last executing test programs: 15m35.860999533s ago: executing program 3 (id=959): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x9, 0x0, 0x0, r2, 0x80eeee}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_PCM_IOCTL_STATUS32(r3, 0x806c4120, &(0x7f0000000240)) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x39b3) r5 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='&'], 0x10) r7 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) r8 = dup2(r7, r7) ioctl$EVIOCSKEYCODE_V2(r8, 0x40284504, &(0x7f0000000000)={0x2, 0x2, 0xd98, 0x13, "48e4ed7da8a5793d14be0e92e080922245a750555f268709d9ce00"}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r6, &(0x7f0000000180), &(0x7f0000000040)=@udp6=r8}, 0x20) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) recvmmsg(r4, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x12140, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r10 = creat(&(0x7f00000000c0)='./bus\x00', 0x182) fallocate(r10, 0x0, 0x1, 0x2000402) write(r9, &(0x7f0000000200)='2', 0x1) 15m35.130528599s ago: executing program 3 (id=965): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x40, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0xfffd, 0x0, 0x4, 0x0, @empty, @private}}}}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000740)={'ah\x00'}, &(0x7f0000000780)=0x1e) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r2, 0x1) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x800) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000001c0)="00940a37", 0x4) sendto$unix(r4, &(0x7f0000000440)="36d9a32e92c131d730b1abaedb51eb66fd2d5b1f7eda4f0e859fdaf294bad70673813533d8bf1c6a77b65a7afdc01b29e73571071a68d5def5d7df839810da130b9348f4d9d407eb478d5bfb298c552a498271af70914e14ba9476fd2a0e47984c25ea20afab3064a748add27a7149e9c4705475bda2ecec9ec30214f28c5e16fd3f50f604f20232c534409e52bff64fc6ca0f5e254083aec2794b7216e002e87caf3d0fa7d04ff9e3b03e81595a04979594ff6ea888bf13de8e8f74c6178e31e47593732ae1a501ad3641d423195a788efdb643f50a8c8b9794a62f7b8dfa0fa7da9d391b92ce2a7f9fe0f9d584a3775f", 0x703d59595f6742a8, 0x800, 0x0, 0x0) recvfrom(r4, &(0x7f00000030c0)=""/4117, 0xffffffffffffffbf, 0x1, 0x0, 0xffffffffffffffb5) renameat2(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file3\x00', 0x6) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000140)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000100)='%pB \x00'}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={r5, &(0x7f0000000480)="974cdcf2536c7a85025a750a6c880500347a5ed8a5d9f04b4254648dbcadcd5c8d909350c85ef8702d6dfc767ca2e97fdab327ebd5f93125a810127c7dde6f956fe0712192aa57c37aee134e566dd231a35f8812f575d5b993157a92f7c96fcbd9b1633d55f334010fa0cefb3c8684916c8ee665f30caf77973a24fdce5a12b6149be466c68fd8f954a42833bf0f8ada6083013f70860bf93b3fad287860bfb6cab87932e4ab7f15cb545a8e199cb7b0832d771be722eddd5a358b84a2db78ebe797adb5607943e4d08eee69ee8351515164031519daf2889f7cfdd7822bb168bab056fb390f6bda397b2a45dcbe53374a166e8f928a", &(0x7f0000000580)=@tcp6, 0x2}, 0x20) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FLOWINFO={0x8}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x12, &(0x7f0000000840)=@raw=[@ldst={0x1, 0x2, 0x4, 0x8, 0xa, 0xfffffffffffffff0, 0xfffffffffffffffc}, @cb_func={0x18, 0x8, 0x4, 0x0, 0x7}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0xffffffff}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x7ff}, @cb_func={0x18, 0x3, 0x4, 0x0, 0xfffffffffffffff8}, @cb_func={0x18, 0xa, 0x4, 0x0, 0xfffffffffffffffa}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x8}, @tail_call], &(0x7f0000000900)='GPL\x00', 0x6, 0x92, &(0x7f0000000940)=""/146, 0x100, 0x29, '\x00', r1, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000a00)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000000a40)={0x0, 0x6, 0x10001, 0x2}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x2, &(0x7f0000000a80)=[r5, r5], &(0x7f0000000ac0)=[{0x0, 0x1, 0x4, 0xa}, {0x4, 0x5, 0x1, 0x4}], 0x10, 0x3}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000c00)={{}, &(0x7f0000000800), &(0x7f0000000bc0)=r8}, 0x20) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x18, 0x2f, 0x9, 0x70bd27, 0x1, {0x4}, [@typed={0x4, 0x19, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), 0xffffffffffffffff) r9 = syz_clone(0x1200000, &(0x7f0000000180)="244a992568bf88dd68c9e80762c6b708d1571187a9fdabb9dcf51edc9f4dcef5ff45a1b387ed7b462af6820ccf7be0d2796b65687838273422a5379aa9e71f2f4fc5971b7bfb096847dbcb2155687d62c196a423ecb4916f6f554ae6473e37af1897b7bc718b28bc9e2325b8d0a5449bc074fc334a83d3d5dc4b10a1dacba39a52227ad89be95e77650e53ea8ff5154e747f59c00a47a9b0bb6714f05e4a3fab0deb8ef9c3b06bf0acf635b6e96858b2b36c652851b5d7e315b4eb518e38d46a715a84ed5f9acb1a8ca8c48a8103", 0xce, &(0x7f0000000280), &(0x7f0000000300), &(0x7f0000000640)="923d5b075cc233e614e8976429ec89baa473dc79d57fe9d152c435ec22e69b86e614ae39b5034c8bae3fd926d86872bbf1f64bd45a584a3385188ac999a28fef8c8b429bc365ac8560c3fa4cfdf91393fb24c48c0cab5721c3497d24dcd3c82dcea41f91fec942dfd3e7a450685d0b742342ca5dd9a6a623aa9f47201a849a471a25bec840230b1ce5c4b93bb7c548ef835341fbe766a3a5bec5c21d17eb9dc0c20e0c8d7505a1a24f95ec9583a956a8d8166731345a24a1d119d1953246598aff452f294f32238274336965a0a491fab53b0f31ba5febd1e37a779ecabfce41eb") syz_pidfd_open(r9, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x70bd27, 0x0, [@sadb_address={0x3, 0x6, 0x33, 0x0, 0x0, @in={0x2, 0x1000}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x5, 0xfc, 0xe0000001}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x8, 0x0, '4'}]}, 0x60}, 0x1, 0x7}, 0x0) 15m34.95906387s ago: executing program 3 (id=966): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x40, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0xfffd, 0x0, 0x4, 0x0, @empty, @private}}}}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000740)={'ah\x00'}, &(0x7f0000000780)=0x1e) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r2, 0x1) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x800) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000001c0)="00940a37", 0x4) sendto$unix(r4, &(0x7f0000000440)="36d9a32e92c131d730b1abaedb51eb66fd2d5b1f7eda4f0e859fdaf294bad70673813533d8bf1c6a77b65a7afdc01b29e73571071a68d5def5d7df839810da130b9348f4d9d407eb478d5bfb298c552a498271af70914e14ba9476fd2a0e47984c25ea20afab3064a748add27a7149e9c4705475bda2ecec9ec30214f28c5e16fd3f50f604f20232c534409e52bff64fc6ca0f5e254083aec2794b7216e002e87caf3d0fa7d04ff9e3b03e81595a04979594ff6ea888bf13de8e8f74c6178e31e47593732ae1a501ad3641d423195a788efdb643f50a8c8b9794a62f7b8dfa0fa7da9d391b92ce2a7f9fe0f9d584a3775f", 0x703d59595f6742a8, 0x800, 0x0, 0x0) recvfrom(r4, &(0x7f00000030c0)=""/4117, 0xffffffffffffffbf, 0x1, 0x0, 0xffffffffffffffb5) renameat2(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file3\x00', 0x6) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000140)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000100)='%pB \x00'}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={r5, &(0x7f0000000480)="974cdcf2536c7a85025a750a6c880500347a5ed8a5d9f04b4254648dbcadcd5c8d909350c85ef8702d6dfc767ca2e97fdab327ebd5f93125a810127c7dde6f956fe0712192aa57c37aee134e566dd231a35f8812f575d5b993157a92f7c96fcbd9b1633d55f334010fa0cefb3c8684916c8ee665f30caf77973a24fdce5a12b6149be466c68fd8f954a42833bf0f8ada6083013f70860bf93b3fad287860bfb6cab87932e4ab7f15cb545a8e199cb7b0832d771be722eddd5a358b84a2db78ebe797adb5607943e4d08eee69ee8351515164031519daf2889f7cfdd7822bb168bab056fb390f6bda397b2a45dcbe53374a166e8f928a", &(0x7f0000000580)=@tcp6, 0x2}, 0x20) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FLOWINFO={0x8}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x12, &(0x7f0000000840)=@raw=[@ldst={0x1, 0x2, 0x4, 0x8, 0xa, 0xfffffffffffffff0, 0xfffffffffffffffc}, @cb_func={0x18, 0x8, 0x4, 0x0, 0x7}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0xffffffff}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x7ff}, @cb_func={0x18, 0x3, 0x4, 0x0, 0xfffffffffffffff8}, @cb_func={0x18, 0xa, 0x4, 0x0, 0xfffffffffffffffa}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x8}, @tail_call], &(0x7f0000000900)='GPL\x00', 0x6, 0x92, &(0x7f0000000940)=""/146, 0x100, 0x29, '\x00', r1, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000a00)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000000a40)={0x0, 0x6, 0x10001, 0x2}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x2, &(0x7f0000000a80)=[r5, r5], &(0x7f0000000ac0)=[{0x0, 0x1, 0x4, 0xa}, {0x4, 0x5, 0x1, 0x4}], 0x10, 0x3}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000c00)={{}, &(0x7f0000000800), &(0x7f0000000bc0)=r8}, 0x20) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x18, 0x2f, 0x9, 0x70bd27, 0x1, {0x4}, [@typed={0x4, 0x19, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), 0xffffffffffffffff) r9 = syz_clone(0x1200000, &(0x7f0000000180)="244a992568bf88dd68c9e80762c6b708d1571187a9fdabb9dcf51edc9f4dcef5ff45a1b387ed7b462af6820ccf7be0d2796b65687838273422a5379aa9e71f2f4fc5971b7bfb096847dbcb2155687d62c196a423ecb4916f6f554ae6473e37af1897b7bc718b28bc9e2325b8d0a5449bc074fc334a83d3d5dc4b10a1dacba39a52227ad89be95e77650e53ea8ff5154e747f59c00a47a9b0bb6714f05e4a3fab0deb8ef9c3b06bf0acf635b6e96858b2b36c652851b5d7e315b4eb518e38d46a715a84ed5f9acb1a8ca8c48a8103", 0xce, &(0x7f0000000280), &(0x7f0000000300), &(0x7f0000000640)="923d5b075cc233e614e8976429ec89baa473dc79d57fe9d152c435ec22e69b86e614ae39b5034c8bae3fd926d86872bbf1f64bd45a584a3385188ac999a28fef8c8b429bc365ac8560c3fa4cfdf91393fb24c48c0cab5721c3497d24dcd3c82dcea41f91fec942dfd3e7a450685d0b742342ca5dd9a6a623aa9f47201a849a471a25bec840230b1ce5c4b93bb7c548ef835341fbe766a3a5bec5c21d17eb9dc0c20e0c8d7505a1a24f95ec9583a956a8d8166731345a24a1d119d1953246598aff452f294f32238274336965a0a491fab53b0f31ba5febd1e37a779ecabfce41eb") syz_pidfd_open(r9, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x70bd27, 0x0, [@sadb_address={0x3, 0x6, 0x33, 0x0, 0x0, @in={0x2, 0x1000}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x5, 0xfc, 0xe0000001}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x8, 0x0, '4'}]}, 0x60}, 0x1, 0x7}, 0x0) 15m34.063297562s ago: executing program 3 (id=973): close(0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000040000000400000000c0000000400000001000004010000000a000000030000000000000000000000000000010500000000000001000000000000000300000000020000000200000000200000006100302e616161610061"], 0x0, 0x64}, 0x28) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0}]) syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0x82, &(0x7f0000006680)) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000003c40)='/dev/comedi4\x00', 0x840, 0x0) ioctl$COMEDI_CMDTEST(r4, 0x8050640a, &(0x7f0000000180)={0x0, 0x40, 0x40, 0x100, 0x10, 0x80, 0x20, 0x1, 0x20, 0xe3f7, 0x4, 0xfffff965, 0x0, 0x0, 0x0}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x90) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000006"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x8000, &(0x7f0000000780)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r7, @ANYBLOB="2c7766646e6f3d685f8342f29d28c7cb2be78e3adb15cb623c1d3150c11d3b984947b8958e4e43372b3e1b97eff7436b23a573b10000008004000000ced6d419bd3eba1c280b6490147a70468035e293ce8d5912b94c9f3b64b3dcdd87a7e72a0ead62e5093e70d8083f84094b1b69fdd8c7cdccaeea33e64457accc873de1b7ab6abfc4784427c0e1287c4df3572eaf5f0aa8e295c52da000000094556be9487f2ed2ade9199e7d9c54ee5a3c36cea17c2649497ec9df666feb66fa3fa228ba199990b9c5793fa7afb5c3489a036832204bbf0a10544274486b97f5997cab903016abba07c150093e5113258d638632f006159602734e5659011db3367f648f75e04886f5602b5399bd6bed20273131bfa5e66fb4325f39eb4811281b62cfceeb00770ef04de759f5c0da155d7cf4aea621dd29d21c2422a6de80f25b1fa9cada163141a8a72a85bcf3c888a62921c849ed26b890f42354f30393c370a009e4058b646ffccdfcdd4ade85c434932eae02c49a8347cef58cb58f7491755f554305884da2107385acdcbf93f312661f7ceb94ae153e4f10611c2e600c7689f8ae51eb444cd9e54dd4ffce4d1f4e44bc22816a4fec28e983a239ca1fd434b7ef7b", @ANYRESHEX=r3, @ANYBLOB=',\x00']) close(r0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r7) 15m33.793471742s ago: executing program 3 (id=976): r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000040)=""/172) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) getpeername$tipc(r0, 0x0, 0x0) 15m30.644260229s ago: executing program 3 (id=991): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x10000000000a) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, &(0x7f0000000580)={0x7, 0x0, [{0x4, 0x6, 0x1, 0x7, 0x40006, 0x100, 0x2}, {0xa, 0x4, 0x0, 0xff, 0x27, 0x7, 0x5}, {0x7, 0x8, 0x0, 0x2, 0xbb69, 0x5, 0xffff}, {0xb, 0xf5f, 0x0, 0x7, 0x0, 0x6, 0x7ffffffd}, {0xd, 0x2bb, 0x1, 0xd, 0x6, 0x62, 0x400}, {0x2, 0x1, 0x5, 0x8, 0x4, 0x4, 0x3}, {0x1, 0x8d3d, 0x6, 0x9, 0x3ff, 0x1, 0x3}]}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000440)={'veth1\x00', 0x2}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r2) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r9, &(0x7f0000019680)=""/102392, 0x18ff8) read$msr(0xffffffffffffffff, &(0x7f0000000480)=""/90, 0xfffffffffffffea1) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xfff2, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x7fffffff, 0xd00, 0x1}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4040840) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0x9, 0x5}, {0x10, 0xffe0}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x10001}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24048024}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r10) sendmsg$TIPC_CMD_ENABLE_BEARER(r10, &(0x7f00000002c0)={0x0, 0xfffffffffffffd63, &(0x7f0000000340)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) close(0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) ioctl$TUNSETGROUP(r0, 0x400454ce, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='.\x00', &(0x7f0000000140)='sysfs\x00', 0x1010811, 0x0) 15m30.169535415s ago: executing program 32 (id=991): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x10000000000a) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, &(0x7f0000000580)={0x7, 0x0, [{0x4, 0x6, 0x1, 0x7, 0x40006, 0x100, 0x2}, {0xa, 0x4, 0x0, 0xff, 0x27, 0x7, 0x5}, {0x7, 0x8, 0x0, 0x2, 0xbb69, 0x5, 0xffff}, {0xb, 0xf5f, 0x0, 0x7, 0x0, 0x6, 0x7ffffffd}, {0xd, 0x2bb, 0x1, 0xd, 0x6, 0x62, 0x400}, {0x2, 0x1, 0x5, 0x8, 0x4, 0x4, 0x3}, {0x1, 0x8d3d, 0x6, 0x9, 0x3ff, 0x1, 0x3}]}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000440)={'veth1\x00', 0x2}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r2) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r9, &(0x7f0000019680)=""/102392, 0x18ff8) read$msr(0xffffffffffffffff, &(0x7f0000000480)=""/90, 0xfffffffffffffea1) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xfff2, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x7fffffff, 0xd00, 0x1}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4040840) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0x9, 0x5}, {0x10, 0xffe0}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x10001}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24048024}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r10) sendmsg$TIPC_CMD_ENABLE_BEARER(r10, &(0x7f00000002c0)={0x0, 0xfffffffffffffd63, &(0x7f0000000340)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) close(0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) ioctl$TUNSETGROUP(r0, 0x400454ce, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='.\x00', &(0x7f0000000140)='sysfs\x00', 0x1010811, 0x0) 14m22.291585428s ago: executing program 1 (id=1415): syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x1ea1e2) openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/pm_freeze_timeout', 0x68a41, 0x3) kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='uid_map\x00') write$cgroup_int(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1d, 0x2, &(0x7f0000000040)=@raw=[@call={0x85, 0x0, 0x0, 0xb8}, @exit], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb}, 0x94) setreuid(0x0, 0xee01) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xfffffffb}, {{}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1200}, {0x3, 0x3, 0x3, 0xa, 0x2, 0xfff0}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x6, 0xa, 0x9, 0xfff0, 0x41}, {0x7, 0x1, 0xb, 0x6, 0x8, 0x20}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0xa, 0x20}, {}, {}, {0x18, 0x8}, {}, {0x15, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f00000002c0)='GPL\x00', 0x6, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) 14m22.013415234s ago: executing program 1 (id=1418): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)) keyctl$clear(0x7, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000140)=0x3) r3 = dup(r2) r4 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x20010, r4, 0xef3e7000) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r5, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x800) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) poll(&(0x7f00000002c0)=[{r1, 0x9002}], 0x1, 0xffffffff) syz_usb_control_io$uac2(r0, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r3, 0x4048ae9b, &(0x7f0000000300)={0x80000, 0x0, {[0x1, 0x9b2, 0x7fffffffffffffff, 0x9, 0x1, 0x7ff, 0x30, 0x3b]}}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000280)={0x40, 0x7, 0xa, "378491e1441926bf33c3"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) 14m18.360779564s ago: executing program 1 (id=1429): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0500000003000000010000000300000000000000", @ANYRES32, @ANYBLOB="0300000000000000000000000000000d5d1281c76efe4206a600000000005733b80dcb952881fcf5a0470b1bc4f181cff5eb82178ad82c42da6aa6b3d8925a4cb7f8707b5f24c603b309199edfee0513d3221bc60e3061d1d8440c2aef071023c709bf5b0b154f0994f7b8b4f9f533ff157b80962d1f71987a4aba0255e247", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000ecb700"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x11, 0x15, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000002000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000070000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f8680000850000008200000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000090000017b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x61800, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3, r2}, 0xc) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000bfd2b357", 0x2f}], 0x1}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="1400040041000200fcff0500050000001000000031f83c58631884f8461f2b5319a8571d90b2e605236f52f65bf6deb2dbc3f7ce26c8ff6bb3d190df0526bdebcd9745b1e65ab309343ed695597324ae"], 0x14}, 0x1, 0x0, 0x0, 0x400c801}, 0x200080c4) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_FREE_STREAMS(r4, 0x8008551d, &(0x7f00000000c0)={0x7073, 0x1, [{0x1, 0x1}]}) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa000000000000080674953dce31fcb7f50180c2000000ac1414280180c200fc00e0000002"], 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001200)=ANY=[@ANYBLOB="61124c00000000006113300000000000bf300000000000002500070007ffffffbd2001000000000095002000000000006916320000000000bf6700000000000004070000b964b01a4607feff00200000540700000ee60090bf050000000000000c5700000000000065070000d23700002c030000000000001f75000000000000bf54000000000000070000000400f9ffad430100000000007c000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c4ed68ecf264e0f84f9f17d3c30e3c7bdd2d17f2f175455000078af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd390700000500000000f18c30907d7bee45a0100000fe9de56c9d05000000c6c60bef0d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cac3f055af65727546e7c955ccefa1f6ab689ffffff7f63ede202fa4e0a2127b8b83c71a51445dc8dfd13ff15f852a39e5b2ab7bcb8f512036a5ba6d04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6901fcecc8158f0200000000c8fb735fd552bdc268694aeb0763f65e439ec1120843e326c819b6cf5c8ac86f8a297dff0445a13d0045fb3cda30a673a6037ed8c85f21ec2c081bdce431e56723888fb126a19bc1172b84b3ebe174aba210d739a018f9bbec63222d20cecac4d03723f1c921b5bbf7949632cacfdd32b3a6aa57f1ad2e99e0e67a993716dbf580469f0f53acbb400001e3abd5dedd3f7d2cf5834f2af97787f696649a46e17e090000000000000045eac1720e83b7838e3eede14308d582685e1becd6f35154bcb400000000000000000000008129277dc467148670ad3e2b26539cebca8f4ddc211bc3ccf0bd9d42ca019dd5d022cf74686e9fbe2562979eaed840a7afaab43176e65ec1118d46d1e827f3472f4445d353887a5ad103649afa1769080584f800031e03a651bb04000000ab04871bc47287cd31cc43ea0ffb567b4040c1458d0320ce7d0000413a0000000000000000005f37983f84e98a523d80bd56a57fa82b82f639601ae899a559944cb9a62a29ab028acfc1cb26a0f6a5480a55d624a0c544ba0dc828c22fe30000aa391598000000437d57fcf8295f63a70837f5cd4e5e77964522dc7ca3aa3476b7f2d851d27fd4de6eabb43e0799dc8d9fb7dc6c523ffbd74a6a40e4acb1ac872ade9d1f2ab779b8dbe843aeeda0426c767c00327b8c95b2bb6ddb55117669d9598c0f3598073f3a921c76beceff7e4fbfea5011db9020823b83abe54346c7af0a99fa077ffe7000feb9e44023a1749eb1d0d572b77d6e0d0fcd74031c8ef2629f5ecff4626746d6abe98a255e92c3c4f79bfcd0d91741380000cfeb73dec68ed56b5d3dfdf0cb8b71ad79000000000000000000000000000000dd434a25e95d0ec29d3adaccf89d0888031ecdfdb4dfbe444673be099ece7e4009c76c7108ef0a7e59fd6d906fbc3c9b412e0478cfee4485f423c63f49db43833c92eeeb647cebd4d7a93a17bcbb6bae5ff876375d4fe39cc2d292691672cc18ca372104ceb83a35ecedd97fc191d8f64d2b1d60c6d12911aada66c26aa4802c3514c3d92ec905000000b13f14c3f2ed6c64ec90000022d600000000000000000000028026b80c3899543223a6079ee96198b9a326db3be3a48af415ca28ca51c502550044ed8e29af8d763ef9b1f31befcad2ce5394601c7cdc233ba3d4ce26ed703dcb9fb3ad650f77e339768924dfdbeead13b88371154d743544a6091ec93e0d3fd5b4dc42911c17d51f964727bfd5cc5ba15370f6e1141d2271eded0b15e4316a1e4623272beb249a0928c417720be14c898f397411c88a7bcf3df46ab3efe7cd5e160c2afd3cc945f75011a102d952c7ad17a58d9be6910023a26faea764fae160cc2260bd028162917807ce89e11b5f261052ee0dde18efa1d802af2b7beecaaa61e7a726571df5cf6f8af41933cea0d0343261bccf64ca1c81045153eafbefdb91fbdff9ee3307d4a1837963b2dc2a3698d90e7915b098f19392e792adaea86052f4e948184001b6494e906925a092483adc7e9c8f7a29d226763c100aecae7f00619c36bceb9fb6dd7e55487d8485e498fdfc377fd3d266d21d46ab2f6b2ce22cd0aebba9b0ffbfe8ec3143c3734967c90b16ebbeeae1ce2baaae05aed6bf0f40c8a323f9235dc99698bd0b800067a901a79daada03cc77e74feb98b1586946b452764ff917a8ecc10e529c5bea49cad70e22df522c2803b6ef65df70223c6e22c3433e322d8dbd6e9b040065a9d6b3d5ae276cffe935d559bea88e1aa36b4e6c19e78457904297e77370e013b705a96548d47c609a93c45f4d1382b39c05dcc07d5b49ad75ddb3ce5b5b9416e03995da046c7aa5e6fc1a6f5d663380967ccef9de49a90ced031335e3219ebd9d06c257a50497ec523f5ff7361261ccfe239d603364a42e2e81fc068fcbb9792b673827fe7018a988fbce55bb74cdb327ce27e134548032a307871cea4c89d4b77b8743fb3cb72cc280b9f62e4f92f46a19600b802cba88b7d0a938d9e0e6cfe5d66b8748d004179e5b6025c0e1050faec7ecd9de190a975db2f8c06a551236278c4766d7e22e3b85168c9851de6266c791252f919b4f8b25055e786734e5142e4666c67aef5b7b2f88c6640995434aa8636993089c73f196c54ae829ad4307132655b075ae534fa7f1ea9a17e62357b0bd2bd1d62d34bfc136464025013665b1cf26a863a5cb3e8acc806611792add8254e705fefd2a44d5b15e3b36f6b75c97c9c04c511d8cf9e24c61c8284a913a381cb1a56c4f3f265a09628878040000000000000017b68afd95d4abd79286692439ee7acca2adc3d83d72b1b778e30c2bf2efbbcd054cf51f5705eb0faa8a0d9f18135cb1d8d567c3436fa697b72c5035d98b9e4f7f3379c0b3339debc78352b2e65299223d7ef2bd540e78167a3ac92a4c4f826f6d0e5c4ebf4f7a70c03e2f5ddbebf168586331eb5995d2288a167b7c6b20b32116b0c528dab6d0c4fe2ee402348104bc5d4012babedee898c6d3e1017be2e9bc759d3ab4d615f5000000000000000000000000000000000000000000007fff0000000000e693e314adf7dc9f517d04f1e6ca367d30d31d3647c6059db6e1e9529eb1623ef99e2d9ac2ab4872f8e784b07a31110bef6d000000a6f9e89e6d50ee06ce716f94da60f1f22db669560d296287c13c92070000ee7553eb2df17a39542fa88d09f000e88a90cf4406b9000000000000000000000000f441d6a6f516c235c6f5863e7f454ee0e16b9aa2593eb31fa3836703e7765aaeb77a8770e518efaa6d3dd85e03b3b133eb749057cea9af75a0e6f633532f2891b8e263cb6eecea691842827bc7c887081c8d320642389f5f0c42dba0ff75a257310f2d92cb1d1e16468949f5675262ee6609cf26ae4a8f5eac0ebf318e735930b01d8f586e34537bcff7d6196f494cdcf3a712078d745db0f5687a78ee6d000b3d171a0f08299b52d207f32e9da311ca090000003a42732808515eec574f892622c5be497fc3d9ca122d7c18b9e54637812c8debc61f0e42d838e44a819b74bce1a56108bb0f72c4a02475920532309c55b2c9ae9f281391ec5cc72a5e94cca1cbf1a706ec201eedfa5fbdb537a0c52bd45a9f966c25616cec30c3ea3246cb8e6aac7cf273638e6656a3e4ccadc348f0172028c99cc5f6d5c6d09ed65aa54549e73c28b7c8ad06ad3c5e3c27eec0eff1a6c84f1189919eefcee8072d1f88cb781e4cdb04af00ac92f1080211c4bee74381a0e31021918f27863fdbafb50f70857d52a1f7df51935a80b1980a4778d35f183ea517f55a98c5a471f3521956f8da6a4ccf2071095305701ab3f3ae43f06e91bc7d85e3800b46926944fba9805a985e63e53a62232fcd3f01dbe1728f300e247a7ebe344f9749818ff3961b2a42664ccd680a90bbb6ab400e286acc8f9febef64594777f848ed1cf980a3da2f0f7745760a05887d0c28060d613dd6539d392fc21fee0b5131609664b821d7a994e6c5965a4fa1ec1790c54e54586907dcc5a071ba22251e2de8bac16e79da9c2444d52facb7ab49420900000000000000f888a94365b99b72796fde1b922fc9ae09b526efca65faf1546c17cbb1d2d2fd12cb1a49cad501a3ca218c595b667b634606c57987ebfb0783a4948e4561d5cda158fe74453ff4a837be14d6a483842c57d6005b544b4f80003386edfd3d4a88a667bd41eefe0d808abed08a29e6bc370a80cc0366fb4080bfbaaa946fd47ab662c79c846e403910bbc3a48bb276cbb08a8eab145c06221ef16a238e3d50ad18aea9a2cec97d3c2d0569caabe2bffe02506bc9cb7294c5d020536dd5e7a6351642112df3b55d0215aaec7e45598995e79699e47567e353e68b03f82be860b188554b734e1192f9c1a867b815ef52cdc3307c0cc9be0000fdde69c350e59f11f1d26a4d04d8c8b2c4a4d23ee931d14bc7807db773a614b670acf46f83f7c65a0f8d43c5f647e1f0d27c46d4b686e867e9b0be76a7978a8f962bb5a070df97f2bf7612115cfe5ebdc7ad0bc5a5f3ace25347d0e5c347279d55aa67a967380000000000000000000000000000000000000000000000ed0942d980c754c6c69ef65c375ad018824f78b260d5f51bc3feba504408a8c8141d84f3f417603b5081680faa8cf38dbe4ae19e936511966965ce268b6345a0001c0f26a32e0a999fc869292e939dcf89b9bfd794f9c12d41959a00688cca43015a9eec58f647796adea520cd2abeb0b55c22949d10e5a05fee4543fdc1e02554a55b5fef2427a6e5708edc38fac53c2f961945a3f83cdf01979939b49bc6b1aef8c733401bbe473de8d64efbe0d123739f387d1c0d9e74f2175c174ada1678c7db79492e8dd0f34e2ccf419cf7f14ffa408b50a52685b36aed14aa22ad928191d5a2697646edc52a1c0c5d720ae690add2b34aed161f51cc1cb424f76098e1e1921e5a405f9d298a8461f2da30e47b7c6ed7c95c84c745f58723e4cddffae3b53b5b947f9435e589f9ae55b30ecd3827b2de5df31976870823da8058c2538c04e397f3d0ef90c11c74da984fa558697ecb57224ce8fa6f79aadbd7dbf3678e74d790bc2ee72769a3ada1dd504f8e4133ce1effd446bc9a2f139e65cc4bd83912af3122352506c7c2191b3705113a5ce1c99193886d6008d3565b00000000000000000000000000000000001c260fc175785ca04e31790f542c0f17b6599e93134792eae9878638b299e1d2b38d367be0d5c99d179c6bde265caebbae48bae74338f9d4f12f"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0, 