238ef4a7b1d22c4cef09320221de883e97e6882466508de06fcdabad3b741bdca2cff879d57ddda52f42b3dcb8a78cfc05826af7e4ff155960ff8491194f4d321ef195990abaeeefdcb852d1e1e3703f317385a9458b6c2dd9db830f757ec29c9939fc7313e639fe485bc1e41ddaaef3fbf1f7cc527c8fad0d21b8082482caad7bee440e5097665f636c3dfec82f8c98afb6243bc3944939675a594277d278ba4361461f7da52e224e4ce5dee4a467bf6ae9f67b61ac6eb0a440406abac2016eec907e241c57f5f44be47290fd0fef785ff04df3810ccd637b4d97a84bae8486a36f75d872e645fe46625969fc2d1f032c56ed44bd98ea27bd9b6ddc8eb2dc2ec9f90f2f1ca1bd20e37ac58b03c84c872f4ba47310654986641460dfdd531ac62a76ad87b89c103ac5c9c2e7e70c66447b3412d4a1e5cbc30e16939505116c04de33ae054ed366de8d1f971c2de439957a194e22a488f58d7efd46439177f3f3c45a1475927eecd846d3d2e6a2ab5c7f8addd99062c2fc6b272d1f51bb8f22f1b6f8bb3faf8aa85e5eb9abf7df5cf8f26267323808b0833a987989cbe59205e7ad06556e2d1b8a4873ca1cbcbc8d43abc145fd4eb832e7a58ab2c793d003ce7b1850ce45eb7480417a1e9eb9d39a1028a2a04a2aa649c098c4f8eee514db5f6021173bb254b8e22b150b2ca01dc7ff235db46ed78d07f43d1adab13b8445d1b32069eb45f9d389fcf5a3f7d3ebe243c5b1fe17b1f5a3d571b65f21b9e471e818172554dc956749b99cb7a5f303ec480d7194a2ba86e204f06aa1becdddc8c49082c527e7064ac2ad77dc05639d3d2a7778f6943ed6105ebf6f0b9e94fddbe05c236ec000f4d1d4e496b10068211ab68ada4c7f7ac61f5f5ba5f1810d5bbe87ff4f8356af0d3f682baedb0ad8f8488b277421f0a03fc5e3095ee34bc4472d8f17e3f7013cf2f79f5ff3ea4b6bae56d1365a33b09bfa9a496323f7da923b7e29dce4beb81035f13130004c96e56d7ef6ca6c101d20c27a218e623227c33c9e488b17e7ae9ac20da8240501f7b614a1730f164553fe479ef149866e4ea47296814284a3d3eb7cbb294289ffb996e0eb053b9c16e54cf267832e3d360eb196ed51305630223309ea97215628f01ec9d3ea48096418d5e962cac5063460f0a18772ec7ce66d14a1cce14b52c40bbbfafccbf1e76f09e57ff0718048e5b993157a6cf4718826b1e09430413a3596a15c4a620fa8c8e1d1663e5739f9f790ddbb3be0e00187d43717d659242467d8681ac10303346157f894d9037641417010e9654c6a5b22263e73a5a37128f50078a980c30930321aa5c5e7851d5d392ddce3a14a96916fa8421ae6728f37f5de7c3e98feb4babd4e1bd2315d595e209d52748f70adc2284fcdaa6ad880470d2a071f3490aaf3491fb64b4547419e8eccdc491a8921156cb4811ad1e66514a32b0b31b641438881f28c1e6461b4f451938999af671e8c6a5cd0c072a9fe4cdbefe24ca616f3d0a15ac97cca835b1a440e04fa28340c6044176c8ecc8ee0d033d47db8a0aacfa0eabdfa1c9509fc2604008f01cbafeb5bd2b503b809ed672340b9a576593f1ef388391b54b605e7a15bef7b1345627a34fca57738b0f8f4f19eea93c903495274a4425a1a1cc6c4c6e335b631df5185c95b485e4257867b5347a40e4e14dcc560f061fd4fd265137dc68afd548adde778f1330f769acb1ccf5da14ff6992c24e210ea6e6179421881b803393bc6974e37106c5b5b3b5d0b3469f8969bffb7e4ceb2c98e928e74366492d27235ae4c74a2f48511aeeaa53a2beafa7a331b50e454c507af1b63350a5cef35668a5b9325014192277e509561008b3601088f79d42eaa8b1e4ae2000b31749e2b8094312ddb7f3c1cd625ef885c11fa22a66e374b52b3425e0b8016154e1fd8471339e32e7373d63ab646d893fbe09ae07b06074c01401ea76b3c382a9d32f24f93c789964e16bc4206ecd75c10917ab84ffd8d6cdf4cd28fd90375ff28518f8c1a3befc538e1b9e427fb671988d29f2fb2fcd039f4d341c84eb4d7cf600ddaba88bb094e4d87a1419180149f491368e648b69985b05ac39a4ecdd3c5135f3a5c8ad7792dacb6470144bb9e67805a211efb3ec9ccaf8e0901345fb19e4da579e1fbe86a1207f4f13c3436009c2c640b7cf3f8b77ca7bd994bf93308027359c6dd1b7db1e153fc0821968ef36c003b6c73fe890f4de24f5c6458dbaaf3819edeaa91783c3cfc7e773689236248195c7bbd60113f2476fa3687621d668d1728ee433d2f8f4db707345d30f1e52ab87a2a0afd547c6b3f0000f59f17facde48f693490e22494b75d11df1a143b85068d143ef6a9bb5937a9df380c8948f1a01e9675e18409edb0f6b9605b68e34632fcce472dc50b90b0f6dcd57931f78e1e8861a0fb62e72b0baad6f9d23c1cfb0f19b25013c8d9fcd786a2f6f79768b5fb398f7b2baa31ce8156d1fc4a46c1c463fdf30360d42aeed2ef11611d0b7f654bb51052fd4dc39328f8ec4c58bbda05e6f1b3c8f6d8adca0268f2410e9a4a7d63b6616006d0e02f6edacc10e5c54fd85f15a8bd7648a293f23d6a699bd9a675250475a73a96d7475e4fabb89fb5e7de5d7a3479aa485c0befc60d0ac4fd5ac6dbecceb06cad86e219fc0ce4720758917811a3215f8d13e413bfb64fc065fc421aede0b56691797dac428c7e463479fa591b9072c309b7533e427c5cc11a1f6cf9a5b995d328d796d874c5b55dfc12a5039b413ce319cf5ba1f355c4e0717d32650b43e18010f37f048731931c52c4f36eb969dda702afe96c2a5241350a67ba2d026946189c5e281293c9a8e2cff3784753f1de78b917101b54e5ab00c045ea15f28a0e3f509962cf8bd3385d85250737eae5c34ece86b86669c13b00308a3b13c0ac3c83ff26fb52a4aa83c1233a9490cb9ca917a056908931751bddb88a62379a713395f0764e4a393faf253a4026d0472270e6036287d56850df1751543484d65b3062155b6300e0024241c59a862ae769c1a9232a2d9fb24705177a09cceb3eefbf9f106f67e01be14cdeb4d2fc7d8661df3e75de5ccd09a7e559f028fb9837c621ea0045b4d1b679067f246339c974631aa7134d4e910efb28d3c48929cef1df7e6c73668762d55086b6c59c36ac90154135fd7ca4e4047dd0aa161fa982d8edf9c0cb9666477e096c55718f6e4742415fefd4f696d1f1ccd6322bc19496ddebd36282a7c707d5b44113e30678e6e33ab7d34be04a59ac614d6a54134490998be02636fa91633d6294781c2b9a54c611c0045cfcfe81f49aa21b29d835cd2047c854486fd8e65a2ebf629f7ced602b9dd107bfde483e5c9b5cbba4a08cdce09920bda9978b7fc2b4a89bf1573a26389e52090fdf5dccf22111dc8c42fd3c8c477092895398086cc22cca665269e193fc650742a361a44b857d258429f701f22e9b7615bc3dab78c1479a41cf8575cdb17169470b347adfc03e03daea3e269725cfc72df5664b9df36d2f2b55013b71133e0b80577a47182511ebb308b6248d457bd2af7b28e77182c305241178c4124ab102771fd5a8c3dacb8775de881301d71587c76bcf0a97a72ad244d0c42fd71aceec32dd48bb5c9a95b391166c832ac5bac8c7cae4d18b3f7d9f2e4782fdf97732e3d51f67bbb57f989ee0d7589dbd0c2a5c63840e914b9d7d720fa120acbffebf816b588b2ccc052e7fa78992e0ea39dd21a122add41195f8e2e1acd777c1a4e8ef4362fef441feb4d9252c6bfbd2742152300a32027776e3341620d3c8d9365e10e81adcca7d87a0e555c98a0353c692557d90ee9be3fbaab766abf93e2462149fd99c92a5fc58d899ee75535cd1fe1386c5ab0b157c2102039d6015258f59cef3f15b951893a30ae839f740402a30b34e7be73796286403c5beb0853d856d83f1b00b48328f56dcb32e1faab08a3435b1482bf18b21c95aefeaafa7fd761c7f28d416fcde06bf7aee5c6e9eb50e55874253ba3f1d0ce2505b4fc7c3fc996bfbb8446bafe84f5bea94bfd7ca5aeaf237fe793b66e5c521d4092e4e1f9bde1dfcfe53fa55005d21cfa833a338fd9792614129336060e10d1911862070761aa20c2902eb7c5a355eff4cf6253d7102a2ca1fead4c53b57d576d104c081310d92797e4e2e8c269d19910d0d4cedf30fa28ba680c00137f83de940624229b6a125ce5233c6cf4a3640b74f58f288dad8451fbe37641c5559a5f3caf1299c8bfb230723652278fe378efd8e459b9da26cffeb58468a6301dbc06d713ba2d8d43d9038f5f2dc8b831ba58a88eeb5b1786b21e398aeeeb7c1f3d6f01d82b3947862fb9e7cbd7da5d04c5fcd34da28d53e2246e3ac1e3a619ad174efa6435eaa0fc94d610799ce0158421dce046306eb5042143daa336d52206b12610ea6389cdda49bf5af1d4ee42ac090a94ae7b7612073f3a5c36a2205eda887f41478f7d20f18667f941f71eebcfa76c1ab28f2a49a3bd56bd3f4e6bd079ab3fe2d94782236e83585a03e52907abaef7456a95d5d3f3d37efdc035dbfd7c41b8ba0af2df8adf1cf24f7ff0beccd3d26bc91caf42314ef7e466f74e19ae0df2e2298fc2f694a7ec134632035585d530e7e19f65c256f001d75382d9825ef741bc213af186377d9ca10d3722354e1897ca5c23ac6a52c9ad0e6b686e1776f7ec65df033e8f4d5db80c1bc354093b319cb70df93d610667675816328c99322f14e636b95f04e6497f139d508b453f53ddb5c289d849fd5407c9bdcefd1642abd46e28cb4e94371bdc606eeb67c9fe17747c68f2d50e82711da4d3edb0eda06f41b7f93fa8fb4d83cf21c79da67000bac2275508217ade1659fa8d24e5f8efb9f4bd21073ebef3d06368eb03fa3cf0d638448bd055ed20d292033ffdba538559c8ff9a2a5c8f83b5c393643d6585d1df994c3be43e72b8f3f53114d2a5f6bcedb573842b23b6a3eb7fca8495bf03bd03fde7b19bd39a16cec49e01f38e671af33cae082d9788e3202799bc466babec2080528d0609c0b731964719093735b4c1e73bd0705637c47516922197c552baeaf3516b5e3bbc2cd1afa3ef8215196ed580d9561092f620b897e98e786a0c7cbb0eedda8063292ba6482497f5f6bb62fb5ab4c97cb7658dc6579718eb97b547fcf47ced1426561af93a15fb4dc6d3d93b868644943c2c94b23b0570bbb81df2666c24f5abccfcdd71e209f3bb43c01d17f9bc8b9af2c26762fc6a741a150b7d1186e4f35175f3c315243e1c11e92c43a1fc492eef5a13c77a81fcf514ebfd0f8e645dae15a07e86b2f01fda065db4505a5eea83cb616f744f6bee731be191c65449c02603556d5a51422cf9c2f19f8d6843e0c1091e0708aa271e91f71c8602b9fa72189e036b7cb6af1569f21269283de94a6d7fe5849fd433d5b719c80419873db0587fc29786cc598d896fb16360bddd2ce12e54d05418f4f5e5f2d7aafe9fcd6268cbe2e9e6329ffb6c67fab8f3ce673028cc06aaa6b857556bba3b44d3fab5b6e875e70a2f3ad4b2ff76f31ead3462d3801ba373b3c2f545e94f57021575e2947f81f53283fc0a5137fd44fa3d074c92de54a0a3465c858f5a7ef08313faddbc3663e4e0167f3cba39612057a7518fbfb031f5ad0f9f75831973ebd733b82e554bf3fdec84e51f65dab6028c6c51366d9d4700fdf255e4c7bd70766e7f2281b3f2a5363f85ce49f9135904d14bcb117ad754c2594dcdca2d30e40ff265b5accfb116f64ed99aad570c4c5a91efdbb984ac651d8721405a0342cf77f448c17a152eabf29e88950558a86d0074e1cefab1eb7c366682f686ee1338737e675ea58eb8b4c86b9f28a6f6e96459f29e3b4dc59ff044c61a0dcc5c31d803e6e98420e446229ccdec3d0f705e92ffe016bb3696373eadab7f35ccf65ab4d9be09a085ce21bbd7c0555376e4d7fe68b5e7a64f48b5127825fb2be598d991f9c1a54bf52713417dcc599e812d85513a537e6eafa738edc972b67e065595d11678449bce6cd3d69800a649b560d0e057c502ca3e72e97820829ecfea801192c3f4e2c8763c095a43ee6fe45fe8730130937668df1d4ee577ada28238be03286481f2d2a004cc4d48856e71fbd64f1a0043a4520ecbbf1b3abdc96b87a27be8495a20542967aa4cd3a44a11502419a083d84e97abfde0901b66dde48388649a0ed6d93b9f20c530e990c7c52370a114d800d6ab3f6687d6bbc105b63738fe05fa6cac98ad6663936bb18cb923264e44312c24c2ce8e642bb73c921012b68a26a70977446b8f15f9d62467d8b356560c183a6bd6cd76ec868c3bd94a595cd7bf996755a508a814980c5e588b275200c45afd900c8c2de329ec2484b0e3ecd7b0960e5e3425881d1ff7f8bd8b20f5cc98ffc3acb77f5e88775a4bd3ab9f9eb027e27d3af55ebdf4eebab48ea911128d668d00fc3f5b5480aa0d9a4af563ba577384448e5425157133d59e1cef3c722f33700bd372825046b1fa5824e405154a3af1440bc2b75acfbd07cf92e8c162587e74b5ab66b1c6aeab3ad5fa3ee91da4900ef30ad04baea326df912517dd96e1696b4a91faa66675978a375e81f25464a1073dc6737af08d7e25956bb31d438548a7da38662d49db812a8cf1d6cc65f5c63879fd9ee7fd2a66ca3fc1a748cb239aab88c87206470b4c60592afeb6d69ed97a8f990155862ba4e22b64804142c131a23792937aa8a8696e165c24d7692a04bb4471b0f0d2507fe7c8618421428fc7a0acc984ca5cc6bacb772e8a717bbaa646f9643275910a6037afaf5a80678d18edda138a4e13d06d04a5d06431eab48738225cf1567e960e765728dc12e91b91c6f2b33dfb6e033aa68c1c2334d24335abc4a7a1df5636dec29091da54d5f5a1fff41e4a35a0c2f04f968f7d78e2f51c73577e2192bb20f289aaba5a175c2ed533855bd9ed9a842ad482136dd5e0cf45eb5e2d31ff62a3be1cf8a94a58316e74f4ab9fc54f3a0bb83beef0f355993bdea2c83e61cdc796bf2564ae51fae616799e8711998cd88d35cd9824452fdd65226174b46792cb87f4dd282e4e6f67eb66da413ad877ed6ce775f7e19bc93f48bb9e5ec04009de3c042aeacf7f4b25ad6b30e017303f64fe07ac79e8744aab6926d117f13513d0469cef335fe1d0d787c2d0b2c031a9521786ac10e9f8b768271680337f2c3262abdccb5d3107c632bf1f74c83ee91f49988222fb080cc8faa9b1a02526d8b6087e0b2354173d29016b3309587c16f057dd812aa63c3169150de81f3af97d082a8f8da4ce4f909ff649821d7f96d97613552e8cc4902e046ecfa329b1d980ff5ece69b8f1615fdff5244f41cec0af924624ae1641ecae5fa26c5fb9006e57100ee71377ced7c255ae17a0845e2ee0287c62c1852f93877f9f86157ca9675d383fff5cd6f2b001ec0136c07cf37f5ace1853122c2baa1092d418e2a490c4a5c8f56b828ce1bafeef4e77f095d6b4ed99d56f66812cb19be540ebe5d52e7eff2d69cbb8477e11514f7e3604bf9999f78c2f1ca6f60a2216b87fa0f25269c425b7d50709b200912b3b7899c95e12d6e9c4dacc19e327721860e0477a53e6793fbb7fb9704a848f395f48c24a6e79b9e1358cc3497251de88b8d3a7b22c6d8af1a7fab81530d9f0cc98f62debb222b54780d89794238532717b447d71b46a60ed481c21db85b590b31720009695ecffd4ef029964e5d5149622233ac013e960a005c924f73ea82c318455546c53d74aa3f7e2ff26aa074c40a55aba8b08027fc19b596eec6c4f89bae39e74b9aad88344f7cc5ad3eefa5095f2ab47222e9a357ecd71c6700ac576025201490d9e446603dfd4bda7617dd500981b2d2ab8c43882a5208494cb3f8ebc720bca8a7cf6c80bd7aaaf89507bb3412ea490a78973f12cc30413e9df1458917ea3d68b438d424c1314bc8d01939c5a5a842438281e62d0c800dee704b2a6cd3e1e4b885a6b26b894a98765fa3308c9e4b87f93625faecdb17c29a27cd243bf6030a67874ec9f2443cf8154261ac2a834c01cbe1f314ee7aa3ca552e1648cf8b42a63f249e3538026e09e44d69dc259adb0d1a0cbccb5a5dd5d0dccc90d023da79d5634188ff060f7e35a5f9d7ad99546824d63975d4452de876093f4e997dc46eedcd80a9eebf5e4f077fbb10c7d9e19a3419e7b845972a3b62613c5404a209b16fa88e0ff49d7b4f21fecc1f773c5b4be61021e0cab8602c6e8257649303aaeafcbb178e7a460ff07f219c46eb6fe5bf8113723e454003bd707767c107daf4255751daaf8decf35262640058924eb6587868b2c08230b317e97396ebc928ba8d274ca0eed0bfcb637676003c64e8c1e1a0420b6c96a44226061ced41b8448382abd2f3d0c472afcde231fbc9ee90c2f1132f8e2391246f95ad93354c7460e20de996ad0f61b13b27646887a637cede90b94b7d8c3130f0fe060e8d955c711a2700b302a75bdeb32a0a6802ea795cb114f5f82a1a381a86bbff88b299e47728b746dff964c94c52b661b9429376b1320b46081426b7c340206dc0da151bf84be2a49e78b6b5938753d2b1be8d9e67c43c5d70e72519f5f90d9f95e84ee38f82b191ac4d968b0a37901fd923cb289d585693ac3c3f8a94fca6df45e694e199a9cd0b1bc1fa7394bcc96aae670dca6605a998793b7e067ac410ba631057b8b76fcbe9524df820c02efef1608b743cd2aa6d60d3d8e476fa12d3acc329f8272b087d89471177ed531fec1f9c24a975ca2fcd8c246a33e291a3f00b7f234052067a0059c86762475256bb5e7dac6f121a0925506b18933c6e314915d4b3b2130aafc2483ef22ff8bb7b887565b1bd22fabca22037d8fc9437f675c5313526266f60bb7c7c47f30c7d567ed142ea5ec367c4298328d20e5344f01c0c90cf8a6302f4d84b6ba7495fba314a05ba29b63bb6d458fdb05a4411136958309f418fb178e19aa09ff9e62b29732fb2986c96e738f7a688cb2122dbb8f2ad9a5f28bc49ec0c462413552afee8e403259b55ad6dc334dde7f2d306929dd01f2aa6036cafd41874522689301b81c9e50e86828894140356db0a3317b081ed9d8148c41e77e6bda6287762532b86eb91f5480915680deb8a91fb8656b7f0109064865d2b846af0861f67d3f720d6e306540cd7b68f095ef3690b88ea93fb6a402ff5697597cda83171f159e85307d1a8c01611189bd4eb4f0453ab88d43ae181a562a76902a67c687514079d6f4304d9a7c0fa24b6e86074ea0a9fd8187c120312078f5ebfa674adc0303734bf8f6b5585943706594192ad24c9f7d9794fb83758924f862855ddd50bff58b522c43d73c03289baec628cd693cab93101b1e473b76532510e10f03e86812fea6f2d6f5467dcf29e6d7cf8524f383a0ded3f0951c3ffb171a6b8a6d97b5fa8899a19f1a3d0e934a1d4741076e4394ba225158f697bf7d5651717c6950229a0be22e8120d76a414edbcd03d505264b7ede8272ccbd6dbdcebaf11daf6a652f6f9eb74ba7a3ecc942892891388005ae5d971e4e79d696564906dffd44845b704a9abc2fa5ba1bb69a548423a08044ad6d0e365db7e6bea0f3844a452759716cb98dcf326001ec90c1c343174098cdf47ea2e13341058ca014d2a30e9ba3c526de72a6e387181bf76a278c9cbc518d8c374a3f1d9802a39464a100903dbec16f8f095f5d82d9d09507281e4f7fe0ce4fbeced193902a5f658af2a4c1d0952dabdc6ae5830b6b5a2c3f5b8d33a73665990822e5f4a7ce5366755a1615543bdf78299c71e890e0bedb6ec277b10a389d6a3ba9c037221421279e51ab50fb115de2076cc99444202e88ebd9d0fbe4e60234b7b761495ac6c9e615ddac8176164a88fb6d6cc2b52672c8949afe3efc1e87a598896bc93e421423844fcaafe65af898a015b3bcaf623ebeef9a57155af5278ceb52b995f7ca466d9e18b05e86380679e0257cff6d0c6750078462f2ee4701d6d8289ed848b877cf5918625b7937060d667c11119881c30809056892352c6c53c01e395af6866ea350e6f21fa3db772c1177c759999973b51e11ffc5908", 0x2000, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x8000}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) close(r8) 778.951323ms ago: executing program 2 (id=1373): r0 = socket$inet(0x10, 0x3, 0xc) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r5, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r6 = socket(0x1, 0x803, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x20}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000020002001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r9], 0x4c}}, 0x4000) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 280.501609ms ago: executing program 3 (id=1374): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000020340)={0x24, r2, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x25, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400c891}, 0x0) 226.358159ms ago: executing program 1 (id=1375): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r0, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='vm_unmapped_area\x00', r1}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='vm_unmapped_area\x00', r2}, 0x10) io_setup(0x3, &(0x7f0000000340)) r3 = socket(0x10, 0x803, 0x0) r4 = gettid() timer_create(0xb, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x80) ioctl$CEC_RECEIVE(r5, 0xc0386106, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x8000000, 0x0, 0x9, '&\x00', 0x0, 0xd3, 0x4a, 0x0, 0x0, 0x0, 0xe}) write(r3, &(0x7f0000000900)="2600000022004701050007008980e8ff02006d20002b1f00c0e9f7094a51f10101033500b088", 0x26) recvfrom$inet6(r3, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x3, @local}, 0x1c) read(r0, 0x0, 0x5d) write$ppp(r0, &(0x7f0000000200)="bc72", 0x2) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000000)=0x2180) 162.191416ms ago: executing program 3 (id=1376): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000080)=@v1={0x0, @aes128, 0x1, @desc1}) r1 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x8, 0x2, 0x7}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000003c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a40)=@delchain={0x30, 0x5f, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x5, 0x2}, {0x1, 0xe}}, [@filter_kind_options=@f_bpf={{0x8}, {0x4}}]}, 0x30}}, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r4, 0x4601, &(0x7f0000000240)={0x400, 0x30, 0xf0, 0x0, 0x0, 0x1f, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x7, 0x0, 0x5, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x16, 0x0, 0x0, 0x5}) 64.066724ms ago: executing program 5 (id=1377): syz_io_uring_setup(0x81f, &(0x7f0000000480)={0x0, 0x0, 0x800, 0x3, 0x34f}, &(0x7f00000000c0), &(0x7f0000000080)) (async) r0 = syz_io_uring_setup(0x81f, &(0x7f0000000480)={0x0, 0x0, 0x800, 0x3, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffff9, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1}) (async) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1}) mount(&(0x7f0000000280)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0)='hfsplus\x00', 0x8000, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000300)}, 0x20) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000440)=0x0, &(0x7f0000000500)=0x4) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f0000000540)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x98, 0x98, 0x5, [@union={0x1, 0x1, 0x0, 0x5, 0x0, 0x5, [{0x1, 0x4, 0x7}]}, @fwd={0xd}, @fwd={0x4}, @ptr={0xa, 0x0, 0x0, 0x2, 0x4}, @func={0x3, 0x0, 0x0, 0xc, 0x2}, @enum={0x5, 0x4, 0x0, 0x6, 0x4, [{0xc, 0xfffff74d}, {0x3, 0x9}, {0x9, 0x8}, {0x6, 0x7}]}, @enum64={0x10, 0x2, 0x0, 