last executing test programs: 5m36.271189978s ago: executing program 32 (id=20): r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_FREQUENCY(r0, 0x402c5639, &(0x7f0000000040)={0x6, 0x4, 0x59a4}) 5m32.914644222s ago: executing program 33 (id=32): bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/node/node0/reclaim\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='100000', 0x6) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) memfd_create(0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x2, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) socket(0x2, 0x80805, 0x0) ptrace$poke(0x4, r1, &(0x7f00000011c0), 0xfffffffffffffffe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = userfaultfd(0x80001) r3 = socket(0xa, 0x801, 0x0) getsockopt(r3, 0x29, 0x40, 0x0, &(0x7f0000001ffc)) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="042f01"], 0x4) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) 4m44.658294488s ago: executing program 34 (id=154): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)="1400000016000b63d25a80648c2594f91624fc60", 0x14}], 0x1}, 0x0) 4m44.565173468s ago: executing program 35 (id=155): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f0000000140)=@arm64={0x5, 0x99, 0x5, '\x00', 0x7}) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e22, @empty}}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000ac0)="ee", 0xfffffe5e}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d70000001010"], 0x10b8}, 0x8000) landlock_create_ruleset(&(0x7f0000000080)={0x8450, 0x1, 0x3}, 0x30, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) splice(r2, 0x0, r1, 0x0, 0x6, 0xc) mq_open(&(0x7f0000000100)='&\x00', 0x40, 0x100, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0xfefc, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x2c008050}, 0x48000) 4m25.623020799s ago: executing program 36 (id=202): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x6, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000f9ffffff0000000000000000850000002c00000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x62}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={r1, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) syz_emit_ethernet(0x11e05, &(0x7f0000000600)=ANY=[], 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r3, 0x5761, &(0x7f0000000040)={0x4, 0x0, [{0xa, 0x2, 0xd, [0xff, 0xdeb, 0x6, 0x0, 0x3e10, 0x8000, 0x2, 0x7fffffff]}, {0x7, 0xb, 0xa2f4, [0xeed, 0x8, 0x6, 0xee, 0x200, 0x7fff, 0x5, 0xde]}, {0x7, 0x400, 0x6, [0x1, 0x5530bc71, 0x0, 0x40, 0x1, 0x4, 0x4, 0x6]}, {0x7, 0x1, 0x3, [0x6, 0x1ff, 0x10001, 0x2, 0x7, 0x2, 0x4, 0x2]}]}) 4m23.664542313s ago: executing program 7 (id=233): r0 = syz_usb_connect$lan78xx(0x5, 0x70, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000140)=ANY=[@ANYRESDEC=r0, @ANYRESDEC=r0, @ANYRESDEC=r0, @ANYRES8=r0, @ANYRES16=r0], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x1c, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) poll(0x0, 0x0, 0x7f) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) unshare(0x2c020400) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x400c804) r1 = io_uring_setup(0x66c0, &(0x7f0000000040)={0x0, 0xed97, 0xb0890, 0x200000c, 0x4c1}) pselect6(0x40, &(0x7f0000000380)={0x101, 0xfffffffffffffffc, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffd, 0x1835}, &(0x7f0000000000)={0x8000021000000021, 0x0, 0x0, 0x6, 0x0, 0x401, 0xfffffffffffffffe, 0x3}, 0x0, 0x0, 0x0) io_uring_enter(r1, 0x2219, 0x7721, 0xb7, 0x0, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r2, 0x7) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e00000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="00000100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000800000000000000000"], 0x50) syz_usb_connect(0x0, 0x4c, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000202000040d804820000010000000109023a02020100052400100105240625"], 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) madvise(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x64) syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000040)=ANY=[@ANYBLOB="20130300000004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000007c0)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000e00)="28d61f7b1e7790f92b23fabafce370f34e14ccc28865005fc7eb0a4fb45a78ca3891721b81e678a3e910307120ddfb3a8e60dbbfe57d6019b5e0abbfb42875e7f37c6985fd9fb614bff9a246c91fdae73c9c14f896b9b76171ecc7a1a2cccd1de4ed05f04efa3aa3cd271721c5870838176f376e0abdad05f329c5c5491e88a2b3b9ad4c85b03a2f2976ac3b972b0024306e8c53dd745901a1539ed0f4191d795a616c32e49249ac80cddd0d7fc948a2962bb91ab4890b75e5907fb4e509bf772a616bc9284f4db39e3509f96b4419d97221551dac0d54daf502e993995090c1e271c41af656beffc67f30ad9eb078c31ad62ecd5135b31555602a6477c6d26c98a97d3dc8cad5a51456f4680be3e14e6e3d88e18a5853c22960e8b94bb6c2baf1d75337d0fc1960a0235a60ae4b9ee47034d0749e88e09d24eaf6d44c577298310c2e1cb27736771a406f9628ff22b6b91a5f6c83fa63a1d91cfb55004095c8600f81b32e9a91949e31d76d80e42e1e5bcd26d415230039909f51906be3c97ed9b5059d6ce565d8a23eb1b2d9cb241723861923ff5f90c42a13155c4e3a1688d51cfaefef66a37f70b11563794f71fb444afb5bb6a09e6b569f65ffad3087a0fd8dd10021d6ccaa65474c611c31105b6995a0c4487a47720a813654f07e5a34334407ef44031be339f1a300aff404393fd560416856e4bed50cb44b948216563f2e3a9d39a3d904eb7071561169ae155e3976afa8b382c4031c11e06bf9bfb7825ecc1d7bd7a6467d19be683e820f586951d6b3268b3c2326c9ebb2c62f7197a9eba72f076ea9c99049cb30cab69b854a77f86bf21151289b4b0320d88d9b4b8dd9967de413f48fc5d4d6f7397034e3dd2dd109182ef9597fa9818bc8f9ae67afcee8a7ba8dc7e949c011716e661d57deb574ea1accff1bb84efd65da4eb217948c0b17c3b6744fbdcd5ade7b28215224ea1591a9a6c8146b3852b72f466d55e94a3b4955f0446b936dc12b86b5699e0f34fbdbbecedcbfd42a0d9680a5d4c41416e1257482a971e9b7bdcd7ff1a38ba2c098e5649e04bc36d8c19719cd6d5f9aab0845d4b202658bb21a3414dc25ac82f948ef264518be946b245660d1e0d877ca039ffff56720fa0c157d2584d232d9d87c782acfb29c4967ac58b9cf43f1c92d6ccd09e48a02a2567689623ff38c6ed8b9f965ba84fe2abaad43f69c23342fc7b4c135c7b6667f90b30e03b9dc0a8815bb20d537d61ef0ae8d22adfb2b26ba3064a206328e9a7dd9092fd766de1e9b804387309b2bebd440945dc9e0fe4e640dd1276251441a5b28e42665fd046c32f3f98e1126584e6cb8235a1f10f18261a59d432b3a3a664642a6d39c5e65c8220f1f506d5629d40be4fe2d0f4f33425415d167c023a77efd85dde661a5bcf74a2d3ae1840546d484fe130b07957979a79daf874b071d756e4c3c3be78ac9b2aa9607bee5721e5905f1b2c7649c7d223953fa6ac6f3ef7e06e1cd4188702c4a6e178e4b19466772a2306006fc7fb90576e0c7c17b45b2eb8eec675c4cbd0883c62a6fd524eea25f0e56a20b0c789633baa875f39d3ebe706f9b11bfaca4b2826da6775c74b88cb98391701e07c3715f69553236f87c7e5337ae17cca5bc54947891e38a2d4255b563688cd05f48fd870a42b04af6d964bb349f705f13656649c65c79c338b37adf655f49bdb400499145c871dda205b61e2242b05cca54f4ceaf33afb5712493b90fc8ce6ecd4ac515970bb7dade343f73951c556c932ca712f8c800ec34c03e5fcdfbebb73414bd51845645fe97f95403a1dedd8f3429e89d63bc2e592d131c89adc1046b8254e0b2fde5df5dae2adeb1c7c71d397ccd3b8d56352eb838a2b2c3a913774de65c344161503c03cdc2b750295ffde0f79f0b5cc50ec62c5f7f02e9c450848129ba1da32fcf6f438726532e12298bb7e73125182d02989c38b6fd53dc93f271908d7d294c71457652dcd886c5980e95a3daf54a37e5cd5c05aa18c8bae306d09be9ae1ec2e55fed6fb844f70bdaf2ee0f53d56c5fc43c15057bd88f76e2e367fb369995117b1daf8bef1af96f196e4d76910bd1a600e946157823a6ccb0655d58f57bafff14d5b5e700bf119319f7a6d5ab696095db92e776092014b32a791f4d927b0b20c9ef623e78da9a88b12150b53980ef457de45625f047c0bcc438fd9f25ab494301005a93677a63cc5494a0cae71d03c11c364db3d8fee995c6f42c88b0108fa2289cefdbe021b04986fad9f3a3547f6f9c32c10813973b4f3c6b04767019b2f9759511337df47135008b6c0cf26dc839378d55b6a680591fc5f0f05464535e6c276c5e8f28340434a9d57ae2bcd7ec41dbbc5ebdb94e7ab6269f0b155ce06c2bffa748a2b896a7b52240528ea36d754831ba83db1217534eaee5ff67a6868f14d5b7da53c4ec472b87a18f0caeb9073b89d8926717a89d8adf387610e8f07427d937e1c393cb5a54e37c0b1aac8af341e29e03f73db522791fe957efd33274a3462689c0dbc555b424898d84b3dc4268998d2816b8583ffad26ed651fecbc6b7b65b875cdb0e6a036c21035194f45b7df3b6717e27218a2c9bc261ea90fcb50e78f71582f34b9406eb33885930c20858a215d1af1a40eeab343e2eedb0f4d9d5b49ac9bb5d17381a2ccb9f2d5e0e7d6f28cec3255007a2323a6c0dc0eca46aae19943c7f945747203dfe6dbe8ff2aa939bdfa50142ebdd17acf7bbd717fe393c7ede8a21750a78dab30796ab20b9a57af12b07c8a5a15af739a3690dab479c44b87542aa2f402a7cda66cd308cbfb391ad71ef905117c8db1df9311d89d8057881002a6f409d6e359975db500532285af4363c8cdb5c853e5ab317f4c9ca4cd8a0d00ebb3c35c1fd6c0ef9aac43f9238e05b2c04986a3b37978b85c41e49eebd8648191730b2c859681fe5675cd072c7a1fd70ff8081da1a69ca79f9cc43f36f53a89e723e38b5a32442980d54f19290a15f6d1ea207febf7f0a801bd43be3d24804534a8ab4c8a0cd85f3686e9f3956ba0bbfba021dd4fd532a6bc5d9a8517e6f82622ba0b4d4f6c7da36f5deef6687e56648147e7eec0d1569871dce1f94d3308abb8523f234631285ea5e2c966dd56e3fe69eb8b159b445b77e07c4d2b21b10035f84bd16d75b83a6af5c7a7480d4d20e2be82a8860ef6dcaba3284ea2bdbfd0c0017c4554c71b098dbeef57519e035dfbde4bdbb5395d5a48a3830725e27013dd9f5228211a77ead41bb613e127e9323ab20d38f846fe26b759f31535467efbaaef0f0df95c2d82797347d2584779619af30c0cd3da791de30cd57d0f74cfe82c004cadbd5be9774e52583c085d60e56a0dc2761b2d58c7b316b3fc894d8b62a2048e3f7bb23490d8f33f717a47c60701b0ca2caaf9b0fa3d6f1343557f0b141679ac86c21401f567b00b934254435e1018a4c2ae06fb929c5c7f293fedf7efae83b5f1384d8409dc2b7e0d77837e8013ad5c5129e69a140739a52056b216f38fa43b5f1cb8680e5e5dd154142dbead429af8c604911c790669b01e42299680f8ec03f72a99dedda884a242e7ec6baa20e4303a26df8686b70f2ec2eb297bebf0132ee3695079d6b4fabf1d6ed4f5208067e977d7a4b4be8baed02fe82cbf3d5cdda61fd0c5ed6b09c025fe5e401d8df4a0008b8bbb3bc0a44210c839e0677c188efce2f03d71d6c2f3600802aeb823b0f9c6050193072ae69aeefd09925a61c11dc11e85e1fe38526f5aad1007534e32fb8b21f2e52aeced1ad7ce6d42ac579884bbf6a2317baf40b32c1a6fdf8ed2240e71ba2878b0b98504843aca478edd3533fc302ce04b1513619b885249f3eec198a435ed203e3c1b897f2c3aac03b3b4cc58a8eb36bee95a9e23a8c5c252c2ef2fd618aef1eb0ecaabf8567bfb25d4dffc964605710ecfe85448b676b0700b1230d3e2c80be0775f8576ab802ae517528313538067f7e53ca9c885a0420d7a55dbae348ebdabf1b72147da4f2fe53b18dc4956ed9fdf1fa44346283d255d91fbdf863c2ed792890e221ec8ac0e20dd9f70f55542a6b4c97f83a972664d3e535a546aa22c5d87ca7a560a85ea72c295b31311f71f898ddb36acaec024e2c48513ce56c9557418b58255749fe39ef30e3d3209848e2077945024fd2015d6b4375aa4918fc12b4f6eac26303b9f2fc7bad260bc2f1611efff0bdd409c883b2cf8daf7aa076d75a80e3bd75e24d5edbca5e34fc81ff811b1172f5b0ae96400a315648ee8f3929c20fc586dd17917c0e6694c9ba6a83ca0e752cec64f4abacf5935ed74cf445cf1139b1c578d88946ea02e8ec8320c204c15bc92cd82fe2efeab08c4bed44d3a2a8c0f1ee1ca2f47c7359d2e813acafce6bbfa4f88755c07fddd27c611924de80a08e57964619851c3b6468e0fc6a0c5fdb54b1db06506b517a851b1cfab2c24d93d6bc89e56949bd2292e767937c40296243cb52973795adfa352fdac8af99bc438198a16dc96fcd4201162c9ee379f42ef1275a843c2d0012ce7be3dcd853fb9e11be670fd27007d42ccb6478781cd42f212620c2e32ea575388a4a865bdc21d3cd689fada4a2ee29cfe16ac162fe95bae0a6d86747e2c292befa17e71cb05230eae31f719683c10584b9a20759b251e4b71af7488415896930a67be45df20ed6a7c5753010982499c8e79d9b4ec24a816370cb7efdfc2985d61b7330e2f3c6e78214611f9cd9a22b25fd51d67bf73f913d69d328a9fe19a9a24bd0499d9bcd7f576a647eef1572dc2ad246c6797cee6c9f149c21ad858d1cec88751e28eaca67504c0846bf521aa2f0ad4d5233b841cbe6a05912406d6a95c7efa14bdb671be87db6e0d03c299300acc2f36f378897ad3ec6cc03f09cc5a762be0e8f60d0f31cbfd348470ffc100eebc68a383103be47350af9fe353644ed09d1110f9a3df450d7c686c8208a5aced069bb69f75475ff8737338caff2cf377a0cc6d757ba40201306fd226681d2f375911aaf2ffeb7cc76ed32f273f4ee047a2e03ba046c6647cf797dfb027711041756b23ed6bf100ec764997ff9944bf32778613d11261dca6420e6adcb5bd7f4e40a18f52f640fd75a77c40fb6dde4d4826dece00fa5ba4f56c447ebb9250c803d6b063bcc68aa43ac44ce58299b0a053b021e3a0b498d281d658c74abf46f8f05d90b96e12dac26317c253828af3ccb2f3b9b9226d66001bcd4bdfb06bce0c367b0034efbaad3da8d753e3691bc06657d0ddc184db7292505d50ce5880cd7290f42bb799bc0ac47ce9ad998b36077952908c03cfb7e969504bff06248f359d6d571658e50c4a0381c2a5dbd5ecd858ffeab326b03b497f69729a5fdfc7d35d14da7aaa9514be931486e8a3a506693a16e586df3032b9cc98addfd05637bc81ad0dfa77cd6d89c886def3c6129a7ec498e61dc0d1af792dd7766123e21e7bd1ad4923ac43ca6e0fe703d882e8f8eed95eefbf234a58294fabb79e95b9277e3698d24754592618972694e0ccb00428f3c27b950642dda3e51092174dff04d35d3ecd89d6dfd56cbf099e8e38971d47945aa7809ee89a8152e3a929cc211cbda62c88012178a65679d6b90fc67f91f66830f38f9a0e9c9292a44f1f32d4b03983137c3d456943c24c839a1f7b96b1629c4b18561e4636627fc94d7e099ebcd036743775af4f43c4a7c365dd130d0b28821c677bd41f56bad1deefcfb9ae6f1ce3152f21a69f39a61d6bc632d9599c125978f5c360a794468a80591b69a366074", 0x1000, 0x4040000, &(0x7f0000001ec0)={0x11, 0x7, 0x0, 0x1, 0x2, 0x6, @local}, 0x14) syz_usb_control_io(r0, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0xd0f, 0x70bd25, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}]}, 0x30}}, 0x44080) socket$nl_route(0x10, 0x3, 0x0) 4m20.286431289s ago: executing program 7 (id=238): r0 = socket$tipc(0x1e, 0x2, 0x0) setresgid(0xee00, 0xee01, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04000a", 0x15}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f00000000c0)={0x0, 0x6e}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000140)={r3, 0xff0c, 0x2, [0xbb6b, 0xfff8]}, 0xc) socket$kcm(0x10, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0xfe33) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="563f000019"], 0xfe33) setresgid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) ioctl$SIOCGETNODEID(r0, 0x89e1, &(0x7f0000000000)={0x1}) 4m19.788130917s ago: executing program 7 (id=239): bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/node/node0/reclaim\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='100000', 0x6) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) memfd_create(0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x2, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syslog(0x3, &(0x7f0000000280)=""/7, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) socket(0x2, 0x80805, 0x0) ptrace$poke(0x4, r1, &(0x7f00000011c0), 0xfffffffffffffffe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = userfaultfd(0x80001) r3 = socket(0xa, 0x801, 0x0) getsockopt(r3, 0x29, 0x40, 0x0, &(0x7f0000001ffc)) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="042f01"], 0x4) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) 4m18.511931599s ago: executing program 7 (id=243): syz_emit_ethernet(0x3b6, &(0x7f0000000940)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x500, 0x26000000, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0302"}, {0x0, 0x1, "000000050000000026000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x0, "b8a3e100908f61640000000200000000000000000000000000008879e66485201a0015ca83747357a02745000400"/55}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) syz_usbip_server_init(0x1) syz_usb_connect$uac2(0x5, 0xe2, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000300000010"], 0x0) r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000005d40), 0x1, 0x0) r1 = epoll_create1(0x80000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000240)={0x3}) syz_emit_ethernet(0xbe, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa23aaaaaaaaaabb8864450000b000000000041190780000000000000000fffc4e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa8698d0a881c5185934d51b57d036ad3c045942824251d7d17b5191584bcd4fbe40a5a3deb25f00523424dbcfd56f1375461caaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1d19cb307b3472ab9cdb042d2643fcbb2c5a57df67d07"], 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffef}]}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000018"], 0x44}}, 0x0) r4 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, 0x0, &(0x7f0000000180)='3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000001c0)='source\x00', &(0x7f0000000200)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000240)='addr\x00', &(0x7f0000000280)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000340)='mountaddr\x00', &(0x7f0000000380)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c8, &(0x7f0000000100)) ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c9, &(0x7f0000000100)) syncfs(r1) pwritev2(r0, &(0x7f0000005ec0)=[{&(0x7f0000005d80)="91", 0x1}], 0x1, 0x5, 0xc7, 0x9) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="38000000100003042bbd7000fedbdf2500000300", @ANYRES32=0x0, @ANYBLOB="2110000000000000180012800b00010067656e657665000008000280040010"], 0x38}, 0x1, 0x0, 0x0, 0x81}, 0x814) r7 = socket(0x10, 0x3, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000540)={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0xc) sendmmsg(r7, &(0x7f0000000000), 0x4000000000001f2, 0x600) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) 4m2.481214795s ago: executing program 37 (id=243): syz_emit_ethernet(0x3b6, &(0x7f0000000940)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x500, 0x26000000, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0302"}, {0x0, 0x1, "000000050000000026000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x0, "b8a3e100908f61640000000200000000000000000000000000008879e66485201a0015ca83747357a02745000400"/55}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) syz_usbip_server_init(0x1) syz_usb_connect$uac2(0x5, 0xe2, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000300000010"], 0x0) r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000005d40), 0x1, 0x0) r1 = epoll_create1(0x80000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000240)={0x3}) syz_emit_ethernet(0xbe, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa23aaaaaaaaaabb8864450000b000000000041190780000000000000000fffc4e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa8698d0a881c5185934d51b57d036ad3c045942824251d7d17b5191584bcd4fbe40a5a3deb25f00523424dbcfd56f1375461caaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1d19cb307b3472ab9cdb042d2643fcbb2c5a57df67d07"], 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffef}]}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000018"], 0x44}}, 0x0) r4 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, 0x0, &(0x7f0000000180)='3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000001c0)='source\x00', &(0x7f0000000200)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000240)='addr\x00', &(0x7f0000000280)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000340)='mountaddr\x00', &(0x7f0000000380)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c8, &(0x7f0000000100)) ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c9, &(0x7f0000000100)) syncfs(r1) pwritev2(r0, &(0x7f0000005ec0)=[{&(0x7f0000005d80)="91", 0x1}], 0x1, 0x5, 0xc7, 0x9) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="38000000100003042bbd7000fedbdf2500000300", @ANYRES32=0x0, @ANYBLOB="2110000000000000180012800b00010067656e657665000008000280040010"], 0x38}, 0x1, 0x0, 0x0, 0x81}, 0x814) r7 = socket(0x10, 0x3, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000540)={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0xc) sendmmsg(r7, &(0x7f0000000000), 0x4000000000001f2, 0x600) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) 4m0.163902009s ago: executing program 38 (id=251): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x101040, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000040)=0x2) epoll_create1(0x0) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x5, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) bpf$MAP_CREATE(0x0, 0x0, 0xfffffe9d) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000200)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000ffff00000000000000bd0000000000000000000000e4ec01000000004000000000fc00000000000000000000000000013da51fd47aa2e2f700000000000000000000000000000000000000000000000000000000000000060000000000000000050000000a004e200e8a34c38f36f0c7eb2700d609bcf41076d88144448ebe7994dd1b33d7c8787734cc315672f62261ceeede940774fd94d2767288cfb3a20882449d601ff878eedd3d57c9eb3a723b62102bd534c8a304a975d752e82cc8d5f969771c94a1d69cfd8694e29b9468fca5df65ece31ed7c209325604001fcd06adc3ac391f60a3523d6d0b4a8a41d39b78057b7b3c16c91cbbadefcf9ec61259915a0e5d03c1403e5fb5424d07d479b047e9a9858276c82b3829ac35ec93de49fc08ecc8ddd27dc63b63ab836f"], 0x310) setsockopt$inet6_group_source_req(r3, 0x29, 0x2c, &(0x7f00000005c0)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x3, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x103080, 0x0) 3m40.146749862s ago: executing program 39 (id=288): r0 = socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x4, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1000}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}]}, &(0x7f0000000080)='syzkaller\x00', 0x3}, 0x94) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_opts(r1, 0x0, 0x0, &(0x7f0000000280)="851e0e18540899c7b572fa", 0xb) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x0, 0x1000, 0x10000}, 0x20) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newqdisc={0x88, 0x24, 0xe0b, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x58, 0x2, {{0x1, 0x6, 0xa00, 0x3, 0x85, 0x200ff}, [@TCA_NETEM_LATENCY64={0xc}, @TCA_NETEM_JITTER64={0xc}, @TCA_NETEM_RATE64={0xc, 0x8, 0xe62077891e54f027}, @TCA_NETEM_LOSS={0x18, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x14, 0x2, {0x4, 0x4, 0x6b08, 0x7}}]}]}}}]}, 0x88}}, 0x4000080) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14) mount$bpf(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x320c8d4, &(0x7f0000000600)=ANY=[@ANYBLOB='mode=00000000000000000000004,context']) sendto$inet6(r0, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 3m33.087586253s ago: executing program 4 (id=313): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000003000000850000008600000018010000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a800000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 3m31.685809911s ago: executing program 4 (id=314): r0 = msgget(0x1, 0x240) msgctl$IPC_RMID(r0, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$selinux_user(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r4 = gettid() ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000100)={0x9, 0x800, {}, {0xee01}, 0xfffffffffffffff9, 0x7}) io_setup(0x5, &(0x7f0000000040)) r6 = getgid() chown(&(0x7f0000000200)='./file0\x00', 0x0, r6) r7 = getpid() ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000140)=0x0) r9 = getgid() r10 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r10, &(0x7f0000019680)=""/102392, 0x18ff8) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@ipv4_newroute={0x30, 0x18, 0x1, 0x1000, 0xfffff7ff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@RTA_NH_ID={0x8, 0x1e, 0xa1}, @RTA_MULTIPATH={0xc, 0x9, {0x2, 0x8, 0x2}}]}, 0x30}}, 0x44890) r12 = syz_ublk_setup_io_uring(0x3194, &(0x7f0000000180)={0x0, 0x894f, 0x2, 0x2, 0x13}, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r13, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1800000040000703fcffffff00000100037c"], 0x18}, 0x1, 0x0, 0x0, 0x4008011}, 0xc000) r14 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x9}, 0x50) syz_open_procfs(0x0, 0x0) r15 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r15, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r16 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r16, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602ffa100000e000a000f000000028000001294", 0x2e}], 0x1}, 0x40) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000006000000000000000b00000018110000", @ANYRES32=r14, @ANYBLOB="0000000000000000b702000014000000b70300000007ca689b6f000086000000bf09000000000000550901004100000095000000000000000d00f8ff000000008301c1bf91000000000000b702000203000000850000002a000000b7000000000000009500000000"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x25}, 0x94) sendmsg$netlink(r1, &(0x7f0000000380)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000040), 0x0, &(0x7f00000002c0)=[@rights={{0x18, 0x1, 0x1, [r2, r3]}}, @cred={{0x1c, 0x1, 0x2, {r4, r5, r6}}}, @cred={{0x1c, 0x1, 0x2, {r7, r8, r9}}}, @rights={{0x18, 0x1, 0x1, [r10, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [r12, r13, 0xffffffffffffffff, r14]}}], 0x90, 0x4000000}, 0x24004000) 3m30.880756511s ago: executing program 4 (id=317): syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x4004000) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000000d06010200000000000000000500000211000300686173683a69702c706f727400000000050001"], 0x38}, 0x1, 0x0, 0x0, 0x20008040}, 0x40048110) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x60042, 0x0) syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r2, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="7f454c460e02fab7ff7f00000000000002000300fffeffffdf020000000000004000000000000000030300ef0000000000000000080038000100040004000d000300000000800000000000000000000007000000000000000800000000004000050000000000000002"], 0x78) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0xa8}, [@ldst={0x5, 0x3, 0x0, 0xa}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xbc, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000080)={0x0, 0x0, 0x7}, 0x10}, 0x94) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_SEQ_SYNC(r0, 0x5101) ioctl$SNDCTL_SEQ_SYNC(r0, 0x5101) 3m27.355105445s ago: executing program 4 (id=321): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x40, 0x23, 0x4, {0x4, 0x3f, "7dcd"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1801}}}, &(0x7f0000000380)={0x34, &(0x7f0000000180)={0x20, 0x5, 0x6a, "936825da49fa038127ad9a2432b4910c055b84fd368ce83c5cd845c01ac49c593438e571a57345a2c5e5b2c40cdbb001c32acd1a7aa9ed810effbd6d32debed208786c5cce8ef2c2d3a0e46acdb0ab362aae71861037cddb63172c652dbd9ce63dbf6c8b822a82081366"}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000240)={0x0, 0x8, 0x1}, &(0x7f0000000280)={0x20, 0x0, 0x5b, {0x59, "4fae97fcfd4f0838642c4399d5611e1d5f04f5718cc0a45fb279f56598d0cfb857c0d3f9c444ad77d191fe25d6e6addf79e4fea87c75439f6941c2204bba892aeebb07e96d1aa182df14fc14a35d4ce72880d74f30bd3b471b"}}, &(0x7f0000000300)={0x20, 0x1, 0x1, 0x7}, &(0x7f0000000340)={0x20, 0x0, 0x1, 0x5}}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000300)={0xffefffff, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000080), 0x8100, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x4, r2}) ioctl$DMA_BUF_SET_NAME_A(r4, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') ioctl$DMA_BUF_SET_NAME_A(r4, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') fsopen(&(0x7f0000000440)='debugfs\x00', 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f0000000500)={0x14, &(0x7f0000000480)={0x0, 0xc, 0x28, {0x28, 0xb, "6ee1e74bf26470bc4a670e5b625f6bb9db75a42670c5106f306f585a56c7c32de25a597b454e"}}, &(0x7f00000004c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1057}}}, &(0x7f0000000700)={0x34, &(0x7f0000000540)={0x0, 0xf, 