last executing test programs: 10.904022943s ago: executing program 1 (id=1161): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40046f41, &(0x7f0000000440)=0x10) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = io_uring_setup(0x830, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8008, 0xc1}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0xe22, 0x2, @empty}, 0x1c) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f000071c000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x48, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000140)="470fc770000f01b105f7000045dc70000f20e035000004000f22e0b9400800000f32430f01c2f3f0428022d3f346afc40195f8a70000000066b861000f00d0", 0x3f}], 0x1, 0x43, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$KVM_SET_SREGS2(r5, 0x4140aecd, &(0x7f0000000200)={{0x3000, 0x70000, 0xd, 0x8, 0x0, 0x1, 0x5, 0x4, 0x6, 0x6, 0x5, 0x6}, {0x0, 0x4000, 0x8, 0xb, 0x40, 0x4, 0x3, 0x6, 0x5, 0x5, 0xfe, 0x8}, {0x70000, 0x200000, 0x9, 0x81, 0x4, 0x6, 0x2, 0x8, 0x4, 0x20, 0x80, 0x6}, {0xa000, 0x200000, 0x3, 0x9, 0x5, 0x8, 0x81, 0xad, 0xf8, 0x73, 0xf6}, {0x9000, 0xeeee8000, 0x4, 0x0, 0xf6, 0x84, 0xa8, 0x20, 0x6, 0xff, 0x2f, 0xa}, {0xb000, 0xb000, 0xc, 0x6, 0x5, 0x2, 0xfe, 0x38, 0xfc, 0x3, 0x6, 0x7}, {0x26000, 0xeefe3000, 0x0, 0xab, 0xff, 0x3, 0x9, 0xe9, 0x2, 0x8, 0x3, 0x30}, {0xb000, 0x25000, 0xe, 0x3, 0xd6, 0x2, 0x98, 0x6, 0x10, 0x9, 0x7, 0x6}, {0xeeee0000, 0x867}, {0x60000, 0x91c}, 0x0, 0x0, 0xdddd1000, 0x400, 0x1, 0x400, 0x60000, 0x0, [0x0, 0x9, 0xc, 0x1000]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x1fe, 0x1, 0xfec00000, 0x2000, &(0x7f000000d000/0x2000)=nil}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 10.81721567s ago: executing program 2 (id=1163): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x2b, 0x80801, 0x1) setsockopt$inet6_mtu(r1, 0x29, 0x1e, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0xf, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000130000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x279, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000e40)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x19, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x41000, 0x1c, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007008500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a00), r0) r8 = socket$netlink(0x10, 0x3, 0x2) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000000)=r3, 0x4) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000440)={0x38, r7, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x2000000}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}]}, 0x38}}, 0x40080) 10.104350623s ago: executing program 2 (id=1166): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000fc0), 0x0, 0x0, 0x0}) 10.097273438s ago: executing program 0 (id=1167): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) creat(&(0x7f00000000c0)='./file0\x00', 0x48) 10.018543163s ago: executing program 2 (id=1169): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)={@val={0x1c, 0xf5}, @val={0x4, 0x1, 0x9, 0x5, 0xf}, @mpls={[], @ipv6=@icmpv6={0x7, 0x6, "991ba0", 0x200, 0x3a, 0x0, @private2={0xfc, 0x2, '\x00', 0xfc}, @remote, {[], @time_exceed={0x3, 0x0, 0x0, 0x4, '\x00', {0xa, 0x6, "f1782f", 0x8, 0x33, 0x0, @remote, @loopback, [@srh={0xb8, 0x6, 0x4, 0x3, 0x5, 0x60, 0x7ff, [@remote, @mcast2, @dev={0xfe, 0x80, '\x00', 0x13}]}, @fragment={0x6, 0x0, 0x5, 0x0, 0x0, 0x18, 0x64}, @dstopts={0x29, 0x7, '\x00', [@calipso={0x7, 0x38, {0x1, 0xc, 0x7f, 0x7ff, [0x100000000, 0x800, 0xfffffffffffffff3, 0x8a8, 0x9, 0x1]}}, @padn={0x1, 0x2, [0x0, 0x0]}]}, @dstopts={0xc, 0x13, '\x00', [@calipso={0x7, 0x38, {0x2, 0xc, 0xfa, 0x7fff, [0x101, 0x7, 0x7fffffff, 0x8, 0x41, 0x1]}}, @generic={0x4, 0x61, "383c342e8cccd2e2508164f45d0d9f5f956bf4077991054720d4a5a26c022d4f81642c955f6d95d20b8495fd44fa889d7491da8c94afb2ad0573add64c89684f24748a1623845670b5e4ddfe1ab604d28983881c49159416f38842eb5b413f7f95"}]}, @dstopts={0x2e, 0x5, '\x00', [@ra={0x5, 0x2, 0x7}, @ra={0x5, 0x2, 0x2}, @pad1, @enc_lim={0x4, 0x1, 0x2c}, @jumbo={0xc2, 0x4, 0x8}, @enc_lim={0x4, 0x1, 0x6}, @pad1, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x9}]}, @routing={0x32, 0x4, 0x0, 0x9, 0x0, [@local, @private0={0xfc, 0x0, '\x00', 0x1}]}, @srh={0x62, 0x4, 0x4, 0x2, 0xd3, 0x58, 0x8, [@private0, @remote]}, @fragment={0x6, 0x0, 0x8, 0x1, 0x0, 0x1, 0x68}], "5d60ea7da59c61b72a37b7d1c21abadb"}}}}}}, 0x236) 9.276891931s ago: executing program 2 (id=1170): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0xffffffffffffffff, 0x2, &(0x7f00000000c0)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x2) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000080)={0x0, r0, 0xfff, 0x5, 0xedce, 0xfffffffffffffffe}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$packet(0x11, 0x2, 0x300) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x8a800, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) setxattr$system_posix_acl(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x2) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000200)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x2, 0x1a1064, 0x3cac79}) io_setup(0x281, &(0x7f0000000100)=0x0) r4 = memfd_create(&(0x7f0000000600)='\xc0\x87:*\x18\xc1k\xa7\x87[\xa0o84I\xaaK\xa5\xd3\v\x86\xca<\x7f\xfd6\x8d}\xd8\xf2G\xb8\xeae)\x90\x86\xe3\x96\b\xe0\xfa\xb1\xd8N\xb2W\xcb\x8d}3lm8\xa57\xc9\x00HO\x00\x00\x00\x00R\xfc\xcb%u3\xec\xde%\x9d\xe4\x1d\rD\x82S\x17?\xd6\xb1\x9aF\xe2\xba[\xc7QR\x9f\x81\x8b\xdc\xc7\xdc\xdem\xbe\x7f2\x11\x17\xd8\xda@4\x9f\xc5*T\x1e^\xf7o\xff\xff\xff\xffwI\x02\xf3\xe3\x8d.\xd1=\xcf\xbf\x81\xb5\x8d%K\x1d\xe7_\xde\x87\xdd\xc1\xf0\x91\x1a!\xa5\xd3\v\xc9\x95d\xe3*\xa9\xfa\x99\xae\xb8\x89>\xc9\xf2/\x13{\x1a\x7f\x00\x00\x00\x00+$\xedX\xb7KV\x90\xc3D-\xf3\x8c\x9a\x15\x9c\xf5\xb4O\x17@d\x81+\xf6\xe6+\xed\r\xd2\xb3\xaa\x9b\x7fC\'\xa2\xf6\x12\xa1\x15Punfo\x7f\x92G\x0e.\xce\xd8h\xb9p2\xccC\xbaH\xc4\xdc\xe2\xa1%)\x85\xc7O]\'9\x92\xad\xfbJ\x02\x1d\x91-\xc99\t&\xbdq\x06`T\xc8\x92\xaf\xad\x06\xdd\xaf\x84\xf4\"\x13\xcf\xe5\x93D\xad~F\xe5\x19\xaa\xaa\xb2\xb1\x03m\x82+\x06\x1bF^\xd3n\xc4F\xc1\xc08\x94\xe6\xe5\x1f\xa7\xf6\xcaA\x90T\xf1\x1b\xe6\xb9\xe7\xff\xc5H\x04\x93\xca\xad\x17UlY\x9a}\r4\xac\x93\xac\v2\xc6\xf9\xbe\xfeI\x8b\xd4/`\xab\x1e\xcf\x7f\b\x94\xfe2.{\xc1\xbe\x9bth~\xcb\xb9E\x10W\xed\xed51[z\xb6>\xd3\xe7Y*\xdb\xa7h\nt\xddP\n\xc5\xeb\xb1ux\x94@\x00\x00g\x02D9\x83\xa7\x97\xf4\xb25wL\x97\xfb\xb9\xccj\xb3\x96\xc1@\xee`{\x87\xa8]\x96\x9cjF^+\xcc1l\xcbmA,5\xc4J\xcab\xa6\x91\xa0\xeaU\x92\x01\x1f,\xfa\x10\"+\x01\x00\x91\xe9\x1cz\xd1f\x901\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o\"\x85Np\xba\x0e<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8V\xe4\xa1C\x90\x17\xcc{\x9d\xf1\xbd\xb0\xca\x03\x96\x85h}\x8f\x1c)X\xc83rA\x90r\xb6\xba!;\x95\xaf\xe0\xcb\xec\xcd$\x02f\x8c4\x1aH\x8fC\xbfr\xd39\x92\x1fShu\x9e\b\xd4m\xa8\x16\xa6\xd5\xae\xcb\x03oFQ\"\xf7F\xb7\vp\xb6\xe5\x92\xe2O}.\x95A\x9bH\x8d\xa1\x80\x1b\x14u\xfdK\xce\xaf\x94i\xf1s\xf7\xb8Jq\xcb3=M\x84\x7f\x181/\x9bQ|4\xaf\xcf\r\xcfz Z\x19\xad_\x13\x99\xf7\xfdOD\xd3\x9d\x9d\xb8d5g\xf1\x84\xbd\xe5\xa2\xb3\xda\x82\x10n1\xed\xba\xe3\x96\x85\"\xb6\xa6n\xe7\xfd\xd4\a\x97\x85\x810/\xc4o\x11\xc8\x1b\xc0\f\xeec\xa4\x7f|P\x00\x00\x00\x000p\xaf\xfdk\xac\xcc\xac`\xc9\a<\xadIt\x9b\xeb\x8a\xfe\x9b\aO\xa5?h\xe1B\xa8C\x8e;/\xa8\x94\x1bs\xf0\xa9>\x9e\xff\xc9\xd2\x00h\xcb\xfb\xb6Y\xbfp\xd8\x90\x96\xec\x83N\x8bNnx\xb6\x16Y\xf8sU\xae\xa0\b\x8cLq\n\x1f\x99t\xb6\xffozu\xa0B(\xe9?\xcdA\xba\xa8\x13Qc\xda\x16?\xe8z\x8f\x862!\xbf\xa4\xb8\x9bC\xe9Od\xe8\xd32m\x06RX\x7f\xf7\xc2\n\x94\xe5P:l\xd9\xd5\xbd\rH6-\x8a\x12m\xff\xe9\xa0\r\tk\xda\xa4q(\xae\\\xb6\x14I\xf7\xe0z\xf1r7}) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000140)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x1, '\x00', 0x0, r9, 0x5, 0x2, 0x4}, 0x50) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000000c0)={r10}, 0xc) syz_usb_connect$uac1(0x2, 0x72, &(0x7f00000004c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x644, 0x8047, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x3, 0x90, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8001, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x95, 0x9, 0x7, {0x7, 0x25, 0x1, 0x4, 0x4, 0x19ef}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0xe, 0xa, 0xa8, {0x7, 0x25, 0x1, 0x4, 0x1, 0x7}}}}}}}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) 9.027082995s ago: executing program 1 (id=1173): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$unix(r1, &(0x7f0000001a00)={&(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001940)=[{&(0x7f0000000180)}, {&(0x7f0000000840)="299bf40cedccde9ee8f059db8d6a7b129b69cada985cd76a97810277054fbdfc2e022daaa18e177ff36599ea14c975125924eda710b06980dd395e2da80b6e9f47a3e303758ddb92169661d818cde5b54672ffc0e133677e5e9e6c829db54ae1139a0a3d20c9e71ee5aad711f07ce9f0e5dee9b33c5999b1d51d857730ef521e65fdeed8291284962182bc0a53b1bafd1a97219bda99ac22aef367443360eac24d072ae2a720f6d53db37d178e34a4e8a67bde616f8ff6fceb0d29045cb1261841a7617c42474060cba4356d120c78e5bbcd84f15fb18cdb11def2d1969177d96dbefe17d239241422d046b3c0a86ae39c65c62874e609cd7f5bf572f3507e0d98e8584d9c8fc70923fa6255bc1686f5575c5df8e427ee09cf23e64efc4317add1d96648fdb4113b44d9c388a8c84c6fd2ec08582d6584c962f27eda6fe0efe59f20dc7c36a98faa8cd2e9016a467f2c4f014f33438b0ea1feebb339a14b64ebe20ed2f4f5ca2bf0ba5c96a37e617ddc1a9e7ad4b955efb6e54c8c79cc13d40985b67dece5def9b78e278752136b8dbe573ddf63c911a29f78afec4e26f498fc9cacf800a796211b1127c0b92a9e44a71ea56efb68059cf4929c0fc564899eb1fc3bc4d2c2c1fbff0695f470e501e9064700f67873ce8941df8bedd23e9e93ff2987eb66bb6817ce19e0aa25e7fcb2110d9408acc81233ad5dc78827fc8d12ebb8c4faf0d50c5aabd9ac4649289aeeaf01948a38e7087a6c9ab4a6005b3ecae0fde05dfd2dbf16491b0eb74c7ef733f45e961e68130b860164f6b6befd1de0ea3f817ebf3ef7b2834bc080c73d874e187c5e88505aa4959da60169a6cf920ea8c8430e3c00212af69157c741a41d5e0054ace96b51cc34c372bdd39bf23c5dabde47481b62d0d5e31c7e36a04242252d2e735d8e9d4e5ed6f0ec55305e820ad5623b4055f1a4a3b835da87051b0ba9de6e9b6cd9340f1480ba7ea95d6e7480574128e38ec55023829f69ad00424d798390e5ee012b5c72d01d8b0d255f37204f0435d91f8af865abc49b964183f99cae974b23c600688ac5c28124de86d1bf00193777afccbfe87061dadf165ba176b86697266980cc0946b902b0a3fb4fb22f566210cc7f28694511d021b90cd32385ad82d2bcafba9b28270edf4eddf6d1a0b25dadf0a13720a8d1aba9766768007c5005a9f3a547c431df41327417bb95e701d4ab25df22adb897095726bd56886604263bf264ef2bfa1a78a6c384bccb2fd9bbf5e61f6208789d36457c633eab2f97e7a07680e79938d59b59a6803228c54e0bef93372df9eba9d9edbf76ddaf5ad7b16f83e1ff45a2a3e914295080f68bed419062a45f00cfdd502127bfec519af6bcfc9ce4b50708ce2be37a131656ff390dd2d4df251300f8a5de2190edf6788ce498a2302c97de5ab0e9bc351bf5395a8f4ccb5c22849cec823b4e7cca78dda68733dfb469b47a0c719f439ff95372f32b6ae92a7bcc0fdcad7396a4e456fa304cdb849b096948d0fea25f58a0d24d0d98e98d24c688b508d134c64b9007de35ba0a7602d5e57d6f59d2a6047953b9414af67f0000f39edd268b5a0e056a967b8b0d932d598e486c3e0ab26488368546622469b27b384608d2c425bbb7b029c6f82408f2a5636d6e53f542994329ebb015a6de6e336ae5f85662962dcf4ba523d65b4a38cdcaa0ed1280bd518586779de6ee6fa50cf6d7fa6a2ab946ae804b38d6ade12ed823738cb1ec14631d9730e23ed75f6cb998238705cc25bc39448572979c6f233efc04ed4dd53ca39bc258b3cc398947d4e5ccb8e2b605c7dffa64d5c76980db71a23e1b95e0aac3fc22ba068915f930d8ec53e4ba71e190187ce357e22c96469d4be99be9d2d2cec5345a2f096c657c00b42de3663f2658f44e6999315fe9f6af8b4b362db0ba970a912116ac6ad736ea4546574f6f2e487a32b95167b4764b0946aca18ec986aac135c1f88c578cbc969e9f188ef71685880de307181ed3234da35f55e720a21b8c58628774e8c640124e341918c95cab9abf79f05a094b2632654a262acb7a51c2b74c79cffb3b6ce58661aa44383e13d9ec8a9dd9d8535ed006114fa02eaf7512de5a072ebdcc443751c0a9d12d4f530f4d2e1782b5584606f16dbee1ab4d58e5fe9290622bd49c1d29a5ddda0c4c1a52f59a0a224f1a898c7688b5cd0b0685be6be7a665290de0db40808f3dbda096159718760325faae37e1ba7fc83585f8e717b6f029b70cbb599d448f790a63bfc43dc03ec8ab9d9213de0fdecd2275424e2da9f8e5fcbb0c7a4b78ce727c2c8510e737a8498c1e41ea6552b7f7920f279bed25e4bb51dff21819225a14256e6b00bb650ed310f39525df6f9ebbee4fb758d51b7cf0a64399ac02ac3189ae6b32226a8d1d91ebeb9b2690be8eecbeced5fe5400c4e6d9094b19d14371b185d980bc5932d786622995fb2df39fb4f69dc6495f32ecc1428ace96170fe313c5ea66253ca5522b36af72a8a5c0139e14c7937dfafd44bd60238cb1ebe9c32177d91da38a2169ecac63a167bd16b85e985ed2a0ca9280f892f4267f6470f3e08652b50609a3be534757e6034ecd317b5120bd2d4579574e6292b4465a69c04bedf2be3c6c8a4d8d99db4ab75d8a9164b6aefe821df18c7752f27177e097f294d3ea543cb203706166d72dafb9660eae1c3f29a7cbeec0be42bdf72d3e4a0d29d92327a47e45081051977c3e02b40b2ce6f3349f5aeb6e7a398cf34a53c3d5dee2474405c16f4cdbda9df225f739d9e2444576c444803a876821d6e16de80dfe1a074907b7a568785d251392c572d23b38309bb57d51be2f131ec0339b468197cb7c25d42d674b0b9466d872f66df704b6e076bf88c3193bf277c2c0dcbed8ddfabf6153f6eb584e098656f1fc12148e9cc99cd4ef04f06427194827c8675bf09dab38be2b676c584cf0c52d90b411228ffc64936010d17b1f8b8f37c4f89f5ecba5300a5c5dfc0da7a998a5b3194a6b9946d7bdcffcec786136f8745d3b659eb0d101f41c2714dc92db7fe8009665fd9b58a8bf245868996f46b36e2f48a3cb4fb255c1c042f1e6b8f1f4d8e8bd1242aed10a3f5a6f6fc01c0cf11982912e1690a6b8725f99b31917cca0d25a3290f854249572aeba544997e6173e9dc5ab560ec9565efbeccac7a6aa0c3c3424e09f0d42a2362d9c61ba574f3d2cb41f87f7a9a330571b8b25cf22a9449fa3390270e782d4fbf0a958f24f2e12da1e28f6a56fe903e14da55505278d9d527e6baa97abd0beb653bbd2315755a027346dc49a681c86f506c78b538ebc14761a681c528e63f598f11829aee31a87dd3c74c8d70cf622a038b33c082a923334f7d796b3255e222a08a11a5d30335b838f773bc245b6e962df38e898db039db58b159afdfc8372cb869c20a6d0b85ae359f476ec50515fb263e2acb0f1554a013b60c4f5ec0cdf9a3a189154786c374f41a80900346d0e77c9a8fc089b67c44ea413f5e5c48e28d663ec11060c8944816a4cc763e3a96148751f1cbb21c495d0a5ab74c7963871224cbbaa0d849dd74a87414db9c235e7207c36adb251d48d3fe1c04c6eebdd438b428a055f5c16f398627918e5b72b88966a3c85328f41530a13f80a3aebe6ad4762872dbe27fe6f0a3a8b69c49ef4d8765cbc342f566be7659a07a8fcca04d20347c5f69e724ff0afbd9cffe7cfb33822ff3c24be14bb8c7e4a33787eb883b5aa6452ee2e80ec5210f2d0b5917387b1191660ef24e387255795a406d78ce18ad966d09c10b1242a651de60637a935419d33f3f56c9796e6eb976a1705e8b5e5c0c3355ecb3c808c0efadabf8f9a1c173cf7372538fd1012eb688c14a2460c2add74b6205e3f94db228a09b1a6b6c58344fd78c8a3e18b714517d04a63bc8b6985a1ddb88b01d432c4194977c379ebf932643da263fe7876bf089983fc8bcd75428febf7c9bf42ed0fd00fd6dc14a350a225f6a41d2cfce94ecaf3716c094d9d3751bf861c19a780f0cfbe4e19044244a8342d4ed368333aa32f1a2b7607402b0612bd768c7f93979b8521fe52a0fb5bee8f6d941847b7ee93e9c00ce66aa3ae28cc582f73ec2795aba640d9e867bc650250b95816bc1e3fd17c9c686162323e05d4e892477983ae59c55a3f6ef412d691a0f1242bcdc59b45ce3939949b9ecd32b65ca1d8871f73225f5f4124fc0a561e73ff3e895d70b484e6908ee4eebd4720dd1294566c5894a262a44e5958306e0a155d4efc61dc4967372407ae2928900ae01e1f985c3c6fca398ebc9ab41c3dcc684d8ea9e04bd66e25de3f63d05986344af5921ad035c8b868119ab86999453eea8cf4923184919222c5f59b6b3c79b38e36fcb0a6707e549a915754156a9512566d7aa8e1af78259c4385e55276649064de3ad3713f7ec1e47dd4eeabee61a73dc070c8600cd3795cd190e930e3869d7895ccf02f3b4f510c01a5c411f23a1865518bbfb53f31a9a4b17bc5ce1403c78a7d787f142b287a5de56106553ba89ac10818e8b260e949606d560a72c6161d569690967abd7558e2cd210847d3c1cd6fda1ab694149dbd56d7defaa7b1b5ba70622ebe75b081a7559b22026c9fd65e80cc3678dd91b02a47687bda3ae30ad4dab26d00208c42674d3d5cb1e46ac6c3fdd58bb62e422707355094a55099dc0102c719ca296d59d048e46dda7fe7957e6b702e902be32130457cb4e1c49476b9f40aea33260da61c9cd46cac60ee81772c57dade3c17b69624e5f414e07ef036f00ef97b7c1474926f1307ffd04ba8c9ce0642394ce8ff865b68795fbc2030f192348a2f0b4d1ba38933aea48d8086ab931cb2f9ed188a19457e6eae11af2a8cd7ec6ea46735300167f3cb7f0712bd38f4d951e0b24ecf5895885b69478141bb583894977c4afc6f6b5fc0f605ceb4a58aeaafd74e69515e19efb48bacf6fc8d259e4d06de2abf44fd30bf45b60cb40574c878ebdcb581fd44bdfc8434aba4ab461313affc8ceb758486d76fed1074aac6fedd3ac6bbd210a187d2f74fb19d7c209eae12d6a2658767767590afa6b74f014050773adef24061d7c95b97c708739000c69ae8c08683d593d60c12329e8b1643074c0f7074de40a38395d5f1f862964bef371bace2ef24e080a9301e4b59847eb8dac753829970ae76d7585680f3bf6021126f14a16898f620e3f8015f1a7d87c7bbb49ddf3e697ece1ae1073414e290cc586a6b6c25ab9dd38419a6c180f951945054df5bcd45edd81df66ba321172facc2203110b3d669770757a9287f7cc801f4a34fc35840fb49f0da8c6b2c3a57dbde139dbb5e5fbeb3c67ee60e61deb05e02460fd363f579f58e5abad43e82ec488c17052fdee2a6c452bfdd4566b45ffbc510e5d54ce3db914a36032eca41569558f83b14b5ddc28f19cb107f0c563a554326735fbc5e46711c41656028b12ffec527bc8548db83da36fb6d25883fc778a32c99eacdec506e10f01c07793d844427d851d8c21b9c5467009bb5f53821021e7a43b41740b885d0420d1f4d209d49e2482124cb7dde88f6bfeed4ec63edf04cf69045e6e44cd8e5776eba542568baedc85ab97c13d52a2f09637f606bbd6f09702001900aa0b2b3030addb28ff3cd1064c872cbe04ceca8699e3571285968f8ab20b76c1c4fc83328879abbb306f70c42bff34c8cefa0d7716038ff49ec51c8f69db701dcce6dc475a872e64d4d55c53876103b56c0f8fca017f2c917d4cdfbdbe65dc4673e0f0cd301999d9f48", 0x1000}, {&(0x7f0000001840)="0c5440aba3d29618eaa9b8b5f02ee3c2", 0x10}, {&(0x7f0000001880)="a4924e3b0fc79da5aba441336de6b75cec1e8b2729f56ad5f1291bdb7ba9b9ca05d8080fe1a0186c9c5377742f17", 0x2e}, {&(0x7f00000018c0)="c4c05c2164c7cd771bbe0ae3ab617949ee94a4199d17d594e633d8c0dfca1b8eb5483576fa5c208e701484c03a6185a347391fbec76165ec2a88d90d7c131a79bb59ea1715fad1982cb4ca5e3c38f91f966b0020", 0x54}], 0x5, &(0x7f00000019c0), 0x0, 0x804}, 0x20008000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0xc, 0xb, &(0x7f00000000c0)=@framed={{0x18, 0x4, 0x0, 0x0, 0xffffffc0, 0x0, 0x0, 0x0, 0x6}, [@printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb1}}]}, &(0x7f00000005c0)='GPL\x00'}, 0x94) sendmsg$IPSET_CMD_GET_BYNAME(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB="280000000e060101000040000000000005000002050001"], 0x28}, 0x1, 0x0, 0x0, 0x2004c000}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000280)={r3, r3, 0x3, 0x1, &(0x7f0000000140)="81", 0x9, 0xf3, 0x10cf, 0x40, 0xc336, 0x1, 0x7, 'syz0\x00'}) 8.733399692s ago: executing program 3 (id=1174): syz_emit_ethernet(0xe4, &(0x7f00000000c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}, @val={@val={0x88a8, 0x5, 0x1, 0x2}, {0x8100, 0x0, 0x1}}, {@generic={0x9000, "684a807d6cf6dd0b230b2f9813ce9ffbed4ac798c53dbf4412051ba6784698d9cbe726a0067dc2fe6668e91c7cfd0e2827932729e4c2e8dfd71f56a90911fee23f35ef13d78083a6b0c000720f6368051713d657e4925e057c1be7a06a6adf77a3b3d6aef8d81bd7e386b1aba7df05e34b4b897694ecf95990cb75044c8776b872955681557070a6c4db524421d74f78d21fef3eaa9f92a275e4a65c401dc5e92b02607320dce4f398d7e24a1fd2241fee8fe68b73852ef209bffdca286bd2119bc29f3af6599a1397e95290424a"}}}, &(0x7f00000001c0)={0x0, 0x2, [0xf5d, 0xc07, 0x3bc, 0xf1]}) (async) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x1}}, '\x00'}) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000080)=0xf, 0x4) (async) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) (async) ioctl$UI_GET_SYSNAME(r1, 0x8040552c, &(0x7f00000002c0)) (async) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_NAN_FUNCTION(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r4, 0x1, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000814}, 0x20001104) (async) sendmsg$NL80211_CMD_DEAUTHENTICATE(r2, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x80, r4, 0x8, 0x70bd29, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xf}, @NL80211_ATTR_MAC={0xa, 0x6, @random="a315df37be2e"}, @NL80211_ATTR_IE={0x3f, 0x2a, [@dsss={0x3, 0x1, 0x1}, @rann={0x7e, 0x15, {{0x0, 0x56}, 0x0, 0xf, @device_a, 0x15, 0x7fff, 0x3}}, @prep={0x83, 0x1f, {{}, 0x8, 0xff, @device_a, 0xffffffff, @void, 0xffffffff, 0x8, @device_a, 0x1}}]}, @NL80211_ATTR_MAC={0xa, 0x6, @random="35a15c03869f"}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}]}, 0x80}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) sendmmsg$inet(r0, &(0x7f0000004880)=[{{&(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="240000000000000000000000070000004414061b"], 0x28}}], 0x1, 0x4000080) 8.628518372s ago: executing program 3 (id=1175): setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) ioctl$VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000140)={0x1}) r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f0000000500)="93", 0x1, 0xfffffffffffffffe) syz_open_dev$dri(0x0, 0x1, 0x0) close(0x3) keyctl$dh_compute(0x17, &(0x7f0000000100)={r0}, 0x0, 0x0, &(0x7f0000000180)={0x0}) io_uring_setup(0x667, &(0x7f0000000000)={0x0, 0xa14a, 0x1000, 0x2, 0x235}) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = syz_open_dev$loop(&(0x7f00000000c0), 0x8, 0x12001) ioctl$LOOP_CLR_FD(r2, 0x4c01) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @loopback}], 0x10) r3 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000440)=[@request_death], 0xfcff, 0x200000000000000, 0x0}) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f00000027c0)={0x2020}, 0x2020) syz_emit_vhci(&(0x7f0000000140)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x0, 0x0, 0x12}, @l2cap_cid_signaling={{0xe}, [@l2cap_info_req={{0xa, 0x3e, 0x2}, {0x6}}, @l2cap_move_chan_cfm={{0x10, 0xe9, 0x4}, {0x1, 0xff}}]}}, 0x17) 8.29014563s ago: executing program 0 (id=1176): r0 = landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x0, 0x0, 0x801, 0x0, 0x1}, 0x30, 0x2) writev(r0, 0x0, 0x0) syz_open_dev$swradio(&(0x7f0000000080), 0x0, 0x2) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) setxattr$system_posix_acl(0x0, &(0x7f0000000040)='system.posix_acl_access\x00', 0x0, 0x0, 0x3) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r4, 0x8b2c, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file7\x00', 0x1ac) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file7/file0\x00', 0x101000, 0x0) getdents64(r5, &(0x7f0000000240)=""/157, 0x9d) socket$inet6_udp(0xa, 0x2, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/unix\x00') lseek(r6, 0x10003, 0x0) 8.061132423s ago: executing program 1 (id=1177): r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000001b00)={0x0, 0x54485746, 0x1, @discrete={0x1, 0x100}}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000306010800000000000000000a000000050001000713000009"], 0x28}, 0x1, 0x0, 0x0, 0x400c050}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000040)={0x7, 0x200, "a99fc8bb20bb74ab86353331a3a06cf38d8f7679833165dc", {0x1, 0x9}, 0x8}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x38) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) 7.426448569s ago: executing program 1 (id=1178): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)) writev(0xffffffffffffffff, &(0x7f0000000400)=[{&(0x7f0000000280)='3', 