0x13, 0x1, 0x4, [{0x4, 0xfffffffe, 0xff}, {0x2, 0xd, 0x1}]}]}, {0x0, [0x5f, 0x61, 0x30]}}, &(0x7f0000000600)=""/29, 0xb5, 0x1d, 0x1, 0x4, 0x10000, @value}, 0x28) r6 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0)={0xffffffffffffffff}, 0x4) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = dup(r7) write$6lowpan_enable(r8, &(0x7f0000000000)='0', 0xfffffd2c) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x14, 0x5, &(0x7f0000000380)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @exit], &(0x7f00000003c0)='GPL\x00', 0xaf, 0x6, &(0x7f0000000400)=""/6, 0x41100, 0x32, '\x00', r4, @fallback=0x19, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000680)={0x5, 0x7, 0xe, 0x8}, 0x10, 0xffffffffffffffff, r6, 0x1, &(0x7f0000000700)=[r8], &(0x7f0000000740)=[{0x5, 0x3, 0xa, 0x6}], 0x10, 0xffffffff, @void, @value}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x14, 0x5, &(0x7f0000000380)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @exit], &(0x7f00000003c0)='GPL\x00', 0xaf, 0x6, &(0x7f0000000400)=""/6, 0x41100, 0x32, '\x00', r4, @fallback=0x19, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000680)={0x5, 0x7, 0xe, 0x8}, 0x10, 0xffffffffffffffff, r6, 0x1, &(0x7f0000000700)=[r8], &(0x7f0000000740)=[{0x5, 0x3, 0xa, 0x6}], 0x10, 0xffffffff, @void, @value}, 0x94) r9 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x82c81, 0x0) syz_open_procfs$userns(0x0, &(0x7f0000000240)) (async) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000240)) mount_setattr(r9, &(0x7f00000001c0)='./file0\x00', 0x8000, &(0x7f0000000280)={0x100000, 0x5, 0x180000, {r10}}, 0x20) io_uring_enter(r0, 0x47bc, 0x0, 0x21, 0x0, 0x0) (async) io_uring_enter(r0, 0x47bc, 0x0, 0x21, 0x0, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x40800, 0x1a0) (async) r11 = open$dir(&(0x7f0000000000)='./file0\x00', 0x40800, 0x1a0) mknodat$loop(r11, &(0x7f0000000040)='./file0\x00', 0x400, 0x1) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r0, 0x18, &(0x7f0000000100)={0x0, r0, 0x34, {0x1, 0x7f}, 0x8}, 0x1) 0s ago: executing program 3 (id=1378): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539esp(adiantum(lrw(serpent),aes-asm,ghash-ce-sync),sha512_m'}, 0x58) ioctl$TIOCMGET(r2, 0x541e, &(0x7f0000000040)) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) r5 = epoll_create(0x101) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000080)={0x40000014}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) rt_sigqueueinfo(0x0, 0xe, &(0x7f00000004c0)={0x22, 0x6, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRESDEC=0x0]) fsopen(&(0x7f0000000000)='autofs\x00', 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000600)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x3, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x1}, {0xa, 0x0, 0x5, @mcast2}}}, 0x48) write$RDMA_USER_CM_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x4}, 0xc) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000440)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x1, @remote, 0x6}, {0xa, 0x4e21, 0x4e00, @remote, 0xfffffffa}, 0xffffffffffffffff, 0x40}}, 0x48) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) clock_settime(0x0, &(0x7f0000000000)={0x77359400}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x8000850}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, 0x0, 0x40) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=000000000100000,', @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) kernel console output (not intermixed with test programs): bcdDevice=80.ea [ 306.765928][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.775417][ T24] usb 6-1: Product: syz [ 306.779690][ T24] usb 6-1: Manufacturer: syz [ 306.784712][ T24] usb 6-1: SerialNumber: syz [ 306.799260][ T24] usb 6-1: config 0 descriptor?? [ 306.808797][ T24] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 306.822253][ T24] usb 6-1: setting power ON [ 306.833175][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 306.847843][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 306.859380][ T24] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 306.868499][ T24] usb 6-1: media controller created [ 307.287242][ T8811] dvb-usb: bulk message failed: -22 (3/0) [ 307.293163][ T8811] usb 6-1: gpio_write failed. [ 307.297963][ T8811] dvb-usb: bulk message failed: -22 (3/0) [ 307.365447][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 307.489468][ T24] usb 6-1: selecting invalid altsetting 6 [ 307.496038][ T24] usb 6-1: digital interface selection failed (-22) [ 307.503109][ T24] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 307.512323][ T24] usb 6-1: setting power OFF [ 307.517018][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 307.523095][ T24] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 308.485192][ T24] (NULL device *): no alternate interface [ 309.539362][ T24] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 309.917110][ T8855] can0: slcan on pty23. [ 310.238432][ T5861] usb 6-1: USB disconnect, device number 7 [ 310.491689][ T8847] can0 (unregistered): slcan off pty23. [ 311.049498][ T8864] can0: slcan on pty29. [ 311.828802][ T8863] can0 (unregistered): slcan off pty29. [ 312.063195][ T8882] syz1: rxe_newlink: already configured on syz_tun [ 312.413049][ T8896] netlink: 20 bytes leftover after parsing attributes in process `syz.1.698'. [ 312.792205][ T5861] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 312.850598][ T5897] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 312.950610][ T24] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 313.331958][ T8913] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=8913 comm=syz.5.701 [ 313.915910][ T5897] usb 3-1: Using ep0 maxpacket: 8 [ 313.923091][ T5861] usb 4-1: Using ep0 maxpacket: 8 [ 313.930916][ T5897] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 313.943842][ T5897] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 313.953245][ T5897] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 313.961924][ T5897] usb 3-1: Product: syz [ 313.966127][ T5897] usb 3-1: Manufacturer: syz [ 314.254306][ T5897] usb 3-1: SerialNumber: syz [ 314.261408][ T5861] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 314.277849][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 314.285233][ T5861] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.300073][ T5861] usb 4-1: Product: syz [ 314.305117][ T5861] usb 4-1: Manufacturer: syz [ 314.311504][ T24] usb 5-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 314.320917][ T5861] usb 4-1: SerialNumber: syz [ 314.326854][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.336395][ T5861] usb 4-1: config 0 descriptor?? [ 314.345769][ T24] usb 5-1: Product: syz [ 314.349980][ T24] usb 5-1: Manufacturer: syz [ 314.358373][ T5861] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 314.374152][ T24] usb 5-1: SerialNumber: syz [ 314.380010][ T5861] usb 4-1: setting power ON [ 314.389073][ T5861] dvb-usb: bulk message failed: -22 (2/0) [ 314.395728][ T24] usb 5-1: config 0 descriptor?? [ 314.420012][ T24] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 314.431810][ T5861] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 314.442679][ T24] usb 5-1: setting power ON [ 314.448934][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 314.458864][ T5861] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 314.478019][ T5861] usb 4-1: media controller created [ 314.485287][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 314.501920][ T5869] usb 3-1: USB disconnect, device number 15 [ 314.515509][ T5861] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 314.537702][ T24] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 314.560825][ T8886] dvb-usb: bulk message failed: -22 (3/0) [ 314.566950][ T8886] usb 4-1: gpio_write failed. [ 314.573351][ T8886] dvb-usb: bulk message failed: -22 (3/0) [ 314.748529][ T8894] dvb-usb: bulk message failed: -22 (3/0) [ 314.755434][ T24] usb 5-1: media controller created [ 315.236015][ T5861] usb 4-1: selecting invalid altsetting 6 [ 315.256590][ T5861] usb 4-1: digital interface selection failed (-22) [ 315.265874][ T8935] 8021q: adding VLAN 0 to HW filter on device bond2 [ 315.270748][ T5861] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 315.655743][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 315.786039][ T5861] usb 4-1: setting power OFF [ 315.797027][ T5861] dvb-usb: bulk message failed: -22 (2/0) [ 315.813734][ T5861] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 315.827809][ T24] usb 5-1: selecting invalid altsetting 6 [ 315.835957][ T5861] (NULL device *): no alternate interface [ 315.836898][ T24] usb 5-1: digital interface selection failed (-22) [ 315.865144][ T24] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 315.865734][ T24] usb 5-1: setting power OFF [ 315.865757][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 315.865769][ T24] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 315.865777][ T24] (NULL device *): no alternate interface [ 315.996456][ T24] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 316.865152][ T5861] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 316.976023][ T24] usb 5-1: USB disconnect, device number 16 [ 316.984940][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.991317][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.008573][ T8958] rdma_rxe: rxe_newlink: failed to add syz_tun [ 317.485194][ T5861] usb 4-1: USB disconnect, device number 11 [ 317.800148][ T8968] netlink: 830 bytes leftover after parsing attributes in process `syz.4.713'. [ 317.941347][ T8973] netlink: 830 bytes leftover after parsing attributes in process `syz.5.714'. [ 319.645412][ T8994] netlink: 80 bytes leftover after parsing attributes in process `syz.3.720'. [ 319.690850][ T8994] netlink: 256 bytes leftover after parsing attributes in process `syz.3.720'. [ 319.700005][ T8994] netlink: 56 bytes leftover after parsing attributes in process `syz.3.720'. [ 320.671600][ T9] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 321.406467][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 321.421062][ T9] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 321.430242][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.440295][ T9016] netlink: 830 bytes leftover after parsing attributes in process `syz.1.727'. [ 321.440732][ T9] usb 6-1: Product: syz [ 321.455575][ T24] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 321.456289][ T9] usb 6-1: Manufacturer: syz [ 321.468156][ T9] usb 6-1: SerialNumber: syz [ 321.488380][ T9] usb 6-1: config 0 descriptor?? [ 321.594482][ T9] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 321.618396][ T9] usb 6-1: setting power ON [ 321.627062][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 321.691036][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 321.709055][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 321.760764][ T8990] dvb-usb: bulk message failed: -22 (3/0) [ 321.766584][ T8990] usb 6-1: gpio_write failed. [ 321.766910][ T9] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 321.771423][ T8990] dvb-usb: bulk message failed: -22 (3/0) [ 321.970610][ T9] usb 6-1: media controller created [ 322.053565][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 322.075158][ T24] usb 4-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 322.086273][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 322.100828][ T24] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 322.114093][ T24] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 322.128788][ T24] usb 4-1: Manufacturer: syz [ 322.146206][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 322.282575][ T24] usb 4-1: config 0 descriptor?? [ 322.312997][ T9] usb 6-1: selecting invalid altsetting 6 [ 322.335042][ T9] usb 6-1: digital interface selection failed (-22) [ 322.369282][ T9] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 322.420617][ T9] usb 6-1: setting power OFF [ 322.443429][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 322.853776][ T9] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 322.881334][ T9] (NULL device *): no alternate interface [ 322.935011][ T9] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 323.593427][ T9] usb 6-1: USB disconnect, device number 8 [ 323.620834][ T9040] binder: BINDER_SET_CONTEXT_MGR already set [ 323.643943][ T9040] binder: 9038:9040 ioctl 4018620d 200000000040 returned -16 [ 323.658502][ T9036] siw: device registration error -23 [ 323.677782][ T9040] binder: 9038:9040 ioctl c0306201 200000001a80 returned -11 [ 324.234051][ T9050] binder: BINDER_SET_CONTEXT_MGR already set [ 324.262412][ T9050] binder: 9049:9050 ioctl 4018620d 200000000040 returned -16 [ 324.273536][ T9050] binder: 9049:9050 ioctl c0306201 200000001a80 returned -11 [ 325.525086][ T971] usb 4-1: USB disconnect, device number 12 [ 326.587606][ T9072] netlink: 'syz.3.741': attribute type 1 has an invalid length. [ 326.887488][ T9077] 8021q: adding VLAN 0 to HW filter on device bond1 [ 326.914192][ T9072] bond0: entered promiscuous mode [ 326.919402][ T9072] bond_slave_0: entered promiscuous mode [ 326.925819][ T9072] bond_slave_1: entered promiscuous mode [ 326.933145][ T9072] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 326.942760][ T9072] bond1: (slave macvlan2): Enslaving as an active interface with an up link [ 327.028872][ T9087] netlink: 80 bytes leftover after parsing attributes in process `syz.5.747'. [ 327.042191][ T9087] netlink: 256 bytes leftover after parsing attributes in process `syz.5.747'. [ 327.051990][ T9087] netlink: 56 bytes leftover after parsing attributes in process `syz.5.747'. [ 327.090622][ T81] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 327.340597][ T81] usb 2-1: Using ep0 maxpacket: 8 [ 327.395367][ T81] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 327.715761][ T81] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.775940][ T81] usb 2-1: Product: syz [ 327.785015][ T81] usb 2-1: Manufacturer: syz [ 327.796413][ T81] usb 2-1: SerialNumber: syz [ 327.822006][ T81] usb 2-1: config 0 descriptor?? [ 327.845913][ T9096] binder: 9095:9096 ioctl c0306201 200000001a80 returned -11 [ 327.847991][ T81] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 327.875346][ T81] usb 2-1: setting power ON [ 327.884088][ T81] dvb-usb: bulk message failed: -22 (2/0) [ 327.901749][ T81] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 327.920816][ T81] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 328.101724][ T9083] dvb-usb: bulk message failed: -22 (3/0) [ 328.107496][ T9083] usb 2-1: gpio_write failed. [ 328.112275][ T9083] dvb-usb: bulk message failed: -22 (3/0) [ 328.889133][ T81] usb 2-1: media controller created [ 328.909436][ T81] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 329.460981][ T81] usb 2-1: selecting invalid altsetting 6 [ 329.485461][ T81] usb 2-1: digital interface selection failed (-22) [ 329.493880][ T81] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 329.516323][ T81] usb 2-1: setting power OFF [ 329.533930][ T81] dvb-usb: bulk message failed: -22 (2/0) [ 329.548674][ T81] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 329.562991][ T81] (NULL device *): no alternate interface [ 329.800682][ T9] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 330.087010][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 330.199123][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 330.244820][ T9] usb 4-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 330.273729][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 330.292993][ T9] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 330.313002][ T9] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 330.339447][ T9] usb 4-1: Manufacturer: syz [ 330.359162][ T9] usb 4-1: config 0 descriptor?? [ 330.467421][ T81] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 330.486167][ T81] usb 2-1: USB disconnect, device number 15 [ 330.674590][ T9124] netlink: 830 bytes leftover after parsing attributes in process `syz.2.757'. [ 330.803475][ T9133] binder: 9132:9133 ioctl c0306201 200000001a80 returned -11 [ 334.909844][ T81] usb 4-1: USB disconnect, device number 13 [ 336.072515][ T1547] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 336.314792][ T9170] rdma_rxe: rxe_newlink: failed to add syz_tun [ 336.703224][ T1547] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 336.715770][ T1547] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 336.728488][ T1547] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 336.745913][ T1547] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 336.762395][ T81] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 336.792210][ T1547] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 336.809163][ T1547] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 336.825890][ T1547] usb 3-1: Manufacturer: syz [ 336.841192][ T1547] usb 3-1: config 0 descriptor?? [ 336.970770][ T81] usb 4-1: Using ep0 maxpacket: 8 [ 336.991035][ T81] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 337.025353][ T81] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.051318][ T81] usb 4-1: Product: syz [ 337.145663][ T81] usb 4-1: Manufacturer: syz [ 337.181778][ T81] usb 4-1: SerialNumber: syz [ 337.319395][ T81] usb 4-1: config 0 descriptor?? [ 337.457615][ T81] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 337.515424][ T81] usb 4-1: setting power ON [ 337.542638][ T81] dvb-usb: bulk message failed: -22 (2/0) [ 337.668109][ T81] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 337.681705][ T81] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 337.684083][ T9183] binder: 9181:9183 ioctl c0306201 200000001a80 returned -11 [ 337.690189][ T81] usb 4-1: media controller created [ 338.528281][ T81] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 