0x41, "16385edf3bd73dc719c603a6266b4e2d9ed4ac5dfa13539f5ac11a8809602dd2c9df2a5ddf547f593973444b2dd7149602e4f95e774e1a18a779a485a67c60090c"}, &(0x7f00000005c0)={0x0, 0xa, 0x1, 0xf8}, &(0x7f0000000600)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000640)={0xc0, 0xa1, 0x4, 0x1}, &(0x7f0000000680)={0x40, 0xa0, 0x4, 0x8cda}, &(0x7f00000006c0)={0xc0, 0xa2, 0x2f, "1229388dcba887eac5df3dc136d58de2fa37a7681b1032de73d328a1e21758c22e7feeedf8a6eeaef8a226157e546a"}}) r5 = socket$kcm(0x2, 0x922000000001, 0x106) setsockopt$sock_attach_bpf(r5, 0x1, 0x19, 0x0, 0x5e) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000040)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) 3m22.63567276s ago: executing program 4 (id=329): bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/node/node0/reclaim\x00', 0x1, 0x0) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) memfd_create(0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x2, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syslog(0x3, &(0x7f0000000280)=""/7, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) socket(0x2, 0x80805, 0x0) ptrace$poke(0x4, r0, &(0x7f00000011c0), 0xfffffffffffffffe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = userfaultfd(0x80001) r2 = socket(0xa, 0x801, 0x0) getsockopt(r2, 0x29, 0x40, 0x0, &(0x7f0000001ffc)) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="042f01"], 0x4) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) 3m20.596101452s ago: executing program 4 (id=334): r0 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000700)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect$lan78xx(0x4, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r1, &(0x7f0000000100)={0x14, &(0x7f0000000080)={0x20, 0x34, 0x11, {0x11, 0xb, "2f86aea14ba345ced9b09201dd0a4c"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x814}}}, &(0x7f0000000440)={0x34, &(0x7f0000000180)={0x40, 0x12, 0xfa, "d0d7a05275608fb6b1296ed1c8223d2954504286a2729cc4f9eaad442049a31119b361252aad04eb9ef8ed15d3eebc45b59ea09c92c17eda9d1657662ac2df56fe3a0302c2c8a74fc77e4dcf61c951e2faaa7283fe988d163a653f0cd47adbd14290d6c6b58692e5f133f2427ac013c56faf400b19f80b4dbebc88967ec172befa124cd8df935d0a9012fb93bc737b665d70c78acfe16c98c9cccfe3ef8add355e54cde2d34b734777eef3b967b4c4d863d9ff1a6824423dbc3f32b5a2e78448cbc36495578b152b9528ee8c8571c1707eb0b66ef13a032770decd1aed9086c39bc4031793f96010271b891f93965b21ccc8ba3268a6ef81d8e3"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0xba}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000340)={0xc0, 0xa1, 0x4, 0x3ff}, &(0x7f0000000380)={0x40, 0xa0, 0x4, 0x4}, &(0x7f00000003c0)={0xc0, 0xa2, 0x2f, "46501ece34e9812c1c62f6b376a83d4ce37e246f36a585f7e1d54c673d641c9ed97e479937dfa032bb9a9bc79dd9a8"}}) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff0000408c1059010100010203010902200001010080fa0904000002ff0000000705810200020007050202000200"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x9, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x409}}, {0x6, &(0x7f0000000380)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f00000003c0)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f0000000440)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f0000000480)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f00000004c0)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f0000000540)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f0000000580)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f00000005c0)=@string={0x6, 0x3, 'syz\x00'}}]}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) write(r2, &(0x7f0000000100)="60000000100001000100000000000000000000000000000000000000000000000900030063616e3000000000340012800800010063616e00280002802400010020a10700"/100, 0x60) r3 = socket$inet(0x2, 0x1, 0x0) ioctl(r3, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) ioctl(r3, 0x8914, &(0x7f0000000500)='can0\x00'/40) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000140)={0x40, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000400)={0x40, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3m13.096429107s ago: executing program 9 (id=347): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NFC_CMD_GET_TARGET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x20, 0x70bd2c, 0x25dfdbff, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40806}, 0x4008854) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x40, r1, 0x5eae78d9c54e9d3f, 0x2, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_SEC_KEY={0x24, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "f94b54cce6396c3599431c882366da01"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x5}, @NL802154_KEY_ATTR_ID={0x4}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x800) 3m12.519013135s ago: executing program 9 (id=348): socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x300, &(0x7f0000002340)=[{&(0x7f0000001080)=""/4096, 0x1000}], 0x1}, 0x81}], 0x1, 0x40000141, 0x0) 3m11.44790115s ago: executing program 9 (id=353): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r1 = fanotify_init(0x1a, 0x800) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0xa8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) fanotify_mark(r1, 0x441, 0x4800001a, r2, 0x0) listns(&(0x7f00000010c0)={0x20, 0x0, 0x7}, &(0x7f0000000140)=[0x0], 0x1, 0x0) fanotify_mark(r1, 0x1, 0x40002009, r2, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x140) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000040)='devtmpfs\x00', 0x0, 0x0) r4 = openat(r3, &(0x7f0000000280)='./dev\x00', 0x195002, 0x6a) pwrite64(r4, 0x0, 0x2d, 0x10c6b) shutdown(r0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80080) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r5, 0x3b70, &(0x7f0000000180)={0xd0, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}}) recvmmsg(r0, &(0x7f00000004c0), 0xf02, 0xf0, 0x0) 3m10.816174829s ago: executing program 9 (id=356): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[], 0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x4008054) write$nci(r2, &(0x7f0000000000)=ANY=[@ANYRES16], 0xc) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000e00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 3m7.487529923s ago: executing program 9 (id=361): bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/node/node0/reclaim\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='100000', 0x6) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) memfd_create(0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x2, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syslog(0x3, &(0x7f0000000280)=""/7, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) socket(0x2, 0x80805, 0x0) ptrace$poke(0x4, r1, &(0x7f00000011c0), 0xfffffffffffffffe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = userfaultfd(0x80001) r3 = socket(0xa, 0x801, 0x0) getsockopt(r3, 0x29, 0x40, 0x0, &(0x7f0000001ffc)) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="042f01"], 0x4) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x40000}, 0x50) 3m5.102086125s ago: executing program 40 (id=334): r0 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000700)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect$lan78xx(0x4, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r1, &(0x7f0000000100)={0x14, &(0x7f0000000080)={0x20, 0x34, 0x11, {0x11, 0xb, "2f86aea14ba345ced9b09201dd0a4c"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x814}}}, &(0x7f0000000440)={0x34, &(0x7f0000000180)={0x40, 0x12, 0xfa, "d0d7a05275608fb6b1296ed1c8223d2954504286a2729cc4f9eaad442049a31119b361252aad04eb9ef8ed15d3eebc45b59ea09c92c17eda9d1657662ac2df56fe3a0302c2c8a74fc77e4dcf61c951e2faaa7283fe988d163a653f0cd47adbd14290d6c6b58692e5f133f2427ac013c56faf400b19f80b4dbebc88967ec172befa124cd8df935d0a9012fb93bc737b665d70c78acfe16c98c9cccfe3ef8add355e54cde2d34b734777eef3b967b4c4d863d9ff1a6824423dbc3f32b5a2e78448cbc36495578b152b9528ee8c8571c1707eb0b66ef13a032770decd1aed9086c39bc4031793f96010271b891f93965b21ccc8ba3268a6ef81d8e3"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0xba}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000340)={0xc0, 0xa1, 0x4, 0x3ff}, &(0x7f0000000380)={0x40, 0xa0, 0x4, 0x4}, &(0x7f00000003c0)={0xc0, 0xa2, 0x2f, "46501ece34e9812c1c62f6b376a83d4ce37e246f36a585f7e1d54c673d641c9ed97e479937dfa032bb9a9bc79dd9a8"}}) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff0000408c1059010100010203010902200001010080fa0904000002ff0000000705810200020007050202000200"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x9, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x409}}, {0x6, &(0x7f0000000380)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f00000003c0)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f0000000440)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f0000000480)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f00000004c0)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f0000000540)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f0000000580)=@string={0x6, 0x3, 'syz\x00'}}, {0x6, &(0x7f00000005c0)=@string={0x6, 0x3, 'syz\x00'}}]}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) write(r2, &(0x7f0000000100)="60000000100001000100000000000000000000000000000000000000000000000900030063616e3000000000340012800800010063616e00280002802400010020a10700"/100, 0x60) r3 = socket$inet(0x2, 0x1, 0x0) ioctl(r3, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) ioctl(r3, 0x8914, &(0x7f0000000500)='can0\x00'/40) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000140)={0x40, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000400)={0x40, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3m3.37553283s ago: executing program 9 (id=369): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/node/node0/reclaim\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='100000', 0x6) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) memfd_create(0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x2, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syslog(0x3, &(0x7f0000000280)=""/7, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) socket(0x2, 0x80805, 0x0) ptrace$poke(0x4, r1, &(0x7f00000011c0), 0xfffffffffffffffe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = userfaultfd(0x80001) r3 = socket(0xa, 0x801, 0x0) getsockopt(r3, 0x29, 0x40, 0x0, &(0x7f0000001ffc)) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="042f01"], 0x4) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) 2m54.628944623s ago: executing program 0 (id=385): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xa4, 0x0, 0x1, 0x401, 0x0, 0x0, {0x5, 0x0, 0x5}, [@CTA_LABELS={0x14, 0x16, 0x1, 0x0, [0x40, 0x1, 0xb73, 0x1]}, @CTA_FILTER={0x14, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x401}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x40}]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x9}, @CTA_NAT_SRC={0x58, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MAXIP={0x14, 0x5, @loopback}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @remote}, @CTA_NAT_PROTO={0x24, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}]}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}]}, @CTA_NAT_V4_MINIP={0x8, 0x1, @local}]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8000}, 0x4008054) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000900)=@raw={'raw\x00', 0x8, 0x3, 0x470, 0x0, 0x43, 0xa0, 0x248, 0x98, 0x3d8, 0x178, 0x178, 0x3d8, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @multicast1, 0x0, 0x0, 'bridge_slave_1\x00', 'ip6erspan0\x00', {0xff}, {}, 0x0, 0x0, 0x61}, 0x12a, 0x228, 0x248, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz1\x00'}}, @common=@unspec=@string={{0xc0}, {0x0, 0x3, 'kmp\x00', "7af8bdb4c056dc65949041982abfe9ed51b01289c0026e2e6034ed587be5f09017b907388134b0ede40eb8d493f20d534fc37f23ec524d91a7a041f36bb1d1c3ab474544c5ef3f2fa69a80a0d967ee4464257d28d31e6843bc1221dfb9a6a27ad13af7061b737fd97d94f50942c68242819c941c0b4d9ec154c7d327187e8198", 0x38, 0x2, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x170, 0x190, 0x0, {}, [@common=@unspec=@conntrack2={{0xc0}, {{@ipv4=@dev={0xac, 0x14, 0x14, 0x42}, [0xffffff00, 0xffffff00, 0xffffff00], @ipv4=@remote, [0xff000000, 0xffffffff, 0xffffffff, 0xff], @ipv4=@private=0xa010100, [0x0, 0x0, 0xffffffff, 0xffffff00], @ipv4=@broadcast, [0xff, 0xff000000, 0xff, 0xff], 0x6, 0x0, 0x84, 0x4e20, 0x4e20, 0x4e22, 0x4e22, 0x2980, 0x1194}, 0x100, 0x40c}}, @common=@set={{0x40}, {{0x3, [0x0, 0x3, 0x0, 0x0, 0x0, 0x302], 0x0, 0x1}}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4d0) 2m54.179882337s ago: executing program 0 (id=386): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0xffa6, &(0x7f0000000140)={&(0x7f0000000200)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0xffe0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 2m53.871940239s ago: executing program 0 (id=387): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) syz_usb_connect(0x0, 0x2e, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x644, 0x8047, 0x100, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1c, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x100, 0xa}}]}}]}}]}}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x3, 0x0) sendmsg$IEEE802154_LLSEC_ADD_DEV(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[], 0x14}, 0x4, 0x700000000000000}, 0x0) ioctl(r2, 0xc4c85513, &(0x7f0000000200)) sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) ptrace$ARCH_MAP_VDSO_64(0x1e, r3, 0xb334, 0x2003) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x2, &(0x7f0000000000)=0x80000000000003) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x3}, 0x4) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0x27) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt_trace\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001080)='tracefs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000010c0)='./mnt_trace/trace_pipe\x00', 0x0, 0x0) readv(r7, &(0x7f0000000240)=[{&(0x7f00000001c0)=""/53, 0x35}, {0x0, 0x500}], 0x2) 2m50.683803436s ago: executing program 0 (id=390): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x2d}, {}, {0x3}, {}, {}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = syz_open_dev$I2C(&(0x7f00000005c0), 0xa, 0x20c0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c000000020000000005000100060000000500050002000000050004000000000016000300686173683a6e65742c706f72742c6e657463ac0000000900020073797a3100"/80], 0x5c}}, 0x4840) ioctl$I2C_PEC(r2, 0x708, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x0, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r6 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x40401, 0x0) write(r6, &(0x7f0000000100)="3c5c0f2397b4d84500b5f812365f00000000000000", 0xff40) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000180)={0x3, 0x0, [{0xbe1, 0x0, 0x3}, {0x3fd, 0x0, 0x7f}, {0x87d, 0x0, 0x6}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='+bond', 0x5) 2m47.955081382s ago: executing program 0 (id=397): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000400)) socket$igmp(0x2, 0x3, 0x2) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000040)={0x23, 0x2, 0x898, 0x7, 0x10000}) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a100efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e6222103472bc55704cdb72b4b996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) ioctl$USBDEVFS_CLEAR_HALT(r2, 0xc0105502, &(0x7f0000000300)={0x1, 0x1}) ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f00000000c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000000)='3', 0x3e) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r6}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r7, 0x1, &(0x7f0000000040), 0x0) modify_ldt$write2(0x11, 0x0, 0x0) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000000100)={0x2}) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000000280)={0x10}) syz_clone(0x289a2400, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) syz_io_uring_setup(0x4303, &(0x7f0000002540)={0x0, 0x53d3, 0x2, 0x3, 0x27a}, &(0x7f00000025c0), &(0x7f0000002600), &(0x7f0000002640)) 2m47.843809178s ago: executing program 41 (id=369): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/node/node0/reclaim\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='100000', 0x6) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) memfd_create(0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x2, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syslog(0x3, &(0x7f0000000280)=""/7, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) socket(0x2, 0x80805, 0x0) ptrace$poke(0x4, r1, &(0x7f00000011c0), 0xfffffffffffffffe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = userfaultfd(0x80001) r3 = socket(0xa, 0x801, 0x0) getsockopt(r3, 0x29, 0x40, 0x0, &(0x7f0000001ffc)) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="042f01"], 0x4) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) 2m45.891427124s ago: executing program 0 (id=401): socket$inet6_udp(0xa, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe(&(0x7f0000000200)={0xffffffffffffffff}) sigaltstack(&(0x7f0000000040)={0x0, 0x0, 0xfffffffffffffed8}, 0x0) r1 = memfd_create(&(0x7f0000000180)='J=\t\xeb\xf8\xa7\x04\x9f\xe1hO\x8e\xd7\xb5\x93}\x8d\xed\x01L`\x93\xcd\x9b`;\x1c\xfc\xaf9\x98\x91\xe7\x00'/52, 0x0) splice(r0, 0x0, r1, 0x0, 0x400c5, 0x5) 2m38.889794009s ago: executing program 2 (id=412): ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0xa, 0x0, 0x3d, 0x10000, 'syz1\x00', 0x5}) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x7, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x10, 0x9]}}) syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaa"], 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x4, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000080), 0x8100, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x2}]) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x1, 0x0, 0x7fff0000}]}) sched_setscheduler(0x0, 0x2, 0x0) setns(0xc9, 0x0) r5 = socket$netlink(0x10, 0x3, 0x14) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000060801"], 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x4) close_range(r4, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYRES16=r4, @ANYRES32], 0x40}}, 0x0) r6 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16abf8d77", 0x8, 0xfffffffffffffffe) r7 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r6, r7, r6}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = dup(r9) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) r12 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="6cfebc9b", @ANYRES16=r12, @ANYBLOB="000828bd7000ffdbdf250400000014000300fc02000000000000000000000000000114000200fc0100"/54], 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x0) r13 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r13}, &(0x7f0000bbdffc)) ptrace(0x8, r13) 2m38.144117351s ago: executing program 2 (id=415): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'vlan0\x00', 0x2}) r1 = socket$inet_icmp(0x2, 0x2, 0x1) close(r1) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0xff, 0xfe, 0x7fff0006}]}) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x20004, r2}) r5 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r4}) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, &(0x7f0000000040)=0x5) socket$unix(0x1, 0x1, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x10010, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r10, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f0000000000)=0x2) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) 2m37.68960519s ago: executing program 2 (id=417): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc00000019000100ffffffff04000000fe8000000000000000000000dc650e6ab60ee8740000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fcffffffffffffff07000000000000000000000000000000000000000000000006020000000000000200000000000000000000000000000000000000000000000000000040000000020000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a0000000000000000000000000000000000000000000000040300"/180], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r2, 0x0, 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, 0x0, 0x2) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x33, &(0x7f0000000040)=0x80000001, 0x4) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000005c0)={0x50, 0x2, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x50}}, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2f0, 0xffffffff, 0xa8, 0xa8, 0x0, 0xffffffff, 0xffffffff, 0x258, 0x258, 0x258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xff, 'veth0_virt_wifi\x00', 'vlan0\x00', {0xff}, {}, 0x1, 0x2, 0x20}, 0x0, 0x70, 0xa8, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x3}, {0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'team_slave_0\x00', 'team0\x00', {0xff}, {}, 0x62, 0x3, 0xc}, 0x287, 0xb8, 0x118, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00', 0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x4, [0x0, 0x3, 0x2, 0x0, 0x4], 0x1, 0x3}, {0x4, [0x6, 0x5, 0x6, 0x0, 0x5], 0x1, 0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x350) r4 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r4, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x2, 0x1234, @loopback}, 0x10) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x280800, 0x0) setsockopt$inet_tcp_buf(r5, 0x6, 0xd, &(0x7f0000000140)="8b275b7315b44b62d68041cd70002d5bf735ab7bc6b9a7013e94b62b93f3f3e1d746e16634d0b6b3d41cd1347cfdf1032d8db39a92d46d0d774f69a6bd8f9236ccd4dc98109668a67bafc85f6dc4793725c2782182ed33d0c219d04de2a4dda5f4614954528b371ebd4c68", 0x6b) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r6, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) 2m35.761984869s ago: executing program 2 (id=419): syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r4, @ANYBLOB="081c00f9ffe0cdc842c23bd6743858f2f033cbb3aa467a834f72b1828aed1d780221010bf5eab719d3c7b781745a85dd02346dab6eff3aff89430531bfcc206f4686e9b57f159115a245fb0fc02c6f35c6e608881d9ffb9ed95b56ff7403bf3097cc2871bdb7cde5eab4e9a9"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r4, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802111f00000064000100080026006c0900000a00de89e89231a98a49020202000008000d000200000008000c00600000000000000000008de7b4bdac71a6425e75035fab499eea04c930a356c775de3eef6cdea144bb84a74d67822080f403984c071bd29b"], 0x68}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x44, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) sendmsg$NL80211_CMD_DISCONNECT(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x14, 0x2, [@TCA_HHF_HH_FLOWS_LIMIT={0x8, 0x3, 0x3beb947}, @TCA_HHF_RESET_TIMEOUT={0x8, 0x4, 0x10}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x48801}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xd, 0x800, 0x0, 0x4, 0x36821, r0, 0x652c450, '\x00', r6, r0, 0x3, 0x0, 0x4, 0x0, @void, @value, @value=r0}, 0x50) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r8 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') mkdirat(r8, &(0x7f0000000180)='./file0\x00', 0x1) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r9, 0xffffffffffffffff, 0x0) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x38, 0x0, 0xb, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_COMPAT_REV={0x8}, @NFTA_COMPAT_NAME={0x11, 0x1, 'cache=fscache'}, @NFTA_COMPAT_TYPE={0x8}]}, 0x38}}, 0x20000880) mount$9p_fd(0x0, &(0x7f00000002c0)='./proc/thread-self/fail-nth\x00', &(0x7f0000000340), 0x204000, &(0x7f0000000600)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r9}, 0x2c, {[{@version_9p2000}, {@version_L}, {@cache_mmap}, {@access_client}, {@posixacl}, {@cache_fscache}], [{@subj_type}]}}) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000740)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r7, &(0x7f0000000580)={0xe, 0x1, 0xfa00, @id_resuseaddr={&(0x7f00000005c0)=0x1, r10, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r7, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r10, 0x10, 0x0, @in={0x2, 0x4e23, @empty}}}, 0x90) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000200), r10, 0x0, 0x1, 0x4}}, 0x20) ioctl$KVM_GET_NR_MMU_PAGES(r8, 0xae45, 0x7fffffffffffffff) 2m32.976151023s ago: executing program 2 (id=423): bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/node/node0/reclaim\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='100000', 0x6) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) memfd_create(0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x2, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syslog(0x3, &(0x7f0000000280)=""/7, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) socket(0x2, 0x80805, 0x0) ptrace$poke(0x4, r1, &(0x7f00000011c0), 0xfffffffffffffffe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = userfaultfd(0x80001) socket(0xa, 0x801, 0x0) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="042f01"], 0x4) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) 2m30.496081041s ago: executing program 42 (id=401): socket$inet6_udp(0xa, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe(&(0x7f0000000200)={0xffffffffffffffff}) sigaltstack(&(0x7f0000000040)={0x0, 0x0, 0xfffffffffffffed8}, 0x0) r1 = memfd_create(&(0x7f0000000180)='J=\t\xeb\xf8\xa7\x04\x9f\xe1hO\x8e\xd7\xb5\x93}\x8d\xed\x01L`\x93\xcd\x9b`;\x1c\xfc\xaf9\x98\x91\xe7\x00'/52, 0x0) splice(r0, 0x0, r1, 0x0, 0x400c5, 0x5) 2m29.909157472s ago: executing program 2 (id=428): r0 = socket$inet_udp(0x2, 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000100)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(0xffffffffffffffff, &(0x7f00000000c0), 0x2) sync() r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) fsetxattr$trusted_overlay_redirect(r2, &(0x7f00000000c0), 0x0, 0x0, 0x2) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x40}, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r3 = semget$private(0x0, 0x6, 0x534) semctl$GETZCNT(r3, 0x0, 0xf, 0x0) syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) readv(r0, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/partitions\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, 0x0, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6d", 0x9) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000140)=[{0x0, 0x0, 0x0}], 0x1, 0x20004800) r7 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r7, r4, &(0x7f00000000c0)=0x58, 0xa) 2m20.463525523s ago: executing program 7 (id=426): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000000)={0x6, 'veth1_vlan\x00', {0x2}, 0xdd3c}) (async) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000240)={0x0, 'bridge_slave_1\x00', {0x4}, 0x54}) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) (rerun: 32) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64) r1 = socket$packet(0x11, 0x3, 0x300) (rerun: 64) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'ip6gre0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000080)="05031600d3fc140000004788031c09103c283a8f80097a274c2398ddd5ebd6d5", 0x20, 0x4, &(0x7f0000000000)={0x11, 0x86dd, r2, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) (async) r3 = syz_open_dev$usbmon(&(0x7f0000000100), 0x7, 0x60000) ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f00000006c0)={0x0, 0x0, 0xfffffffd}) ioctl$MON_IOCH_MFLUSH(r3, 0x9208, 0x8) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/devcoredump/disabled\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)="b1", 0x1) 2m19.523470387s ago: executing program 7 (id=441): sendto$inet(0xffffffffffffffff, &(0x7f0000000000)="fcfdf0b0b7ea9ad06f22d50a888ae83352b239a89a5a1a65c0fa012a7853c3a4ebcf070e8b78be8005de510720fa33a311e29c4fee2f5af97019f2e4695cffe2eae69bd734fb6bff3e11cfd1961d45ff728e580f324f58afefb9c691e9f5fee66cc5e59518317d864d2e3e1a2ee878ca3b04a79dc5c5b71d9e3a850f3c4689b74cce64", 0x83, 0x14, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e62, 0xfffffffd, @loopback, 0x3681}, 0x1c) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0x20, &(0x7f0000000000)={@in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x0, 0x3f, 0x0, "a30b3b68af4d2f246a016542daa845f387713f4048ff2ece1e75f1fc0100f41e4de6256109383664417165bba0dd5ace522fa788000e00000033035551502f07b4001a00"}, 0xd8) r1 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x800000, 0x852241) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(r1, 0x6f2d, 0x800000000000) 2m14.611820812s ago: executing program 43 (id=428): r0 = socket$inet_udp(0x2, 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000100)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(0xffffffffffffffff, &(0x7f00000000c0), 0x2) sync() r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) fsetxattr$trusted_overlay_redirect(r2, &(0x7f00000000c0), 0x0, 0x0, 0x2) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x40}, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r3 = semget$private(0x0, 0x6, 0x534) semctl$GETZCNT(r3, 0x0, 0xf, 0x0) syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) readv(r0, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/partitions\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, 0x0, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6d", 0x9) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000140)=[{0x0, 0x0, 0x0}], 0x1, 0x20004800) r7 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r7, r4, &(0x7f00000000c0)=0x58, 0xa) 2m4.20384405s ago: executing program 44 (id=441): sendto$inet(0xffffffffffffffff, &(0x7f0000000000)="fcfdf0b0b7ea9ad06f22d50a888ae83352b239a89a5a1a65c0fa012a7853c3a4ebcf070e8b78be8005de510720fa33a311e29c4fee2f5af97019f2e4695cffe2eae69bd734fb6bff3e11cfd1961d45ff728e580f324f58afefb9c691e9f5fee66cc5e59518317d864d2e3e1a2ee878ca3b04a79dc5c5b71d9e3a850f3c4689b74cce64", 0x83, 0x14, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e62, 0xfffffffd, @loopback, 0x3681}, 0x1c) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0x20, &(0x7f0000000000)={@in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x0, 0x3f, 0x0, "a30b3b68af4d2f246a016542daa845f387713f4048ff2ece1e75f1fc0100f41e4de6256109383664417165bba0dd5ace522fa788000e00000033035551502f07b4001a00"}, 0xd8) r1 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x800000, 0x852241) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(r1, 0x6f2d, 0x800000000000) 9.79645983s ago: executing program 6 (id=782): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0xc2480, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, 0x1, 0x4, 0xb01, 0x0, 0x0, {0x7, 0x0, 0x5}, [@NFULA_CFG_CMD={0x5, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008804}, 0x40080) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r0, 0x3b87, &(0x7f00000005c0)={0x18, 0x0, 0x1}) 8.950320333s ago: executing program 6 (id=785): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000440)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x12) ioctl$UI_SET_SNDBIT(r2, 0x4004556a, 0x1) ioctl$UI_DEV_CREATE(r2, 0x5501) write$uinput_user_dev(r1, &(0x7f00000004c0)={'syz0\x00', {0x7, 0x4, 0x1, 0x9}, 0x7, [0x4, 0x6, 0x802, 0xe9a2, 0xfffffffe, 0x9b, 0xa9ba, 0xc1f, 0x1, 0x101, 0x3, 0x6, 0xffff, 0x9, 0x2, 0x9, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x3, 0x3, 0x9, 0x4, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xfffffffc, 0x0, 0x0, 0xf, 0xa33, 0x5, 0x80, 0x401, 0x5, 0xa3a, 0xfffffffd, 0x7, 0xb, 0x3, 0xffff8001, 0x2, 0x4, 0x80000000, 0x1, 0xb, 0x7, 0x0, 0x5, 0xb6, 0x1, 0x7fe, 0x7fff, 0x2, 0x1000002, 0x8], [0x2, 0x1, 0x10000, 0x7, 0xb66, 0x2, 0x5, 0x80000001, 0x8000001, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x6, 0x8, 0x5, 0xcc, 0xbc1, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0x5, 0x6, 0x0, 0x0, 0x4, 0x4, 0x7, 0x9, 0x4, 0x1, 0x5, 0x5, 0xfffffb66, 0x80, 0x2, 0x81, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x8, 0x6f, 0x80b, 0x3, 0x6, 0x525ba681, 0x4f71, 0x4, 0x1, 0x1, 0x8, 0x100, 0x6, 0x10000, 0x1306, 0x100008b, 0x10000, 0xfe4, 0x3ff], [0x2, 0x7, 0x4, 0x3, 0x7a8, 0x10, 0x80, 0x8001, 0x5, 0x0, 0x9, 0x8, 0x80000001, 0x1, 0x1, 0x4, 0x8, 0xfffffffa, 0x7, 0x9, 0x6, 0x4, 0xfffffff7, 0x2, 0x3, 0x0, 0x0, 0x3, 0x4c, 0x3, 0x1, 0x2, 0x0, 0x9, 0x13, 0x1, 0x2, 0xfff, 0x6, 0x100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x7, 0x47, 0x7, 0x0, 0x11, 0x3, 0x1, 0x5, 0x7, 0x8000, 0xffc, 0x10, 0x2, 0x10001, 0x1, 0x0, 0x6, 0x71c], [0x81, 0x10003, 0x10, 0x4e26, 0x6, 0x40, 0x7, 0x497, 0x4, 0x5, 0x0, 0x5, 0x56, 0xc28, 0x9, 0x10001, 0x0, 0x7, 0x79a, 0x40, 0x9, 0x6, 0xc421, 0x80000001, 0x6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x4, 0x3ff, 0x10, 0xd, 0x6, 0x8000, 0x4f, 0x78d, 0x6, 0x1, 0xffffb029, 0xfffffff8, 0x9, 0x7, 0x6, 0x101, 0x1, 0x7, 0x4, 0x0, 0x8000b, 0x400, 0x8, 0x0, 0x200008, 0x10001, 0x9a33247, 0x6, 0x0, 0x1, 0x8001, 0xfffffff7, 0x2000005]}, 0x45c) 7.30902885s ago: executing program 8 (id=790): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x51, 0x0, 0x0, 0x0, 0x20, 0x766, 0x204, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xba4e7a40265e5c6b, 0x2c, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x8000, 0x9, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0xfc, 0x8}}}}}]}}]}}, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r2 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$cdc_ecm(0x3, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x20, 0x2, "", [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x2, 0x6, 0x0, 0xd5, {{0x5}, {0x5, 0x24, 0x0, 0x45}, {0xd, 0x24, 0xf, 0x1, 0xfff, 0x0, 0x7, 0x7}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x5f, 0xbd}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x7, 0x1, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$XFS_IOC_FSGROWFSDATA(r2, 0x4010586e, &(0x7f0000000080)={0x6, 0xa}) 6.905925843s ago: executing program 1 (id=792): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc_dir\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_dir/acpi/wakeup\x00', 0x2, 0x0) write$P9_RGETATTR(r0, &(0x7f0000000200)={0xa0, 0x19, 0x2, {0x1d02, {0x20, 0x5, 0x1}, 0x4, 0x0, 0x0, 0xffdffffffffffff8, 0x1, 0x40000000000000, 0x3, 0x6a3d0188, 0xed3, 0x4, 0xffffffff, 0x2, 0x9, 0x2, 0x10000, 0x200, 0x9, 0x5}}, 0xa0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_dir\x00', 0x1ff) (async) mount(0x0, &(0x7f00000000c0)='./proc_dir\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_dir/acpi/wakeup\x00', 0x2, 0x0) (async) write$P9_RGETATTR(r0, &(0x7f0000000200)={0xa0, 0x19, 0x2, {0x1d02, {0x20, 0x5, 0x1}, 0x4, 0x0, 0x0, 0xffdffffffffffff8, 0x1, 0x40000000000000, 0x3, 0x6a3d0188, 0xed3, 0x4, 0xffffffff, 0x2, 0x9, 0x2, 0x10000, 0x200, 0x9, 0x5}}, 0xa0) (async) 6.799036813s ago: executing program 5 (id=793): r0 = socket$inet(0x2, 0x2, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x3d, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) ftruncate(r3, 0x9) fcntl$addseals(r0, 0x409, 0xb) 6.571661341s ago: executing program 1 (id=794): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x6, 0x8a}, 0x0) symlink(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x2000, 0x0, 0x1}, 0x30, 0x0) landlock_restrict_self(r2, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file1/file2\x00', 0x2) setrlimit(0xd, &(0x7f0000000000)={0x0, 0x2}) sched_setscheduler(0x0, 0x2, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, 0x0, 0x44000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)=ANY=[@ANYBLOB="40000000100005ff00000008000000000000004a", @ANYRES32=0x0, @ANYBLOB="7f15000000000000140012800b0001006261746164760000040002800a0001"], 0x40}}, 0x20000840) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x85}, 0x4000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x2c, 0x0, 0x20d, 0x70bd2b, 0x25dfdbfe, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x2}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x6}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x26]}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc051}, 0x0) sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)={0x40, 0x0, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0xffffffff}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x10, 0x7b0, 0x6]}, @SEG6_ATTR_DST={0x14, 0x1, @remote}]}, 0x40}, 0x1, 0x0, 0x0, 0x4040011}, 0x20000040) sendmmsg$inet(r4, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x4, 0x200000005c831, 0xffffffffffffffff, 0x0) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r6, &(0x7f0000000200)=@unlock_all, 0xb) ioctl$BLKPG(0xffffffffffffffff, 0x1269, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r8, &(0x7f0000c00000)=nil) ioctl$KVM_XEN_HVM_CONFIG(r8, 0x4038ae7a, &(0x7f0000000100)={0x2, 0x40000000, 0x0, 0x0}) 6.571124487s ago: executing program 6 (id=795): keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000026c0)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000002880)={0x0, @in={{0x2, 0x4e24, @multicast2}}, 0x9, 0x7, 0x1, 0x0, 0x15a}, &(0x7f0000002940)=0x98) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000002a40)=[{&(0x7f0000000280)=@in={0x2, 0x4e21, @remote}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="30f9dd4cf8b37b50c4537885a44da7b14ae4dc9e6f488db6f045c90038d5cc26fccf9c46e5366c4e0ebadb5adfa1e60418f916b427ace6628b2e33f2a146e31d8107ff0138aabb9413c8e645627c02b18877e2c85e14f62578b6b658d8a0c5ec218d5a5f6e", 0x65}], 0x1, &(0x7f0000000640)=ANY=[@ANYBLOB="20000000000000008400000008000000fc00000000000000000000000000000030000000000000008400000001000000000039000202000000000000ffffff7f040000000500000009000000", @ANYRES32=0x0, @ANYBLOB="30000000000000008400000001000000ff01060010020000070000007f0000000f0000000002000000000000", @ANYRES32=0x0, @ANYBLOB="1800000000000000840000000500000000000000ff0700002000000000000000840000000800000000000000000000000000000000000001"], 0xb8, 0x4000}, {&(0x7f0000000700)=@in6={0xa, 0x4e20, 0x7af9a17, @local, 0x7}, 0x1c, &(0x7f0000000f40)=[{&(0x7f0000000740)="95479b1b025dfcda16085ffd6c70a1c1a497ddb1c00cb10280d1d436818f329b10bcc1b146d8f7b25b23d12a9fa0d2c35589269cd470cea634526307ecc4426f07a53b1693dbd03c93100465495a7e4bfb37276f69685da682d788e65e2ce0acf8", 0x61}, {&(0x7f0000000880)="5eb0ea73969d0f399bd0dac283dc2897abe94ee064a7faa7895b9f3b0add4fa3bd5f5038b81d7027122ba2071f432112d6b62d1c5fabb4b1ffd14995cac92b06a19e828b6a58b30de25ec424825b1d0d37b809c4024e95ef075790097ff6f66b66d589ee7814b9bf6a4c59406733da67d01930ac37199aab8dcec0db0a56a70479c1ec180da391a85e77d872b496f82c44aa2d3146ee17a0e935a4f3b830504753bff2f7bb780c27c1a7b4d211a761184ac03ed05d80ed3ed4e39712e524ce60ad2443088a0cbdb74b8f6e38d25a6332280a1e495679", 0xd6}, {&(0x7f0000000e80)="bca86920d11fea255334ddf62d10e55e51639ffd76d38abecb58d3646820821a51326a78ae78ca74c926fd0e36b02ecc32cb1595948ee426856482a38c06f18d379b9dc001eeeaa5f54ba027a102984a8038430a6278f4d07756a81aeadfc9af1323d3eff450a62621fb33b50fd41770ab72d49455b6cf06dabba96258b88f097afa4ef728a4e47968d68e71494a26", 0x8f}], 0x3, &(0x7f0000000f80)=[@dstaddrv6={0x20, 0x84, 0x8, @dev={0xfe, 0x80, '\x00', 0x24}}], 0x20, 0x40000}, {&(0x7f0000000fc0)=@in6={0xa, 0x4e21, 0x2, @private1, 0x8}, 0x1c, &(0x7f0000001140)=[{&(0x7f0000001000)="ad2d0e94f1316a50d2412db87b1a145252ce96d12a8071a99551a4254cb067debb2aca2b71787a104d3cc3564027759c34ea3d31", 0x34}, {&(0x7f0000001040)="eeb13bc2207db4dcb71d7d18107143aff1f3b9200255e0f0ad41c74c1acf0c183f39959848d29ad22feab2f8e69891d5e8baa66fdbc3658cf2bc13d701555f38d725cca7cfe36c32befecddbd15745d4bd1e37bfa675b7a5915ffbf027e69dc35b749b7ff28ba9ef5d8def40e845780cd0a0b4e9b81e4f28232d5f1f0a1664ba0f84c87e0b3ef6324451586b010c2c147ff14e52477191545fe33c7e2a1fbf4fcdc8493a366bf0d382a9cccb353d41a2a9ea29d184eac0e9bd0aece379539202fbc9555e375148", 0xc7}], 0x2, &(0x7f0000001180)=ANY=[@ANYBLOB="18000000000000000100100018000000000000008400000006000000000000000000000018000000000000008400000006000000266900"/72], 0x48, 0x4010}, {&(0x7f0000001200)=@in={0x2, 0x4e22, @empty}, 0x10, &(0x7f0000001700)=[{&(0x7f0000001240)="b338fb91fd05d8499440fa74ddf0ebb4435c0ff493d9773589dac9", 0x1b}, {&(0x7f0000001280)}, {&(0x7f00000012c0)="909032af089e885a1e24ff0e1af6ca2652357f7d6b1660d73130511155f95b79e4bcc3a048b1dc96268b04f0c8023a6f8acff8fcd0b50c5d1a2d56b38d9bb8c22d379f36358a6ddfdb688e3956a846613ac91b", 0x53}, {&(0x7f0000001340)="c316905192ad03700740c02decb7bbcf37d829731852d9a1697a5697d8cd82e1d8833682d7b4bc6cc2640f67edff8ff1539ae473f1df4d631f8bfb81fd7f190a6544196870dc39043a53baecd62eae32111aff9343bb64b46ffce0dddbd7caf9b824f7fd0b6e0b68b94c2a6fff1158b739970043aa629f1eec194746c9d80e9679d1f9e8088dc77474b32d3a49eb721130d75f9afd628f717400776e2d11294a758292cc960a7ed63b8a3435cc20ae808ef12868a51e22a059c0819e2523e173ef5a9b4cdd7b282e481cf5e906a9fddcc0", 0xd1}, {&(0x7f0000001440)="569ec1bcd816a3aee83518c3c129d2e9e244173d9e6e5ac7006bb797a4be98dd4ed3686a53d64046471079e47c6198fb6be31a4756882987e3eace5e10fdac289a6547d5a0f2f3b914854991b7f27f984fdcb76694268d2e992d2cbbb8fe4fdd52ba21ee2bc031eb38454564ae71d2a41a6796f3f57f86eca8e41ddc66d9e0985bfc852961c843fad51ba6bb03b1cee94b620a8dd79c5c00e7f13c85093ced760949643dad0aa595700c3d6d372ae5538a1bf4f37ed055c571e9985e64411a331f737d9af71e7ff86f872d15bb1b01311fe822782e", 0xd5}, {&(0x7f0000001540)="e881a32c463ed8f003e852208ed6f5efd8b5536bc52838324f3500c1ee51923109d7224a9548f1dfc92be74a9a2b784376ce3fe423f378f38e35aadc70101235abed0e6157022346c7d32fcc81fb7e4e5bdae3ec217e88e14300", 0x5a}, {&(0x7f00000015c0)="e46672f550af023e9a86980a85dae46da8bda8044f012f36412dfd39f05ea34f84aeb7595c362527dd7d838917def1d61ff5862a69e33918d32ca691df56d9b158f8d0216ecfb2438ada60de700fdd552f48a2aeeeb5e0f2f62b73465f6d8d6921f530b291ebdd932c25e73b250474072d3434cd6ad214083fbfc42bc5b626a1bc71929500fd90071c9ed732d87e147f7a5153458af3fda37daa8b105877b8eeb10a56261db93e2fbaae44ed849c91750f5bc732b37b5c513d3ce35e0e", 0xbd}, {&(0x7f0000001680)="b845f501316d8c02c66be295ee54edda35985c0a176e9b1c8e31f96c90a05bfec765c12fe9e06fbc838e76551da71fdce77f4047d53883e4e9cfba5146aa6a56b6304b6e095a72dd49e72e0065a1533d3e838b96d7c39e5cd9e7631432b422006292c452022bc1245f17849c", 0x6c}], 0x8, &(0x7f0000001800)=[@dstaddrv4={0x18, 0x84, 0x7, @empty}, @dstaddrv4={0x18, 0x84, 0x7, @remote}, @dstaddrv4={0x18, 0x84, 0x7, @multicast1}, @sndrcv={0x30, 0x84, 0x1, {0x8, 0x1, 0x3, 0xad, 0x1, 0x40, 0x5, 0x5}}, @authinfo={0x18, 0x84, 0x6, {0xf}}, @authinfo={0x18, 0x84, 0x6, {0x1}}], 0xa8}, {&(0x7f00000018c0)=@in={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000001d80)=[{&(0x7f0000001900)="d3a7aad7da65ac02d9c0b83ec9cc74930667f93762665ad6841605879581d98131ace072cdd8bcf0fda4faa7f711732ed10f43b96e3884993fb3452cc24cfe16114eb6013e9ea5b7e719f6fe89e2d3bd30fb0945a275d2dd36c2506dea2a977a7dc0d5485cfe9b8abdb4ae5e7896d59dc84267c1eb027ec2bcdad2a2a46638414ba50900c174209a167c376300278fa5d0708c62b82259e74eb9b08ffb7d4e4d79a6089292e64fb59d53a5b946d71d47cd28df84fad377fb72418f32f76cd778dd7e42d0d5ce22068092f37b7376078d1664948f909d91e69a7490ca1edc250e2327bb7b8ead83", 0xe7}, {&(0x7f0000001a00)="59b6373184922e143366ec204a804d974e8ca2e462b8911b853745323e5e3ffeadf1d5266539dfa4c919a78da837dc3a9f294ea721a3dba816e7ed43595002f75c64f523ebfa76615e715dab6ce916e4e01fac6c19a16206ddad8c8240c35803de0ae2e9edba88a4e3b7ffcfa6c155bf4cce7d9d624d0e83419439a0195087c1d2a9e5a3194984d4e7f2029b2d563902a132fa0a0be5f890741a3d47", 0x9c}, {&(0x7f0000001ac0)="a039e1f3b0d2f08641a73a6e4e77e606f91226b7ee01c53d2c7ba3d0543ee81847264130567b16b23ad5f17302a2d24414a8c36066b405c60d70b4bc7eb861ca2d92d5dd62c38da928ed4c2b48ab6ceeae92591cc7b34610a2fa6b532ffa6bcdfe88c37e40dd87a0e879bda750d1e31e8f3854626eec77c5c501a586e46f4448ad5feee21f44939f870d6738cd2aef0eba79a73b7fd557d71f86646bf2a184be217f97e1b40da05a08359334b321f86fc8d0eb9a02a248d580175993007a80ae8ba8d3ab4408aefd2f68d7d3179699df6a832bbfc3d0c162337cbe1cabd180820dfd169bf13168b507bba4fa93779d668c49682bbe244bf66546b4cbbf8b", 0xfe}, {&(0x7f0000001bc0)="aa99446e38ddf53c49e353c1e0936f43cdfb2df1c7e43f3c42e5d913055f00fcf79c088aab31c147711e19a33274aa69b4106c", 0x33}, {&(0x7f0000001c00)="d6888332f00e8d6086f272215936037c472ecf5bb73a40743b9dd0373b15a30f33b229afc14be2c2e925119380ac6c83b79d05b38dac1648247e8d8341cd8e562da97b0ba4f6056f36c4497f2c80b6b9a0a449fc79fddfe285d7e0575bba972211e158e3355bd4aa820235ed1d420decbb6baf1602fdd93cf94fec9d7406c331c71683c440b8ba2c95c87e081d1e95d15d09e7037ade81c818fc184ab80efc99ca8367ae0a1175d5988d5b585124fdaf652b4c244cc5e3aebb21374cbebc950d11cbefa8e754e37995c3f13e8b16b99bad55d6a45f38a9a10fdb5356065e109be4d2e9d566938539974e4eb0e41bac4f8923f441b580d45a1e", 0xf9}, {&(0x7f0000001d00)="3a6ad7bab502dcaabe32f3b9367c129ab4851155cebe7b86cd1d64c66228256d2b651cfc0dbc490ca20cf63e15747ec4e70e052950daed97fd3832e8bbfb4bc8828272aaaf3240d508cc942e8f4bbfbddabce34191039bee0d46c84983df88aae5e0857dc61059067a315ea90f18adbdb91e47404b", 0x75}], 0x6, &(0x7f0000001e80)=[@sndinfo={0x20, 0x84, 0x2, {0x9, 0x4, 0x5, 0x3}}, @dstaddrv6={0x20, 0x84, 0x8, @private1}, @sndrcv={0x30, 0x84, 0x1, {0xfff, 0x1, 0x0, 0x8, 0x889, 0x5, 0x6be, 0x2}}, @init={0x18, 0x84, 0x0, {0xf, 0x3e15, 0x200, 0x4}}], 0x88, 0x6a20030e666ce006}, {&(0x7f0000001f40)=@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000002480)=[{&(0x7f0000001f80)="f0c14bfc10a96ec391a9d2e86e1202139d057d4d0a144e8a9099f067dc3f93b781d9b5029d4ca3ddc833c8a2c3f6818e503a094a02ced3fe6113e4ce0bea379d8b86137c57479da873c1f5461a32fe865beea0e12ed5cea395383afda7170f690385e7a1b71ac421cae26c8af7640e9333559670d2aa9135bd7b62014ce38a1af4a52bac6c36a6ceb6e380c840", 0x8d}, {&(0x7f0000002040)="ccd07a805af212d4756ff1d99113179adb42b7cbab49086f484f326752a0febd0f1be5f82e5af3d6d36afa62bcf90b7c4b84c0c29e4ccaec8a683ef485a1ec2d3e82dcdb840395bbd3b05d8a7747f59fcabc381050ad91f2a74019dfdf8990c0bb621c9b43a85bdef3e49103d58e731de0f95322fe3a291bc89d2de5628d38a6c8c040177bfafb8c6abaa87a318b1fc3c9c72d724eee350b2267491cf89086a5473a8bcdcb14bcaa5cf6187fa4796a4658caf2527d16726769766a6671ce0d8b03dd5ebc1c703368bd22a9e4d40241ae572af6adef2686f1877e41236a1a", 0xde}, {&(0x7f0000002140)="9e8b60b0168cb04542726b1a6e7aaff5fc3ef05601d8648515c9ab56c0f05920b456b50cdbbe2e2909ccceba397b7abc02a99f0561adb687e1c65b2123274de4f319a9618a488b01ea8341dbb94979f8890b87c7de02026b0929f553b43a7141bd29a98cfc155c41fb7989e7ebff40266c15ed5ea108429a2c578023170342d678ffb2a1f6285f6a9236d99a57994224955b88f65b79594202d54ec90fa986e3cf4e9568c1d4006c4303c0ba82e018915ec4e937c104886094d7b3", 0xbb}, {&(0x7f0000002200)="ec125f767d55f4d450ac730f922191d2ea768c555c7e8c73f4b94553e35ebd8fa19b3acbcd6841fc37b6fd86755cc75bfd4c4ed96f668a33c4118f0a17f6d615deb3d47700c13db1178a77e51e63fed2c9ce71a128ac54f455e40ee435629bfdcaeafe4741bf2aff397769e4d495", 0x6e}, {&(0x7f0000002280)="e03330adfdaa8331ef1f50e600b8c0d6695de4d874d30543efc2df6d72308c2bd2cc95d1c425ac126d6d757aa6ea4c7ccf8ffadd315814bf7ece0a75d9dece2f166d6a96e033cacb40c1c3b9db17cacb11a1ec70e071757eb18b05e9943ab2de848d43abfba96570af9cf9897a9815a85d0a8e89e2ea324dc33c65", 0x7b}, {&(0x7f0000002300)="8bf50ba492ede232ae5e68aa388861a7af1f9a6e3a48eccc7dd738bd1e4ffa600b39a94a6fc62be6e77c90c553ee1cb1518d4c93279805da6b66d84a482972d2da709bef5cc907925dc5d5e4e2e903946e23be8c66556961179e7fba0a3ba2159adea6e146c6eef749d37fd393deaeeaa31904593e6c3d68ff504bfd8d88aecce25695dc51c457319168b0e2d056a3a31861593ff04d1d30124153990324e8416617005f0ad3fffbc48dc130e54a88ba2548ca5d2c46e750d6f154dfd88fe8209a42780e7f51de0abd99d547796036c938efe46d", 0xd4}, {&(0x7f0000002400)="9e61f4d50c907ef3569186ceba40f2d28d27fd6078e6260dbc8896d19e37a5364335665b32ded543c3120d3268915668e4ec9e56ec32b8458245cdb2354e1ee9f78fef5ae2341f7460e8d68cb05b99e9f50f1703903e4166fea2e2b2a8fc11bc5346510ec79fed46b5f37623a71b1df47e33", 0x72}], 0x7, &(0x7f0000002500)=ANY=[@ANYBLOB="200000000000000084000000080000000000000000000000000000000001180000000000000084000000050000002000000006000000"], 0x38, 0x10}, {&(0x7f0000002540)=@in6={0xa, 0x4e22, 0x4, @ipv4={'\x00', '\xff\xff', @local}, 0x3}, 0x1c, &(0x7f0000002840)=[{&(0x7f0000002580)="c347f6468e66b46f80d41aa559b6bdf9b05db8959ee0ec463d6e7e9160aaba065469486637582d1dfea065b032ae56d851f524d15db0f9fbfd201aec7860cc11b0124f04a74f48485a84f3b96b86d99adba5ba0039143a2be6eb8441c04f3e7bde443503ba1c0eed94441822151b2020f6cf511326f29036b42dfbe4b293b4c6d8d116bf3fe659579ae85a63676ffbcae256a2d4d0ac84bf903fe19c2c45c2af7da46b6c61620b9714b25c3a1ccb2e51b3c3cfb11d9c0f363e2b", 0xba}, {&(0x7f0000002640)="213b0a5f73c1a3087ad37c18dc2670f553f7bb22c4f5ed085119865b5e5180b131fe0727ccf7eace3fe0e7c4116563d2d766f8393afb74416205441b03486ebdcc626a9445223550a568d5b44babf6aee38a82a13fd7bb997c8266c10e20adccf1bb9764173503dec753be20ae0a6ded2ab14d631a3f2c4820", 0x79}, {&(0x7f0000002780)="225ff2168717b8eff074dedc99530f95dcc7fb333e4ec35a8491239885fd33eb73884df8d8c4429a2cf0b88ec1c3070e3c80619384a7700d47f417d410bfb106f59e5712623950333723ea174adbd19dcb2d5aee8592b08a659347a4896e137ce2b3b88fad574ca1d4ab82ad6095a559d2b8f01c7d24cd6c1779b2e5c198d4cf0396ca5d933dccb3a899db", 0x8b}], 0x3, &(0x7f0000002980)=[@prinfo={0x18, 0x84, 0x5, {0x0, 0x1}}, @sndinfo={0x20, 0x84, 0x2, {0x16f4, 0x8, 0x9, 0x7f, r0}}, @dstaddrv6={0x20, 0x84, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}}, @init={0x18, 0x84, 0x0, {0x401, 0x7fff, 0x0, 0xd}}, @authinfo={0x18}, @dstaddrv6={0x20, 0x84, 0x8, @mcast1}], 0xa8, 0x40000}], 0x7, 0x80) pipe2(0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000a00)={'syz1\x00', {0x4, 0x7, 0x5, 0x7}, 0x3f, [0x6, 0x10000002, 0x18, 0x2, 0x8, 0x400, 0x4, 0x0, 0x8, 0x0, 0xa, 0x40000001, 0x7, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffa, 0x0, 0xffffffeb, 0x2004, 0x3, 0x7, 0xf253, 0x80, 0x4800, 0x300000, 0x7, 0xe, 0x9537, 0x0, 0x10001, 0x1ff, 0x8000, 0x7, 0x3, 0xc, 0x3, 0xba55, 0x8da8, 0x2a, 0x5, 0x2, 0x5, 0x2000000e, 0x2, 0x2, 0x8000006f, 0x8, 0x405, 0x80000000, 0x199d, 0x6, 0x7, 0xffffffff, 0x3, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0x9, 0x5], [0x7, 0x45cb, 0x3, 0x8000, 0xfffffffd, 0x3, 0x2, 0x25, 0x4a, 0xfffffffc, 0x8, 0x7fff, 0x729, 0x1c32, 0x3, 0x1, 0xfffffff7, 0x400, 0x7ffd, 0x5, 0x3, 0x297, 0x9, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000001, 0x14, 0xfffffff7, 0xfffffffd, 0x7, 0x9, 0xffffffff, 0x6, 0x4, 0x800, 0x0, 0x6, 0x96, 0xfffffff9, 0x20002, 0x0, 0x2, 0x9, 0x5, 0x3, 0x37a, 0x9, 0xe, 0x5, 0x5, 0x6, 0x6, 0x3, 0x1, 0xe, 0x20007, 0x200, 0x3], [0x1, 0x8000c584, 0xffff, 0xcd3, 0xb, 0x8001, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0x3, 0x5, 0x80000001, 0xffff0000, 0x9, 0x1000, 0x0, 0x7fff, 0x6, 0xfffffff9, 0x0, 0x8001000, 0x80040101, 0x81, 0x8, 0x6, 0x200003, 0xfffffffe, 0x5, 0x80, 0x9, 0x8001, 0x12000, 0x4, 0x7, 0x400004, 0x3, 0x9, 0x3, 0x8, 0x0, 0xbf23, 0x6, 0x5, 0x956, 0x0, 0x3ff, 0xa7ec, 0x6, 0x100dffd, 0x2005, 0x9, 0x4, 0x1000, 0x9, 0x7fffffff, 0x3, 0x80, 0x0, 0x7d, 0x401, 0x5], [0x80108e, 0xffff, 0x3, 0x3, 0x88, 0x80000002, 0x4000000, 0x4, 0x50, 0x2, 0x763, 0xb, 0x2402, 0x1, 0x5, 0x1000, 0x5, 0x5, 0x8, 0x4, 0x0, 0x5, 0x3, 0x4, 0xe47, 0x4, 0x2, 0x4, 0x200, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4004, 0x20008, 0x8a5, 0x8003, 0x44, 0x409, 0x6, 0x4, 0x4, 0xe, 0x7, 0xfffffff7, 0x7fff, 0xffff8a33, 0xfffffff8, 0x481, 0x0, 0x200, 0x7, 0x4edf, 0xffffffff, 0xd, 0x5, 0x101, 0xf, 0xffffffa3, 0x136, 0x7]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) readv(0xffffffffffffffff, &(0x7f0000000080), 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, 0x0, &(0x7f00000001c0)) msgsnd(0x0, 0x0, 0x8, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xfffe, 0x4}, 0x6) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) r3 = fcntl$dupfd(r2, 0x406, r2) sendto$inet(r2, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x1c, 0x15, 0x1, 0x70bd26, 0x25dfdbff, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @ipv4=@broadcast}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48080}, 0x40010) unlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/ports/1\x00', 0x200) sendmsg$NFT_BATCH(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000007f40)=ANY=[], 0x76b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004001) 5.786954926s ago: executing program 5 (id=796): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000640), 0xc0000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r2, 0x0, 0x10000, 0x0, 0x200000, 0x9e3f5, 0xda3db}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r2, 0x0, 0x10000, 0x0, 0x8, 0x2ea473, 0x2eb80c, 0xf4}) 4.287816819s ago: executing program 6 (id=798): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00'}) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/166, 0x1f8}], 0x1, 0xfffffff7, 0xc84d) 4.160100113s ago: executing program 8 (id=799): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000017c0)={0x44, 0x41, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x28, 0x1, 0x0, 0x1, [@typed={0x10, 0x4, 0x0, 0x0, @str='\xca\xb1\x89: \xb8\xd2\xa95!