0x1}, {&(0x7f0000000340)="2009f5", 0x3}], 0x2) ioctl$UFFDIO_ZEROPAGE(r1, 0xc018aa06, &(0x7f0000000380)={{&(0x7f00007db000/0x2000)=nil, 0x2000}}) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="12011001e8dbcf20460d810021fca502030109021200010303900909044f0500aca74b00"], 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) accept4(r2, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x1, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000019000000000080950000ced8d5f59b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x4000000000000, 0xfffffffffffffffc}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) write(r0, &(0x7f0000000000)="18000000010000", 0x7) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000000)={0x8, 0x400, 0x2, 0x5}, 0x10) waitid(0x3, 0x0, 0x0, 0x8, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r4, 0xc0305302, &(0x7f0000000100)={0xf, 0x20000, 0x2, 0xcbc, 0x1, 0x8}) socket$netlink(0x10, 0x3, 0xb) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r5, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r5, 0x7a0, &(0x7f0000000440)={@local, 0x1}) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000200)={'syztnl1\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x10, 0x20, 0x8, 0x5, {{0x19, 0x4, 0x1, 0x1, 0x64, 0x67, 0x0, 0xa, 0x4, 0x0, @broadcast, @rand_addr=0x64010100, {[@generic={0x44, 0xd, "4930e612b00dc0fbd75b56"}, @generic={0x83, 0xc, "5d568bdf5d0f3eff9392"}, @timestamp={0x44, 0x14, 0xde, 0x0, 0x2, [0x7ffd, 0x8, 0x3bbc, 0x6]}, @timestamp={0x44, 0x20, 0x93, 0x0, 0x0, [0x43cd, 0x8, 0x1, 0xa7c, 0x0, 0x4, 0x9]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) 7.330827948s ago: executing program 0 (id=1179): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000fc0), 0x0, 0x0, 0x0}) 7.153924396s ago: executing program 0 (id=1180): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x401, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x25104000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000c000000000000"], 0x0, 0x44}, 0x28) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r3}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x8, 0x0, 0x0, 0x0, 0x10, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, 0x0) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={0xffffffffffffffff, 0x0, 0x0}, 0x20) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="170c0000000004005000128009000100766c616e0000000040000280340003800c0001d600000000000000000c000100f1ffffff0c0000000010000001000080050000000c0001000100000000c0d600060001000400000008000500", @ANYRES32=r6], 0x78}, 0x1, 0x0, 0x0, 0x28001}, 0x48000) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x1) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) prctl$PR_SCHED_CORE(0x25, 0x8020000000000002, 0x0, 0x0, 0x0) ioctl$TCFLSH(r4, 0x89f3, 0x20001116) capget(&(0x7f00000001c0)={0x19980330, r0}, &(0x7f00000003c0)={0x3, 0x80, 0x10001, 0x100, 0x6e2e540a, 0x80000001}) listxattr(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) 6.332907406s ago: executing program 3 (id=1181): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRESDEC=0x0, @ANYRES32=r0, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0xaaa9, 0x0, 0x0, 0x41100, 0x70, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x7, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440), 0x0, 0x10, 0x4}, 0x94) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') init_module(0x0, 0xa99, &(0x7f0000001800)='GPL\x00') r4 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r4, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1, 0x0, 0x0, 0xff000000}}, {{&(0x7f0000000080)={0xa, 0x4e20, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x45af}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000340)="01", 0x1}], 0x1b6}}], 0x2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1, &(0x7f00000000c0)={@dev={0xfe, 0x80, '\x00', 0x34}}, 0x14) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)="5c00000012006bcd9e3fe3dc6e48aa310b6b87033c00a6001f03000000000000040012000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0) syz_clone3(&(0x7f0000000080)={0x2a694b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0x58) creat(&(0x7f00000000c0)='./file0\x00', 0x48) socket$inet_smc(0x2b, 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000200000000000000b6c447b499"], &(0x7f0000000180)='syzkaller\x00', 0x101, 0x0, 0x0, 0x1e00, 0x2c}, 0x94) 5.592411247s ago: executing program 0 (id=1182): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) syz_open_dev$vim2m(&(0x7f0000000280), 0x4eb36, 0x2) socket$alg(0x26, 0x5, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448cb, 0x0) r3 = socket(0x2, 0x80805, 0x0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file0/..\x00', 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1, 0x9}]}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x844) r5 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040410e414240000102030109026e0003017d0006080b0002012230090904000000010130000a2401100a00090000000904010000bf6b795fd14cc19101010230000905010960002503050a2525010400000500000904020000010230000904020101010230000905820900027706c00a2525ffffff7f01e10b"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r5, 0x0, &(0x7f0000000940)={0x84, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000000000)={r6, 0xfffb}, 0x8) close_range(r1, 0xffffffffffffffff, 0x0) 5.495331142s ago: executing program 4 (id=1183): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40046f41, &(0x7f0000000440)=0x10) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = io_uring_setup(0x830, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8008, 0xc1}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0xe22, 0x2, @empty}, 0x1c) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f000071c000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x48, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000140)="470fc770000f01b105f7000045dc70000f20e035000004000f22e0b9400800000f32430f01c2f3f0428022d3f346afc40195f8a70000000066b861000f00d0", 0x3f}], 0x1, 0x43, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$KVM_SET_SREGS2(r5, 0x4140aecd, &(0x7f0000000200)={{0x3000, 0x70000, 0xd, 0x8, 0x0, 0x1, 0x5, 0x4, 0x6, 0x6, 0x5, 0x6}, {0x0, 0x4000, 0x8, 0xb, 0x40, 0x4, 0x3, 0x6, 0x5, 0x5, 0xfe, 0x8}, {0x70000, 0x200000, 0x9, 0x81, 0x4, 0x6, 0x2, 0x8, 0x4, 0x20, 0x80, 0x6}, {0xa000, 0x200000, 0x3, 0x9, 0x5, 0x8, 0x81, 0xad, 0xf8, 0x73, 0xf6}, {0x9000, 0xeeee8000, 0x4, 0x0, 0xf6, 0x84, 0xa8, 0x20, 0x6, 0xff, 0x2f, 0xa}, {0xb000, 0xb000, 0xc, 0x6, 0x5, 0x2, 0xfe, 0x38, 0xfc, 0x3, 0x6, 0x7}, {0x26000, 0xeefe3000, 0x0, 0xab, 0xff, 0x3, 0x9, 0xe9, 0x2, 0x8, 0x3, 0x30}, {0xb000, 0x25000, 0xe, 0x3, 0xd6, 0x2, 0x98, 0x6, 0x10, 0x9, 0x7, 0x6}, {0xeeee0000, 0x867}, {0x60000, 0x91c}, 0x0, 0x0, 0xdddd1000, 0x400, 0x1, 0x400, 0x60000, 0x0, [0x0, 0x9, 0xc, 0x1000]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x1fe, 0x1, 0xfec00000, 0x2000, &(0x7f000000d000/0x2000)=nil}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 5.326329652s ago: executing program 3 (id=1184): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRESDEC=0x0, @ANYRES32=r0, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0xaaa9, 0x0, 0x0, 0x41100, 0x70, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x7, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440), 0x0, 0x10, 0x4}, 0x94) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') init_module(0x0, 0xa99, &(0x7f0000001800)='GPL\x00') r4 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r4, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1, 0x0, 0x0, 0xff000000}}, {{&(0x7f0000000080)={0xa, 0x4e20, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x45af}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000340)="01", 0x1}], 0x1b6}}], 0x2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1, &(0x7f00000000c0)={@dev={0xfe, 0x80, '\x00', 0x34}}, 0x14) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)="5c00000012006bcd9e3fe3dc6e48aa310b6b87033c00a6001f03000000000000040012000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40) syz_clone3(&(0x7f0000000080)={0x2a694b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) creat(&(0x7f00000000c0)='./file0\x00', 0x48) socket$inet_smc(0x2b, 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000200000000000000b6c447b499"], &(0x7f0000000180)='syzkaller\x00', 0x101, 0x0, 0x0, 0x1e00, 0x2c}, 0x94) 4.307675298s ago: executing program 3 (id=1185): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) setxattr$trusted_overlay_opaque(&(0x7f0000000140)='./file0/file1\x00', &(0x7f0000000180), 0x0, 0x0, 0x1) (fail_nth: 4) 4.213340527s ago: executing program 2 (id=1186): unshare(0x6a000000) socket$l2tp(0x2, 0x2, 0x73) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) unshare(0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x800) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000003c0)="7be194f795b067770d449b1e4e43654f1aa6a1474868424b5120a9594635ee805d5785a0e21809343d40f0f9683b04c4f953ef6b4613fce92f0d378e617553c7610f13601859c090baceba1c3d73202365842785286c37dda2ab855d9d66178d86e4d0e4563b0ebdbdfea26adf69c3da13a52ad9ab5160b467bc521443e02efa5005a8b0fef06657e634cf85", 0x8c) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x90000000000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001100)=[{0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0, 0x90f95eb2b7014cbe}, {0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f0000000680)="99b609ef53ba999488c2e11bce90ff9a91489c0c956122dacd7a65db94740e756dba361d1903c5033e6e6716b476a31b9e9eb2ad047bcff2087b7f11e1acce2a11069b108aae08dd13c84847309ba3625c6b6dd81b7ca417afc6af3b65b4fe2b323ba30e4deba16ee6ab900f87740b480dfc87e024835999282e5d9c58598b6c7227b7b6bccad8df5acf21697c192dbfa4dfcf99bb512bfb428e956e1ec20f8390d038fb5932c6bdf9ff08f6a80dccf8d2ab1752551c615c4a2f39ed9ff78304a96020aa9498bea07d877935054d8f96eebdc8634fcaa8031b9695df5ab72a1ef9a1252652ea1492277803d3e264722cb47854ad1834dfd6b497341480a19f53a70656db7158cc9a618e4e90636fb186e772b17093230d59e9c1a5f6fd3a0e82fba1fb4a7e13052563dcc63baf3d704671b704fdf47b4cd03de66be97a4e64", 0x13f}, {&(0x7f00000005c0)="b6d61bdceedc9b86bf24303303000000c861ed4000c1929c7e8968e92c030000000000000011fe0eea34b91d951ca8c6ef0353f4a0fa362eb30530bcc0ad8b000000000c50f7bd28365a28edff22e35d42316dd07ce2cf531be5f655631376fe8aac525c9ed56563938b0ba435ff0f0000000000003be0e7a9987aac4e57068f1336eb2a018b20a2f89a753f6a982acd00", 0x91}, {&(0x7f0000000880)="d3fdb3439da7026127875fd41fac5d7573a0b7b432dac4981b225cf3de101867fbf4104861ea1119a1d4b6d98ef1438882d154768ce5ce2fa17608d0e3a754f4bdbc5729ef61920bd38a", 0x4a}, {&(0x7f0000000f80)="1846247e91127cc350760f5e63c38c3f9142f94e379b845a081787b177a32904bb641cc1e1c08153ebe1aab8250b3348bce55b0050148f3784a07692d5bcd508615b7bef0384664879f9de082b15e7361e45555b5884366ea9584dc60b4e94ae841469063f011973690d0ac165bf6cd0575f7d32da2a50707dff999a9c8c00000000000000000000000000000000847be990492adf34398312800ff0433124ab034b25b41b238723013c2fcb0e945bf2", 0xb0}, {&(0x7f0000000ac0)}, {&(0x7f0000000bc0)="a258b90c3acc8ac592ce94a844fcd355f2209b1bc352f541dae753886779d661c58bc148d3aa50402c1fa60600c767bc864f18763d3f0806db597da6a546cc67ae16ba025e93c038c2913e4633865af0874f98c0599c4235da5b22eef313d678e9ba1c49a6fba32b7b3ff31db1715eb58e4916ec1aad7776c94503c613f361a3be52beeaa9a8a0e1d00be0b55a688ce2752209b8626a6bca0064c8f93e093cdd35fc6a1847607aa7dd04484c0734e499c93420a406cea08e0b328f8a796ca4e6648dadd93aae1bd626704cce183db40ff42197", 0xd3}, {&(0x7f0000000cc0)="f162b8c77ed8fad851340c289be7501b232dc460fe9748392043828f7d4be9ee0fddb2727d24a8a1492f36fb89b943b7c84508bd9534dbfd56249727fa5b2942fcca08471022ac7e214f557e0cf91687376642b25ffb50ca48217b68979ba8cc667a1ea425bf36c02845b302f094f826ef40533ddd57042506f9a591eae9", 0x7e}, {&(0x7f00000000c0)="a710721b0069e8c27b6c2978f46b50e11a1d90df060099b81a1fa52d1a4a7ea8424286a7dde2f1aec7e11248842066fc42c0f806df641c626c549bb90e2876213f625b639c2a9e561fb310a0fe6509bc6735fa2ec82bb4361cc236287098045ce8540e2b", 0x64}, {&(0x7f0000000e00)}], 0x9, &(0x7f00000014c0)=ANY=[], 0x168, 0x4048005}], 0x2, 0x4000021) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f0000000280)="0f01cf66f30f52af0060000066baf80cb808de698aef66bafc0c66b8000066efdbd5b9b50800000f32c4e2aaf5620ff3660f32c4e1fd6f4ed466b8da008ec866baf80cb86481d389ef66bafc0cb8d4600000ef", 0x53}], 0x1, 0x43, 0x0, 0x0) r6 = socket(0x1d, 0x80802, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f0000000380)={0x1d, r7, 0x1, {0x0, 0xf0, 0x3}, 0xfe}, 0x18) r8 = userfaultfd(0x1) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0xf58ed5ab95d0cf6d}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[], 0x38}}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000540), r6) writev(r6, &(0x7f0000000580)=[{&(0x7f0000000080)='`\v', 0x2}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) 4.196332577s ago: executing program 1 (id=1187): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'tunl0\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000000)=0x10002, 0x29) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r2, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x200}, 0x1c) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r4, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x3, @loopback={0x100000}, 0x6}, 0x1c) listen(r4, 0x6) listen(r2, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x10}]}}, @TCA_RATE={0x4, 0x5, {0x5, 0x9}}]}, 0x40}}, 0x4800) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xb, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x1}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff2c}, 0x68) rseq(&(0x7f0000000140), 0x20, 0x0, 0x0) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r6 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x6889, 0x1f280, 0xfffffffd, 0x399}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000713000/0x3000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffff78}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1e00001001000000f0ffffff0400000034000000", @ANYRES32, @ANYBLOB="0200"/20, @ANYRES32, @ANYRES32, @ANYBLOB="0300000001000000040000000e"], 0x50) io_uring_enter(r6, 0x8ae, 0xfbb9, 0x1e, 0x0, 0x0) r7 = syz_pidfd_open(r5, 0x0) ioctl$FS_IOC_GETVERSION(r7, 0xff01, &(0x7f0000000180)) r8 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x182000, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x12000, 0x0) ioctl$FBIOPUT_VSCREENINFO(r8, 0x4601, &(0x7f0000000180)={0x356, 0xa0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, {0x10, 0x8}, {0x8, 0x8}, {0x0, 0x8}, {0x4, 0xb}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xb, 0x400009, 0x6, 0x0, 0x17, 0x1, 0x0, 0x5}) 3.663151089s ago: executing program 3 (id=1188): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000280)=0x3) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r3, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x0, 0x6}]}) ioctl$KVM_INTERRUPT(r3, 0x4004ae86, &(0x7f0000000240)=0x4) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000000c0)={[0x8, 0x100000f, 0x9, 0x0, 0x1, 0x0, 0xd, 0x87b, 0x2, 0x0, 0x0, 0x0, 0x6, 0x6, 0x1, 0x3], 0x70000, 0x8340}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000000)={0x40, 0xb, 0x64, {0x64, 0x2, "044c9bdb5621bf54acd17adfdda080d442448bfbf8d8f7a9e4dbd96aaab0fc66827e169fa018d6f85070a83ee83374b6510e0632964d808fa05b481d3e8195512d86aa39e73d108893ab4387d4d231f36d24904cf1b0783a4089ed3d7c81a4bf0ddd"}}, &(0x7f0000000080)=ANY=[@ANYBLOB="00030400eaff04031104"]}, &(0x7f0000000440)={0x44, &(0x7f0000000100)={0x20, 0xb, 0xd9, "3e1e647a25563627dd1449ccc298273e97f23ded84a8e7e553fad0b299bc3ecf19dde1db0dcd14e93b453468b60b9968ffd2a36fd898aee546cdbdbc5a99f030651ce25be1afb35e51ac8cb39482c9158eeaace2ab30983992fb3204921a258d114d383ad67a6716180e667c84ef7459fe71e8d84fe892bb0cee2bd9351981828a95f193a246a0557a7bacecf168d94287b45932513ee5c4c1c5fac25c2e00c9aad373d040e500312b82fd9f1ba0887cd09dba138510232613c1a86942fcbde0273308192d1db348b947e6fa54cfb1738ea5479e461fc28465"}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0xc}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x1b}, &(0x7f00000002c0)={0x20, 0x81, 0x2, "5ff4"}, &(0x7f0000000340)={0x20, 0x82, 0x1, '^'}, &(0x7f0000000380)={0x20, 0x83, 0x3, "4727f5"}, &(0x7f00000003c0)={0x20, 0x84, 0x2, "a942"}, &(0x7f0000000400)={0x20, 0x85, 0x3, "dccdf4"}}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r4 = signalfd(0xffffffffffffffff, &(0x7f00000004c0)={[0xffffffffffff740f]}, 0x8) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r4, 0x89fa, &(0x7f0000000540)={'sit0\x00', &(0x7f0000000500)={@dev={0xfe, 0x80, '\x00', 0x32}, @remote, 0x8, 0x16}}) r5 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)='asymmetPic@\xe6u\x18\x8f\x8d\xd0\xb9\xb4d\x97\xee\x9bY\xb3\xa0dI$(\xed\x98S\xdcB\xdf\x99J\x9c&#m\xd0\xb0\x134m\xa7se\x8fvS\x84:\"-\x94\x84\xbd\xf4X\xf2F6\xe44\x1f\xa7f\x82\xd7aLt@%a\x8a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf\xb4\xc6m39\x9e)\xa5\xe7\xdb\xdc\xb3\xb6\x1f\x1d5\x13\xde\xab\x86\xf5`S<\xd5\xc7@-X0\xa9\xe4l\xab\xf0}\xf0\xeaco\x85kM\x8aS\x1bZ\xa1\xba\xb4E\xbc', r5) keyctl$restrict_keyring(0xa, r5, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000000)='id:cb2e') syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000000240)={0x40, 0x27, 0x2, "37b3"}, 0x0, 0x0}) 3.661861723s ago: executing program 4 (id=1189): r0 = landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x0, 0x0, 0x801, 0x0, 0x1}, 0x30, 0x2) writev(r0, &(0x7f0000000080), 0x0) syz_open_dev$swradio(&(0x7f0000000080), 0x0, 0x2) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) setxattr$system_posix_acl(0x0, &(0x7f0000000040)='system.posix_acl_access\x00', 0x0, 0x0, 0x3) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r4, 0x8b2c, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file7\x00', 0x1ac) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file7/file0\x00', 0x101000, 0x0) getdents64(r5, &(0x7f0000000240)=""/157, 0x9d) socket$inet6_udp(0xa, 0x2, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/unix\x00') lseek(r6, 0x10003, 0x0) 2.485671563s ago: executing program 1 (id=1190): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)) writev(0xffffffffffffffff, &(0x7f0000000400)=[{&(0x7f0000000280)='3', 0x1}, {&(0x7f0000000340)="2009f5", 0x3}], 0x2) ioctl$UFFDIO_ZEROPAGE(r1, 0xc018aa06, &(0x7f0000000380)={{&(0x7f00007db000/0x2000)=nil, 0x2000}}) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="12011001e8dbcf20460d810021fca502030109021200010303900909044f0500aca74b00"], 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) accept4(r2, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x1, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000019000000000080950000ced8d5f59b"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x4000000000000, 0xfffffffffffffffc}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) write(r0, &(0x7f0000000000)="18000000010000", 0x7) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000000)={0x8, 0x400, 0x2, 0x5}, 0x10) waitid(0x3, 0x0, 0x0, 0x8, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r4, 0xc0305302, &(0x7f0000000100)={0xf, 0x20000, 0x2, 0xcbc, 0x1, 0x8}) r5 = socket$netlink(0x10, 0x3, 0xb) ioctl$sock_SIOCBRDELBR(r5, 0x89a2, &(0x7f0000000000)='bridge0\x00') ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000440)={@local, 0x1}) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000200)={'syztnl1\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x10, 0x20, 0x8, 0x5, {{0x19, 0x4, 0x1, 0x1, 0x64, 0x67, 0x0, 0xa, 0x4, 0x0, @broadcast, @rand_addr=0x64010100, {[@generic={0x44, 0xd, "4930e612b00dc0fbd75b56"}, @generic={0x83, 0xc, "5d568bdf5d0f3eff9392"}, @timestamp={0x44, 0x14, 0xde, 0x0, 0x2, [0x7ffd, 0x8, 0x3bbc, 0x6]}, @timestamp={0x44, 0x20, 0x93, 0x0, 0x0, [0x43cd, 0x8, 0x1, 0xa7c, 0x0, 0x4, 0x9]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) 2.478884827s ago: executing program 0 (id=1191): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000044e22008d31324320dcb010c03010902120001040020000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000200)={0x14, &(0x7f0000000040)={0x0, 0xf, 0x8a, {0x8a, 0x5, "e75551ac3bbf730ddb23ba9ee0d0b017a3be14fa5f86f9a124fee98fa6ddcea0662f0a7157d1f3f45ca31afbe3287a3c4d088ad3e6c082b2d500a46e058457dd34e1d211dc8379435e8a343f8355f61e81d34272518ae3f4f467713bdf212bed5a0b25ba7d4f052686bff3c2b19cf04b5177ebeadebcba444f64b7d640d3891853633c8cdd0ad3e5"}}, &(0x7f0000000100)=ANY=[@ANYBLOB="0003c4000000c40310d65ffc40a779c4bdcb1e0a8b98fc07d113f05f185758e002301bdc3e150cfe8f495669139229d46c4c6f4c68523364ed273ef3ec67b4dba9f3c65e20d984a826a96a0365708154001ee78310a8368ef3153becf81d74a73b33cb6ed39fdd44a77fc2cbbdc20d7447ce418c18a9f45bb588670eed75007b07cd63031d5b33e951f8b47548271b89836992df3ad330abc373478ed9e54f6a2fc273e02d50546c153d380db6466eb65365d6ea7ff0739772605909ce002da9e2000000000000000000"]}, &(0x7f00000004c0)={0x44, &(0x7f0000000240)={0x20, 0xf, 0x83, "96ab58de43af3c99c754bd81115e0f20855155a7a628c45f54913b200e120fc623ad119b8231b22b8c3761921b0ad0bfa14e7e7364f5ae65e8a168ed6a62f8c20e4423c67b4cbf72857165c0b2d7abd34041b612d2b589c0856f47832260dc80c136972caec20af4d23b6e4ac02441cc811d38e80a03913724d22cfeada818ba4e4739"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0xd1}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000380)={0x20, 0x81, 0x3, "2490a0"}, &(0x7f00000003c0)={0x20, 0x82, 0x2, "4991"}, &(0x7f0000000400)={0x20, 0x83, 0x1, "c3"}, &(0x7f0000000440)={0x20, 0x84, 0x1, "c7"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "c7cd04"}}) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f0000000040)=[@ioring_restriction_register_op={0x0, 0x18}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x19, 0x4, 0x4, 0x1ffff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) listen(0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r2, &(0x7f00000047c0), &(0x7f0000004880)=@udp}, 0x20) unshare(0x22020600) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x9}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@ipv6_newnexthop={0x2c, 0x68, 0x1, 0x0, 0x0, {0x2}, [@NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @LWTUNNEL_IP6_TC={0x5}}, @NHA_OIF={0x8}]}, 0x2c}}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) recvfrom$inet6(0xffffffffffffffff, &(0x7f0000000040)=""/62, 0x3e, 