338.572840][ T81] usb 4-1: selecting invalid altsetting 6 [ 338.578590][ T81] usb 4-1: digital interface selection failed (-22) [ 338.594730][ T81] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 338.618450][ T81] usb 4-1: setting power OFF [ 338.665064][ T81] dvb-usb: bulk message failed: -22 (2/0) [ 338.684485][ T81] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 338.711055][ T81] (NULL device *): no alternate interface [ 338.762582][ T1547] rc_core: IR keymap rc-hauppauge not found [ 338.785361][ T81] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 338.799536][ T1547] Registered IR keymap rc-empty [ 338.817053][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 338.856743][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 339.112362][ T1547] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 339.467737][ T1547] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input15 [ 339.482838][ T971] usb 4-1: USB disconnect, device number 14 [ 340.023549][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 340.033984][ T9211] binder: 9208:9211 ioctl c0306201 200000001a80 returned -11 [ 340.060703][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 340.270631][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 340.395022][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 341.180637][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 341.371178][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 341.410973][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 341.449727][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 341.482895][ T9228] rdma_rxe: rxe_newlink: failed to add syz_tun [ 342.280551][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 342.364493][ T1547] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 342.739390][ T1547] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 342.747476][ T1547] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 342.770850][ T1547] usb 3-1: USB disconnect, device number 16 [ 347.763940][ T9286] can0: slcan on pty23. [ 348.281622][ T81] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 348.621473][ T9282] can0 (unregistered): slcan off pty23. [ 348.835888][ T81] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 348.846399][ T81] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 348.890621][ T1547] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 348.990467][ T81] usb 6-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 349.012585][ T81] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 349.488673][ T81] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 349.520113][ T81] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 349.540469][ T81] usb 6-1: Manufacturer: syz [ 349.552546][ T81] usb 6-1: config 0 descriptor?? [ 349.563045][ T1547] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 349.574606][ T1547] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 349.636336][ T1547] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 349.649567][ T1547] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 349.667785][ T1547] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 349.680485][ T1547] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 349.688889][ T1547] usb 5-1: Manufacturer: syz [ 349.705610][ T1547] usb 5-1: config 0 descriptor?? [ 349.847998][ T9309] rdma_rxe: rxe_newlink: failed to add syz_tun [ 349.856113][ T9310] netlink: 'syz.3.802': attribute type 1 has an invalid length. [ 349.863987][ T9310] netlink: 'syz.3.802': attribute type 2 has an invalid length. [ 349.874940][ T9310] netlink: 'syz.3.802': attribute type 1 has an invalid length. [ 349.882767][ T9310] netlink: 'syz.3.802': attribute type 2 has an invalid length. [ 350.623529][ T9315] siw: device registration error -23 [ 350.958064][ T9319] siw: device registration error -23 [ 351.450692][ T1547] rc_core: IR keymap rc-hauppauge not found [ 352.006191][ T1547] Registered IR keymap rc-empty [ 352.016581][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 352.130006][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 352.321309][ T1547] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 352.452778][ T1547] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input16 [ 352.483688][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 353.061644][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 353.115500][ T81] usb 6-1: USB disconnect, device number 9 [ 353.131048][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 353.161160][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 353.180666][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 353.359149][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 353.372776][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 354.336328][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 354.351068][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 354.380770][ T1547] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 354.390626][ T9180] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 354.402719][ T1547] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 355.431699][ T1547] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 355.450151][ T1547] usb 5-1: USB disconnect, device number 17 [ 355.672149][ T9180] usb 4-1: Using ep0 maxpacket: 8 [ 355.683583][ T9180] usb 4-1: device descriptor read/all, error -71 [ 356.895347][ T9369] can0: slcan on pty31. [ 357.057554][ T1547] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 357.142136][ T9350] can0 (unregistered): slcan off pty31. [ 357.670611][ T1547] usb 5-1: Using ep0 maxpacket: 8 [ 357.704656][ T1547] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 357.725406][ T1547] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 357.849726][ T1547] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 357.879556][ T1547] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.923449][ T1547] usb 5-1: Product: syz [ 357.927650][ T1547] usb 5-1: Manufacturer: syz [ 358.065437][ T1547] usb 5-1: SerialNumber: syz [ 358.077415][ T1547] usb 5-1: bad CDC descriptors [ 358.284819][ T54] Bluetooth: hci5: command 0x0405 tx timeout [ 358.392527][ T971] usb 5-1: USB disconnect, device number 18 [ 358.524997][ T9402] netlink: 4 bytes leftover after parsing attributes in process `syz.1.824'. [ 359.807585][ T9180] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 359.990912][ T9180] usb 5-1: Using ep0 maxpacket: 8 [ 360.007875][ T9180] usb 5-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 360.048592][ T9180] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.069518][ T9180] usb 5-1: Product: syz [ 360.143295][ T9180] usb 5-1: Manufacturer: syz [ 360.143457][ T9180] usb 5-1: SerialNumber: syz [ 360.222892][ T9180] usb 5-1: config 0 descriptor?? [ 360.297013][ T9180] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 361.064458][ T9180] usb 5-1: setting power ON [ 361.069920][ T9180] dvb-usb: bulk message failed: -22 (2/0) [ 361.116423][ T9180] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 361.282275][ T9180] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 361.610697][ T9180] usb 5-1: media controller created [ 361.646822][ T9180] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 361.664545][ T9180] usb 5-1: selecting invalid altsetting 6 [ 361.670280][ T9180] usb 5-1: digital interface selection failed (-22) [ 361.677154][ T9180] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 361.694650][ T9180] usb 5-1: setting power OFF [ 361.710186][ T9180] dvb-usb: bulk message failed: -22 (2/0) [ 361.740603][ T9180] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 361.759143][ T9180] (NULL device *): no alternate interface [ 362.447713][ T9180] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 362.592739][ T9180] usb 5-1: USB disconnect, device number 19 [ 362.757349][ T9461] netlink: 'syz.4.836': attribute type 1 has an invalid length. [ 362.757385][ T9461] netlink: 'syz.4.836': attribute type 2 has an invalid length. [ 363.237447][ T9471] can0: slcan on pty25. [ 363.869696][ T9473] can1: slcan on pty31. [ 364.627626][ T9479] binder: 9478:9479 ioctl c0306201 200000001a80 returned -11 [ 364.791452][ T9464] can0 (unregistered): slcan off pty25. [ 364.871617][ T9466] can1 (unregistered): slcan off pty31. [ 365.528632][ T30] audit: type=1400 audit(1746789984.734:427): avc: denied { unmount } for pid=5824 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 365.710688][ T5931] usb 6-1: new full-speed USB device number 10 using dummy_hcd [ 366.030407][ T9502] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=9502 comm=syz.4.846 [ 366.481062][ T5931] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 366.505911][ T5931] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 366.636999][ T5931] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 366.664958][ T5931] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 366.777268][ T5931] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 366.822591][ T5931] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 366.866663][ T5931] usb 6-1: Manufacturer: syz [ 366.872438][ T9504] netlink: 'syz.4.849': attribute type 1 has an invalid length. [ 366.915172][ T5931] usb 6-1: config 0 descriptor?? [ 367.300077][ T9512] siw: device registration error -23 [ 367.861257][ T5931] rc_core: IR keymap rc-hauppauge not found [ 367.867199][ T5931] Registered IR keymap rc-empty [ 367.880854][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 367.920636][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.031384][ T5931] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 368.052561][ T5931] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input17 [ 368.083369][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.131222][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.571507][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.601062][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.621535][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.655112][ T9531] netlink: 'syz.1.856': attribute type 1 has an invalid length. [ 368.663356][ T9531] netlink: 'syz.1.856': attribute type 2 has an invalid length. [ 368.667672][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.674481][ T9531] netlink: 'syz.1.856': attribute type 1 has an invalid length. [ 368.691406][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.720640][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.760778][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.782494][ T5931] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 368.957614][ T5931] mceusb 6-1:0.0: Registered with mce emulator interface version 1 [ 368.967377][ T5931] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 369.010854][ T24] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 369.090298][ T9542] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=9542 comm=syz.1.859 [ 369.511218][ T5931] usb 6-1: USB disconnect, device number 10 [ 369.724249][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 369.793725][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 369.860606][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 369.878887][ T24] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 369.880734][ T9539] netlink: 830 bytes leftover after parsing attributes in process `syz.2.861'. [ 369.912704][ T9546] rdma_rxe: rxe_newlink: failed to add syz_tun [ 369.939601][ T24] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 369.965939][ T24] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 369.986176][ T24] usb 5-1: Manufacturer: syz [ 370.011335][ T24] usb 5-1: config 0 descriptor?? [ 370.845355][ T9557] siw: device registration error -23 [ 371.552507][ T24] rc_core: IR keymap rc-hauppauge not found [ 371.558456][ T24] Registered IR keymap rc-empty [ 371.581582][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 371.624877][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 371.654483][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 371.693088][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input18 [ 371.978354][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 372.014134][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 372.054023][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 372.090701][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 372.110674][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 372.248221][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 372.281911][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 372.310657][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 372.340696][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 372.621816][ T24] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 372.795801][ T24] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 372.846200][ T24] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 373.100686][ T24] usb 5-1: USB disconnect, device number 20 [ 376.963839][ T9631] syz1: rxe_newlink: already configured on syz_tun [ 378.102721][ T9651] netlink: 830 bytes leftover after parsing attributes in process `syz.3.888'. [ 378.218521][ T9655] netlink: 28 bytes leftover after parsing attributes in process `syz.3.890'. [ 378.439303][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.449829][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.660916][ T9] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 379.462391][ T9] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 379.490308][ T9] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 379.520884][ T9] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 379.539857][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.854763][ T9679] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=8192 sclass=netlink_xfrm_socket pid=9679 comm=syz.2.896 [ 380.701757][ T9] usb 2-1: usb_control_msg returned -32 [ 381.093587][ T9] usbtmc 2-1:16.0: can't read capabilities [ 381.231508][ T30] audit: type=1326 audit(1746790000.444:428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9680 comm="syz.2.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65afd8e969 code=0x7fc00000 [ 381.403214][ T9686] team0: Cannot enslave team device to itself [ 381.606865][ T30] audit: type=1326 audit(1746790000.804:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9680 comm="syz.2.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65afd8e969 code=0x7fc00000 [ 381.741548][ T9] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 382.302307][ T10] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 382.329478][ T5861] usb 2-1: USB disconnect, device number 16 [ 382.370994][ T9] usb 6-1: device descriptor read/64, error -71 [ 382.473109][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 382.914645][ T9709] netlink: 'syz.2.906': attribute type 2 has an invalid length. [ 383.052471][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 383.064237][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 383.073931][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 383.088130][ T10] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 383.100594][ T9] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 383.108267][ T10] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 383.118977][ T10] usb 5-1: Manufacturer: syz [ 383.132830][ T10] usb 5-1: config 0 descriptor?? [ 383.428152][ T9] usb 6-1: device descriptor read/64, error -71 [ 383.961431][ T30] audit: type=1400 audit(1746790002.804:430): avc: denied { sqpoll } for pid=9712 comm="syz.2.908" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 383.999706][ T9] usb usb6-port1: attempt power cycle [ 384.199919][ T9719] siw: device registration error -23 [ 384.557729][ T9722] netlink: 16 bytes leftover after parsing attributes in process `syz.1.910'. [ 384.626483][ T9722] netlink: 16 bytes leftover after parsing attributes in process `syz.1.910'. [ 385.830570][ T10] rc_core: IR keymap rc-hauppauge not found [ 385.836515][ T10] Registered IR keymap rc-empty [ 385.856232][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 385.920807][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 385.992338][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 386.025295][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input19 [ 386.060989][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 386.084537][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 386.222760][ T5861] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 386.405543][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 386.580678][ T5861] usb 3-1: Using ep0 maxpacket: 8 [ 386.621538][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 386.773195][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 386.915287][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 386.980464][ T5861] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 386.989633][ T5861] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.000557][ T5861] usb 3-1: Product: syz [ 387.000764][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 387.004721][ T5861] usb 3-1: Manufacturer: syz [ 387.004740][ T5861] usb 3-1: SerialNumber: syz [ 387.034381][ T5861] usb 3-1: config 0 descriptor?? [ 387.057653][ T5861] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 387.080810][ T5861] usb 3-1: setting power ON [ 387.085352][ T5861] dvb-usb: bulk message failed: -22 (2/0) [ 387.130670][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 387.170653][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 387.200774][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 387.302552][ T10] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 387.744079][ T5861] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 387.754191][ T10] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 387.779557][ T5861] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 