\x80\n'}, @nested={0x11, 0x1c, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x8000000000000000}, @generic='l']}]}, @nested={0x4, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x40815}, 0xc000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@bridge_dellink={0x24, 0x11, 0x5, 0x1000000, 0xfffffffe, {0x7, 0x0, 0x0, r3, 0x6201a, 0x100}, [@IFLA_AF_SPEC={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x800c000}, 0x40000) getsockname(r0, 0x0, &(0x7f0000001540)) 4.156161187s ago: executing program 8 (id=800): timer_create(0x3, 0x0, &(0x7f0000000000)=0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000e, 0x6c033, 0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x77359400}, {0x0, 0x3938700}}, 0x0) timer_gettime(r0, &(0x7f0000000180)) 4.038392374s ago: executing program 5 (id=801): socket$kcm(0x10, 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x801) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x4e071, 0xffffffffffffffff, 0x80000000) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) 3.892465754s ago: executing program 6 (id=803): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00', 0x0}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r2}, 0x90) r3 = socket$nl_route(0x10, 0x3, 0x0) fanotify_init(0x200, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x0, 0x103) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x50) setsockopt$sock_attach_bpf(r4, 0x84, 0x19, &(0x7f0000000080), 0x4) write$sysctl(r4, &(0x7f00000004c0)='4\x00', 0xfad7acd8fedca028) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) fanotify_mark(r4, 0x1, 0x10001003, r4, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001100010025bd7000ffdbdf2500000000", @ANYRES32=r5], 0x20}, 0x1, 0x0, 0x0, 0xc881}, 0x8080) accept(r0, &(0x7f0000000740)=@caif=@dgm, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000080000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x34, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x6, 0xc, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x501, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r8, r7, 0x25, 0x0, @val=@perf_event={0x17}}, 0x18) syz_emit_ethernet(0x3e, &(0x7f00000000c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa080045f0003000000000000190780a010102ac1414aa040290780100000045a4616975fa000001110006ac1414aae0000001"], 0x0) r9 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_CROP(r9, 0xc038563b, &(0x7f00000001c0)={0x1, 0x0, {0x6, 0x6, 0x1, 0x5}}) socket$l2tp(0x2, 0x2, 0x73) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) epoll_create(0x3) futex(&(0x7f0000000000)=0x1, 0x6, 0x2, 0x0, 0x0, 0x3) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x4, 0xb, 0x4, 0x0, &(0x7f0000048000)=0x2, 0x0) futex(&(0x7f0000000400)=0xfffffffe, 0xd, 0x1, 0x0, &(0x7f0000000380)=0x1, 0x2) 3.863845415s ago: executing program 3 (id=804): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0xffff0000) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'wrr\x00', 0x10, 0x10, 0x3e}, 0x2c) 3.860121447s ago: executing program 5 (id=805): timer_create(0x9, 0x0, &(0x7f0000bbdffc)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x0, &(0x7f0000000200)}) open(&(0x7f0000000140)='./bus\x00', 0x143bc2, 0x1c0) unlink(&(0x7f0000000040)='./bus\x00') 3.766152373s ago: executing program 1 (id=806): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x3, 0x101000) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x9cf0, 0xc002, 0x5, 0x2bb}) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x5, 0x5, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYRES16, @ANYBLOB='\t\r\x00\x00\x00\x00\x00', @ANYRES32, @ANYRES8=r0], 0x58}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x240448c8) 3.660032176s ago: executing program 3 (id=807): syz_open_dev$video4linux(&(0x7f0000000000), 0x806, 0x1233c1) socket$packet(0x11, 0x3, 0x300) fanotify_init(0x4, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x8100, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r3, 0x0, 0x0) getsockname$packet(r3, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sysvipc/sem\x00', 0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) write$tun(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="000089142460", @ANYRES64=r4], 0xb2) 3.659640768s ago: executing program 5 (id=808): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000020c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = add_key(&(0x7f0000002340)='big_key\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$read(0xb, r1, &(0x7f00000010c0)=""/4096, 0x1000) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mknod(&(0x7f00000000c0)='./bus\x00', 0x8000, 0xd02) acct(&(0x7f0000000000)='./bus\x00') acct(0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x8080, 0x8, 0x3, 0x0, 0x0, r0}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount(0x0, 0x0, 0x0, 0x44021, 0x0) socket$unix(0x1, 0x2, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001100)={0x14, 0x2a, 0x9, 0x70bd27, 0x0, {0x4, 0x0, 0x2c00}}, 0x14}, 0x1, 0x3000000}, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r5, 0x4b66, &(0x7f0000000040)={0x400000000000027c, &(0x7f0000000080)}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000000) syz_open_dev$vbi(&(0x7f0000000000), 0x2, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/printer.usb0/pnp_string\x00', 0x0, 0x86) 3.631553354s ago: executing program 8 (id=809): socket(0x23, 0x3, 0x80000000) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x10}}], 0xa8}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) pipe(&(0x7f00000007c0)) r2 = socket(0x1e, 0x5, 0xa60) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) io_uring_setup(0x1ba5, &(0x7f0000000000)={0x0, 0x8dcf, 0x10000, 0x42, 0x233}) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x3) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f00000000c0)="2000000012005f0214f9f4070000fbe414019ff5526ac553f0ff49a1fc8bf60a1e00", 0x22) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) recvmmsg(r4, &(0x7f00000021c0), 0x5b, 0x40, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') read$FUSE(r7, &(0x7f0000003380)={0x2020}, 0x2020) recvmmsg(r2, &(0x7f0000006bc0)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/117, 0x75}, {&(0x7f00000005c0)=""/199, 0xc7}], 0x2}}], 0x1, 0x20b0, 0x0) 1.990405071s ago: executing program 8 (id=810): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) setpgid(0x0, r3) fchdir(r2) stat(&(0x7f00000001c0)='./file0/../file0/file0\x00', 0x0) r4 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) getdents(r4, &(0x7f0000001fc0)=""/184, 0xb8) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x406c1, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x81, 0x0, 0x4, 0x8}, {0x40, 0xf, 0xf4, 0x4}, {0xc, 0xf, 0x81, 0x800}]}) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x8, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r8, 0xc0502100, &(0x7f0000000280)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r8, 0xc0182101, &(0x7f00000000c0)={r9}) r10 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x80, 0xd3, 0x1d}, 0x18) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r7, 0x40182103, &(0x7f0000000100)={r9, 0x2, r10, 0x6, 0x80000}) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000300)={0x2516, 0x0, 0x4, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) 1.98862853s ago: executing program 5 (id=811): r0 = syz_usb_connect$uac3(0x0, 0xa0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f0000132403050001020602028000000700100002000f240902020000000001"], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000240)={0x20, 0x6, 0x4, "e971ec7b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x80002, 0x0) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_INIT(r2, 0x29, 0xc8, &(0x7f0000000100), 0x4) socket(0xa, 0x3, 0x3a) sendmmsg$inet6(r1, &(0x7f0000000540)=[{{&(0x7f0000000000)={0xa, 0x4e25, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x4004800) syz_usb_control_io(r0, 0x0, &(0x7f0000000b40)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r3, 0x800448d3, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000280)={0x20, 0x18}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000009c0)={0x84, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.877739488s ago: executing program 3 (id=812): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x7, 0x7ffc0001}]}) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) readahead(r0, 0x2dc5, 0x3) (fail_nth: 5) 1.62328725s ago: executing program 3 (id=813): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000000)=0x7, 0x4) setsockopt$packet_int(r0, 0x107, 0xf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="0503d0fcd3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.592855974s ago: executing program 1 (id=814): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00'}) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/166, 0x1f8}], 0x1, 0xfffffff7, 0xc84d) 1.39367812s ago: executing program 3 (id=815): socket$kcm(0x10, 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x801) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x4e071, 0xffffffffffffffff, 0x80000000) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) 1.3161576s ago: executing program 1 (id=816): socket(0x23, 0x3, 0x80000000) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x10}}], 0xa8}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) pipe(&(0x7f00000007c0)) r2 = socket(0x1e, 0x5, 0xa60) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) io_uring_setup(0x1ba5, &(0x7f0000000000)={0x0, 0x8dcf, 0x10000, 0x42, 0x233}) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x3) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f00000000c0)="2000000012005f0214f9f4070000fbe414019ff5526ac553f0ff49a1fc8bf60a1e00", 0x22) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) recvmmsg(r4, &(0x7f00000021c0), 0x5b, 0x40, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') read$FUSE(r7, &(0x7f0000003380)={0x2020}, 0x2020) recvmmsg(r2, &(0x7f0000006bc0)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/117, 0x75}, {&(0x7f00000005c0)=""/199, 0xc7}], 0x2}}], 0x1, 0x20b0, 0x0) 1.314522365s ago: executing program 6 (id=817): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r4, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r2], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendto$packet(r1, 0x0, 0x0, 0x4004004, &(0x7f0000000180)={0xc9, 0x1, r4, 0x1, 0x0, 0x6, @remote}, 0x14) r5 = syz_pidfd_open(r0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r5, 0xff08, 0x0) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_pidfd_open(r6, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r7, 0xff08, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000204355420000002e00000109022400010000000b0904000001030000000921fd7f000122ea00090581031000000f00"], 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) syz_open_dev$sndctrl(&(0x7f0000000240), 0x1, 0x280) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xf, &(0x7f0000001340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000007100000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f0000000180)=0x15) ioctl(r9, 0x40204706, &(0x7f0000000200)) 1.131164773s ago: executing program 3 (id=818): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r4, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r2], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendto$packet(r1, 0x0, 0x0, 0x4004004, &(0x7f0000000180)={0xc9, 0x1, r4, 0x1, 0x0, 0x6, @remote}, 0x14) r5 = syz_pidfd_open(r0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r5, 0xff08, 0x0) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_pidfd_open(r6, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r7, 0xff08, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000204355420000002e00000109022400010000000b0904000001030000000921fd7f000122ea00090581031000000f00"], 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r9 = syz_open_dev$sndctrl(&(0x7f0000000240), 0x1, 0x280) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r9, 0xc10c5541, &(0x7f0000000480)={0xffffa836, 0x2}) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xf, &(0x7f0000001340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000007100000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$TIOCSETD(r10, 0x5423, &(0x7f0000000180)=0x15) ioctl(r10, 0x40204706, &(0x7f0000000200)) 143.814532ms ago: executing program 1 (id=819): epoll_create1(0x80000) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0xf, {[@main=@item_012={0x0, 0x0, 0xb}, @main=@item_4={0x3, 0x0, 0x8, "62966124"}, @global=@item_012={0x1, 0x1, 0x8, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "86"}, @main=@item_4={0x3, 0x0, 0xb, "4070f43f"}]}}, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000000), 0x0, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = userfaultfd(0x80800) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) r4 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r4, 0x0, 0x8, 0x0) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000240)={&(0x7f000046a000/0x2000)=nil, &(0x7f000012a000/0x3000)=nil, 0x2000, 0x3}) r5 = getpid() process_vm_readv(r5, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) r6 = socket(0x2b, 0x1, 0x1) listen(r6, 0x5) accept4$phonet_pipe(r6, 0x0, 0x0, 0x80000) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000540)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000240)={0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="40d9020070000000700f6fa4b180743e45ad9723be2b60bedc10259e2608479e131e16aadff13319fa5d3c02da50def9a186293125036c3f7f55c258b36451a2678860c5de283f28d46ee856aa3ffc37e9cc639f5868d1f41467c78fa3bff53f8b03b296919b45f0b5dbf5e234623fac055431a05441cd1fdb77623e151b16a1553095eeb5b4f6e4b3a6298c19476293d1a25464a7591bef428973def029ec0b521593f56275bddb22dc0c34c5017b5e3aebd72c422090069077331a2dc29256eb9b8425d25d0682d830b2000d75db5268ff3d68aa01433f716bc31b"], &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x239}}, &(0x7f0000000140)={0x0, 0x22, 0xa, {[@local=@item_4={0x3, 0x2, 0x7, "034a07a5"}, @global=@item_012={0x2, 0x1, 0x8, "02ea"}, @main=@item_012={0x1, 0x0, 0xa, "82"}]}}, 0x0}, 0x0) 0s ago: executing program 8 (id=820): r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406d0422c200000000000109022d0001010080320904000002030000000921110100012223000905810340000a00000905020340"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022230000000600ff0900a10185020901150026ff0075089508810209029512910209039503b102c0"], 0x0}, 0x0) syz_usb_ep_read(r0, 0x2, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="001614"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xb, 0x0, &(0x7f0000000000)=0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xfffff000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) statx(0xffffffffffffff9c, 0x0, 0x4100, 0x20, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000500)=0x80) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) socket$nl_route(0x10, 0x3, 0x0) kernel console output (not intermixed with test programs): x420 [ 348.532289][T10320] ? __pfx_genl_rcv_msg+0x10/0x10 [ 348.532310][T10320] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 348.532347][T10320] ? netlink_deliver_tap+0x1ae/0xcc0 [ 348.532378][T10320] genl_rcv+0x28/0x40 [ 348.532393][T10320] netlink_unicast+0x585/0x850 [ 348.532424][T10320] ? __pfx_netlink_unicast+0x10/0x10 [ 348.532450][T10320] ? __pfx_sock_has_perm+0x10/0x10 [ 348.532482][T10320] netlink_sendmsg+0x8b0/0xda0 [ 348.532513][T10320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 348.532542][T10320] ? selinux_socket_sendmsg+0x198/0x2f0 [ 348.532574][T10320] ____sys_sendmsg+0xa4d/0xbe0 [ 348.532596][T10320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 348.532625][T10320] ? __pfx_____sys_sendmsg+0x10/0x10 [ 348.532653][T10320] ? lock_acquire+0x1d1/0x380 [ 348.532671][T10320] ? get_pid_task+0x2a/0x250 [ 348.532698][T10320] ___sys_sendmsg+0x190/0x1e0 [ 348.532723][T10320] ? __pfx____sys_sendmsg+0x10/0x10 [ 348.532747][T10320] ? get_pid_task+0x106/0x250 [ 348.532782][T10320] ? find_held_lock+0x2b/0x80 [ 348.532825][T10320] __sys_sendmsg+0x160/0x210 [ 348.532844][T10320] ? __pfx___sys_sendmsg+0x10/0x10 [ 348.532871][T10320] ? syscall_user_dispatch+0x76/0x130 [ 348.532899][T10320] do_syscall_64+0x123/0x790 [ 348.532923][T10320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.532942][T10320] RIP: 0033:0x7efeeb19e159 [ 348.532957][T10320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 348.532974][T10320] RSP: 002b:00007efee93d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 348.532992][T10320] RAX: ffffffffffffffda RBX: 00007efeeb426090 RCX: 00007efeeb19e159 [ 348.533004][T10320] RDX: 0000000004040084 RSI: 0000200000000100 RDI: 0000000000000008 [ 348.533016][T10320] RBP: 00007efee93d5090 R08: 0000000000000000 R09: 0000000000000000 [ 348.533027][T10320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 348.533038][T10320] R13: 00007efeeb426128 R14: 00007efeeb426090 R15: 00007ffe039ed8a8 [ 348.533065][T10320] [ 348.966948][ T5717] usb 9-1: device descriptor read/64, error -71 [ 348.970734][T10322] FAULT_INJECTION: forcing a failure. [ 348.970734][T10322] name failslab, interval 1, probability 0, space 0, times 0 [ 348.970764][T10322] CPU: 1 UID: 0 PID: 10322 Comm: syz.3.581 Tainted: G L syzkaller #0 PREEMPT(full) [ 348.970791][T10322] Tainted: [L]=SOFTLOCKUP [ 348.970798][T10322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 348.970808][T10322] Call Trace: [ 348.970814][T10322] [ 348.970821][T10322] dump_stack_lvl+0x100/0x190 [ 348.970854][T10322] should_fail_ex.cold+0x5/0xa [ 348.970881][T10322] should_failslab+0xc2/0x120 [ 348.970904][T10322] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 348.970923][T10322] ? register_lock_class+0x3f/0x7b0 [ 348.970942][T10322] ? __d_alloc+0x35/0xa50 [ 348.970971][T10322] __d_alloc+0x35/0xa50 [ 348.970992][T10322] ? __lock_acquire+0x4c5/0x1ec0 [ 348.971013][T10322] d_alloc_parallel+0x105/0x14c0 [ 348.971033][T10322] ? avc_has_perm_noaudit+0x145/0x3b0 [ 348.971060][T10322] ? lock_acquire+0x1d1/0x380 [ 348.971077][T10322] ? lookup_slow+0x42/0x70 [ 348.971101][T10322] ? __pfx_d_alloc_parallel+0x10/0x10 [ 348.971119][T10322] ? __pfx___might_resched+0x10/0x10 [ 348.971138][T10322] ? find_held_lock+0x2b/0x80 [ 348.971166][T10322] ? down_read+0x13b/0x4c0 [ 348.971191][T10322] ? __pfx_down_read+0x10/0x10 [ 348.971217][T10322] __lookup_slow+0x98/0x320 [ 348.971247][T10322] lookup_slow+0x50/0x70 [ 348.971273][T10322] link_path_walk+0x1377/0x1cc0 [ 348.971301][T10322] path_openat+0x1ac/0x2440 [ 348.971327][T10322] ? __pfx_path_openat+0x10/0x10 [ 348.971356][T10322] do_file_open+0x20e/0x430 [ 348.971380][T10322] ? __pfx_do_file_open+0x10/0x10 [ 348.971421][T10322] ? _raw_spin_unlock+0x28/0x50 [ 348.971447][T10322] ? alloc_fd+0x471/0x7a0 [ 348.971477][T10322] do_sys_openat2+0x10f/0x1e0 [ 348.971501][T10322] ? __pfx_do_sys_openat2+0x10/0x10 [ 348.971531][T10322] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 348.971553][T10322] ? __fget_files+0x21f/0x3d0 [ 348.971578][T10322] __x64_sys_openat+0x12d/0x210 [ 348.971602][T10322] ? __pfx___x64_sys_openat+0x10/0x10 [ 348.971624][T10322] ? ksys_write+0x1ac/0x250 [ 348.971651][T10322] do_syscall_64+0x123/0x790 [ 348.971675][T10322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.971695][T10322] RIP: 0033:0x7f0a9d59e159 [ 348.971711][T10322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 348.971727][T10322] RSP: 002b:00007f0a9e44f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 348.971746][T10322] RAX: ffffffffffffffda RBX: 00007f0a9d826090 RCX: 00007f0a9d59e159 [ 348.971759][T10322] RDX: 0000000000000002 RSI: 0000200000000240 RDI: ffffffffffffff9c [ 348.971771][T10322] RBP: 00007f0a9e44f090 R08: 0000000000000000 R09: 0000000000000000 [ 348.971782][T10322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 348.971793][T10322] R13: 00007f0a9d826128 R14: 00007f0a9d826090 R15: 00007ffc840a7488 [ 348.971820][T10322] [ 349.069337][ T985] usb 6-1: USB disconnect, device number 19 [ 349.082314][ T5717] usb usb9-port1: attempt power cycle [ 349.410465][T10331] xt_hashlimit: size too large, truncated to 1048576 [ 349.417349][T10331] xt_hashlimit: invalid rate [ 349.432085][ T5717] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 349.452524][ T5717] usb 9-1: device descriptor read/8, error -71 [ 349.465065][ T9] usb 4-1: USB disconnect, device number 16 [ 349.684380][ T10] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 349.698605][ T31] audit: type=1400 audit(1788458228.255:895): avc: denied { write } for pid=10321 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 349.722332][ T5717] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 349.724758][ T30] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 349.743900][ T5717] usb 9-1: device descriptor read/8, error -71 [ 349.842703][ T10] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 349.861065][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.861106][ T10] usb 6-1: Product: syz [ 349.861155][ T10] usb 6-1: Manufacturer: syz [ 349.861172][ T10] usb 6-1: SerialNumber: syz [ 349.862840][ T5717] usb usb9-port1: unable to enumerate USB device [ 349.892947][ T30] usb 7-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 349.894406][ T30] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 349.894458][ T30] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 349.943420][ T31] audit: type=1400 audit(1788458228.495:896): avc: denied { write } for pid=10340 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 350.167594][T10331] FAULT_INJECTION: forcing a failure. [ 350.167594][T10331] name failslab, interval 1, probability 0, space 0, times 0 [ 350.167645][T10331] CPU: 1 UID: 0 PID: 10331 Comm: syz.6.584 Tainted: G L syzkaller #0 PREEMPT(full) [ 350.167673][T10331] Tainted: [L]=SOFTLOCKUP [ 350.167679][T10331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 350.167688][T10331] Call Trace: [ 350.167693][T10331] [ 350.167700][T10331] dump_stack_lvl+0x100/0x190 [ 350.167733][T10331] should_fail_ex.cold+0x5/0xa [ 350.167765][T10331] should_failslab+0xc2/0x120 [ 350.167790][T10331] __kmalloc_noprof+0xfc/0x840 [ 350.167810][T10331] ? __register_sysctl_table+0xbc8/0x1650 [ 350.167837][T10331] ? __register_sysctl_table+0xbe4/0x1650 [ 350.167869][T10331] __register_sysctl_table+0xbe4/0x1650 [ 350.167902][T10331] ? __pfx___register_sysctl_table+0x10/0x10 [ 350.167930][T10331] ? register_pidns_sysctls+0x48/0x1c0 [ 350.167966][T10331] ? __asan_memcpy+0x3c/0x60 [ 350.167999][T10331] register_pidns_sysctls+0x11d/0x1c0 [ 350.168030][T10331] ? __ns_common_init+0x299/0x4b0 [ 350.168056][T10331] copy_pid_ns+0x680/0x10a0 [ 350.168084][T10331] ? __pfx_copy_pid_ns+0x10/0x10 [ 350.168110][T10331] ? __pfx_copy_mnt_ns+0x10/0x10 [ 350.168141][T10331] ? create_new_namespaces+0x30/0xac0 [ 350.168167][T10331] create_new_namespaces+0x2aa/0xac0 [ 350.168195][T10331] unshare_nsproxy_namespaces+0xf2/0x220 [ 350.168221][T10331] ksys_unshare+0x4a2/0xa70 [ 350.168244][T10331] ? __pfx_ksys_unshare+0x10/0x10 [ 350.168277][T10331] __x64_sys_unshare+0x31/0x40 [ 350.168299][T10331] do_syscall_64+0x123/0x790 [ 350.168325][T10331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.168345][T10331] RIP: 0033:0x7efeeb19e159 [ 350.168367][T10331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 350.168389][T10331] RSP: 002b:00007efee93f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 350.168411][T10331] RAX: ffffffffffffffda RBX: 00007efeeb425fa0 RCX: 00007efeeb19e159 [ 350.168425][T10331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000400 [ 350.168438][T10331] RBP: 00007efeeb235024 R08: 0000000000000000 R09: 0000000000000000 [ 350.168451][T10331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 350.168465][T10331] R13: 00007efeeb426038 R14: 00007efeeb425fa0 R15: 00007ffe039ed8a8 [ 350.168494][T10331] [ 350.168503][T10331] sysctl could not get directory: /kernel -12 [ 350.248587][ T10] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 350.248641][ T10] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 350.248662][ T10] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 350.387233][ T10] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 350.493707][ T10] usb 6-1: USB disconnect, device number 20 [ 351.230500][ T10] usb 7-1: USB disconnect, device number 14 [ 351.475958][ T31] audit: type=1400 audit(1788458230.035:897): avc: denied { write } for pid=10342 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 351.512606][ T31] audit: type=1400 audit(1788458230.075:898): avc: denied { append } for pid=10370 comm="syz.6.588" name="comedi3" dev="devtmpfs" ino=1276 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 351.644854][ T31] audit: type=1400 audit(1788458230.205:899): avc: denied { append } for pid=10371 comm="syz.8.590" name="cpu_dma_latency" dev="devtmpfs" ino=1312 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pmqos_device_t tclass=chr_file permissive=1 [ 351.670244][ T31] audit: type=1400 audit(1788458230.205:900): avc: denied { open } for pid=10371 comm="syz.8.590" path="/97/dev/cpu_dma_latency" dev="devtmpfs" ino=1312 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pmqos_device_t tclass=chr_file permissive=1 [ 351.740176][ T31] audit: type=1400 audit(1788458230.295:901): avc: denied { write } for pid=10381 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 351.989483][ T31] audit: type=1400 audit(1788458230.545:902): avc: denied { setopt } for pid=10395 comm="syz.3.596" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 352.072038][ T5717] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 352.112139][ T10] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 352.222103][ T5717] usb 6-1: Using ep0 maxpacket: 8 [ 352.222646][ T5717] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 352.223532][ T5717] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 352.223563][ T5717] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 352.223597][ T5717] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 352.223621][ T5717] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 352.223645][ T5717] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 352.223670][ T5717] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 352.223695][ T5717] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 352.223718][ T5717] usb 6-1: config 168 interface 0 has no altsetting 0 [ 352.224538][ T5717] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 352.224566][ T5717] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 352.224598][ T5717] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 352.224622][ T5717] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 352.224646][ T5717] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 352.224671][ T5717] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 352.224695][ T5717] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 352.224719][ T5717] usb 6-1: config 168 interface 0 has no altsetting 0 [ 352.225524][ T5717] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 352.225553][ T5717] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 352.225587][ T5717] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 352.225613][ T5717] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 352.225635][ T5717] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 352.225658][ T5717] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 352.225681][ T5717] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 352.225708][ T5717] usb 6-1: config 168 interface 0 has no altsetting 0 [ 352.228398][ T5717] usb 6-1: string descriptor 0 