0x0, 0x0, r3}, 0x94) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000580)={0x58, r9, 0x1, 0x70bd2d, 0x0, {{0x2}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_FRAME={0x34, 0x33, @deauth={{{0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1}, {0x5}, @broadcast, @device_a, @from_mac, {0x7, 0x5}, @value=@ver_80211n={0x0, 0x2, 0x3, 0x2, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1}}, 0x5, @val={0x8c, 0x10, {0x363, "0a905c8a42f9", @short="b63e294968214f3f"}}}}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16c1}]]}, 0x58}, 0x1, 0x0, 0x0, 0x4004008}, 0x4040000) sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x111200}, 0xc, &(0x7f0000000740)={&(0x7f00000007c0)=ANY=[@ANYBLOB="d0c949878991d48a1134379d263a9933d23b1e8d35c7c5da1341833e30b2e42d37dbbce39bed544190b3daa4a017f6b08f98e60f22449eaa64065abc00"/76, @ANYRES16=r9, @ANYBLOB="080026bd7000fbdbdf25350000000c009900ff7f0000080000000a00340002020202020200000a0006003b8028f0095f00000a00340002020202020200000a0034000101010101010000140055004e74cce275a3d32dbef81f5437af7ab80a00340001010101010100000a00340002020202020200001400fe00b3233a596859f58d8084511c757158731400fe0073d1871ea5e0357946c36f2c4e761749"], 0xa4}, 0x1, 0x0, 0x0, 0x4c010}, 0x4000000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) r11 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f00000001c0)="888155cfda6e47f7752e5bd14bdfc03947302a892460289cb28116030fee84fcbb1c7603c0a9550b02d16c6e17678e1f83588bedb43aaf7b77c41f9ce1479fb31ea14f1ae45c9ccf910a0560d64db3f3e434009ac35dd3c5acf1eacd5255c9a1e637c9d24bb42e513f84b868330f76933d07574b31653661eba769", 0x7b) syz_clone(0x40000, &(0x7f0000000240), 0x0, &(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)="affe5e926f9554a4a68e4d461fd7c37654ad096b5b8908b51d5831596e344c87bd114318b0892d0baac1a0c4b49efd2afde0cc5f2ce4e524fadf") connect$vsock_stream(r8, &(0x7f0000000680)={0x28, 0x0, 0x0, @hyper}, 0x10) r12 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x1, 0x0) write(r12, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r8) 14m17.214153838s ago: executing program 1 (id=1434): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x41000, 0x0, '\x00', 0x0, @sk_msg}, 0x94) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) recvfrom(r1, &(0x7f0000001780)=""/4112, 0x11fe0, 0x2080, 0x0, 0x0) r4 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0xa0040) ioctl$CEC_ADAP_S_LOG_ADDRS(r4, 0xc05c6104, &(0x7f0000000300)={"caa24bf7", 0x1, 0x0, 0x9c, 0x1, 0x7f, "361096f7b08a2ec290d12af17695e9", "ea5ada4e", "ef2a36e9", "0f3f1b0a", ["c7fd4ba4873c42b59549a56f", "f9eee13c2f9b1f6ae6a5d5e5", "84e22caa1bcc3b439d65640a", "c588cc5e4dbb4770ea784af5"]}) 14m17.088669502s ago: executing program 1 (id=1436): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000000100)='./file1\x00') r1 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r2 = openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) socket(0x6, 0x800, 0x9) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r3, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f00000005c0)={0xfffffffa, 0x1, 0x0, 'queue0\x00', 0x5}) writev(r4, &(0x7f0000000580)=[{&(0x7f0000000080)="268292", 0xff95}], 0x1) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000009, 0x4010, 0xffffffffffffffff, 0xc000) setsockopt$inet6_tcp_int(r3, 0x6, 0x8, &(0x7f00000000c0)=0x7, 0x4) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) close_range(r5, 0xffffffffffffffff, 0x2000000000000) recvmsg$unix(r3, &(0x7f00000004c0)={&(0x7f0000000140), 0x6e, &(0x7f0000000400)=[{&(0x7f0000000380)=""/74, 0x4a}], 0x1, &(0x7f0000000680)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x58}, 0x40010040) ioctl$DRM_IOCTL_GET_MAGIC(r3, 0x80046402, &(0x7f0000000080)=0x8e57) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffdfffff6, 0x4031, 0xffffffffffffffff, 0x7542d000) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r6 = syz_clone(0x211, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) ptrace(0x10, r6) wait4(r6, 0x0, 0x80000000, 0x0) move_pages(r6, 0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0) close(r2) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000004780)={[], 0xf000}, 0x1000) 14m16.384972227s ago: executing program 1 (id=1442): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000003c0)={0x0, 0xfffffffffffffd90, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="01072bbd74000000000005000000"], 0x14}, 0x1, 0x0, 0x0, 0x20004074}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000080)=ANY=[@ANYRESDEC=r0], &(0x7f0000000c00)='GPL\x00'}, 0x94) unshare(0x22020400) r2 = bpf$MAP_CREATE(0xe4ffffff00000000, &(0x7f0000004440)=ANY=[@ANYBLOB="0400000004000000040000000b"], 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000000)={r1, r2}, 0xc) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r3, 0x29, 0x19, &(0x7f0000000000)=0x9, 0x4) sendto$inet6(r3, 0x0, 0x0, 0x400cc8c1, &(0x7f0000000040)={0xa, 0x4e24, 0x2, @empty}, 0x1c) sendto$inet6(r3, 0x0, 0xfffffffffffffe58, 0x44800, 0x0, 0x19) recvfrom(r3, 0x0, 0x0, 0x2001, &(0x7f00000012c0)=@in={0x2, 0x4e21, @loopback}, 0x80) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r5, &(0x7f00000000c0)={&(0x7f00000002c0)=@in6={0x2, 0x4e21, 0x0, @empty}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) ioctl$EXT4_IOC_MIGRATE(r5, 0x6609) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='minix\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) io_uring_setup(0x1949, &(0x7f000000c480)={0x0, 0xc46e, 0x1, 0x3, 0x3}) r6 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$uac1(r6, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000140)=ANY=[@ANYBLOB="40000f000000012721dcfe14c639a500ba17162716"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r6, 0x0, &(0x7f00000005c0)={0x44, &(0x7f00000002c0)=ANY=[@ANYBLOB="6005aea102000040"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r7, 0x5b15, 0x0) 14m1.315424201s ago: executing program 33 (id=1442): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000003c0)={0x0, 0xfffffffffffffd90, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="01072bbd74000000000005000000"], 0x14}, 0x1, 0x0, 0x0, 0x20004074}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000080)=ANY=[@ANYRESDEC=r0], &(0x7f0000000c00)='GPL\x00'}, 0x94) unshare(0x22020400) r2 = bpf$MAP_CREATE(0xe4ffffff00000000, &(0x7f0000004440)=ANY=[@ANYBLOB="0400000004000000040000000b"], 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000000)={r1, r2}, 0xc) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r3, 0x29, 0x19, &(0x7f0000000000)=0x9, 0x4) sendto$inet6(r3, 0x0, 0x0, 0x400cc8c1, &(0x7f0000000040)={0xa, 0x4e24, 0x2, @empty}, 0x1c) sendto$inet6(r3, 0x0, 0xfffffffffffffe58, 0x44800, 0x0, 0x19) recvfrom(r3, 0x0, 0x0, 0x2001, &(0x7f00000012c0)=@in={0x2, 0x4e21, @loopback}, 0x80) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r5, &(0x7f00000000c0)={&(0x7f00000002c0)=@in6={0x2, 0x4e21, 0x0, @empty}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) ioctl$EXT4_IOC_MIGRATE(r5, 0x6609) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='minix\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) io_uring_setup(0x1949, &(0x7f000000c480)={0x0, 0xc46e, 0x1, 0x3, 0x3}) r6 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$uac1(r6, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000140)=ANY=[@ANYBLOB="40000f000000012721dcfe14c639a500ba17162716"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r6, 0x0, &(0x7f00000005c0)={0x44, &(0x7f00000002c0)=ANY=[@ANYBLOB="6005aea102000040"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r7, 0x5b15, 0x0) 7.165583421s ago: executing program 2 (id=7892): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@gettaction={0x18, 0x32, 0xd137acf432635e93, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x24000004) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {0x0}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000004c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 5.535107492s ago: executing program 2 (id=7896): syz_emit_ethernet(0x7e, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x6c, 0x0, @multicast2, @empty, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0xe, [{@remote, 0x4e210000}]}, @timestamp_addr={0x44, 0x34, 0x0, 0x1, 0x0, [{@multicast1}, {}, {@dev}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffffff}]}]}}}}}}}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x3a) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$kcm(0x29, 0x5, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3e, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume_offset', 0x100102, 0x50) sendfile(r4, r4, 0x0, 0x6) ioctl$SNDCTL_DSP_SYNC(r4, 0x5001, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000003c0)={0x0, 0x0}) mq_notify(r2, &(0x7f0000000440)={0x0, 0x2, 0x0, @tid=r5}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x9, 0x3, 0x228, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x190, 0xffffffff, 0xffffffff, 0x190, 0xffffffff, 0x3, &(0x7f0000000000), {[{{@uncond, 0x0, 0x98, 0xb8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@TRACE={0x20}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, 0xffffffff, 0x0, '\x00', 'veth1_to_bridge\x00', {0xff}, {}, 0x5e, 0x1, 0x6}, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x8000, 0xb, 0x2, 'netbios-ns\x00', 'syz1\x00', {0x8000000000000001}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x288) sendmmsg$inet6(r0, &(0x7f0000000340)=[{{&(0x7f0000000380)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, 0x1c}}], 0x1, 0x4) 5.135532012s ago: executing program 6 (id=7899): socket$pppl2tp(0x18, 0x1, 0x1) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r2 = openat2(0xffffffffffffff9c, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)={0x122240, 0x10b, 0x7}, 0x18) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000700)=[{&(0x7f00000003c0)=""/185, 0xb9}, {&(0x7f0000000540)=""/255, 0xff}, {&(0x7f0000000640)=""/82, 0x52}, {&(0x7f00000006c0)=""/14, 0xe}], 0x4) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r3, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r3, 0x0, 0x0, 0x400c80c1, &(0x7f0000000040)={0xa, 0x4e24, 0x2, @mcast1}, 0x1c) sendto$inet6(r3, 0x0, 0xfffffffffffffe58, 0x44800, 0x0, 0x19) recvfrom(r3, 0x0, 0x0, 0x2001, &(0x7f00000012c0)=@l2={0x1f, 0x6, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x1f, 0x2}, 0x80) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) write$mtd(r2, &(0x7f0000000100)="cd7c4daa4cdf16cd531009ba5eff0f240f755a297c1303864beea599f7241552678ee99443e00e83a1efe2f8c92eb8c6bd9cbe46d1a6e54d6ac9718353ba6788058b98158e407a4f60efcceccdb015eb4d447beb676bd0a7dc36a9bd2e6624c3fea33f5576deef821096d816af82737e650391f5bcc3ae05c0d262aba3a020eb8ab1b5ff6e8a03c77075f23f8440cd2e", 0x90) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000740)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMKSA(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000780)={0x1c, r5, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c915}, 0x8090) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, 0x0, 0x4) r8 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x8, 0x141102) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x100000000) r9 = fsopen(&(0x7f0000000000)='jfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000280)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\bb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xd7\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0xfffffffffffffffe, 0x8000, 0x4, 0x3}, 0x0, 0x0, 0x0, 0x0) 4.028316299s ago: executing program 6 (id=7902): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@delneigh={0x28, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r1, 0x0, 0x96, 0x4}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}, 0x1, 0x0, 0x0, 0x40081}, 0x2000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x4c, 0x10, 0x439, 0x70bd2a, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x3, 0x610c3}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_TTL={0x5, 0x4, 0xff}, @IFLA_IPTUN_ENCAP_FLAGS={0x6, 0x10, 0x40}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @empty}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4008040) 3.658125542s ago: executing program 6 (id=7905): r0 = fsopen(&(0x7f0000000040)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='%(,c\xbe\xfbL:', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='source', &(0x7f00000000c0)='%(,\xc7', 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r3, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmmsg$inet(r4, &(0x7f0000003b00)=[{{&(0x7f0000000040)={0x2, 0x0, @empty}, 0x10, 0x0}}, {{&(0x7f0000000000)={0x2, 0x0, @empty}, 0x10, 0x0}}], 0x2, 0x0) getsockopt$bt_hci(r2, 0x0, 0x1, &(0x7f0000000000)=""/2, &(0x7f0000001080)=0x2) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000002b40)='cubic', 0x4) fsopen(&(0x7f0000000040)='nfs\x00', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='%(,c\xbe\xfbL:', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='source', &(0x7f00000000c0)='%(,\xc7', 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) (async) syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') (async) pread64(r3, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) sendmmsg$inet(r4, &(0x7f0000003b00)=[{{&(0x7f0000000040)={0x2, 0x0, @empty}, 0x10, 0x0}}, {{&(0x7f0000000000)={0x2, 0x0, @empty}, 0x10, 0x0}}], 0x2, 0x0) (async) getsockopt$bt_hci(r2, 0x0, 0x1, &(0x7f0000000000)=""/2, &(0x7f0000001080)=0x2) (async) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000002b40)='cubic', 0x4) (async) 3.455428313s ago: executing program 0 (id=7908): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f00000000c0)) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x20004, r1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/lru_gen\x00', 0x2, 0x0) write(r4, &(0x7f0000000800)='+ 1 0 0 1', 0x9) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x1) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffffffd}]}) r7 = dup2(r5, r6) syz_init_net_socket$llc(0x1a, 0x1, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r8, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r3}) r9 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r9, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r3}) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000040)=0x5) 3.432923556s ago: executing program 4 (id=7909): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0b00000000010000081100000900000009"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000940)={{r0, 0xffffffffffffffff}, 0x0, 0x0}, 0x20) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1, {0xee01, 0xee00}}, './file0\x00'}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={@map=r1, 0xe, 0x0, 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x0, &(0x7f0000000080)=[0x0, 0x0], &(0x7f00000000c0)=[0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x0, 0x8, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x7}, [@map_val={0x18, 0x6, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x7}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_idx={0x18, 0x7, 0x5, 0x0, 0x8}]}, &(0x7f0000000240)='syzkaller\x00', 0x3, 0x24, &(0x7f0000000280)=""/36, 0x40f00, 0x7, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000002c0)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000300)={0x1, 0x0, 0x11ff, 0x9}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[r1, r1], 0x0, 0x10, 0xfffffff9}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={@fallback=r1, r2, 0x30, 0xc, 0x0, @void, @value=r4, @void, @void, r3}, 0x20) ioctl$XFS_IOC_GETBMAP(r0, 0xc0205826, &(0x7f0000000440)={0x8, 0xffff, 0x5, 0x4}) 3.305723859s ago: executing program 4 (id=7911): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x40, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0xfffd, 0x0, 0x4, 0x0, @empty, @private}}}}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000740)={'ah\x00'}, &(0x7f0000000780)=0x1e) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r2, 0x1) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x800) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000001c0)="00940a37", 0x4) sendto$unix(r4, &(0x7f0000000440)="36d9a32e92c131d730b1abaedb51eb66fd2d5b1f7eda4f0e859fdaf294bad70673813533d8bf1c6a77b65a7afdc01b29e73571071a68d5def5d7df839810da130b9348f4d9d407eb478d5bfb298c552a498271af70914e14ba9476fd2a0e47984c25ea20afab3064a748add27a7149e9c4705475bda2ecec9ec30214f28c5e16fd3f50f604f20232c534409e52bff64fc6ca0f5e254083aec2794b7216e002e87caf3d0fa7d04ff9e3b03e81595a04979594ff6ea888bf13de8e8f74c6178e31e47593732ae1a501ad3641d423195a788efdb643f50a8c8b9794a62f7b8dfa0fa7da9d391b92ce2a7f9fe0f9d584a3775f", 0x703d59595f6742a8, 0x800, 0x0, 0x0) recvfrom(r4, &(0x7f00000030c0)=""/4117, 0xffffffffffffffbf, 0x1, 0x0, 0xffffffffffffffb5) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x400, 0x112}, 0x8) renameat2(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file3\x00', 0x6) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000140)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000100)='%pB \x00'}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={r5, &(0x7f0000000480), &(0x7f0000000580)=@tcp6, 0x2}, 0x20) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FLOWINFO={0x8}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x12, &(0x7f0000000840)=@raw=[@ldst={0x1, 0x2, 0x4, 0x8, 0xa, 0xfffffffffffffff0, 0xfffffffffffffffc}, @cb_func={0x18, 0x8, 0x4, 0x0, 0x7}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0xffffffff}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x7ff}, @cb_func={0x18, 0x3, 0x4, 0x0, 0xfffffffffffffff8}, @cb_func={0x18, 0xa, 0x4, 0x0, 0xfffffffffffffffa}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x8}, @tail_call], &(0x7f0000000900)='GPL\x00', 0x6, 0x0, 0x0, 0x100, 0x29, '\x00', r1, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000a00)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000000a40)={0x0, 0x6, 0x10001, 0x2}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x2, &(0x7f0000000a80)=[r5, r5], &(0x7f0000000ac0)=[{0x0, 0x1, 0x4, 0xa}, {0x4, 0x5, 0x1, 0x4}], 0x10, 0x3}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000c00)={{}, &(0x7f0000000800), &(0x7f0000000bc0)=r8}, 0x20) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x18, 0x2f, 0x9, 0x70bd27, 0x1, {0x4}, [@typed={0x4, 0x19, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), 0xffffffffffffffff) r9 = syz_clone(0x1200000, &(0x7f0000000180)="244a992568bf88dd68c9e80762c6b708d1571187a9fdabb9dcf51edc9f4dcef5ff45a1b387ed7b462af6820ccf7be0d2796b65687838273422a5379aa9e71f2f4fc5971b7bfb096847dbcb2155687d62c196a423ecb4916f6f554ae6473e37af1897b7bc718b28bc9e2325b8d0a5449bc074fc334a83d3d5dc4b10a1dacba39a52227ad89be95e77650e53ea8ff5154e747f59c00a47a9b0bb6714f05e4a3fab0deb8ef9c3b06bf0acf635b6e96858b2b36c652851b5d7e315b4eb518e38d46a715a84ed5f9acb1a8ca8c48a8103", 0xce, &(0x7f0000000280), &(0x7f0000000300), &(0x7f0000000640)="923d5b075cc233e614e8976429ec89baa473dc79d57fe9d152c435ec22e69b86e614ae39b5034c8bae3fd926d86872bbf1f64bd45a584a3385188ac999a28fef8c8b429bc365ac8560c3fa4cfdf91393fb24c48c0cab5721c3497d24dcd3c82dcea41f91fec942dfd3e7a450685d0b742342ca5dd9a6a623aa9f47201a849a471a25bec840230b1ce5c4b93bb7c548ef835341fbe766a3a5bec5c21d17eb9dc0c20e0c8d7505a1a24f95ec9583a956a8d8166731345a24a1d119d1953246598aff452f294f32238274336965a0a491fab53b0f31ba5febd1e37a779ecabfce41eb") syz_pidfd_open(r9, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x70bd27, 0x0, [@sadb_address={0x3, 0x6, 0x33, 0x0, 0x0, @in={0x2, 0x1000}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x5, 0xfc, 0xe0000001}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x8, 0x0, '4'}]}, 0x60}, 0x1, 0x7}, 0x0) 3.175503255s ago: executing program 0 (id=7912): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@gettaction={0x28, 0x32, 0xd137acf432635e93, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x4}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x15, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3c}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x24000004) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}}, 0x40014) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000004c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 2.700585291s ago: executing program 0 (id=7914): r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000140)={0x2001, 0x1, 0x3, 0x9, 0x4}) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000002a82, 0x0) mount(0x0, &(0x7f0000000200)='proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r1, 0x107, 0x13, 0x0, &(0x7f0000007040)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x4000000) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000500)=[r0], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0xc00) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_USERDATA={0x5, 0xd, 0x1, 0x0, "be"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000c80)={0x2c, 0xa, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24048014}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000000104010100000000000000000a0000040600064000040000a99d97319639c5990e443ef82aa181f196d7d2956fd111d2a97d92c0a07104ef4f4d17fd68cd9dd2d09cdf550ed46415f7d00100d9dc211fe9d1d5e925d19cb1a1114e81b2c108233b8728a46bf9131b667332ec5948c7b808b07a51edcae20d8e234af639007fae5af760f28ab7a65b6a6ed97744e940c0f68170c871dc0e08bd3b7c0300"/172], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x44010) socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_int(r1, 0x1, 0x29, 0x0, &(0x7f0000000540)) r5 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r5, 0xc008561c, 0x0) writev(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001200add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f00000001c0)="ee64", 0x2}], 0x2) write$nci(0xffffffffffffffff, &(0x7f0000000680)=ANY=[@ANYBLOB="420106011f7cfe12f2fbdf1c8950446830d1916a20921b675fad3e23343360cd98025e0f0d03bf301650be664fc26bdcadba1238cb51b634d7170130ca3141ba98ea3be8e3fa7de550c42c232921d7f3639ec21e26171e8404314bd00a606b9212e77ed24e3083de1d3864a2d6bdd8d72550f515841da52ca9cf4cd0d9a4dd66d10009d8a74b5260c2e69ebb9ac26769929b5bff2f0c33aa078ea8d87a73fbc22a925a33d69356bce1016be2bd14e7f2196dea4c2010b8d8d3c7109f912467a7b140ff23429d4bb17ceee16e4e3859e592d4bc88072efff4297b1c91dd4f37cd"], 0xffffffe9) 2.657304113s ago: executing program 6 (id=7915): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@gettaction={0x28, 0x32, 0xd137acf432635e93, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x4}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x15, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3c}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x24000004) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}}, 0x40014) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000004c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 2.626020013s ago: executing program 4 (id=7916): syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4) r0 = io_uring_setup(0x1c79, &(0x7f0000000580)={0x0, 0x5be5, 0x20, 0x88, 0x32c}) syz_emit_ethernet(0x6e, &(0x7f0000000600)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000000000383a40fe8000000000000000000000000000bbfe0400000000000000000000000000aa01009078000000006000000000206c40fe8000000000000000000000000000aafe8000000000000000000000000000bb00001234000000a0ec37e45ceea300"], 