388.102288][ T5861] usb 3-1: media controller created [ 388.314461][ T10] usb 5-1: USB disconnect, device number 21 [ 388.382908][ T5861] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 388.627799][ T5861] usb 3-1: selecting invalid altsetting 6 [ 388.637394][ T5861] usb 3-1: digital interface selection failed (-22) [ 388.647864][ T5861] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 388.664474][ T5861] usb 3-1: setting power OFF [ 388.676315][ T5861] dvb-usb: bulk message failed: -22 (2/0) [ 388.719977][ T5861] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 388.774225][ T5861] (NULL device *): no alternate interface [ 389.109968][ T5861] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 389.429162][ T24] usb 3-1: USB disconnect, device number 17 [ 389.504980][ T10] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 389.805843][ T5818] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 390.159040][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 390.170187][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 390.200103][ T10] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 390.219469][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 390.253382][ T10] usb 6-1: config 0 descriptor?? [ 390.936874][ T10] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 391.242839][ T9779] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 391.320060][ T10] cp2112 0003:10C4:EA90.0003: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.5-1/input0 [ 391.353567][ T9779] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 391.379761][ T9779] netlink: 32 bytes leftover after parsing attributes in process `syz.5.929'. [ 391.389417][ T9779] netlink: 32 bytes leftover after parsing attributes in process `syz.5.929'. [ 391.399109][ T9779] netlink: 32 bytes leftover after parsing attributes in process `syz.5.929'. [ 391.408530][ T9779] netlink: 32 bytes leftover after parsing attributes in process `syz.5.929'. [ 391.456237][ T10] cp2112 0003:10C4:EA90.0003: error requesting version [ 391.494947][ T10] cp2112 0003:10C4:EA90.0003: probe with driver cp2112 failed with error -71 [ 391.523949][ T10] usb 6-1: USB disconnect, device number 14 [ 397.220570][ T24] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 397.508208][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 397.530597][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 397.560740][ T24] usb 4-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 397.584741][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 397.604859][ T24] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 397.620758][ T24] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 397.639003][ T24] usb 4-1: Manufacturer: syz [ 397.647471][ T24] usb 4-1: config 0 descriptor?? [ 398.536400][ T9904] FAULT_INJECTION: forcing a failure. [ 398.536400][ T9904] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 398.574075][ T9904] CPU: 1 UID: 0 PID: 9904 Comm: syz.2.966 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 398.574105][ T9904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 398.574127][ T9904] Call Trace: [ 398.574134][ T9904] [ 398.574141][ T9904] dump_stack_lvl+0x16c/0x1f0 [ 398.574172][ T9904] should_fail_ex+0x512/0x640 [ 398.574201][ T9904] _copy_to_user+0x32/0xd0 [ 398.574229][ T9904] simple_read_from_buffer+0xcb/0x170 [ 398.574259][ T9904] proc_fail_nth_read+0x197/0x270 [ 398.574286][ T9904] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 398.574320][ T9904] ? rw_verify_area+0xcf/0x680 [ 398.574342][ T9904] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 398.574369][ T9904] vfs_read+0x1de/0xc70 [ 398.574397][ T9904] ? __pfx___mutex_lock+0x10/0x10 [ 398.574421][ T9904] ? __pfx_vfs_read+0x10/0x10 [ 398.574453][ T9904] ? __fget_files+0x20e/0x3c0 [ 398.574489][ T9904] ksys_read+0x12a/0x240 [ 398.574514][ T9904] ? __pfx_ksys_read+0x10/0x10 [ 398.574537][ T9904] ? rcu_is_watching+0x12/0xc0 [ 398.574566][ T9904] do_syscall_64+0xcd/0x260 [ 398.574592][ T9904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.574612][ T9904] RIP: 0033:0x7f65afd8d37c [ 398.574627][ T9904] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 398.574645][ T9904] RSP: 002b:00007f65b0bdf030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 398.574666][ T9904] RAX: ffffffffffffffda RBX: 00007f65affb5fa0 RCX: 00007f65afd8d37c [ 398.574679][ T9904] RDX: 000000000000000f RSI: 00007f65b0bdf0a0 RDI: 0000000000000004 [ 398.574690][ T9904] RBP: 00007f65b0bdf090 R08: 0000000000000000 R09: 0000000000000000 [ 398.574701][ T9904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 398.574712][ T9904] R13: 0000000000000000 R14: 00007f65affb5fa0 R15: 00007fff2f147c68 [ 398.574738][ T9904] [ 399.293768][ T9910] siw: device registration error -23 [ 399.522256][ T9920] can0: slcan on pty25. [ 400.250830][ T9911] can0 (unregistered): slcan off pty25. [ 401.030616][ T5861] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 402.017802][ T5861] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 402.060250][ T5861] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 402.098537][ T5869] usb 4-1: USB disconnect, device number 17 [ 402.138028][ T9959] netlink: 24 bytes leftover after parsing attributes in process `syz.4.976'. [ 402.139505][ T30] audit: type=1400 audit(1746790021.344:431): avc: denied { write } for pid=9955 comm="syz.1.975" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 402.147723][ T9957] audit: audit_lost=2 audit_rate_limit=0 audit_backlog_limit=64 [ 402.175041][ T5861] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 402.175073][ T5861] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 402.175096][ T5861] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 402.189991][ T5861] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 402.215549][ T9957] audit: out of memory in audit_log_start [ 402.381801][ T5861] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 402.390067][ T5861] usb 6-1: Product: syz [ 402.927322][ T5861] usb 6-1: Manufacturer: syz [ 402.932313][ T5861] usb 6-1: SerialNumber: syz [ 403.149097][ T5861] usb 6-1: config 0 descriptor?? [ 403.688337][ T5861] radio-si470x 6-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 403.749189][ T9988] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 403.795140][ T9990] can0: slcan on pty27. [ 403.940545][ T5861] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -5 [ 404.181741][ T5861] usb 6-1: USB disconnect, device number 15 [ 404.201910][ T9976] can0 (unregistered): slcan off pty27. [ 405.455655][T10020] netlink: 830 bytes leftover after parsing attributes in process `syz.5.988'. [ 405.852999][ T5869] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 406.020851][ T5869] usb 4-1: device descriptor read/64, error -71 [ 406.670918][ T5869] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 406.840631][ T5869] usb 4-1: device descriptor read/64, error -71 [ 407.059916][ T5869] usb usb4-port1: attempt power cycle [ 408.110767][ T5931] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 408.118455][ T5869] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 408.131244][ T5869] usb 4-1: device descriptor read/8, error -71 [ 408.382116][T10063] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1000'. [ 408.391131][ T5869] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 408.421214][ T5869] usb 4-1: device descriptor read/8, error -71 [ 408.432339][ T5931] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 408.460125][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 408.493596][ T5931] usb 2-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 408.520720][ T5931] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 408.548689][ T5931] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 408.568235][ T5931] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 408.586921][ T5931] usb 2-1: Manufacturer: syz [ 408.606334][ T5869] usb usb4-port1: unable to enumerate USB device [ 408.654313][ T5931] usb 2-1: config 0 descriptor?? [ 409.124790][ T30] audit: type=1400 audit(1746790028.334:432): avc: denied { append } for pid=10069 comm="syz.3.1003" name="event0" dev="devtmpfs" ino=918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 409.149496][ T5869] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 409.246395][T10070] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1003'. [ 409.280648][ T5869] usb 6-1: device descriptor read/64, error -71 [ 409.550738][ T5869] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 410.526666][ T5818] Bluetooth: hci5: command 0x0405 tx timeout [ 410.853079][ T5869] usb 6-1: device descriptor read/64, error -71 [ 410.993048][ T5869] usb usb6-port1: attempt power cycle [ 411.041193][T10086] siw: device registration error -23 [ 411.161652][ T5815] Bluetooth: hci1: command 0x0406 tx timeout [ 411.355700][ T5869] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 411.524075][ T5869] usb 6-1: device descriptor read/8, error -71 [ 411.985818][T10096] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1009'. [ 412.199727][ T5861] usb 2-1: USB disconnect, device number 17 [ 413.024726][T10112] FAULT_INJECTION: forcing a failure. [ 413.024726][T10112] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 413.149427][T10112] CPU: 1 UID: 0 PID: 10112 Comm: syz.3.1013 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 413.149454][T10112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 413.149464][T10112] Call Trace: [ 413.149469][T10112] [ 413.149476][T10112] dump_stack_lvl+0x16c/0x1f0 [ 413.149504][T10112] should_fail_ex+0x512/0x640 [ 413.149529][T10112] _copy_to_user+0x32/0xd0 [ 413.149554][T10112] simple_read_from_buffer+0xcb/0x170 [ 413.149582][T10112] proc_fail_nth_read+0x197/0x270 [ 413.149605][T10112] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 413.149631][T10112] ? rw_verify_area+0xcf/0x680 [ 413.149651][T10112] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 413.149674][T10112] vfs_read+0x1de/0xc70 [ 413.149701][T10112] ? __pfx___mutex_lock+0x10/0x10 [ 413.149724][T10112] ? __pfx_vfs_read+0x10/0x10 [ 413.149754][T10112] ? __fget_files+0x20e/0x3c0 [ 413.149786][T10112] ksys_read+0x12a/0x240 [ 413.149809][T10112] ? __pfx_ksys_read+0x10/0x10 [ 413.149841][T10112] do_syscall_64+0xcd/0x260 [ 413.149867][T10112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 413.149885][T10112] RIP: 0033:0x7fe76398d37c [ 413.149900][T10112] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 413.149917][T10112] RSP: 002b:00007fe76489a030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 413.149934][T10112] RAX: ffffffffffffffda RBX: 00007fe763bb6080 RCX: 00007fe76398d37c [ 413.149946][T10112] RDX: 000000000000000f RSI: 00007fe76489a0a0 RDI: 0000000000000005 [ 413.149958][T10112] RBP: 00007fe76489a090 R08: 0000000000000000 R09: 0000000000000000 [ 413.149968][T10112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 413.149979][T10112] R13: 0000000000000000 R14: 00007fe763bb6080 R15: 00007ffe4f19a698 [ 413.150004][T10112] [ 414.511165][ T30] audit: type=1400 audit(1746790033.674:433): avc: denied { append } for pid=10133 comm="syz.2.1020" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 415.853571][ T30] audit: type=1400 audit(1746790035.054:434): avc: denied { mount } for pid=10153 comm="syz.4.1025" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 415.899271][ T30] audit: type=1400 audit(1746790035.064:435): avc: denied { mounton } for pid=10153 comm="syz.4.1025" path="/220/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 415.921740][ T30] audit: type=1400 audit(1746790035.084:436): avc: denied { name_bind } for pid=10153 comm="syz.4.1025" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 415.990020][ T30] audit: type=1400 audit(1746790035.194:437): avc: denied { unmount } for pid=5824 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 417.187923][ T971] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 417.590642][ T971] usb 6-1: Using ep0 maxpacket: 8 [ 417.631801][ T971] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 417.960580][ T971] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.968608][ T971] usb 6-1: Product: syz [ 417.981071][ T971] usb 6-1: Manufacturer: syz [ 417.985698][ T971] usb 6-1: SerialNumber: syz [ 418.011091][ T971] usb 6-1: config 0 descriptor?? [ 418.089331][ T30] audit: type=1400 audit(1746790037.274:438): avc: denied { module_request } for pid=10181 comm="syz.4.1033" kmod="can-proto-5" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 418.102217][ T971] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 418.156470][ T971] usb 6-1: setting power ON [ 418.180842][ T971] dvb-usb: bulk message failed: -22 (2/0) [ 418.260364][ T971] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 418.335713][T10182] can: request_module (can-proto-5) failed. [ 418.356359][ T971] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 418.468441][ T30] audit: type=1400 audit(1746790037.674:439): avc: denied { map } for pid=10181 comm="syz.4.1033" path="socket:[23205]" dev="sockfs" ino=23205 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 418.492736][ T971] usb 6-1: media controller created [ 418.523019][ T971] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 418.542193][T10194] lo speed is unknown, defaulting to 1000 [ 418.726402][ T971] usb 6-1: selecting invalid altsetting 6 [ 418.732337][ T971] usb 6-1: digital interface selection failed (-22) [ 418.738948][ T971] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 418.750961][ T971] usb 6-1: setting power OFF [ 418.755593][ T971] dvb-usb: bulk message failed: -22 (2/0) [ 418.762897][ T971] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 418.772741][ T971] (NULL device *): no alternate interface [ 418.801946][ T971] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 418.821466][ T971] usb 6-1: USB disconnect, device number 20 [ 419.009217][ T30] audit: type=1400 audit(1746790038.204:440): avc: denied { bind } for pid=10200 comm="syz.2.1036" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 419.144813][ T30] audit: type=1400 audit(1746790038.254:441): avc: denied { read } for pid=10200 comm="syz.2.1036" dev="sockfs" ino=23213 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 419.203227][ T30] audit: type=1400 audit(1746790038.264:442): avc: denied { bind } for pid=10200 comm="syz.2.1036" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 419.229671][T10205] can0: slcan on pty27. [ 419.421085][T10185] can0 (unregistered): slcan off pty27. [ 420.447736][T10224] cgroup: Name too long [ 420.500837][ T30] audit: type=1400 audit(1746790039.654:443): avc: denied { getopt } for pid=10220 comm="syz.4.1042" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 421.187072][ T30] audit: type=1400 audit(1746790040.394:444): avc: denied { read } for pid=10229 comm="syz.1.1044" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 421.222141][ T30] audit: type=1400 audit(1746790040.394:445): avc: denied { ioctl } for pid=10229 comm="syz.1.1044" path="/dev/rtc0" dev="devtmpfs" ino=921 ioctlcmd=0x7003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 423.131559][T10257] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1051'. [ 423.153080][T10257] netlink: 5 bytes leftover after parsing attributes in process `syz.3.1051'. [ 423.227962][ T30] audit: type=1400 audit(1746790042.434:446): avc: denied { create } for pid=10255 comm="syz.5.1052" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 423.315721][T10257] macsec1: entered promiscuous mode [ 423.355742][ T30] audit: type=1400 audit(1746790042.484:447): avc: denied { write } for pid=10255 comm="syz.5.1052" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 424.153556][ T1547] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 424.164947][T10269] FAULT_INJECTION: forcing a failure. [ 424.164947][T10269] name failslab, interval 1, probability 0, space 0, times 0 [ 424.184179][T10269] CPU: 1 UID: 0 PID: 10269 Comm: syz.3.1057 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 424.184206][T10269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 424.184216][T10269] Call Trace: [ 424.184222][T10269] [ 424.184229][T10269] dump_stack_lvl+0x16c/0x1f0 [ 424.184258][T10269] should_fail_ex+0x512/0x640 [ 424.184280][T10269] ? __kmalloc_node_noprof+0xc5/0x500 [ 424.184301][T10269] should_failslab+0xc2/0x120 [ 424.184320][T10269] __kmalloc_node_noprof+0xd8/0x500 [ 424.184339][T10269] ? __vmalloc_node_range_noprof+0x3eb/0x1540 [ 424.184368][T10269] __vmalloc_node_range_noprof+0x3eb/0x1540 [ 424.184402][T10269] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 424.184428][T10269] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 424.184454][T10269] ? find_held_lock+0x2b/0x80 [ 424.184484][T10269] ? __fget_files+0x204/0x3c0 [ 424.184513][T10269] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 424.184539][T10269] __vmalloc_noprof+0x6d/0x90 [ 424.184563][T10269] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 424.184582][T10269] bpf_prog_alloc_no_stats+0x54/0x630 [ 424.184604][T10269] bpf_prog_alloc+0x3b/0x230 [ 424.184624][T10269] bpf_prog_load+0x14ea/0x2490 [ 424.184646][T10269] ? avc_has_perm_noaudit+0x117/0x3b0 [ 424.184669][T10269] ? __pfx_bpf_prog_load+0x10/0x10 [ 424.184688][T10269] ? avc_has_perm_noaudit+0x149/0x3b0 [ 424.184724][T10269] ? selinux_bpf+0xde/0x130 [ 424.184742][T10269] ? bpf_lsm_bpf+0x9/0x10 [ 424.184769][T10269] __sys_bpf+0x433c/0x4d80 [ 424.184795][T10269] ? __pfx___sys_bpf+0x10/0x10 [ 424.184816][T10269] ? ksys_write+0x190/0x240 [ 424.184845][T10269] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 424.184887][T10269] ? fput+0x70/0xf0 [ 424.184906][T10269] ? ksys_write+0x1b9/0x240 [ 424.184930][T10269] ? __pfx_ksys_write+0x10/0x10 [ 424.184953][T10269] ? rcu_is_watching+0x12/0xc0 [ 424.184978][T10269] __x64_sys_bpf+0x78/0xc0 [ 424.185000][T10269] ? lockdep_hardirqs_on+0x7c/0x110 [ 424.185022][T10269] do_syscall_64+0xcd/0x260 [ 424.185047][T10269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.185066][T10269] RIP: 0033:0x7fe76398e969 [ 424.185082][T10269] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 424.185099][T10269] RSP: 002b:00007fe7648bb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 424.185117][T10269] RAX: ffffffffffffffda RBX: 00007fe763bb5fa0 RCX: 00007fe76398e969 [ 424.185129][T10269] RDX: 0000000000000094 RSI: 0000200000000c00 RDI: 0000000000000005 [ 424.185140][T10269] RBP: 00007fe7648bb090 R08: 0000000000000000 R09: 0000000000000000 [ 424.185152][T10269] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 424.185162][T10269] R13: 0000000000000000 R14: 00007fe763bb5fa0 R15: 00007ffe4f19a698 [ 424.185188][T10269] [ 424.185492][T10269] syz.3.1057: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 424.509489][T10269] CPU: 1 UID: 0 PID: 10269 Comm: syz.3.1057 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 424.509519][T10269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 424.509529][T10269] Call Trace: [ 424.509536][T10269] [ 424.509543][T10269] dump_stack_lvl+0x16c/0x1f0 [ 424.509573][T10269] warn_alloc+0x248/0x3a0 [ 424.509603][T10269] ? __pfx_warn_alloc+0x10/0x10 [ 424.509627][T10269] ? dump_stack_lvl+0x1a1/0x1f0 [ 424.509658][T10269] ? rcu_is_watching+0x12/0xc0 [ 424.509686][T10269] ? __kmalloc_node_noprof+0x23b/0x500 [ 424.509711][T10269] __vmalloc_node_range_noprof+0x1110/0x1540 [ 424.509747][T10269] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 424.509772][T10269] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 424.509798][T10269] ? find_held_lock+0x2b/0x80 [ 424.509820][T10269] ? __fget_files+0x204/0x3c0 [ 424.509849][T10269] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 424.509867][T10269] __vmalloc_noprof+0x6d/0x90 [ 424.509891][T10269] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 424.509910][T10269] bpf_prog_alloc_no_stats+0x54/0x630 [ 424.509932][T10269] bpf_prog_alloc+0x3b/0x230 [ 424.509952][T10269] bpf_prog_load+0x14ea/0x2490 [ 424.509974][T10269] ? avc_has_perm_noaudit+0x117/0x3b0 [ 424.509997][T10269] ? __pfx_bpf_prog_load+0x10/0x10 [ 424.510016][T10269] ? avc_has_perm_noaudit+0x149/0x3b0 [ 424.510055][T10269] ? selinux_bpf+0xde/0x130 [ 424.510072][T10269] ? bpf_lsm_bpf+0x9/0x10 [ 424.510100][T10269] __sys_bpf+0x433c/0x4d80 [ 424.510125][T10269] ? __pfx___sys_bpf+0x10/0x10 [ 424.510147][T10269] ? ksys_write+0x190/0x240 [ 424.510177][T10269] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 424.510218][T10269] ? fput+0x70/0xf0 [ 424.510237][T10269] ? ksys_write+0x1b9/0x240 [ 424.510261][T10269] ? __pfx_ksys_write+0x10/0x10 [ 424.510285][T10269] ? rcu_is_watching+0x12/0xc0 [ 424.510309][T10269] __x64_sys_bpf+0x78/0xc0 [ 424.510331][T10269] ? lockdep_hardirqs_on+0x7c/0x110 [ 424.510354][T10269] do_syscall_64+0xcd/0x260 [ 424.510379][T10269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.510398][T10269] RIP: 0033:0x7fe76398e969 [ 424.510415][T10269] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 424.510432][T10269] RSP: 002b:00007fe7648bb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 424.510451][T10269] RAX: ffffffffffffffda RBX: 00007fe763bb5fa0 RCX: 00007fe76398e969 [ 424.510463][T10269] RDX: 0000000000000094 RSI: 0000200000000c00 RDI: 0000000000000005 [ 424.510475][T10269] RBP: 00007fe7648bb090 R08: 0000000000000000 R09: 0000000000000000 [ 424.510486][T10269] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 424.510497][T10269] R13: 0000000000000000 R14: 00007fe763bb5fa0 R15: 00007ffe4f19a698 [ 424.510522][T10269] [ 424.796889][T10269] Mem-Info: [ 424.800089][T10269] active_anon:11820 inactive_anon:0 isolated_anon:0 [ 424.800089][T10269] active_file:1623 inactive_file:41308 isolated_file:0 [ 424.800089][T10269] unevictable:768 dirty:640 writeback:0 [ 424.800089][T10269] slab_reclaimable:11879 slab_unreclaimable:102787 [ 424.800089][T10269] mapped:33167 shmem:6494 pagetables:1013 [ 424.800089][T10269] sec_pagetables:0 bounce:0 [ 424.800089][T10269] kernel_misc_reclaimable:0 [ 424.800089][T10269] free:1324935 free_pcp:2013 free_cma:0 [ 424.847770][ T1547] usb 6-1: Using ep0 maxpacket: 16 [ 424.853590][ T5861] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 424.868232][ T1547] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 424.879226][ T1547] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 424.889254][ T1547] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 424.909219][ T1547] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.063976][T10269] Node 0 active_anon:38280kB inactive_anon:0kB active_file:6492kB inactive_file:165028kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:132668kB dirty:2560kB writeback:0kB shmem:15440kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11628kB pagetables:4052kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 425.111002][ T1547] usb 6-1: config 0 descriptor?? [ 425.134785][T10269] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 425.202740][T10269] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 425.236123][T10276] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1059'. [ 425.238607][T10269] lowmem_reserve[]: [ 425.248748][ T5861] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 425.254080][T10269] 0 2484 2486 2486 2486 [ 425.267446][T10269] Node 0 DMA32 free:1403112kB boost:0kB min:34108kB low:42632kB high:51156kB reserved_highatomic:0KB active_anon:26868kB inactive_anon:0kB active_file:6492kB inactive_file:163196kB unevictable:1536kB writepending:2560kB present:3129332kB managed:2543928kB mlocked:0kB bounce:0kB free_pcp:1628kB local_pcp:892kB free_cma:0kB [ 425.267541][ T5861] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 425.298726][T10269] lowmem_reserve[]: 0 0 1 1 1 [ 425.316275][ T30] audit: type=1400 audit(1746790044.524:448): avc: denied { write } for pid=10275 comm="syz.1.1059" name="sg0" dev="devtmpfs" ino=755 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 425.318104][T10269] Node 0 Normal free:20kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB active_anon:12kB inactive_anon:0kB active_file:0kB inactive_file:1832kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:36kB local_pcp:8kB free_cma:0kB [ 425.377012][T10269] lowmem_reserve[]: 0 0 0 0 0 [ 425.382193][T10269] Node 1 Normal free:3908460kB boost:0kB min:55768kB low:69708kB high:83648kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:100kB local_pcp:0kB free_cma:0kB [ 425.395026][ T5861] usb 5-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 425.411933][T10269] lowmem_reserve[]: 0 0 0 0 0 [ 425.427942][ T5861] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.429267][T10269] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 425.450622][ T5861] usb 5-1: Product: syz [ 425.453153][T10269] Node 0 [ 425.455344][ T5861] usb 5-1: Manufacturer: syz [ 425.455363][ T5861] usb 5-1: SerialNumber: syz [ 425.458736][ T5861] usb 5-1: config 0 descriptor?? [ 425.473108][T10269] DMA32: 1279*4kB (UM) [ 425.473546][T10267] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 425.486595][T10267] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 425.493851][T10269] 660*8kB (UME) 503*16kB (UME) 503*32kB (UME) 301*64kB (UME) 98*128kB (UME) 48*256kB (UME) 18*512kB (UM) 11*1024kB (ME) 9*2048kB (UME) 314*4096kB (UME) = 1403692kB [ 425.509908][T10280] netlink: 'syz.1.1061': attribute type 13 has an invalid length. [ 425.511364][T10269] Node 0 [ 425.518690][ T971] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 425.520623][T10269] Normal: 1*4kB (M) 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20kB [ 425.531372][ T30] audit: type=1400 audit(1746790044.734:449): avc: denied { bind } for pid=10279 comm="syz.1.1061" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 425.541427][T10269] Node 1 Normal: 221*4kB (UE) 63*8kB (UME) 50*16kB (UME) 207*32kB (UME) 96*64kB (UME) 34*128kB (UME) 12*256kB (UME) 6*512kB (UM) 4*1024kB (UM) 2*2048kB (UE) 946*4096kB (UM) = 3908460kB [ 425.595345][T10269] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 425.605487][T10269] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 425.618626][T10269] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 425.628719][T10269] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 425.640858][T10269] 45546 total pagecache pages [ 425.645551][T10269] 0 pages in swap cache [ 425.653681][T10269] Free swap = 124996kB [ 425.657848][T10269] Total swap = 124996kB [ 425.664355][T10269] 2097051 pages RAM [ 425.668169][T10269] 0 pages HighMem/MovableOnly [ 425.673391][ T971] usb 3-1: Using ep0 maxpacket: 32 [ 425.689067][T10269] 428963 pages reserved [ 425.694892][ T971] usb 3-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 425.707382][ T971] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.716501][T10269] 0 pages cma reserved [ 425.732388][ T971] usb 3-1: config 0 descriptor?? [ 425.739129][ T1547] corsair 0003:1B1C:1B02.0004: unknown main item tag 0x0 [ 425.747338][T10267] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 425.760592][ T1547] corsair 0003:1B1C:1B02.0004: unknown main item tag 0x0 [ 425.768176][T10283] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 425.768498][T10283] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 425.781487][ T1547] corsair 0003:1B1C:1B02.0004: item fetching failed at offset 2/5 [ 425.793658][ T1547] corsair 0003:1B1C:1B02.0004: parse failed [ 425.799651][ T971] as10x_usb: device has been detected [ 425.802753][ T1547] corsair 0003:1B1C:1B02.0004: probe with driver corsair failed with error -22 [ 425.832356][T10267] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 426.211045][ T971] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 426.224113][T10278] netlink: 'syz.2.1060': attribute type 10 has an invalid length. [ 426.237471][ T971] usb 3-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 426.261859][ T1547] usb 6-1: USB disconnect, device number 21 [ 426.294041][ T5861] Error reading MAC address [ 426.326077][ T5861] usb 5-1: USB disconnect, device number 22 [ 426.748206][ T30] audit: type=1400 audit(1746790045.604:450): avc: denied { listen } for pid=10277 comm="syz.2.1060" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 427.003864][ T30] audit: type=1400 audit(1746790045.604:451): avc: denied { accept } for pid=10277 comm="syz.2.1060" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 428.376253][T10297] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 428.546079][ T30] audit: type=1400 audit(1746790047.754:452): avc: denied { firmware_load } for pid=971 comm="kworker/0:2" path="/lib/firmware/as102_data1_st.hex" dev="sda1" ino=297 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 428.547101][ T971] as10x_usb: error during firmware upload part1 [ 428.571298][ C1] vkms_vblank_simulate: vblank timer overrun [ 429.787851][ T971] Registered device nBox DVB-T Dongle [ 429.909420][T10311] netlink: 'syz.5.1069': attribute type 10 has an invalid length. [ 429.923845][T10311] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 429.984762][T10311] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 430.980943][ T5861] usb 3-1: USB disconnect, device number 18 [ 431.149061][T10311] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 431.233909][ T5861] Unregistered device nBox DVB-T Dongle [ 431.255804][ T5861] as10x_usb: device has been disconnected [ 431.394396][T10324] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1072'. [ 432.251812][ T10] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 433.172094][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 433.233999][ T10] usb 6-1: New USB device found, idVendor=046d, idProduct=c50c, bcdDevice= 0.00 [ 433.287863][T10345] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 433.303298][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.331475][ T10] usb 6-1: config 0 descriptor?? [ 433.419976][T10347] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1078'. [ 433.464321][T10347] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1078'. [ 433.510693][T10347] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1078'. [ 433.710293][ T1547] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 433.716386][T10352] macvlan0: entered promiscuous mode [ 433.750678][ T10] logitech 0003:046D:C50C.0005: unbalanced collection at end of report description [ 433.753888][T10352] netlink: 'syz.3.1080': attribute type 1 has an invalid length. [ 433.907445][T10352] netlink: 'syz.3.1080': attribute type 2 has an invalid length. [ 433.911178][ T10] logitech 0003:046D:C50C.0005: parse failed [ 433.926319][T10357] can0: slcan on pty25. [ 433.934673][ T10] logitech 0003:046D:C50C.0005: probe with driver logitech failed with error -22 [ 434.119936][T10363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.136350][T10363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.149972][ T1547] usb 2-1: not running at top speed; connect to a high speed hub [ 434.441740][T10348] can0 (unregistered): slcan off pty25. [ 434.556193][ T1547] usb 2-1: config 1 has an invalid descriptor of length 54, skipping remainder of the config [ 434.811600][ T1547] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 434.835200][ T1547] usb 2-1: config 1 has no interface number 1 [ 434.854338][ T10] usb 6-1: USB disconnect, device number 22 [ 434.889488][T10372] binder: 10371:10372 ioctl 4018620d 0 returned -22 [ 434.940242][T10372] binder: 10371:10372 ioctl c0306201 200000001a80 returned -11 [ 434.987618][T10375] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1085'. [ 435.015137][ T1547] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 435.040674][ T1547] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.043389][T10375] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.048680][ T1547] usb 2-1: Product: syz [ 435.048700][ T1547] usb 2-1: Manufacturer: syz [ 435.048715][ T1547] usb 2-1: SerialNumber: syz [ 435.055923][T10375] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.608232][ T1547] usb 2-1: 2:1 : no or invalid class specific endpoint descriptor [ 435.663401][T10375] netlink: 256 bytes leftover after parsing attributes in process `syz.5.1085'. [ 435.699730][T10375] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1085'. [ 435.861034][ T1547] usb 2-1: 2:1: All rates were zero [ 435.866765][ T1547] usb 2-1: 2:1 : invalid channels 0 [ 436.046322][T10391] x_tables: ip_tables: tcp match: only valid for protocol 6 [ 436.316263][ T1547] usb 2-1: USB disconnect, device number 18 [ 436.646212][ T9859] udevd[9859]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 437.975911][T10427] binder: 10426:10427 ioctl c0306201 0 returned -14 [ 438.066656][T10427] binder: 10426:10427 ioctl c0306201 200000001a80 returned -11 [ 438.799135][ T30] audit: type=1400 audit(1746790058.004:453): avc: denied { read } for pid=10437 comm="syz.2.1097" name="usbmon1" dev="devtmpfs" ino=717 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 438.864024][ T30] audit: type=1400 audit(1746790058.004:454): avc: denied { open } for pid=10437 comm="syz.2.1097" path="/dev/usbmon1" dev="devtmpfs" ino=717 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 439.628112][ T1547] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 439.805048][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.811654][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.471328][ T1547] usb 4-1: Using ep0 maxpacket: 8 [ 440.585205][ T1547] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 440.610971][ T1547] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.618997][ T1547] usb 4-1: Product: syz [ 440.623512][ T1547] usb 4-1: Manufacturer: syz [ 440.628120][ T1547] usb 4-1: SerialNumber: syz [ 440.644132][ T1547] usb 4-1: config 0 descriptor?? [ 440.660423][ T1547] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 440.679763][ T1547] usb 4-1: setting power ON [ 440.687725][ T1547] dvb-usb: bulk message failed: -22 (2/0) [ 440.721751][ T1547] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 440.751165][ T1547] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 440.783662][ T1547] usb 4-1: media controller created [ 440.790770][T10471] binder: BINDER_SET_CONTEXT_MGR already set [ 440.810589][T10471] binder: 10465:10471 ioctl 4018620d 200000000240 returned -16 [ 440.842003][T10468] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1102'. [ 440.856823][T10445] dvb-usb: bulk message failed: -22 (3/0) [ 440.863581][T10445] usb 4-1: gpio_write failed. [ 440.868275][T10445] dvb-usb: bulk message failed: -22 (3/0) [ 441.068244][ T1547] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 442.076816][ T1547] usb 4-1: selecting invalid altsetting 6 [ 442.101485][ T1547] usb 4-1: digital interface selection failed (-22) [ 442.242015][ T1547] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 442.314780][ T1547] usb 4-1: setting power OFF [ 442.324781][ T1547] dvb-usb: bulk message failed: -22 (2/0) [ 442.338760][ T1547] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 442.360390][T10487] binder: 10485:10487 ioctl c0306201 0 returned -14 [ 442.361411][ T1547] (NULL device *): no alternate interface [ 442.421487][T10487] binder: 10485:10487 ioctl c0306201 200000001a80 returned -11 [ 442.683880][T10492] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 443.321139][ T1547] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 443.690873][ T1547] usb 4-1: USB disconnect, device number 22 [ 444.287203][T10507] FAULT_INJECTION: forcing a failure. [ 444.287203][T10507] name failslab, interval 1, probability 0, space 0, times 0 [ 444.300636][T10507] CPU: 1 UID: 0 PID: 10507 Comm: syz.1.1113 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 444.300661][T10507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 444.300671][T10507] Call