read error: -22 [ 352.228505][ T5717] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.237332][ T5717] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 352.238347][ T5701] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 352.346325][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 352.356046][ T31] audit: type=1400 audit(1788458230.915:903): avc: denied { write } for pid=10390 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 352.370675][ T10] usb 7-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 352.423959][ T5701] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 352.424137][ T10] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 352.424162][ T10] usb 7-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 352.447743][ T10] usb 7-1: config 0 interface 0 has no altsetting 0 [ 352.538230][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.538255][ T10] usb 7-1: Product: syz [ 352.538270][ T10] usb 7-1: Manufacturer: syz [ 352.538284][ T10] usb 7-1: SerialNumber: syz [ 352.576964][ T5701] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.576990][ T5701] usb 4-1: Product: syz [ 352.577006][ T5701] usb 4-1: Manufacturer: syz [ 352.577020][ T5701] usb 4-1: SerialNumber: syz [ 352.668745][ T10] usb 7-1: config 0 descriptor?? [ 352.669040][ T31] audit: type=1400 audit(1788458231.225:904): avc: denied { write } for pid=10414 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 352.804347][ T31] audit: type=1400 audit(1788458231.355:905): avc: denied { setopt } for pid=10420 comm="syz.1.601" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 352.878182][ T5732] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 353.236861][ T985] usb 4-1: USB disconnect, device number 17 [ 353.411411][T10430] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.425809][T10430] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 353.449233][ T10] gs_usb 7-1:0.0: Couldn't get device config: (err=-121) [ 353.449279][ T10] gs_usb 7-1:0.0: probe with driver gs_usb failed with error -121 [ 354.506062][ T5732] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 354.506274][ T5732] ath9k_htc: Failed to initialize the device [ 354.825421][ T985] usb 4-1: ath9k_htc: USB layer deinitialized [ 354.945532][ T10] usb 6-1: USB disconnect, device number 21 [ 355.020671][ T5732] usb 7-1: USB disconnect, device number 15 [ 355.143901][T10459] IPVS: set_ctl: invalid protocol: 1 224.0.0.2:20000 [ 355.237208][T10461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.607'. [ 355.259947][ T31] kauditd_printk_skb: 3 callbacks suppressed [ 355.259988][ T31] audit: type=1400 audit(1788458233.815:909): avc: denied { write } for pid=10432 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 355.938755][ T31] audit: type=1400 audit(1788458234.495:910): avc: denied { write } for pid=10470 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 356.028838][ T31] audit: type=1400 audit(1788458234.585:911): avc: denied { bind } for pid=10475 comm="syz.5.613" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 356.028851][T10477] Unsupported ieee802154 address type: 0 [ 356.062486][T10450] netlink: 'syz.1.605': attribute type 1 has an invalid length. [ 356.164741][T10473] netlink: 16 bytes leftover after parsing attributes in process `syz.1.605'. [ 356.209345][T10450] 8021q: adding VLAN 0 to HW filter on device bond1 [ 356.266149][T10485] netlink: 24 bytes leftover after parsing attributes in process `syz.6.612'. [ 356.305850][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056b96400: rx timeout, send abort [ 356.419936][T10469] bond1: (slave geneve2): making interface the new active one [ 356.510347][T10469] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 356.805900][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056b96400: abort rx timeout. Force session deactivation [ 356.806068][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056b94800: rx timeout, send abort [ 356.817473][ T43] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 357.306392][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056b94800: abort rx timeout. Force session deactivation [ 357.333776][T10473] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 357.351224][T10473] bond2 (unregistering): Released all slaves [ 357.444036][ T8792] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 357.507554][ T8792] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 357.544378][ T1166] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 357.544447][ T1166] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 357.587196][T10502] netlink: 56 bytes leftover after parsing attributes in process `syz.3.620'. [ 357.826153][T10513] netlink: 28 bytes leftover after parsing attributes in process `syz.1.621'. [ 357.842364][ T985] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 357.909711][T10513] overlayfs: failed to resolve './file1/file0': -2 [ 357.952460][ T31] audit: type=1400 audit(1788458236.515:912): avc: denied { connect } for pid=10514 comm="syz.5.622" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 357.954826][ T10] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 358.000519][ T31] audit: type=1400 audit(1788458236.555:913): avc: denied { mount } for pid=10522 comm="syz.8.623" name="/" dev="hugetlbfs" ino=32573 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 358.024824][ T985] usb 4-1: Using ep0 maxpacket: 32 [ 358.030628][ T985] usb 4-1: New USB device found, idVendor=16c0, idProduct=05e1, bcdDevice= 0.00 [ 358.045364][ T985] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 130, changing to 11 [ 358.057103][ T985] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid maxpacket 33320, setting to 1024 [ 358.057148][ T985] usb 4-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 358.057191][ T985] usb 4-1: config 0 interface 0 has no altsetting 0 [ 358.057226][ T985] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 358.098884][ T985] usb 4-1: config 0 descriptor?? [ 358.111981][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 358.112658][ T10] usb 7-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=7b.55 [ 358.113664][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 109, changing to 10 [ 358.113693][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 25697, setting to 1024 [ 358.115472][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.115494][ T10] usb 7-1: Product: syz [ 358.115509][ T10] usb 7-1: Manufacturer: syz [ 358.115523][ T10] usb 7-1: SerialNumber: syz [ 358.119478][ T10] usb 7-1: config 0 descriptor?? [ 358.123326][T10507] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 358.197238][ T31] audit: type=1400 audit(1788458236.755:914): avc: denied { write } for pid=10496 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 358.206976][ T10] usb 7-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 358.308725][T10502] netlink: 104 bytes leftover after parsing attributes in process `syz.3.620'. [ 358.312109][ T5732] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 358.331766][ T985] usbhid 4-1:0.0: can't add hid device: -71 [ 358.337883][ T985] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 358.358879][ T985] usb 4-1: USB disconnect, device number 18 [ 358.411032][ T31] audit: type=1400 audit(1788458236.965:915): avc: denied { write } for pid=10530 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 358.487546][ T5732] usb 9-1: Using ep0 maxpacket: 16 [ 358.495195][ T5732] usb 9-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 358.506712][ T5732] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.506745][ T5732] usb 9-1: Product: syz [ 358.506762][ T5732] usb 9-1: Manufacturer: syz [ 358.506797][ T5732] usb 9-1: SerialNumber: syz [ 358.518210][ T5732] r8152-cfgselector 9-1: Unknown version 0x0000 [ 358.518234][ T5732] r8152-cfgselector 9-1: config 0 descriptor?? [ 358.721298][ T8795] usb 7-1: Failed to submit usb control message: -71 [ 358.721347][ T8795] usb 7-1: unable to send the bmi data to the device: -71 [ 358.721380][ T8795] usb 7-1: unable to get target info from device [ 358.721412][ T8795] usb 7-1: could not get target info (-71) [ 358.721715][ T8795] usb 7-1: could not probe fw (-71) [ 358.721903][ T9] usb 7-1: USB disconnect, device number 16 [ 358.963224][ T985] r8152-cfgselector 9-1: USB disconnect, device number 28 [ 359.631137][ T31] audit: type=1400 audit(1788458238.185:916): avc: denied { unmount } for pid=6924 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 359.694284][ T31] audit: type=1400 audit(1788458238.245:917): avc: denied { write } for pid=10533 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 359.956584][T10557] FAULT_INJECTION: forcing a failure. [ 359.956584][T10557] name failslab, interval 1, probability 0, space 0, times 0 [ 359.956660][T10557] CPU: 1 UID: 0 PID: 10557 Comm: syz.3.629 Tainted: G L syzkaller #0 PREEMPT(full) [ 359.956689][T10557] Tainted: [L]=SOFTLOCKUP [ 359.956696][T10557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 359.956707][T10557] Call Trace: [ 359.956714][T10557] [ 359.956722][T10557] dump_stack_lvl+0x100/0x190 [ 359.956754][T10557] should_fail_ex.cold+0x5/0xa [ 359.956781][T10557] should_failslab+0xc2/0x120 [ 359.956805][T10557] __kvmalloc_node_noprof+0x113/0x9b0 [ 359.956824][T10557] ? __kmalloc_cache_noprof+0x241/0x6d0 [ 359.956852][T10557] ? percpu_ref_init+0xec/0x3f0 [ 359.956875][T10557] ? io_alloc_cache_init+0x38/0x170 [ 359.956904][T10557] io_alloc_cache_init+0x38/0x170 [ 359.956930][T10557] io_uring_setup.cold+0x48c/0x1cde [ 359.956952][T10557] ? lock_acquire+0x1d1/0x380 [ 359.956972][T10557] ? avc_has_perm_noaudit+0x56/0x3b0 [ 359.956996][T10557] ? __pfx_io_uring_setup+0x10/0x10 [ 359.957029][T10557] ? find_held_lock+0x2b/0x80 [ 359.957054][T10557] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 359.957076][T10557] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 359.957118][T10557] ? exit_to_user_mode_loop+0x166/0x700 [ 359.957141][T10557] ? rcu_is_watching+0x13/0xc0 [ 359.957171][T10557] __x64_sys_io_uring_setup+0xc2/0x170 [ 359.957193][T10557] do_syscall_64+0x123/0x790 [ 359.957218][T10557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.957239][T10557] RIP: 0033:0x7f0a9d59e159 [ 359.957255][T10557] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 359.957273][T10557] RSP: 002b:00007f0a9e42dee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 359.957293][T10557] RAX: ffffffffffffffda RBX: 0000200000000a88 RCX: 00007f0a9d59e159 [ 359.957306][T10557] RDX: 0000200000000b08 RSI: 0000200000000a88 RDI: 00000000000003c9 [ 359.957318][T10557] RBP: 0000200000000a80 R08: 0000000000000000 R09: 0000000000000000 [ 359.957330][T10557] R10: 0000200000000b10 R11: 0000000000000206 R12: 0000200000000b08 [ 359.957343][T10557] R13: 0000200000000b10 R14: 00007f0a9e42dfd8 R15: 0000000000000000 [ 359.957370][T10557] [ 360.359947][T10563] FAULT_INJECTION: forcing a failure. [ 360.359947][T10563] name failslab, interval 1, probability 0, space 0, times 0 [ 360.360006][T10563] CPU: 0 UID: 0 PID: 10563 Comm: syz.8.628 Tainted: G L syzkaller #0 PREEMPT(full) [ 360.360030][T10563] Tainted: [L]=SOFTLOCKUP [ 360.360035][T10563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 360.360044][T10563] Call Trace: [ 360.360049][T10563] [ 360.360056][T10563] dump_stack_lvl+0x100/0x190 [ 360.360085][T10563] should_fail_ex.cold+0x5/0xa [ 360.360113][T10563] should_failslab+0xc2/0x120 [ 360.360136][T10563] __kmalloc_noprof+0xfc/0x840 [ 360.360155][T10563] ? genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 360.360182][T10563] genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 360.360210][T10563] genl_family_rcv_msg_doit+0xc7/0x300 [ 360.360231][T10563] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 360.360260][T10563] ? bpf_lsm_capable+0x9/0x10 [ 360.360285][T10563] ? security_capable+0x80/0x260 [ 360.360316][T10563] genl_rcv_msg+0x560/0x800 [ 360.360339][T10563] ? __pfx_genl_rcv_msg+0x10/0x10 [ 360.360357][T10563] ? __lock_acquire+0x4c5/0x1ec0 [ 360.360376][T10563] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 360.360405][T10563] ? __pfx_nl802154_add_llsec_key+0x10/0x10 [ 360.360431][T10563] ? __pfx_nl802154_post_doit+0x10/0x10 [ 360.360458][T10563] ? __lock_acquire+0x4c5/0x1ec0 [ 360.360483][T10563] netlink_rcv_skb+0x159/0x420 [ 360.360510][T10563] ? __pfx_genl_rcv_msg+0x10/0x10 [ 360.360530][T10563] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 360.360568][T10563] ? netlink_deliver_tap+0x1ae/0xcc0 [ 360.360598][T10563] genl_rcv+0x28/0x40 [ 360.360615][T10563] netlink_unicast+0x585/0x850 [ 360.360645][T10563] ? __pfx_netlink_unicast+0x10/0x10 [ 360.360680][T10563] netlink_sendmsg+0x8b0/0xda0 [ 360.360711][T10563] ? __pfx_netlink_sendmsg+0x10/0x10 [ 360.360741][T10563] ? selinux_socket_sendmsg+0x198/0x2f0 [ 360.360777][T10563] ____sys_sendmsg+0xa4d/0xbe0 [ 360.360798][T10563] ? __pfx_netlink_sendmsg+0x10/0x10 [ 360.360826][T10563] ? __pfx_____sys_sendmsg+0x10/0x10 [ 360.360856][T10563] ? lock_acquire+0x1d1/0x380 [ 360.360874][T10563] ? get_pid_task+0x2a/0x250 [ 360.360902][T10563] ___sys_sendmsg+0x190/0x1e0 [ 360.360928][T10563] ? __pfx____sys_sendmsg+0x10/0x10 [ 360.360952][T10563] ? get_pid_task+0x106/0x250 [ 360.360991][T10563] ? find_held_lock+0x2b/0x80 [ 360.361034][T10563] __sys_sendmsg+0x160/0x210 [ 360.361053][T10563] ? __pfx___sys_sendmsg+0x10/0x10 [ 360.361086][T10563] do_syscall_64+0x123/0x790 [ 360.361111][T10563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 360.361130][T10563] RIP: 0033:0x7f5b0159e159 [ 360.361146][T10563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 360.361163][T10563] RSP: 002b:00007f5b02411028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 360.361182][T10563] RAX: ffffffffffffffda RBX: 00007f5b01825fa0 RCX: 00007f5b0159e159 [ 360.361194][T10563] RDX: 0000000000000800 RSI: 00002000000002c0 RDI: 0000000000000004 [ 360.361206][T10563] RBP: 00007f5b02411090 R08: 0000000000000000 R09: 0000000000000000 [ 360.361217][T10563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 360.361228][T10563] R13: 00007f5b01826038 R14: 00007f5b01825fa0 R15: 00007ffc703ea858 [ 360.361255][T10563] [ 361.193300][T10571] FAULT_INJECTION: forcing a failure. [ 361.193300][T10571] name failslab, interval 1, probability 0, space 0, times 0 [ 361.193331][T10571] CPU: 0 UID: 0 PID: 10571 Comm: syz.3.631 Tainted: G L syzkaller #0 PREEMPT(full) [ 361.193357][T10571] Tainted: [L]=SOFTLOCKUP [ 361.193364][T10571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 361.193375][T10571] Call Trace: [ 361.193381][T10571] [ 361.193389][T10571] dump_stack_lvl+0x100/0x190 [ 361.193421][T10571] should_fail_ex.cold+0x5/0xa [ 361.193447][T10571] should_failslab+0xc2/0x120 [ 361.193470][T10571] __kmalloc_noprof+0xfc/0x840 [ 361.193489][T10571] ? bpf_test_init.isra.0+0x88/0x100 [ 361.193524][T10571] bpf_test_init.isra.0+0x88/0x100 [ 361.193550][T10571] bpf_prog_test_run_xdp+0x587/0x1670 [ 361.193586][T10571] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 361.193620][T10571] ? fput+0x7c/0x100 [ 361.193642][T10571] ? __bpf_prog_get+0x97/0x290 [ 361.193666][T10571] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 361.193692][T10571] __sys_bpf+0x2265/0x4a30 [ 361.193716][T10571] ? __pfx___sys_bpf+0x10/0x10 [ 361.193733][T10571] ? find_held_lock+0x2b/0x80 [ 361.193757][T10571] ? get_pid_task+0xfc/0x250 [ 361.193779][T10571] ? get_pid_task+0xfc/0x250 [ 361.193811][T10571] ? find_held_lock+0x2b/0x80 [ 361.193841][T10571] ? rcu_read_lock_any_held+0x6a/0x90 [ 361.193866][T10571] ? find_held_lock+0x2b/0x80 [ 361.193889][T10571] ? ksys_write+0x190/0x250 [ 361.193905][T10571] ? ksys_write+0x190/0x250 [ 361.193921][T10571] ? lock_acquire+0x1d1/0x380 [ 361.193960][T10571] ? fput+0x7c/0x100 [ 361.193981][T10571] ? ksys_write+0x1ac/0x250 [ 361.194001][T10571] ? __x64_sys_bpf+0xce/0x140 [ 361.194017][T10571] __x64_sys_bpf+0xce/0x140 [ 361.194035][T10571] ? do_syscall_64+0xae/0x790 [ 361.194058][T10571] do_syscall_64+0x123/0x790 [ 361.194080][T10571] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 361.194099][T10571] RIP: 0033:0x7f0a9d59e159 [ 361.194115][T10571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 361.194131][T10571] RSP: 002b:00007f0a9e470028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 361.194149][T10571] RAX: ffffffffffffffda RBX: 00007f0a9d825fa0 RCX: 00007f0a9d59e159 [ 361.194161][T10571] RDX: 0000000000000050 RSI: 0000200000000100 RDI: 000000000000000a [ 361.194173][T10571] RBP: 00007f0a9e470090 R08: 0000000000000000 R09: 0000000000000000 [ 361.194184][T10571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 361.194195][T10571] R13: 00007f0a9d826038 R14: 00007f0a9d825fa0 R15: 00007ffc840a7488 [ 361.194222][T10571] [ 361.238525][ T31] audit: type=1400 audit(1788458239.785:918): avc: denied { write } for pid=10566 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 361.247515][ T31] audit: type=1400 audit(1788458239.795:919): avc: denied { nlmsg_write } for pid=10573 comm="syz.8.633" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 361.281707][ T31] audit: type=1400 audit(1788458239.835:920): avc: denied { audit_write } for pid=10573 comm="syz.8.633" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 361.288213][ T31] audit: type=1107 audit(1788458239.835:921): pid=10573 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 361.312091][ T5732] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 361.345116][ T30] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 361.472997][ T5732] usb 7-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 361.476209][ T5732] usb 7-1: config 0 has an invalid interface number: 69 but max is 0 [ 361.476234][ T5732] usb 7-1: config 0 has no interface number 0 [ 361.476268][ T5732] usb 7-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 361.476291][ T5732] usb 7-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 361.486356][ T5732] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.486381][ T5732] usb 7-1: Product: syz [ 361.486395][ T5732] usb 7-1: Manufacturer: syz [ 361.486409][ T5732] usb 7-1: SerialNumber: syz [ 361.508483][ T31] audit: type=1400 audit(1788458240.055:922): avc: denied { write } for pid=10576 comm="syz.3.634" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 361.509598][ T5732] usb 7-1: config 0 descriptor?? [ 361.510236][T10564] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 361.516316][ T31] audit: type=1400 audit(1788458240.075:923): avc: denied { write } for pid=10576 comm="syz.3.634" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 361.518449][ T5732] cyberjack 7-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 361.554616][ T5732] usb 7-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 361.590786][ T30] usb 2-1: Using ep0 maxpacket: 32 [ 361.683782][ T30] usb 2-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 361.735861][ T30] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 361.735887][ T30] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 361.735933][ T30] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 361.809954][ C0] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22 [ 361.853196][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.853223][ T30] usb 2-1: Product: syz [ 361.853238][ T30] usb 2-1: Manufacturer: syz [ 361.853252][ T30] usb 2-1: SerialNumber: syz [ 362.238997][T10564] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 362.317013][T10564] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.344878][T10559] xt_socket: unknown flags 0x4c [ 362.454568][T10564] netlink: 'syz.6.626': attribute type 2 has an invalid length. [ 362.464212][T10564] netlink: 'syz.6.626': attribute type 2 has an invalid length. [ 362.566667][T10568] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 362.598503][T10568] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.761390][ T30] usb 2-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 362.827666][ T30] usb 2-1: incorrect wMaxPacketSize 0x10 for BADD profile [ 363.286735][T10564] wlan0 speed is unknown, defaulting to 1000 [ 363.298126][ T30] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 363.316811][ T30] usb 2-1: USB disconnect, device number 32 [ 363.358650][ T31] audit: type=1400 audit(1788458241.915:924): avc: denied { setopt } for pid=10591 comm="syz.5.638" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 363.360022][ T31] audit: type=1400 audit(1788458241.915:925): avc: denied { write } for pid=10591 comm="syz.5.638" name="functions" dev="configfs" ino=9285 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 364.275362][ T5975] udevd[5975]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 364.345814][ T31] audit: type=1400 audit(1788458242.895:926): avc: denied { cmd } for pid=10590 comm="syz.3.639" path="/65/file2" dev="tmpfs" ino=384 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=io_uring permissive=1 [ 365.752031][ T5717] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 365.922659][ T5717] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 365.990090][T10621] rnbd_client L607: Mapping device /dev/ram. on session s+, (access_mode: rw, nr_poll_queues: 0) [ 366.079424][T10621] rtrs_client L2095: : Failed to resolve address, err: -ENODEV [ 366.089052][T10621] rtrs_client L2636: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 366.197226][ T985] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 366.242079][ T5717] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.242141][ T5717] usb 6-1: Product: syz [ 366.242169][ T5717] usb 6-1: Manufacturer: syz [ 366.242186][ T5717] usb 6-1: SerialNumber: syz [ 366.682033][ T985] usb 2-1: Using ep0 maxpacket: 32 [ 366.688726][ T985] usb 2-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 366.720832][ T985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 366.720903][ T985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 45076, setting to 1024 [ 366.720950][ T985] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 366.933544][ T985] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.933597][ T985] usb 2-1: Product: syz [ 366.933628][ T985] usb 2-1: Manufacturer: syz [ 366.933646][ T985] usb 2-1: SerialNumber: syz [ 367.058640][ T985] usb 2-1: config 0 descriptor?? [ 367.066684][T10617] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 367.248257][ T5732] usb 7-1: USB disconnect, device number 17 [ 367.274074][ T5732] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 367.286018][ T5732] cyberjack 7-1:0.69: device disconnected [ 367.380390][ T31] audit: type=1400 audit(1788458245.935:927): avc: denied { ioctl } for pid=10626 comm="syz.8.647" path="/dev/binderfs/binder0" dev="binder" ino=9 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 367.470306][ T31] audit: type=1400 audit(1788458246.025:928): avc: denied { bind } for pid=10614 comm="syz.1.644" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 367.623311][ T5717] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 367.623391][ T5717] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 367.948807][ T5732] usb 2-1: USB disconnect, device number 33 [ 368.354680][ T31] audit: type=1400 audit(1788458246.915:929): avc: denied { write } for pid=10615 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 368.586513][ T31] audit: type=1400 audit(1788458247.145:930): avc: denied { write } for pid=10648 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 369.013360][T10657] can0: slcan on ttyS3. [ 369.565188][T10650] can0 (unregistered): slcan off ttyS3. [ 369.610605][T10611] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 369.624777][T10611] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 369.666291][ T5717] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000080. ret = -EPIPE [ 369.666361][ T5717] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 369.667069][ T5717] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 369.704429][ T5717] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -32 [ 369.713539][ T5717] usb 6-1: USB disconnect, device number 22 [ 370.278021][ T5604] Bluetooth: hci2: command 0x0406 tx timeout [ 370.379227][ T31] audit: type=1400 audit(1788458248.935:931): avc: denied { remount } for pid=10667 comm="syz.3.645" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 370.669681][ T31] audit: type=1400 audit(1788458249.225:932): avc: denied { bind } for pid=10663 comm="syz.6.653" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 370.669753][ T31] audit: type=1400 audit(1788458249.225:933): avc: denied { name_bind } for pid=10663 comm="syz.6.653" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 371.763399][ T31] audit: type=1400 audit(1788458250.325:934): avc: denied { write } for pid=10654 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 371.878902][ T31] audit: type=1400 audit(1788458250.435:935): avc: denied { write } for pid=10687 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 372.926447][ T31] audit: type=1400 audit(1788458251.025:936): avc: denied { name_bind } for pid=10692 comm="syz.8.657" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 373.081219][T10700] FAULT_INJECTION: forcing a failure. [ 373.081219][T10700] name failslab, interval 1, probability 0, space 0, times 0 [ 373.097322][ T5784] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 373.123039][T10700] CPU: 0 UID: 0 PID: 10700 Comm: syz.1.659 Tainted: G L syzkaller #0 PREEMPT(full) [ 373.123078][T10700] Tainted: [L]=SOFTLOCKUP [ 373.123086][T10700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 373.123099][T10700] Call Trace: [ 373.123107][T10700] [ 373.123115][T10700] dump_stack_lvl+0x100/0x190 [ 373.123154][T10700] should_fail_ex.cold+0x5/0xa [ 373.123181][T10700] should_failslab+0xc2/0x120 [ 373.123207][T10700] __kmalloc_cache_noprof+0x91/0x6d0 [ 373.123235][T10700] ? vhost_iotlb_add_range_ctx+0x7b5/0xb70 [ 373.123273][T10700] vhost_iotlb_add_range_ctx+0x7b5/0xb70 [ 373.123314][T10700] vhost_chr_write_iter+0x957/0x11d0 [ 373.123345][T10700] ? __pfx_vhost_chr_write_iter+0x10/0x10 [ 373.123370][T10700] ? avc_policy_seqno+0x9/0x20 [ 373.123396][T10700] ? bpf_lsm_file_permission+0x9/0x10 [ 373.123422][T10700] ? security_file_permission+0x76/0x210 [ 373.123444][T10700] ? rw_verify_area+0xce/0x6d0 [ 373.123475][T10700] vfs_write+0x6af/0x1050 [ 373.123507][T10700] ? __pfx_vhost_net_chr_write_iter+0x10/0x10 [ 373.123536][T10700] ? __pfx_vfs_write+0x10/0x10 [ 373.123564][T10700] ? find_held_lock+0x2b/0x80 [ 373.123611][T10700] ksys_write+0x12a/0x250 [ 373.123629][T10700] ? __pfx_ksys_write+0x10/0x10 [ 373.123657][T10700] do_syscall_64+0x123/0x790 [ 373.123684][T10700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.123706][T10700] RIP: 