0x0) epoll_create1(0x80000) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0xf, [0x0, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x1, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x298, 0x1, 0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x0, 0xd, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x400000, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x4, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, 0x18c, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x100, 0x0, 0x0, 0x204, 0x0, 0x0, 0x4000, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x2, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x8, 0x9, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x5cb9, 0xcaa, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7fffffff, 0x0, 0x4]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) ioctl$UI_GET_SYSNAME(r1, 0x8040552c, &(0x7f0000000240)) r2 = socket$can_raw(0x1d, 0x3, 0x1) accept4(r2, &(0x7f00000003c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, &(0x7f0000000440)=0x80, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/wakeup_count', 0x0, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000000020603000000000000000000000000000c000300686173683a69700005000400000000000900020073797a31000000001400078008001340000017e5080012400002000905000500020200000500010006"], 0x58}}, 0x4080) r5 = socket$inet6(0xa, 0xa, 0x0) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x4e22, 0x2ea, @private0, 0xe}, 0x1c) lsm_get_self_attr(0x64, &(0x7f0000000040), &(0x7f0000000000)=0x101, 0x0) lsm_get_self_attr(0x64, &(0x7f0000000040)={0x0, 0x0, 0xd1, 0xb1, ""/177}, &(0x7f0000000140)=0xd1, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="440000000906010200000000000000000000fffe09000200737900070000001c0007800c000180080001407f00006416cc682b9b5e4ced01290002800800014064010102000000000000000000"], 0x44}, 0x1, 0x0, 0x0, 0x10000057}, 0x4000050) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0xc0010058, 0x0, 0xffffffffffffffff}]}) connect$pppl2tp(r3, &(0x7f0000000180)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @broadcast}, 0x3, 0x4, 0x1, 0x3}}, 0x26) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xffffffffffffffb1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x0, 0x0, 0x0, 0x7fffffc, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.599442994s ago: executing program 5 (id=7917): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)}}], 0x2, 0x40800) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000240000000000000001f"], 0x14}}, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$selinux_load(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) (fail_nth: 1) 1.945153492s ago: executing program 2 (id=7918): socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0x10, 0x2, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240), 0x120040, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r1 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000140)={{0x0, 0x1}, {0xf}}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="3567130e14dd6c8eee45bae9d6fc3960093bf2f3cf767f16dc366ec808e69ec254a127e1654f4b437080f3c76fc4ff3cdf09e015fbe1f3ecd69aecf48b86f4af3a57d151d64b91401617c91375f3dcaa77ef898d4ec45eef6d4a2caa5ac758ffdc26c229d1ae0d59812b201b90f6eea36a950921c6fb3825321afc9dbba00e0828fd8d0a5098f8fc232825ae0d7124b1f89e4d3d3062fe2b2a6e0821092c36fdb9704193550251c436663606437e2fbecbac5f1fc1c11c4e60ada8055bd3eda2c8c2d4dc68d9c6c67730786657d7837add5a92dd87efc8ba1a3ca4644948bc59c7d5bb4b24886b6b3e26c54003113ff0a954cd50dd6090ff93e4a75b74148d", @ANYRES8=r0], 0x50) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) write$binfmt_misc(r4, &(0x7f0000000000), 0xd) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, &(0x7f0000000240), &(0x7f0000000380)=r3}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) socket(0x2, 0x80805, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r5 = io_uring_setup(0x1b78, &(0x7f0000000040)={0x0, 0xccdb, 0xc000, 0x0, 0x20002fb}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x29, 0xfa00, {0x1, 0x0, 0x111, 0x9}}, 0x20) r6 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0xffffffeb) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1.667899965s ago: executing program 6 (id=7919): openat$sequencer2(0xffffff9c, &(0x7f0000000040), 0x80941, 0x0) (async) openat$kvm(0xffffffffffffff9c, 0x0, 0xe8381, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) (async) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x5e, 0x2000) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000010000', @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r3, 0x29, 0x1b, 0x0, 0x0) (async) mkdir(&(0x7f0000000080)='./file1\x00', 0x8) (async) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') (async) chdir(&(0x7f00000000c0)='./file1\x00') (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r4, 0xffffffff80000801, 0x0, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) 1.592491523s ago: executing program 5 (id=7920): socket(0x10, 0x803, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x39, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25d7dbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x7, 0xa, 0x4000000, 0x70000000}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x50}, 0x0) close(0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xc, 0xa, 0x0, 0x5}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 1.57361686s ago: executing program 0 (id=7921): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$kvm(0xffffff9c, &(0x7f0000000400), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_PIT(r3, 0x8048ae66, &(0x7f0000000000)={[{0x4, 0x200, 0x8, 0x4f, 0x8, 0x7, 0x3, 0x1, 0x1, 0x6, 0xc, 0x4, 0x9}, {0xa, 0xaef3, 0x80, 0x8, 0x4, 0x1, 0x4, 0x3, 0x0, 0x13, 0x1, 0x6, 0x10005}, {0x0, 0x7, 0x10, 0x10, 0x25, 0x2, 0x0, 0xfb, 0x4, 0x15, 0x1, 0x4, 0x40000000000002}], 0x9}) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c5912c1", @ANYRES16=r5, @ANYBLOB="010000000000fbdbdf250700000008000b0000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40014}, 0x0) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x6, 0xffff, 0x0, 0x7ff, 0xfffffffffffffffd, 0x4002004c4, 0x1000, 0x0, 0x1003, 0x10, 0x0, 0x4, 0x100000000000000, 0x8, 0xb], 0xc000, 0x2011c0}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) io_setup(0x3fd, &(0x7f0000000500)=0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000690000/0x7000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000ff1000/0xc000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff3000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r8 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x4001, 0x800000c1}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r8, 0x2219, 0x7721, 0x16, 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x26) ioctl$KVM_HYPERV_EVENTFD(r9, 0x4018aebd, &(0x7f00000002c0)={0x4, r1, 0x1}) io_pgetevents(r7, 0x1, 0x1, &(0x7f0000000100)=[{}], 0x0, 0x0) io_submit(r7, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfdfe, 0x400000000000000}]) socket$nl_xfrm(0x10, 0x3, 0x6) r10 = socket$inet_udp(0x2, 0x2, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r11, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="340000000104010200000000000000000200000005f91400010000000800054000000002060006400003000008000340000000c1"], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x880) setsockopt$inet_buf(r10, 0x0, 0x25, &(0x7f0000000140)="5ffbe6d41a96ffb25e8e734ae230ccc09a87cc7b15cb8616a69039596b6d01551b7593be0dd515fa696b640252e70e21cc709439990376bba003637376a76efde609fb29ba3d6b047db8dcff6b2ec4d076b811a1726dee8b54b2b1bd760c737b949114865beaa2db82b6eb8efacb4988debb23ad2c167bcfb648ba9ac4d4b035a202b530c5b7096e404db4de94b9dbed9b7e7b5a599d5b3d67c37f86fdb80f9468b789fdfa7b41f2d946a7dce07c6f25de478c158c4475b8eebd821a08e62929282203c2992f6f0ff4", 0xc9) sendmsg$IPSET_CMD_FLUSH(r11, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="600000000406010200000000000000000100008a05000100070000000900020073797a300000000005000100070000000900020073797a31000000000900020073797a30000000000900020073797a3100000000"], 0x60}, 0x1, 0x0, 0x0, 0x20004000}, 0x20040800) 1.410889701s ago: executing program 2 (id=7922): setns(0xc9, 0x0) r0 = socket(0x2a, 0x80000, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x400261f3, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) io_uring_setup(0x4030, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x56) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x20, 0x10, 0x439, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, 0x49801, 0x59ec9}}, 0x20}}, 0x0) sendto$packet(r1, &(0x7f0000000400)="05d936277c6f5422007f83477ca1b278e3e4018a34e7bfd3de1a00ad6762646c95c716727eb53b", 0x27, 0x40880, &(0x7f0000000200)={0x11, 0x86dd, r3, 0x1, 0x4, 0x6, @local}, 0x14) r4 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/18], 0x48) r5 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r4, &(0x7f0000000280), &(0x7f0000000a80)=@udp6=r5}, 0x20) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) 1.127025428s ago: executing program 4 (id=7923): socket(0x10, 0x803, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x39, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25d7dbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x7, 0xa, 0x4000000, 0x70000000}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x50}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xc, 0xa, 0x0, 0x5}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 1.126543714s ago: executing program 6 (id=7924): prlimit64(0x0, 0xd, &(0x7f0000001200)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x81) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x8084) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a31000000000c00078008000640000007010500050002000000050004000000000016000300686173683a6e65742c706f7274"], 0x5c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000ffff00000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070011000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x20000880) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) mount(&(0x7f00000010c0)=@md0, &(0x7f0000001140)='./cgroup\x00', &(0x7f0000001180)='squashfs\x00', 0x20001, &(0x7f00000011c0)='-{\x00') setxattr$incfs_metadata(&(0x7f0000000480)='./cgroup\x00', &(0x7f0000000280), 0x0, 0x0, 0x0) sendmmsg$unix(r4, 0x0, 0x0, 0x0) sendmsg$NLBL_CALIPSO_C_LIST(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001380)={&(0x7f0000001400)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00082abd7000fddbdf2503000000080001000200000008000100020000000800020002000000080001000000000008000100010000000800020002000000080002000200000008000200020000003443c203348cfa3515f4c1829cd88b5f2d60bad6294f30a6b6c1e9182d529d2f99b6c1f78b4c899a9231c6174bbf2b4edc7e925d2058455594126cf34259379c0212d3eb5f24f1b062dba994573a4680d113d425a127ddeadfcf374954fe38f5267c653fcdc91a1c16f571aa3e8b4675a3d791edcc86e0d215bdbf"], 0x54}, 0x1, 0x0, 0x0, 0x880}, 0x8804) clock_gettime(0xc, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) sendfile(r5, r5, 0x0, 0x3) fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000001c00), 0xc) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x80}}, 0x0) dup(0xffffffffffffffff) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000080)={0x18, {"a2e3ad21ed6b52f99cfbf4c087f7ac9b36096eff7fc6e5539b428f0e1ac6e7049b346d959b189a242a9b3ff3988f7ef319520100ffe8d178708c523c921b1b25470a169b63d336cd3b78130daa61d8e81aea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae193973735b36d5b1b63e91c00300300000000000000b1dda98e2d749be7bd1d020000000000000075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490843bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870242f5e801000000005b6bfc821e7e90af2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0f1f4f674f3f39fe23491e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ffc4ac488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b412435111c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269caf12c31357c8219793e9639e1f59c0ede26c6b5d74b078a7315c31634e5ae098ce9ee70771aaa18119a687974e7b4ab01b7f73483b6a62fa678ca14ffd9f9db2a5869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da3710ac000000001a527777a5371f87d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1388dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe8a3c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be1200fdc4e9134f77020000f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f103000000416d594c3f0008047096a44060bebc2420aed92fa9b6578b4779415d97b9a6d601005c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac292d9e53803ed000000009737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df34959eaef6572e1e007fa55a2999f596d0673f586749b25f5a448427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3eff1b0ff034ef655b253ca050083815b1b6fc6522d4e4fdcf3a38cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d0100d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441984cb51682a8ae4d24ad0465f3927f889b09114edb8e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca4051c2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfd7b2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb67ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe529003d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f236c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb4483f070077d443e8b40426db6fe29068c0ca3d3414442e863a154504b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071b9397b033a53faf46366e7205dd8d6f37525c1a0e94610dd94223f6c15d07f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85e654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef928ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971f41488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b405177548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd84e935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6144345f48843dd014e5c5ad8fe995754bd1cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f87a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba30b4279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463181f4b87c10772d2b13f7809959bc048850613d17cb51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227edff2de20a4b8e3737fbb42913777c06376f799ecb767d6f84fad6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b30f0b932a4d02da711b757fe43c069595e4e98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb92c2ed3de5a8a8f0011e80e0082d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d0000010000000000fcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a10010549820a73c8839475f732ae00398e4bd1f4908b7807fb33b72685ec37a2d3f766b13a60459716246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d080e8ac32a308e15fc37d06aeac289c0523f487e1ff7408c60edddab652f2ef91d4f2b01987b0f46e4034e5c3f745a7ee81087dc746b0827cbf652f406c6b95f2722e58c05f352ceee26596e784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed704887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f0cfc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea62839b4a7dde4dcb61fea6ff7ffb1d62458d0741a12830052fcc460db043afe520629b40d7cee65802cb5e930ed624806c4380b6dc9336d07c2b8081c188d26558f48261f7897084c2a1a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30842b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c0ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2bbb935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f7150b704c971439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264c7b34252600c9654e502dcea39cb0800eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc640df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c0bec664bff000000000000005d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e975be53f8d2a1dfb1c6000204b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f04817fb909729a7db6ff9576abc9ede7886294ff1aa7082ead01a9b03c37b0969be0bff60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058093fef86faec216eb6992162f8dcbf6c9c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bccf8bb0d872a02238926407a4eddd5d0fc5a752f9000000000000000000000000000000000000000000000000000370f00", 0x1000}}, 0x1006) 1.125115946s ago: executing program 5 (id=7925): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f0000002300)={0x0, 0x0, &(0x7f00000022c0)={&(0x7f0000002240)={0x1c, 0x140f, 0x1, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'ib_srpt\x00'}]}, 0x1c}, 0x1, 0x3f000000, 0x0, 0x8044}, 0x8) 1.117674525s ago: executing program 2 (id=7926): r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x32d1c0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000100)={0xeb, 0x0, [{0x1, 0x0, 0x5, 0x7, 0x800, 0x7fffffff, 0x2}]}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000000)) syz_usb_connect(0x4, 0x2d, &(0x7f00000000c0)=ANY=[@ANYRESDEC=r0], 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) io_uring_register$IORING_REGISTER_SEND_MSG_RING(0xffffffffffffffff, 0x1f, &(0x7f00000012c0)={0x28, 0x8, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x8, 0x1, 0x0, {0x0, 0x0, 0xffffffffffffffff, 0x80}}, 0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) r6 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r6, 0xc0945662, &(0x7f0000000180)={0x5, 0x0, '\x00', {0x0, @bt={0x8, 0x2, 0x1, 0x1, 0x10000, 0xb97, 0x4, 0x5, 0x400, 0x5, 0x2, 0xfffffff7, 0x86, 0x1, 0x0, 0x20, {0x426c, 0x4}, 0xf9, 0x2}}}) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0xffff, 0xffff}, {0xf, 0x7}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x18, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x4566, 0x4, 0x1, 0xd, 0xc, 0x19, 0x6}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x48801}, 0x0) writev(0xffffffffffffffff, &(0x7f0000001180)=[{&(0x7f0000000100)="aeeab98b47de1e2dcb25c1b5bfa3c9fab751b5bfea252d4fac229b66777386e0880392defc9c5fc96a2529451783fb510d61ccd62b37f85f2c1733a5e9404296c80bb371b55d593572e2bb2226dec9f3e99fc24774fcc6e7f2962df67f", 0x5d}, {&(0x7f0000000180)="13e74be867652269dc683e59a081ca83a274b70b38ae8319898692f0d8a3cf7946a41105e590c04d70ed018bad292e964331f64abf2f08ffcfddb0a22dc20cbd9f8e38d07b86e8ce286d590912bf040cdfc1d2380b6d43b33f04026d88c0de4b9ea55d87157b87831a0728b12e293143826bdbb3d559666c9af7d94c573097734870bacd75e7adf75dbac398794f0c5016c5490ca9e2f79f78d195bd62703b383921f59b340ff2a2f9f10c658f7618e1682287c87b7b1b0f65333b4f5d372e4ec7244499e3e85c00a9cfad4c401a861f797bda4105b665698b080518d9f1ad2ef5caa681b207fcf24e7740cc04a5a2ce9898260a13f5b7dd3ef2dda97724becaef325225bbd5c6d22de4f243a361e920a635c3a517e72813480ef831082b04010f414792f30019bffd25c2ae537b0326e1d3f4772b928678c5b24942151b93ab46d8beb22657ff832608e16592349966d74386841c9b13f43db5a285aa837a6637b5275cfc040c8d6166142ab6ee4450f60c2ab392e53b58c70fa271b6a17229358af0a0af0399f976c52f0a7cd3a3cd0760530c6402ed107374cc9ae5b3f258b2c6cfb9d7b3d26e9d01e0bd3f7fc0044e108efcfb37bba1688c242b140df346aa65175fda1b62499f2e67cea5c2e204e7b99f9306138e8e5daed9d0754d172c7ec81f69d4fe317b61ed8ef8c7ad045412817f1396fcdcda75d8f57657c90251b852236ee932238302ffa89d4c411e751ba5f13d4be82572f4c84b69b7294272233814bf4276b1933971540fb4047d1263dc1872caeb5f46d630caacef9612cb329445aad584c8f85b81d57020df0f7d4b092032aeed3ff11a53ff6031cea5ad4e222beeea3f04ef5c7c0e420674071ddbefc1600a801e9513f457ecce86678bf408110f435333ab46c89b4f9be437b65b2cd4afcfb70268d726685dcc8891425c3f30cf934cd1167dcd7edf5ae9c0d11a84fedb261b671173a06f697e1dcb5fa9ac98a47782bad6a8903d5255455075b28519edb84087fc40787abeff3d352a74a286147bb40beb482046531f819d2ef1c7d5c84ccb9eaa4cf6abf06802e63d75071cb422889ed6cb823d84ec70ab6b733f1a9fe9044189b73d4e06d47a90e69a5f3fd525a7e9ce42a1158b843e49bbedfe791976a8e03c9c3e8a2e01623272dc095dcb7ac6deadbd17fdcf519164ab63599f59a08c6206eb392a4d94dfaafeaf9d2edb0775bf6cd60c97a2c21aef4ce211c842d613524dfe54ad176e0b76165f2282b46024401bbbd6a2ab68d1ac485ee87f3ca1caccf95e900bb16a2e907d8f19defb07ce3b2971b88cfa9165ef6886e3c34c6ba6400ecb1f522963d54ff88641e0fbdf33a8c87887ca2657c36dc16bd45f2a8ab2db81e64a01f4f3c76f86ffa226c8f1523afec17082f791a20b3d8ac8aeea1769c47e6015ba2b0611da4ff4c080ac7c1e3a3bac2db4ea702906344e040317ebde2a0762efae5191dfb755d08b9ff5ba4b4de0b71e0cf4c8b67e789f39f345e9b436467d1c718ad99b6ac7840c684e17a823412a2a3751dc05b745f35b1cf3c856a05385b28d549854e21cfd87c7888bc40f650694d6768fb355c6a4a0da7ac42ce8b33421764fcc048c1284f6d10bb987a78bbe5263621beb1dd9f277954c9fbf6a164c858292417a9ddedda49354c16ac2277a34002c9079abdb86af4b8de846c0557c7019bdc937123e8bb1d2ae8b6f959c8ada61599e6af22be848a1eb7cfec8bcbcd07498acbf4e62c97ce3a37ebd5e214a81999cd82b7ecab2d452f680f4ba112429cd4f7f23e5677cbb984137e87f414bdff41515c6e3f5d4f39ba7c8e430addb1b9632083b88b0e1e6a97a9aa5b4d297a0420397e25469dbe979583542478e5832dc0c31fee1f31a264e6efaf4a07e66c46f910c76c95b8f59d5b41ab6527038d51b9f53c2432c4c0f0f3f7c672d6cd5c3367ac443c0565c1727b18ccc4dc6a3559aaaf1209aef26e3760021adfb2a544aadfa8e15bf7a11fe1048b49ac343ca498164c54e5df9e3504310137d6c282d4955d423a52601387cfd33e02370ae60a481940b3b785b79b58b5303a7b396621412dcd8b883f54f53f4a8c1ddbc94f038f1cf641481514e6bfc010fbc1a83925f7bdd6a5907ad4b49b8856e4bb6bcb1553204cb69a80de490cf59c5bb1d2ccab1245fb46f8b6b4b400703e877f64b619e0857ea65bf6936b4ee7bda70aca935a542eef576fdf3844011332d76279b1d999436cb0768540c01b26aaa704009ffdb296eae3c3b6cbcc81065d7be73019421f075a2e7c6be1c100552d354f1ff9eedc08bc85af792314f27fb1da66e8f5b8415c8597b9991e1fb0ce2fddaac04e4b04962606f983a2819295fb557f37946c6d48696f8dc4387794c27f1d7dcee6e029a5d6a7c935155ff440b66b4d1f2dabb9eee2906c22388ff0488f8ef887642371a114860011cfb542f4f80eb5be8b8d864dee064ca08ec215fad2f68697be7549a0dbb81ee74c9e3b79cc07ad2660915f1bd580838e551de9d7af0307231f1b181c37d77442fbc2f1eb89f85119a9ce46eed97c7ad161c1def92737e148126c3f7a6c2dd90a7b2d8a06b7aa32c6979aa3eeead44d8c67068e490f08b97711cb7366d6149d21a285ef7325e65826533cc2aa99193a4b827550a474d5700bfe08836053c86dc9ab1b8b7cd360402cc1a341fc9c7510ad879dacac2a1d27906309e87acaaaee5747b5b54422545690536c1bc7b614163b2607787235455d65a3db557e1fd5f546c9c5c2e66de434814c38aa1ee20aea8df60653fc1739420a7b511356332e95d1e3bb0b1915445b62ccbdce10b31e25027ff725551fc7b16b03265d3f2f3a0dfdc06fc6a1348f3ac34c468b95f5b187bd2c40df4cb1a2da200b05fe915627e0970614f127e9d60ded3d573468cfef6d2bee547832160531b73aeafc047a51abdfd6a10c5b0702f1205ba17935bbb432ede12afdab0279427bfc9f587a948b5f1240f28ee52dba74849c74fbb02d60a56b6abf8b7bcee7b914d16572cdf181dffeff82e59f2bf44a3615de8e0216afbef134fa033923ee3ad37725d22153fc4448f198a0df838c86d969fc5d453b41202f1762dc5feb2654e68e060306bb89cad207b71dc5fe1c7566a7c2d2bfac8c41e707ca2af01bbcf42e60184166a481740d92f88605c68e1247c2bcbd98edecb7b3f1a4892ae6c014a9bdc153f427bc91d794028d20aa9f0f45c7606ec69ead0e3665553245beb24e11b365fc524dcef6ad0d208195b7feb207dbb4e4d121c25a2917066d70a6e26d7200af0848fed0012ce131597030dbc3bd44b138da0ab7023aa1ec9bef519daabf95a54244eddaab7f8c2ca4b9b2afafb31d4bbb2dfb1809a4302ada2de834dd839fb481239791b3a13e6cab05742ff162d318544c3a7c5341b0ce7c1cc70d4c6c924558fa2fefaa3a2ebef0bad366b4d27e1b14cd05a188bb4f8fe1afe84cf3a8a4ed632369c862c2a506e60246435cb81350b09c2ff5d55d57686b92ab7e28737f3b2336780a45fcf283470e605bd9c5d1b214dddbb53f0b9b3fa4a022fe1e7541bb377833dc340f69a6e8ab7f4d506805c9891a083df7c7df0c84c265f804a3212cee7eac93f3c80c283ba029f3339a5a5d84de5d284ceca3611c98cefa092d58ef1b27ffc7944dd4221f82c502452a3fdecfcb6723d2712406866937f236c6d391f0581418b4c2aa789dc06e8c60f706113b48067587c7c05b69565c8cdfaab90bed1155ebaf0fc92152b403f6221aeac41d5112f4bd91f5b69ec11aa5e72c5ddf2cceade64c29f2cd29832fc83d980e1b7b14be62cd9b551c59f33425d2b161c695b94854c3c9bdde651f5a5cc1901d909d80841f33dd823082b4ea0f582e2d961ea21dffe4c4d03cf78796e5a43e41fd4d49d6370b7af705cc7afc9b3f50fba3e378da100e30a44c1f282cb9c788719f0062c963fb5b6245f6d3d1d423ee7e18c04493d3100f8efcc282deeb6ebc7603dc8b0aee7b0b923728575d2e11a3a2abb4295fd135efe53976d326d131dbea1687f904b77b85f25d4d0642e9abf2fb83c2e78808fb6683b127210837480e3742688f05225f1a17dcbe4c72acae146cf2738906fd1294e841e111551e84ab6faded0ed3a004c60626a20996716832c9f31d1c3114219ec34f26cf9cde632bdd86b93785a010fe168eac7b20da77c34d505068ef59e259b7f9c60ca2d3d8effd2cf480d141f8f3f4880c5d4437e06144aeb4352247c0723a2d4606d4db623b3671e2591e714195935c59be94d3524683aaf77d2980612a39e7b0afd1a16dad6c1070e91a52db4db085fbf76520526c65e4b27a3b2c36a05258484d172e8c473f2ea4f03a79206767ea8f7df0f75edde7a93a549540db7d8ee94588b336f3f365c7798fde8edcd12f99e999c135467387118ecbd548b6d52ceb08cc43a351a1cc84addb258fc0da7318739d290cea692b15b10522f8fa6b42537ce83fb636f861e1c0d0a153e9c605f4eaa00b6e3bed9a7ac5ecc677fdd8f825a9770bebab980189ce74301385559559b86ec1d3a536cdcddecd403a62bb66b45f1b0781c17de478a856de7711a2a511502299727e81fbea3e4a6c7051b225474c10437652cb35520fc739dfe9b628c8ee50acbbf7b00a6340803f6aab3462ccdf7976c27b60520ebfa5dff72bc63683eae4c5a452df73f1c9b94dde2c892c25a5565436b0700d037546897ef9b8d0e50d224c7f4ca9ed5dd0b2e01f4e00a45f721663a535a0db34e3109b90bbc2735b543223e287efa7494053afdcbf812d4eb2164398cdc8128784582fc0a4291b23beda907781cfca9cc941ae359f4fc7459b528887b9506d07a0cbe3adf49c926aaada165169e994260b20a1e743ceff7cd801814d3a25f41273da94420de036352bfc50a7de972bc461467d2b7a1916cc8ab0a609d1dc79265ce3ff9f548a9824f0d1c7a5a62e6057f1af53e11c09e48632b5312e2dee3fd8e911fa614657e8d740e281aba92cce427e30db5b7ead055f988b2f0fd7d536b39ad6305058c1b31f380043fe95b8b0b277aeffb240d3c00c909db89e945ffc68829afb36d211113872f99e3498052eb138979e49e133e616ebe20daeaa832bcfa6ff3421b4d15d0e1e06e9b5ebc94bc2a20ca10ccae5ba33fb25e3919ff3f018325aa68b2a700719362736a60533acd4f1bf74666106816360d6092cbec0fe6f8cf3badeacf72a46b38c59d765a0f9976c360ccf1b8375e7e35e010a54cfb11db5e9bf8ec86358d906a946d7c0c13782ee49235b173acb3f017fafb259ab2bc99f86d63e05fd219a69a3cd80630cf23a2b7fdcf9fa96ee151d30980eae08003128a3033db711fedf364e137d0bb858f5b5bf89f84a3e8d924e4cce3d43aaa68cb6ae4460b11406cdbe5a5ed446a5a31580db10a31bcf76122a4f82157c7a31590946261164e5f5103f3a003720803a3ab2ff1b5cf8f7585d48c66fe10fcd672e886277780019fcc477989df55eb4e67c5fe669df5617ae3c7794d965163dd80b788203ccc2f179a518c0da466103f5c9c17038d3045695bc6f8a5df7160237122b8b3e7e2f41eb8e85bd4555d6ac1edf227d02f8df51569c6d17219f8830d5ecb7f7d6c8918eeeca1a174098e9fc18f16165c66f0fe5a21aff5a32149fd358bbdb0e09c784326e8a1991e731721437e50b4dcc658dcd32bcfce23b86e0d004a2f61f1dd1869cf188ef2381f1f8423e1b51da9a470ca68ec6e0b78b5d930fdaccd059f197d8707", 