0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000ec0), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r5, &(0x7f0000000f80)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x4, "1ce45b", "60566ca741c4e20411f2d6e601ea18f1293b4d8f73a5b9b50dd91982a0660972b708f2e2e09eed3d7b731c0bfccaceb147e1173955fdd575b077ac926cddcb67549b689bd4cf576d4d71d14014fdec4db42bb37b39ed4e22675a8c9ac1c0b3a035eff0c853d9fe79061a84d30af7c550ee9645e38ec58ee0305377ebaa7b81fa5fc2e04ad790d197d82c347b22c14e4b834e6619e63148c27d7e5451a393d35188600f8e25a2a350f34bad09b41164bab4b23001f884ada299ce258a668a615b5fcca4062a2bc6294943ccc9aa6167f21ff721307796568a97bdb22923589a4bc01385fe4262ed2478e8ed9bafa4dd60b28f9f5eb139076af38f3ee9a9e57d2d"}}, 0x110) semget$private(0x0, 0x1, 0x504) 2.372505389s ago: executing program 4 (id=1192): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102400, 0x19000) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[]) r1 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4f28, 0x3, 'nq\x00', 0x5, 0x8, 0x78}, {@dev={0xac, 0x14, 0x14, 0x30}, 0x4e23, 0x10003, 0xcd, 0x1}}, 0x44) r2 = syz_open_procfs(0x0, &(0x7f0000002400)='net/netstat\x00') read$FUSE(r2, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x1c, 0x68, 0x1, 0xfcfd, 0x25dfdbfb, {0x2}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="200000006a0005062cbd7000fcdbdf25020000000000000008000500", @ANYRES32=r5], 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x880) r6 = syz_io_uring_setup(0x18d7, &(0x7f0000000040)={0x0, 0x2ffd, 0x2, 0xffffffff, 0x177}, 0x0, &(0x7f0000ffe000), &(0x7f0000000000)) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r6, 0x2, &(0x7f0000000180), 0xfe) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) faccessat2(0xffffffffffffffff, &(0x7f0000019440)='./file0\x00', 0x98, 0xea076e9531dbe33) r7 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$vim2m_VIDIOC_G_FMT(r7, 0xc0d05604, 0x0) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r4, 0xc038943b, &(0x7f0000000100)={0x2000000000010201, 0x0, '\x00', 0x1, 0x0}) setsockopt$MRT6_INIT(0xffffffffffffffff, 0x29, 0xc8, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.current\x00', 0x275a, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r8, 0x40485404, &(0x7f0000019300)={{0x2, 0x3, 0xfcb, 0x2, 0xffff}, 0x4, 0x7ff}) write$binfmt_script(r8, &(0x7f0000000000), 0x208e24b) syz_emit_ethernet(0x66, &(0x7f0000019380)=ANY=[@ANYBLOB="e33110495bfdaaaaaaaaaa0086dd60cb653e00303afffe800000000000000000000000000015ff020000000000003cb85a5e99a693f715de9baa22dded00000000000000018900907800000000fc010000000000000000000000000001fc01000000000000000000000000000102019595f429ae08"], 0x0) 1.714989558s ago: executing program 4 (id=1193): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000640)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) close(r0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000001c0)="4b6a1bc33f6364cd8cfa6f0035e78321403825b1f336e4ba06f1dd123809ae8b32db03e4f1373a42a7a666", 0x2b) pipe(&(0x7f0000000200)) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000000)="d2c113c29ca1f0329c09333c4e57bb838cfea716579dab7d1cbdce058b04b86cd2573f5a46ec9ad1bb3c276903ebcad8758f3bdb0ea994c5ea01d7771c5b21040018c812e3b3d2c92d14193a28633e7a06c3239d8e97c69f11a821f535082d74ee0c1925c46bfba566d8c9647889a9dde67089b24871471415a695730085f81a0b7c8dc2eae85ccd015b85d7d1fecd2528f2a8369ee0315327ba0d506a583c716ea4fa23575566c8cf1a2a844691717179b82f10998b7d540188e57e864820665ab70db2d483c4fdcb115ea6bbd4a888f9d383f6fea063635b69686590f540c638a77fe8e8cb266cf72667e61871faf1d1810c749c30c5a7b61609d81114f7aa0355967a7513f659d021338ddb687b0f7372386170902b612c56f58dc73a1ccecb389ccd39f926ee91220a5c053dc277919ed4e32b63da14781cb46227a71388f2aeb37e8971d4a554824bb05f7e6861a916c94204feae48f115680a40b7b2da6ec3af295979016cb78ee53d347a2a8de81c26d0468db8b59df449513e109f26ccdff64403180deba17211813b69ef3f0c42f498a6f3d05a4e7f47f99a8b9ff6bb375fcd1cf444a794a7c2a274f2786c8c220b1f80f2d0c1f311960b37357e31198a44f1e25aaa320f6daad7a42c0367de29a2d0d5567098dfc4ac2b0393a7accfaed79afeec5c9d526503e8fbbd3d1f6365c698775999e5109bada3ec51a9d4b884631086bcfa4fe99135a7c482d9e3d2cbd0a58a42f8cd737a812c21185d909bab234d412bd450da975be70eac2a8db479f7030ff5f41817cd798d59a2db9d8d829765459531044ba3bfa6fc89d046c75e707133e5211fd05d20f63d4f493b23bcd966e3f4314a512451b761fb3b3ed815da07c604f71d2a86937142ede6fce427766dbde15f74f2c45d4c3c08e815b507bb05ee97ddf7ed79ea2ddd5c6ef057d455d84c79bdfd6e68ba6f5cd806a6b9dfd5ed65e394554fb59df7aba2676779a547cf8a7c97379abc760e94e01264a2a23c8c63296ec0d9a4e0aa5c9c470fe46beb8db8322372f3649b7d2ad0b8d09e77e4757a2f40835860b56d41382fabc35d891deedd2168ff3b20f3345ec3238ce795fd9b0311fbd7cf10bbefe4e9349bdf7ea5294f3fc3ded1203c01c9a057641ea122eea48e30b942fdebdc4e7263353361dfcf3562eb3f7eb491fe5394ac1e9af734950b3de71b557bd1baf334d39c5dd9e6842a3ef24004eafc5eb85fbdad5c1e49f60f565da146b119f27ec9077774e21300edf2883f34e299ae0465779ab80ba2d097f5d791a72785f35090dbc369864476c33d3279382a49ac45be1706211659d6fac1ae12d772fa270eb3746a69082e67664f4be335f2d172d52f5083a0768e5d4332352be40eb41e3406de4498e740a470141032ea251c144cdb5352d8049281898c72f13a5d3509c9c77308fe45016abfd7d42b1a022a60b9a5bbcece7c0a10bf9f157995465729b38fdcadd0d977574636206982a6b4e8f24bc75e3eb054fb9ae81e878afd24cfa9756f053bb89f0e4a42e195bd2af8a91a6dd5c9fbccd938681a7387ed22a0e3a8284d3182aa7ef1905a267850fc405494d7079f6d0364287cf7b16dc2310b15bc49fb68d1a96075cb5f30f4fc2ec0c51d0b7e806e78f108f4060a55b8c23b3c89a2f2fa321d5138019c417a504d230ec496583933daba2998e20d8f9a2e6798f681e1d4df88fa4e084513d3648ed4f6624d8b894470cf325e837ad177a634bf58d21378fa0d3370bcb724fa88314bbd0749bbe6ff9dd5d7826701891c180278833c3327a8b1500c3e86fbdaacaaba0e0f708052ddecaae4fe142689c812aeccc7211f61159e0787a8f639d1f0a4db373c17317fea5d3ca1c6060fc44a2d02502f0230334acb69861f0cdb82220827f5887a14e7eab133ce4ecd9a414b2a6b31d8c631325319bbb65ad01aaea7e157fea6cbb434c67f4582028c32f5890ceb243dc972e61e122cb36840d5838dff32d4b613ae1909f3970404fb1973f1e80b0e388141b2e24d47276be045880a4ac18fd136c08cf266b35c75e9b796f6210817439833b613195fe4688b22127a978d20f8b32e3df3297e09a565e659857d8052bf69c5006c5870bd25e6c3aeb411553924d06ccb849cdeca659448cb220d259b4ee20d256d44149814b5e13ab365c448369a43553e01874acded99d24da7d1c9c283dae95b0b5311344af85c7c9a8483fb18a5bfd7a4fb4bbade211edfa4c30f3d1b5bc9672a02adb5d638faea66424e2c82540937dc4cf21392fe16e05811f1bcfb83132deb1cf2a522f9b543758b25d6949400af5d2a7a566f4ab0f5fe0b0a8e8379850e3ed78cb823f5b59b3df4de700427b197720ec69b86c76080b2cfdc4a2619e9d2a901e247e591d79dea91257c0d4a3c7ebb86af42de6833aaaa2d69b71e684236705744b79c62079236759def4a37a0b97742dcdc1af8e54385ad496af31cffe7539e4a69d65ae28845439e5e3eea34785e6065c32f3c7b71ef4edfdb16ca9ee9d5d4e066a60f9919461ce932a61c4100276dad7a22447c681bfebac9186f23dd38509090e0c0fd60219d33174d0d1f5a2b3eb194ae1c7003b159dd560e909fcd0b14b803ded8a94f2a61ca59f9015a673c018515b7605512ecdec58b60aafcba88e88b790e6dabc09a6721613d4e60ffd8d01b07ccacc1c7f2415347f5f5aa9eb7e5d27090403a55d0364721bf0363e34bdf9d92c8e83fe39e8d23e0a038717c00f82dd27709ea69a7a857575f0e039b067750b0e226dd01091b6aecae409d563a72e0805c8c101401a9d4356c532ec27cf25ad0ea92eb137e5bb367623155b3e62baa1cb29d86e4765a635d180d26f37f58a24683494cca93547b1f9ff0cc81c085cc4509b746c5327f1f169ca3bd059d324ac91e3c05bb225e5f81655d2f5b5f0cd6389d35be14f63cf76ef856634c5c42f5f6763a457be1745d9ddc4e7a77cbe86398585dd18159eb7dadc2da143cabd5794c4caafab774c5b0ad661f6f9e7bd5163af6f214bbd6351560cfb5e9fe42d3b67912e0bb52926429a43c27aa6c52e904660029285c4b763d6becb5cd4e9a029fb092ae20df18e073627d896a8de5f89474cbc2d2a525edbaa635a9704ec9f30bc0d18dea437a986553da723befb7f91d73a9976a528d2ff2ff80aef0fb80b4c84fca0d810e1f0c3857aef2616c9908aa7dc6a02e28085ccbb88e13c8c8c1acc631e4121e39b453a5897602dfcff5629f88d75ae7375cb9d08969dc6e870870c7aaad3c62f1f39c363d7edfda2d5ce1e9e62b25cf3b31bf4da9b90616a79d3be8f031837844c13fa6ea8af83db6eaa6abcb5158c38abe7fd39b8710c7d8d830ac93d5d3cec1d038c7947861c4ea118b3c205be5c441d35ef856c9a81f970c2850397e735a2fb991fe2dd0f293224ed263963a1041dcefc67b77b25b82d6ab047eb282702ddab528cc4bfb8c82d86352057e893bfd4b41e3396d64d7f1a78f6a0d4cd420d4bf84eb791a513163f837556c1a2e7c4e84ab9bfaa3a23a7114bfd301ea1f6b5e5c94e076e8f42a4da7e05224589005625245672ef85a11d6ac4b379b72660583ccb62b3d6cf00090c9c0ef7f3e3bce7bc6e10baa0498799de647451281afb45cf053c7a57eca0732a8f9e9f02437be51649bc7d1a391aca1561fb6b2d47817394e97e426afda0fb9fdd248579b8eb768ef9e249dbef8b0ebbd0e8dec2f149e2356df3a9f728b5392875ea476b54a1c990040ef4e63373566611c5b555b5d60a0e69f32e05db3f9047ea3e261ee6e3d87516bb0fff783333eef6444c8d9d17f8b23514d6358c62cd34dbf0e9dd60f54f286c533d68f2610c82eaedd9e512884f37211f190a08cd3766c7ca6a5043ee9dbabf5994c48d03a2fa5ccedce7ffbe9cee1e9d54036ca4ca7c4fdc339011448c7aad3d14b639dc179e7a97f03b606b0e47a32b8c9ab82c59fbba5e0ab663538aba9ba71d27216614f59bdccb050cc2512f65f465e8476d36855df64b8bb181907e91f45c6262dba02b35dc238bb32b9cc7070d31f7f95f2193b5fca347874a64041ab629cb5c3a3d77ba999793badacf01c4244ae13c0d77fe01fae16c489fcd58010afc3084ffadb9bf7264f23f1ad0e8d9d762dcc431163c343054181812c9cd1a6ecdc9964caa0a2ba8cd29271e6824891129b89efc1ea2996100f1932940a49a324e8eb688d05ac7d6ba273aade15c2be8cc74ef1eafad9b9ebfdfa36edc5c6d109485a48ac6a8395ccdf23779919953cf3c61c3a635c7e782f84098f3cc6bea7644cf3924c2352c97c76bc7141227dd29f1d47ef209adc3aaefd8cf204fb265e6b262e83736c2f26b22d80870af83095338c23a47a5a86af2ae7decd1aaabd925ae900bfe8e82728e14fd82677769bc9962dbb507a61e206821ac9c0940b12d79ecb7a916b9f6573fa3d9a7ef773f66de8cf8db6536d986a29d7b50a2973d228ec48468c5ebec6253130c578e5ec2848b62e8e1082a3d584e84b86e24211a9546e1abf79e568827af5d9ba98ba7b33b5cd9cb7a81dc873ea11276049d9d6206d2ed0933ada7ef9b6823f24b756ebea834297743ffb146350f320ec9044df55b20df0ff84584c16350f465b5ad7d364f9b166fb534c2a0e65f6bb4d61feeb84463ceb4a4f7853c0c2410955881a60170b0bbc131f6699e2616752851063c7e8b0a82e4357b84e48bad8002610e5770c17ee0cb301f9dfe8d5cbb66c6962b5edcae17b5c5dd42026737ea9e2c79bfb9392d290b44d66ade6eb62e26321ee214a6d15facb7cca610b6209392179a50f3dcba1494d3f302745461f6172d329a12d68405be5ee05ad2a641a7aa3da1d1fd3198671bf1af5b39e2bdeed49df80cf0c6e0edc5c4812350097bda47d3fafb3827d73eeb0b29320c74dae6d4d61d8fc269652835f5a7f98710c644dd50d3af618651b41916bbabb9ea7cc46c8208dd7fb99474be66e1a970c899f17129a9ed17ccce0d93411e71b8f1c7790c787f7a97a50d54acbc6f4eee49a38882c34e3477c97e1c6da0b39a1e9d0d25a3cea9364033bf4f625a02412174d03dafd642526867578f71f2e52920833b8d23713d5ac48165f49545f6c7c75b5b4ef2e0682f8f2e191fdb6c0ba529856f887391f8d5aa3f7dfc5230170b97662611e53a4436bf4e98a5ceaeb16a79bb95f962b2675cb6da9f1cfcdc1ab604ef7749fe87ccb5a3660f463ff5f488b5c544cf847be84dab22d038730a7021cdc7f7ab714c1561c98a39cc92cd6aaf53c82b28665114ac18b2149ee7f1b52f894c28a49eb45d4cf6a0e65df39b3c717039ae41958fe810c1e05ad62ceef2980e0cfd891bfae0db61fb1c8d65b6812ef1bf5d426f955ab4826eae69f531979699685f5312882032a5f47ed8cf2e98e67d9f6c299d2060a04b4aa677500b48a33586b10f71293d57de846d2683621b588630a6ef06a41437bd99366787b787a68c71779132d0ee73aa5f97d5b9ca18a7ae26b7002512df1073e2eccdb4d2f137a15d9604e10547fa465aeb4f2e5899b531adeb5e72fb76c2c1c9d18ceb4a23a5f6174ba86a7119d82e35cb5a5d1c6a093351aaee0094b32b92417dc50c1d3806fffdafd2ec0e3ba176d84bdb7d59755e9083e61ded802e2a089ae9d6746f738b55845bcd4ff0a21888c2c6b972db043973fb323fd1c15e70137aa6a4bce3f60f27c1d1488f3751e5425a5776c7cc3a3c8acbfbd2171407e1a242e8e241e6e9e1287d8995265a8092ec59ad99652e63a41b744f34392017f29c1b1ca4ce7728200743d4497a70cfd2369d0ecf9e0ba6f28da25b2d918a06ad1173091b8d750b8c2120321818a0912bf47b96c9a8962930a843ea8419b24b8618b7b43482291906e151bf39d3634756d9e1ff5a6e787d1fc4be7349c38a3b882e059a5da930a9cb2a01eb8b24b54def2a2949538fc063542921947f1997dbee59842a50a043d431649ea0adde68c43259ab51592107b2618c5f761364d4d3d5d0f4d4ae1b94650cb4b695db5831c6dd789140b87525d9ed46fb8dce8fa75d68f317dfc3858d810928fb3530b7ae8701d622b0e69ab16cbbd46c8165c467850d081292da8147fe07f472776d1e2c75c17bdc0f8bafbc964da953a5efe64af69944f0f8858b2a4dece04428ede8967d0e93827910400af8a859b59579d9628191b291732bae90a3b50f8b2b7728725568a83e006ed21e940d4b7e7291ad6365138aa2d59c0b303cc298f7a70d0c39e4f17a878083631b1f96a65d7b4c5a4403929180694f55b71ba29685bdf472f0e21a1c8b3c2dbfc4892ffbc0f0f23f38ed0b785080c11b0766ffc5a0c2c750080b764df159e42ac8eb82681baec5b0ad7948153679162c223f63bf22545718accf2a30bc4402f6b54996baa00508c6def488975a2e2bf2a8dbcff49293e83f998f8baebe722cdfef96c46ac3d945d56ada194353f7cd03d2b86cb9844f7d63f008fbe553fe0023f6968e8bea9054ed3c567e5c55b283fb2337fbd20510e5e098537f5c1baa6b509f63b1e812840aaf470690894a2725f4460a106a3b0e14b12b47c3fc1a083ae7e8cd2e710b5d428b2063f7bb91105255cc0fcc8ac51398ec3df6416d283c4aba6ed44846e82be02d242c710c973c5f0a9b3b16da8a96f5cd2a164a3fa040075b0cb99944f1b34f7e79ae039d15a6c992cb40aa403de90992c064e1771f2a396734480f43b024dc799b8e242df235dc0d33cfdce41755722907f4533a1480d78e99320412326c27e15434fd3fdb19ed33a07063a8a62b39ce14be2ea1e0adadec65fcf4f19901bd801b87e90fc91f1270b420fb530b71b7aea9ad23c4a4ad28d4b63444bc2fa7b44247d5e9f0ca0209a489035b4521b5e886a419df1f9d0e27b9c5007ee75fd3909d4e0156973bdf2ff8d1a88cad1d534ba93648ecb34a30b1e760f1ee8cfb90c27c36385fd68ee48982e5f0c190e8786b7ef0e1dfd3cb1cc00efc19a92020b509d3e2c74b4265bdc765085bc49c6fc61476aa22cff375a78c59f33394cc6ff460584ebbd8dba2cbfe97feb1c9147068dbc1d3e25631ad8478d826d88c28b2cf967d07d3ff845cbb25699406d106eabd31066e9cf8abbe7598f71cca663a6f63bfb63caa95d3a363e69e9a3bc889d026df28c37e41786bf8c9a1ccc06c3499986a72bb10367f32b1b8a55365c2a5b46061b58b81c5da69ad39db6c468906f1c1225527f1b26a3dbad94b1419f3671086b061117206a634cd08beee1fcdfb4a3a7cc78b3cb1293dc900d0859505018b38033a1cc9a0051968af1f8fa60350865328b6834f9c30bb1734949fcdab62cc6904b285322da3d49f188019648cac314d65a7c57f4e25864f17e346e7ebbe411695a237622356ecc10e66c8ba33e7106a756b8d3abc1a1aababc26413adcfda74a59b9002a7e2e3edb3e7551d32c461c2e40c25cb9de751ffda44d7f353513c5bbbc473594127c09775844dec5dc922caea5532dfa98fe80d80243233a4f0c15520d9dc76da3623aabef3582380ca4d2f9558d6c71b672f259b94f26710aa1d933b3ad79c8755a96c18fcfd62a972ca80ea0d33afbfc80045ba7dab492aa06c73ea3a598b2bc6eb1549627d183c25c3486814960eb1e1b02200a92f51b8642683f88185a9ee91c6dbb576dd8a869e1338b81ec205d979242bd963308af90ec23e01d253a70440edd3ebfac8e489db0a70bb5c887f22e7a5de33918374a9ae5229d419b1948eeb23bdf8dce3c5df3b81d1a3e3b38e095f261cb9e00f5567413a5c13abb469fdf64adc830cc442a099609cf0ebd3ffe936d77d6099d816be2b4cdd31e4fdf5af5904120ec65e81138416462f9e9bbe9ba6d5980c7de01288bd9f4741848802c32f3774678367c70014e531ad7f95b5527d022232ada51148012328f1693b2d08b8eba80dc26d8e9fc369b410331ed720e410ded5bd03ce69942ffb97489a2c5b6e4da93cc73811738a141c3a16d4ff6edf2ad1b3d3ae45a21c5ca2613b92e7871dea89d3cd699b86520c80f6a391cc2911538f8108dc90203b0e74ee43a087e033265e0745a9c991facff49339c40601420bb72ef014bc4b9a51cad1dcde9f1567b4ae9d11b1416ff3d8dee15f4672bdbca4348e7e71f8d75a73851bc0ad539312b7d52c498602a5eda4630296fb40aaa90d8f6122da7fb56d02755f861df193bdc5effd8a0e54c2ef78a284f7543c2b25a81bf545be3a3f549aabe86700bf058877e3fec53813f9992814a2cebf341cedcad346dba70596da899add4d723d98366ab60997cae7e5b9d417252734d9145ab8c5ece5b5b0efdc2f2578838c500ee17b866323a951979c6f1a50da2833bc437bcddd6efaed0244df44e6069daf359289d9c50c073f0fef4be1fb3802be5ea643761ed6347a35a3f537cbde402911c28d7c7c7e6b8612facbe87221f3505ff078d0dbb28ec469fe6eba2efcb4efdcfc5745299c0850e21ee2c9ef77db8070d589c547cc7379b58677d16077093514849869ab5bf8f896fa933ba3edc676dcb73e91386cc48f01782ba635564e0f91988cf98a3a17544abfedcdc1d80540e9499bf98180feb80325194cbc369be3275ed390f8e91b8d75b1364e9fabe50a1e3b9531c3fe1aaf6523e54bb05738bd3a67ca5de01b2e479ef7678a86b13d6b747fb3cb5fe1be8913228705fc232ce422186cb79c3b66c944f6124eb414322806d47978044336221f26d3a09ed8dceb52e3c7e3413535faf1f7868cb47bbbf02c37b4cc877a1d5f4023083d5b36650b673a4e51387c64d44daf58057adaa5610d22a15329804cd51a42f663311c4e5ece9d99b5a813c4025e8e0a98c0f3ec13cf07de0b18d7e1ba7d3eb143f5825f62ae5b5f6d92b167f9dbb2177e84f23322566814296277fc2933956f818f5475b6aa031545e6e2265679d16cbedff96c4f419d5fabe99ee652feac8acf9a90771ab8ade8291b42d25ebbdc03faac02b9599fdb83621f6ae1e2e7f946520f3cff881cd600c17b4a00c08d0996f7d2bb97d35647f72b80ba8ad3b4a16cb71094b2d1193a5fa1456e4671788bc51c0d506f4809ca34620d4a75a62ddfa20ab5c4d347a08eb8784d4c572fcb473b766f5e1ce9d92db70ebee83accd58b8253da36b9542686edce545261f309144a3d64900f796620003b36ee3d44a06cc4d088f73aa45288b90476d2e1e461795d473d59500aa23a6b7724a2f0d6473dc2f0af6ea311a648e193072016e199b920bc8c0830ae18f1c17e33d73badadc0f9d34cd52b54f4d3d480a7ddfe0f140f8de1a382a4c5a722d3e0f875b69054d88b8bab94e9394ba8d28937f1ffd871d1666a377620e7f032633fe58ebc87e533bd6461b537cdde38352ece085378dd7b24fa3fd5a3dc3f5b77492e4fc91238a8bfcc4e20bb396bd3317155981ec593926f2e9f15e5ac1aa533e122441649a681d88142a93386a6ed6b2d5b18d7fb57541e31a69acee17345b08c6667ebbc53a082fbcd980b4751937ba729dd2fd9b43d06091517922dd3ea524db002db7525902a465081843191d2d7ac76adb7724ac2bb88e4cb2f3188dbf0cd47acf5011b4519ec100a44b2ee6a1dacac5aade2cdcdca777c6b5edf596b05691d247f671491f68bf2e113a7e8674309ea98ab794d05c664ade246288796270e10f4a308420a62bf0df1d1636330e88bf4cc78051e5f715c8f97b8a83119b3fb5129ac6d0733256bec96d8cf435fa005e14d88884a0ca24266a4e78e25e2519796ba31971e4d0cb44ea58c5ddf54a15e3b449642e395679fc5ba600cc6bb7f2b004bfb0d621e51f9cf16309e4a02ce4f23f4a2d225aa8c84840bf2d3522a5f7a983cfbbfe4adb62d6ea622ebb784072bc6673878c5eaa865a7657b619f48cf0c51a4b0d47b20f426adc7f8ab68238b97abf68443f0eaac3796bfd99e0bc644e4f6fc43e551eccd615db802dfb031444e09aedcb04846bb894a2cf42dd0a578dc94d727736e502194ae25bf8556373969cb7f27788b6edf5b2bf25a79c7f89289f827ed4be611d65f6bd89698b130aaadd0f2d914819f41a0185dfc73adcea80d2ee592bf32d15010cb32a95ef112bccb2b780b461637ffa1641d34e1b114cdd3dd1ceb365933efef1781f9ec620a73097594c945969c2ea036e36b2380b33599c3e1d4eb2b7f210324aee3bba5a944b71cf0246ceed878897fe00e30d0bd32b3dde08c8805e30efe39cbc9d11b97491d82fbb5d93b1997e5f3128252472ecd256b9f79611175b6f686629ee744d0ba2494607a4476ea5f934c936403509c14bddbc2403ad5d97bfed0da36707b66f39ffdcee7ab39602e740c1ca9761570cdbab5f56b2060db428921457445b15c4c92b9c4b0ebb0746936bc3053836fa884e97c96e44d18a5a52feca033ec4caf950927bf9a281ea1aacb2a8b1a1f74b20de25ad5f3e459ab8b61ba5d00eaedcb6b5467dcd8608cfd48cc8c1a01f2c9f68bc9ef9adf2fd81cb3e28277c52d58f42ea87c8896383c2fa88dd15dba7172990893fe28ad1b50095b2ca20856de64693f3a663be6e34a9ccbb09add5724c5599495d0c95d2b900444651048bf418070b324016678d694b82565931159ffc37d3eefd7b482c41637cdd69b8f7051b6e88cf87a01d26d0689057ca0f66f65a2c3fbca608f7dec52d8e41ea98d21be162eeb38b27e9465d5525e0ffac3bd989adae19bdcf98edc48ff9d9d2a2f0850fa2cac8421ee6e211b1930f9fe9cb7138e8058ae476aa93c0ca49b170eb4ebbbb6fb4020d000eae537b4dd4bdfc63e3fb281848c057b94fc14dc12f8833d5ada50c8f0178137964c3b1524c59eae7ae19066a8003b9f4036b0be91f6f24baf6839f360473907135a8eb777dfe4dcf18d15fb8e16d069c48c5a128f046667f66bb22d36e986c73d2ebaa1a9638a9e8c049d0c766e2008fb19c4aabd96e3443c48377214b01dec0f73538fa5a882553a60664e549030fc9cc21a74a73cf79cfdbbfa3676a474910a295044d804b9f6a30104fc8250da4efcfddc379c3a1b84a2050ee78b18ba84ec5cb4db62540ea7be026b48d2b9294f06aa48e44087dbc494d92fe3e8648792c2b9f5d0d580afac814f8fc74208239b5f8fa6c20fc75c9d73fbe448a4fd1eb1af10165c37e7aa72c83c47dbb92bf3203bc0bea3b3ae261636b9a6b621725aed16de5c33502f152ca3704b1e83a60cfc5807177d9e561b12f43c3ded0951c4ec7af0ab29f55e3745df0f10bedcdcee2d443c0023d7547018c94e2cbb04a5c67a81d33df4dda99f80777b1db00f91bf8abb96ca360353c08b8979d00860ee3af86988171d6739a0f546f64ec34c045afd1be790176228204782836484f6d118d734c8e1b302788aa20e704502da74cd11bc5a22bb717a1d10d5176a4426e88cc132479aa7e8370772b9776ea38d5bd217b08c50f94072acbdf93e732e6ce41f92159b626e59e39925b458465ec3b0191a56d8e1c3a76110200e38380ccfcc1a05f85608bc3ea0bdbbf326bfe003158c8c9e01e90a7ae164cc20de5b23146baa9786111", 0x2000, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x10001, 0x2, 0x1, 0x5, 0x4, 0x6}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002000)={0x0, 0x0}, 0x28) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) io_destroy(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r5 = openat$comedi(0xffffffffffffff9c, 0x0, 0xe2100, 0x0) ioctl$COMEDI_BUFCONFIG(r5, 0x8020640d, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000047c0)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r6, &(0x7f0000003700)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000280)=""/4085, 0xff5}], 0x1}}], 0x4000000000001a3, 0x140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e20, @empty}}, 0xd9d, 0x1}, &(0x7f0000000040)=0x90) 1.3564ms ago: executing program 2 (id=1194): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRESDEC=0x0, @ANYRES32=r0, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0xaaa9, 0x0, 0x0, 0x41100, 0x70, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x7, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440), 0x0, 0x10, 0x4}, 0x94) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') init_module(0x0, 0xa99, &(0x7f0000001800)='GPL\x00') r4 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r4, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1, 0x0, 0x0, 0xff000000}}, {{&(0x7f0000000080)={0xa, 0x4e20, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x45af}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000340)="01", 0x1}], 0x1b6}}], 0x2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1, &(0x7f00000000c0)={@dev={0xfe, 0x80, '\x00', 0x34}}, 0x14) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)="5c00000012006bcd9e3fe3dc6e48aa310b6b87033c00a6001f03000000000000040012000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0) syz_clone3(&(0x7f0000000080)={0x2a694b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0x58) creat(&(0x7f00000000c0)='./file0\x00', 0x48) socket$inet_smc(0x2b, 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000200000000000000b6c447b499"], &(0x7f0000000180)='syzkaller\x00', 0x101, 0x0, 0x0, 0x1e00, 0x2c}, 0x94) 0s ago: executing program 4 (id=1195): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000000), r0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) sendmmsg$inet(r2, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x24, r1, 0x121, 0x0, 0x0, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x24}}, 0x0) kernel console output (not intermixed with test programs): .867552][ T5793] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 301.895711][ T5793] em28xx 2-1:0.0: board has no eeprom [ 302.470138][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 302.470154][ T29] audit: type=1400 audit(1782641055.409:850): avc: denied { mount } for pid=8684 comm="syz.4.739" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 302.503066][ T8685] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 302.581149][ T29] audit: type=1400 audit(1782641055.519:851): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 302.632124][ T8687] FAULT_INJECTION: forcing a failure. [ 302.632124][ T8687] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 302.652566][ T8687] CPU: 1 UID: 0 PID: 8687 Comm: syz.4.740 Tainted: G L syzkaller #0 PREEMPT(full) [ 302.652605][ T8687] Tainted: [L]=SOFTLOCKUP [ 302.652611][ T8687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 302.652624][ T8687] Call Trace: [ 302.652630][ T8687] [ 302.652637][ T8687] dump_stack_lvl+0x100/0x190 [ 302.652667][ T8687] should_fail_ex.cold+0x5/0xa [ 302.652692][ T8687] _copy_to_user+0x32/0xd0 [ 302.652714][ T8687] simple_read_from_buffer+0xcb/0x170 [ 302.652734][ T8687] proc_fail_nth_read+0x1af/0x230 [ 302.652760][ T8687] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 302.652786][ T8687] ? rw_verify_area+0xce/0x6d0 [ 302.652809][ T8687] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 302.652831][ T8687] vfs_read+0x1e4/0xb40 [ 302.652859][ T8687] ? __pfx_vfs_read+0x10/0x10 [ 302.652884][ T8687] ? __fget_files+0x215/0x3d0 [ 302.652906][ T8687] ? __fget_files+0x21f/0x3d0 [ 302.652933][ T8687] ksys_read+0x12a/0x250 [ 302.652953][ T8687] ? __pfx_ksys_read+0x10/0x10 [ 302.652979][ T8687] do_syscall_64+0x115/0x870 [ 302.652999][ T8687] ? clear_bhb_loop+0x40/0x90 [ 302.653016][ T8687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 302.653030][ T8687] RIP: 0033:0x7fec00d5d68e [ 302.653042][ T8687] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 302.653055][ T8687] RSP: 002b:00007fec01cfdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 302.653069][ T8687] RAX: ffffffffffffffda RBX: 00007fec01cfe6c0 RCX: 00007fec00d5d68e [ 302.653078][ T8687] RDX: 000000000000000f RSI: 00007fec01cfe0a0 RDI: 0000000000000004 [ 302.653086][ T8687] RBP: 00007fec01cfe090 R08: 0000000000000000 R09: 0000000000000000 [ 302.653094][ T8687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 302.653102][ T8687] R13: 00007fec01016038 R14: 00007fec01015fa0 R15: 00007ffeca769418 [ 302.653121][ T8687] [ 303.070044][ T5793] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 303.088792][ T5793] em28xx 2-1:0.0: dvb set to bulk mode. [ 303.092397][ T8652] em28xx 2-1:0.0: reading from i2c device at 0xe failed (error=-5) [ 303.095262][ T5703] em28xx 2-1:0.0: Binding DVB extension [ 303.178447][ T5793] usb 2-1: USB disconnect, device number 25 [ 303.230527][ T5793] em28xx 2-1:0.0: Disconnecting em28xx [ 303.645816][ T5703] em28xx 2-1:0.0: Registering input extension [ 303.653451][ T5793] em28xx 2-1:0.0: Closing input extension [ 303.794031][ T5793] em28xx 2-1:0.0: Freeing device [ 304.244443][ T5711] kobil_sct 4-1:3.79: required endpoints missing [ 304.286361][ T5711] usb 4-1: USB disconnect, device number 22 [ 304.355454][ T8700] use of bytesused == 0 is deprecated and will be removed in the future, [ 304.372017][ T8700] use the actual size instead. [ 304.388419][ T8700] FAULT_INJECTION: forcing a failure. [ 304.388419][ T8700] name failslab, interval 1, probability 0, space 0, times 0 [ 304.410791][ T8700] CPU: 1 UID: 0 PID: 8700 Comm: syz.3.743 Tainted: G L syzkaller #0 PREEMPT(full) [ 304.410819][ T8700] Tainted: [L]=SOFTLOCKUP [ 304.410826][ T8700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 304.410834][ T8700] Call Trace: [ 304.410838][ T8700] [ 304.410843][ T8700] dump_stack_lvl+0x100/0x190 [ 304.410862][ T8700] should_fail_ex.cold+0x5/0xa [ 304.410879][ T8700] ? __pfx_vivid_thread_vid_out+0x10/0x10 [ 304.410897][ T8700] should_failslab+0xc2/0x120 [ 304.410911][ T8700] __kmalloc_cache_noprof+0x91/0x6c0 [ 304.410930][ T8700] ? __kthread_create_on_node+0xce/0x3f0 [ 304.410951][ T8700] ? __pfx_vivid_thread_vid_out+0x10/0x10 [ 304.410967][ T8700] __kthread_create_on_node+0xce/0x3f0 [ 304.410984][ T8700] ? __pfx___kthread_create_on_node+0x10/0x10 [ 304.411003][ T8700] ? trace_event_raw_event_rdev_dump_survey+0x320/0x3b0 [ 304.411019][ T8700] ? __pfx_vivid_thread_vid_out+0x10/0x10 [ 304.411036][ T8700] kthread_create_on_node+0xc7/0x100 [ 304.411052][ T8700] ? __pfx_kthread_create_on_node+0x10/0x10 [ 304.411068][ T8700] ? __pfx___schedule+0x10/0x10 [ 304.411083][ T8700] ? do_raw_spin_lock+0x128/0x260 [ 304.411101][ T8700] ? preempt_schedule_thunk+0x16/0x40 [ 304.411115][ T8700] vivid_start_generating_vid_out+0x315/0x4e0 [ 304.411135][ T8700] vid_out_start_streaming+0x2ca/0x3e0 [ 304.411149][ T8700] ? __pfx_vid_out_buf_queue+0x10/0x10 [ 304.411163][ T8700] ? _raw_spin_unlock+0x3e/0x50 [ 304.411176][ T8700] ? __pfx_vid_out_start_streaming+0x10/0x10 [ 304.411191][ T8700] vb2_start_streaming+0x162/0x570 [ 304.411206][ T8700] ? __bitmap_weight+0xd7/0x110 [ 304.411226][ T8700] vb2_core_streamon+0x26a/0x3c0 [ 304.411242][ T8700] vb2_ioctl_streamon+0xd9/0x150 [ 304.411256][ T8700] ? v4l_streamon+0x1a/0xa0 [ 304.411269][ T8700] __video_do_ioctl+0xb2a/0xdf0 [ 304.411284][ T8700] ? __might_fault+0xc5/0x140 [ 304.411294][ T8700] ? __pfx___video_do_ioctl+0x10/0x10 [ 304.411310][ T8700] video_usercopy+0x47a/0x1730 [ 304.411323][ T8700] ? __pfx___video_do_ioctl+0x10/0x10 [ 304.411335][ T8700] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 304.411352][ T8700] ? __pfx_video_usercopy+0x10/0x10 [ 304.411373][ T8700] v4l2_ioctl+0x1bd/0x250 [ 304.411384][ T8700] ? __pfx_v4l2_ioctl+0x10/0x10 [ 304.411397][ T8700] __x64_sys_ioctl+0x18e/0x210 [ 304.411414][ T8700] do_syscall_64+0x115/0x870 [ 304.411435][ T8700] ? clear_bhb_loop+0x40/0x90 [ 304.411448][ T8700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.411460][ T8700] RIP: 0033:0x7f67ef59ce59 [ 304.411470][ T8700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 304.411481][ T8700] RSP: 002b:00007f67f03d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 304.411492][ T8700] RAX: ffffffffffffffda RBX: 00007f67ef815fa0 RCX: 00007f67ef59ce59 [ 304.411499][ T8700] RDX: 0000200000000100 RSI: 0000000040045612 RDI: 0000000000000003 [ 304.411505][ T8700] RBP: 00007f67f03d1090 R08: 0000000000000000 R09: 0000000000000000 [ 304.411511][ T8700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 304.411517][ T8700] R13: 00007f67ef816038 R14: 00007f67ef815fa0 R15: 00007fff02ffeb78 [ 304.411531][ T8700] [ 304.555780][ T8700] vivid-000: kernel_thread() failed [ 304.750873][ T8667] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 304.949507][ T29] audit: type=1400 audit(1782641057.879:852): avc: denied { read } for pid=8705 comm="syz.2.745" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 304.979762][ T29] audit: type=1400 audit(1782641057.879:853): avc: denied { open } for pid=8705 comm="syz.2.745" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 305.013084][ T29] audit: type=1400 audit(1782641057.889:854): avc: denied { ioctl } for pid=8705 comm="syz.2.745" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9374 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 307.365191][ T8733] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 307.406273][ T8714] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 307.447632][ T5743] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 307.597620][ T5711] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 307.640278][ T5743] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 307.669487][ T5743] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.688607][ T5743] usb 2-1: Product: syz [ 307.698181][ T5743] usb 2-1: Manufacturer: syz [ 307.713137][ T5743] usb 2-1: SerialNumber: syz [ 307.825727][ T5711] usb 5-1: Using ep0 maxpacket: 32 [ 307.832295][ T5711] usb 5-1: config 3 has an invalid interface number: 79 but max is 0 [ 307.848210][ T5711] usb 5-1: config 3 has no interface number 0 [ 307.855303][ T5711] usb 5-1: config 3 interface 79 has no altsetting 0 [ 307.878833][ T5711] usb 5-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=fc.21 [ 307.895753][ T5711] usb 5-1: New USB device strings: Mfr=165, Product=2, SerialNumber=3 [ 307.907802][ T5711] usb 5-1: Product: syz [ 307.913693][ T5711] usb 5-1: Manufacturer: syz [ 307.920114][ T5711] usb 5-1: SerialNumber: syz [ 308.180322][ T8725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 308.305453][ T8725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 308.385275][ T5743] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 308.408471][ T5743] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 308.826620][ T5620] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 308.828624][ T5743] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 309.259288][ T5743] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 309.269786][ T5743] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 309.284780][ T5743] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 309.310849][ T5743] usb 2-1: USB disconnect, device number 26 [ 310.406227][ T5711] kobil_sct 5-1:3.79: required endpoints missing [ 310.429393][ T5711] usb 5-1: USB disconnect, device number 24 [ 310.458299][ T8736] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 310.905845][ T5793] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 311.055954][ T5793] usb 3-1: Using ep0 maxpacket: 32 [ 311.069945][ T5793] usb 3-1: config 3 has an invalid interface number: 79 but max is 0 [ 311.079995][ T5793] usb 3-1: config 3 has no interface number 0 [ 311.100427][ T5793] usb 3-1: config 3 interface 79 has no altsetting 0 [ 311.116661][ T5793] usb 3-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=fc.21 [ 311.126058][ T5793] usb 3-1: New USB device strings: Mfr=165, Product=2, SerialNumber=3 [ 311.167512][ T8767] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 311.176425][ T5793] usb 3-1: Product: syz [ 311.199412][ T5793] usb 3-1: Manufacturer: syz [ 311.233321][ T5793] usb 3-1: SerialNumber: syz [ 311.654812][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.668729][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 311.710102][ T8776] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=8776 comm=syz.0.763 [ 311.855492][ T29] audit: type=1400 audit(1782641064.789:855): avc: denied { create } for pid=8763 comm="syz.2.760" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 311.910029][ T29] audit: type=1400 audit(1782641064.789:856): avc: denied { ioctl } for pid=8763 comm="syz.2.760" path="socket:[24209]" dev="sockfs" ino=24209 ioctlcmd=0x89a2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 314.204540][ T5793] kobil_sct 3-1:3.79: required endpoints missing [ 314.262012][ T5793] usb 3-1: USB disconnect, device number 29 [ 314.842564][ T5703] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 314.844878][ T8807] binder: BINDER_SET_CONTEXT_MGR already set [ 314.859070][ T8807] binder: 8803:8807 ioctl 4018620d 200000004a80 returned -16 [ 314.908973][ T8806] ieee802154 phy0 wpan0: encryption failed: -22 [ 314.913499][ T8807] binder: 8803:8807 ioctl c0306201 0 returned -14 [ 315.156268][ T5703] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 315.177723][ T5703] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.230469][ T5703] usb 5-1: Product: syz [ 315.246356][ T5703] usb 5-1: Manufacturer: syz [ 315.266148][ T5703] usb 5-1: SerialNumber: syz [ 315.448493][ T5793] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 315.508903][ T8814] Failed to get privilege flags for destination (handle=0x2:0x2) [ 315.683975][ T5793] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 315.698598][ T5793] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.707921][ T8794] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 315.730158][ T8794] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 315.739841][ T5793] usb 2-1: Product: syz [ 315.744057][ T5793] usb 2-1: Manufacturer: syz [ 315.749152][ T5703] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 315.761058][ T5793] usb 2-1: SerialNumber: syz [ 315.779997][ T5703] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 316.229907][ T8809] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 316.244881][ T5620] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 316.263253][ T5703] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 316.294738][ T8809] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 316.314992][ T5793] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 316.336120][ T5703] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 316.357718][ T5793] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 316.378378][ T5703] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 316.413709][ T5703] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 316.470879][ T5703] usb 5-1: USB disconnect, device number 25 [ 316.814234][ T5620] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 316.825179][ T5793] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 316.846120][ T5793] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 316.863712][ T5793] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 316.894527][ T5793] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 316.932911][ T5793] usb 2-1: USB disconnect, device number 27 [ 317.855883][ T5703] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 317.989764][ T5743] libceph: connect (1)[c::]:6789 error -101 [ 318.007165][ T5743] libceph: mon0 (1)[c::]:6789 connect error [ 318.026044][ T8841] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 318.053261][ T8833] ceph: No mds server is up or the cluster is laggy [ 318.085723][ T5703] usb 5-1: Using ep0 maxpacket: 32 [ 318.123388][ T5703] usb 5-1: config 3 has an invalid interface number: 79 but max is 0 [ 318.149166][ T5703] usb 5-1: config 3 has no interface number 0 [ 318.178500][ T5703] usb 5-1: config 3 interface 79 has no altsetting 0 [ 318.208105][ T5703] usb 5-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=fc.21 [ 318.218764][ T5703] usb 5-1: New USB device strings: Mfr=165, Product=2, SerialNumber=3 [ 318.247405][ T5703] usb 5-1: Product: syz [ 318.258146][ T5703] usb 5-1: Manufacturer: syz [ 318.274055][ T5703] usb 5-1: SerialNumber: syz [ 318.632835][ T8855] NILFS (nullb0): couldn't find nilfs on the device [ 318.756095][ T29] audit: type=1400 audit(1782641071.599:857): avc: denied { read } for pid=8844 comm="syz.1.782" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 320.596553][ T5703] kobil_sct 5-1:3.79: required endpoints missing [ 320.681573][ T5703] usb 5-1: USB disconnect, device number 26 [ 321.550798][ T8880] netlink: 'syz.3.789': attribute type 10 has an invalid length. [ 321.560163][ T8880] netlink: 40 bytes leftover after parsing attributes in process `syz.3.789'. [ 321.586665][ T29] audit: type=1400 audit(1782641074.379:858): avc: denied { module_load } for pid=8876 comm="syz.3.789" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 322.639437][ T8889] tmpfs: Bad value for 'mpol' [ 322.984232][ T8903] veth0_macvtap: left promiscuous mode [ 323.023173][ T8903] macvtap0: entered allmulticast mode [ 323.732700][ T8910] binder: 8909:8910 ioctl c0306201 0 returned -14 [ 323.759141][ T8910] binder: BINDER_SET_CONTEXT_MGR already set [ 323.767146][ T8910] binder: 8909:8910 ioctl 4018620d 200000004a80 returned -16 [ 323.935728][ T24] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 324.089420][ T24] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 324.098699][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.118237][ T24] usb 5-1: Product: syz [ 324.128507][ T24] usb 5-1: Manufacturer: syz [ 324.135625][ T24] usb 5-1: SerialNumber: syz [ 324.601025][ T8908] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.613002][ T8908] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.631240][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 324.648561][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 324.851916][ T8884] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 324.865707][ T8912] comedi comedi1: reset error (fatal) [ 324.964896][ T8914] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 325.019094][ T8914] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 325.149037][ T5620] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 325.200435][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 325.213235][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 325.256115][ T5703] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 325.266734][ T24] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 325.469872][ T24] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 325.563111][ T24] usb 5-1: USB disconnect, device number 27 [ 325.627539][ T5703] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 325.638684][ T5703] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 325.695320][ T5703] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 325.732960][ T5703] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 325.788262][ T5703] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 325.819418][ T5703] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 325.829689][ T5703] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 325.838441][ T5703] usb 3-1: Product: syz [ 325.844060][ T5703] usb 3-1: Manufacturer: syz [ 325.919911][ T29] audit: type=1400 audit(1782641078.859:859): avc: denied { audit_read } for pid=8928 comm="syz.0.802" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 325.947328][ T5703] cdc_wdm 3-1:1.0: skipping garbage [ 325.969992][ T5703] cdc_wdm 3-1:1.0: skipping garbage [ 326.040230][ T5703] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 326.123601][ T5703] cdc_wdm 3-1:1.0: Unknown control protocol [ 326.496280][ T5725] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 326.790898][ T8943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 326.801730][ T8943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 327.237299][ T5725] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 327.246670][ T5725] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.254716][ T5725] usb 1-1: Product: syz [ 327.261833][ T5725] usb 1-1: Manufacturer: syz [ 327.288552][ T5725] usb 1-1: SerialNumber: syz [ 327.785385][ T8935] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 327.805334][ T8936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 327.823643][ T8936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 327.895311][ T5725] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 327.913551][ T5725] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 328.176748][ T8951] NILFS (nullb0): couldn't find nilfs on the device [ 328.479783][ T8936] binder: 8934:8936 ioctl c0306201 200000000000 returned -14 [ 328.676789][ T5703] usb 3-1: USB disconnect, device number 30 [ 328.845732][ T5725] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 328.847096][ T5620] Bluetooth: hci4: ACL packet for unknown connection handle 200 [ 328.881898][ T5725] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 329.040934][ T5725] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 329.237290][ T5725] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 329.285241][ T5725] usb 1-1: USB disconnect, device number 26 [ 330.607973][ T8958] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 330.662059][ T8986] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 331.185713][ T5341] usb 1-1: new full-speed USB device number 27 using dummy_hcd [ 331.347857][ T5341] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 331.364929][ T5341] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 331.399883][ T5341] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 331.470762][ T5341] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.855978][ T5341] usb 1-1: usb_control_msg returned -32 [ 331.861730][ T5341] usbtmc 1-1:16.0: can't read capabilities [ 332.244783][ T9013] FAULT_INJECTION: forcing a failure. [ 332.244783][ T9013] name failslab, interval 1, probability 0, space 0, times 0 [ 332.264962][ T5725] IPVS: starting estimator thread 0... [ 332.289158][ T9013] CPU: 1 UID: 0 PID: 9013 Comm: syz.0.816 Tainted: G L syzkaller #0 PREEMPT(full) [ 332.289182][ T9013] Tainted: [L]=SOFTLOCKUP [ 332.289186][ T9013] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 332.289193][ T9013] Call Trace: [ 332.289197][ T9013] [ 332.289201][ T9013] dump_stack_lvl+0x100/0x190 [ 332.289219][ T9013] should_fail_ex.cold+0x5/0xa [ 332.289235][ T9013] should_failslab+0xc2/0x120 [ 332.289250][ T9013] __kmalloc_noprof+0xfc/0x820 [ 332.289262][ T9013] ? rcu_is_watching+0x12/0xc0 [ 332.289280][ T9013] ? tomoyo_realpath_from_path+0xb6/0x690 [ 332.289299][ T9013] tomoyo_realpath_from_path+0xb6/0x690 [ 332.289319][ T9013] tomoyo_path_number_perm+0x23c/0x580 [ 332.289333][ T9013] ? tomoyo_path_number_perm+0x22e/0x580 [ 332.289348][ T9013] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 332.289388][ T9013] ? find_held_lock+0x2b/0x80 [ 332.289399][ T9013] ? __fget_files+0x215/0x3d0 [ 332.289409][ T9013] ? hook_file_ioctl_common+0x140/0x440 [ 332.289423][ T9013] ? __fget_files+0x215/0x3d0 [ 332.289437][ T9013] ? __fget_files+0x21f/0x3d0 [ 332.289450][ T9013] security_file_ioctl+0xd3/0x230 [ 332.289466][ T9013] __x64_sys_ioctl+0xb7/0x210 [ 332.289483][ T9013] do_syscall_64+0x115/0x870 [ 332.289499][ T9013] ? clear_bhb_loop+0x40/0x90 [ 332.289512][ T9013] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.289523][ T9013] RIP: 0033:0x7f18f219ce59 [ 332.289533][ T9013] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 332.289543][ T9013] RSP: 002b:00007f18f30d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 332.289554][ T9013] RAX: ffffffffffffffda RBX: 00007f18f2416090 RCX: 00007f18f219ce59 [ 332.289561][ T9013] RDX: 0000200000000040 RSI: 00000000c0105b08 RDI: 0000000000000006 [ 332.289567][ T9013] RBP: 00007f18f30d6090 R08: 0000000000000000 R09: 0000000000000000 [ 332.289573][ T9013] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 332.289579][ T9013] R13: 00007f18f2416128 R14: 00007f18f2416090 R15: 00007ffc31bc50d8 [ 332.289593][ T9013] [ 332.289611][ T9013] ERROR: Out of memory at tomoyo_realpath_from_path. [ 332.731308][ T5725] usb 1-1: USB disconnect, device number 27 [ 332.768251][ T9014] IPVS: using max 78 ests per chain, 187200 per kthread [ 333.162647][ T29] audit: type=1400 audit(1782641085.899:860): avc: denied { read } for pid=9019 comm="syz.0.820" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 333.545742][ T5703] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 333.819183][ T5703] usb 5-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 333.939019][ T5703] usb 5-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 333.978926][ T5703] usb 5-1: Product: syz [ 334.509123][ T5703] usb 5-1: Manufacturer: syz [ 334.522903][ T5703] usb 5-1: SerialNumber: syz [ 334.547701][ T5703] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 334.561591][ T9043] netlink: 8 bytes leftover after parsing attributes in process `syz.2.826'. [ 334.572118][ T9043] netlink: 'syz.2.826': attribute type 5 has an invalid length. [ 335.083616][ T5703] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 335.104261][ T5703] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 335.255716][ T9055] netlink: 'syz.0.828': attribute type 10 has an invalid length. [ 335.263540][ T9055] netlink: 40 bytes leftover after parsing attributes in process `syz.0.828'. [ 336.139954][ T9066] netlink: 'syz.0.830': attribute type 4 has an invalid length. [ 336.288156][ T9068] netlink: 36 bytes leftover after parsing attributes in process `syz.0.830'. [ 336.330023][ T9068] netlink: 16 bytes leftover after parsing attributes in process `syz.0.830'. [ 336.351972][ T5703] usb 5-1: USB disconnect, device number 28 [ 336.363784][ T9068] netlink: 36 bytes leftover after parsing attributes in process `syz.0.830'. [ 336.633947][ T9061] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 336.644131][ T9061] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 336.675734][ T5793] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 336.726233][ T5725] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 336.827572][ T5793] usb 3-1: unable to get BOS descriptor or descriptor too short [ 336.848112][ T5793] usb 3-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 336.872558][ T5793] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 336.875935][ T5341] usb 5-1: new full-speed USB device number 29 using dummy_hcd [ 336.894462][ T5793] usb 3-1: string descriptor 0 read error: -22 [ 336.901181][ T5793] usb 3-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 336.920452][ T5793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.924678][ T5725] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 336.970138][ T5725] usb 1-1: New USB device found, idVendor=2040, idProduct=5530, bcdDevice=a8.82 [ 336.987166][ T5725] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.006005][ T5725] usb 1-1: config 0 descriptor?? [ 337.021459][ T5725] smsusb:smsusb_probe: board id=8, interface number 0 [ 337.029436][ T5725] smsusb:smsusb_probe: Device initialized with return code -19 [ 337.057583][ T5341] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 337.074815][ T5793] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 337.091451][ T5341] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 337.252880][ T5341] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 337.274170][ T5341] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 337.287237][ T5341] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.295283][ T5341] usb 5-1: Product: syz [ 337.299849][ T5341] usb 5-1: Manufacturer: syz [ 337.304464][ T5341] usb 5-1: SerialNumber: syz [ 337.319684][ T5341] usb 5-1: config 0 descriptor?? [ 337.321329][ T5793] usb 1-1: USB disconnect, device number 28 [ 337.325318][ T9074] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 337.432758][ T5341] rc_core: IR keymap rc-streamzap not found [ 337.439367][ T5341] Registered IR keymap rc-empty [ 337.458838][ T5341] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 337.477329][ T5341] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input21 [ 337.706855][ T5703] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 337.728552][ T9087] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.750245][ T5793] usb 5-1: USB disconnect, device number 29 [ 337.758375][ T9087] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.885726][ T5703] usb 4-1: Using ep0 maxpacket: 32 [ 337.893167][ T5703] usb 4-1: config 3 has an invalid interface number: 79 but max is 0 [ 337.902293][ T5703] usb 4-1: config 3 has no interface number 0 [ 337.908796][ T5703] usb 4-1: config 3 interface 79 has no altsetting 0 [ 337.917757][ T5703] usb 4-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=fc.21 [ 337.926937][ T5703] usb 4-1: New USB device strings: Mfr=165, Product=2, SerialNumber=3 [ 337.935103][ T5703] usb 4-1: Product: syz [ 337.939433][ T5703] usb 4-1: Manufacturer: syz [ 337.944495][ T5703] usb 4-1: SerialNumber: syz [ 337.995746][ T5725] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 338.158803][ T5725] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 338.175690][ T5725] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.183799][ T5725] usb 2-1: Product: syz [ 338.188299][ T5725] usb 2-1: Manufacturer: syz [ 338.194651][ T5725] usb 2-1: SerialNumber: syz [ 338.606883][ T9070] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 338.752374][ T9089] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.789882][ T9089] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 338.808122][ T5725] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 338.820209][ T5725] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 339.329061][ T5620] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 339.330039][ T5725] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 339.414620][ T5725] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 339.448217][ T5725] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 339.479890][ T5725] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 339.523808][ T5725] usb 2-1: USB disconnect, device number 28 [ 339.742916][ T48] usb 3-1: USB disconnect, device number 31 [ 339.747927][ T9109] Failed to get privilege flags for destination (handle=0x2:0x2) [ 340.495113][ T5703] kobil_sct 4-1:3.79: required endpoints missing [ 340.563131][ T5703] usb 4-1: USB disconnect, device number 23 [ 342.967233][ T5703] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 343.167848][ T5703] usb 5-1: unable to get BOS descriptor or descriptor too short [ 343.192110][ T5703] usb 5-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 343.227503][ T5703] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 343.270964][ T5703] usb 5-1: string descriptor 0 read error: -22 [ 343.293300][ T5703] usb 5-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 343.329607][ T5703] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.656494][ T5725] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 343.659791][ T5703] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 343.962006][ T5725] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 343.984130][ T5725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.001546][ T5725] usb 4-1: Product: syz [ 344.010950][ T5725] usb 4-1: Manufacturer: syz [ 344.031175][ T5725] usb 4-1: SerialNumber: syz [ 344.092164][ T9172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 344.115466][ T9172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 344.369035][ T5341] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 344.459004][ T9165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 344.476309][ T9165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 344.497410][ T5725] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 344.516120][ T5725] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 344.530517][ T5341] usb 2-1: Using ep0 maxpacket: 32 [ 344.545894][ T5341] usb 2-1: config 3 has an invalid interface number: 79 but max is 0 [ 344.560296][ T5341] usb 2-1: config 3 has no interface number 0 [ 344.575767][ T5341] usb 2-1: config 3 interface 79 has no altsetting 0 [ 344.591688][ T5341] usb 2-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=fc.21 [ 344.608450][ T5341] usb 2-1: New USB device strings: Mfr=165, Product=2, SerialNumber=3 [ 344.617538][ T5341] usb 2-1: Product: syz [ 344.621831][ T5341] usb 2-1: Manufacturer: syz [ 344.626803][ T5341] usb 2-1: SerialNumber: syz [ 345.059140][ T5620] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 345.604680][ T5725] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 345.616770][ T5725] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 345.628625][ T5725] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 345.641510][ T5725] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 345.700487][ T48] usb 5-1: USB disconnect, device number 30 [ 346.022246][ T5725] usb 4-1: USB disconnect, device number 24 [ 347.455771][ T5341] kobil_sct 2-1:3.79: required endpoints missing [ 347.535183][ T5341] usb 2-1: USB disconnect, device number 29 [ 348.595817][ T5703] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 348.802326][ T5703] usb 1-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 348.821675][ T5703] usb 1-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 348.854434][ T5703] usb 1-1: Product: syz [ 348.864124][ T5703] usb 1-1: Manufacturer: syz [ 348.879742][ T5703] usb 1-1: SerialNumber: syz [ 348.879850][ T9228] Failed to get privilege flags for destination (handle=0x2:0x2) [ 348.927289][ T5703] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 349.335863][ T5703] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 349.348127][ T48] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 349.382921][ T5703] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 349.637638][ T48] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 349.754227][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.888014][ T48] usb 4-1: Product: syz [ 349.970772][ T48] usb 4-1: Manufacturer: syz [ 350.042325][ T48] usb 4-1: SerialNumber: syz [ 350.672494][ T9231] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 350.701551][ T9231] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 350.730142][ T48] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 350.759293][ T48] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 350.788378][ T5703] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 350.955794][ T5703] usb 2-1: Using ep0 maxpacket: 32 [ 350.975157][ T5703] usb 2-1: config 3 has an invalid interface number: 79 but max is 0 [ 351.002228][ T5703] usb 2-1: config 3 has no interface number 0 [ 351.024167][ T5703] usb 2-1: config 3 interface 79 has no altsetting 0 [ 351.037827][ T5703] usb 2-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=fc.21 [ 351.049463][ T5703] usb 2-1: New USB device strings: Mfr=165, Product=2, SerialNumber=3 [ 351.058109][ T5703] usb 2-1: Product: syz [ 351.064675][ T5703] usb 2-1: Manufacturer: syz [ 351.069532][ T5703] usb 2-1: SerialNumber: syz [ 351.113810][ T5795] usb 1-1: USB disconnect, device number 29 [ 351.471072][ T5620] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 352.543955][ T48] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 352.603893][ T48] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 352.948852][ T48] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 352.974312][ T48] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 353.025361][ T48] usb 4-1: USB disconnect, device number 25 [ 353.758974][ T5703] kobil_sct 2-1:3.79: required endpoints missing [ 353.788759][ T5703] usb 2-1: USB disconnect, device number 30 [ 359.191818][ T9300] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 359.696117][ T5725] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 360.008437][ T5725] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 360.021431][ T5725] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 360.040825][ T5725] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 360.064287][ T5725] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 212, setting to 64 [ 360.085042][ T5725] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 360.148587][ T5725] usb 3-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 360.180937][ T5725] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.220041][ T5725] usb 3-1: Product: syz [ 360.234108][ T5725] usb 3-1: Manufacturer: syz [ 360.245347][ T5725] usb 3-1: SerialNumber: syz [ 360.270353][ T5725] usb 3-1: config 0 descriptor?? [ 360.304041][ T9339] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 360.405756][ T5725] rc_core: IR keymap rc-xbox-dvd not found [ 360.419292][ T5725] Registered IR keymap rc-empty [ 360.434743][ T5725] rc rc0: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 360.435022][ T9363] syz.0.904: vmalloc error: size 18446744073699066186, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null) [ 360.457486][ T5725] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input22 [ 360.459134][ T9363] ,cpuset=/,mems_allowed=0-1 [ 360.510170][ T9363] CPU: 0 UID: 0 PID: 9363 Comm: syz.0.904 Tainted: G L syzkaller #0 PREEMPT(full) [ 360.510201][ T9363] Tainted: [L]=SOFTLOCKUP [ 360.510207][ T9363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 360.510216][ T9363] Call Trace: [ 360.510222][ T9363] [ 360.510229][ T9363] dump_stack_lvl+0x100/0x190 [ 360.510258][ T9363] warn_alloc.cold+0x94/0xa8 [ 360.510277][ T9363] ? __pfx_warn_alloc+0x10/0x10 [ 360.510293][ T9363] ? do_syscall_64+0x115/0x870 [ 360.510318][ T9363] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 360.510339][ T9363] ? __lock_acquire+0x49f/0x1a40 [ 360.510360][ T9363] ? find_held_lock+0x2b/0x80 [ 360.510373][ T9363] ? avc_has_extended_perms+0x33a/0x1080 [ 360.510388][ T9363] ? avc_has_extended_perms+0x33a/0x1080 [ 360.510406][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.510429][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.510451][ T9363] __vmalloc_node_range_noprof+0x136c/0x1630 [ 360.510489][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.510511][ T9363] ? trace_contention_end+0x126/0x160 [ 360.510534][ T9363] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 360.510562][ T9363] ? dvb_demux_do_ioctl+0x929/0x1200 [ 360.510588][ T9363] ? find_held_lock+0x2b/0x80 [ 360.510603][ T9363] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 360.510626][ T9363] ? __pfx___mutex_lock+0x10/0x10 [ 360.510654][ T9363] ? tomoyo_path_number_perm+0x188/0x580 [ 360.510678][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.510701][ T9363] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 360.510724][ T9363] __vmalloc_node_noprof+0xad/0xf0 [ 360.510749][ T9363] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 360.510772][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.510796][ T9363] dvb_demux_do_ioctl+0x9e0/0x1200 [ 360.510822][ T9363] ? do_vfs_ioctl+0x226/0x13e0 [ 360.510851][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.510872][ T9363] dvb_usercopy+0x167/0x340 [ 360.510892][ T9363] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 360.510914][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.510935][ T9363] ? __pfx_dvb_usercopy+0x10/0x10 [ 360.510965][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.510985][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.511007][ T9363] ? selinux_file_ioctl+0x13b/0x290 [ 360.511032][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.511053][ T9363] ? selinux_file_ioctl+0xb6/0x290 [ 360.511080][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.511102][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.511124][ T9363] dvb_demux_ioctl+0x29/0x40 [ 360.511144][ T9363] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 360.511166][ T9363] __x64_sys_ioctl+0x18e/0x210 [ 360.511193][ T9363] do_syscall_64+0x115/0x870 [ 360.511218][ T9363] ? clear_bhb_loop+0x40/0x90 [ 360.511239][ T9363] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 360.511256][ T9363] RIP: 0033:0x7f18f219ce59 [ 360.511272][ T9363] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 360.511288][ T9363] RSP: 002b:00007f18f30d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 360.511305][ T9363] RAX: ffffffffffffffda RBX: 00007f18f2416090 RCX: 00007f18f219ce59 [ 360.511316][ T9363] RDX: ffffffffff60014a RSI: 0000000000006f2d RDI: 0000000000000005 [ 360.511326][ T9363] RBP: 00007f18f2232e6f R08: 0000000000000000 R09: 0000000000000000 [ 360.511336][ T9363] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 360.511346][ T9363] R13: 00007f18f2416128 R14: 00007f18f2416090 R15: 00007ffc31bc50d8 [ 360.511364][ T9363] ? __UNIQUE_ID_modinfo_723+0x63bc53da/0xffffffffffeca290 [ 360.511391][ T9363] [ 360.511701][ T9363] Mem-Info: [ 360.576697][ T5703] usb 3-1: USB disconnect, device number 32 [ 360.579412][ C0] xbox_remote 3-1:0.0: xbox_remote_irq_in: usb_submit_urb()=-19 [ 360.623445][ T9363] active_anon:15674 inactive_anon:0 isolated_anon:0 [ 360.623445][ T9363] active_file:1 inactive_file:58651 isolated_file:0 [ 360.623445][ T9363] unevictable:768 dirty:326 writeback:0 [ 360.623445][ T9363] slab_reclaimable:11590 slab_unreclaimable:101826 [ 360.623445][ T9363] mapped:35377 shmem:4141 pagetables:1502 [ 360.623445][ T9363] sec_pagetables:0 bounce:0 [ 360.623445][ T9363] kernel_misc_reclaimable:0 [ 360.623445][ T9363] free:1288467 free_pcp:11703 free_cma:0 [ 360.838959][ T9374] overlayfs: failed to resolve './file0': -2 [ 360.863764][ T9363] Node 0 active_anon:62696kB inactive_anon:0kB active_file:4kB inactive_file:234312kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:149620kB dirty:1300kB writeback:0kB shmem:15028kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13172kB pagetables:5844kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 360.991661][ T9363] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:292kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:88kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 361.176950][ T9363] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 361.355855][ T9363] lowmem_reserve[]: 0 2475 2476 2476 2476 [ 361.370014][ T9363] Node 0 DMA32 free:1208696kB boost:0kB min:34036kB low:42544kB high:51052kB reserved_highatomic:0KB free_highatomic:0KB active_anon:62896kB inactive_anon:0kB active_file:4kB inactive_file:234312kB unevictable:1536kB writepending:1300kB zspages:0kB present:3129332kB managed:2535236kB mlocked:0kB bounce:0kB free_pcp:36116kB local_pcp:14848kB free_cma:0kB [ 361.465752][ T9363] lowmem_reserve[]: 0 0 0 0 0 [ 361.473938][ T9363] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:764kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 361.512573][ T9363] lowmem_reserve[]: 0 0 0 0 0 [ 361.519253][ T9363] Node 1 Normal free:3930100kB boost:0kB min:55852kB low:69812kB high:83772kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:292kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:10004kB local_pcp:10004kB free_cma:0kB [ 361.552540][ T9363] lowmem_reserve[]: 0 0 0 0 0 [ 361.568125][ T9378] netlink: 'syz.2.907': attribute type 10 has an invalid length. [ 361.576009][ T9363] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 361.589083][ T9378] netlink: 40 bytes leftover after parsing attributes in process `syz.2.907'. [ 361.598647][ T9363] Node 0 DMA32: 883*4kB (UME) 418*8kB (UME) 335*16kB (UME) 719*32kB (UME) 184*64kB (UME) 76*128kB (UME) 38*256kB (UME) 15*512kB (UME) 18*1024kB (UME) 25*2048kB (UME) 260*4096kB (UME) = 1208748kB [ 361.627038][ T9363] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 361.661993][ T9363] Node 1 Normal: 3*4kB (UM) 9*8kB (UM) 8*16kB (UM) 7*32kB (UM) 7*64kB (UM) 7*128kB (UM) 5*256kB (UM) 2*512kB (M) 0*1024kB 1*2048kB (M) 958*4096kB (UM) = 3930100kB [ 361.680304][ T9363] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 361.696157][ T9363] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 361.725018][ T9363] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 361.742128][ T9363] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 361.753439][ T9363] 62807 total pagecache pages [ 361.775931][ T9363] 0 pages in swap cache [ 361.780465][ T9363] Free swap = 124996kB [ 361.784856][ T9363] Total swap = 124996kB [ 361.789669][ T9363] 2097051 pages RAM [ 361.794422][ T9363] 0 pages HighMem/MovableOnly [ 361.800515][ T9363] 431436 pages reserved [ 361.805094][ T9363] 0 pages cma reserved [ 363.038728][ T9344] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 363.390841][ T9396] netlink: 'syz.4.913': attribute type 10 has an invalid length. [ 363.398617][ T9396] netlink: 40 bytes leftover after parsing attributes in process `syz.4.913'. [ 364.209248][ T9410] netlink: 8 bytes leftover after parsing attributes in process `syz.1.916'. [ 364.825265][ T9430] FAULT_INJECTION: forcing a failure. [ 364.825265][ T9430] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 364.889656][ T9430] CPU: 0 UID: 0 PID: 9430 Comm: syz.0.922 Tainted: G L syzkaller #0 PREEMPT(full) [ 364.889687][ T9430] Tainted: [L]=SOFTLOCKUP [ 364.889693][ T9430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 364.889704][ T9430] Call Trace: [ 364.889712][ T9430] [ 364.889719][ T9430] dump_stack_lvl+0x100/0x190 [ 364.889749][ T9430] should_fail_ex.cold+0x5/0xa [ 364.889774][ T9430] _copy_from_user+0x2e/0xd0 [ 364.889799][ T9430] move_addr_to_kernel+0x65/0x170 [ 364.889825][ T9430] copy_msghdr_from_user+0x3f0/0x4c0 [ 364.889851][ T9430] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 364.889889][ T9430] ___sys_sendmsg+0x106/0x1e0 [ 364.889921][ T9430] ? __pfx____sys_sendmsg+0x10/0x10 [ 364.889943][ T9430] ? __lock_acquire+0x49f/0x1a40 [ 364.889967][ T9430] ? get_pid_task+0x106/0x250 [ 364.890011][ T9430] __sys_sendmsg+0x160/0x210 [ 364.890030][ T9430] ? __pfx___sys_sendmsg+0x10/0x10 [ 364.890062][ T9430] do_syscall_64+0x115/0x870 [ 364.890088][ T9430] ? clear_bhb_loop+0x40/0x90 [ 364.890108][ T9430] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.890125][ T9430] RIP: 0033:0x7f18f219ce59 [ 364.890139][ T9430] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.890154][ T9430] RSP: 002b:00007f18f30f7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 364.890169][ T9430] RAX: ffffffffffffffda RBX: 00007f18f2415fa0 RCX: 00007f18f219ce59 [ 364.890180][ T9430] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 364.890190][ T9430] RBP: 00007f18f30f7090 R08: 0000000000000000 R09: 0000000000000000 [ 364.890200][ T9430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 364.890210][ T9430] R13: 00007f18f2416038 R14: 00007f18f2415fa0 R15: 00007ffc31bc50d8 [ 364.890233][ T9430] [ 365.171259][ T29] audit: type=1326 audit(1782641118.089:861): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9432 comm="syz.1.923" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa69799ce59 code=0x7ffc0000 [ 365.217519][ T29] audit: type=1326 audit(1782641118.089:862): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9432 comm="syz.1.923" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa69799ce59 