0033:0x7f4a19d9e159 [ 373.123725][T10700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 373.123744][T10700] RSP: 002b:00007f4a1ad4e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 373.123764][T10700] RAX: ffffffffffffffda RBX: 00007f4a1a025fa0 RCX: 00007f4a19d9e159 [ 373.123778][T10700] RDX: 0000000000000048 RSI: 0000200000000a80 RDI: 0000000000000004 [ 373.123791][T10700] RBP: 00007f4a19e35024 R08: 0000000000000000 R09: 0000000000000000 [ 373.123804][T10700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 373.123815][T10700] R13: 00007f4a1a026038 R14: 00007f4a1a025fa0 R15: 00007ffed3156318 [ 373.123844][T10700] [ 373.249447][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 373.249500][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 373.260650][ T5784] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 373.312351][ T5717] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 373.372423][ T5784] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 373.372450][ T5784] usb 4-1: config 1 has no interface number 0 [ 373.372484][ T5784] usb 4-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 373.372509][ T5784] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 373.372532][ T5784] usb 4-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 373.430646][ T5784] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.430684][ T5784] usb 4-1: Product: syz [ 373.430719][ T5784] usb 4-1: Manufacturer: syz [ 373.430737][ T5784] usb 4-1: SerialNumber: syz [ 373.487115][ T985] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 373.508109][T10691] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 373.509680][ T5717] usb 6-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 373.513966][ T5717] usb 6-1: config 0 has an invalid interface number: 69 but max is 0 [ 373.513990][ T5717] usb 6-1: config 0 has no interface number 0 [ 373.514048][ T5717] usb 6-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 373.514074][ T5717] usb 6-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 373.525343][ T5717] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.525368][ T5717] usb 6-1: Product: syz [ 373.525394][ T5717] usb 6-1: Manufacturer: syz [ 373.525415][ T5717] usb 6-1: SerialNumber: syz [ 373.538150][ T5717] usb 6-1: config 0 descriptor?? [ 373.539415][T10703] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 373.548627][ T5717] cyberjack 6-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 373.594819][ T5717] usb 6-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 373.615427][ T985] usb 2-1: device descriptor read/64, error -71 [ 373.783532][ C1] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22 [ 373.789820][T10688] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 373.857128][ T985] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 373.949799][ T31] audit: type=1400 audit(1788458252.505:937): avc: denied { write } for pid=10705 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 373.985825][ T985] usb 2-1: device descriptor read/64, error -71 [ 373.989005][T10703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 373.989431][T10703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 373.991274][T10703] netlink: 'syz.5.660': attribute type 2 has an invalid length. [ 373.991292][T10703] netlink: 'syz.5.660': attribute type 2 has an invalid length. [ 374.006195][T10703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.008456][T10703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.092518][ T985] usb usb2-port1: attempt power cycle [ 374.111609][T10723] wlan0 speed is unknown, defaulting to 1000 [ 374.233115][ T31] audit: type=1400 audit(1788458252.795:938): avc: denied { write } for pid=10724 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 374.271998][ T5784] sierra_net 4-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.3-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:07 [ 374.394878][ T5270] 8021q: adding VLAN 0 to HW filter on device eth12 [ 374.432672][ T985] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 374.476511][ T985] usb 2-1: device descriptor read/8, error -71 [ 374.634244][ T7317] usb 6-1: USB disconnect, device number 23 [ 374.639648][ T7317] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 374.644914][ T7317] cyberjack 6-1:0.69: device disconnected [ 374.712340][ T985] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 374.736436][ T985] usb 2-1: device descriptor read/8, error -71 [ 374.846064][ T985] usb usb2-port1: unable to enumerate USB device [ 375.079998][T10691] wlan0 speed is unknown, defaulting to 1000 [ 375.468523][ T5784] sierra_net 4-1:1.7 wwan0: Submit SYNC failed -71 [ 375.475714][ T5784] sierra_net 4-1:1.7 wwan0: Send SYNC failed, status -71 [ 375.491568][ T5784] sierra_net 4-1:1.7 wwan0: Submit SYNC failed -71 [ 375.491620][ T5784] sierra_net 4-1:1.7 wwan0: Send SYNC failed, status -71 [ 375.549529][ T5784] usb 4-1: USB disconnect, device number 19 [ 375.568038][ T5784] sierra_net 4-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.3-1, Sierra Wireless USB-to-WWAN Modem [ 376.022090][T10753] FAULT_INJECTION: forcing a failure. [ 376.022090][T10753] name failslab, interval 1, probability 0, space 0, times 0 [ 376.022170][T10753] CPU: 0 UID: 0 PID: 10753 Comm: syz.8.662 Tainted: G L syzkaller #0 PREEMPT(full) [ 376.022201][T10753] Tainted: [L]=SOFTLOCKUP [ 376.022210][T10753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 376.022223][T10753] Call Trace: [ 376.022231][T10753] [ 376.022240][T10753] dump_stack_lvl+0x100/0x190 [ 376.022273][T10753] should_fail_ex.cold+0x5/0xa [ 376.022303][T10753] should_failslab+0xc2/0x120 [ 376.022328][T10753] kmem_cache_alloc_noprof+0x92/0x6a0 [ 376.022350][T10753] ? do_getname+0x35/0x390 [ 376.022384][T10753] do_getname+0x35/0x390 [ 376.022414][T10753] do_sys_openat2+0xc7/0x1e0 [ 376.022440][T10753] ? __pfx_do_sys_openat2+0x10/0x10 [ 376.022476][T10753] __x64_sys_openat+0x12d/0x210 [ 376.022503][T10753] ? __pfx___x64_sys_openat+0x10/0x10 [ 376.022531][T10753] ? trace_irq_enable.constprop.0+0x2f/0x160 [ 376.022565][T10753] do_syscall_64+0x123/0x790 [ 376.022592][T10753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.022613][T10753] RIP: 0033:0x7f5b0155e98e [ 376.022630][T10753] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 376.022649][T10753] RSP: 002b:00007f5b0238cec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 376.022669][T10753] RAX: ffffffffffffffda RBX: 00007f5b0238d6c0 RCX: 00007f5b0155e98e [ 376.022682][T10753] RDX: 0000000000000002 RSI: 00007f5b0238cf90 RDI: ffffffffffffff9c [ 376.022695][T10753] RBP: 00007f5b01635024 R08: 0000000000000000 R09: 0000000000000000 [ 376.022707][T10753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 376.022719][T10753] R13: 00007f5b018263f8 R14: 00007f5b01826360 R15: 00007ffc703ea858 [ 376.022748][T10753] [ 376.356068][ T5784] sierra_net 4-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 376.420660][ T31] audit: type=1400 audit(1788458254.975:939): avc: denied { write } for pid=10731 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 376.536561][ T31] audit: type=1400 audit(1788458255.085:940): avc: denied { write } for pid=10755 comm="syz.1.667" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 376.575193][ T31] audit: type=1400 audit(1788458255.135:941): avc: denied { write } for pid=10755 comm="syz.1.667" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 377.193822][ T30] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 377.375209][ T30] usb 7-1: Using ep0 maxpacket: 8 [ 377.403882][ T30] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 377.442954][ T30] usb 7-1: config index 0 descriptor too short (expected 74, got 45) [ 377.443138][ T30] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 377.443217][ T30] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 377.443269][ T30] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 377.443302][ T30] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 377.443333][ T30] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 377.443441][ T30] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 378.156905][ T30] usb 7-1: GET_CAPABILITIES returned 0 [ 378.156968][ T30] usbtmc 7-1:16.0: can't read capabilities [ 378.558197][ T5956] block nbd0: Possible stuck request ffff888027867000: control (read@0,1024B). Runtime 240 seconds [ 378.560658][ T5956] block nbd0: Possible stuck request ffff8880278671c0: control (read@1024,3072B). Runtime 240 seconds [ 379.210355][T10770] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 379.228670][T10770] rtrs_client L2095: : Failed to resolve address, err: -ENODEV [ 379.228752][T10770] rtrs_client L2636: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 379.230173][ T31] audit: type=1400 audit(1788458257.785:942): avc: denied { write } for pid=10764 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 379.549737][ T5270] 8021q: adding VLAN 0 to HW filter on device eth21 [ 379.610039][T10760] netlink: 12 bytes leftover after parsing attributes in process `syz.6.666'. [ 379.746835][T10788] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 379.775069][T10788] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 379.842136][ T7317] usb 7-1: USB disconnect, device number 18 [ 379.922090][ T5724] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 380.072007][ T5724] usb 2-1: Using ep0 maxpacket: 32 [ 380.072762][ T5724] usb 2-1: New USB device found, idVendor=1199, idProduct=0224, bcdDevice=bc.e6 [ 380.073639][ T5724] usb 2-1: config 183 has an invalid interface number: 124 but max is 0 [ 380.073662][ T5724] usb 2-1: config 183 has no interface number 0 [ 380.073696][ T5724] usb 2-1: config 183 interface 124 altsetting 5 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 380.073722][ T5724] usb 2-1: config 183 interface 124 altsetting 5 endpoint 0x9 has invalid maxpacket 1023, setting to 64 [ 380.073748][ T5724] usb 2-1: config 183 interface 124 altsetting 5 endpoint 0x1 has an invalid bInterval 92, changing to 7 [ 380.073772][ T5724] usb 2-1: config 183 interface 124 altsetting 5 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 380.073796][ T5724] usb 2-1: config 183 interface 124 altsetting 5 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 380.073820][ T5724] usb 2-1: config 183 interface 124 altsetting 5 endpoint 0xE has invalid wMaxPacketSize 0 [ 380.073840][ T5724] usb 2-1: config 183 interface 124 has no altsetting 0 [ 380.075585][ T5724] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.075607][ T5724] usb 2-1: Product: syz [ 380.075623][ T5724] usb 2-1: Manufacturer: syz [ 380.075637][ T5724] usb 2-1: SerialNumber: syz [ 380.086066][T10796] netlink: 'syz.5.676': attribute type 39 has an invalid length. [ 380.303141][ T5784] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 380.467801][ T5784] usb 9-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 380.468816][ T5784] usb 9-1: config 0 has an invalid interface number: 69 but max is 0 [ 380.468858][ T5784] usb 9-1: config 0 has no interface number 0 [ 380.468893][ T5784] usb 9-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 380.468916][ T5784] usb 9-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 380.471243][ T5784] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.471265][ T5784] usb 9-1: Product: syz [ 380.471279][ T5784] usb 9-1: Manufacturer: syz [ 380.471300][ T5784] usb 9-1: SerialNumber: syz [ 380.478447][ T5784] usb 9-1: config 0 descriptor?? [ 380.479550][T10792] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 380.483242][ T5784] cyberjack 9-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 380.877915][ T5784] usb 9-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 380.891294][T10350] Bluetooth: Short BCSP packet [ 380.913281][ T1163] IPVS: starting estimator thread 0... [ 380.952624][ C0] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22 [ 380.953887][ T8795] Bluetooth: Error in BCSP hdr checksum [ 381.005187][T10804] IPVS: using max 66 ests per chain, 158400 per kthread [ 381.035428][ T31] audit: type=1400 audit(1788458259.595:943): avc: denied { write } for pid=10789 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 381.153941][T10792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 381.154398][T10792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.157502][T10792] netlink: 'syz.8.675': attribute type 2 has an invalid length. [ 381.157520][T10792] netlink: 'syz.8.675': attribute type 2 has an invalid length. [ 381.166088][T10792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 381.166538][T10792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.288811][T10810] wlan0 speed is unknown, defaulting to 1000 [ 381.523868][ T1568] usb 9-1: USB disconnect, device number 29 [ 381.528722][ T1568] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 381.529357][ T1568] cyberjack 9-1:0.69: device disconnected [ 381.648875][ T5784] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 381.701765][ T31] audit: type=1400 audit(1788458260.255:944): avc: denied { write } for pid=10809 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 381.792985][ T5784] usb 6-1: Using ep0 maxpacket: 8 [ 381.793794][ T5784] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 381.794721][ T5784] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 381.794751][ T5784] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 381.794788][ T5784] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 381.794815][ T5784] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 381.794857][ T5784] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 381.794882][ T5784] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 381.794906][ T5784] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 381.794931][ T5784] usb 6-1: config 168 interface 0 has no altsetting 0 [ 381.795914][ T5784] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 381.795943][ T5784] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 381.795974][ T5784] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 381.796000][ T5784] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 381.796043][ T5784] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 381.796068][ T5784] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 381.796092][ T5784] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 381.796116][ T5784] usb 6-1: config 168 interface 0 has no altsetting 0 [ 381.797035][ T5784] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 381.797065][ T5784] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 381.797117][ T5784] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 381.797142][ T5784] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 381.797166][ T5784] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 381.797190][ T5784] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 381.797214][ T5784] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 381.797257][ T5784] usb 6-1: config 168 interface 0 has no altsetting 0 [ 381.800027][ T5784] usb 6-1: string descriptor 0 read error: -22 [ 381.800154][ T5784] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.826660][ T5784] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 381.945365][ T5270] 8021q: adding VLAN 0 to HW filter on device eth22 [ 382.442196][ T5611] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 382.892055][ T7317] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 382.963034][ T5724] sierra 2-1:183.124: Sierra USB modem converter detected [ 382.989738][ T5724] usb 2-1: Sierra USB modem converter now attached to ttyUSB0 [ 383.039830][ T5724] usb 2-1: Sierra USB modem converter now attached to ttyUSB1 [ 383.048189][ T7317] usb 9-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 383.053976][ T5724] usb 2-1: Sierra USB modem converter now attached to ttyUSB2 [ 383.066169][ T7317] usb 9-1: config 0 has an invalid interface number: 69 but max is 0 [ 383.074400][ T7317] usb 9-1: config 0 has no interface number 0 [ 383.074470][ T7317] usb 9-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 383.074499][ T7317] usb 9-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 383.113462][ T7317] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.116368][ T5724] usb 2-1: USB disconnect, device number 38 [ 383.121548][ T7317] usb 9-1: Product: syz [ 383.121567][ T7317] usb 9-1: Manufacturer: syz [ 383.121581][ T7317] usb 9-1: SerialNumber: syz [ 383.158772][ T7317] usb 9-1: config 0 descriptor?? [ 383.163931][ T30] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 383.164696][T10824] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 383.171550][T10841] FAULT_INJECTION: forcing a failure. [ 383.171550][T10841] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 383.171579][T10841] CPU: 0 UID: 0 PID: 10841 Comm: syz.1.681 Tainted: G L syzkaller #0 PREEMPT(full) [ 383.171605][T10841] Tainted: [L]=SOFTLOCKUP [ 383.171611][T10841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 383.171622][T10841] Call Trace: [ 383.171628][T10841] [ 383.171635][T10841] dump_stack_lvl+0x100/0x190 [ 383.171666][T10841] should_fail_ex.cold+0x5/0xa [ 383.171693][T10841] _copy_from_user+0x2e/0xd0 [ 383.171721][T10841] sk_setsockopt+0x110d/0x5d80 [ 383.171747][T10841] ? __pfx_sk_setsockopt+0x10/0x10 [ 383.171767][T10841] ? avc_has_perm+0x135/0x1e0 [ 383.171790][T10841] ? __pfx_avc_has_perm+0x10/0x10 [ 383.171813][T10841] ? get_pid_task+0x106/0x250 [ 383.171843][T10841] ? sock_has_perm+0x25a/0x2f0 [ 383.171867][T10841] ? __pfx_sock_has_perm+0x10/0x10 [ 383.171894][T10841] udp_lib_setsockopt+0x42b/0x890 [ 383.171916][T10841] ? __pfx_udp_push_pending_frames+0x10/0x10 [ 383.171946][T10841] ? __pfx_udp_lib_setsockopt+0x10/0x10 [ 383.171968][T10841] ? find_held_lock+0x2b/0x80 [ 383.171992][T10841] ? __fget_files+0x215/0x3d0 [ 383.172016][T10841] udp_setsockopt+0xa3/0xb0 [ 383.172034][T10841] ? __pfx_udp_push_pending_frames+0x10/0x10 [ 383.172062][T10841] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 383.172092][T10841] do_sock_setsockopt+0xf3/0x1d0 [ 383.172117][T10841] __sys_setsockopt+0x195/0x220 [ 383.172150][T10841] __x64_sys_setsockopt+0xbd/0x160 [ 383.172176][T10841] ? do_syscall_64+0xae/0x790 [ 383.172195][T10841] ? lockdep_hardirqs_on+0x7d/0x110 [ 383.172215][T10841] do_syscall_64+0x123/0x790 [ 383.172236][T10841] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 383.172255][T10841] RIP: 0033:0x7f4a19d9e159 [ 383.172270][T10841] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 383.172287][T10841] RSP: 002b:00007f4a1ad4e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 383.172305][T10841] RAX: ffffffffffffffda RBX: 00007f4a1a025fa0 RCX: 00007f4a19d9e159 [ 383.172317][T10841] RDX: 0000000000000019 RSI: 0000000000000001 RDI: 0000000000000003 [ 383.172328][T10841] RBP: 00007f4a1ad4e090 R08: 0000000000000000 R09: 0000000000000000 [ 383.172340][T10841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 383.172350][T10841] R13: 00007f4a1a026038 R14: 00007f4a1a025fa0 R15: 00007ffed3156318 [ 383.172376][T10841] [ 383.226059][ T7317] cyberjack 9-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 383.238089][ T5724] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 383.268559][ T5724] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 383.288005][ T5724] sierra ttyUSB2: Sierra USB modem converter now disconnected from ttyUSB2 [ 383.294389][ T5724] sierra 2-1:183.124: device disconnected [ 383.430476][ T31] audit: type=1400 audit(1788458261.985:945): avc: denied { write } for pid=10820 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 383.442771][ T30] usb 7-1: Using ep0 maxpacket: 32 [ 383.460666][ T30] usb 7-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 383.486748][ T30] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 383.488027][ C1] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22 [ 383.554931][ T7317] usb 9-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 383.564953][ T30] usb 7-1: New USB device strings: Mfr=46, Product=0, SerialNumber=0 [ 383.573444][ T30] usb 7-1: Manufacturer: syz [ 383.600486][T10824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 383.600868][T10824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 383.629374][ T30] usb 7-1: config 0 descriptor?? [ 383.629649][T10824] netlink: 'syz.8.680': attribute type 2 has an invalid length. [ 383.630170][T10824] netlink: 'syz.8.680': attribute type 2 has an invalid length. [ 383.640438][T10824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 383.656846][T10824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 383.742024][ T5724] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 383.892072][ T5724] usb 2-1: Using ep0 maxpacket: 32 [ 383.894672][ T5724] usb 2-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 383.898443][ T5724] usb 2-1: config 0 interface 0 altsetting 13 endpoint 0x81 has an invalid bInterval 171, changing to 11 [ 383.898473][ T5724] usb 2-1: config 0 interface 0 altsetting 13 endpoint 0x81 has invalid maxpacket 1321, setting to 1024 [ 383.898543][ T5724] usb 2-1: config 0 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 383.898569][ T5724] usb 2-1: config 0 interface 0 has no altsetting 0 [ 383.898599][ T5724] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.944899][ T5724] usb 2-1: config 0 descriptor?? [ 383.945745][T10844] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 383.989028][T10827] wlan0 speed is unknown, defaulting to 1000 [ 384.047780][ T31] audit: type=1400 audit(1788458262.605:946): avc: denied { write } for pid=10846 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 384.093086][ T30] usbhid 7-1:0.0: can't add hid device: -71 [ 384.093214][ T30] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 384.112252][ T30] usb 7-1: USB disconnect, device number 19 [ 384.189594][T10844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 384.190053][T10844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 384.227983][ T5724] usbhid 2-1:0.0: can't add hid device: -71 [ 384.228108][ T5724] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 384.247588][ T5724] usb 2-1: USB disconnect, device number 39 [ 384.360617][ T5270] 8021q: adding VLAN 0 to HW filter on device eth23 [ 384.393762][ T5784] usb 6-1: USB disconnect, device number 24 [ 384.497750][ T5724] usb 9-1: USB disconnect, device number 30 [ 384.974380][ T5724] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 384.975014][ T5724] cyberjack 9-1:0.69: device disconnected [ 385.035435][T10857] syz_tun: entered allmulticast mode [ 385.562139][ T5604] Bluetooth: hci4: command 0x0406 tx timeout [ 385.830848][T10871] sg_write: data in/out 221184/136 bytes for SCSI command 0x0-- guessing data in; [ 385.830848][T10871] program syz.8.687 not setting count and/or reply_len properly [ 386.066333][T10863] syz_tun: left allmulticast mode [ 388.012180][ T30] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 388.450586][ T31] audit: type=1400 audit(1788458267.005:947): avc: denied { write } for pid=10856 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 388.491984][ T30] usb 9-1: Using ep0 maxpacket: 8 [ 388.497747][ T30] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 388.510815][ T30] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 388.511166][ T30] usb 9-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 388.511229][ T30] usb 9-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 388.511260][ T30] usb 9-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 388.511285][ T30] usb 9-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 388.511313][ T30] usb 9-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 388.511339][ T30] usb 9-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 388.511365][ T30] usb 9-1: config 168 interface 0 has no altsetting 0 [ 388.555977][ T30] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 388.556015][ T30] usb 9-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 388.556055][ T30] usb 9-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 388.556082][ T30] usb 9-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 388.556105][ T30] usb 9-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 388.556128][ T30] usb 9-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 388.556150][ T30] usb 9-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 388.556174][ T30] usb 9-1: config 168 interface 0 has no altsetting 0 [ 388.719992][ T1151] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 388.731595][ T30] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 388.731653][ T30] usb 9-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 388.731703][ T30] usb 9-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 388.731734][ T30] usb 9-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 388.731762][ T30] usb 9-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 388.731791][ T30] usb 9-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 388.731819][ T30] usb 9-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 388.731847][ T30] usb 9-1: config 168 interface 0 has no altsetting 0 [ 388.833831][ T30] usb 9-1: string descriptor 0 read error: -22 [ 388.833962][ T30] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.858025][ T30] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 388.949870][ T31] audit: type=1400 audit(1788458267.505:948): avc: denied { mount } for pid=10908 comm="syz.5.696" name="/" dev="rpc_pipefs" ino=34915 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 388.978413][ T31] audit: type=1400 audit(1788458267.535:949): avc: denied { write } for pid=10914 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 389.094951][ T5270] 8021q: adding VLAN 0 to HW filter on device eth24 [ 389.275110][ T1568] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 389.399315][ T31] audit: type=1400 audit(1788458267.955:950): avc: denied { unmount } for pid=8843 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 389.430284][ T1568] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 389.439215][ T1568] usb 4-1: config 0 has an invalid interface number: 69 but max is 0 [ 389.439240][ T1568] usb 4-1: config 0 has no interface number 0 [ 389.439276][ T1568] usb 4-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 389.439301][ T1568] usb 4-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 389.457836][ T1568] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.457861][ T1568] usb 4-1: Product: syz [ 389.457877][ T1568] usb 4-1: Manufacturer: syz [ 389.457937][ T1568] usb 4-1: SerialNumber: syz [ 389.480619][ T1568] usb 4-1: config 0 descriptor?? [ 