0x1000}], 0x2) 837.462758ms ago: executing program 5 (id=7927): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a", 0x27}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd", 0x59}], 0x2}], 0x1, 0x40800) recvmsg$can_bcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)=""/26, 0x1a}, {&(0x7f0000000440)=""/131, 0x83}], 0x2}, 0x40012030) 694.747217ms ago: executing program 5 (id=7928): setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x40106183, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x3a) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0xfff, 0x4000000007}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) 205.401975ms ago: executing program 4 (id=7929): r0 = syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000880)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="030027bd7000fbdbdb250200000008000100", @ANYRES32, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x20008000}, 0x4004044) 141.76967ms ago: executing program 0 (id=7930): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a", 0x27}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd", 0x59}], 0x2}], 0x1, 0x40800) recvmsg$can_bcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)=""/26, 0x1a}, {&(0x7f0000000440)=""/131, 0x83}], 0x2}, 0x40012030) 117.998211ms ago: executing program 5 (id=7931): r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000140)={0x2001, 0x1, 0x3, 0x9, 0x4}) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000002a82, 0x0) mount(0x0, &(0x7f0000000200)='proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r1, 0x107, 0x13, 0x0, &(0x7f0000007040)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x4000000) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000500)=[r0], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0xc00) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_USERDATA={0x5, 0xd, 0x1, 0x0, "be"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000c80)={0x2c, 0xa, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24048014}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000000104010100000000000000000a0000040600064000040000a99d97319639c5990e443ef82aa181f196d7d2956fd111d2a97d92c0a07104ef4f4d17fd68cd9dd2d09cdf550ed46415f7d00100d9dc211fe9d1d5e925d19cb1a1114e81b2c108233b8728a46bf9131b667332ec5948c7b808b07a51edcae20d8e234af639007fae5af760f28ab7a65b6a6ed97744e940c0f68170c871dc0e08bd3b7c0300"/172], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x44010) socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_int(r1, 0x1, 0x29, 0x0, &(0x7f0000000540)) r5 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r5, 0xc008561c, 0x0) writev(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001200add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f00000001c0)="ee64", 0x2}], 0x2) write$nci(0xffffffffffffffff, &(0x7f0000000680)=ANY=[@ANYBLOB="420106011f7cfe12f2fbdf1c8950446830d1916a20921b675fad3e23343360cd98025e0f0d03bf301650be664fc26bdcadba1238cb51b634d7170130ca3141ba98ea3be8e3fa7de550c42c232921d7f3639ec21e26171e8404314bd00a606b9212e77ed24e3083de1d3864a2d6bdd8d72550f515841da52ca9cf4cd0d9a4dd66d10009d8a74b5260c2e69ebb9ac26769929b5bff2f0c33aa078ea8d87a73fbc22a925a33d69356bce1016be2bd14e7f2196dea4c2010b8d8d3c7109f912467a7b140ff23429d4bb17ceee16e4e3859e592d4bc88072efff4297b1c91dd4f37cd"], 0xffffffe9) 93.956345ms ago: executing program 4 (id=7932): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x1, 0x2, "001200", 0x7, 0x7}) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5200000002"], 0x8) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x1, 0x2, "001200", 0x7, 0x7}) (async) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5200000002"], 0x8) (async) 21.033012ms ago: executing program 0 (id=7933): r0 = syz_open_dev$sndctrl(&(0x7f0000002b80), 0x1, 0x8000) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0x80045500, &(0x7f0000000000)) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x10, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000001000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002008000850000008200000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="00000000040000090000000000000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b70800000c300000638af8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x16, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r5, 0x5, 0xe, 0x0, &(0x7f00000000c0)="469dc2d342e2b7000091000000000bcf48f3ac4e19a56ceb0b42c0", 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x22) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0x10, 0x38, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040104"], 0x7) 0s ago: executing program 2 (id=7934): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x3, 0xb, &(0x7f0000000000)=ANY=[@ANYBLOB="1802002002000000000000000000000018010000756c"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r0 = socket$kcm(0xf, 0x3, 0x2) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000100730109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) sendmsg$inet(r0, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a17c45c8d260c9", 0x33fe0}], 0x1, 0x0, 0x0, 0x34000}, 0x0) kernel console output (not intermixed with test programs): dit: type=1400 audit(1786151305.270:3791): avc: denied { write search } for pid=26822 comm="syz.0.7276" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 1058.227660][ T951] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1058.249407][ T29] audit: type=1400 audit(1786151305.370:3792): avc: denied { search } for pid=26822 comm="syz.0.7276" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 1058.277371][ T951] bond1: (slave gretap1): failed to get link speed/duplex [ 1058.325516][T26817] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1058.356713][T26831] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 1058.385895][T26817] bond5: (slave bond0): making interface the new active one [ 1058.431462][T26817] bond5: (slave bond0): Enslaving as an active interface with an up link [ 1058.498226][ T951] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1058.571728][ T951] bond1: (slave gretap1): failed to get link speed/duplex [ 1058.602385][T26837] netlink: 168 bytes leftover after parsing attributes in process `syz.5.7280'. [ 1058.686417][ T5329] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 1058.701688][T25540] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1058.728424][T25540] bond1: (slave gretap1): failed to get link speed/duplex [ 1058.758561][T26839] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1058.778875][T26839] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7282'. [ 1058.965870][ T5329] usb 3-1: Using ep0 maxpacket: 8 [ 1059.206726][T26844] syzkaller0: entered promiscuous mode [ 1059.228574][T26844] syzkaller0: entered allmulticast mode [ 1059.285487][ T29] audit: type=1400 audit(1786151306.400:3793): avc: denied { ioctl } for pid=26847 comm="syz.6.7273" path="socket:[107431]" dev="sockfs" ino=107431 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 1060.233850][ T5329] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1060.247408][ T5329] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1060.267373][ T5329] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1060.289005][ T5329] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1060.347560][ T5329] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1060.377689][ T5329] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1060.400565][ T5329] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1061.159890][T26872] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 1061.262617][ T29] audit: type=1400 audit(1786151308.340:3794): avc: denied { append } for pid=26873 comm="syz.5.7290" name="loop6" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1061.302893][T26876] usbtmc 3-1:16.0: simple usb_control_msg returned 0 [ 1062.143988][T14763] usb 3-1: USB disconnect, device number 59 [ 1062.413939][T26896] kvm: kvm [26894]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x4000002a) = 0x4 [ 1062.788255][ T12] net_ratelimit: 48 callbacks suppressed [ 1062.788273][ T12] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1062.842515][ T12] bond1: (slave gretap1): failed to get link speed/duplex [ 1062.977476][ T951] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1063.011552][ T951] bond1: (slave gretap1): failed to get link speed/duplex [ 1063.047373][ T981] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 1063.178655][T25540] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1063.213671][T25540] bond1: (slave gretap1): failed to get link speed/duplex [ 1063.237421][ T981] usb 3-1: device descriptor read/64, error -71 [ 1063.361312][T25540] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1063.400207][T25540] bond1: (slave gretap1): failed to get link speed/duplex [ 1063.543167][ T951] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1063.595658][T26921] CUSE: unknown device info "" [ 1063.600610][T26921] CUSE: unknown device info "" [ 1063.605464][T26921] CUSE: unknown device info "" [ 1063.610398][T26921] CUSE: unknown device info "" [ 1063.615243][T26921] CUSE: unknown device info "" [ 1063.620204][T26921] CUSE: zero length info key specified [ 1063.626713][ T981] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1063.694177][T26921] Process accounting paused [ 1063.701093][ T951] bond1: (slave gretap1): failed to get link speed/duplex [ 1064.018830][ T29] audit: type=1800 audit(1786151311.110:3795): pid=26929 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.7306" name="bmAttributes" dev="configfs" ino=109574 res=0 errno=0 [ 1064.166356][ T981] usb 3-1: device descriptor read/64, error -71 [ 1064.874775][T26932] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 1064.898242][ T981] usb usb3-port1: attempt power cycle [ 1064.925386][T26935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1064.954360][T26935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1065.237413][ T981] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1066.035624][ T981] usb 3-1: device descriptor read/8, error -71 [ 1067.117542][ T29] audit: type=1400 audit(1786151314.210:3796): avc: denied { remount } for pid=26955 comm="syz.2.7314" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1067.138085][T26961] befs: (nbd2): unable to read superblock [ 1067.827660][ T951] net_ratelimit: 62 callbacks suppressed [ 1067.827710][ T951] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1067.827760][ T951] bond1: (slave gretap1): failed to get link speed/duplex [ 1067.987491][T23007] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1067.987546][T23007] bond1: (slave gretap1): failed to get link speed/duplex [ 1068.123692][T25540] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1068.157825][T25540] bond1: (slave gretap1): failed to get link speed/duplex [ 1068.277495][T23007] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1068.285344][T23007] bond1: (slave gretap1): failed to get link speed/duplex [ 1068.417699][T25540] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1068.448871][T25540] bond1: (slave gretap1): failed to get link speed/duplex [ 1069.474966][T26993] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7322'. [ 1069.542613][T26995] netlink: 'syz.4.7323': attribute type 39 has an invalid length. [ 1069.564997][T26996] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7322'. [ 1069.624858][T26996] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7322'. [ 1069.850027][T26993] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1070.113398][T26996] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1070.134434][T27009] MTD: Couldn't look up './dev/mtdblock0': -2 [ 1070.161162][T26996] bond8: (slave bond0): making interface the new active one [ 1070.219128][T26996] bond8: (slave bond0): Enslaving as an active interface with an up link [ 1070.331212][T27012] futex_wake_op: syz.2.7328 tries to shift op by -1; fix this program [ 1070.587468][T14763] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1071.447363][T14763] usb 3-1: Using ep0 maxpacket: 32 [ 1071.462118][T14763] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1071.476496][T14763] usb 3-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1071.484631][T27022] loop6: detected capacity change from 0 to 2640 [ 1071.486643][T14763] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1071.500547][T14763] usb 3-1: Product: syz [ 1071.504789][T14763] usb 3-1: Manufacturer: syz [ 1071.509448][T14763] usb 3-1: SerialNumber: syz [ 1071.535772][T14763] usb 3-1: config 0 descriptor?? [ 1071.545444][T14763] cdc_ether 3-1:0.0: missing cdc header descriptor [ 1071.552992][T14763] usb 3-1: unsupported MDLM descriptors [ 1071.563552][T27022] buffer_io_error: 25 callbacks suppressed [ 1071.563568][T27022] Buffer I/O error on dev loop6, logical block 0, async page read [ 1071.680088][T27023] blk_print_req_error: 25 callbacks suppressed [ 1071.680108][T27023] I/O error, dev loop6, sector 0 op 0x1:(WRITE) flags 0xc800 phys_seg 128 prio class 2 [ 1071.747266][T27029] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1071.748687][T27022] Buffer I/O error on dev loop6, logical block 0, async page read [ 1071.749906][T27022] Buffer I/O error on dev loop6, logical block 0, async page read [ 1071.794749][T16038] usb 3-1: USB disconnect, device number 64 [ 1071.802517][T27023] I/O error, dev loop6, sector 0 op 0x1:(WRITE) flags 0xc800 phys_seg 128 prio class 2 [ 1071.878610][T27029] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1071.895400][T27023] I/O error, dev loop6, sector 1008 op 0x1:(WRITE) flags 0xc800 phys_seg 128 prio class 2 [ 1071.946446][T27023] I/O error, dev loop6, sector 1008 op 0x1:(WRITE) flags 0xc800 phys_seg 128 prio class 2 [ 1071.969848][T27022] Buffer I/O error on dev loop6, logical block 0, async page read [ 1071.982813][T27023] I/O error, dev loop6, sector 2016 op 0x1:(WRITE) flags 0x8800 phys_seg 3 prio class 2 [ 1072.046309][T27022] Buffer I/O error on dev loop6, logical block 0, async page read [ 1072.048797][T27023] I/O error, dev loop6, sector 2016 op 0x1:(WRITE) flags 0x8800 phys_seg 3 prio class 2 [ 1072.114279][T27023] I/O error, dev loop6, sector 2032 op 0x1:(WRITE) flags 0x8800 phys_seg 77 prio class 2 [ 1072.133309][T27022] Buffer I/O error on dev loop6, logical block 0, async page read [ 1072.137148][T27023] I/O error, dev loop6, sector 2032 op 0x1:(WRITE) flags 0x8800 phys_seg 77 prio class 2 [ 1072.224066][T27022] Buffer I/O error on dev loop6, logical block 0, async page read [ 1072.275896][T27022] Buffer I/O error on dev loop6, logical block 0, async page read [ 1072.321728][T27022] ldm_validate_partition_table(): Disk read failed. [ 1072.374451][T27022] Buffer I/O error on dev loop6, logical block 0, async page read [ 1072.438170][T27022] Buffer I/O error on dev loop6, logical block 0, async page read [ 1072.514940][T27022] Dev loop6: unable to read RDB block 0 [ 1072.579252][T27022] loop6: unable to read partition table [ 1072.639811][T27022] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 1072.890826][T23007] net_ratelimit: 54 callbacks suppressed [ 1072.890852][T23007] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1073.115236][T23007] bond1: (slave gretap1): failed to get link speed/duplex [ 1074.905614][ T951] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1074.916951][ T951] bond1: (slave gretap1): failed to get link speed/duplex [ 1074.917353][T14763] usb 3-1: new full-speed USB device number 65 using dummy_hcd [ 1075.048500][T26481] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1075.056000][T26481] bond1: (slave gretap1): failed to get link speed/duplex [ 1075.102512][T14763] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1075.110818][T14763] usb 3-1: not running at top speed; connect to a high speed hub [ 1075.140430][T14763] usb 3-1: New USB device found, idVendor=0763, idProduct=2003, bcdDevice= 0.40 [ 1075.162994][T14763] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1075.177416][T26481] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1075.206828][T26481] bond1: (slave gretap1): failed to get link speed/duplex [ 1075.217367][T14763] usb 3-1: Product: syz [ 1075.237422][T16038] usb 6-1: new low-speed USB device number 73 using dummy_hcd [ 1075.262117][T14763] usb 3-1: Manufacturer: syz [ 1075.287401][T14763] usb 3-1: SerialNumber: syz [ 1075.377382][T16038] usb 6-1: device descriptor read/64, error -71 [ 1075.385934][T25540] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1075.393447][T25540] bond1: (slave gretap1): failed to get link speed/duplex [ 1075.560236][T14763] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1075.585599][T14763] usb 3-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 1075.617398][T16038] usb 6-1: new low-speed USB device number 74 using dummy_hcd [ 1075.646154][T14763] usb 3-1: 2:1: cannot set freq 204529 to ep 0x82 [ 1075.686523][T27074] netlink: 168 bytes leftover after parsing attributes in process `syz.0.7347'. [ 1075.777402][T16038] usb 6-1: device descriptor read/64, error -71 [ 1075.867351][ T5714] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 1075.917697][T16038] usb usb6-port1: attempt power cycle [ 1076.014310][ T5714] usb 7-1: device descriptor read/64, error -71 [ 1076.017431][T14763] usb 3-1: USB disconnect, device number 65 [ 1076.196629][T27083] udevd[27083]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 1076.297556][ T5714] usb 7-1: new high-speed USB device number 51 using dummy_hcd [ 1076.457955][ T5714] usb 7-1: device descriptor read/64, error -71 [ 1076.617684][ T5714] usb usb7-port1: attempt power cycle [ 1076.634522][T27099] netlink: 68 bytes leftover after parsing attributes in process `syz.5.7354'. [ 1076.832967][T27101] i2c i2c-0: Failed to register i2c client retu at 0x01 (-16) [ 1076.863286][T16038] usb usb6-port1: Cannot enable. Maybe the USB cable is bad? [ 1076.935772][T27108] MTD: Couldn't look up './dev/mtdblock0': -2 [ 1077.043483][T16038] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 1077.067250][ T5714] usb 7-1: new high-speed USB device number 52 using dummy_hcd [ 1077.174573][T16038] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1077.262880][T16038] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1077.344114][T16038] usb 6-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 1077.437189][T16038] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1077.722981][T16038] usb 6-1: config 0 descriptor?? [ 1077.798098][ T5714] usb 7-1: device descriptor read/8, error -71 [ 1077.939850][ T12] net_ratelimit: 40 callbacks suppressed [ 1077.939870][ T12] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1077.948177][T27112] netlink: 168 bytes leftover after parsing attributes in process `syz.2.7358'. [ 1077.983099][ T12] bond1: (slave gretap1): failed to get link speed/duplex [ 1078.037366][ T5714] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 1078.147509][T26481] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1078.252200][T26481] bond1: (slave gretap1): failed to get link speed/duplex [ 1078.267809][ T5714] usb 7-1: device descriptor read/8, error -71 [ 1078.368331][T26481] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1078.383782][ T5714] usb usb7-port1: unable to enumerate USB device [ 1078.391427][T26481] bond1: (slave gretap1): failed to get link speed/duplex [ 1078.489216][T16038] hid-steam 0003:28DE:1142.0016: unknown main item tag 0x0 [ 1078.507457][T26481] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1078.522354][T16038] hid-steam 0003:28DE:1142.0016: unknown main item tag 0x0 [ 1078.543885][T16038] hid-steam 0003:28DE:1142.0016: unknown main item tag 0x0 [ 1078.577351][T14763] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1078.577478][T26481] bond1: (slave gretap1): failed to get link speed/duplex [ 1078.595889][T16038] hid-steam 0003:28DE:1142.0016: unknown main item tag 0x0 [ 1078.617429][T16038] hid-steam 0003:28DE:1142.0016: unknown main item tag 0x0 [ 1078.655340][T16038] hid-steam 0003:28DE:1142.0016: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.5-1/input0 [ 1078.681788][T27099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1078.725625][T27099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1078.748467][T14763] usb 5-1: Using ep0 maxpacket: 32 [ 1078.757402][T26481] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1078.759386][T14763] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 1078.793798][T26481] bond1: (slave gretap1): failed to get link speed/duplex [ 1078.840428][T14763] usb 5-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= a.f5 [ 1078.882635][T14763] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1078.927748][T14763] usb 5-1: Product: syz [ 1078.942893][T14763] usb 5-1: Manufacturer: syz [ 1078.968419][T14763] usb 5-1: SerialNumber: syz [ 1079.027945][T14763] usb 5-1: config 0 descriptor?? [ 1079.059084][T27133] netlink: 'syz.6.7366': attribute type 39 has an invalid length. [ 1079.062690][T27118] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 1079.151082][T14763] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1079.343791][T27135] gadgetfs: bound to dummy_udc driver [ 1079.554195][T27099] hid-steam 0003:28DE:1142.0016: pid 27099 passed too large report [ 1079.638682][ T5691] usb 2-1: new full-speed USB device number 43 using dummy_hcd [ 1079.687349][ C1] gadgetfs: connected [ 1079.697122][ T5691] gadgetfs: disconnected [ 1079.718729][ T5714] usb 6-1: USB disconnect, device number 76 [ 1079.799518][ T29] audit: type=1400 audit(1786151326.920:3797): avc: denied { unmount } for pid=21370 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 1079.888018][T14763] usb 3-1: new low-speed USB device number 66 using dummy_hcd [ 1080.054185][T14763] usb 3-1: device descriptor read/64, error -71 [ 1080.499183][T14763] usb 3-1: new low-speed USB device number 67 using dummy_hcd [ 1080.677634][T14763] usb 3-1: device descriptor read/64, error -71 [ 1080.743904][ T5691] usb 5-1: USB disconnect, device number 91 [ 1080.774609][T27152] netlink: 40 bytes leftover after parsing attributes in process `syz.6.7370'. [ 1080.818679][T14763] usb usb3-port1: attempt power cycle [ 1081.297523][T14763] usb 3-1: new low-speed USB device number 68 using dummy_hcd [ 1081.318078][T27165] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1081.358576][T14763] usb 3-1: device descriptor read/8, error -71 [ 1081.379354][T27165] netlink: 20 bytes leftover after parsing attributes in process `syz.5.7374'. [ 1081.987404][T14763] usb 3-1: new low-speed USB device number 69 using dummy_hcd [ 1082.303473][T14763] usb 3-1: device descriptor read/8, error -71 [ 1082.417758][T14763] usb usb3-port1: unable to enumerate USB device [ 1082.947659][T23007] net_ratelimit: 68 callbacks suppressed [ 1082.947676][T23007] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1082.975155][T23007] bond1: (slave gretap1): failed to get link speed/duplex [ 1083.000164][T27190] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7383'. [ 1083.146399][T23007] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1083.795200][T23007] bond1: (slave gretap1): failed to get link speed/duplex [ 1084.050017][T23007] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1084.136899][T23007] bond1: (slave gretap1): failed to get link speed/duplex [ 1084.222860][T27209] netlink: 20 bytes leftover after parsing attributes in process `syz.5.7388'. [ 1084.277630][T23007] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1085.057997][T23007] bond1: (slave gretap1): failed to get link speed/duplex [ 1085.287421][ T5906] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1085.310400][ T5906] bond1: (slave gretap1): failed to get link speed/duplex [ 1086.427413][ T5714] usb 6-1: new low-speed USB device number 77 using dummy_hcd [ 1086.687409][ T5714] usb 6-1: device descriptor read/64, error -71 [ 1087.018306][ T5714] usb 6-1: new low-speed USB device number 78 using dummy_hcd [ 1087.158681][ T5714] usb 6-1: device descriptor read/64, error -71 [ 1087.170473][T27245] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7400'. [ 1087.418066][ T5714] usb usb6-port1: attempt power cycle [ 1088.052662][ T12] net_ratelimit: 46 callbacks suppressed [ 1088.052686][ T12] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1088.238556][ T12] bond1: (slave gretap1): failed to get link speed/duplex [ 1088.448600][T11694] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1088.488574][T11694] bond1: (slave gretap1): failed to get link speed/duplex [ 1088.629454][T27262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1088.641856][T23007] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1088.690135][T23007] bond1: (slave gretap1): failed to get link speed/duplex [ 1088.711738][T27262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1088.837644][ T12] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1088.883326][ T12] bond1: (slave gretap1): failed to get link speed/duplex [ 1089.148219][T23007] bond1: (slave ip6gretap0): failed to get link speed/duplex [ 1089.188805][T23007] bond1: (slave gretap1): failed to get link speed/duplex [ 1089.221357][T27284] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7414'. [ 1091.055330][T27297] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 1091.065017][T27297] SELinux: failed to load policy [ 1091.572203][T27315] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7426'. [ 1092.307612][ T5714] usb 7-1: new low-speed USB device number 54 using dummy_hcd [ 1092.510535][ T5714] usb 7-1: device descriptor read/64, error -71 [ 1092.610588][T27322] netlink: 'syz.0.7428': attribute type 2 has an invalid length. [ 1092.623456][T27322] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 1092.639124][ T29] audit: type=1400 audit(1786151339.740:3798): avc: denied { read } for pid=27308 comm="syz.4.7424" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 1092.832568][ T5714] usb 7-1: new low-speed USB device number 55 using dummy_hcd [ 1092.833341][T27318] block nbd0: NBD_DISCONNECT [ 1092.846531][T27318] block nbd0: Send disconnect failed -32 [ 1092.852516][T27318] block nbd0: shutting down sockets [ 1093.037384][ T5714] usb 7-1: device descriptor read/64, error -71 [ 1093.148332][ T5714] usb usb7-port1: attempt power cycle [ 1093.547616][ T5714] usb 7-1: new low-speed USB device number 56 using dummy_hcd [ 1093.665235][ T5714] usb 7-1: device descriptor read/8, error -71 [ 1093.970265][ T5714] usb 7-1: new low-speed USB device number 57 using dummy_hcd [ 1094.023009][ T5714] usb 7-1: device descriptor read/8, error -71 [ 1094.183882][T27332] Process accounting resumed [ 1094.193258][ T5714] usb usb7-port1: unable to enumerate USB device [ 1094.218281][ T951] bond1 (unregistering): (slave ip6gretap0): Removing an active aggregator [ 1094.240177][ T951] bond1 (unregistering): (slave ip6gretap0): Releasing backup interface [ 1094.256237][ T951] bond1 (unregistering): (slave ip6gretap0): the permanent HWaddr of slave - 46:ea:b9:d5:2a:e5 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1094.454493][T27349] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7438'. [ 1094.480440][ T951] bond1 (unregistering): (slave gretap1): Releasing backup interface [ 1094.954292][ T951] bond1 (unregistering): Released all slaves [ 1095.364971][ T951] bond2 (unregistering): Released all slaves [ 1095.454495][ T951] bond3 (unregistering): Released all slaves [ 1095.496256][T27371] xt_policy: output policy not valid in PREROUTING and INPUT [ 1095.544601][T27371] overlayfs: failed to resolve './file1': -2 [ 1095.553873][ T951] bond4 (unregistering): Released all slaves [ 1095.603008][ T951] bond5 (unregistering): Released all slaves [ 1095.677784][ T951] bond0 (unregistering): Released all slaves [ 1095.725501][ T951] bond6 (unregistering): Released all slaves [ 1095.793694][T27377] tipc: Enabled bearer , priority 0 [ 1095.826427][T27356] syzkaller0: entered promiscuous mode [ 1095.841381][T27356] syzkaller0: entered allmulticast mode [ 1095.909251][T14763] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 1095.949303][ T951] tipc: Left network mode [ 1095.951159][ T29] audit: type=1400 audit(1786151343.070:3799): avc: denied { accept } for pid=27385 comm="syz.4.7447" lport=54319 faddr=::ffff:10.137.0.252 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1095.977476][ T10] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 1095.988267][ T29] audit: type=1400 audit(1786151343.070:3800): avc: denied { getopt } for pid=27385 comm="syz.4.7447" lport=54319 faddr=::ffff:10.137.0.252 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1096.092339][T14763] usb 3-1: Using ep0 maxpacket: 8 [ 1096.099010][T14763] usb 3-1: config 6 has an invalid interface number: 213 but max is 1 [ 1096.107804][T14763] usb 3-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 1096.118462][T14763] usb 3-1: config 6 has 1 interface, different from the descriptor's value: 2 [ 1096.127459][T14763] usb 3-1: config 6 has no interface number 0 [ 1096.133755][T14763] usb 3-1: config 6 interface 213 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1096.144956][T14763] usb 3-1: config 6 interface 213 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1096.159106][T14763] usb 3-1: config 6 interface 213 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1096.170752][ T10] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1096.186059][T14763] usb 3-1: config 6 interface 213 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1096.186419][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1096.236674][T27389] CUSE: unknown device info "" [ 1096.241608][T27389] CUSE: unknown device info "" [ 1096.246481][T27389] CUSE: unknown device info "" [ 1096.250001][T14763] usb 3-1: New USB device found, idVendor=eb1a, idProduct=e357, bcdDevice=85.86 [ 1096.251369][T27389] CUSE: unknown device info "" [ 1096.265232][T27389] CUSE: unknown device info "" [ 1096.267979][T14763] usb 3-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 1096.270207][T27389] CUSE: zero length info key specified [ 1096.282616][ T10] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1096.325481][T14763] usb 3-1: Manufacturer: syz [ 1096.340151][T14763] usb 3-1: SerialNumber: syz [ 1096.356131][ T10] usb 7-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 1096.372279][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1096.408154][ T10] usb 7-1: Product: syz [ 1096.412458][ T10] usb 7-1: Manufacturer: syz [ 1096.420624][ T10] usb 7-1: SerialNumber: syz [ 1096.439027][ T10] usb 7-1: selecting invalid altsetting 1 [ 1096.445433][ T10] usb 7-1: unit 6 not found! [ 1096.594490][T27399] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 1096.615502][T27399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1096.628599][T27399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1096.643773][T14763] em28xx 3-1:6.213: New device syz @ 480 Mbps (eb1a:e357, interface 213, class 213) [ 1096.653837][T27353] tipc: Resetting bearer [ 1096.654752][T14763] em28xx 3-1:6.213: Audio interface 213 found (Vendor Class) [ 1096.700523][T27353] tipc: Disabling bearer [ 1096.721932][T14763] em28xx 3-1:6.213: unknown em28xx chip ID (0) [ 1096.729008][T14763] em28xx 3-1:6.213: Config register raw data: 0xfffffffb [ 1096.738680][T14763] em28xx 3-1:6.213: AC97 chip type couldn't be determined [ 1096.745853][T14763] em28xx 3-1:6.213: No AC97 audio processor [ 1096.762098][T14763] usb 3-1: USB disconnect, device number 70 [ 1096.786127][T14763] em28xx 3-1:6.213: Disconnecting em28xx [ 1096.823954][T14763] em28xx 3-1:6.213: Freeing device [ 1097.101534][ T29] audit: type=1400 audit(1786151344.220:3801): avc: denied { recv } for pid=23911 comm="syz-executor" saddr=10.128.0.169 src=30006 daddr=10.128.0.177 dest=49030 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 1097.134518][ T29] audit: type=1400 audit(1786151344.220:3802): avc: denied { read write } for pid=23911 comm="syz-executor" name="loop4" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1097.182811][ T29] audit: type=1400 audit(1786151344.220:3803): avc: denied { open } for pid=23911 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1097.208281][ T29] audit: type=1400 audit(1786151344.220:3804): avc: denied { ioctl } for pid=23911 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=649 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1097.234828][ T29] audit: type=1400 audit(1786151344.250:3805): avc: denied { read } for pid=27404 comm="syz.4.7455" name="event1" dev="devtmpfs" ino=918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1097.260067][ T29] audit: type=1400 audit(1786151344.250:3806): avc: denied { open } for pid=27404 comm="syz.4.7455" path="/dev/input/event1" dev="devtmpfs" ino=918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1097.285299][ T951] hsr_slave_0: left promiscuous mode [ 1097.290162][ T29] audit: type=1400 audit(1786151344.270:3807): avc: denied { read } for pid=27404 comm="syz.4.7455" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1097.317056][ T951] hsr_slave_1: left promiscuous mode [ 1097.338944][ T951] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1097.359732][T27409] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7456'. [ 1097.371996][ T951] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1097.390299][ T951] veth1_macvtap: left promiscuous mode [ 1097.421992][ T951] veth0_macvtap: left promiscuous mode [ 1097.433659][ T951] veth1_vlan: left promiscuous mode [ 1097.452329][ T951] veth0_vlan: left promiscuous mode [ 1098.305136][ T29] kauditd_printk_skb: 20 callbacks suppressed [ 1098.305153][ T29] audit: type=1400 audit(1786151345.420:3828): avc: denied { create } for pid=27423 comm="syz.2.7459" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1098.413337][ T29] audit: type=1400 audit(1786151345.470:3829): avc: denied { allowed } for pid=27423 comm="syz.2.7459" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1098.435274][ T29] audit: type=1400 audit(1786151345.480:3830): avc: denied { read write } for pid=27423 comm="syz.2.7459" name="video0" dev="devtmpfs" ino=931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1098.463112][ T29] audit: type=1400 audit(1786151345.480:3831): avc: denied { open } for pid=27423 comm="syz.2.7459" path="/dev/video0" dev="devtmpfs" ino=931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1098.487707][ T29] audit: type=1400 audit(1786151345.480:3832): avc: denied { ioctl } for pid=27423 comm="syz.2.7459" path="/dev/video0" dev="devtmpfs" ino=931 ioctlcmd=0x5608 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1098.512854][ T29] audit: type=1400 audit(1786151345.480:3833): avc: denied { prog_load } for pid=27423 comm="syz.2.7459" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1098.532185][ T29] audit: type=1400 audit(1786151345.480:3834): avc: denied { bpf } for pid=27423 comm="syz.2.7459" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1098.553212][ T29] audit: type=1400 audit(1786151345.480:3835): avc: denied { perfmon } for pid=27423 comm="syz.2.7459" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1098.620301][ T29] audit: type=1400 audit(1786151345.490:3836): avc: denied { read } for pid=27423 comm="syz.2.7459" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1098.661336][ T29] audit: type=1400 audit(1786151345.490:3837): avc: denied { open } for pid=27423 comm="syz.2.7459" path="/dev/binderfs/binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1098.750796][T27433] netlink: 72 bytes leftover after parsing attributes in process `syz.4.7463'. [ 1098.945002][ T5602] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 1099.036404][ T10] usb 7-1: 2:0: cannot get min/max values for control 1 (id 2) [ 1099.214914][T27440] netlink: 32 bytes leftover after parsing attributes in process `syz.5.7466'. [ 1099.322025][ T10] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1099.357838][ T10] usb 7-1: USB disconnect, device number 58 [ 1099.433263][T25516] udevd[25516]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 1099.518717][T27452] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7470'. [ 1099.557430][ T5691] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 1099.759132][ T5691] usb 6-1: Using ep0 maxpacket: 8 [ 1099.773241][ T5691] usb 6-1: config 0 has an invalid interface number: 239 but max is 0 [ 1099.804496][ T5691] usb 6-1: config 0 has no interface number 0 [ 1099.812419][T27460] i2c i2c-0: Failed to register i2c client retu at 0x01 (-16) [ 1099.821239][ T5691] usb 6-1: config 0 interface 239 altsetting 0 has an endpoint descriptor with address 0x64, changing to 0x4 [ 1099.855253][ T951] IPVS: stop unused estimator thread 0... [ 1099.877380][ T5691] usb 6-1: config 0 interface 239 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 8 [ 1099.995545][ T5691] usb 6-1: config 0 interface 239 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1102.089230][ T5691] usb 6-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=99.1a [ 1102.100226][ T5691] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1102.108916][ T5691] usb 6-1: Product: syz [ 1102.113285][ T5691] usb 6-1: Manufacturer: syz [ 1102.118005][ T5691] usb 6-1: SerialNumber: syz [ 1102.124830][ T5691] usb 6-1: config 0 descriptor?? [ 1102.130568][T27446] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1102.235064][T27475] netlink: 168 bytes leftover after parsing attributes in process `syz.4.7475'. [ 1102.301169][ T5691] ath6kl: Failed to submit usb control message: -71 [ 1102.350524][ T5691] ath6kl: unable to send the bmi data to the device: -71 [ 1102.372339][ T5691] ath6kl: Unable to send get target info: -71 [ 1102.404781][ T5691] ath6kl: Failed to init ath6kl core: -71 [ 1102.419858][ T5691] ath6kl_usb 6-1:0.239: probe with driver ath6kl_usb failed with error -71 [ 1102.439997][ T5691] usb 6-1: USB disconnect, device number 80 [ 1102.467650][ T46] usb 7-1: new low-speed USB device number 59 using dummy_hcd [ 1102.535088][T27489] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7480'. [ 1102.617392][ T46] usb 7-1: device descriptor read/64, error -71 [ 1103.127531][ T46] usb 7-1: new low-speed USB device number 60 using dummy_hcd [ 1103.321760][ T46] usb 7-1: device descriptor read/64, error -71 [ 1103.497655][ T46] usb usb7-port1: attempt power cycle [ 1103.776686][T27504] net_ratelimit: 46 callbacks suppressed [ 1103.776704][T27504] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 1103.829768][T27510] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 1103.896870][ T29] kauditd_printk_skb: 82 callbacks suppressed [ 1103.896886][ T29] audit: type=1400 audit(1786151351.010:3920): avc: denied { create } for pid=27503 comm="syz.4.7485" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1103.959426][T27513] overlay: Unknown parameter 's [ 1103.959426][T27513] >K@' [ 1103.968833][ T29] audit: type=1400 audit(1786151351.060:3921): avc: denied { create } for pid=27503 comm="syz.4.7485" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1104.000789][T27517] netlink: 20 bytes leftover after parsing attributes in process `syz.6.7492'. [ 1104.009959][ T29] audit: type=1400 audit(1786151351.060:3922): avc: denied { connect } for pid=27512 comm="syz.2.7490" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1104.053725][ T29] audit: type=1400 audit(1786151351.070:3923): avc: denied { write } for pid=27512 comm="syz.2.7490" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1104.177378][T16038] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1104.274434][T27525] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1104.441429][T27525] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1104.456772][ T29] audit: type=1400 audit(1786151351.300:3924): avc: denied { create } for pid=27522 comm="syz.0.7494" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1104.706112][ T29] audit: type=1400 audit(1786151351.740:3925): avc: denied { create } for pid=27522 comm="syz.0.7494" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1104.956740][ T29] audit: type=1400 audit(1786151351.770:3926): avc: denied { write } for pid=27522 comm="syz.0.7494" name="event2" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1105.031567][ T29] audit: type=1400 audit(1786151351.790:3927): avc: denied { ioctl } for pid=27522 comm="syz.0.7494" path="/dev/input/event2" dev="devtmpfs" ino=921 ioctlcmd=0x4580 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1105.058093][ T29] audit: type=1400 audit(1786151352.140:3928): avc: denied { read write } for pid=27529 comm="syz.5.7497" name="mouse0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1105.082164][T16038] usb 5-1: Using ep0 maxpacket: 8 [ 1105.092039][ T29] audit: type=1400 audit(1786151352.140:3929): avc: denied { open } for pid=27529 comm="syz.5.7497" path="/dev/input/mouse0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1105.118304][T16038] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1105.126719][T16038] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1105.146918][T16038] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1105.175249][T16038] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1105.204815][T16038] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1105.237637][T16038] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1105.261153][T16038] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1105.767389][ T5714] usb 3-1: new low-speed USB device number 71 using dummy_hcd [ 1105.907361][ T5714] usb 3-1: device descriptor read/64, error -71 [ 1106.095898][T27510] usbtmc 5-1:16.0: simple usb_control_msg returned 0 [ 1106.098423][T27555] netlink: 20 bytes leftover after parsing attributes in process `syz.6.7506'. [ 1106.187368][ T5714] usb 3-1: new low-speed USB device number 72 using dummy_hcd [ 1106.817194][T16038] usb 5-1: USB disconnect, device number 92 [ 1107.159434][ T5714] usb 3-1: device descriptor read/64, error -71 [ 1107.289321][ T5714] usb usb3-port1: attempt power cycle [ 1107.832376][ T5714] usb 3-1: new low-speed USB device number 73 using dummy_hcd [ 1107.873226][ T5714] usb 3-1: device descriptor read/8, error -71 [ 1108.054180][T27590] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7518'. [ 1108.117387][ T5714] usb 3-1: new low-speed USB device number 74 using dummy_hcd [ 1109.587537][ T29] kauditd_printk_skb: 24 callbacks suppressed [ 1109.587554][ T29] audit: type=1400 audit(1786151356.710:3954): avc: denied { write } for pid=27591 comm="syz.5.7519" path="/dev/vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1109.747598][ T5714] usb 3-1: device not accepting address 74, error -71 [ 1109.771649][ T29] audit: type=1400 audit(1786151356.890:3955): avc: denied { setopt } for pid=27605 comm="syz.6.7524" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1109.789790][ T5714] usb usb3-port1: unable to enumerate USB device [ 1109.996246][ T29] audit: type=1400 audit(1786151356.910:3956): avc: denied { bind } for pid=27605 comm="syz.6.7524" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1110.018708][ T29] audit: type=1400 audit(1786151356.970:3957): avc: denied { setopt } for pid=27610 comm="syz.5.7526" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1110.046628][T27613] xt_hashlimit: size too large, truncated to 1048576 [ 1110.075686][ T29] audit: type=1400 audit(1786151357.160:3958): avc: denied { read write } for pid=27610 comm="syz.5.7526" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1110.130749][ T29] audit: type=1400 audit(1786151357.160:3959): avc: denied { open } for pid=27610 comm="syz.5.7526" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1110.156748][ T29] audit: type=1400 audit(1786151357.160:3960): avc: denied { setopt } for pid=27610 comm="syz.5.7526" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1110.207086][ T29] audit: type=1400 audit(1786151357.220:3961): avc: denied { name_bind } for pid=27610 comm="syz.5.7526" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 1110.293131][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1110.296226][ T29] audit: type=1400 audit(1786151357.350:3962): avc: denied { create } for pid=27627 comm="syz.6.7531" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1110.447467][ T29] audit: type=1400 audit(1786151357.360:3963): avc: denied { connect } for pid=27627 comm="syz.6.7531" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1110.534530][T27634] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7534'. [ 1111.434246][T27640] syzkaller0: entered promiscuous mode [ 1111.461185][T27640] syzkaller0: entered allmulticast mode [ 1111.827221][T27662] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.6.7546:27662 [ 1112.029747][T27669] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7549'. [ 1112.068591][T27671] fuse: Bad value for 'user_id' [ 1112.321991][T27671] fuse: Bad value for 'user_id' [ 1113.032218][T27678] netlink: 168 bytes leftover after parsing attributes in process `syz.2.7551'. [ 1113.285393][T27692] syzkaller0: entered promiscuous mode [ 1113.305921][T27692] syzkaller0: entered allmulticast mode [ 1113.326989][T11694] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1113.422208][T27699] ubi0: attaching mtd0 [ 1113.445245][T27702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1113.478245][T27702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1113.524793][T27702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1113.527206][T27699] ubi0: scanning is finished [ 1113.545121][T27702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1113.565780][T27699] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 1113.570660][T27702] netlink: 220 bytes leftover after parsing attributes in process `syz.0.7560'. [ 1113.682231][T27711] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1113.714221][T27711] netlink: 20 bytes leftover after parsing attributes in process `syz.5.7563'. [ 1114.664992][T27721] netlink: 168 bytes leftover after parsing attributes in process `syz.0.7568'. [ 1114.723897][T27719] FAULT_INJECTION: forcing a failure. [ 1114.723897][T27719] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1114.736950][T27719] CPU: 1 UID: 0 PID: 27719 Comm: syz.4.7566 Tainted: G L syzkaller #0 PREEMPT(full) [ 1114.736969][T27719] Tainted: [L]=SOFTLOCKUP [ 1114.736973][T27719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1114.736980][T27719] Call Trace: [ 1114.736984][T27719] [ 1114.736989][T27719] dump_stack_lvl+0x100/0x190 [ 1114.737007][T27719] should_fail_ex.cold+0x5/0xa [ 1114.737021][T27719] _copy_from_user+0x2e/0xd0 [ 1114.737037][T27719] copy_msghdr_from_user+0x9f/0x4c0 [ 1114.737049][T27719] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1114.737066][T27719] ___sys_sendmsg+0x106/0x1e0 [ 1114.737078][T27719] ? __pfx____sys_sendmsg+0x10/0x10 [ 1114.737087][T27719] ? __lock_acquire+0x49f/0x1a40 [ 1114.737101][T27719] ? get_pid_task+0x106/0x250 [ 1114.737125][T27719] __sys_sendmsg+0x160/0x210 [ 1114.737140][T27719] ? __pfx___sys_sendmsg+0x10/0x10 [ 1114.737158][T27719] ? syscall_user_dispatch+0x76/0x130 [ 1114.737180][T27719] do_syscall_64+0x115/0x870 [ 1114.737195][T27719] ? clear_bhb_loop+0x70/0xc0 [ 1114.737209][T27719] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1114.737220][T27719] RIP: 0033:0x7f02af39e0d9 [ 1114.737230][T27719] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1114.737241][T27719] RSP: 002b:00007f02b01d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1114.737256][T27719] RAX: ffffffffffffffda RBX: 00007f02af625fa0 RCX: 00007f02af39e0d9 [ 1114.737267][T27719] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000004 [ 1114.737278][T27719] RBP: 00007f02b01d2090 R08: 0000000000000000 R09: 0000000000000000 [ 1114.737288][T27719] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1114.737298][T27719] R13: 00007f02af626038 R14: 00007f02af625fa0 R15: 00007ffe8f05e7b8 [ 1114.737318][T27719] [ 1114.919764][ T29] kauditd_printk_skb: 20 callbacks suppressed [ 1114.919780][ T29] audit: type=1400 audit(1786151362.040:3984): avc: denied { write } for pid=27717 comm="syz.4.7566" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1114.952894][ T29] audit: type=1400 audit(1786151362.060:3985): avc: denied { bind } for pid=27717 comm="syz.4.7566" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1114.972267][ T29] audit: type=1400 