code=0x7ffc0000 [ 365.245323][ T29] audit: type=1326 audit(1782641118.089:863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9432 comm="syz.1.923" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa69799ce59 code=0x7ffc0000 [ 365.316055][ T29] audit: type=1326 audit(1782641118.089:864): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9432 comm="syz.1.923" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa69799ce59 code=0x7ffc0000 [ 365.774652][ T29] audit: type=1326 audit(1782641118.089:865): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9432 comm="syz.1.923" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=217 compat=0 ip=0x7fa69799ce59 code=0x7ffc0000 [ 365.867786][ T29] audit: type=1326 audit(1782641118.089:866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9432 comm="syz.1.923" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa69799ce59 code=0x7ffc0000 [ 365.895156][ T29] audit: type=1326 audit(1782641118.089:867): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9432 comm="syz.1.923" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa69799ce59 code=0x7ffc0000 [ 365.936609][ T29] audit: type=1326 audit(1782641118.089:868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9432 comm="syz.1.923" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa69799ce59 code=0x7ffc0000 [ 365.987704][ T29] audit: type=1326 audit(1782641118.089:869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9432 comm="syz.1.923" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa69799ce59 code=0x7ffc0000 [ 366.016506][ T29] audit: type=1326 audit(1782641118.089:870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9432 comm="syz.1.923" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fa69795d68e code=0x7ffc0000 [ 366.172568][ T9452] FAULT_INJECTION: forcing a failure. [ 366.172568][ T9452] name failslab, interval 1, probability 0, space 0, times 0 [ 366.185394][ T9452] CPU: 0 UID: 0 PID: 9452 Comm: syz.1.927 Tainted: G L syzkaller #0 PREEMPT(full) [ 366.185421][ T9452] Tainted: [L]=SOFTLOCKUP [ 366.185428][ T9452] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 366.185434][ T9452] Call Trace: [ 366.185440][ T9452] [ 366.185444][ T9452] dump_stack_lvl+0x100/0x190 [ 366.185463][ T9452] should_fail_ex.cold+0x5/0xa [ 366.185479][ T9452] should_failslab+0xc2/0x120 [ 366.185493][ T9452] kmem_cache_alloc_noprof+0x91/0x6a0 [ 366.185507][ T9452] ? do_getname+0x35/0x390 [ 366.185523][ T9452] do_getname+0x35/0x390 [ 366.185538][ T9452] user_path_at+0x26/0x60 [ 366.185549][ T9452] __x64_sys_mount+0x1fb/0x310 [ 366.185563][ T9452] ? __pfx___x64_sys_mount+0x10/0x10 [ 366.185581][ T9452] do_syscall_64+0x115/0x870 [ 366.185596][ T9452] ? clear_bhb_loop+0x40/0x90 [ 366.185610][ T9452] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.185621][ T9452] RIP: 0033:0x7fa69799ce59 [ 366.185637][ T9452] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 366.185653][ T9452] RSP: 002b:00007fa698804028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 366.185669][ T9452] RAX: ffffffffffffffda RBX: 00007fa697c16090 RCX: 00007fa69799ce59 [ 366.185680][ T9452] RDX: 0000200000000040 RSI: 0000200000000240 RDI: 0000000000000000 [ 366.185690][ T9452] RBP: 00007fa698804090 R08: 0000000000000000 R09: 0000000000000000 [ 366.185699][ T9452] R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000001 [ 366.185709][ T9452] R13: 00007fa697c16128 R14: 00007fa697c16090 R15: 00007ffd38a53788 [ 366.185731][ T9452] [ 367.212811][ T9412] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 367.885570][ T9459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.929'. [ 368.735712][ T5703] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 368.821491][ T9484] netlink: 'syz.0.936': attribute type 10 has an invalid length. [ 368.829407][ T9484] netlink: 40 bytes leftover after parsing attributes in process `syz.0.936'. [ 369.295861][ T5703] usb 2-1: Using ep0 maxpacket: 8 [ 369.314888][ T5703] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 370.272185][ T5703] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 370.283051][ T5703] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 370.292972][ T5703] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 370.306974][ T5703] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 370.320868][ T5703] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 370.527434][ T5703] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.252558][ T9469] evm: overlay not supported [ 371.333797][ T5703] usb 2-1: usb_control_msg returned -71 [ 371.355725][ T5703] usbtmc 2-1:16.0: can't read capabilities [ 371.399579][ T5703] usb 2-1: USB disconnect, device number 31 [ 373.087807][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 373.315058][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 373.410481][ T9526] netlink: 8 bytes leftover after parsing attributes in process `syz.4.945'. [ 373.728831][ T29] kauditd_printk_skb: 122 callbacks suppressed [ 373.728844][ T29] audit: type=1400 audit(1782641126.669:993): avc: denied { append } for pid=9528 comm="syz.1.946" name="001" dev="devtmpfs" ino=728 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 374.135713][ T9] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 374.505249][ T9] usb 2-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 374.521454][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 374.551204][ T9] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 374.569819][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.583160][ T9] usb 2-1: Product: syz [ 374.597766][ T9] usb 2-1: Manufacturer: syz [ 374.602885][ T9] usb 2-1: SerialNumber: syz [ 374.826460][ T9515] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 376.893890][ T48] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 377.359537][ T48] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 377.376581][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.394807][ T48] usb 5-1: Product: syz [ 377.404521][ T48] usb 5-1: Manufacturer: syz [ 377.409833][ T48] usb 5-1: SerialNumber: syz [ 377.455373][ T5703] usb 2-1: USB disconnect, device number 32 [ 377.618100][ T9572] netlink: 8 bytes leftover after parsing attributes in process `syz.1.958'. [ 377.816675][ T5795] usb 3-1: new full-speed USB device number 33 using dummy_hcd [ 378.139019][ T9556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 378.156043][ T9556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 378.179592][ T48] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 378.213410][ T48] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 378.244720][ T5795] usb 3-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 378.284883][ T5795] usb 3-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 378.355907][ T5795] usb 3-1: Product: syz [ 378.416145][ T9] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 378.600048][ T5795] usb 3-1: Manufacturer: syz [ 378.634399][ T5795] usb 3-1: SerialNumber: syz [ 378.677202][ T5795] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 378.729011][ T48] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 378.752023][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 378.764621][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 378.781256][ T48] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 378.781448][ T9] usb 2-1: config 4 has an invalid interface number: 147 but max is 0 [ 378.818043][ T9] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 378.828740][ T48] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 378.862959][ T48] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 378.885486][ T9] usb 2-1: config 4 has no interface number 0 [ 378.897686][ T48] usb 5-1: USB disconnect, device number 31 [ 378.920487][ T9] usb 2-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 378.930074][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.957297][ T9] usb 2-1: Product: 봞拽⯘戊͊嬖緅郎箫쀨糹 [ 378.967848][ T9] usb 2-1: SerialNumber: syz [ 379.063035][ T5795] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 379.074573][ T5795] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 379.166495][ T5793] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 379.378154][ T5793] usb 1-1: unable to get BOS descriptor or descriptor too short [ 379.401833][ T5793] usb 1-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 380.028224][ T5793] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 380.040325][ T5793] usb 1-1: string descriptor 0 read error: -22 [ 380.048572][ T5793] usb 1-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 380.058010][ T5793] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.078248][ T9591] input: syz0 as /devices/virtual/input/input23 [ 380.558749][ T5793] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 380.646610][ T9596] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 380.660176][ T9596] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 380.969811][ T9600] netlink: 'syz.4.964': attribute type 10 has an invalid length. [ 380.977726][ T9600] netlink: 40 bytes leftover after parsing attributes in process `syz.4.964'. [ 381.371553][ T9] uvcvideo 2-1:4.147: Found UVC 0.00 device 봞拽⯘戊͊嬖緅郎箫쀨糹 (04f2:b746) [ 381.382527][ T9] uvcvideo 2-1:4.147: No valid video chain found. [ 381.394514][ T9] usb 2-1: USB disconnect, device number 33 [ 381.446959][ T5725] usb 3-1: USB disconnect, device number 33 [ 381.909630][ T5793] usb 1-1: USB disconnect, device number 30 [ 381.926859][ T9567] syz.3.955 (9567): drop_caches: 2 [ 382.092643][ T9614] netlink: 8 bytes leftover after parsing attributes in process `syz.0.970'. [ 387.595700][ T9] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 387.838331][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 387.851456][ T9] usb 4-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 387.863556][ T9680] input: syz0 as /devices/virtual/input/input24 [ 387.890107][ T9] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 387.921086][ T9] usb 4-1: string descriptor 0 read error: -22 [ 387.931940][ T9] usb 4-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 387.963816][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.978774][ T9682] SELinux: policydb magic number 0x5a565d78 does not match expected magic number 0xf97cff8c [ 387.989193][ T29] audit: type=1400 audit(1782641140.919:994): avc: denied { load_policy } for pid=9681 comm="syz.0.988" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 388.066940][ T9682] SELinux: failed to load policy [ 388.079947][ T29] audit: type=1400 audit(1782641141.009:995): avc: denied { map } for pid=9681 comm="syz.0.988" path="socket:[29919]" dev="sockfs" ino=29919 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 388.177123][ T9682] trusted_key: encrypted_key: key trusted:syz not found [ 388.177995][ T29] audit: type=1400 audit(1782641141.009:996): avc: denied { read } for pid=9681 comm="syz.0.988" path="socket:[29919]" dev="sockfs" ino=29919 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 388.279788][ T9] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 388.846934][ T9694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 388.862323][ T9676] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 388.890746][ T9676] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 388.910890][ T9694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 389.188977][ T9701] netlink: 'syz.0.992': attribute type 21 has an invalid length. [ 389.213533][ T9701] netlink: 'syz.0.992': attribute type 22 has an invalid length. [ 389.231330][ T9701] netlink: 'syz.0.992': attribute type 23 has an invalid length. [ 389.292779][ T9701] netlink: 'syz.0.992': attribute type 25 has an invalid length. [ 389.345802][ T9701] netlink: 'syz.0.992': attribute type 26 has an invalid length. [ 389.467612][ T9704] nvme_fabrics: missing parameter 'transport=%s' [ 389.489963][ T9704] nvme_fabrics: missing parameter 'nqn=%s' [ 390.029176][ T5703] usb 4-1: USB disconnect, device number 26 [ 394.316123][ T9736] input: syz0 as /devices/virtual/input/input25 [ 394.518327][ T5793] usb 3-1: new full-speed USB device number 34 using dummy_hcd [ 394.680593][ T9741] netlink: 'syz.3.1001': attribute type 10 has an invalid length. [ 394.689459][ T9741] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1001'. [ 394.888804][ T5793] usb 3-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 394.904330][ T5793] usb 3-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 394.917291][ T5793] usb 3-1: Product: syz [ 394.924263][ T5793] usb 3-1: Manufacturer: syz [ 394.929551][ T5793] usb 3-1: SerialNumber: syz [ 394.940808][ T5793] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 395.387130][ T9747] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 395.409372][ T5793] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 395.441444][ T5793] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 395.516066][ T9761] FAULT_INJECTION: forcing a failure. [ 395.516066][ T9761] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 395.529215][ T9761] CPU: 0 UID: 0 PID: 9761 Comm: syz.1.1005 Tainted: G L syzkaller #0 PREEMPT(full) [ 395.529242][ T9761] Tainted: [L]=SOFTLOCKUP [ 395.529248][ T9761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 395.529259][ T9761] Call Trace: [ 395.529265][ T9761] [ 395.529272][ T9761] dump_stack_lvl+0x100/0x190 [ 395.529300][ T9761] should_fail_ex.cold+0x5/0xa [ 395.529326][ T9761] _copy_from_iter+0x1f4/0x1690 [ 395.529357][ T9761] ? __asan_memset+0x23/0x50 [ 395.529376][ T9761] ? __pfx__copy_from_iter+0x10/0x10 [ 395.529397][ T9761] ? __pfx___alloc_skb+0x10/0x10 [ 395.529425][ T9761] netlink_sendmsg+0x808/0xda0 [ 395.529455][ T9761] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.529478][ T9761] ? __might_fault+0x60/0x140 [ 395.529504][ T9761] ____sys_sendmsg+0xa4d/0xbe0 [ 395.529526][ T9761] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.529553][ T9761] ? __pfx_____sys_sendmsg+0x10/0x10 [ 395.529587][ T9761] ___sys_sendmsg+0x190/0x1e0 [ 395.529613][ T9761] ? __pfx____sys_sendmsg+0x10/0x10 [ 395.529635][ T9761] ? __lock_acquire+0x49f/0x1a40 [ 395.529658][ T9761] ? get_pid_task+0x106/0x250 [ 395.529702][ T9761] __sys_sendmsg+0x160/0x210 [ 395.529722][ T9761] ? __pfx___sys_sendmsg+0x10/0x10 [ 395.529747][ T9761] ? trace_hardirqs_off+0x70/0x170 [ 395.529776][ T9761] do_syscall_64+0x115/0x870 [ 395.529802][ T9761] ? clear_bhb_loop+0x40/0x90 [ 395.529824][ T9761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.529842][ T9761] RIP: 0033:0x7fa69799ce59 [ 395.529857][ T9761] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 395.529873][ T9761] RSP: 002b:00007fa6987e3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 395.529891][ T9761] RAX: ffffffffffffffda RBX: 00007fa697c16180 RCX: 00007fa69799ce59 [ 395.529903][ T9761] RDX: 0000000000040000 RSI: 00002000000001c0 RDI: 0000000000000005 [ 395.529914][ T9761] RBP: 00007fa6987e3090 R08: 0000000000000000 R09: 0000000000000000 [ 395.529924][ T9761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 395.529934][ T9761] R13: 00007fa697c16218 R14: 00007fa697c16180 R15: 00007ffd38a53788 [ 395.529959][ T9761] [ 395.756129][ T9747] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 395.799486][ T9749] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 395.809157][ T9749] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 396.155734][ T5793] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 396.371719][ T5793] usb 4-1: unable to get BOS descriptor or descriptor too short [ 396.634181][ T5793] usb 4-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 396.651797][ T5703] usb 3-1: USB disconnect, device number 34 [ 396.752416][ T5793] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 396.783125][ T5793] usb 4-1: string descriptor 0 read error: -22 [ 396.804284][ T5793] usb 4-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 397.375430][ T5793] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.508134][ T9783] overlay: Unknown parameter 'appraise' [ 397.595998][ T5793] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 397.616460][ T5703] usb 3-1: new full-speed USB device number 35 using dummy_hcd [ 397.620809][ T6152] udevd[6152]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 397.719301][ T9793] input: syz0 as /devices/virtual/input/input26 [ 397.891118][ T5703] usb 3-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 397.901464][ T5703] usb 3-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 397.910765][ T5703] usb 3-1: Product: syz [ 397.916517][ T5703] usb 3-1: Manufacturer: syz [ 397.921200][ T5703] usb 3-1: SerialNumber: syz [ 397.932168][ T5703] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 398.107186][ T9801] netlink: 'syz.0.1017': attribute type 10 has an invalid length. [ 398.115552][ T9801] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1017'. [ 398.565413][ T5703] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 398.585786][ T5703] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 398.917644][ T9808] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 398.929983][ T9805] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 399.373129][ T5341] usb 4-1: USB disconnect, device number 27 [ 399.562889][ T9] usb 3-1: USB disconnect, device number 35 [ 400.297203][ T5341] usb 5-1: new full-speed USB device number 32 using dummy_hcd [ 400.579745][ T9785] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 400.962585][ T5341] usb 5-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 400.973397][ T5341] usb 5-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 401.490725][ T5341] usb 5-1: Product: syz [ 401.506833][ T5341] usb 5-1: Manufacturer: syz [ 401.533838][ T5341] usb 5-1: SerialNumber: syz [ 402.454570][ T5341] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 402.563387][ T5341] vp7045: USB control message 'out' went wrong. [ 402.591775][ T5341] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 402.634840][ T5341] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 402.957233][ T5341] usb 5-1: USB disconnect, device number 32 [ 403.245923][ T9845] input: syz0 as /devices/virtual/input/input27 [ 404.505724][ T5703] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 404.686012][ T5703] usb 4-1: unable to get BOS descriptor or descriptor too short [ 404.700828][ T5703] usb 4-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 404.713437][ T5703] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 404.815155][ T5703] usb 4-1: string descriptor 0 read error: -22 [ 404.821695][ T5703] usb 4-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 404.857730][ T5703] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.189814][ T5703] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 405.783565][ T9858] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 405.795317][ T6152] udevd[6152]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 405.830999][ T9858] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 406.380927][ T9891] Failed to get privilege flags for destination (handle=0x2:0x2) [ 406.428838][ T9893] netlink: 'syz.4.1038': attribute type 10 has an invalid length. [ 406.436759][ T9893] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1038'. [ 406.549374][ T48] usb 1-1: new full-speed USB device number 31 using dummy_hcd [ 406.641155][ T9897] netlink: 'syz.1.1040': attribute type 10 has an invalid length. [ 406.649126][ T9897] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1040'. [ 406.803336][ T48] usb 1-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 406.989863][ T48] usb 1-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 407.012707][ T48] usb 1-1: Product: syz [ 407.023077][ T48] usb 1-1: Manufacturer: syz [ 407.038375][ T48] usb 1-1: SerialNumber: syz [ 407.164229][ T48] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 407.195636][ T5341] usb 4-1: USB disconnect, device number 28 [ 407.258603][ T9907] input: syz0 as /devices/virtual/input/input28 [ 407.670578][ T48] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 407.814112][ T48] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 409.438200][ T9927] FAULT_INJECTION: forcing a failure. [ 409.438200][ T9927] name failslab, interval 1, probability 0, space 0, times 0 [ 409.452268][ T9927] CPU: 0 UID: 0 PID: 9927 Comm: syz.1.1048 Tainted: G L syzkaller #0 PREEMPT(full) [ 409.452287][ T9927] Tainted: [L]=SOFTLOCKUP [ 409.452291][ T9927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 409.452297][ T9927] Call Trace: [ 409.452301][ T9927] [ 409.452306][ T9927] dump_stack_lvl+0x100/0x190 [ 409.452325][ T9927] should_fail_ex.cold+0x5/0xa [ 409.452340][ T9927] should_failslab+0xc2/0x120 [ 409.452355][ T9927] kmem_cache_alloc_noprof+0x91/0x6a0 [ 409.452368][ T9927] ? dst_alloc+0x99/0x1a0 [ 409.452386][ T9927] ? __pfx_ip6_dst_gc+0x10/0x10 [ 409.452400][ T9927] dst_alloc+0x99/0x1a0 [ 409.452417][ T9927] ip6_pol_route+0x9fd/0x1310 [ 409.452429][ T9927] ? __pfx_ip6_pol_route+0x10/0x10 [ 409.452444][ T9927] ? lock_acquire+0x1b9/0x370 [ 409.452459][ T9927] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 409.452470][ T9927] fib6_rule_action+0x762/0x910 [ 409.452487][ T9927] ? __pfx_fib6_rule_action+0x10/0x10 [ 409.452502][ T9927] fib_rules_lookup+0x418/0x1060 [ 409.452519][ T9927] ? __pfx_fib_rules_lookup+0x10/0x10 [ 409.452536][ T9927] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 409.452546][ T9927] fib6_rule_lookup+0x18b/0x720 [ 409.452562][ T9927] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 409.452580][ T9927] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 409.452599][ T9927] ip6_route_input+0x662/0xc50 [ 409.452611][ T9927] ? __pfx_ip6_route_input+0x10/0x10 [ 409.452625][ T9927] ? find_held_lock+0x2b/0x80 [ 409.452639][ T9927] ? nf_hook.constprop.0+0x2d9/0x750 [ 409.452654][ T9927] ? nf_hook.constprop.0+0x2e3/0x750 [ 409.452664][ T9927] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 409.452676][ T9927] ? __pfx_nf_hook.constprop.0+0x10/0x10 [ 409.452690][ T9927] ip6_rcv_finish_core.isra.0+0x1b1/0x1260 [ 409.452705][ T9927] ipv6_rcv+0x1e8/0x3d0 [ 409.452716][ T9927] ? __pfx_ipv6_rcv+0x10/0x10 [ 409.452726][ T9927] __netif_receive_skb_one_core+0x12d/0x1e0 [ 409.452743][ T9927] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 409.452760][ T9927] ? lock_acquire+0x1b9/0x370 [ 409.452777][ T9927] __netif_receive_skb+0x1f/0x120 [ 409.452793][ T9927] netif_receive_skb+0x139/0x7d0 [ 409.452809][ T9927] ? __pfx_netif_receive_skb+0x10/0x10 [ 409.452829][ T9927] tun_rx_batched.isra.0+0x3f6/0x750 [ 409.452847][ T9927] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 409.452865][ T9927] ? tun_get_user+0x1cc8/0x3c20 [ 409.452884][ T9927] tun_get_user+0x1e31/0x3c20 [ 409.452905][ T9927] ? __pfx_tun_get_user+0x10/0x10 [ 409.452921][ T9927] ? __file_has_perm+0x336/0x460 [ 409.452936][ T9927] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 409.452956][ T9927] ? find_held_lock+0x2b/0x80 [ 409.452965][ T9927] ? tun_get+0x191/0x370 [ 409.452979][ T9927] ? tun_get+0x191/0x370 [ 409.452996][ T9927] tun_chr_write_iter+0xdc/0x200 [ 409.453014][ T9927] vfs_write+0x6ac/0x1050 [ 409.453031][ T9927] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 409.453049][ T9927] ? __pfx_vfs_write+0x10/0x10 [ 409.453064][ T9927] ? find_held_lock+0x2b/0x80 [ 409.453082][ T9927] ksys_write+0x12a/0x250 [ 409.453098][ T9927] ? __pfx_ksys_write+0x10/0x10 [ 409.453118][ T9927] do_syscall_64+0x115/0x870 [ 409.453134][ T9927] ? clear_bhb_loop+0x40/0x90 [ 409.453147][ T9927] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.453158][ T9927] RIP: 0033:0x7fa69795d68e [ 409.453169][ T9927] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 409.453179][ T9927] RSP: 002b:00007fa698824fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 409.453190][ T9927] RAX: ffffffffffffffda RBX: 00007fa6988256c0 RCX: 00007fa69795d68e [ 409.453196][ T9927] RDX: 000000000000004a RSI: 0000200000000080 RDI: 00000000000000c8 [ 409.453202][ T9927] RBP: 00007fa698825090 R08: 0000000000000000 R09: 0000000000000000 [ 409.453208][ T9927] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 409.453214][ T9927] R13: 00007fa697c16038 R14: 00007fa697c15fa0 R15: 00007ffd38a53788 [ 409.453227][ T9927] [ 410.120634][ T5795] usb 1-1: USB disconnect, device number 31 [ 410.234113][ T9935] FAULT_INJECTION: forcing a failure. [ 410.234113][ T9935] name failslab, interval 1, probability 0, space 0, times 0 [ 410.297233][ T9935] CPU: 0 UID: 0 PID: 9935 Comm: syz.0.1051 Tainted: G L syzkaller #0 PREEMPT(full) [ 410.297263][ T9935] Tainted: [L]=SOFTLOCKUP [ 410.297269][ T9935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 410.297280][ T9935] Call Trace: [ 410.297286][ T9935] [ 410.297293][ T9935] dump_stack_lvl+0x100/0x190 [ 410.297323][ T9935] should_fail_ex.cold+0x5/0xa [ 410.297349][ T9935] should_failslab+0xc2/0x120 [ 410.297374][ T9935] __kmalloc_noprof+0xfc/0x820 [ 410.297395][ T9935] ? do_sys_poll+0x273/0xe90 [ 410.297417][ T9935] do_sys_poll+0x273/0xe90 [ 410.297433][ T9935] ? bpf_ksym_find+0x128/0x1c0 [ 410.297460][ T9935] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 410.297482][ T9935] ? is_bpf_text_address+0x94/0x1a0 [ 410.297509][ T9935] ? __pfx_do_sys_poll+0x10/0x10 [ 410.297526][ T9935] ? arch_stack_walk+0xa6/0xf0 [ 410.297613][ T9935] ? __mutex_unlock_slowpath+0x35d/0x930 [ 410.297639][ T9935] ? set_user_sigmask+0x1e1/0x270 [ 410.297661][ T9935] ? __pfx_set_user_sigmask+0x10/0x10 [ 410.297683][ T9935] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 410.297714][ T9935] __x64_sys_ppoll+0x2b5/0x350 [ 410.297736][ T9935] ? __pfx___x64_sys_ppoll+0x10/0x10 [ 410.297753][ T9935] ? ksys_write+0x1ac/0x250 [ 410.297780][ T9935] ? __pfx_ksys_write+0x10/0x10 [ 410.297817][ T9935] do_syscall_64+0x115/0x870 [ 410.297842][ T9935] ? clear_bhb_loop+0x40/0x90 [ 410.297864][ T9935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.297882][ T9935] RIP: 0033:0x7f18f219ce59 [ 410.297898][ T9935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 410.297915][ T9935] RSP: 002b:00007f18f30f7028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 410.297933][ T9935] RAX: ffffffffffffffda RBX: 00007f18f2415fa0 RCX: 00007f18f219ce59 [ 410.297944][ T9935] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 410.297955][ T9935] RBP: 00007f18f30f7090 R08: 0000000000000000 R09: 0000000000000000 [ 410.297965][ T9935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 410.297975][ T9935] R13: 00007f18f2416038 R14: 00007f18f2415fa0 R15: 00007ffc31bc50d8 [ 410.297999][ T9935] [ 410.615759][ T29] audit: type=1326 audit(1782641163.529:997): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9942 comm="syz.4.1054" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fec00d9ce59 code=0x0 [ 410.693784][ T9945] Failed to get privilege flags for destination (handle=0x2:0x2) [ 410.724442][ T29] audit: type=1400 audit(1782641163.649:998): avc: denied { bind } for pid=9942 comm="syz.4.1054" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 410.818314][ T29] audit: type=1400 audit(1782641163.649:999): avc: denied { name_bind } for pid=9942 comm="syz.4.1054" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 410.919222][ T29] audit: type=1400 audit(1782641163.649:1000): avc: denied { node_bind } for pid=9942 comm="syz.4.1054" saddr=fe80::bb src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 411.003213][ T29] audit: type=1400 audit(1782641163.649:1001): avc: denied { write } for pid=9942 comm="syz.4.1054" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 411.075701][ T5341] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 411.355448][ T9957] netlink: 'syz.0.1056': attribute type 10 has an invalid length. [ 411.363405][ T9957] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1056'. [ 411.597408][ T5341] usb 4-1: unable to get BOS descriptor or descriptor too short [ 411.608472][ T5341] usb 4-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 411.629105][ T5341] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 411.659297][ T9960] input: syz0 as /devices/virtual/input/input29 [ 411.668899][ T5341] usb 4-1: string descriptor 0 read error: -22 [ 411.677257][ T5341] usb 4-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 411.701152][ T5341] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.192344][ T5341] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 412.226350][ T6152] udevd[6152]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 412.685893][ T5703] usb 2-1: new full-speed USB device number 34 using dummy_hcd [ 413.039503][ T5703] usb 2-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 413.050260][ T5703] usb 2-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 413.065447][ T5703] usb 2-1: Product: syz [ 413.070825][ T5703] usb 2-1: Manufacturer: syz [ 413.076270][ T5703] usb 2-1: SerialNumber: syz [ 413.095348][ T5703] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 413.113535][ T29] audit: type=1400 audit(1782641166.049:1002): avc: denied { nlmsg_read } for pid=9989 comm="syz.4.1065" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 413.495546][ T5703] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 413.507654][ T5703] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 414.259330][ T5703] usb 4-1: USB disconnect, device number 29 [ 414.763178][T10010] input: syz0 as /devices/virtual/input/input30 [ 414.786012][ T9] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 414.955453][ T5703] usb 2-1: USB disconnect, device number 34 [ 414.965690][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 414.980254][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 414.996969][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 415.019505][ T9] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0xE has invalid maxpacket 0 [ 415.087938][ T9] usb 3-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice= 0.40 [ 415.109685][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.211725][ T9966] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 415.233931][ T9] usb 3-1: Product: syz [ 415.761160][ T9] usb 3-1: Manufacturer: syz [ 415.768108][ T9] usb 3-1: SerialNumber: syz [ 416.996305][ T5711] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 417.165923][ T5711] usb 4-1: Using ep0 maxpacket: 32 [ 417.258949][ T5711] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 418.239455][ T5711] usb 4-1: config 0 has no interface number 0 [ 418.267226][ T5711] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 418.272194][ T5703] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 418.277420][ T5711] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.456295][ T5711] usb 4-1: Product: syz [ 418.468135][ T5711] usb 4-1: Manufacturer: syz [ 418.490016][ T5711] usb 4-1: SerialNumber: syz [ 418.510310][ T5711] usb 4-1: config 0 descriptor?? [ 418.630128][ T5703] usb 5-1: unable to get BOS descriptor or descriptor too short [ 418.702568][ T5703] usb 5-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 418.857784][ T5703] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 419.092057][ T5703] usb 5-1: string descriptor 0 read error: -22 [ 419.098990][ T5703] usb 5-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 419.118775][ T5703] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.333491][ T9] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 419.357362][ T5703] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 419.401612][T10029] loop3: detected capacity change from 0 to 7 [ 419.423087][T10029] Dev loop3: unable to read RDB block 7 [ 419.428838][T10029] loop3: AHDI p3 p4 [ 419.432084][ T9] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -12 [ 419.446868][T10029] loop3: partition table partially beyond EOD, truncated [ 419.450190][ T9] usb 3-1: USB disconnect, device number 36 [ 419.471085][T10049] binder: 10048:10049 ioctl c0306201 0 returned -14 [ 419.511011][ T5632] udevd[5632]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 419.570535][T10029] loop3: p3 start 1702000233 is beyond EOD, truncated [ 419.650315][ T5711] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 419.669283][ T5711] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 419.702805][ T5711] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 419.754578][ T5711] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 419.775434][ T5711] usb 4-1: USB disconnect, device number 30 [ 420.695277][ T29] audit: type=1400 audit(1782641173.529:1003): avc: denied { mount } for pid=10059 comm="syz.1.1085" name="/" dev="autofs" ino=32120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 420.910409][ T5743] usb 5-1: USB disconnect, device number 33 [ 420.945693][ T5711] usb 1-1: new full-speed USB device number 32 using dummy_hcd [ 421.252017][ T5711] usb 1-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 421.288010][ T5711] usb 1-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 421.310722][ T5711] usb 1-1: Product: syz [ 421.321160][ T5711] usb 1-1: Manufacturer: syz [ 421.347066][ T5711] usb 1-1: SerialNumber: syz [ 421.935980][ T5711] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 422.047582][T10077] input: syz0 as /devices/virtual/input/input31 [ 422.566153][ T5711] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 422.764186][ T5711] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 423.123733][ T29] audit: type=1400 audit(1782641176.059:1004): avc: denied { write } for pid=10087 comm="syz.4.1092" name="usbmon7" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 423.292641][T10095] xt_hashlimit: max too large, truncated to 1048576 [ 423.637404][ T29] audit: type=1400 audit(1782641176.569:1005): avc: denied { ioctl } for pid=10087 comm="syz.4.1092" path="socket:[32360]" dev="sockfs" ino=32360 ioctlcmd=0x5867 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 424.109958][ T24] usb 1-1: USB disconnect, device number 32 [ 426.716054][ T5703] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 427.012264][ T5703] usb 4-1: unable to get BOS descriptor or descriptor too short [ 427.013079][ T5703] usb 4-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 427.013103][ T5703] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 427.027170][ T5703] usb 4-1: string descriptor 0 read error: -22 [ 427.027235][ T5703] usb 4-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 427.027249][ T5703] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.251464][ T5703] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 427.578448][T10138] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 428.684113][T10146] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 428.844365][T10150] input: syz0 as /devices/virtual/input/input32 [ 429.279901][T10153] Failed to get privilege flags for destination (handle=0x2:0x2) [ 429.638564][ T5703] usb 4-1: USB disconnect, device number 31 [ 430.822166][T10171] netlink: 'syz.2.1109': attribute type 10 has an invalid length. [ 430.830056][T10171] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1109'. [ 430.916777][ T5703] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 430.925800][ T5743] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 431.136316][ T5703] usb 4-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 431.202566][ T5703] usb 4-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 431.215696][ T5743] usb 5-1: Using ep0 maxpacket: 8 [ 431.335726][ T29] audit: type=1400 audit(1782641184.189:1006): avc: denied { accept } for pid=10174 comm="syz.2.1111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 431.359808][ T5743] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 431.383180][ T5743] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 431.402648][ T5703] usb 4-1: Product: syz [ 431.408537][ T5703] usb 4-1: Manufacturer: syz [ 431.418090][ T5703] usb 4-1: SerialNumber: syz [ 431.450730][ T5703] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 431.470294][ T5743] usb 5-1: New USB device found, idVendor=172f, idProduct=0037, bcdDevice= 0.00 [ 431.508277][ T5620] Bluetooth: hci2: ACL packet for unknown connection handle 2249 [ 431.511427][ T5743] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.601128][ T5743] usb 5-1: config 0 descriptor?? [ 431.859586][ T5703] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 432.026672][ T5703] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 432.364540][ T5743] waltop 0003:172F:0037.000A: unknown main item tag 0x0 [ 432.382594][ T5743] waltop 0003:172F:0037.000A: unknown main item tag 0x0 [ 432.399477][ T5743] waltop 0003:172F:0037.000A: unknown main item tag 0x0 [ 432.414545][ T5743] waltop 0003:172F:0037.000A: unknown main item tag 0x0 [ 432.432727][ T5743] waltop 0003:172F:0037.000A: unknown main item tag 0x0 [ 432.459184][ T5743] waltop 0003:172F:0037.000A: unknown main item tag 0x0 [ 432.469101][ T5743] waltop 0003:172F:0037.000A: unknown main item tag 0x0 [ 432.477937][ T5743] waltop 0003:172F:0037.000A: unknown main item tag 0x0 [ 432.493580][ T5743] waltop 0003:172F:0037.000A: hidraw0: USB HID v0.00 Device [HID 172f:0037] on usb-dummy_hcd.4-1/input0 [ 432.702135][ T5703] usb 4-1: USB disconnect, device number 32 [ 434.814337][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 434.820706][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 434.979457][ T5711] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 435.697081][ T5711] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 435.970959][ T5711] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.018902][ T5711] usb 3-1: Product: syz [ 436.223709][ T5711] usb 3-1: Manufacturer: syz [ 436.469158][ T5711] usb 3-1: SerialNumber: syz [ 436.578079][ T5725] usb 5-1: USB disconnect, device number 34 [ 436.856999][ T29] audit: type=1400 audit(1782641189.799:1007): avc: denied { bind } for pid=10219 comm="syz.3.1122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 436.882362][ T5711] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 437.383347][ T5711] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 437.394608][ T5711] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 437.411464][ T29] audit: type=1400 audit(1782641190.349:1008): avc: denied { create } for pid=10219 comm="syz.3.1122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 437.492724][ T5711] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 437.646977][ T5711] usb 3-1: USB disconnect, device number 37 [ 438.268324][T10242] netlink: 'syz.3.1128': attribute type 10 has an invalid length. [ 438.276270][T10242] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1128'. [ 438.751191][T10236] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 438.845959][T10236] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 438.873242][T10248] netlink: 'syz.3.1129': attribute type 4 has an invalid length. [ 438.889448][T10249] netlink: 'syz.3.1129': attribute type 4 has an invalid length. [ 439.395684][ T5725] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 439.545957][ T48] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 439.789375][ T5725] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 439.890823][ T5725] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 440.045776][ T5725] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 440.047811][ T48] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 440.055352][ T5725] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.120355][ T48] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.123503][ T5725] usb 4-1: config 0 descriptor?? [ 440.149444][ T48] usb 2-1: Product: syz [ 440.155209][ T48] usb 2-1: Manufacturer: syz [ 440.163818][ T48] usb 2-1: SerialNumber: syz [ 440.344982][ T5725] usbhid 4-1:0.0: can't add hid device: -71 [ 440.352529][ T5725] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 440.367532][ T5725] usb 4-1: USB disconnect, device number 33 [ 440.546070][ T5711] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 440.614246][T10256] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 440.623098][T10256] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 440.634000][ T48] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 440.646361][ T48] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 440.658643][T10256] binder: 10255:10256 ioctl c0306201 200000000000 returned -14 [ 440.669194][ T5620] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 440.679046][ T48] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 440.695484][ T48] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 440.705320][ T48] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 440.707375][ T5711] usb 5-1: unable to get BOS descriptor or descriptor too short [ 440.723476][ T5711] usb 5-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 440.724915][ T48] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 440.734988][ T5711] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 440.749332][ T48] usb 2-1: USB disconnect, device number 35 [ 440.760788][ T5711] usb 5-1: string descriptor 0 read error: -22 [ 440.769032][ T5711] usb 5-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 440.778466][ T5711] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.805771][ T5725] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 440.862859][ T5711] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 440.966988][ T5725] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 440.993579][ T5725] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 441.020375][ T5725] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 441.040082][ T5725] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.052221][ T5725] usb 4-1: config 0 descriptor?? [ 441.271005][T10254] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 441.412925][T10280] netlink: 'syz.2.1139': attribute type 10 has an invalid length. [ 441.420864][T10280] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1139'. [ 441.471306][ T48] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 441.504918][T10254] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 441.760026][ T48] usb 1-1: unable to get BOS descriptor or descriptor too short [ 441.771255][ T48] usb 1-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 441.784464][ T48] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 441.797916][ T48] usb 1-1: string descriptor 0 read error: -22 [ 441.804313][ T48] usb 1-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 441.814927][ T48] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.864866][ T48] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 441.877630][ T5725] keytouch 0003:0926:3333.000B: fixing up Keytouch IEC report descriptor [ 441.899861][ T5725] input: HID 0926:3333 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0926:3333.000B/input/input33 [ 442.026806][ T9] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 442.057080][ T5725] keytouch 0003:0926:3333.000B: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.3-1/input0 [ 442.105012][ T5725] usb 4-1: USB disconnect, device number 34 [ 442.141017][T10286] fido_id[10286]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 442.202353][ T9] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 442.221183][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.252802][ T9] usb 2-1: Product: syz [ 442.261582][ T9] usb 2-1: Manufacturer: syz [ 442.270738][ T9] usb 2-1: SerialNumber: syz [ 442.806647][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 442.821568][T10283] binder: 10282:10283 ioctl c0306201 200000000000 returned -14 [ 442.848698][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 442.864915][ T5620] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 442.872647][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 442.872691][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 442.873184][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 442.907598][ T9] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 442.963261][ T9] usb 2-1: USB disconnect, device number 36 [ 443.163922][T10295] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 443.302572][T10303] netlink: 'syz.3.1145': attribute type 10 has an invalid length. [ 443.310503][T10303] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1145'. [ 443.375822][ T48] usb 5-1: USB disconnect, device number 35 [ 443.400711][T10300] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 443.904798][ T5703] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 444.090715][ T9] usb 1-1: USB disconnect, device number 33 [ 444.203117][ T5703] usb 2-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 444.226843][ T5703] usb 2-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 444.245789][ T5703] usb 2-1: Product: syz [ 444.251092][ T5703] usb 2-1: Manufacturer: syz [ 