389.487289][T10916] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 389.502962][ T1568] cyberjack 4-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 389.559390][ T1568] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 389.952289][ C0] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22 [ 390.153496][T10916] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.162485][T10916] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.173136][T10916] netlink: 'syz.3.698': attribute type 2 has an invalid length. [ 390.182046][T10916] netlink: 'syz.3.698': attribute type 2 has an invalid length. [ 390.191070][T10916] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.200084][T10916] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.294188][ T5724] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 390.324416][ T31] audit: type=1400 audit(1788458268.885:951): avc: denied { write } for pid=10918 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 390.368391][T10916] wlan0 speed is unknown, defaulting to 1000 [ 390.393819][ T30] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 390.443261][ T5724] usb 6-1: Using ep0 maxpacket: 8 [ 390.444329][ T5724] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 390.448466][ T5724] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 390.448505][ T5724] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 390.448593][ T5724] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 390.448622][ T5724] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 390.448647][ T5724] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 390.448671][ T5724] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 390.448716][ T5724] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 390.448742][ T5724] usb 6-1: config 168 interface 0 has no altsetting 0 [ 390.451219][ T5724] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 390.451270][ T5724] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 390.451305][ T5724] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 390.451333][ T5724] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 390.451358][ T5724] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 390.451401][ T5724] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 390.451426][ T5724] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 390.451450][ T5724] usb 6-1: config 168 interface 0 has no altsetting 0 [ 390.456986][ T5724] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 390.457021][ T5724] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 390.457056][ T5724] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 390.457082][ T5724] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 390.457137][ T5724] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 390.457163][ T5724] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 390.457189][ T5724] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 390.457216][ T5724] usb 6-1: config 168 interface 0 has no altsetting 0 [ 390.478432][ T5724] usb 6-1: string descriptor 0 read error: -22 [ 390.478569][ T5724] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.702234][ T31] audit: type=1400 audit(1788458269.225:952): avc: denied { write } for pid=10939 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 390.704689][ T5724] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 390.727871][ T30] usb 2-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 391.153244][ T30] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 391.153299][ T30] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 391.176387][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 391.176428][ T30] usb 2-1: Product: syz [ 391.176458][ T30] usb 2-1: Manufacturer: syz [ 391.224933][ T30] mos7840 2-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 391.306239][ T5724] usb 9-1: USB disconnect, device number 31 [ 391.349538][ T1568] usb 6-1: USB disconnect, device number 25 [ 391.597637][ T5732] usb 4-1: USB disconnect, device number 20 [ 391.628964][ T5732] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 391.641475][ T5732] cyberjack 4-1:0.69: device disconnected [ 391.669488][T10956] fuse: Bad value for 'fd' [ 391.684579][T10951] FAULT_INJECTION: forcing a failure. [ 391.684579][T10951] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 391.684626][T10951] CPU: 0 UID: 0 PID: 10951 Comm: syz.8.702 Tainted: G L syzkaller #0 PREEMPT(full) [ 391.684654][T10951] Tainted: [L]=SOFTLOCKUP [ 391.684662][T10951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 391.684673][T10951] Call Trace: [ 391.684680][T10951] [ 391.684689][T10951] dump_stack_lvl+0x100/0x190 [ 391.684721][T10951] should_fail_ex.cold+0x5/0xa [ 391.684748][T10951] _copy_from_iter+0x1f4/0x1690 [ 391.684781][T10951] ? __pfx__copy_from_iter+0x10/0x10 [ 391.684808][T10951] ? _copy_from_iter+0x270/0x1690 [ 391.684849][T10951] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 391.684882][T10951] skb_copy_datagram_from_iter+0x11f/0x720 [ 391.684909][T10951] ? _kstrtoull+0x144/0x200 [ 391.684930][T10951] ? iov_iter_advance+0xac/0x6d0 [ 391.684955][T10951] ? __pfx__kstrtoull+0x10/0x10 [ 391.684979][T10951] tun_get_user+0x1866/0x3cc0 [ 391.685010][T10951] ? __lock_acquire+0x4c5/0x1ec0 [ 391.685031][T10951] ? __pfx_tun_get_user+0x10/0x10 [ 391.685053][T10951] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 391.685085][T10951] ? find_held_lock+0x2b/0x80 [ 391.685111][T10951] ? tun_get+0x191/0x370 [ 391.685136][T10951] ? tun_get+0x191/0x370 [ 391.685170][T10951] tun_chr_write_iter+0xdc/0x200 [ 391.685192][T10951] vfs_write+0x6af/0x1050 [ 391.685224][T10951] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 391.685246][T10951] ? __pfx_vfs_write+0x10/0x10 [ 391.685272][T10951] ? find_held_lock+0x2b/0x80 [ 391.685316][T10951] ksys_write+0x12a/0x250 [ 391.685334][T10951] ? __pfx_ksys_write+0x10/0x10 [ 391.685362][T10951] do_syscall_64+0x123/0x790 [ 391.685386][T10951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.685406][T10951] RIP: 0033:0x7f5b0159e159 [ 391.685422][T10951] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 391.685440][T10951] RSP: 002b:00007f5b02411028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 391.685460][T10951] RAX: ffffffffffffffda RBX: 00007f5b01825fa0 RCX: 00007f5b0159e159 [ 391.685474][T10951] RDX: 000000000000340a RSI: 0000200000000100 RDI: 0000000000000004 [ 391.685486][T10951] RBP: 00007f5b02411090 R08: 0000000000000000 R09: 0000000000000000 [ 391.685499][T10951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 391.685511][T10951] R13: 00007f5b01826038 R14: 00007f5b01825fa0 R15: 00007ffc703ea858 [ 391.685539][T10951] [ 391.758132][T10958] netlink: 8 bytes leftover after parsing attributes in process `syz.6.703'. [ 391.758151][T10958] netlink: 8 bytes leftover after parsing attributes in process `syz.6.703'. [ 391.758163][T10958] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Add Mapping response ret = -22) [ 392.245244][ T31] audit: type=1400 audit(1788458270.805:953): avc: denied { write } for pid=10946 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 392.282886][ T30] mos7840 ttyUSB1: probe with driver mos7840 failed with error -71 [ 392.300380][ T30] usb 2-1: USB disconnect, device number 40 [ 392.343807][ T30] mos7840 2-1:1.0: device disconnected [ 393.631218][ T31] audit: type=1400 audit(1788458272.185:954): avc: denied { write } for pid=10984 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 393.845004][ T31] audit: type=1400 audit(1788458272.405:955): avc: denied { write } for pid=10986 comm="syz.5.708" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 393.939781][ T31] audit: type=1400 audit(1788458272.475:956): avc: denied { write } for pid=10986 comm="syz.5.708" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 395.098810][T10994] netlink: 'syz.6.709': attribute type 1 has an invalid length. [ 395.124538][T10993] netlink: 20 bytes leftover after parsing attributes in process `syz.1.710'. [ 395.124591][T10993] netlink: 20 bytes leftover after parsing attributes in process `syz.1.710'. [ 395.200299][T10993] geneve3: entered promiscuous mode [ 395.412032][ T5784] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 395.502486][ T5709] usb 6-1: new full-speed USB device number 26 using dummy_hcd [ 395.583936][ T5784] usb 2-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 395.584855][ T5784] usb 2-1: config 1 has an invalid interface number: 7 but max is 0 [ 395.584879][ T5784] usb 2-1: config 1 has no interface number 0 [ 395.584913][ T5784] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 395.584939][ T5784] usb 2-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 395.586750][ T5784] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.586774][ T5784] usb 2-1: Product: syz [ 395.586789][ T5784] usb 2-1: Manufacturer: syz [ 395.586804][ T5784] usb 2-1: SerialNumber: syz [ 395.590182][T11001] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 395.604949][ T5784] usb 2-1: Error in usbnet_get_endpoints (-22) [ 395.672908][ T5709] usb 6-1: not running at top speed; connect to a high speed hub [ 395.672953][ T5709] usb 6-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 395.691332][ T5709] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 395.691370][ T5709] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 395.691406][ T5709] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 395.691456][ T5709] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 395.729836][T11022] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 395.729836][T11022] [ 395.730159][T11022] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 395.730222][T11022] CIFS: Attempting to mount //127.0.0.1/share [ 395.731028][T11022] CIFS: VFS: Error connecting to socket. Aborting operation. [ 395.731060][T11022] CIFS: VFS: cifs_mount failed w/return code = -101 [ 395.782277][ T5709] uvcvideo 6-1:1.0: Found UVC 1.00 device (046d:0825) [ 395.852194][T11026] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 395.852194][T11026] [ 395.852250][T11026] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 395.852310][T11026] CIFS: Attempting to mount //127.0.0.1/share [ 395.853069][T11026] CIFS: VFS: Error connecting to socket. Aborting operation. [ 395.853100][T11026] CIFS: VFS: cifs_mount failed w/return code = -101 [ 396.663646][ T5709] uvcvideo 6-1:1.0: Failed to query (GET_INFO) UVC control 2 on unit 1: 0 (exp. 1). [ 396.874773][ T5709] uvcvideo 6-1:1.0: No streaming interface found for terminal 32770. [ 396.907269][ T31] audit: type=1400 audit(1788458275.465:957): avc: denied { write } for pid=11014 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 397.059897][ T31] audit: type=1400 audit(1788458275.615:958): avc: denied { write } for pid=11044 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 397.326355][ T5732] usb 6-1: USB disconnect, device number 26 [ 397.512004][ T5709] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 397.624193][ T31] audit: type=1400 audit(1788458276.185:959): avc: denied { write } for pid=11051 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 397.664428][ T5709] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 397.674887][ T5709] usb 4-1: config 0 has an invalid interface number: 69 but max is 0 [ 397.674927][ T5709] usb 4-1: config 0 has no interface number 0 [ 397.674968][ T5709] usb 4-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 397.674997][ T5709] usb 4-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 397.713312][ T5709] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.721670][ T5709] usb 4-1: Product: syz [ 397.726191][ T5709] usb 4-1: Manufacturer: syz [ 397.730964][ T5709] usb 4-1: SerialNumber: syz [ 397.741423][ T5709] usb 4-1: config 0 descriptor?? [ 397.770739][T11050] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 397.779493][ T5709] cyberjack 4-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 397.804303][ T5709] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 397.917546][ T31] audit: type=1400 audit(1788458276.475:960): avc: denied { write } for pid=11064 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 398.001328][ C1] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22 [ 398.219614][T11050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.220019][T11050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 398.243730][T11050] netlink: 'syz.3.717': attribute type 2 has an invalid length. [ 398.243778][T11050] netlink: 'syz.3.717': attribute type 2 has an invalid length. [ 398.270719][T11050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.271149][T11050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 398.301666][ T1568] usb 2-1: USB disconnect, device number 41 [ 398.491484][T11077] wlan0 speed is unknown, defaulting to 1000 [ 398.693870][T11082] netlink: 4 bytes leftover after parsing attributes in process `syz.1.721'. [ 398.795847][ T5709] usb 4-1: USB disconnect, device number 21 [ 398.828662][ T5709] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 398.848437][ T5709] cyberjack 4-1:0.69: device disconnected [ 399.058203][T11090] netlink: 'syz.5.722': attribute type 1 has an invalid length. [ 399.143933][ T31] audit: type=1400 audit(1788458277.705:961): avc: denied { write } for pid=11074 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 399.357498][T11090] bond1: (slave bridge1): making interface the new active one [ 399.367518][T11090] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 402.279252][ T31] audit: type=1400 audit(1788458280.825:962): avc: denied { write } for pid=11109 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 402.538533][ T5270] 8021q: adding VLAN 0 to HW filter on device eth9 [ 402.655653][T11075] syz.6.720 (11075): drop_caches: 2 [ 402.881191][T11124] ve: renamed from veth0_vlan [ 403.195986][T11135] netlink: 12 bytes leftover after parsing attributes in process `syz.6.731'. [ 403.329034][T11143] bridge1: port 1(dummy0) entered blocking state [ 403.351196][T11135] netlink: 'syz.6.731': attribute type 10 has an invalid length. [ 403.351246][T11135] netlink: 40 bytes leftover after parsing attributes in process `syz.6.731'. [ 403.522079][T11143] bridge1: port 1(dummy0) entered disabled state [ 403.562139][T11143] dummy0: entered allmulticast mode [ 403.573156][T11143] dummy0: entered promiscuous mode [ 403.677454][T11135] bridge1: port 1(dummy0) entered blocking state [ 403.677657][T11135] bridge1: port 1(dummy0) entered forwarding state [ 403.686270][ T31] audit: type=1400 audit(1788458282.245:963): avc: denied { write } for pid=11127 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 403.701712][T11135] dummy0: left allmulticast mode [ 403.702474][T11135] bridge1: port 1(dummy0) entered disabled state [ 404.009311][ T31] audit: type=1400 audit(1788458282.565:964): avc: denied { write } for pid=11158 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 404.303911][ T5270] 8021q: adding VLAN 0 to HW filter on device eth10 [ 404.387807][ T5611] Bluetooth: hci2: unexpected event for opcode 0x2029 [ 404.406546][T11176] xt_socket: unknown flags 0xc [ 405.013909][T11186] netlink: 12 bytes leftover after parsing attributes in process `syz.8.742'. [ 405.017960][T11186] netlink: 60 bytes leftover after parsing attributes in process `syz.8.742'. [ 405.030422][T11186] xt_nfacct: accounting object `syz0' does not exist [ 405.856706][ T31] audit: type=1400 audit(1788458284.415:965): avc: denied { write } for pid=11178 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 405.880166][ T5709] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 405.883848][ T50] rpcbind: server 127.0.0.1 not responding, timed out [ 406.007733][ T31] audit: type=1400 audit(1788458284.565:966): avc: denied { write } for pid=11202 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 406.046811][ T31] audit: type=1400 audit(1788458284.605:967): avc: denied { append } for pid=11198 comm="syz.3.746" name="usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 406.071819][ T5709] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 406.087305][ T5709] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.087345][ T5709] usb 6-1: Product: syz [ 406.087379][ T5709] usb 6-1: Manufacturer: syz [ 406.087397][ T5709] usb 6-1: SerialNumber: syz [ 406.114552][ T5709] usb 6-1: config 0 descriptor?? [ 406.144891][ T5732] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 406.272384][ T5270] 8021q: adding VLAN 0 to HW filter on device eth11 [ 406.580554][T11190] xt_hashlimit: size too large, truncated to 1048576 [ 406.670101][T11215] netlink: 'syz.5.745': attribute type 11 has an invalid length. [ 407.126166][T11217] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 407.172462][ T5710] usb 4-1: new low-speed USB device number 22 using dummy_hcd [ 407.381579][ T5710] usb 4-1: New USB device found, idVendor=1223, idProduct=3f07, bcdDevice= 0.00 [ 407.418948][ T5710] usb 4-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 407.430306][ T5710] usb 4-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 407.430368][ T5710] usb 4-1: config 0 interface 0 has no altsetting 0 [ 407.430544][ T5710] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.749498][ T5710] usb 4-1: config 0 descriptor?? [ 407.852136][T11226] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 408.089246][ T5709] usb 6-1: Firmware version (0.0) predates our first public release. [ 408.089301][ T5709] usb 6-1: Please update to version 0.2 or newer [ 409.330697][ T5956] block nbd0: Possible stuck request ffff888027867000: control (read@0,1024B). Runtime 270 seconds [ 409.343307][ T5956] block nbd0: Possible stuck request ffff8880278671c0: control (read@1024,3072B). Runtime 270 seconds [ 409.418329][ T31] audit: type=1400 audit(1788458287.975:968): avc: denied { write } for pid=11212 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 409.496319][T11224] ¾x9’tend#: renamed from bridge_slave_0 (while UP) [ 409.610714][ T5710] usbhid 4-1:0.0: can't add hid device: -71 [ 409.617156][ T5710] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 409.650309][ T5710] usb 4-1: USB disconnect, device number 22 [ 409.689378][ T31] audit: type=1400 audit(1788458288.245:969): avc: denied { write } for pid=11240 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 409.919881][ T5784] usb 6-1: USB disconnect, device number 27 [ 410.187515][ T31] audit: type=1400 audit(1788458288.745:970): avc: denied { write } for pid=11246 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 410.315447][ T31] audit: type=1400 audit(1788458288.875:971): avc: denied { write } for pid=11266 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 410.317850][T11249] team0 (unregistering): Port device team_slave_0 removed [ 410.354555][T11249] team0 (unregistering): Port device team_slave_1 removed [ 410.392007][ T5710] usb 7-1: new full-speed USB device number 20 using dummy_hcd [ 410.402000][ T25] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 410.509967][ T31] audit: type=1400 audit(1788458289.065:972): avc: denied { listen } for pid=11267 comm="syz.3.754" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 410.552279][ T25] usb 9-1: Using ep0 maxpacket: 32 [ 410.558914][ T5710] usb 7-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 410.571647][ T5710] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 410.571718][ T5710] usb 7-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 410.571776][ T5710] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.607878][ T25] usb 9-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 410.620229][ T25] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 410.645949][ T25] usb 9-1: New USB device strings: Mfr=46, Product=0, SerialNumber=0 [ 410.645988][ T25] usb 9-1: Manufacturer: syz [ 410.672231][ T25] usb 9-1: config 0 descriptor?? [ 410.962384][ T5041] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 411.102455][ T5724] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 411.117046][ T31] audit: type=1400 audit(1788458289.675:973): avc: denied { cmd } for pid=11262 comm="syz.6.753" path="socket:[35912]" dev="sockfs" ino=35912 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 411.143082][ T5041] usb 4-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 411.158506][ T5710] dvb_ttusb_budget: ttusb_init_controller: error [ 411.174597][ T5041] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.174636][ T5041] usb 4-1: Product: syz [ 411.174685][ T5041] usb 4-1: Manufacturer: syz [ 411.174704][ T5041] usb 4-1: SerialNumber: syz [ 411.203278][ T5710] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 411.238454][ T5041] usb 4-1: config 0 descriptor?? [ 411.247083][ T5041] hub 4-1:0.0: bad descriptor, ignoring hub [ 411.247135][ T5041] hub 4-1:0.0: probe with driver hub failed with error -5 [ 411.252302][ T5724] usb 2-1: Using ep0 maxpacket: 32 [ 411.253683][ T5724] usb 2-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 411.254481][ T5724] usb 2-1: config 0 has no interfaces? [ 411.254513][ T5724] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.282814][ T5724] usb 2-1: config 0 descriptor?? [ 411.354919][ T5710] DVB: Unable to find symbol stv0299_attach() [ 411.449514][ T5710] DVB: Unable to find symbol tda8083_attach() [ 411.456433][ T5710] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 411.478431][ T5041] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 411.506022][ T5041] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 411.517237][ T5041] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 411.527811][ T5041] usb 4-1: media controller created [ 411.558067][ T5041] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 411.632472][ T5041] DVB: Unable to find symbol dib7000p_attach() [ 411.632501][ T5041] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 411.667404][ T31] audit: type=1400 audit(1788458290.225:974): avc: denied { write } for pid=11277 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 411.679192][T11285] FAULT_INJECTION: forcing a failure. [ 411.679192][T11285] name fail_futex, interval 1, probability 0, space 0, times 1 [ 411.679229][T11285] CPU: 0 UID: 0 PID: 11285 Comm: syz.1.759 Tainted: G L syzkaller #0 PREEMPT(full) [ 411.679259][T11285] Tainted: [L]=SOFTLOCKUP [ 411.679268][T11285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 411.679281][T11285] Call Trace: [ 411.679289][T11285] [ 411.679297][T11285] dump_stack_lvl+0x100/0x190 [ 411.679333][T11285] should_fail_ex.cold+0x5/0xa [ 411.679363][T11285] get_futex_key+0x1d0/0x14f0 [ 411.679391][T11285] ? __pfx_get_futex_key+0x10/0x10 [ 411.679417][T11285] ? putname+0xb1/0x110 [ 411.679441][T11285] ? kasan_save_stack+0x3f/0x50 [ 411.679461][T11285] ? kasan_save_stack+0x30/0x50 [ 411.679481][T11285] ? kasan_save_track+0x14/0x30 [ 411.679505][T11285] futex_wake+0xf4/0x5e0 [ 411.679537][T11285] ? __pfx_futex_wake+0x10/0x10 [ 411.679578][T11285] do_futex+0x2b2/0x440 [ 411.679610][T11285] ? __pfx_do_futex+0x10/0x10 [ 411.679638][T11285] ? __seccomp_filter+0x896/0x1130 [ 411.679677][T11285] __x64_sys_futex+0x34f/0x4d0 [ 411.679709][T11285] ? __pfx___x64_sys_futex+0x10/0x10 [ 411.679734][T11285] ? kmem_cache_free+0x127/0x6c0 [ 411.679772][T11285] do_syscall_64+0x123/0x790 [ 411.679798][T11285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.679819][T11285] RIP: 0033:0x7f4a19d9e159 [ 411.679836][T11285] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 411.679857][T11285] RSP: 002b:00007f4a1ad4e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 411.679877][T11285] RAX: ffffffffffffffda RBX: 00007f4a1a025fa8 RCX: 00007f4a19d9e159 [ 411.679891][T11285] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f4a1a025fac [ 411.679906][T11285] RBP: 00007f4a1a025fa0 R08: 0000000000000001 R09: 0000000000000000 [ 411.679918][T11285] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 411.679931][T11285] R13: 00007f4a1a026038 R14: 00007ffed3156230 R15: 00007ffed3156318 [ 411.679959][T11285] [ 411.984773][ T31] audit: type=1400 audit(1788458290.515:975): avc: denied { write } for pid=11296 comm="syz.5.760" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 411.986933][ T31] audit: type=1400 audit(1788458290.545:976): avc: denied { write } for pid=11296 comm="syz.5.760" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 412.223012][T11285] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.234965][T11285] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.393077][ T1151] bond0: (slave bond_slave_0): interface is now down [ 412.393222][ T1151] bond0: (slave bond_slave_1): interface is now down [ 412.508714][ T8793] bond0: (slave bond_slave_0): interface is now down [ 412.508785][ T8793] bond0: (slave bond_slave_1): interface is now down [ 412.640279][ T8793] bond0: (slave bond_slave_0): interface is now down [ 412.647823][ T8793] bond0: (slave bond_slave_1): interface is now down [ 412.684748][ T50] bond0: (slave bond_slave_0): interface is now down [ 412.693609][ T50] bond0: (slave bond_slave_1): interface is now down [ 412.736186][ T8792] bond0: (slave bond_slave_0): interface is now down [ 412.743672][ T8792] bond0: (slave bond_slave_1): interface is now down [ 412.782726][ T8792] bond0: (slave bond_slave_0): interface is now down [ 412.782843][ T8792] bond0: (slave bond_slave_1): interface is now down [ 412.823552][ T50] bond0: (slave bond_slave_0): interface is now down [ 412.823626][ T50] bond0: (slave bond_slave_1): interface is now down [ 412.853332][ T3350] bond0: (slave bond_slave_0): interface is now down [ 412.853373][ T3350] bond0: (slave bond_slave_1): interface is now down [ 412.896261][ T1151] bond0: (slave bond_slave_0): interface is now down [ 412.896379][ T1151] bond0: (slave bond_slave_1): interface is now down [ 412.947480][ T8800] bond0: (slave bond_slave_0): interface is now down [ 412.958505][ T8800] bond0: (slave bond_slave_1): interface is now down [ 413.035135][ T5710] usb 2-1: USB disconnect, device number 43 [ 413.705841][ T8800] bond0: now running without any active interface! [ 413.735653][ T5041] rc_core: IR keymap rc-dib0700-rc5 not found [ 413.743104][ T5041] Registered IR keymap rc-empty [ 413.743448][ T5041] dvb-usb: could not initialize remote control. [ 413.743464][ T5041] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 413.819336][ T5724] usb 7-1: USB disconnect, device number 20 [ 413.915025][ T31] audit: type=1400 audit(1788458292.475:977): avc: denied { write } for pid=11305 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 413.963857][ T5041] usb 4-1: USB disconnect, device number 23 [ 414.097140][ T5041] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 