audit(1786151362.080:3986): avc: denied { mounton } for pid=27716 comm="syz.6.7567" path="/proc/1484/task" dev="proc" ino=113697 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 1115.115776][T27699] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 1115.161201][T27725] loop5: detected capacity change from 0 to 7 [ 1115.284371][ T10] usb 7-1: new high-speed USB device number 62 using dummy_hcd [ 1115.358466][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1115.368564][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1115.378272][ C0] buffer_io_error: 6 callbacks suppressed [ 1115.378288][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1115.401474][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1115.411194][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1115.431302][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1115.440960][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1115.451836][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1115.461545][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1115.478950][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1115.488667][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1115.517791][ T10] usb 7-1: Using ep0 maxpacket: 8 [ 1115.530527][ T10] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1115.546716][ T10] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1115.554739][T27734] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7572'. [ 1115.558586][ T10] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1115.575928][ T10] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1115.613480][ T10] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1115.625075][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1115.634030][ T29] audit: type=1400 audit(1786151362.750:3987): avc: denied { create } for pid=27739 comm="syz.5.7575" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1115.657346][ T29] audit: type=1400 audit(1786151362.750:3988): avc: denied { ioctl } for pid=27739 comm="syz.5.7575" path="socket:[113340]" dev="sockfs" ino=113340 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1115.686019][T27740] Device name not specified. [ 1115.686019][T27740] [ 1115.695013][ T29] audit: type=1400 audit(1786151362.800:3989): avc: denied { mounton } for pid=27739 comm="syz.5.7575" path="/syzcgroup/unified/syz5" dev="cgroup2" ino=288 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 1115.708250][T27734] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7572'. [ 1115.885501][T27754] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1115.907978][T27754] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7580'. [ 1115.969378][ T10] usb 7-1: GET_CAPABILITIES returned 0 [ 1115.982847][ T10] usbtmc 7-1:16.0: can't read capabilities [ 1116.895152][T27760] netlink: 168 bytes leftover after parsing attributes in process `syz.2.7582'. [ 1117.055178][T27765] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 1117.819427][T14763] usb 7-1: USB disconnect, device number 62 [ 1118.231089][T27779] syzkaller0: entered promiscuous mode [ 1118.260432][T27779] syzkaller0: entered allmulticast mode [ 1118.270417][ T136] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1118.282693][ T10] usb 6-1: new low-speed USB device number 81 using dummy_hcd [ 1118.355559][T27784] syzkaller0: entered promiscuous mode [ 1118.372543][T27784] syzkaller0: entered allmulticast mode [ 1118.439576][ T10] usb 6-1: device descriptor read/64, error -71 [ 1118.540710][T27786] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7590'. [ 1118.580605][T27793] netlink: 168 bytes leftover after parsing attributes in process `syz.4.7594'. [ 1118.580810][T27786] bridge0: port 2(bridge_slave_1) entered disabled state [ 1118.602494][T27795] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1118.669492][T27795] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7593'. [ 1118.682949][T27786] bridge_slave_1 (unregistering): left allmulticast mode [ 1118.696895][T27786] bridge_slave_1 (unregistering): left promiscuous mode [ 1118.706020][T27786] bridge0: port 2(bridge_slave_1) entered disabled state [ 1118.713317][ T10] usb 6-1: new low-speed USB device number 82 using dummy_hcd [ 1118.740607][T27799] netlink: 'syz.6.7595': attribute type 13 has an invalid length. [ 1118.803667][ T29] audit: type=1400 audit(1786151365.920:3990): avc: denied { egress } for pid=5691 comm="kworker/1:4" saddr=fe80::1b daddr=ff02::16 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:netif_t tclass=netif permissive=1 [ 1118.853317][ T10] usb 6-1: device descriptor read/64, error -71 [ 1118.977941][ T10] usb usb6-port1: attempt power cycle [ 1119.006166][T27803] netlink: 84 bytes leftover after parsing attributes in process `syz.6.7595'. [ 1119.006277][ T29] audit: type=1400 audit(1786151365.920:3991): avc: denied { sendto } for pid=5691 comm="kworker/1:4" saddr=fe80::1b daddr=ff02::16 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:node_t tclass=node permissive=1 [ 1119.229216][T27805] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 1119.462101][T27821] syzkaller0: entered promiscuous mode [ 1119.469103][T27821] syzkaller0: entered allmulticast mode [ 1119.675898][ T29] audit: type=1400 audit(1786151366.790:3992): avc: denied { read } for pid=27827 comm="syz.0.7604" name="vhost-net" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1119.720652][T27837] netlink: 168 bytes leftover after parsing attributes in process `syz.2.7606'. [ 1119.761655][ T29] audit: type=1400 audit(1786151366.790:3993): avc: denied { open } for pid=27827 comm="syz.0.7604" path="/dev/vhost-net" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1119.818288][ T5714] libceph: connect (1)[c::]:6789 error -101 [ 1119.850185][ T5714] libceph: mon0 (1)[c::]:6789 connect error [ 1120.075137][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 1120.075155][ T29] audit: type=1400 audit(1786151367.190:3995): avc: denied { read } for pid=27847 comm="syz.2.7609" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1120.143938][ T5691] libceph: connect (1)[c::]:6789 error -101 [ 1120.173529][ T5691] libceph: mon0 (1)[c::]:6789 connect error [ 1120.500436][ T4913] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1120.535473][ T4913] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1120.543927][ T4913] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1120.547469][ T10] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1120.562129][ T4913] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1120.581183][ T4913] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1120.590989][T27828] ceph: No mds server is up or the cluster is laggy [ 1120.708683][ T5602] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1120.742653][ T5602] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1120.749987][ T10] usb 5-1: device descriptor read/64, error -71 [ 1120.756900][ T5602] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1120.778307][ T5602] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1120.789818][ T5602] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1120.833097][ T29] audit: type=1400 audit(1786151367.930:3996): avc: denied { mounton } for pid=27858 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 1120.866944][T27865] block2mtd: error: cannot open device /dev/loop0 [ 1120.998927][ T10] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1121.007347][ T981] usb 7-1: new high-speed USB device number 63 using dummy_hcd [ 1121.070362][T26648] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1121.169084][ T10] usb 5-1: device descriptor read/64, error -71 [ 1121.180198][ T981] usb 7-1: Using ep0 maxpacket: 8 [ 1121.298336][ T10] usb usb5-port1: attempt power cycle [ 1121.332470][ T981] usb 7-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 1121.347561][ T981] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1121.369441][ T981] usb 7-1: Product: syz [ 1121.388700][ T981] usb 7-1: Manufacturer: syz [ 1121.398805][ T981] usb 7-1: SerialNumber: syz [ 1121.489830][ T29] audit: type=1400 audit(1786151368.590:3997): avc: denied { ioctl } for pid=27881 comm="syz.0.7621" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=114041 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1121.550695][T26648] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1121.657402][ T10] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1121.698445][ T10] usb 5-1: device descriptor read/8, error -71 [ 1121.712766][ T29] audit: type=1400 audit(1786151368.830:3998): avc: denied { execute } for pid=27862 comm="syz.6.7615" name="file0" dev="tmpfs" ino=3043 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1121.761254][T27889] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1121.792678][ T29] audit: type=1400 audit(1786151368.870:3999): avc: denied { execute_no_trans } for pid=27862 comm="syz.6.7615" path="/593/file0" dev="tmpfs" ino=3043 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1121.795318][T27889] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1121.915157][T26648] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1121.945993][T27863] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1121.957391][ T10] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1121.977696][T27863] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1121.998359][ T29] audit: type=1400 audit(1786151369.120:4000): avc: denied { ioctl } for pid=27862 comm="syz.6.7615" path="socket:[114113]" dev="sockfs" ino=114113 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1122.069430][T27889] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1122.118373][ T10] usb 5-1: device descriptor read/8, error -71 [ 1122.129294][T27889] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1122.185365][T26648] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1122.228799][ T10] usb usb5-port1: unable to enumerate USB device [ 1122.328892][T27863] vlan2: entered promiscuous mode [ 1122.334975][T27863] bridge0: entered promiscuous mode [ 1122.355252][ T981] mxuport 7-1:254.0: mxuport_send_ctrl_data_urb - usb_control_msg failed (-71) [ 1122.397235][T27858] wlan0 speed is unknown, defaulting to 1000 [ 1122.404175][ T981] mxuport 7-1:254.0: mxuport_send_ctrl_data_urb - usb_control_msg failed (-71) [ 1122.433682][ T981] mxuport 7-1:254.0: probe with driver mxuport failed with error -71 [ 1122.472768][ T981] usb 7-1: USB disconnect, device number 63 [ 1122.510394][ T29] audit: type=1400 audit(1786151369.620:4001): avc: denied { mount } for pid=27902 comm="syz.0.7625" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1122.621616][ T29] audit: type=1400 audit(1786151369.740:4002): avc: denied { read } for pid=27902 comm="syz.0.7625" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1122.773346][T27903] tmpfs: Bad value for 'mpol' [ 1122.777298][ T29] audit: type=1400 audit(1786151369.890:4003): avc: denied { remount } for pid=27902 comm="syz.0.7625" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1122.838470][ T29] audit: type=1400 audit(1786151369.930:4004): avc: denied { read } for pid=5258 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 1122.862571][ T4913] Bluetooth: hci2: command tx timeout [ 1122.925599][ T136] netdevsim netdevsim5 eth5: set [0, 0] type 1 family 0 port 8472 - 0 [ 1122.970118][ T136] netdevsim netdevsim5 eth6: set [0, 0] type 1 family 0 port 8472 - 0 [ 1123.012226][ T136] netdevsim netdevsim5 eth7: set [0, 0] type 1 family 0 port 8472 - 0 [ 1123.117900][ T12] netdevsim netdevsim5 eth8: set [0, 0] type 1 family 0 port 8472 - 0 [ 1123.172030][T26648] bridge_slave_1: left allmulticast mode [ 1123.195025][T26648] bridge_slave_1: left promiscuous mode [ 1123.227073][T26648] bridge0: port 2(bridge_slave_1) entered disabled state [ 1123.284016][T26648] bridge_slave_0: left allmulticast mode [ 1123.296700][T26648] bridge_slave_0: left promiscuous mode [ 1123.310921][T26648] bridge0: port 1(bridge_slave_0) entered disabled state [ 1123.472448][T27950] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7636'. [ 1124.045391][T26648] bond5 (unregistering): (slave bond0): Releasing active interface [ 1124.065933][T26648] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1124.080631][T26648] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1124.093770][T26648] bond0 (unregistering): Released all slaves [ 1124.109365][T26648] bond1 (unregistering): Released all slaves [ 1124.125699][T26648] bond2 (unregistering): Released all slaves [ 1124.153425][T26648] bond3 (unregistering): Released all slaves [ 1124.179939][T26648] bond4 (unregistering): Released all slaves [ 1124.216755][T26648] bond5 (unregistering): Released all slaves [ 1124.258133][ T5258] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1124.272842][T27962] Process accounting paused [ 1124.484113][T26648] tipc: Left network mode [ 1124.597596][T27858] bridge0: port 1(bridge_slave_0) entered blocking state [ 1124.630985][T27858] bridge0: port 1(bridge_slave_0) entered disabled state [ 1124.640596][T27858] bridge_slave_0: entered allmulticast mode [ 1124.667941][T27858] bridge_slave_0: entered promiscuous mode [ 1124.755802][T27858] bridge0: port 2(bridge_slave_1) entered blocking state [ 1124.791752][T27858] bridge0: port 2(bridge_slave_1) entered disabled state [ 1124.820508][T27858] bridge_slave_1: entered allmulticast mode [ 1124.837128][T27858] bridge_slave_1: entered promiscuous mode [ 1124.928091][ T4913] Bluetooth: hci2: command tx timeout [ 1125.024858][ T5329] usb 7-1: new full-speed USB device number 64 using dummy_hcd [ 1125.044801][T27858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1125.101051][T27858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1125.198001][ T5329] usb 7-1: device descriptor read/64, error -71 [ 1125.313012][T28043] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7660'. [ 1125.322827][T28043] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7660'. [ 1125.327171][T27858] team0: Port device team_slave_0 added [ 1125.623976][T27858] team0: Port device team_slave_1 added [ 1125.627342][ T5329] usb 7-1: new full-speed USB device number 65 using dummy_hcd [ 1125.757951][T27858] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1125.786454][ T29] kauditd_printk_skb: 33 callbacks suppressed [ 1125.786480][ T29] audit: type=1400 audit(1786151372.900:4038): avc: denied { write } for pid=28027 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1125.792796][T27858] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1125.846934][T27858] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1125.850721][ T5329] usb 7-1: device descriptor read/64, error -71 [ 1125.881194][T27858] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1125.899912][T28059] netlink: 68 bytes leftover after parsing attributes in process `syz.0.7665'. [ 1125.909437][T27858] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1125.951004][T27858] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1125.987717][ T5329] usb usb7-port1: attempt power cycle [ 1126.019467][ T29] audit: type=1400 audit(1786151373.130:4039): avc: denied { write } for pid=28062 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1126.086048][T27858] hsr_slave_0: entered promiscuous mode [ 1126.104035][T27858] hsr_slave_1: entered promiscuous mode [ 1126.118671][T28067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1126.132100][T28067] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1126.148000][T27858] debugfs: 'hsr0' already exists in 'hsr' [ 1126.156714][T27858] Cannot create hsr debugfs directory [ 1126.226044][ T5258] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1126.357675][ T5329] usb 7-1: new full-speed USB device number 66 using dummy_hcd [ 1126.390373][ T5329] usb 7-1: device descriptor read/8, error -71 [ 1126.437469][T28080] FAULT_INJECTION: forcing a failure. [ 1126.437469][T28080] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1126.452867][T28080] CPU: 0 UID: 0 PID: 28080 Comm: syz.4.7674 Tainted: G L syzkaller #0 PREEMPT(full) [ 1126.452898][T28080] Tainted: [L]=SOFTLOCKUP [ 1126.452906][T28080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1126.452917][T28080] Call Trace: [ 1126.452924][T28080] [ 1126.452931][T28080] dump_stack_lvl+0x100/0x190 [ 1126.452960][T28080] should_fail_ex.cold+0x5/0xa [ 1126.452982][T28080] _copy_from_user+0x2e/0xd0 [ 1126.453007][T28080] __sys_bpf+0x2f5/0x4e80 [ 1126.453034][T28080] ? __pfx___sys_bpf+0x10/0x10 [ 1126.453051][T28080] ? find_held_lock+0x2b/0x80 [ 1126.453068][T28080] ? get_pid_task+0xfc/0x250 [ 1126.453084][T28080] ? get_pid_task+0xfc/0x250 [ 1126.453109][T28080] ? find_held_lock+0x2b/0x80 [ 1126.453131][T28080] ? rcu_read_lock_any_held+0x6a/0xa0 [ 1126.453149][T28080] ? find_held_lock+0x2b/0x80 [ 1126.453165][T28080] ? ksys_write+0x190/0x250 [ 1126.453187][T28080] ? ksys_write+0x190/0x250 [ 1126.453222][T28080] ? fput+0x79/0x100 [ 1126.453247][T28080] ? __x64_sys_bpf+0xce/0x140 [ 1126.453265][T28080] __x64_sys_bpf+0xce/0x140 [ 1126.453284][T28080] ? do_syscall_64+0x90/0x870 [ 1126.453310][T28080] do_syscall_64+0x115/0x870 [ 1126.453332][T28080] ? clear_bhb_loop+0x70/0xc0 [ 1126.453355][T28080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1126.453373][T28080] RIP: 0033:0x7f02af39e0d9 [ 1126.453390][T28080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1126.453407][T28080] RSP: 002b:00007f02b01d2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1126.453426][T28080] RAX: ffffffffffffffda RBX: 00007f02af625fa0 RCX: 00007f02af39e0d9 [ 1126.453438][T28080] RDX: 0000000000000028 RSI: 0000200000000000 RDI: 0000000000000012 [ 1126.453449][T28080] RBP: 00007f02b01d2090 R08: 0000000000000000 R09: 0000000000000000 [ 1126.453460][T28080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1126.453471][T28080] R13: 00007f02af626038 R14: 00007f02af625fa0 R15: 00007ffe8f05e7b8 [ 1126.453496][T28080] [ 1126.787961][ T5329] usb 7-1: new full-speed USB device number 67 using dummy_hcd [ 1126.828671][ T5329] usb 7-1: device descriptor read/8, error -71 [ 1126.952294][ T5329] usb usb7-port1: unable to enumerate USB device [ 1127.009282][ T4913] Bluetooth: hci2: command tx timeout [ 1127.097846][ T29] audit: type=1400 audit(1786151374.210:4040): avc: denied { write } for pid=28088 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1127.140326][T27858] netdevsim netdevsim5 eth8 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1127.208897][ T29] audit: type=1400 audit(1786151374.310:4041): avc: denied { write } for pid=28109 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1127.265978][ T5258] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1127.322284][T28113] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7678'. [ 1127.372352][T27858] netdevsim netdevsim5 eth7 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1127.399385][T26648] hsr_slave_0: left promiscuous mode [ 1127.419361][T26648] hsr_slave_1: left promiscuous mode [ 1127.439799][T26648] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1127.464026][T26648] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1127.853756][T27858] netdevsim netdevsim5 eth6 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1128.121665][T27858] netdevsim netdevsim5 eth5 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1128.188020][ T29] audit: type=1400 audit(1786151375.300:4042): avc: denied { mount } for pid=28139 comm="syz.4.7687" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1128.260066][ T29] audit: type=1400 audit(1786151375.380:4043): avc: denied { unmount } for pid=23911 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1128.315672][T28148] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1128.329661][ T29] audit: type=1400 audit(1786151375.430:4044): avc: denied { write } for pid=28121 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1128.366082][T28148] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1128.533676][T28157] loop6: detected capacity change from 0 to 2640 [ 1128.540914][ T29] audit: type=1400 audit(1786151375.670:4045): avc: denied { write } for pid=28154 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1128.578812][T28157] Buffer I/O error on dev loop6, logical block 0, async page read [ 1128.612279][T28159] I/O error, dev loop6, sector 0 op 0x1:(WRITE) flags 0xc800 phys_seg 128 prio class 2 [ 1128.629041][T28157] Buffer I/O error on dev loop6, logical block 0, async page read [ 1128.638861][T28159] I/O error, dev loop6, sector 0 op 0x1:(WRITE) flags 0xc800 phys_seg 128 prio class 2 [ 1128.657998][T28157] Buffer I/O error on dev loop6, logical block 0, async page read [ 1128.665976][T28159] I/O error, dev loop6, sector 1008 op 0x1:(WRITE) flags 0xc800 phys_seg 128 prio class 2 [ 1128.676352][T28157] Buffer I/O error on dev loop6, logical block 0, async page read [ 1128.684492][T28159] I/O error, dev loop6, sector 1008 op 0x1:(WRITE) flags 0xc800 phys_seg 128 prio class 2 [ 1128.699521][T28157] Buffer I/O error on dev loop6, logical block 0, async page read [ 1128.707719][T28157] Buffer I/O error on dev loop6, logical block 0, async page read [ 1128.716168][T28159] I/O error, dev loop6, sector 2016 op 0x1:(WRITE) flags 0x8800 phys_seg 3 prio class 2 [ 1128.727508][T28157] Buffer I/O error on dev loop6, logical block 0, async page read [ 1128.735386][T28159] I/O error, dev loop6, sector 2016 op 0x1:(WRITE) flags 0x8800 phys_seg 3 prio class 2 [ 1128.750241][T28157] Buffer I/O error on dev loop6, logical block 0, async page read [ 1128.764704][T28159] I/O error, dev loop6, sector 2032 op 0x1:(WRITE) flags 0x8800 phys_seg 77 prio class 2 [ 1128.781149][T28157] ldm_validate_partition_table(): Disk read failed. [ 1128.791497][T28157] Buffer I/O error on dev loop6, logical block 0, async page read [ 1128.799809][T28159] I/O error, dev loop6, sector 2032 op 0x1:(WRITE) flags 0x8800 phys_seg 77 prio class 2 [ 1128.811714][T28157] Buffer I/O error on dev loop6, logical block 0, async page read [ 1128.836097][T28157] Dev loop6: unable to read RDB block 0 [ 1128.857172][T27858] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1128.860615][T28157] loop6: unable to read partition table [ 1128.887411][T28157] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 1128.896731][T27858] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1128.930947][T27858] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1128.997357][T27858] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1129.042039][T27858] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1129.087651][ T4913] Bluetooth: hci2: command tx timeout [ 1129.107677][T28172] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 sclass=netlink_tcpdiag_socket pid=28172 comm=syz.4.7693 [ 1129.110193][T27858] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1129.156584][T27858] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1129.172115][T28174] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7693'. [ 1129.199034][T27858] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1129.222019][T28174] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 1129.240281][T28172] nftables ruleset with unbound chain [ 1129.253528][T28172] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7693'. [ 1129.262777][T28172] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7693'. [ 1129.272951][T28174] bridge0: port 2(bridge_slave_1) entered disabled state [ 1129.280608][T28174] bridge0: port 1(bridge_slave_0) entered disabled state [ 1129.357054][T28172] bridge0: entered promiscuous mode [ 1129.363686][T28172] ip6gretap0: entered promiscuous mode [ 1129.370605][T28172] hsr1: Slave A (bridge0) is not up; please bring it up to get a fully working HSR network [ 1129.425934][ T29] audit: type=1400 audit(1786151376.540:4046): avc: denied { write } for pid=28160 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1129.926562][T28212] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 1130.626096][T27858] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1130.636732][ T29] audit: type=1400 audit(1786151377.740:4047): avc: denied { write } for pid=28205 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1130.878198][T28224] loop7: detected capacity change from 0 to 7 [ 1130.898925][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1130.915977][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1130.935574][T28224] ldm_validate_partition_table(): Disk read failed. [ 1130.963061][T28224] Dev loop7: unable to read RDB block 0 [ 1130.985353][T28224] loop7: unable to read partition table [ 1131.005333][T28224] loop7: partition table beyond EOD, truncated [ 1131.058449][T28224] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 1131.142693][T27858] 8021q: adding VLAN 0 to HW filter on device team0 [ 1131.177075][ T5906] bridge0: port 1(bridge_slave_0) entered blocking state [ 1131.184271][ T5906] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1131.379960][ T136] bridge0: port 2(bridge_slave_1) entered blocking state [ 1131.387125][ T136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1131.763477][ T29] audit: type=1400 audit(1786151378.860:4048): avc: denied { mount } for pid=28247 comm="syz.4.7712" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1132.577410][ T29] audit: type=1400 audit(1786151379.690:4049): avc: denied { write } for pid=28221 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1132.762158][ T29] audit: type=1400 audit(1786151379.800:4050): avc: denied { write } for pid=28262 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1132.924984][ T29] audit: type=1400 audit(1786151380.040:4051): avc: denied { unmount } for pid=23911 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1133.108317][ T29] audit: type=1400 audit(1786151380.220:4052): avc: denied { mount } for pid=28277 comm="syz.2.7719" name="/" dev="gadgetfs" ino=7694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 1133.215318][T28285] 9p: Bad value for 'rfdno' [ 1133.228037][T28278] gadgetfs: bound to dummy_udc driver [ 1133.260632][ T29] audit: type=1400 audit(1786151380.330:4053): avc: denied { mounton } for pid=28277 comm="syz.2.7719" path="/385/gadget/ep1in-bulk" dev="gadgetfs" ino=116159 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=file permissive=1 [ 1133.379266][T28288] geneve2: entered promiscuous mode [ 1133.440809][T28288] geneve2: entered allmulticast mode [ 1133.507400][ T5329] usb 2-1: new full-speed USB device number 44 using dummy_hcd [ 1133.542329][ C0] gadgetfs: connected [ 1133.563463][ T5329] gadgetfs: disconnected [ 1133.609671][T28286] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1133.653363][T28286] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1133.717511][ C0] gadgetfs: connected [ 1133.735858][ T5329] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1133.774745][ T5329] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 1133.804977][T28307] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7723'. [ 1133.811359][ T5329] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1133.859213][T28307] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1133.860158][ C0] gadgetfs: configuration #1 [ 1133.904234][T28277] gadgetfs: suspended from state 3 [ 1133.927496][T28277] gadgetfs: disconnected [ 1133.934394][ T5691] usb 2-1: USB disconnect, device number 44 [ 1134.098357][ T29] audit: type=1400 audit(1786151381.220:4054): avc: denied { write } for pid=28273 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1134.410573][ T29] audit: type=1400 audit(1786151381.530:4055): avc: denied { write } for pid=28322 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1136.298924][ T29] audit: type=1400 audit(1786151383.420:4056): avc: denied { unmount } for pid=22085 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 1136.387198][ T29] audit: type=1400 audit(1786151383.450:4057): avc: denied { bind } for pid=28352 comm="syz.6.7724" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1137.116978][T27858] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1137.183762][T28377] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1137.825001][ T29] audit: type=1400 audit(1786151384.940:4058): avc: denied { mounton } for pid=28365 comm="syz.0.7728" path="/syzcgroup/unified/syz0" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 1137.936228][ T29] audit: type=1400 audit(1786151384.970:4059): avc: denied { write } for pid=28365 comm="syz.0.7728" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 1137.957333][T16038] usb 3-1: new low-speed USB device number 75 using dummy_hcd [ 1138.041219][ T29] audit: type=1400 audit(1786151384.970:4060): avc: denied { setattr } for pid=28365 comm="syz.0.7728" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 1138.105860][T16038] usb 3-1: device descriptor read/64, error -71 [ 1138.170656][ T29] audit: type=1400 audit(1786151385.030:4061): avc: denied { write } for pid=28363 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1138.409296][T16038] usb 3-1: new low-speed USB device number 76 using dummy_hcd [ 1138.443622][ T29] audit: type=1400 audit(1786151385.560:4062): avc: denied { write } for pid=28399 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1138.574684][T27858] veth0_vlan: entered promiscuous mode [ 1138.577415][T16038] usb 3-1: device descriptor read/64, error -71 [ 1138.617855][T27858] veth1_vlan: entered promiscuous mode [ 1138.727871][T16038] usb usb3-port1: attempt power cycle [ 1138.733707][T27858] veth0_macvtap: entered promiscuous mode [ 1138.784504][T27858] veth1_macvtap: entered promiscuous mode [ 1138.865391][T27858] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1138.916328][T27858] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1139.060241][T11692] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1139.082316][T16038] usb 3-1: new low-speed USB device number 77 using dummy_hcd [ 1139.123293][ T29] audit: type=1400 audit(1786151386.240:4063): avc: denied { write } for pid=28411 comm="syz.6.7735" name="binder-control" dev="binder" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1139.139709][T16038] usb 3-1: device descriptor read/8, error -71 [ 1139.167630][ T136] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1139.238473][ T29] audit: type=1400 audit(1786151386.280:4064): avc: denied { map } for pid=28411 comm="syz.6.7735" path="/dev/binderfs/binder-control" dev="binder" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1139.263681][T26648] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1139.271729][ T136] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1139.288655][T26648] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1139.307644][ T136] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1139.346904][ T29] audit: type=1400 audit(1786151386.280:4065): avc: denied { ioctl } for pid=28411 comm="syz.6.7735" path="/dev/binderfs/binder-control" dev="binder" ino=2 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1139.370967][ T136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1139.411871][ T136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1139.445468][ T29] audit: type=1400 audit(1786151386.550:4066): avc: denied { mounton } for pid=27858 comm="syz-executor" path="/root/syzkaller.CuYUVi/syz-tmp" dev="sda1" ino=2068 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 1139.457846][T16038] usb 3-1: new low-speed USB device number 78 using dummy_hcd [ 1140.206329][ T29] audit: type=1400 audit(1786151386.560:4067): avc: denied { mounton } for pid=27858 comm="syz-executor" path="/root/syzkaller.CuYUVi/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 1140.526523][T16038] usb 3-1: device descriptor read/8, error -71 [ 1140.726522][T16038] usb usb3-port1: unable to enumerate USB device [ 1141.558495][T28438] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1141.573108][T28438] netlink: 20 bytes leftover after parsing attributes in process `syz.5.7610'. [ 1142.173571][T28438] team0 (unregistering): Port device team_slave_0 removed [ 1143.294074][T28438] team0 (unregistering): Port device team_slave_1 removed [ 1143.555971][T28446] hsr0: entered promiscuous mode [ 1143.843440][ T5602] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1143.859600][ T5602] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1143.870228][ T5602] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1143.884861][ T5602] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1143.899907][ T5602] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1143.982809][ T29] kauditd_printk_skb: 5 callbacks suppressed [ 1143.982837][ T29] audit: type=1400 audit(1786151391.100:4073): avc: denied { setopt } for pid=28461 comm="syz.2.7749" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1144.035516][ T29] audit: type=1400 audit(1786151391.110:4074): avc: denied { firmware_load } for pid=28461 comm="syz.2.7749" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 1144.146294][ T29] audit: type=1400 audit(1786675679.262:4075): avc: denied { write } for pid=28461 comm="syz.2.7749" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1144.382896][T28477] netlink: 44 bytes leftover after parsing attributes in process `syz.5.7752'. [ 1144.442589][T28477] bridge0: port 2(bridge_slave_1) entered disabled state [ 1144.453423][T28477] bridge0: port 1(bridge_slave_0) entered disabled state [ 1144.623174][T28483] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1144.666210][T28483] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7755'. [ 1144.791617][ T29] audit: type=1400 audit(1786675679.912:4076): avc: denied { setopt } for pid=28484 comm="syz.4.7754" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1144.873736][T28485] binder: 28484:28485 unknown command 1701076845 [ 1144.921120][T28485] binder: 28484:28485 ioctl c0306201 200000000100 returned -22 [ 1146.050734][ T5602] Bluetooth: hci3: command tx timeout [ 1146.485268][ T29] audit: type=1400 audit(1786675681.602:4077): avc: denied { create } for pid=28492 comm="syz.0.7757" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1146.594770][T28497] input: syz1 as /devices/virtual/input/input71 [ 1146.644236][ T29] audit: type=1400 audit(1786675681.762:4078): avc: denied { read } for pid=4948 comm="acpid" name="event4" dev="devtmpfs" ino=3857 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1146.727851][T28500] overlayfs: failed to resolve './bus': -2 [ 1146.751761][ T29] audit: type=1400 audit(1786675681.762:4079): avc: denied { open } for pid=4948 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3857 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1146.847793][ T29] audit: type=1400 audit(1786675681.762:4080): avc: denied { ioctl } for pid=4948 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3857 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1147.007170][T28507] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7762'. [ 1147.032210][T11694] netdevsim netdevsim6 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1147.074175][ T29] audit: type=1400 audit(1786675682.192:4081): avc: denied { connect } for pid=28504 comm="syz.4.7762" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1147.079966][T28509] binder: 28504:28509 ioctl 40046205 0 returned -22 [ 1147.100689][T11694] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1147.153484][ T29] audit: type=1400 audit(1786675682.192:4082): avc: denied { ioctl } for pid=28504 comm="syz.4.7762" path="socket:[117975]" dev="sockfs" ino=117975 ioctlcmd=0x745a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1147.244419][T28507] netlink: 'syz.4.7762': attribute type 2 has an invalid length. [ 1147.264399][T28507] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7762'. [ 1147.332849][T28521] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1147.363718][T28521] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7768'. [ 1147.578575][T28526] netlink: 'syz.5.7771': attribute type 1 has an invalid length. [ 1147.691431][T28528] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=28528 comm=syz.5.7771 [ 1147.786485][T28529] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7771'. [ 1147.798836][T28529] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7771'. [ 1148.127838][ T5602] Bluetooth: hci3: command tx timeout [ 1148.286832][T11694] netdevsim netdevsim6 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1148.327416][T11694] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1148.476998][T28459] wlan0 speed is unknown, defaulting to 1000 [ 1148.692152][T28545] FAULT_INJECTION: forcing a failure. [ 1148.692152][T28545] name failslab, interval 1, probability 0, space 0, times 0 [ 1148.733917][T28545] CPU: 1 UID: 0 PID: 28545 Comm: syz.4.7774 Tainted: G L syzkaller #0 PREEMPT(full) [ 1148.733947][T28545] Tainted: [L]=SOFTLOCKUP [ 1148.733954][T28545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1148.733965][T28545] Call Trace: [ 1148.733971][T28545] [ 1148.733978][T28545] dump_stack_lvl+0x100/0x190 [ 1148.734006][T28545] should_fail_ex.cold+0x5/0xa [ 1148.734029][T28545] should_failslab+0xc2/0x120 [ 1148.734054][T28545] __kvmalloc_node_noprof+0x116/0x970 [ 1148.734076][T28545] ? __kvmalloc_node_noprof+0x36d/0x970 [ 1148.734097][T28545] ? io_alloc_cache_init+0x38/0x170 [ 1148.734122][T28545] io_alloc_cache_init+0x38/0x170 [ 1148.734144][T28545] io_rsrc_cache_init+0x26/0x50 [ 1148.734163][T28545] io_uring_setup.cold+0x4c0/0x1cae [ 1148.734195][T28545] ? __pfx_io_uring_setup+0x10/0x10 [ 1148.734220][T28545] ? find_held_lock+0x2b/0x80 [ 1148.734237][T28545] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 1148.734257][T28545] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 1148.734291][T28545] ? ksys_write+0x1ac/0x250 [ 1148.734309][T28545] ? __pfx_ksys_write+0x10/0x10 [ 1148.734329][T28545] __x64_sys_io_uring_setup+0xc2/0x170 [ 1148.734358][T28545] do_syscall_64+0x115/0x870 [ 1148.734380][T28545] ? clear_bhb_loop+0x70/0xc0 [ 1148.734403][T28545] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1148.734422][T28545] RIP: 0033:0x7f02af39e0d9 [ 1148.734438][T28545] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1148.734455][T28545] RSP: 002b:00007f02b01d1ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1148.734473][T28545] RAX: ffffffffffffffda RBX: 0000200000000a88 RCX: 00007f02af39e0d9 [ 1148.734486][T28545] RDX: 0000200000000b08 RSI: 0000200000000a88 RDI: 00000000000003c9 [ 1148.734502][T28545] RBP: 0000200000000a80 R08: 0000000000000000 R09: 0000000000000000 [ 1148.734513][T28545] R10: 0000200000000b10 R11: 0000000000000206 R12: 0000200000000b08 [ 1148.734525][T28545] R13: 0000200000000b10 R14: 00007f02b01d1fd8 R15: 0000000000000000 [ 1148.734549][T28545] [ 1149.121417][T28553] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1149.147741][T28553] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7781'. [ 1149.190670][T11694] netdevsim netdevsim6 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1149.195600][T28556] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7780'. [ 1149.207913][T11694] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1149.295622][ T29] kauditd_printk_skb: 7 callbacks suppressed [ 1149.295706][ T29] audit: type=1400 audit(1786675684.412:4090): avc: denied { ioctl } for pid=28555 comm="syz.2.7782" path="socket:[118115]" dev="sockfs" ino=118115 ioctlcmd=0x89e1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1149.397744][T28560] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7776'. [ 1149.456893][T28564] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7776'. [ 1149.467791][T28561] binder: 28554:28561 ioctl 40046205 0 returned -22 [ 1149.483937][ T29] audit: type=1400 audit(1786675684.412:4091): avc: denied { append } for pid=28555 comm="syz.2.7782" name="cec2" dev="devtmpfs" ino=962 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1149.535817][T28564] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7776'. [ 1149.546814][T28565] netlink: 'syz.0.7780': attribute type 2 has an invalid length. [ 1149.576404][T28568] netlink: 'syz.5.7776': attribute type 10 has an invalid length. [ 1150.147107][T28560] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1150.180409][T28564] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1150.209514][ T5602] Bluetooth: hci3: command tx timeout [ 1150.234244][T28564] bond1: (slave bond0): making interface the new active one [ 1150.254427][T28564] bond1: (slave bond0): Enslaving as an active interface with an up link [ 1150.283597][T28568] bridge0: port 2(bridge_slave_1) entered blocking state [ 1150.290829][T28568] bridge0: port 2(bridge_slave_1) entered listening state [ 1150.298196][T28568] bridge0: port 1(bridge_slave_0) entered blocking state [ 1150.305311][T28568] bridge0: port 1(bridge_slave_0) entered listening state [ 1150.317904][ T29] audit: type=1400 audit(1786675685.442:4092): avc: denied { ioctl } for pid=28580 comm="syz.0.7787" path="socket:[117531]" dev="sockfs" ino=117531 ioctlcmd=0x587b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1150.345464][T28568] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1150.352059][ T29] audit: type=1400 audit(1786675685.462:4093): avc: denied { write } for pid=28580 comm="syz.0.7787" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1150.481740][T11694] netdevsim netdevsim6 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1150.514809][T11694] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1150.528365][ T46] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 1150.718340][ T46] usb 3-1: Using ep0 maxpacket: 16 [ 1150.728890][ T46] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1150.756895][ T46] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1150.789434][ T46] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1150.851000][ T46] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1150.873773][ T29] audit: type=1400 audit(1786675685.992:4094): avc: denied { bind } for pid=28601 comm="syz.5.7793" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1150.882120][ T46] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1150.957490][ T46] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1151.028541][ T5906] netdevsim netdevsim6 eth5: set [0, 0] type 1 family 0 port 8472 - 0 [ 1151.046829][ T46] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1151.181663][ T46] usb 3-1: Manufacturer: syz [ 1151.380880][ T46] usb 3-1: config 0 descriptor?? [ 1151.942650][ T29] audit: type=1400 audit(1786675687.062:4095): avc: denied { write } for pid=28582 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1152.063761][ T5906] netdevsim netdevsim6 eth6: set [0, 0] type 1 family 0 port 8472 - 0 [ 1152.335107][ T5602] Bluetooth: hci3: command tx timeout [ 1152.446863][T11694] bridge_slave_1: left allmulticast mode [ 1152.452662][ T29] audit: type=1400 audit(1786675687.581:4096): avc: denied { write } for pid=28623 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1152.478501][ T46] rc_core: IR keymap rc-hauppauge not found [ 1152.484614][ T46] Registered IR keymap rc-empty [ 1152.484722][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.498770][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.519244][ T46] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1152.520887][ T46] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input72 [ 1152.526312][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.570468][T11694] bridge_slave_1: left promiscuous mode [ 1152.577351][T11694] bridge0: port 2(bridge_slave_1) entered disabled state [ 1152.590608][T11694] bridge_slave_0: left allmulticast mode [ 1152.598928][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.609232][T11694] bridge_slave_0: left promiscuous mode [ 1152.626866][T11694] bridge0: port 1(bridge_slave_0) entered disabled state [ 1152.636026][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.679240][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.709483][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.728728][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.770931][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.817780][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.858522][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.898768][ T46] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1152.935138][ T46] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 1152.944688][ T46] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1152.965157][ T46] usb 3-1: USB disconnect, device number 79 [ 1153.187553][T28629] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1153.831946][T11694] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1153.878615][ T46] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 1153.909643][T11694] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1153.923273][T11694] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1153.935314][T11694] bond0 (unregistering): Released all slaves [ 1153.955803][T11694] bond1 (unregistering): Released all slaves [ 1153.988172][T11694] bond2 (unregistering): Released all slaves [ 1154.008057][T11694] bond3 (unregistering): Released all slaves [ 1154.024171][T11694] bond4 (unregistering): Released all slaves [ 1154.035363][T11694] bond5 (unregistering): Released all slaves [ 1154.042683][ T46] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1154.053767][ T46] usb 3-1: New USB device found, idVendor=0b05, idProduct=1abe, bcdDevice= 0.00 [ 1154.063531][ T46] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1154.080466][ T46] usb 3-1: config 0 descriptor?? [ 1154.112719][ T46] usbhid 3-1:0.0: fixing wrong optional hid class descriptors count [ 1154.144467][T11694] tipc: Left network mode [ 1154.150753][T25540] netdevsim netdevsim6 eth8: set [0, 0] type 1 family 0 port 8472 - 0 [ 1154.184283][T25540] netdevsim netdevsim6 eth7: set [0, 0] type 1 family 0 port 8472 - 0 [ 1154.228983][ T5714] usb 6-1: new full-speed USB device number 84 using dummy_hcd [ 1154.260682][T28459] bridge0: port 1(bridge_slave_0) entered blocking state [ 1154.272721][T28459] bridge0: port 1(bridge_slave_0) entered disabled state [ 1154.297606][T28459] bridge_slave_0: entered allmulticast mode [ 1154.333663][T28459] bridge_slave_0: entered promiscuous mode [ 1154.345203][T28660] Process accounting resumed [ 1154.345366][T28459] bridge0: port 2(bridge_slave_1) entered blocking state [ 1154.371806][T28459] bridge0: port 2(bridge_slave_1) entered disabled state [ 1154.384926][T28459] bridge_slave_1: entered allmulticast mode [ 1154.395303][ T5714] usb 6-1: no configurations [ 1154.415327][T28459] bridge_slave_1: entered promiscuous mode [ 1154.418942][ T46] usbhid 3-1:0.0: can't add hid device: -71 [ 1154.434586][ T5714] usb 6-1: can't read configurations, error -22 [ 1154.453323][ T46] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1154.520064][ T46] usb 3-1: USB disconnect, device number 80 [ 1154.534330][T28670] 9p: Bad value for 'rfdno' [ 1154.563873][ T29] audit: type=1400 audit(1786675689.681:4097): avc: denied { accept } for pid=28668 comm="syz.4.7810" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1154.600377][ T5714] usb 6-1: new full-speed USB device number 85 using dummy_hcd [ 1154.755237][T28459] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1154.770089][ T5714] usb 6-1: no configurations [ 1154.774853][ T5714] usb 6-1: can't read configurations, error -22 [ 1154.805568][ T5714] usb usb6-port1: attempt power cycle [ 1154.874500][T28459] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1154.936215][T28684] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 1155.019197][T28684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1155.043920][T28459] team0: Port device team_slave_0 added [ 1155.053361][T28684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1155.117553][T28459] team0: Port device team_slave_1 added [ 1155.156943][ T29] audit: type=1400 audit(1786675690.271:4098): avc: denied { write } for pid=28667 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1155.188230][ T5714] usb 6-1: new full-speed USB device number 86 using dummy_hcd [ 1155.229691][ T5714] usb 6-1: no configurations [ 1155.254297][ T5714] usb 6-1: can't read configurations, error -22 [ 1155.288381][T28459] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1155.333204][T28459] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1155.381911][ T29] audit: type=1400 audit(1786675690.491:4099): avc: denied { write } for pid=28702 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1155.409132][T28459] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1155.423199][ T5714] usb 6-1: new full-speed USB device number 87 using dummy_hcd [ 1155.446311][T28459] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1155.456441][ T5714] usb 6-1: no configurations [ 1155.461214][ T5714] usb 6-1: can't read configurations, error -22 [ 1155.467997][T28705] __nla_validate_parse: 1 callbacks suppressed [ 1155.468012][T28705] netlink: 44 bytes leftover after parsing attributes in process `syz.2.7819'. [ 1155.483683][T28459] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1155.512575][ T5714] usb usb6-port1: unable to enumerate USB device [ 1155.524383][T28459] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1155.566237][ T5258] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1155.579586][ T5329] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1155.662744][T28459] hsr_slave_0: entered promiscuous mode [ 1155.680840][T28459] hsr_slave_1: entered promiscuous mode [ 1155.710550][T28459] debugfs: 'hsr0' already exists in 'hsr' [ 1155.723560][T28459] Cannot create hsr debugfs directory [ 1155.739305][ T5329] usb 5-1: device descriptor read/64, error -71 [ 1155.752251][T28708] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7820'. [ 