Trace: [ 444.300677][T10507] [ 444.300683][T10507] dump_stack_lvl+0x16c/0x1f0 [ 444.300710][T10507] should_fail_ex+0x512/0x640 [ 444.300732][T10507] ? __kmalloc_node_noprof+0xc5/0x500 [ 444.300754][T10507] should_failslab+0xc2/0x120 [ 444.300773][T10507] __kmalloc_node_noprof+0xd8/0x500 [ 444.300791][T10507] ? __vmalloc_node_range_noprof+0x3eb/0x1540 [ 444.300820][T10507] __vmalloc_node_range_noprof+0x3eb/0x1540 [ 444.300843][T10507] ? find_held_lock+0x2b/0x80 [ 444.300872][T10507] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 444.300897][T10507] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 444.300929][T10507] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 444.300947][T10507] __vmalloc_noprof+0x6d/0x90 [ 444.300971][T10507] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 444.300989][T10507] bpf_prog_alloc_no_stats+0x54/0x630 [ 444.301006][T10507] ? security_capable+0x7e/0x260 [ 444.301028][T10507] bpf_prog_alloc+0x3b/0x230 [ 444.301043][T10507] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 444.301073][T10507] bpf_prog_load+0x1a04/0x2490 [ 444.301100][T10507] ? __pfx_bpf_prog_load+0x10/0x10 [ 444.301119][T10507] ? avc_has_perm_noaudit+0x149/0x3b0 [ 444.301163][T10507] ? selinux_bpf+0xde/0x130 [ 444.301180][T10507] ? bpf_lsm_bpf+0x9/0x10 [ 444.301207][T10507] __sys_bpf+0x433c/0x4d80 [ 444.301232][T10507] ? __pfx___sys_bpf+0x10/0x10 [ 444.301254][T10507] ? ksys_write+0x190/0x240 [ 444.301284][T10507] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 444.301324][T10507] ? fput+0x70/0xf0 [ 444.301343][T10507] ? ksys_write+0x1b9/0x240 [ 444.301367][T10507] ? __pfx_ksys_write+0x10/0x10 [ 444.301389][T10507] ? rcu_is_watching+0x12/0xc0 [ 444.301411][T10507] __x64_sys_bpf+0x78/0xc0 [ 444.301432][T10507] ? lockdep_hardirqs_on+0x7c/0x110 [ 444.301453][T10507] do_syscall_64+0xcd/0x260 [ 444.301478][T10507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 444.301496][T10507] RIP: 0033:0x7f506c78e969 [ 444.301510][T10507] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 444.301526][T10507] RSP: 002b:00007f506d6d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 444.301542][T10507] RAX: ffffffffffffffda RBX: 00007f506c9b5fa0 RCX: 00007f506c78e969 [ 444.301555][T10507] RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000005 [ 444.301566][T10507] RBP: 00007f506d6d5090 R08: 0000000000000000 R09: 0000000000000000 [ 444.301576][T10507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 444.301585][T10507] R13: 0000000000000000 R14: 00007f506c9b5fa0 R15: 00007ffcca6f0208 [ 444.301606][T10507] [ 444.301617][T10507] syz.1.1113: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null) [ 444.389375][ T30] audit: type=1400 audit(1746790063.594:455): avc: denied { read } for pid=10509 comm="syz.5.1114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 444.448224][T10507] ,cpuset=/,mems_allowed=0-1 [ 444.629531][T10507] CPU: 0 UID: 0 PID: 10507 Comm: syz.1.1113 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 444.629557][T10507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 444.629567][T10507] Call Trace: [ 444.629574][T10507] [ 444.629581][T10507] dump_stack_lvl+0x16c/0x1f0 [ 444.629608][T10507] warn_alloc+0x248/0x3a0 [ 444.629638][T10507] ? __pfx_warn_alloc+0x10/0x10 [ 444.629662][T10507] ? dump_stack_lvl+0x1a1/0x1f0 [ 444.629693][T10507] ? rcu_is_watching+0x12/0xc0 [ 444.629716][T10507] ? __kmalloc_node_noprof+0x23b/0x500 [ 444.629740][T10507] __vmalloc_node_range_noprof+0x1110/0x1540 [ 444.629765][T10507] ? find_held_lock+0x2b/0x80 [ 444.629795][T10507] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 444.629820][T10507] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 444.629854][T10507] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 444.629872][T10507] __vmalloc_noprof+0x6d/0x90 [ 444.629896][T10507] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 444.629915][T10507] bpf_prog_alloc_no_stats+0x54/0x630 [ 444.629932][T10507] ? security_capable+0x7e/0x260 [ 444.629955][T10507] bpf_prog_alloc+0x3b/0x230 [ 444.629970][T10507] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 444.630001][T10507] bpf_prog_load+0x1a04/0x2490 [ 444.630028][T10507] ? __pfx_bpf_prog_load+0x10/0x10 [ 444.630048][T10507] ? avc_has_perm_noaudit+0x149/0x3b0 [ 444.630086][T10507] ? selinux_bpf+0xde/0x130 [ 444.630103][T10507] ? bpf_lsm_bpf+0x9/0x10 [ 444.630130][T10507] __sys_bpf+0x433c/0x4d80 [ 444.630155][T10507] ? __pfx___sys_bpf+0x10/0x10 [ 444.630177][T10507] ? ksys_write+0x190/0x240 [ 444.630206][T10507] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 444.630246][T10507] ? fput+0x70/0xf0 [ 444.630265][T10507] ? ksys_write+0x1b9/0x240 [ 444.630289][T10507] ? __pfx_ksys_write+0x10/0x10 [ 444.630312][T10507] ? rcu_is_watching+0x12/0xc0 [ 444.630340][T10507] __x64_sys_bpf+0x78/0xc0 [ 444.630362][T10507] ? lockdep_hardirqs_on+0x7c/0x110 [ 444.630384][T10507] do_syscall_64+0xcd/0x260 [ 444.630416][T10507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 444.630436][T10507] RIP: 0033:0x7f506c78e969 [ 444.630452][T10507] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 444.630470][T10507] RSP: 002b:00007f506d6d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 444.630487][T10507] RAX: ffffffffffffffda RBX: 00007f506c9b5fa0 RCX: 00007f506c78e969 [ 444.630499][T10507] RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000005 [ 444.630510][T10507] RBP: 00007f506d6d5090 R08: 0000000000000000 R09: 0000000000000000 [ 444.630519][T10507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 444.630528][T10507] R13: 0000000000000000 R14: 00007f506c9b5fa0 R15: 00007ffcca6f0208 [ 444.630550][T10507] [ 444.903118][T10498] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 444.917699][T10507] Mem-Info: [ 445.143983][T10507] active_anon:11201 inactive_anon:0 isolated_anon:0 [ 445.143983][T10507] active_file:1623 inactive_file:41341 isolated_file:0 [ 445.143983][T10507] unevictable:768 dirty:382 writeback:0 [ 445.143983][T10507] slab_reclaimable:11928 slab_unreclaimable:102442 [ 445.143983][T10507] mapped:33342 shmem:4261 pagetables:1040 [ 445.143983][T10507] sec_pagetables:0 bounce:0 [ 445.143983][T10507] kernel_misc_reclaimable:0 [ 445.143983][T10507] free:1318385 free_pcp:4603 free_cma:0 [ 445.194865][T10507] Node 0 active_anon:44804kB inactive_anon:0kB active_file:6492kB inactive_file:165160kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:133368kB dirty:1524kB writeback:0kB shmem:15508kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11608kB pagetables:4160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 445.233674][T10507] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 445.284740][T10507] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 445.418159][T10507] lowmem_reserve[]: 0 2484 2486 2486 2486 [ 445.445937][T10507] Node 0 DMA32 free:1351368kB boost:0kB min:34108kB low:42632kB high:51156kB reserved_highatomic:0KB active_anon:54192kB inactive_anon:0kB active_file:6492kB inactive_file:163328kB unevictable:1536kB writepending:1524kB present:3129332kB managed:2543928kB mlocked:0kB bounce:0kB free_pcp:7272kB local_pcp:988kB free_cma:0kB [ 445.529646][T10507] lowmem_reserve[]: 0 0 1 1 1 [ 445.535721][T10507] Node 0 Normal free:20kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB active_anon:12kB inactive_anon:0kB active_file:0kB inactive_file:1832kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:36kB local_pcp:8kB free_cma:0kB [ 445.548277][T10522] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1118'. [ 445.586411][T10507] lowmem_reserve[]: 0 0 0 0 0 [ 445.592792][T10507] Node 1 Normal free:3908460kB boost:0kB min:55768kB low:69708kB high:83648kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:100kB local_pcp:100kB free_cma:0kB [ 445.644289][T10507] lowmem_reserve[]: 0 0 0 0 0 [ 445.654459][T10507] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 445.667734][T10507] Node 0 DMA32: 126*4kB (UE) 11*8kB (UE) 65*16kB (UME) 112*32kB (M) 222*64kB (UME) 94*128kB (UME) 41*256kB (UME) 19*512kB (UM) 11*1024kB (ME) 7*2048kB (UME) 311*4096kB (M) = 1351136kB [ 445.699151][T10507] Node 0 Normal: 1*4kB (M) 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20kB [ 445.718102][T10507] Node 1 Normal: 221*4kB (UE) 63*8kB (UME) 50*16kB (UME) 207*32kB (UME) 96*64kB (UME) 34*128kB (UME) 12*256kB (UME) 6*512kB (UM) 4*1024kB (UM) 2*2048kB (UE) 946*4096kB (UM) = 3908460kB [ 445.740437][T10507] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 445.750688][T10507] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 445.797352][T10507] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 445.807958][T10507] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 445.818222][T10507] 50072 total pagecache pages [ 445.824449][T10507] 0 pages in swap cache [ 445.828915][T10507] Free swap = 124996kB [ 445.848865][T10507] Total swap = 124996kB [ 445.982519][T10507] 2097051 pages RAM [ 445.987599][T10507] 0 pages HighMem/MovableOnly [ 445.992948][T10507] 428963 pages reserved [ 445.997162][T10507] 0 pages cma reserved [ 447.596016][T10542] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1124'. [ 447.616184][T10542] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1124'. [ 447.630131][T10542] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1124'. [ 448.900360][T10554] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 449.405366][ T30] audit: type=1400 audit(1746790068.614:456): avc: denied { setopt } for pid=10558 comm="syz.1.1127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 450.653300][T10582] can0: slcan on pty31. [ 451.250956][ T9] usb 2-1: new full-speed USB device number 19 using dummy_hcd [ 451.308747][T10599] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1135'. [ 451.361495][T10599] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1135'. [ 451.383448][T10578] can0 (unregistered): slcan off pty31. [ 451.437390][T10599] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1135'. [ 451.497612][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 451.537091][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 452.051653][ T9] usb 2-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 452.062258][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 452.076591][ T9] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 452.110614][ T9] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 452.118642][ T9] usb 2-1: Manufacturer: syz [ 452.144699][ T30] audit: type=1400 audit(1746790071.354:457): avc: denied { getopt } for pid=10610 comm="syz.3.1138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 452.174445][ T9] usb 2-1: config 0 descriptor?? [ 454.193765][T10630] siw: device registration error -23 [ 455.501580][ T5861] usb 2-1: USB disconnect, device number 19 [ 455.885939][ T30] audit: type=1400 audit(1746790075.094:458): avc: denied { setopt } for pid=10656 comm="syz.5.1150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 455.909793][ T30] audit: type=1400 audit(1746790075.114:459): avc: denied { read } for pid=10656 comm="syz.5.1150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 456.046112][T10661] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 457.730792][T10670] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1152'. [ 457.884124][T10667] FAULT_INJECTION: forcing a failure. [ 457.884124][T10667] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 457.960615][T10667] CPU: 1 UID: 0 PID: 10667 Comm: syz.4.1153 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 457.960643][T10667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 457.960653][T10667] Call Trace: [ 457.960660][T10667] [ 457.960667][T10667] dump_stack_lvl+0x16c/0x1f0 [ 457.960696][T10667] should_fail_ex+0x512/0x640 [ 457.960723][T10667] _copy_from_user+0x2e/0xd0 [ 457.960749][T10667] __tun_chr_ioctl+0x1de/0x4740 [ 457.960775][T10667] ? ioctl_has_perm.constprop.0.isra.0+0x2fe/0x450 [ 457.960809][T10667] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 457.960837][T10667] ? hook_file_ioctl_common+0x145/0x410 [ 457.960864][T10667] ? selinux_file_ioctl+0x180/0x270 [ 457.960887][T10667] ? selinux_file_ioctl+0xb4/0x270 [ 457.960913][T10667] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 457.960940][T10667] __x64_sys_ioctl+0x190/0x200 [ 457.960966][T10667] do_syscall_64+0xcd/0x260 [ 457.960991][T10667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.961010][T10667] RIP: 0033:0x7fa27518e969 [ 457.961026][T10667] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 457.961044][T10667] RSP: 002b:00007fa275f3a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 457.961062][T10667] RAX: ffffffffffffffda RBX: 00007fa2753b5fa0 RCX: 00007fa27518e969 [ 457.961075][T10667] RDX: 00002000000002c0 RSI: 00000000400454d9 RDI: 0000000000000007 [ 457.961087][T10667] RBP: 00007fa275f3a090 R08: 0000000000000000 R09: 0000000000000000 [ 457.961102][T10667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 457.961112][T10667] R13: 0000000000000000 R14: 00007fa2753b5fa0 R15: 00007ffc39cfa5d8 [ 457.961139][T10667] [ 460.414040][ T5861] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 460.601389][ T5861] usb 4-1: Using ep0 maxpacket: 8 [ 460.666060][ T5861] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 460.779749][ T5861] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.789384][ T5861] usb 4-1: Product: syz [ 460.797108][ T5861] usb 4-1: Manufacturer: syz [ 460.802791][ T5861] usb 4-1: SerialNumber: syz [ 460.812667][ T5861] usb 4-1: config 0 descriptor?? [ 460.821385][ T5861] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 460.829689][ T5861] usb 4-1: setting power ON [ 460.836300][ T5861] dvb-usb: bulk message failed: -22 (2/0) [ 460.859670][ T5861] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 460.876259][ T30] audit: type=1400 audit(1746790080.084:460): avc: denied { bind } for pid=10704 comm="syz.2.1161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 461.013827][T10698] ceph: No mds server is up or the cluster is laggy [ 461.026097][ T5861] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 461.035091][ T5861] usb 4-1: media controller created [ 461.037790][ T30] audit: type=1400 audit(1746790080.244:461): avc: denied { setopt } for pid=10704 comm="syz.2.1161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 461.040440][T10690] dvb-usb: bulk message failed: -22 (3/0) [ 461.066540][T10690] usb 4-1: gpio_write failed. [ 461.071284][T10690] dvb-usb: bulk message failed: -22 (3/0) [ 461.108065][ T5861] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 461.218942][ T5861] usb 4-1: selecting invalid altsetting 6 [ 461.224888][ T5861] usb 4-1: digital interface selection failed (-22) [ 461.231844][ T5861] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 461.257789][ T5861] usb 4-1: setting power OFF [ 461.264838][ T5861] dvb-usb: bulk message failed: -22 (2/0) [ 461.270886][ T5861] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 461.287018][ T5861] (NULL device *): no alternate interface [ 462.837101][ T30] audit: type=1400 audit(1746790082.044:462): avc: denied { bind } for pid=10728 comm="syz.5.1167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 462.911089][ T30] audit: type=1400 audit(1746790082.074:463): avc: denied { connect } for pid=10728 comm="syz.5.1167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 462.975721][ T30] audit: type=1400 audit(1746790082.084:464): avc: denied { ioctl } for pid=10728 comm="syz.5.1167" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x89ea scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 463.142320][ T5861] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 463.164589][ T5861] usb 4-1: USB disconnect, device number 23 [ 465.188277][T10760] Driver unsupported XDP return value 0 on prog (id 327) dev N/A, expect packet loss! [ 468.910069][T10796] tty tty1: ldisc open failed (-12), clearing slot 0 [ 470.112542][T10826] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 470.937340][ T30] audit: type=1400 audit(1746790090.144:465): avc: denied { write } for pid=10838 comm="syz.3.1197" path="socket:[25426]" dev="sockfs" ino=25426 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 471.448607][T10846] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1199'. [ 471.692698][T10848] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1199'. [ 471.705454][T10848] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1199'. [ 473.138462][T10869] binder: 10868:10869 ioctl c0306201 0 returned -14 [ 473.429575][T10876] netlink: 'syz.4.1206': attribute type 1 has an invalid length. [ 473.477089][T10876] bond0: entered promiscuous mode [ 473.483162][T10876] bond_slave_0: entered promiscuous mode [ 473.489106][T10876] bond_slave_1: entered promiscuous mode [ 473.496352][T10876] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 473.505996][T10876] bond2: (slave macvlan2): Enslaving as a backup interface with an up link [ 474.710150][ T30] audit: type=1400 audit(1746790093.914:466): avc: denied { getopt } for pid=10889 comm="syz.3.1211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 475.159670][ T9] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 475.421917][ T9] usb 4-1: config 0 has an invalid interface number: 75 but max is 0 [ 475.596484][ T9] usb 4-1: config 0 has no interface number 0 [ 475.740777][ T9] usb 4-1: config 0 interface 75 altsetting 0 endpoint 0x8 has an invalid bInterval 0, changing to 7 [ 475.752504][ T9] usb 4-1: config 0 interface 75 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 475.762613][ T9] usb 4-1: config 0 interface 75 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 475.778830][ T9] usb 4-1: New USB device found, idVendor=1199, idProduct=9011, bcdDevice=bf.ec [ 475.810609][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.862883][ T9] usb 4-1: Product: syz [ 475.868676][ T9] usb 4-1: Manufacturer: syz [ 475.887399][ T9] usb 4-1: SerialNumber: syz [ 475.931718][ T9] usb 4-1: config 0 descriptor?? [ 476.790891][ T9] usb 4-1: USB disconnect, device number 24 [ 476.865297][T10929] binder: 10928:10929 ioctl c0306201 0 returned -14 [ 478.903231][T10954] FAULT_INJECTION: forcing a failure. [ 478.903231][T10954] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 478.916519][T10954] CPU: 1 UID: 0 PID: 10954 Comm: syz.3.1222 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 478.916545][T10954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 478.916556][T10954] Call Trace: [ 478.916563][T10954] [ 478.916570][T10954] dump_stack_lvl+0x16c/0x1f0 [ 478.916599][T10954] should_fail_ex+0x512/0x640 [ 478.916627][T10954] _copy_from_user+0x2e/0xd0 [ 478.916653][T10954] usbdev_ioctl+0x1746/0x4070 [ 478.916685][T10954] ? __pfx_usbdev_ioctl+0x10/0x10 [ 478.916711][T10954] ? do_vfs_ioctl+0x512/0x1990 [ 478.916735][T10954] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 478.916765][T10954] ? ioctl_has_perm.constprop.0.isra.0+0x2f4/0x450 [ 478.916794][T10954] ? ioctl_has_perm.constprop.0.isra.0+0x2fe/0x450 [ 478.916823][T10954] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 478.916859][T10954] ? hook_file_ioctl_common+0x145/0x410 [ 478.916886][T10954] ? selinux_file_ioctl+0x180/0x270 [ 478.916910][T10954] ? selinux_file_ioctl+0xb4/0x270 [ 478.916938][T10954] ? __pfx_usbdev_ioctl+0x10/0x10 [ 478.916966][T10954] __x64_sys_ioctl+0x190/0x200 [ 478.916991][T10954] do_syscall_64+0xcd/0x260 [ 478.917017][T10954] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.917041][T10954] RIP: 0033:0x7fe76398e969 [ 478.917057][T10954] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 478.917075][T10954] RSP: 002b:00007fe764879038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 478.917093][T10954] RAX: ffffffffffffffda RBX: 00007fe763bb6160 RCX: 00007fe76398e969 [ 478.917106][T10954] RDX: 0000200000000000 RSI: 00000000c0105512 RDI: 0000000000000004 [ 478.917118][T10954] RBP: 00007fe764879090 R08: 0000000000000000 R09: 0000000000000000 [ 478.917129][T10954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 478.917140][T10954] R13: 0000000000000000 R14: 00007fe763bb6160 R15: 00007ffe4f19a698 [ 478.917167][T10954] [ 479.868496][T10960] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=10960 comm=syz.5.1225 [ 479.921042][T10960] netlink: 'syz.5.1225': attribute type 39 has an invalid length. [ 480.943229][T10979] netlink: 348 bytes leftover after parsing attributes in process `syz.5.1225'. [ 481.210494][T10987] binder: 10984:10987 ioctl c0306201 0 returned -14 [ 481.267220][T10985] binder: BINDER_SET_CONTEXT_MGR already set [ 481.321712][T10985] binder: 10984:10985 ioctl 4018620d 2000000000c0 returned -16 [ 481.781369][T11005] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 482.539559][T11006] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 483.848446][T11021] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1236'. [ 484.898260][T11035] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1239'. [ 484.926816][T11035] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1239'. [ 485.416523][ T30] audit: type=1400 audit(1746790104.624:467): avc: denied { bind } for pid=11032 comm="syz.2.1239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 485.827601][ T30] audit: type=1400 audit(1746790105.034:468): avc: denied { create } for pid=11032 comm="syz.2.1239" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 486.964919][T11077] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 486.982917][ T5815] Bluetooth: hci5: command 0x0405 tx timeout [ 487.050605][ T5931] usb 2-1: new full-speed USB device number 20 using dummy_hcd [ 487.292329][ T5931] usb 2-1: unable to get BOS descriptor or descriptor too short [ 487.623431][ T5931] usb 2-1: not running at top speed; connect to a high speed hub [ 487.649800][ T5931] usb 2-1: config 129 has an invalid interface number: 28 but max is 0 [ 487.664641][ T5931] usb 2-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 487.701484][ T5931] usb 2-1: config 129 has no interface number 0 [ 487.730839][ T5931] usb 2-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice=db.57 [ 487.770828][T11096] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 488.693439][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.701550][ T5931] usb 2-1: Product: syz [ 488.705709][ T5931] usb 2-1: Manufacturer: syz [ 488.710295][ T5931] usb 2-1: SerialNumber: syz [ 488.967874][ T5931] etas_es58x 2-1:129.28: Starting syz syz (Serial Number syz) [ 489.072483][ T5931] usb 2-1: USB disconnect, device number 20 [ 489.490354][T11127] FAULT_INJECTION: forcing a failure. [ 489.490354][T11127] name failslab, interval 1, probability 0, space 0, times 0 [ 489.503134][T11127] CPU: 1 UID: 0 PID: 11127 Comm: syz.4.1256 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 489.503161][T11127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 489.503172][T11127] Call Trace: [ 489.503179][T11127] [ 489.503187][T11127] dump_stack_lvl+0x16c/0x1f0 [ 489.503215][T11127] should_fail_ex+0x512/0x640 [ 489.503238][T11127] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 489.503279][T11127] should_failslab+0xc2/0x120 [ 489.503299][T11127] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 489.503327][T11127] ? alloc_empty_file+0x55/0x1e0 [ 489.503352][T11127] alloc_empty_file+0x55/0x1e0 [ 489.503374][T11127] path_openat+0xe0/0x2d40 [ 489.503398][T11127] ? __x64_sys_openat+0x174/0x210 [ 489.503418][T11127] ? do_syscall_64+0xcd/0x260 [ 489.503440][T11127] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.503469][T11127] ? __pfx_path_openat+0x10/0x10 [ 489.503503][T11127] do_filp_open+0x20b/0x470 [ 489.503530][T11127] ? __pfx_do_filp_open+0x10/0x10 [ 489.503576][T11127] ? alloc_fd+0x471/0x7d0 [ 489.503610][T11127] do_sys_openat2+0x11b/0x1d0 [ 489.503630][T11127] ? __pfx_do_sys_openat2+0x10/0x10 [ 489.503654][T11127] ? __fget_files+0x20e/0x3c0 [ 489.503685][T11127] __x64_sys_openat+0x174/0x210 [ 489.503706][T11127] ? __pfx___x64_sys_openat+0x10/0x10 [ 489.503726][T11127] ? ksys_write+0x1b9/0x240 [ 489.503760][T11127] do_syscall_64+0xcd/0x260 [ 489.503786][T11127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.503804][T11127] RIP: 0033:0x7fa27518d2d0 [ 489.503820][T11127] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 [ 489.503837][T11127] RSP: 002b:00007fa272ff5f10 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 489.503855][T11127] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fa27518d2d0 [ 489.503868][T11127] RDX: 0000000000000002 RSI: 00007fa272ff5fa0 RDI: 00000000ffffff9c [ 489.503879][T11127] RBP: 00007fa272ff5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 489.503890][T11127] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 489.503902][T11127] R13: 0000000000000000 R14: 00007fa2753b6160 R15: 00007ffc39cfa5d8 [ 489.503927][T11127] [ 489.771292][T11129] netlink: 830 bytes leftover after parsing attributes in process `syz.2.1258'. [ 491.270633][T11139] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 493.599116][T11163] hub 9-0:1.0: USB hub found [ 493.605419][T11163] hub 9-0:1.0: 1 port detected [ 495.612633][T11197] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 497.801354][ T5931] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 498.600954][ T5931] usb 6-1: Using ep0 maxpacket: 8 [ 498.687592][ T5931] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 498.740613][ T5931] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.752125][ T5931] usb 6-1: Product: syz [ 498.756316][ T5931] usb 6-1: Manufacturer: syz [ 498.761440][ T5931] usb 6-1: SerialNumber: syz [ 498.770155][ T5931] usb 6-1: config 0 descriptor?? [ 498.781905][ T5931] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 498.790359][ T5931] usb 6-1: setting power ON [ 498.794997][ T5931] dvb-usb: bulk message failed: -22 (2/0) [ 498.808223][ T5931] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 498.825825][ T5931] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 498.841028][ T5931] usb 6-1: media controller created [ 498.932427][ T5931] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 498.956357][T11225] netlink: 830 bytes leftover after parsing attributes in process `syz.4.1279'. [ 498.963841][ T5931] usb 6-1: selecting invalid altsetting 6 [ 498.986449][ T5931] usb 6-1: digital interface selection failed (-22) [ 498.993662][T11214] dvb-usb: bulk message failed: -22 (3/0) [ 498.999438][T11214] usb 6-1: gpio_write failed. [ 499.004229][T11214] dvb-usb: bulk message failed: -22 (3/0) [ 499.207131][ T5931] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 499.219423][ T5931] usb 6-1: setting power OFF [ 499.229746][ T5931] dvb-usb: bulk message failed: -22 (2/0) [ 499.236444][ T5931] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 499.249146][ T5931] (NULL device *): no alternate interface [ 500.869313][ T5931] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 500.875176][T11244] binder: 11243:11244 ioctl c0306201 200000001a80 returned -11 [ 501.152235][ T5931] usb 6-1: USB disconnect, device number 23 [ 501.292788][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.299159][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.568587][T11252] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1286'. [ 502.623299][T11264] can0: slcan on pty25. [ 502.758220][T11268] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1290'. [ 503.210840][ T30] audit: type=1400 audit(1746790122.424:469): avc: denied { connect } for pid=11267 comm="syz.5.1291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 504.440706][ T5815] Bluetooth: hci5: command 0x0405 tx timeout [ 505.803969][T11253] can0 (unregistered): slcan off pty25. [ 506.120936][ T5931] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 506.635262][ T5931] usb 2-1: Using ep0 maxpacket: 8 [ 506.653358][ T5931] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 506.710637][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 506.739185][ T5931] usb 2-1: Product: syz [ 506.754749][ T5931] usb 2-1: Manufacturer: syz [ 506.769404][ T5931] usb 2-1: SerialNumber: syz [ 506.791870][ T5931] usb 2-1: config 0 descriptor?? [ 506.927279][ T5931] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 506.969289][ T5931] usb 2-1: setting power ON [ 506.983190][ T5931] dvb-usb: bulk message failed: -22 (2/0) [ 507.526681][ T5869] usb 5-1: new full-speed USB device number 23 using dummy_hcd [ 508.457086][ T5931] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 509.426441][ T5931] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 509.574147][ T5869] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 509.807641][ T5931] usb 2-1: media controller created [ 510.080677][ T5869] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 510.100565][ T5869] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 510.147048][ T5869] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 510.152224][ T5931] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 510.197076][ T5869] usb 5-1: string descriptor 0 read error: -71 [ 510.225369][ T5869] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 510.272369][T11328] netlink: 'syz.2.1302': attribute type 1 has an invalid length. [ 510.288500][ T5869] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 510.367211][ T5931] usb 2-1: selecting invalid altsetting 6 [ 510.376707][ T5931] usb 2-1: digital interface selection failed (-22) [ 510.383792][ T5931] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 510.385568][ T5869] usb 5-1: config 0 descriptor?? [ 510.393685][ T5931] usb 2-1: setting power OFF [ 510.671796][ T5931] dvb-usb: bulk message failed: -22 (2/0) [ 510.862640][ T5869] usb 5-1: can't set config #0, error -71 [ 510.881569][ T5931] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 511.105498][ T5869] usb 5-1: USB disconnect, device number 23 [ 511.127713][ T5931] (NULL device *): no alternate interface [ 511.680831][ T5931] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 512.329853][ T5931] usb 2-1: USB disconnect, device number 21 [ 512.793123][ T10] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 512.808060][T11371] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2564 sclass=netlink_route_socket pid=11371 comm=syz.3.1309 [ 513.294375][ T10] usb 5-1: config 5 has an invalid interface number: 123 but max is 0 [ 513.347004][T11371] nftables ruleset with unbound set [ 513.374543][ T10] usb 5-1: config 5 has no interface number 0 [ 513.394336][ T10] usb 5-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 513.429807][ T10] usb 5-1: config 5 interface 123 altsetting 7 endpoint 0x4 has invalid wMaxPacketSize 0 [ 513.450732][ T10] usb 5-1: config 5 interface 123 has no altsetting 0 [ 513.564434][ T10] usb 5-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 513.576001][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.588423][ T10] usb 5-1: Product: syz [ 513.602784][ T10] usb 5-1: Manufacturer: syz [ 513.619413][ T10] usb 5-1: SerialNumber: syz [ 514.120901][ T9] usb 6-1: new full-speed USB device number 24 using dummy_hcd [ 514.313009][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 514.325623][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 514.367089][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 514.427617][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 514.495257][ T9] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 514.516360][ T9] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 514.544655][ T9] usb 6-1: Manufacturer: syz [ 514.598988][ T10] ni6501 5-1:5.123: driver 'ni6501' failed to auto-configure device. [ 514.651191][ T9] usb 6-1: config 0 descriptor?? [ 514.688834][ T10] usb 5-1: USB disconnect, device number 24 [ 515.467785][T11385] siw: device registration error -23 [ 515.549838][T11405] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1316'. [ 515.571429][T11405] netlink: 'syz.4.1316': attribute type 7 has an invalid length. [ 515.579876][T11405] netlink: 'syz.4.1316': attribute type 8 has an invalid length. [ 515.604362][ T9] rc_core: IR keymap rc-hauppauge not found [ 515.624035][T11405] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1316'. [ 515.673204][ T9] Registered IR keymap rc-empty [ 515.708290][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 515.740679][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 515.800197][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 516.301388][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input21 [ 516.324594][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 516.380709][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 516.582769][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 516.771319][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 516.861276][T11418] befs: (nbd4): No write support. Marking filesystem read-only [ 516.928439][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 516.963758][T11418] syz.4.1319: attempt to access beyond end of device [ 516.963758][T11418] nbd4: rw=0, sector=0, nr_sectors = 2 limit=0 [ 516.995098][T11418] befs: (nbd4): unable to read superblock [ 517.018154][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 517.193242][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 517.233867][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 517.270803][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 517.851589][ T9] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 517.877030][T11423] netlink: 'syz.2.1320': attribute type 1 has an invalid length. [ 517.924082][ T9] mceusb 6-1:0.0: Registered with mce emulator interface version 1 [ 518.017726][ T9] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 518.121847][ T9] usb 6-1: USB disconnect, device number 24 [ 518.175899][T11431] evm: overlay not supported [ 518.250721][ T1547] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 518.413880][ T1547] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 518.428222][ T1547] usb 5-1: New USB device found, idVendor=1b96, idProduct=0012, bcdDevice= 0.00 [ 518.439744][ T1547] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 518.457240][ T1547] usb 5-1: config 0 descriptor?? [ 518.478303][ T1547] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 519.125955][T11451] can0: slcan on pty25. [ 519.550856][T11443] can0 (unregistered): slcan off pty25. [ 519.788375][T11458] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1329'. [ 519.793839][ T30] audit: type=1400 audit(1746790138.994:470): avc: denied { setopt } for pid=11455 comm="syz.2.1329" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 521.532077][ T10] usb 5-1: USB disconnect, device number 25 [ 521.644486][T11480] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1334'. [ 522.209487][ T30] audit: type=1400 audit(1746790141.414:471): avc: denied { create } for pid=11487 comm="syz.5.1337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 522.210577][T11488] netlink: 'syz.5.1337': attribute type 1 has an invalid length. [ 522.263566][ T30] audit: type=1400 audit(1746790141.414:472): avc: denied { write } for pid=11487 comm="syz.5.1337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 522.505457][T11490] bond2: entered promiscuous mode [ 522.515435][T11490] 8021q: adding VLAN 0 to HW filter on device bond2 [ 522.524559][T11490] bond1: (slave bond2): making interface the new active one [ 522.532626][T11490] bond1: (slave bond2): Enslaving as an active interface with an up link [ 523.904255][T11516] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1345'. [ 523.936932][T11516] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1345'. [ 524.831082][T11531] libceph: resolve '½@½Ée2²âOAq§¨­cz' (ret=-3): failed [ 525.441443][T11522] overlayfs: failed to resolve './file0': -2 [ 525.602288][T11540] netlink: 'syz.2.1351': attribute