414.295314][T11312] netlink: 12 bytes leftover after parsing attributes in process `syz.1.762'. [ 414.305316][T11318] trusted_key: encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false [ 414.514333][ T25] usbhid 9-1:0.0: can't add hid device: -71 [ 414.521788][ T25] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 414.539580][ T25] usb 9-1: USB disconnect, device number 32 [ 414.542178][ T5724] usb 7-1: new full-speed USB device number 21 using dummy_hcd [ 414.648453][T11324] netlink: 24 bytes leftover after parsing attributes in process `syz.3.765'. [ 414.694623][ T5724] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 414.697421][ T5724] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 414.697464][ T5724] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 414.697488][ T5724] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 414.697525][ T5724] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.774932][T11332] netlink: 'syz.3.765': attribute type 1 has an invalid length. [ 414.774977][T11332] netlink: 4 bytes leftover after parsing attributes in process `syz.3.765'. [ 414.916814][ T5724] usb 7-1: usb_control_msg returned -32 [ 414.916874][ T5724] usbtmc 7-1:16.0: can't read capabilities [ 415.394201][ T5724] usb 7-1: USB disconnect, device number 21 [ 415.452064][ T31] audit: type=1400 audit(1788458294.005:978): avc: denied { mount } for pid=11323 comm="syz.3.765" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 415.748174][ T31] audit: type=1400 audit(1788458294.305:979): avc: denied { write } for pid=11313 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 416.135235][T11351] FAULT_INJECTION: forcing a failure. [ 416.135235][T11351] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 416.151177][T11351] CPU: 0 UID: 0 PID: 11351 Comm: syz.3.769 Tainted: G L syzkaller #0 PREEMPT(full) [ 416.151213][T11351] Tainted: [L]=SOFTLOCKUP [ 416.151221][T11351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 416.151234][T11351] Call Trace: [ 416.151242][T11351] [ 416.151250][T11351] dump_stack_lvl+0x100/0x190 [ 416.151284][T11351] should_fail_ex.cold+0x5/0xa [ 416.151311][T11351] copy_fpstate_to_sigframe+0x82d/0xae0 [ 416.151341][T11351] ? do_raw_spin_lock+0x128/0x260 [ 416.151369][T11351] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 416.151403][T11351] ? posixtimer_deliver_signal+0x1a0/0x6e0 [ 416.151438][T11351] ? x86_task_fpu+0x5f/0x90 [ 416.151466][T11351] get_sigframe+0x3fb/0x940 [ 416.151499][T11351] ? __pfx_get_sigframe+0x10/0x10 [ 416.151522][T11351] ? rcu_is_watching+0x13/0xc0 [ 416.151547][T11351] ? siginfo_layout+0x156/0x290 [ 416.151572][T11351] x64_setup_rt_frame+0x12f/0xce0 [ 416.151606][T11351] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 416.151641][T11351] arch_do_signal_or_restart+0x5ee/0x7e0 [ 416.151670][T11351] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 416.151703][T11351] ? __pfx___x64_sys_timer_create+0x10/0x10 [ 416.151729][T11351] ? fput+0x7c/0x100 [ 416.151759][T11351] exit_to_user_mode_loop+0x139/0x700 [ 416.151782][T11351] ? rcu_is_watching+0x13/0xc0 [ 416.151809][T11351] do_syscall_64+0x661/0x790 [ 416.151834][T11351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.151855][T11351] RIP: 0033:0x7f0a9d59e159 [ 416.151872][T11351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 416.151890][T11351] RSP: 002b:00007f0a9e44f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000de [ 416.151909][T11351] RAX: 0000000000000000 RBX: 00007f0a9d826090 RCX: 00007f0a9d59e159 [ 416.151921][T11351] RDX: 0000200000000180 RSI: 0000000000000000 RDI: 0000000000000002 [ 416.151932][T11351] RBP: 00007f0a9e44f090 R08: 0000000000000000 R09: 0000000000000000 [ 416.151942][T11351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 416.151953][T11351] R13: 00007f0a9d826128 R14: 00007f0a9d826090 R15: 00007ffc840a7488 [ 416.151977][T11351] [ 416.505353][ T31] audit: type=1400 audit(1788458295.065:980): avc: denied { write } for pid=11350 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 417.049898][ T31] audit: type=1400 audit(1788458295.595:981): avc: denied { write } for pid=11362 comm="syz.8.775" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 417.096702][ T31] audit: type=1400 audit(1788458295.645:982): avc: denied { write } for pid=11362 comm="syz.8.775" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 418.279552][T11370] 0x00000000000a-0x000000000309 : "" [ 418.388850][T11370] ftl_cs: FTL header corrupt! [ 419.125434][ T31] audit: type=1400 audit(1788458297.685:983): avc: denied { getopt } for pid=11384 comm="syz.8.779" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 419.139393][ T31] audit: type=1400 audit(1788458297.695:984): avc: denied { write } for pid=11372 comm="syz.6.778" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 419.358986][ T8800] rpcbind: server 127.0.0.1 not responding, timed out [ 419.408345][T11386] binder: 11384:11386 ioctl c0306201 0 returned -14 [ 419.484409][T11390] binder: 11384:11390 ioctl c0306201 0 returned -14 [ 419.782755][T11401] 9p: Bad value for 'wfdno' [ 420.224309][ T31] audit: type=1400 audit(1788458298.785:985): avc: denied { read } for pid=11394 comm="syz.5.781" dev="nsfs" ino=4026532947 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 420.263531][ T31] audit: type=1400 audit(1788458298.815:986): avc: denied { open } for pid=11394 comm="syz.5.781" path="net:[4026532947]" dev="nsfs" ino=4026532947 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 420.400419][ T31] audit: type=1400 audit(1788458298.955:987): avc: denied { write } for pid=11369 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 420.593857][ T31] audit: type=1400 audit(1788458299.155:988): avc: denied { write } for pid=11409 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 420.780191][T11412] input: syz0 as /devices/virtual/input/input15 [ 421.402261][ T5604] Bluetooth: hci0: command 0x0406 tx timeout [ 422.625965][ T5784] kernel write not supported for file /input/mice (pid: 5784 comm: kworker/0:7) [ 422.633766][ T31] audit: type=1400 audit(1788458301.195:989): avc: denied { ioctl } for pid=11435 comm="syz.3.791" path="/dev/input/mice" dev="devtmpfs" ino=915 ioctlcmd=0x4b63 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 422.733461][ T5724] usb 9-1: new high-speed USB device number 33 using dummy_hcd [ 422.892107][ T5724] usb 9-1: Using ep0 maxpacket: 32 [ 423.180181][ T5724] usb 9-1: New USB device found, idVendor=0766, idProduct=0204, bcdDevice= 0.00 [ 423.203213][ T5724] usb 9-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 423.214872][ T5724] usb 9-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 423.214951][ T5724] usb 9-1: config 0 interface 0 has no altsetting 0 [ 423.229347][ T5724] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.293974][ T5724] usb 9-1: config 0 descriptor?? [ 423.348048][ T31] audit: type=1400 audit(1788458301.885:990): avc: denied { write } for pid=11448 comm="syz.6.795" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 423.355033][ T31] audit: type=1400 audit(1788458301.905:991): avc: denied { write } for pid=11448 comm="syz.6.795" name="ports" dev="configfs" ino=3470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 424.118107][T11434] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 424.152960][T11434] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 424.222946][ T5724] usbhid 9-1:0.0: can't add hid device: -71 [ 424.229647][ T5724] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 424.437672][ T5724] usb 9-1: USB disconnect, device number 33 [ 424.470479][T11455] batadv1: entered promiscuous mode [ 424.580796][ T31] audit: type=1400 audit(1788458303.135:992): avc: denied { read write } for pid=11452 comm="syz.1.794" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 424.629304][ T31] audit: type=1400 audit(1788458303.185:993): avc: denied { open } for pid=11452 comm="syz.1.794" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 425.117413][T11467] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 425.198867][ T31] audit: type=1400 audit(1788458303.755:994): avc: denied { write } for pid=11419 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 425.547779][ T31] audit: type=1400 audit(1788458304.105:995): avc: denied { write } for pid=11479 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 425.640469][T11487] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 425.716104][T11487] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 425.965375][T11501] sg_write: data in/out 876544/136 bytes for SCSI command 0x0-- guessing data in; [ 425.965375][T11501] program syz.3.807 not setting count and/or reply_len properly [ 426.284765][ T25] Process accounting resumed [ 427.432585][ T31] audit: type=1400 audit(1788458305.985:996): avc: denied { mount } for pid=11509 comm="syz.8.810" name="/" dev="autofs" ino=37051 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 427.525643][ T31] audit: type=1326 audit(1788458306.085:997): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11517 comm="syz.3.812" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a9d59e159 code=0x7ffc0000 [ 427.527456][ T31] audit: type=1326 audit(1788458306.085:998): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11517 comm="syz.3.812" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a9d59e159 code=0x7ffc0000 [ 427.536626][T11518] FAULT_INJECTION: forcing a failure. [ 427.536626][T11518] name failslab, interval 1, probability 0, space 0, times 0 [ 427.536659][T11518] CPU: 1 UID: 0 PID: 11518 Comm: syz.3.812 Tainted: G L syzkaller #0 PREEMPT(full) [ 427.536686][T11518] Tainted: [L]=SOFTLOCKUP [ 427.536694][T11518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 427.536706][T11518] Call Trace: [ 427.536714][T11518] [ 427.536721][T11518] dump_stack_lvl+0x100/0x190 [ 427.536754][T11518] should_fail_ex.cold+0x5/0xa [ 427.536781][T11518] should_failslab+0xc2/0x120 [ 427.536806][T11518] __kmalloc_cache_noprof+0x91/0x6d0 [ 427.536833][T11518] ? audit_log_d_path+0xed/0x210 [ 427.536858][T11518] audit_log_d_path+0xed/0x210 [ 427.536879][T11518] audit_log_d_path_exe+0x46/0x80 [ 427.536898][T11518] audit_log_task+0x2fe/0x3a0 [ 427.536921][T11518] ? __pfx_audit_log_task+0x10/0x10 [ 427.536944][T11518] ? find_held_lock+0x2b/0x80 [ 427.536970][T11518] ? ksys_write+0x190/0x250 [ 427.536988][T11518] ? ksys_write+0x190/0x250 [ 427.537008][T11518] audit_seccomp+0x7a/0x1f0 [ 427.537037][T11518] __seccomp_filter+0x88c/0x1130 [ 427.537069][T11518] ? __pfx___seccomp_filter+0x10/0x10 [ 427.537101][T11518] ? ksys_write+0x1ac/0x250 [ 427.537118][T11518] ? __pfx_ksys_write+0x10/0x10 [ 427.537140][T11518] __seccomp_permit_syscall+0x224/0x2e0 [ 427.537170][T11518] do_syscall_64+0x591/0x790 [ 427.537196][T11518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.537230][T11518] RIP: 0033:0x7f0a9d59e159 [ 427.537247][T11518] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 427.537265][T11518] RSP: 002b:00007f0a9e470028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bb [ 427.537291][T11518] RAX: ffffffffffffffda RBX: 00007f0a9d825fa0 RCX: 00007f0a9d59e159 [ 427.537304][T11518] RDX: 0000000000000003 RSI: 0000000000002dc5 RDI: 0000000000000003 [ 427.537319][T11518] RBP: 00007f0a9e470090 R08: 0000000000000000 R09: 0000000000000000 [ 427.537332][T11518] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 427.537344][T11518] R13: 00007f0a9d826038 R14: 00007f0a9d825fa0 R15: 00007ffc840a7488 [ 427.537372][T11518] [ 427.752855][ T5724] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 427.935236][ T5724] usb 6-1: unable to get BOS descriptor or descriptor too short [ 427.935301][ T5724] usb 6-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 427.955156][ T5724] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 427.956813][ T5724] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 427.982781][ T5724] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.982821][ T5724] usb 6-1: Product: syz [ 427.982856][ T5724] usb 6-1: Manufacturer: syz [ 427.982874][ T5724] usb 6-1: SerialNumber: syz [ 428.029237][ T5724] usb 6-1: selecting invalid altsetting 1 [ 428.035818][ T5724] usb 6-1: unit 6 not found! [ 428.095868][ T31] kauditd_printk_skb: 17 callbacks suppressed [ 428.095925][ T31] audit: type=1400 audit(1788458306.655:1016): avc: denied { write } for pid=11506 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 429.165747][ T31] audit: type=1400 audit(1788458307.725:1017): avc: denied { write } for pid=11546 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 429.265553][ T5724] usb 6-1: 2:0: failed to get current value for ch 0 (-71) [ 429.344723][ T5724] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 429.358051][ T5724] usb 6-1: USB disconnect, device number 28 [ 429.418827][ T5975] udevd[5975]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 429.563958][ T32] INFO: task syz.2.428:9123 blocked for more than 143 seconds. [ 429.564213][ T32] Tainted: G L syzkaller #0 [ 429.564240][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 429.564252][ T32] task:syz.2.428 state:D stack:26568 pid:9123 tgid:9118 ppid:7690 task_flags:0x400040 flags:0x00080002 [ 429.564322][ T32] Call Trace: [ 429.564332][ T32] [ 429.564347][ T32] __schedule+0x1259/0x6920 [ 429.564375][ T32] ? __lock_acquire+0x4c5/0x1ec0 [ 429.564416][ T32] ? __pfx___schedule+0x10/0x10 [ 429.564436][ T32] ? find_held_lock+0x2b/0x80 [ 429.564466][ T32] ? schedule+0x225/0x2c0 [ 429.564493][ T32] schedule+0xdd/0x2c0 [ 429.564516][ T32] schedule_preempt_disabled+0x13/0x30 [ 429.564538][ T32] __mutex_lock+0xccb/0x1bd0 [ 429.564564][ T32] ? sync_bdevs+0x153/0x480 [ 429.564597][ T32] ? sync_bdevs+0x1ff/0x480 [ 429.564628][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 429.564673][ T32] ? iput.part.0+0x1a0/0x1050 [ 429.564704][ T32] ? sync_bdevs+0xf7/0x480 [ 429.564739][ T32] ? sync_bdevs+0x153/0x480 [ 429.564766][ T32] sync_bdevs+0x153/0x480 [ 429.564800][ T32] ksys_sync+0xb0/0xf0 [ 429.564829][ T32] ? __pfx_ksys_sync+0x10/0x10 [ 429.564862][ ** replaying previous printk message ** [ 429.564862][ T32] ? do_syscall_64+0xae/0x790 [ 429.564888][ T32] __do_sys_sync+0xe/0x20 [ 429.564914][ T32] do_syscall_64+0x123/0x790 [ 429.564942][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.564966][ T32] RIP: 0033:0x7fa328f9e159 [ 429.564986][ T32] RSP: 002b:00007fa329f54028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 429.565010][ T32] RAX: ffffffffffffffda RBX: 00007fa329225fa0 RCX: 00007fa328f9e159 [ 429.565026][ T32] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 429.565041][ T32] RBP: 00007fa329225fa0 R08: 0000000000000000 R09: 0000000000000000 [ 429.565055][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 429.565070][ T32] R13: 00007fa329226038 R14: 00007fa329225fa0 R15: 00007ffe0aa25b78 [ 429.565102][ T32] [ 429.565154][ T32] [ 429.565154][ T32] Showing all locks held in the system: [ 429.565172][ T32] locks held by kworker/1:1/30: 3, on CPU#1: [ 429.565190][ T32] #0: ffff88801c056140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 429.565286][ T32] #1: ffffc90000a67d08 ((work_completion)(&hcd->wakeup_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 429.565356][ T32] #2: ffff888029e4c1d8 (&dev->mutex){....}-{4:4}, at: usb_remote_wakeup+0x23/0x100 [ 429.565422][ T32] locks held by khungtaskd/32: 1, last CPU#0: [ 429.565439][ T32] #0: ffffffff8edec060 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 429.565521][ T32] locks held by kworker/0:2/1568: 6, on CPU#0: [ 429.565538][ T32] #0: ffff8880222c4540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 429.565608][ T32] #1: ffffc90005cffd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 429.565682][ T32] #2: ffff88802a70b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 [ 429.565744][ T32] #3: ffff88802a70f568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2b3e/0x4420 [ 429.565808][ T32] #4: ffff88802a63de60 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2b67/0x4420 [ 429.565872][ T32] #5: ffffffff9027e148 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x1a1/0x1bd0 [ 429.565949][ T32] locks held by kworker/1:3/5041: 6, on CPU#1: [ 429.565966][ T32] #0: ffff8880222c4540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 429.566034][ T32] #1: ffffc90002e47d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 429.566103][ T32] #2: ffff88802a85a1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 [ 429.566165][ T32] #3: ffff88802a85f568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2b3e/0x4420 [ 429.566228][ T32] #4: ffff88802a81c060 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2b67/0x4420 [ 429.566291][ T32] #5: ffffffff9027e148 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x1a1/0x1bd0 [ 429.566354][ T32] locks held by getty/5366: 2, on CPU#0: [ 429.566370][ T32] #0: ffff8880337320a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 429.566439][ T32] #1: ffffc9000321e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 429.566505][ T32] locks held by udevd/5614: 1, on CPU#1: [ 429.566522][ T32] #0: ffff888023b8c350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 429.566590][ T32] locks held by kworker/1:5/5710: 6, on CPU#1: [ 429.566606][ T32] #0: ffff8880222c4540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 429.566674][ T32] #1: ffffc90003c07d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 429.566742][ T32] #2: ffff88802a5e81d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 [ 429.566803][ T32] #3: ffff88802a601568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2b3e/0x4420 [ 429.566894][ T32] #4: ffff88802a545360 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2b67/0x4420 [ 429.566958][ T32] #5: ffffffff9027e148 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x1a1/0x1bd0 [ 429.567030][ T32] locks held by syz.2.428/9123: 1, on CPU#0: [ 429.567046][ T32] #0: ffff888023b8c350 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x153/0x480 [ 429.567116][ T32] locks held by sed/11562: 3, last CPU#1: [ 429.567132][ T32] #0: ffff8880b843bf60 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 [ 429.567192][ T32] #1: ffff8880b8524568 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2e0c/0x6920 [ 429.567247][ T32] #2: ffff88801f6ce5b8 (&sig->wait_chldexit){....}-{3:3}, at: __wake_up_sync_key+0x1c/0x50 [ 429.567313][ T32] [ 429.567321][ T32] ============================================= [ 429.567321][ T32] [ 429.567342][ T32] NMI backtrace for cpu 0 [ 429.567356][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 429.567383][ T32] Tainted: [L]=SOFTLOCKUP [ 429.567390][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 429.567402][ T32] Call Trace: [ 429.567410][ T32] [ 429.567417][ T32] dump_stack_lvl+0x100/0x190 [ 429.567446][ T32] nmi_cpu_backtrace.cold+0x12d/0x151 [ 429.567475][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 429.567498][ T32] nmi_trigger_cpumask_backtrace+0x21f/0x2a0 [ 429.567530][ T32] sys_info+0x141/0x190 [ 429.567554][ T32] watchdog+0xcb1/0x1030 [ 429.567585][ T32] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 429.567605][ T32] ? __pfx_watchdog+0x10/0x10 [ 429.567627][ T32] ? __kthread_parkme+0x18f/0x230 [ 429.567658][ T32] ? kthread+0x13a/0x450 [ 429.567681][ T32] ? __pfx_watchdog+0x10/0x10 [ 429.567699][ T32] kthread+0x373/0x450 [ 429.567724][ T32] ? __pfx_kthread+0x10/0x10 [ 429.567750][ T32] ret_from_fork+0x730/0xd60 [ 429.567772][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 429.567796][ T32] ? __switch_to+0x800/0x10f0 [ 429.567823][ T32] ? __pfx_kthread+0x10/0x10 [ 429.567849][ T32] ret_from_fork_asm+0x1a/0x30 [ 429.567882][ T32] [ 429.567908][ T32] Sending NMI from CPU 0 to CPUs 1: [ 429.567941][ C1] NMI backtrace for cpu 1 [ 429.567954][ C1] CPU: 1 UID: 0 PID: 11561 Comm: dhcpcd-run-hook Tainted: G L syzkaller #0 PREEMPT(full) [ 429.567979][ C1] Tainted: [L]=SOFTLOCKUP [ 429.567985][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 429.567995][ C1] RIP: 0010:stack_depot_save_flags+0x16c/0x9f0 [ 429.568016][ C1] Code: 41 c1 c8 08 45 29 c1 4c 8b 3d 70 e0 65 16 45 89 c8 44 23 05 5e e0 65 16 49 c1 e0 04 4d 01 c7 65 48 ff 05 af a2 2c 0f 4d 8b 37 <4d> 39 f7 75 1b e9 af 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 4d 8b [ 429.568032][ C1] RSP: 0000:ffffc900044df2f0 EFLAGS: 00000282 [ 429.568046][ C1] RAX: 0000000062fcb24d RBX: 0000000000000001 RCX: 000000009d8a7e97 [ 429.568057][ C1] RDX: 000000000000000c RSI: 00000000a516e9c6 RDI: 0000000000000003 [ 429.568067][ C1] RBP: 0000000000140cca R08: 000000000072bc90 R09: 00000000f1272bc9 [ 429.568078][ C1] R10: 0000000000000001 R11: 0000000000000001 R12: ffffc900044df368 [ 429.568089][ C1] R13: 000000000000000c R14: ffff888037ac73d0 R15: ffff88823b52bc90 [ 429.568100][ C1] FS: 00007fa6cbe9cc80(0000) GS:ffff888123c61000(0000) knlGS:0000000000000000 [ 429.568117][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 429.568129][ C1] CR2: 00007ffcf5a800a8 CR3: 000000004d29e000 CR4: 00000000003526f0 [ 429.568148][ C1] Call Trace: [ 429.568153][ C1] [ 429.568162][ C1] save_stack+0x16f/0x1e0 [ 429.568182][ C1] ? __pfx_save_stack+0x10/0x10 [ 429.568200][ C1] ? post_alloc_hook+0xfd/0x120 [ 429.568222][ C1] ? get_page_from_freelist+0x110d/0x35d0 [ 429.568245][ C1] ? __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 429.568269][ C1] ? alloc_pages_mpol+0x201/0x550 [ 429.568288][ C1] ? folio_alloc_mpol_noprof+0x36/0x260 [ 429.568311][ C1] ? vma_alloc_folio_noprof+0xed/0x1d0 [ 429.568332][ C1] ? do_wp_page+0x1b15/0x45c0 [ 429.568350][ C1] ? __handle_mm_fault+0x1cd2/0x2f60 [ 429.568371][ C1] ? handle_mm_fault+0x363/0xa20 [ 429.568391][ C1] ? do_user_addr_fault+0x59c/0x12f0 [ 429.568411][ C1] ? exc_page_fault+0x6f/0xd0 [ 429.568428][ C1] ? asm_exc_page_fault+0x26/0x30 [ 429.568445][ C1] ? __lock_acquire+0x4c5/0x1ec0 [ 429.568465][ C1] __set_page_owner+0x8c/0x540 [ 429.568487][ C1] ? __pfx___set_page_owner+0x10/0x10 [ 429.568506][ C1] ? bad_range+0x257/0x3f0 [ 429.568523][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 429.568541][ C1] ? get_page_from_freelist+0x10e6/0x35d0 [ 429.568569][ C1] post_alloc_hook+0xfd/0x120 [ 429.568591][ C1] get_page_from_freelist+0x110d/0x35d0 [ 429.568625][ C1] ? __pfx_get_page_from_freelist+0x10/0x10 [ 429.568650][ C1] ? prepare_alloc_pages+0x1f0/0x5b0 [ 429.568668][ C1] ? __mod_memcg_lruvec_state+0x18c/0x5b0 [ 429.568688][ C1] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 429.568715][ C1] ? lru_gen_add_folio+0x20f/0x1490 [ 429.568741][ C1] ? mark_held_locks+0x40/0x70 [ 429.568757][ C1] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 429.568781][ C1] ? __pfx_flush_tlb_func+0x10/0x10 [ 429.568800][ C1] ? smp_call_function_many_cond+0x944/0x18c0 [ 429.568821][ C1] ? __pfx_should_flush_tlb+0x10/0x10 [ 429.568837][ C1] ? __pfx_flush_tlb_func+0x10/0x10 [ 429.568861][ C1] ? __lock_acquire+0x4c5/0x1ec0 [ 429.568878][ C1] ? __css_rstat_updated+0x1ce/0x590 [ 429.568897][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 429.568916][ C1] ? policy_nodemask+0xed/0x4f0 [ 429.568937][ C1] alloc_pages_mpol+0x201/0x550 [ 429.568957][ C1] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 429.568977][ C1] ? __mod_memcg_lruvec_state+0x18c/0x5b0 [ 429.568995][ C1] ? find_held_lock+0x2b/0x80 [ 429.569019][ C1] folio_alloc_mpol_noprof+0x36/0x260 [ 429.569042][ C1] vma_alloc_folio_noprof+0xed/0x1d0 [ 429.569064][ C1] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 429.569085][ C1] ? rcu_read_unlock+0x2d/0xb0 [ 429.569107][ C1] ? rcu_read_unlock+0x2d/0xb0 [ 429.569132][ C1] do_wp_page+0x1b15/0x45c0 [ 429.569158][ C1] ? lock_acquire+0x1d1/0x380 [ 429.569174][ C1] ? __pfx_do_wp_page+0x10/0x10 [ 429.569193][ C1] ? do_raw_spin_lock+0x128/0x260 [ 429.569213][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 429.569237][ C1] __handle_mm_fault+0x1cd2/0x2f60 [ 429.569260][ C1] ? lock_vma_under_rcu+0x11d/0x590 [ 429.569280][ C1] ? __pfx___handle_mm_fault+0x10/0x10 [ 429.569304][ C1] ? lock_vma_under_rcu+0x17c/0x590 [ 429.569333][ C1] handle_mm_fault+0x363/0xa20 [ 429.569357][ C1] do_user_addr_fault+0x59c/0x12f0 [ 429.569381][ C1] exc_page_fault+0x6f/0xd0 [ 429.569398][ C1] asm_exc_page_fault+0x26/0x30 [ 429.569414][ C1] RIP: 0033:0x7fa6cc193268 [ 429.569427][ C1] Code: 8b 54 24 20 8b 74 24 08 48 8b bc 24 90 00 00 00 e8 8f ed ff ff 85 c0 74 37 80 7b 47 01 75 07 83 7c 24 14 00 7e 2a 48 8b 7b 38 <6a> 01 5e e8 40 2f fc ff 8b 4c 24 34 48 8b 54 24 20 8b 74 24 08 48 [ 429.569441][ C1] RSP: 002b:00007ffcf5a800b0 EFLAGS: 00010202 [ 429.569454][ C1] RAX: 0000000000000001 RBX: 000056411906b2c0 RCX: 0000000000000000 [ 429.569464][ C1] RDX: 000056411906b2c0 RSI: 0000000000000001 RDI: 00007ffcf5a80a30 [ 429.569475][ C1] RBP: 000056411906b810 R08: 00007ffcf5a7ff70 R09: 000056411906b810 [ 429.569486][ C1] R10: 0000000000000000 R11: 0000000000000202 R12: 000056411907bc38 [ 429.569497][ C1] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 429.569514][ C1] [ 429.592007][ T5710] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 429.593772][ T31] audit: type=1400 audit(1788458308.145:1018): avc: denied { write } for pid=11548 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 429.622325][ T5041] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 429.692102][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 430.815788][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 430.826462][ T32] Tainted: [L]=SOFTLOCKUP [ 430.830779][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 430.840814][ T32] Call Trace: [ 430.844073][ T32] [ 430.846984][ T32] dump_stack_lvl+0x100/0x190 [ 430.851644][ T32] vpanic+0x553/0x970 [ 430.855599][ T32] ? __pfx_vpanic+0x10/0x10 [ 430.860083][ T32] panic+0xd1/0xe0 [ 430.863785][ T32] ? __pfx_panic+0x10/0x10 [ 430.868198][ T32] ? nmi_trigger_cpumask_backtrace+0x263/0x2a0 [ 430.874337][ T32] ? nmi_trigger_cpumask_backtrace+0x26d/0x2a0 [ 430.880499][ T32] ? watchdog.cold+0x1ec/0x234 [ 430.885287][ T32] watchdog.cold+0x1fd/0x234 [ 430.889891][ T32] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 430.895689][ T32] ? __pfx_watchdog+0x10/0x10 [ 430.900355][ T32] ? __kthread_parkme+0x18f/0x230 [ 430.905379][ T32] ? kthread+0x13a/0x450 [ 430.909626][ T32] ? __pfx_watchdog+0x10/0x10 [ 430.914297][ T32] kthread+0x373/0x450 [ 430.918355][ T32] ? __pfx_kthread+0x10/0x10 [ 430.922937][ T32] ret_from_fork+0x730/0xd60 [ 430.927526][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 430.932625][ T32] ? __switch_to+0x800/0x10f0 [ 430.937298][ T32] ? __pfx_kthread+0x10/0x10 [ 430.941905][ T32] ret_from_fork_asm+0x1a/0x30 [ 430.946686][ T32] [ 430.949930][ T32] Kernel Offset: disabled [ 430.954255][ T32] Rebooting in 86400 seconds..