1155.873200][T28714] netlink: 'syz.2.7820': attribute type 10 has an invalid length. [ 1155.920958][T28714] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7820'. [ 1156.140972][ T5329] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 1157.369356][ T29] audit: type=1400 audit(1786675692.241:4100): avc: denied { connect } for pid=28723 comm="syz.0.7822" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1157.423984][T28712] bridge3: port 1(dummy0) entered blocking state [ 1157.453036][T28712] bridge3: port 1(dummy0) entered disabled state [ 1157.476543][T28712] dummy0: entered allmulticast mode [ 1157.494295][T28712] dummy0: entered promiscuous mode [ 1157.517635][T28714] bridge3: port 1(dummy0) entered blocking state [ 1157.526557][T28714] bridge3: port 1(dummy0) entered forwarding state [ 1157.529127][ T5329] usb 5-1: device descriptor read/64, error -71 [ 1157.569693][T28714] dummy0: left allmulticast mode [ 1157.583832][T28714] bridge3: port 1(dummy0) entered disabled state [ 1157.659985][ T5329] usb usb5-port1: attempt power cycle [ 1157.677004][ T29] audit: type=1400 audit(1786675692.791:4101): avc: denied { write } for pid=28718 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1157.955553][ T29] audit: type=1400 audit(1786675693.071:4102): avc: denied { write } for pid=28739 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1158.039168][ T5329] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1158.110168][ T5329] usb 5-1: device descriptor read/8, error -71 [ 1158.252822][ T29] audit: type=1400 audit(1786675693.371:4103): avc: denied { create } for pid=28751 comm="syz.2.7828" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1158.284706][ T29] audit: type=1400 audit(1786675693.401:4104): avc: denied { ioctl } for pid=28751 comm="syz.2.7828" path="socket:[119198]" dev="sockfs" ino=119198 ioctlcmd=0x89ef scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1158.381301][ T5258] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1158.398725][ T29] audit: type=1400 audit(1786675693.511:4105): avc: denied { name_connect } for pid=28757 comm="syz.4.7829" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 1158.528436][T28765] kAFS: Can only specify source 'none' with -o dyn [ 1158.529455][ T29] audit: type=1400 audit(1786675693.551:4106): avc: denied { create } for pid=28757 comm="syz.4.7829" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1158.608103][T28459] netdevsim netdevsim6 eth8 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1158.859942][ T10] usb 6-1: new full-speed USB device number 88 using dummy_hcd [ 1158.985451][T28459] netdevsim netdevsim6 eth7 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1159.030109][ T10] usb 6-1: device descriptor read/64, error -71 [ 1159.224411][T11694] hsr_slave_0: left promiscuous mode [ 1159.245269][T11694] hsr_slave_1: left promiscuous mode [ 1159.302471][ T10] usb 6-1: new full-speed USB device number 89 using dummy_hcd [ 1159.342298][T11694] veth1_macvtap: left promiscuous mode [ 1159.358658][T11694] veth0_macvtap: left promiscuous mode [ 1159.377464][T11694] veth1_vlan: left promiscuous mode [ 1159.395033][T11694] veth0_vlan: left promiscuous mode [ 1159.410189][ T4913] Bluetooth: hci3: command 0x0405 tx timeout [ 1159.470560][ T10] usb 6-1: device descriptor read/64, error -71 [ 1159.612123][ T10] usb usb6-port1: attempt power cycle [ 1159.647241][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 1159.647256][ T29] audit: type=1400 audit(1786675694.760:4111): avc: denied { write } for pid=28774 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1159.718386][ T29] audit: type=1400 audit(1786675694.810:4112): avc: denied { create } for pid=28792 comm="syz.4.7838" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1159.805563][ T29] audit: type=1400 audit(1786675694.810:4113): avc: denied { mounton } for pid=28792 comm="syz.4.7838" path="/299/file0" dev="tmpfs" ino=1596 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1159.897928][ T29] audit: type=1400 audit(1786675695.020:4114): avc: denied { write } for pid=28795 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1159.990127][ T10] usb 6-1: new full-speed USB device number 90 using dummy_hcd [ 1160.029927][ T10] usb 6-1: device descriptor read/8, error -71 [ 1160.279509][ T10] usb 6-1: new full-speed USB device number 91 using dummy_hcd [ 1160.323526][ T10] usb 6-1: device descriptor read/8, error -71 [ 1160.392214][T28459] netdevsim netdevsim6 eth6 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1160.451441][ T10] usb usb6-port1: unable to enumerate USB device [ 1161.009042][T28459] netdevsim netdevsim6 eth5 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1161.571934][T11694] IPVS: stop unused estimator thread 0... [ 1161.750178][T28818] 9p: Bad value for 'rfdno' [ 1162.058344][ T29] audit: type=1400 audit(1786675697.170:4115): avc: denied { write } for pid=28802 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1162.441317][ T29] audit: type=1400 audit(1786675697.360:4116): avc: denied { write } for pid=28840 comm="syz.4.7850" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1162.475554][T28830] tipc: Started in network mode [ 1162.519671][T28830] tipc: Node identity 7a95dffc55f6, cluster identity 4711 [ 1162.554912][T28830] tipc: Enabled bearer , priority 0 [ 1162.610863][T28828] tipc: Disabling bearer [ 1162.691738][ T29] audit: type=1400 audit(1786675697.810:4117): avc: denied { write } for pid=28855 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1162.818666][ T29] audit: type=1400 audit(1786675697.930:4118): avc: denied { bind } for pid=28856 comm="syz.4.7852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1162.946640][ T29] audit: type=1400 audit(1786675698.060:4119): avc: denied { cmd } for pid=28856 comm="syz.4.7852" path="socket:[119559]" dev="sockfs" ino=119559 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1162.980565][T28459] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1163.009019][T28459] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1163.021324][ T29] audit: type=1400 audit(1786675698.120:4120): avc: denied { read } for pid=28866 comm="syz.0.7855" dev="sockfs" ino=118737 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1163.045366][T28459] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1163.065679][T28459] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1163.083109][T28459] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1163.122487][T28459] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1163.142631][T28459] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1163.162306][T28459] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1163.407099][T28459] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1163.512937][T28459] 8021q: adding VLAN 0 to HW filter on device team0 [ 1163.552256][T26648] bridge0: port 1(bridge_slave_0) entered blocking state [ 1163.559401][T26648] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1163.650534][T11694] bridge0: port 2(bridge_slave_1) entered blocking state [ 1163.657698][T11694] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1163.703836][T28905] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1163.907506][T28905] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7864'. [ 1164.747495][T28923] netlink: 52 bytes leftover after parsing attributes in process `syz.4.7869'. [ 1164.773496][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 1164.773511][ T29] audit: type=1400 audit(1786675699.880:4124): avc: denied { write } for pid=28915 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1164.834210][T28920] UBIFS error (pid: 28920): cannot open "ubi0_0", error -19 [ 1165.333141][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 1165.349474][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 1165.363586][ T29] audit: type=1400 audit(1786675700.480:4125): avc: denied { read } for pid=28940 comm="syz.4.7873" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1165.521939][T28954] netlink: 'syz.4.7876': attribute type 1 has an invalid length. [ 1165.631804][T28962] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=28962 comm=syz.4.7876 [ 1165.651813][T28954] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1165.695272][T28966] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1165.697678][ T29] audit: type=1400 audit(1786675700.790:4126): avc: denied { write } for pid=28931 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1165.894630][ T5602] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 1166.842168][T28954] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7876'. [ 1167.109981][T28954] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7876'. [ 1167.136126][ T29] audit: type=1400 audit(1786675702.249:4127): avc: denied { write } for pid=28971 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1167.256748][T28979] tc_dump_action: action bad kind [ 1167.541780][T28459] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1167.844652][T28981] netlink: 480 bytes leftover after parsing attributes in process `syz.2.7881'. [ 1167.864043][T28981] netlink: 480 bytes leftover after parsing attributes in process `syz.2.7881'. [ 1168.294653][T29008] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7886'. [ 1168.967234][T28459] veth0_vlan: entered promiscuous mode [ 1168.986604][T28459] veth1_vlan: entered promiscuous mode [ 1169.056331][T28459] veth0_macvtap: entered promiscuous mode [ 1169.089453][T28459] veth1_macvtap: entered promiscuous mode [ 1169.145663][T28459] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1169.196214][T28459] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1169.260820][T11686] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1169.298737][T11686] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1169.317131][T29021] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1169.332883][T11686] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1169.522189][ T5714] usb 6-1: new full-speed USB device number 92 using dummy_hcd [ 1169.569119][ T46] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 1170.679894][ T70] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1170.802740][ T46] usb 5-1: Using ep0 maxpacket: 16 [ 1170.821275][ T5714] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1170.832758][ T46] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 1170.846535][ T5714] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1170.875781][ T46] usb 5-1: config 0 has no interface number 0 [ 1170.890455][ T5714] usb 6-1: Product: syz [ 1170.922561][ T5714] usb 6-1: Manufacturer: syz [ 1170.928044][ T46] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1170.973332][ T5714] usb 6-1: SerialNumber: syz [ 1170.983367][ T46] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1171.000052][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1171.006138][ T5714] usb 6-1: config 0 descriptor?? [ 1171.044464][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1171.049505][ T46] usb 5-1: config 0 interface 41 has no altsetting 0 [ 1171.083437][ T46] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1171.140929][ T46] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1171.158167][ T46] usb 5-1: Product: syz [ 1171.176261][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1171.182090][ T46] usb 5-1: Manufacturer: syz [ 1171.210629][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1171.211260][T29026] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1171.227840][ T46] usb 5-1: SerialNumber: syz [ 1171.253306][ T46] usb 5-1: config 0 descriptor?? [ 1171.272882][ T5714] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1171.289907][T29026] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1171.290681][T29015] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1171.352578][T29015] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1171.507731][T29028] netlink: 168 bytes leftover after parsing attributes in process `syz.6.7744'. [ 1171.672758][T29015] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1171.715685][T29015] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1171.736148][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1171.764461][ T29] audit: type=1400 audit(1786675706.869:4128): avc: denied { create } for pid=29029 comm="syz.6.7894" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1171.851315][ T29] audit: type=1400 audit(1786675706.879:4129): avc: denied { write } for pid=29029 comm="syz.6.7894" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1171.936962][ T29] audit: type=1400 audit(1786675706.959:4130): avc: denied { write } for pid=29029 comm="syz.6.7894" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1172.039496][T29032] FAULT_INJECTION: forcing a failure. [ 1172.039496][T29032] name failslab, interval 1, probability 0, space 0, times 0 [ 1172.086554][T29032] CPU: 1 UID: 0 PID: 29032 Comm: syz.6.7895 Tainted: G L syzkaller #0 PREEMPT(full) [ 1172.086586][T29032] Tainted: [L]=SOFTLOCKUP [ 1172.086593][T29032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1172.086603][T29032] Call Trace: [ 1172.086610][T29032] [ 1172.086618][T29032] dump_stack_lvl+0x100/0x190 [ 1172.086649][T29032] should_fail_ex.cold+0x5/0xa [ 1172.086673][T29032] should_failslab+0xc2/0x120 [ 1172.086698][T29032] __kmalloc_noprof+0xfc/0x820 [ 1172.086719][T29032] ? rcu_is_watching+0x12/0xc0 [ 1172.086745][T29032] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1172.086770][T29032] tomoyo_realpath_from_path+0xb6/0x690 [ 1172.086794][T29032] tomoyo_path_number_perm+0x23c/0x580 [ 1172.086826][T29032] ? tomoyo_path_number_perm+0x22e/0x580 [ 1172.086853][T29032] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1172.086903][T29032] ? find_held_lock+0x2b/0x80 [ 1172.086921][T29032] ? __fget_files+0x215/0x3d0 [ 1172.086939][T29032] ? hook_file_ioctl_common+0x140/0x440 [ 1172.086959][T29032] ? __fget_files+0x215/0x3d0 [ 1172.086982][T29032] ? __fget_files+0x21f/0x3d0 [ 1172.087005][T29032] security_file_ioctl+0xd3/0x230 [ 1172.087034][T29032] __x64_sys_ioctl+0xb7/0x210 [ 1172.087064][T29032] do_syscall_64+0x115/0x870 [ 1172.087087][T29032] ? clear_bhb_loop+0x70/0xc0 [ 1172.087108][T29032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1172.087126][T29032] RIP: 0033:0x7f157c39e0d9 [ 1172.087142][T29032] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1172.087159][T29032] RSP: 002b:00007f157d237028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1172.087179][T29032] RAX: ffffffffffffffda RBX: 00007f157c625fa0 RCX: 00007f157c39e0d9 [ 1172.087191][T29032] RDX: 0000200000003ac0 RSI: 000000004008af03 RDI: 0000000000000003 [ 1172.087202][T29032] RBP: 00007f157d237090 R08: 0000000000000000 R09: 0000000000000000 [ 1172.087213][T29032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1172.087224][T29032] R13: 00007f157c626038 R14: 00007f157c625fa0 R15: 00007ffe38351c78 [ 1172.087249][T29032] [ 1172.087281][T29032] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1172.305688][ T46] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -22 [ 1172.334150][ T5714] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1172.347293][ T5714] usb 6-1: USB disconnect, device number 92 [ 1172.545931][ T29] audit: type=1400 audit(1786675707.659:4131): avc: denied { create } for pid=29037 comm="syz.2.7896" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1172.572779][ T29] audit: type=1400 audit(1786675707.679:4132): avc: denied { read } for pid=29037 comm="syz.2.7896" path="socket:[120476]" dev="sockfs" ino=120476 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1172.636632][ T5714] usb 5-1: USB disconnect, device number 101 [ 1172.841825][ T29] audit: type=1400 audit(1786675707.949:4133): avc: denied { map } for pid=29041 comm="syz.0.7897" path="socket:[121382]" dev="sockfs" ino=121382 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1172.868679][T29042] netlink: 14 bytes leftover after parsing attributes in process `syz.0.7897'. [ 1172.891631][ T29] audit: type=1400 audit(1786675707.949:4134): avc: denied { read } for pid=29041 comm="syz.0.7897" path="socket:[121382]" dev="sockfs" ino=121382 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1172.985153][T29050] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1174.273196][ T29] audit: type=1400 audit(1786675709.378:4135): avc: denied { kexec_image_load } for pid=29057 comm="syz.5.7901" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 1174.346859][T29058] netlink: 20 bytes leftover after parsing attributes in process `syz.5.7901'. [ 1174.457845][T29065] netlink: 168 bytes leftover after parsing attributes in process `syz.4.7904'. [ 1174.676039][ T29] audit: type=1400 audit(1786675709.788:4136): avc: denied { write } for pid=29066 comm="syz.6.7905" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1174.748148][ T29] audit: type=1400 audit(1786675709.828:4137): avc: denied { create } for pid=29073 comm="syz.0.7908" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1175.389019][T29097] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1176.313235][T29104] SELinux: failed to load policy [ 1176.334505][T29103] input: syz0 as /devices/virtual/input/input73 [ 1176.459712][T29105] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7916'. [ 1176.560188][T29105] kvm: kvm [29101]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010058) = 0xffffffffffffffff [ 1176.617069][T29119] tipc: Enabled bearer , priority 0 [ 1176.701952][T29124] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7921'. [ 1176.725068][T29118] tipc: Disabling bearer [ 1176.749835][T29122] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7921'. [ 1177.102207][T29132] tipc: Enabled bearer , priority 0 [ 1177.254653][T29129] tipc: Disabling bearer [ 1177.992927][T29149] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1178.099077][ T5776] [ 1178.101427][ T5776] ============================================ [ 1178.107562][ T5776] WARNING: possible recursive locking detected [ 1178.113689][ T5776] syzkaller #0 Tainted: G L [ 1178.119641][ T5776] -------------------------------------------- [ 1178.125766][ T5776] kworker/1:6/5776 is trying to acquire lock: [ 1178.131804][ T5776] ffff888032a37928 (&grp->list_lock){.+.+}-{3:3}, at: snd_seq_deliver_event+0x230/0x860 [ 1178.141528][ T5776] [ 1178.141528][ T5776] but task is already holding lock: [ 1178.148864][ T5776] ffff88802c914928 (&grp->list_lock){.+.+}-{3:3}, at: snd_seq_deliver_event+0x230/0x860 [ 1178.158590][ T5776] [ 1178.158590][ T5776] other info that might help us debug this: [ 1178.166629][ T5776] Possible unsafe locking scenario: [ 1178.166629][ T5776] [ 1178.174055][ T5776] CPU0 [ 1178.177318][ T5776] ---- [ 1178.180571][ T5776] lock(&grp->list_lock); [ 1178.184965][ T5776] lock(&grp->list_lock); [ 1178.189354][ T5776] [ 1178.189354][ T5776] *** DEADLOCK *** [ 1178.189354][ T5776] [ 1178.197477][ T5776] May be due to missing lock nesting notation [ 1178.197477][ T5776] [ 1178.205767][ T5776] 3 locks held by kworker/1:6/5776: [ 1178.210938][ T5776] #0: ffff88801bc0b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 [ 1178.221353][ T5776] #1: ffffc9000447fd08 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 [ 1178.233238][ T5776] #2: ffff88802c914928 (&grp->list_lock){.+.+}-{3:3}, at: snd_seq_deliver_event+0x230/0x860 [ 1178.243398][ T5776] [ 1178.243398][ T5776] stack backtrace: [ 1178.249263][ T5776] CPU: 1 UID: 0 PID: 5776 Comm: kworker/1:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 1178.249283][ T5776] Tainted: [L]=SOFTLOCKUP [ 1178.249292][ T5776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1178.249302][ T5776] Workqueue: events snd_rawmidi_input_event_work [ 1178.249324][ T5776] Call Trace: [ 1178.249329][ T5776] [ 1178.249335][ T5776] dump_stack_lvl+0x100/0x190 [ 1178.249352][ T5776] print_deadlock_bug.cold+0xbd/0xca [ 1178.249374][ T5776] __lock_acquire+0x1256/0x1a40 [ 1178.249393][ T5776] lock_acquire+0x1b9/0x370 [ 1178.249408][ T5776] ? snd_seq_deliver_event+0x230/0x860 [ 1178.249429][ T5776] ? do_raw_read_unlock+0x3f/0x70 [ 1178.249449][ T5776] _raw_read_lock+0x5f/0x70 [ 1178.249464][ T5776] ? snd_seq_deliver_event+0x230/0x860 [ 1178.249484][ T5776] snd_seq_deliver_event+0x230/0x860 [ 1178.249503][ T5776] ? do_raw_spin_lock+0x128/0x260 [ 1178.249523][ T5776] ? __pfx_snd_seq_deliver_event+0x10/0x10 [ 1178.249542][ T5776] ? mark_held_locks+0x40/0x70 [ 1178.249558][ T5776] ? lockdep_hardirqs_on+0x78/0x100 [ 1178.249575][ T5776] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1178.249590][ T5776] ? client_use_ptr+0x107/0x4b0 [ 1178.249608][ T5776] snd_seq_kernel_client_dispatch+0x16f/0x1b0 [ 1178.249630][ T5776] queue_broadcast_event.isra.0+0x143/0x1b0 [ 1178.249645][ T5776] ? __pfx_queue_broadcast_event.isra.0+0x10/0x10 [ 1178.249660][ T5776] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1178.249675][ T5776] ? snd_seq_timer_start+0x1f0/0x2a0 [ 1178.249693][ T5776] snd_seq_control_queue+0x709/0xb70 [ 1178.249708][ T5776] ? __pfx_event_input_timer+0x10/0x10 [ 1178.249725][ T5776] __snd_seq_deliver_single_event+0x127/0x1c0 [ 1178.249746][ T5776] snd_seq_deliver_single_event+0x31f/0x8c0 [ 1178.249767][ T5776] ? __pfx_snd_seq_deliver_single_event+0x10/0x10 [ 1178.249787][ T5776] ? __lock_acquire+0x49f/0x1a40 [ 1178.249806][ T5776] snd_seq_deliver_event+0x44b/0x860 [ 1178.249825][ T5776] ? do_raw_spin_lock+0x128/0x260 [ 1178.249845][ T5776] ? __pfx_snd_seq_deliver_event+0x10/0x10 [ 1178.249864][ T5776] ? mark_held_locks+0x40/0x70 [ 1178.249879][ T5776] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1178.249895][ T5776] ? lockdep_hardirqs_on+0x78/0x100 [ 1178.249911][ T5776] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1178.249926][ T5776] ? client_use_ptr+0x107/0x4b0 [ 1178.249944][ T5776] snd_seq_kernel_client_dispatch+0x16f/0x1b0 [ 1178.249965][ T5776] send_timer_event.isra.0+0x130/0x190 [ 1178.249986][ T5776] ? __pfx_send_timer_event.isra.0+0x10/0x10 [ 1178.250005][ T5776] ? lockdep_hardirqs_on+0x78/0x100 [ 1178.250022][ T5776] ? snd_seq_queue_timer_set_tempo+0x199/0x510 [ 1178.250038][ T5776] snd_seq_oss_timer_start+0x1db/0x320 [ 1178.250059][ T5776] ? __pfx_snd_seq_oss_timer_start+0x10/0x10 [ 1178.250079][ T5776] ? snd_seq_oss_readq_put_timestamp+0xd1/0x260 [ 1178.250097][ T5776] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1178.250112][ T5776] ? find_slot+0x166/0x1b0 [ 1178.250126][ T5776] snd_seq_oss_midi_input+0x467/0xa30 [ 1178.250142][ T5776] ? __pfx_snd_seq_oss_midi_input+0x10/0x10 [ 1178.250158][ T5776] ? find_held_lock+0x2b/0x80 [ 1178.250170][ T5776] ? snd_seq_port_use_ptr+0x128/0x190 [ 1178.250188][ T5776] snd_seq_oss_event_input+0x194/0x250 [ 1178.250209][ T5776] ? __pfx_snd_seq_oss_event_input+0x10/0x10 [ 1178.250230][ T5776] __snd_seq_deliver_single_event+0x127/0x1c0 [ 1178.250251][ T5776] snd_seq_deliver_single_event+0x31f/0x8c0 [ 1178.250272][ T5776] ? __pfx_snd_seq_deliver_single_event+0x10/0x10 [ 1178.250296][ T5776] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1178.250312][ T5776] ? lockdep_hardirqs_on+0x78/0x100 [ 1178.250328][ T5776] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1178.250343][ T5776] ? snd_seq_timer_get_cur_tick+0x50/0x70 [ 1178.250362][ T5776] snd_seq_deliver_event+0x2c1/0x860 [ 1178.250382][ T5776] ? __pfx_snd_seq_deliver_event+0x10/0x10 [ 1178.250402][ T5776] ? mark_held_locks+0x40/0x70 [ 1178.250418][ T5776] ? lockdep_hardirqs_on+0x78/0x100 [ 1178.250434][ T5776] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1178.250449][ T5776] ? client_use_ptr+0x107/0x4b0 [ 1178.250467][ T5776] snd_seq_kernel_client_dispatch+0x16f/0x1b0 [ 1178.250488][ T5776] snd_midi_input_event+0x32f/0x470 [ 1178.250506][ T5776] ? __pfx_snd_midi_input_event+0x10/0x10 [ 1178.250526][ T5776] ? __pfx_snd_midi_input_event+0x10/0x10 [ 1178.250543][ T5776] snd_rawmidi_input_event_work+0x61/0x80 [ 1178.250563][ T5776] process_one_work+0xa23/0x1940 [ 1178.250580][ T5776] ? __pfx_process_one_work+0x10/0x10 [ 1178.250597][ T5776] ? __pfx_snd_rawmidi_input_event_work+0x10/0x10 [ 1178.250618][ T5776] worker_thread+0x5ef/0xe50 [ 1178.250636][ T5776] ? kthread+0x13a/0x450 [ 1178.250648][ T5776] ? __pfx_worker_thread+0x10/0x10 [ 1178.250661][ T5776] kthread+0x370/0x450 [ 1178.250673][ T5776] ? __pfx_kthread+0x10/0x10 [ 1178.250686][ T5776] ret_from_fork+0x72b/0xd50 [ 1178.250705][ T5776] ? __pfx_ret_from_fork+0x10/0x10 [ 1178.250724][ T5776] ? __switch_to+0x800/0x10f0 [ 1178.250738][ T5776] ? __pfx_kthread+0x10/0x10 [ 1178.250751][ T5776] ret_from_fork_asm+0x1a/0x30 [ 1178.250775][ T5776] [ 1180.692261][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1180.699488][ C0] bridge0: topology change detected, propagating [ 1180.705972][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1180.713162][ C0] bridge0: topology change detected, propagating