type 1 has an invalid length. [ 525.799976][T11533] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1349'. [ 526.989086][ T5931] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 527.150856][ T5931] usb 6-1: Using ep0 maxpacket: 32 [ 527.186449][ T5931] usb 6-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 527.225210][ T5931] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.266848][ T5931] usb 6-1: config 0 descriptor?? [ 527.279144][ T5931] gspca_main: sunplus-2.14.0 probing 041e:400b [ 527.468759][T11566] netlink: 'syz.3.1359': attribute type 1 has an invalid length. [ 527.968907][ T5931] gspca_sunplus: reg_w_riv err -110 [ 528.017699][ T5931] sunplus 6-1:0.0: probe with driver sunplus failed with error -110 [ 529.582274][ T24] usb 6-1: USB disconnect, device number 25 [ 529.903455][T11593] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1364'. [ 530.604022][T11602] FAULT_INJECTION: forcing a failure. [ 530.604022][T11602] name failslab, interval 1, probability 0, space 0, times 0 [ 530.616894][T11602] CPU: 1 UID: 0 PID: 11602 Comm: syz.2.1365 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 530.616920][T11602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 530.616931][T11602] Call Trace: [ 530.616937][T11602] [ 530.616944][T11602] dump_stack_lvl+0x16c/0x1f0 [ 530.616973][T11602] should_fail_ex+0x512/0x640 [ 530.616996][T11602] ? fs_reclaim_acquire+0xae/0x150 [ 530.617022][T11602] ? tomoyo_encode2+0x100/0x3e0 [ 530.617045][T11602] should_failslab+0xc2/0x120 [ 530.617064][T11602] __kmalloc_noprof+0xd2/0x510 [ 530.617094][T11602] ? tomoyo_encode2+0x5d/0x3e0 [ 530.617120][T11602] tomoyo_encode2+0x100/0x3e0 [ 530.617148][T11602] tomoyo_encode+0x29/0x50 [ 530.617171][T11602] tomoyo_realpath_from_path+0x18f/0x6e0 [ 530.617205][T11602] tomoyo_path_number_perm+0x245/0x580 [ 530.617226][T11602] ? tomoyo_path_number_perm+0x237/0x580 [ 530.617248][T11602] ? __schedule+0x4/0x5de0 [ 530.617269][T11602] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 530.617320][T11602] ? hook_file_ioctl_common+0x36/0x410 [ 530.617338][T11602] ? hook_file_ioctl_common+0xac/0x410 [ 530.617356][T11602] ? hook_file_ioctl_common+0x145/0x410 [ 530.617381][T11602] ? __fget_files+0x20e/0x3c0 [ 530.617412][T11602] security_file_ioctl+0x9b/0x240 [ 530.617439][T11602] __x64_sys_ioctl+0xb7/0x200 [ 530.617464][T11602] do_syscall_64+0xcd/0x260 [ 530.617490][T11602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.617509][T11602] RIP: 0033:0x7f65afd8e969 [ 530.617524][T11602] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 530.617542][T11602] RSP: 002b:00007f65b0b9d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 530.617560][T11602] RAX: ffffffffffffffda RBX: 00007f65affb6160 RCX: 00007f65afd8e969 [ 530.617573][T11602] RDX: 0000200000000000 RSI: 00000000c0105512 RDI: 0000000000000005 [ 530.617585][T11602] RBP: 00007f65b0b9d090 R08: 0000000000000000 R09: 0000000000000000 [ 530.617596][T11602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 530.617607][T11602] R13: 0000000000000000 R14: 00007f65affb6160 R15: 00007fff2f147c68 [ 530.617634][T11602] [ 530.617744][T11602] ERROR: Out of memory at tomoyo_realpath_from_path. [ 530.852344][ T9] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 530.879225][T11605] FAULT_INJECTION: forcing a failure. [ 530.879225][T11605] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 530.895885][T11605] CPU: 1 UID: 0 PID: 11605 Comm: syz.1.1368 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 530.895918][T11605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 530.895929][T11605] Call Trace: [ 530.895936][T11605] [ 530.895942][T11605] dump_stack_lvl+0x16c/0x1f0 [ 530.895971][T11605] should_fail_ex+0x512/0x640 [ 530.895998][T11605] _copy_to_user+0x32/0xd0 [ 530.896025][T11605] simple_read_from_buffer+0xcb/0x170 [ 530.896054][T11605] proc_fail_nth_read+0x197/0x270 [ 530.896080][T11605] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 530.896108][T11605] ? rw_verify_area+0xcf/0x680 [ 530.896130][T11605] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 530.896157][T11605] vfs_read+0x1de/0xc70 [ 530.896185][T11605] ? __pfx___mutex_lock+0x10/0x10 [ 530.896209][T11605] ? __pfx_vfs_read+0x10/0x10 [ 530.896241][T11605] ? __fget_files+0x20e/0x3c0 [ 530.896275][T11605] ksys_read+0x12a/0x240 [ 530.896300][T11605] ? __pfx_ksys_read+0x10/0x10 [ 530.896333][T11605] do_syscall_64+0xcd/0x260 [ 530.896359][T11605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.896378][T11605] RIP: 0033:0x7f506c78d37c [ 530.896394][T11605] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 530.896411][T11605] RSP: 002b:00007f506d6d5030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 530.896429][T11605] RAX: ffffffffffffffda RBX: 00007f506c9b5fa0 RCX: 00007f506c78d37c [ 530.896441][T11605] RDX: 000000000000000f RSI: 00007f506d6d50a0 RDI: 0000000000000004 [ 530.896452][T11605] RBP: 00007f506d6d5090 R08: 0000000000000000 R09: 0000000000000000 [ 530.896463][T11605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 530.896474][T11605] R13: 0000000000000000 R14: 00007f506c9b5fa0 R15: 00007ffcca6f0208 [ 530.896501][T11605] [ 531.081395][ C1] vkms_vblank_simulate: vblank timer overrun [ 531.110581][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 531.118914][ T9] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 531.140965][ T9] usb 5-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 531.273022][ T9] usb 5-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 531.917378][ T9] usb 5-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 531.931145][ T9] usb 5-1: config 7 interface 0 has no altsetting 0 [ 531.937777][ T9] usb 5-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 531.947176][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 532.086793][T11619] netlink: 'syz.2.1373': attribute type 1 has an invalid length. [ 532.318737][T11631] syz.5.1377: attempt to access beyond end of device [ 532.318737][T11631] nbd5: rw=2048, sector=2, nr_sectors = 1 limit=0 [ 532.368026][ T30] audit: type=1400 audit(1746790151.574:473): avc: denied { read write } for pid=11630 comm="syz.5.1377" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 532.411468][ T30] audit: type=1400 audit(1746790151.584:474): avc: denied { open } for pid=11630 comm="syz.5.1377" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 532.537072][T11643] fuse: Unknown parameter '0xffffffffffffffff017777777777777777777770000000000000000000000000000000000000000' [ 637.560526][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 637.567505][ C1] rcu: 0-...!: (1 ticks this GP) idle=d89c/1/0x4000000000000000 softirq=52150/52150 fqs=0 [ 637.578457][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P11632/1:b..l [ 637.586464][ C1] rcu: (detected by 1, t=10502 jiffies, g=36325, q=65 ncpus=2) [ 637.594097][ C1] Sending NMI from CPU 1 to CPUs 0: [ 637.594129][ C0] NMI backtrace for cpu 0 [ 637.594144][ C0] CPU: 0 UID: 0 PID: 11643 Comm: syz.3.1378 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 637.594164][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 637.594177][ C0] RIP: 0010:check_preemption_disabled+0x8/0xe0 [ 637.594205][ C0] Code: 37 08 85 c0 74 04 90 0f 0b 90 e9 53 fc ff ff 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 54 55 53 48 83 ec 08 <65> 8b 1d 85 24 37 08 65 8b 05 7a 24 37 08 a9 ff ff ff 7f 74 0f 48 [ 637.594221][ C0] RSP: 0018:ffffc90000007ce0 EFLAGS: 00000082 [ 637.594233][ C0] RAX: ffff88805443a440 RBX: ffff888029569300 RCX: 0000000000000001 [ 637.594244][ C0] RDX: 0000000000000000 RSI: ffffffff8dcd2703 RDI: ffffffff8bf48320 [ 637.594254][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 637.594263][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 637.594272][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 637.594281][ C0] FS: 00007fe7648586c0(0000) GS:ffff8881249e1000(0000) knlGS:0000000000000000 [ 637.594297][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 637.594307][ C0] CR2: 000000110c28689f CR3: 0000000036148000 CR4: 00000000003526f0 [ 637.594317][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 637.594326][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 637.594336][ C0] Call Trace: [ 637.594342][ C0] [ 637.594348][ C0] ? __kasan_check_byte+0x13/0x50 [ 637.594367][ C0] lock_acquire+0x140/0x350 [ 637.594389][ C0] ? do_raw_spin_unlock+0x172/0x230 [ 637.594405][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 637.594425][ C0] ? __pfx_advance_sched+0x10/0x10 [ 637.594445][ C0] _raw_spin_lock+0x2e/0x40 [ 637.594460][ C0] ? advance_sched+0xd9/0xc80 [ 637.594480][ C0] advance_sched+0xd9/0xc80 [ 637.594500][ C0] ? find_held_lock+0x2b/0x80 [ 637.594519][ C0] ? do_raw_spin_unlock+0x172/0x230 [ 637.594536][ C0] ? __pfx_advance_sched+0x10/0x10 [ 637.594555][ C0] __hrtimer_run_queues+0x1ff/0xad0 [ 637.594575][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 637.594591][ C0] ? read_tsc+0x9/0x20 [ 637.594614][ C0] hrtimer_interrupt+0x397/0x8e0 [ 637.594636][ C0] __sysvec_apic_timer_interrupt+0x108/0x3f0 [ 637.594656][ C0] sysvec_apic_timer_interrupt+0x9f/0xc0 [ 637.594675][ C0] [ 637.594680][ C0] [ 637.594685][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 637.594714][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 637.594733][ C0] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 e6 9e 28 f6 48 89 df e8 8e f2 28 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 e5 5e 19 f6 65 8b 05 1e 94 34 08 85 c0 74 16 5b [ 637.594748][ C0] RSP: 0018:ffffc90000b27ca8 EFLAGS: 00000246 [ 637.594760][ C0] RAX: 0000000000000002 RBX: ffff8880b8427840 RCX: 0000000000000007 [ 637.594769][ C0] RDX: 0000000000000000 RSI: ffffffff8dbe181f RDI: ffffffff8bf48320 [ 637.594779][ C0] RBP: 0000000000000283 R08: 0000000000000001 R09: 0000000000000001 [ 637.594788][ C0] R10: ffffffff9084f117 R11: 0000000000000000 R12: 0000000000000000 [ 637.594797][ C0] R13: 0000007bfd42f080 R14: dffffc0000000000 R15: ffff8880b8427840 [ 637.594819][ C0] clock_was_set+0x599/0x870 [ 637.594838][ C0] ? __pfx_clock_was_set+0x10/0x10 [ 637.594855][ C0] ? rcu_is_watching+0x12/0xc0 [ 637.594871][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 637.594890][ C0] do_settimeofday64+0x304/0x4b0 [ 637.594911][ C0] ? __pfx_do_settimeofday64+0x10/0x10 [ 637.594929][ C0] ? bpf_lsm_capable+0x9/0x10 [ 637.594942][ C0] ? handler_ext+0x324/0xdf0 [ 637.594959][ C0] ? capable+0xd4/0x110 [ 637.594976][ C0] do_sys_settimeofday64+0x1dc/0x260 [ 637.594999][ C0] __x64_sys_clock_settime+0x1be/0x2a0 [ 637.595015][ C0] ? __pfx___x64_sys_clock_settime+0x10/0x10 [ 637.595030][ C0] ? rcu_is_watching+0x12/0xc0 [ 637.595050][ C0] do_syscall_64+0xcd/0x260 [ 637.595071][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.595086][ C0] RIP: 0033:0x7fe76398e969 [ 637.595100][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 637.595115][ C0] RSP: 002b:00007fe764858038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e3 [ 637.595128][ C0] RAX: ffffffffffffffda RBX: 00007fe763bb6240 RCX: 00007fe76398e969 [ 637.595139][ C0] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000000 [ 637.595148][ C0] RBP: 00007fe763a10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 637.595158][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 637.595171][ C0] R13: 0000000000000000 R14: 00007fe763bb6240 R15: 00007ffe4f19a698 [ 637.595187][ C0] [ 637.596121][ C1] task:syz.5.1377 state:R running task stack:26360 pid:11632 tgid:11630 ppid:6174 task_flags:0x400140 flags:0x00004002 [ 638.077509][ C1] Call Trace: [ 638.080780][ C1] [ 638.083711][ C1] __schedule+0x116f/0x5de0 [ 638.088233][ C1] ? __pfx___schedule+0x10/0x10 [ 638.093079][ C1] ? __lock_acquire+0x5ca/0x1ba0 [ 638.098033][ C1] ? mark_held_locks+0x49/0x80 [ 638.102798][ C1] preempt_schedule_irq+0x51/0x90 [ 638.107818][ C1] irqentry_exit+0x36/0x90 [ 638.112231][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 638.118209][ C1] RIP: 0010:debug_lockdep_rcu_enabled+0xe/0x40 [ 638.124385][ C1] Code: 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 8b 05 66 3b 18 05 85 c0 74 20 <8b> 05 10 6a 18 05 85 c0 74 16 65 48 8b 05 68 39 37 08 8b 80 ec 0a [ 638.143997][ C1] RSP: 0018:ffffc90002f472a0 EFLAGS: 00000202 [ 638.150062][ C1] RAX: 0000000000000002 RBX: ffffc90002f47720 RCX: ffffc90002f48001 [ 638.158026][ C1] RDX: ffffc90002f47728 RSI: ffffc90002f47710 RDI: ffffc90002f47328 [ 638.166008][ C1] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 638.173996][ C1] R10: 0000000000000001 R11: 00000000000145c2 R12: ffffc90002f47368 [ 638.181976][ C1] R13: ffffc90002f47318 R14: ffffc90002f47720 R15: ffffc90002f4734c [ 638.189983][ C1] unwind_next_frame+0x3de/0x20a0 [ 638.195015][ C1] ? alloc_buffer_head+0x21/0x160 [ 638.200042][ C1] ? stack_depot_save_flags+0x28/0xa50 [ 638.205505][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 638.211659][ C1] arch_stack_walk+0x94/0x100 [ 638.216341][ C1] ? folio_alloc_buffers+0x2bd/0x830 [ 638.221627][ C1] stack_trace_save+0x8e/0xc0 [ 638.226301][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 638.231678][ C1] kasan_save_stack+0x33/0x60 [ 638.236354][ C1] ? kasan_save_stack+0x33/0x60 [ 638.241205][ C1] ? kasan_save_track+0x14/0x30 [ 638.246074][ C1] ? __kasan_slab_alloc+0x89/0x90 [ 638.251097][ C1] ? kmem_cache_alloc_noprof+0x1cb/0x3b0 [ 638.256731][ C1] ? alloc_buffer_head+0x21/0x160 [ 638.261799][ C1] kasan_save_track+0x14/0x30 [ 638.266563][ C1] __kasan_slab_alloc+0x89/0x90 [ 638.271421][ C1] kmem_cache_alloc_noprof+0x1cb/0x3b0 [ 638.276893][ C1] ? lockdep_init_map_type+0x5c/0x280 [ 638.282268][ C1] ? alloc_buffer_head+0x21/0x160 [ 638.287299][ C1] alloc_buffer_head+0x21/0x160 [ 638.292171][ C1] folio_alloc_buffers+0x2bd/0x830 [ 638.297297][ C1] create_empty_buffers+0x36/0x480 [ 638.302409][ C1] folio_create_buffers+0x109/0x150 [ 638.307607][ C1] __block_write_begin_int+0x320/0x16d0 [ 638.313190][ C1] ? __pfx___block_write_begin_int+0x10/0x10 [ 638.319189][ C1] iomap_write_begin+0x5de/0x1680 [ 638.324237][ C1] ? fault_in_readable+0x170/0x200 [ 638.329363][ C1] ? fault_in_readable+0x15d/0x200 [ 638.334479][ C1] ? fault_in_readable+0x160/0x200 [ 638.339610][ C1] ? __pfx_iomap_write_begin+0x10/0x10 [ 638.345069][ C1] ? fault_in_readable+0x1a7/0x200 [ 638.350199][ C1] ? __pfx_fault_in_readable+0x10/0x10 [ 638.355683][ C1] iomap_file_buffered_write+0x43b/0xcb0 [ 638.361347][ C1] ? __pfx_iomap_file_buffered_write+0x10/0x10 [ 638.367533][ C1] ? __pfx_down_read+0x10/0x10 [ 638.372305][ C1] ? preempt_count_add+0x76/0x150 [ 638.377344][ C1] ? mnt_put_write_access_file+0xc1/0xf0 [ 638.382999][ C1] blkdev_write_iter+0x56f/0xdf0 [ 638.387950][ C1] vfs_write+0x5ba/0x1180 [ 638.392287][ C1] ? __pfx_blkdev_write_iter+0x10/0x10 [ 638.397752][ C1] ? __pfx_vfs_write+0x10/0x10 [ 638.402517][ C1] ? find_held_lock+0x2b/0x80 [ 638.407210][ C1] ksys_write+0x12a/0x240 [ 638.411555][ C1] ? __pfx_ksys_write+0x10/0x10 [ 638.416424][ C1] ? rcu_is_watching+0x12/0xc0 [ 638.421200][ C1] do_syscall_64+0xcd/0x260 [ 638.425715][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.431623][ C1] RIP: 0033:0x7f15f8b8e969 [ 638.436042][ C1] RSP: 002b:00007f15f9940038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 638.444461][ C1] RAX: ffffffffffffffda RBX: 00007f15f8db6080 RCX: 00007f15f8b8e969 [ 638.452428][ C1] RDX: 00000000fffffd2c RSI: 0000200000000000 RDI: 0000000000000006 [ 638.460396][ C1] RBP: 00007f15f8c10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 638.468358][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 638.476318][ C1] R13: 0000000000000000 R14: 00007f15f8db6080 R15: 00007fff73da6a78 [ 638.484311][ C1] [ 638.487337][ C1] rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g36325 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 638.499663][ C1] rcu: Possible timer handling issue on cpu=0 timer-softirq=32331 [ 638.507548][ C1] rcu: rcu_preempt kthread starved for 10502 jiffies! g36325 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0 [ 638.518904][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 638.528859][ C1] rcu: RCU grace-period kthread stack dump: [ 638.534731][ C1] task:rcu_preempt state:I stack:28024 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 [ 638.546660][ C1] Call Trace: [ 638.549931][ C1] [ 638.552857][ C1] __schedule+0x116f/0x5de0 [ 638.557369][ C1] ? __lock_acquire+0x5ca/0x1ba0 [ 638.562314][ C1] ? __pfx___schedule+0x10/0x10 [ 638.567165][ C1] ? find_held_lock+0x2b/0x80 [ 638.571839][ C1] ? schedule+0x2d7/0x3a0 [ 638.576166][ C1] schedule+0xe7/0x3a0 [ 638.580230][ C1] schedule_timeout+0x123/0x290 [ 638.585076][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 638.590443][ C1] ? __pfx_process_timeout+0x10/0x10 [ 638.595729][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 638.601532][ C1] ? prepare_to_swait_event+0xf5/0x480 [ 638.606996][ C1] rcu_gp_fqs_loop+0x1ea/0xb00 [ 638.611765][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 638.617049][ C1] ? rcu_gp_init+0xc76/0x15a0 [ 638.621734][ C1] ? rcu_is_watching+0x12/0xc0 [ 638.626492][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 638.632304][ C1] rcu_gp_kthread+0x270/0x380 [ 638.636982][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 638.642177][ C1] ? rcu_is_watching+0x12/0xc0 [ 638.647023][ C1] ? lockdep_hardirqs_on+0x7c/0x110 [ 638.652223][ C1] ? __kthread_parkme+0x19e/0x250 [ 638.657246][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 638.662442][ C1] kthread+0x3c2/0x780 [ 638.666509][ C1] ? __pfx_kthread+0x10/0x10 [ 638.671098][ C1] ? __pfx_kthread+0x10/0x10 [ 638.675688][ C1] ? __pfx_kthread+0x10/0x10 [ 638.680268][ C1] ? __pfx_kthread+0x10/0x10 [ 638.684848][ C1] ? rcu_is_watching+0x12/0xc0 [ 638.689606][ C1] ? __pfx_kthread+0x10/0x10 [ 638.694195][ C1] ret_from_fork+0x45/0x80 [ 638.698606][ C1] ? __pfx_kthread+0x10/0x10 [ 638.703190][ C1] ret_from_fork_asm+0x1a/0x30 [ 638.707971][ C1]