444.267133][ T5703] usb 2-1: SerialNumber: syz [ 444.294937][ T5703] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 444.328721][T10319] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 444.499530][T10319] audit: out of memory in audit_log_start [ 444.825528][T10330] FAULT_INJECTION: forcing a failure. [ 444.825528][T10330] name failslab, interval 1, probability 0, space 0, times 0 [ 444.840217][T10330] CPU: 0 UID: 0 PID: 10330 Comm: syz.0.1152 Tainted: G L syzkaller #0 PREEMPT(full) [ 444.840246][T10330] Tainted: [L]=SOFTLOCKUP [ 444.840252][T10330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 444.840261][T10330] Call Trace: [ 444.840268][T10330] [ 444.840275][T10330] dump_stack_lvl+0x100/0x190 [ 444.840300][T10330] should_fail_ex.cold+0x5/0xa [ 444.840317][T10330] should_failslab+0xc2/0x120 [ 444.840332][T10330] __kmalloc_noprof+0xfc/0x820 [ 444.840346][T10330] ? tomoyo_encode2+0xfb/0x3c0 [ 444.840377][T10330] tomoyo_encode2+0xfb/0x3c0 [ 444.840400][T10330] ? tomoyo_realpath_from_path+0x3b5/0x690 [ 444.840428][T10330] tomoyo_encode+0x29/0x50 [ 444.840444][T10330] tomoyo_realpath_from_path+0x18c/0x690 [ 444.840464][T10330] tomoyo_path_number_perm+0x23c/0x580 [ 444.840478][T10330] ? tomoyo_path_number_perm+0x22e/0x580 [ 444.840497][T10330] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 444.840520][T10330] ? register_lock_class+0x40/0x560 [ 444.840549][T10330] ? __lock_acquire+0x49f/0x1a40 [ 444.840576][T10330] ? __pfx___might_resched+0x10/0x10 [ 444.840589][T10330] ? find_held_lock+0x2b/0x80 [ 444.840599][T10330] ? mnt_get_write_access+0x52/0x2f0 [ 444.840618][T10330] ? down_write_killable+0x152/0x250 [ 444.840631][T10330] ? __pfx_down_write_killable+0x10/0x10 [ 444.840652][T10330] security_path_chmod+0x121/0x2c0 [ 444.840676][T10330] chmod_common+0x19a/0x4d0 [ 444.840697][T10330] ? __pfx_chmod_common+0x10/0x10 [ 444.840719][T10330] ? do_getname+0x191/0x390 [ 444.840734][T10330] do_fchmodat+0x10a/0x1b0 [ 444.840746][T10330] ? __pfx_do_fchmodat+0x10/0x10 [ 444.840756][T10330] ? ksys_write+0x1ac/0x250 [ 444.840775][T10330] ? __pfx_ksys_write+0x10/0x10 [ 444.840804][T10330] __x64_sys_fchmodat+0x77/0xc0 [ 444.840822][T10330] ? lockdep_hardirqs_on+0x78/0x100 [ 444.840849][T10330] do_syscall_64+0x115/0x870 [ 444.840865][T10330] ? clear_bhb_loop+0x40/0x90 [ 444.840878][T10330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 444.840889][T10330] RIP: 0033:0x7f18f219ce59 [ 444.840900][T10330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 444.840912][T10330] RSP: 002b:00007f18f30d6028 EFLAGS: 00000246 ORIG_RAX: 000000000000010c [ 444.840929][T10330] RAX: ffffffffffffffda RBX: 00007f18f2416090 RCX: 00007f18f219ce59 [ 444.840940][T10330] RDX: 00000000fffffffb RSI: 0000200000000000 RDI: ffffffffffffff9c [ 444.840949][T10330] RBP: 00007f18f30d6090 R08: 0000000000000000 R09: 0000000000000000 [ 444.840958][T10330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 444.840967][T10330] R13: 00007f18f2416128 R14: 00007f18f2416090 R15: 00007ffc31bc50d8 [ 444.840990][T10330] [ 444.841073][T10330] ERROR: Out of memory at tomoyo_realpath_from_path. [ 445.374496][ T5703] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 445.387578][ T5703] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 445.605674][ T5743] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 445.635540][T10340] Failed to get privilege flags for destination (handle=0x2:0x2) [ 445.777682][ T5743] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 445.789998][ T5743] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 445.800698][ T5743] usb 3-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 445.810068][ T5743] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.832722][ T5743] usb 3-1: config 0 descriptor?? [ 445.846467][ T5718] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 446.008990][ T5718] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 446.019895][ T5718] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.030828][ T5718] usb 1-1: Product: syz [ 446.035149][ T5718] usb 1-1: Manufacturer: syz [ 446.040609][ T5718] usb 1-1: SerialNumber: syz [ 446.160984][ T5725] usb 2-1: USB disconnect, device number 37 [ 446.185693][ T9] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 446.258869][ T5743] hid-steam 0003:28DE:1142.000C: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.2-1/input0 [ 446.325877][ T5743] hid-steam 0003:28DE:1142.000C: Steam wireless receiver connected [ 446.529731][T10351] netlink: 'syz.4.1158': attribute type 10 has an invalid length. [ 446.537775][T10351] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1158'. [ 446.584159][T10339] binder: 10337:10339 ioctl c0306201 200000000000 returned -14 [ 446.592459][ T5718] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 446.684407][ T5620] Bluetooth: hci4: ACL packet for unknown connection handle 200 [ 446.974691][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 447.055808][ T5718] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 447.179009][ T9] usb 4-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 447.182235][T10356] FAULT_INJECTION: forcing a failure. [ 447.182235][T10356] name failslab, interval 1, probability 0, space 0, times 0 [ 447.205674][ T5718] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 447.226181][ T5718] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 447.227020][T10356] CPU: 0 UID: 0 PID: 10356 Comm: syz.4.1160 Tainted: G L syzkaller #0 PREEMPT(full) [ 447.227045][T10356] Tainted: [L]=SOFTLOCKUP [ 447.227050][T10356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 447.227059][T10356] Call Trace: [ 447.227064][T10356] [ 447.227070][T10356] dump_stack_lvl+0x100/0x190 [ 447.227095][T10356] should_fail_ex.cold+0x5/0xa [ 447.227117][T10356] should_failslab+0xc2/0x120 [ 447.227138][T10356] __kmalloc_cache_noprof+0x91/0x6c0 [ 447.227161][T10356] ? __kasan_kmalloc+0xaa/0xb0 [ 447.227178][T10356] ? udf_init_fs_context+0x4b/0x830 [ 447.227198][T10356] udf_init_fs_context+0x4b/0x830 [ 447.227215][T10356] alloc_fs_context+0x60c/0xf40 [ 447.227240][T10356] __x64_sys_fsopen+0xed/0x220 [ 447.227262][T10356] do_syscall_64+0x115/0x870 [ 447.227284][T10356] ? clear_bhb_loop+0x40/0x90 [ 447.227303][T10356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.227318][T10356] RIP: 0033:0x7fec00d9ce59 [ 447.227332][T10356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 447.227346][T10356] RSP: 002b:00007fec01cfe028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 447.227362][T10356] RAX: ffffffffffffffda RBX: 00007fec01015fa0 RCX: 00007fec00d9ce59 [ 447.227373][T10356] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 447.227382][T10356] RBP: 00007fec01cfe090 R08: 0000000000000000 R09: 0000000000000000 [ 447.227390][T10356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 447.227399][T10356] R13: 00007fec01016038 R14: 00007fec01015fa0 R15: 00007ffeca769418 [ 447.227419][T10356] [ 447.306438][ T9] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 447.456446][ T5743] hid-steam 0003:28DE:1142.000D: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.2-1/input0 [ 447.474267][ T5743] usb 3-1: USB disconnect, device number 38 [ 447.492595][ T5743] hid-steam 0003:28DE:1142.000C: Steam wireless receiver disconnected [ 447.508252][ T9] usb 4-1: string descriptor 0 read error: -22 [ 447.573761][ T9] usb 4-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 447.602243][ T5718] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 447.623315][ T5718] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 447.627906][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.694708][T10357] fido_id[10357]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 447.746440][ T5718] usb 1-1: USB disconnect, device number 34 [ 448.304126][ T29] audit: type=1400 audit(1782641201.239:1009): avc: denied { bind } for pid=10365 comm="syz.4.1165" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 448.304503][T10366] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1165'. [ 448.326456][ T9] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 448.652920][T10378] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 448.680921][T10378] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 448.932939][T10386] netlink: 'syz.4.1168': attribute type 10 has an invalid length. [ 448.940879][T10386] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1168'. [ 449.405066][ T5718] usb 4-1: USB disconnect, device number 35 [ 449.627203][T10402] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1173'. [ 450.095709][ T5718] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 450.258960][ T5718] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 450.268950][ T5718] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.279921][ T5718] usb 4-1: Product: syz [ 450.385939][ T5718] usb 4-1: Manufacturer: syz [ 450.393009][ T5718] usb 4-1: SerialNumber: syz [ 451.069304][ T5718] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 451.083943][T10411] binder: 10410:10411 ioctl c0306201 200000000000 returned -14 [ 451.155862][ T5718] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 451.167893][ T5620] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 451.177532][ T5718] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 451.193229][ T5718] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 451.203081][ T5718] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 451.218505][ T5718] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 451.235841][ T5718] usb 4-1: USB disconnect, device number 36 [ 451.305703][ T5703] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 451.535696][ T5703] usb 2-1: Using ep0 maxpacket: 32 [ 451.997646][ T5703] usb 2-1: config 3 has an invalid interface number: 79 but max is 0 [ 452.016451][ T5703] usb 2-1: config 3 has no interface number 0 [ 452.032619][ T5703] usb 2-1: config 3 interface 79 has no altsetting 0 [ 452.062308][ T5703] usb 2-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=fc.21 [ 452.080555][ T5703] usb 2-1: New USB device strings: Mfr=165, Product=2, SerialNumber=3 [ 452.108233][ T5703] usb 2-1: Product: syz [ 452.118796][ T5703] usb 2-1: Manufacturer: syz [ 452.129698][ T5703] usb 2-1: SerialNumber: syz [ 452.564687][ T5793] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 452.880061][ T29] audit: type=1400 audit(1782641205.809:1010): avc: denied { write } for pid=10429 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 453.026525][ T5793] usb 3-1: Using ep0 maxpacket: 32 [ 453.037082][ T5793] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 255, changing to 7 [ 453.165932][ T5793] usb 3-1: New USB device found, idVendor=0644, idProduct=800e, bcdDevice= 0.40 [ 453.185666][ T5793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.204616][ T29] audit: type=1400 audit(1782641206.139:1011): avc: denied { write } for pid=10452 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 453.233240][ T5793] usb 3-1: Product: syz [ 453.237810][ T5793] usb 3-1: Manufacturer: syz [ 453.243233][ T5793] usb 3-1: SerialNumber: syz [ 453.396674][ T5718] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 453.455558][ T5793] usb 3-1: can't set config #1, error -71 [ 453.471982][ T5793] usb 3-1: USB disconnect, device number 39 [ 453.672527][T10461] netlink: 'syz.3.1184': attribute type 10 has an invalid length. [ 453.680447][T10461] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1184'. [ 453.915428][ T5718] usb 1-1: unable to get BOS descriptor or descriptor too short [ 453.937811][ T5718] usb 1-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 453.948617][ T5718] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 453.962620][ T5718] usb 1-1: string descriptor 0 read error: -22 [ 453.969399][ T5718] usb 1-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 453.979801][ T5718] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.048383][T10454] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 454.178523][T10466] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 454.223931][ T5718] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 454.277757][ T5703] kobil_sct 2-1:3.79: required endpoints missing [ 454.324018][ T5703] usb 2-1: USB disconnect, device number 38 [ 454.396823][T10469] overlayfs: overlapping lowerdir path [ 454.420666][T10469] FAULT_INJECTION: forcing a failure. [ 454.420666][T10469] name failslab, interval 1, probability 0, space 0, times 0 [ 454.454393][T10474] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1187'. [ 454.464998][T10469] CPU: 1 UID: 0 PID: 10469 Comm: syz.3.1185 Tainted: G L syzkaller #0 PREEMPT(full) [ 454.465026][T10469] Tainted: [L]=SOFTLOCKUP [ 454.465031][T10469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 454.465041][T10469] Call Trace: [ 454.465047][T10469] [ 454.465053][T10469] dump_stack_lvl+0x100/0x190 [ 454.465081][T10469] should_fail_ex.cold+0x5/0xa [ 454.465106][T10469] should_failslab+0xc2/0x120 [ 454.465130][T10469] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 454.465153][T10469] ? __d_alloc+0x35/0xa50 [ 454.465178][T10469] __d_alloc+0x35/0xa50 [ 454.465202][T10469] d_alloc_parallel+0x105/0x14b0 [ 454.465237][T10469] ? __pfx_d_alloc_parallel+0x10/0x10 [ 454.465263][T10469] ? __pfx___might_resched+0x10/0x10 [ 454.465285][T10469] ? try_to_unlazy+0x296/0x910 [ 454.465314][T10469] ? down_read+0x13b/0x4c0 [ 454.465332][T10469] ? __pfx_down_read+0x10/0x10 [ 454.465351][T10469] __lookup_slow+0x98/0x320 [ 454.465376][T10469] lookup_slow+0x50/0x70 [ 454.465400][T10469] path_lookupat+0x5e8/0xc40 [ 454.465426][T10469] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.465447][T10469] filename_lookup+0x202/0x590 [ 454.465467][T10469] ? __pfx_filename_lookup+0x10/0x10 [ 454.465513][T10469] ? find_held_lock+0x2b/0x80 [ 454.465530][T10469] ? __might_fault+0xc5/0x140 [ 454.465547][T10469] ? __might_fault+0xc5/0x140 [ 454.465569][T10469] filename_setxattr+0xa1/0x1d0 [ 454.465595][T10469] ? __pfx_filename_setxattr+0x10/0x10 [ 454.465617][T10469] ? do_getname+0x191/0x390 [ 454.465639][T10469] path_setxattrat+0x1ff/0x3b0 [ 454.465661][T10469] ? __pfx_path_setxattrat+0x10/0x10 [ 454.465684][T10469] ? ksys_write+0x190/0x250 [ 454.465706][T10469] ? ksys_write+0x190/0x250 [ 454.465748][T10469] ? fput+0x79/0x100 [ 454.465768][T10469] ? ksys_write+0x1ac/0x250 [ 454.465793][T10469] ? __pfx_ksys_write+0x10/0x10 [ 454.465823][T10469] __x64_sys_setxattr+0xc6/0x140 [ 454.465842][T10469] ? do_syscall_64+0x90/0x870 [ 454.465867][T10469] ? lockdep_hardirqs_on+0x78/0x100 [ 454.465892][T10469] do_syscall_64+0x115/0x870 [ 454.465916][T10469] ? clear_bhb_loop+0x40/0x90 [ 454.465937][T10469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.465954][T10469] RIP: 0033:0x7f67ef59ce59 [ 454.465969][T10469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 454.465984][T10469] RSP: 002b:00007f67f03d1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 454.466002][T10469] RAX: ffffffffffffffda RBX: 00007f67ef815fa0 RCX: 00007f67ef59ce59 [ 454.466013][T10469] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000200000000140 [ 454.466024][T10469] RBP: 00007f67f03d1090 R08: 0000000000000001 R09: 0000000000000000 [ 454.466034][T10469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 454.466044][T10469] R13: 00007f67ef816038 R14: 00007f67ef815fa0 R15: 00007fff02ffeb78 [ 454.466067][T10469] [ 454.845772][ T29] audit: type=1400 audit(1782641207.779:1012): avc: denied { write } for pid=10460 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 455.350236][ T29] audit: type=1400 audit(1782641208.289:1013): avc: denied { write } for pid=10488 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 455.935713][ T5743] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 455.961245][ T5703] usb 1-1: USB disconnect, device number 35 [ 456.096038][ T5743] usb 4-1: Using ep0 maxpacket: 32 [ 456.102951][ T5743] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 456.113404][ T5743] usb 4-1: config 0 has no interface number 0 [ 456.120254][ T5743] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 456.133461][ T5743] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 456.144786][ T5743] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.153273][ T5743] usb 4-1: Product: syz [ 456.159912][ T5743] usb 4-1: Manufacturer: syz [ 456.165444][ T5743] usb 4-1: SerialNumber: syz [ 456.181439][ T5743] usb 4-1: config 0 descriptor?? [ 456.199327][ T5743] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 456.217036][ T5743] em28xx 4-1:0.132: Video interface 132 found: [ 456.415689][ T9] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 456.475044][T10489] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 456.475822][ T5703] usb 1-1: new full-speed USB device number 36 using dummy_hcd [ 456.595719][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 456.603739][ T9] usb 2-1: config 3 has an invalid interface number: 79 but max is 0 [ 456.612230][ T9] usb 2-1: config 3 has no interface number 0 [ 456.619091][ T9] usb 2-1: config 3 interface 79 has no altsetting 0 [ 456.634187][ T9] usb 2-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=fc.21 [ 456.644129][ T9] usb 2-1: New USB device strings: Mfr=165, Product=2, SerialNumber=3 [ 456.646302][ T5703] usb 1-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 456.652512][ T9] usb 2-1: Product: syz [ 456.666384][ T9] usb 2-1: Manufacturer: syz [ 456.667603][ T5703] usb 1-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 456.679720][ T9] usb 2-1: SerialNumber: syz [ 456.680208][ T5703] usb 1-1: Product: syz [ 456.690013][ T5703] usb 1-1: Manufacturer: syz [ 456.694700][ T5703] usb 1-1: SerialNumber: syz [ 456.711486][ T5743] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 456.712402][ T5703] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 457.971291][ T5703] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 457.971641][ T5743] em28xx 4-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 457.994583][ T5703] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 458.044149][ T5743] em28xx 4-1:0.132: board has no eeprom [ 458.155841][ T5743] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 458.175905][ T5743] em28xx 4-1:0.132: analog set to bulk mode. [ 458.188056][ T5341] em28xx 4-1:0.132: Registering V4L2 extension [ 458.491499][ T5743] usb 4-1: USB disconnect, device number 37 [ 458.501879][ T5341] em28xx 4-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 458.527556][ T5743] em28xx 4-1:0.132: Disconnecting em28xx [ 458.658218][ T5341] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 458.671917][ T5341] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 458.688745][ T5341] em28xx 4-1:0.132: No AC97 audio processor [ 458.743088][ T5341] usb 4-1: Decoder not found [ 458.763291][ T5341] em28xx 4-1:0.132: failed to create media graph [ 458.776808][ T5341] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 459.194165][ T5703] usb 1-1: USB disconnect, device number 36 [ 459.302591][ T5341] em28xx 4-1:0.132: Remote control support is not available for this card. [ 459.311469][ T5743] em28xx 4-1:0.132: Closing input extension [ 459.318816][ T5743] ================================================================== [ 459.326908][ T5743] BUG: KASAN: slab-use-after-free in media_device_unregister+0x59d/0x610 [ 459.335322][ T5743] Read of size 8 at addr ffff888053e80210 by task kworker/0:8/5743 [ 459.343191][ T5743] [ 459.345503][ T5743] CPU: 0 UID: 0 PID: 5743 Comm: kworker/0:8 Tainted: G L syzkaller #0 PREEMPT(full) [ 459.345525][ T5743] Tainted: [L]=SOFTLOCKUP [ 459.345530][ T5743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 459.345543][ T5743] Workqueue: usb_hub_wq hub_event [ 459.345563][ T5743] Call Trace: [ 459.345569][ T5743] [ 459.345574][ T5743] dump_stack_lvl+0x100/0x190 [ 459.345594][ T5743] print_report+0x13d/0x4b0 [ 459.345619][ T5743] ? __virt_addr_valid+0x239/0x430 [ 459.345643][ T5743] ? media_device_unregister+0x59d/0x610 [ 459.345665][ T5743] kasan_report+0xdf/0x1c0 [ 459.345686][ T5743] ? media_device_unregister+0x59d/0x610 [ 459.345707][ T5743] media_device_unregister+0x59d/0x610 [ 459.345728][ T5743] em28xx_unregister_media_device+0x4e/0xe0 [ 459.345745][ T5743] em28xx_release_resources+0x79/0x1b0 [ 459.345760][ T5743] em28xx_usb_disconnect.cold+0x17d/0x253 [ 459.345776][ T5743] usb_unbind_interface+0x1dd/0x9e0 [ 459.345802][ T5743] ? __pfx_usb_unbind_interface+0x10/0x10 [ 459.345819][ T5743] device_remove+0x12a/0x180 [ 459.345836][ T5743] device_release_driver_internal+0x44e/0x620 [ 459.345860][ T5743] bus_remove_device+0x2bc/0x560 [ 459.345876][ T5743] ? __pfx_bus_remove_device+0x10/0x10 [ 459.345890][ T5743] ? __pfx_device_remove_attrs+0x10/0x10 [ 459.345910][ T5743] device_del+0x376/0x9b0 [ 459.345928][ T5743] ? __pfx_device_del+0x10/0x10 [ 459.345944][ T5743] ? kobject_put+0xb9/0x640 [ 459.345964][ T5743] usb_disable_device+0x367/0x810 [ 459.345983][ T5743] usb_disconnect+0x2e2/0x9a0 [ 459.346000][ T5743] hub_event+0x1d0c/0x4af0 [ 459.346020][ T5743] ? __lock_acquire+0x49f/0x1a40 [ 459.346037][ T5743] ? do_raw_spin_unlock+0x145/0x1e0 [ 459.346058][ T5743] ? __pfx_hub_event+0x10/0x10 [ 459.346072][ T5743] ? debug_object_deactivate+0x2e4/0x3b0 [ 459.346096][ T5743] ? rcu_is_watching+0x12/0xc0 [ 459.346119][ T5743] process_one_work+0xa23/0x1940 [ 459.346139][ T5743] ? __pfx_process_one_work+0x10/0x10 [ 459.346156][ T5743] ? __pfx_hub_event+0x10/0x10 [ 459.346171][ T5743] worker_thread+0x5ef/0xe50 [ 459.346188][ T5743] ? __pfx_worker_thread+0x10/0x10 [ 459.346204][ T5743] ? kthread+0x13a/0x450 [ 459.346218][ T5743] ? __pfx_worker_thread+0x10/0x10 [ 459.346232][ T5743] kthread+0x370/0x450 [ 459.346245][ T5743] ? __pfx_kthread+0x10/0x10 [ 459.346259][ T5743] ret_from_fork+0x72b/0xd50 [ 459.346280][ T5743] ? __pfx_ret_from_fork+0x10/0x10 [ 459.346305][ T5743] ? __switch_to+0x800/0x10f0 [ 459.346320][ T5743] ? __pfx_kthread+0x10/0x10 [ 459.346334][ T5743] ret_from_fork_asm+0x1a/0x30 [ 459.346353][ T5743] [ 459.346358][ T5743] [ 459.596619][ T5743] Allocated by task 5341: [ 459.600936][ T5743] kasan_save_stack+0x30/0x50 [ 459.605607][ T5743] kasan_save_track+0x14/0x30 [ 459.610273][ T5743] __kasan_kmalloc+0xaa/0xb0 [ 459.614848][ T5743] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 459.620210][ T5743] em28xx_v4l2_init.cold+0x94/0x3a40 [ 459.625478][ T5743] em28xx_init_extension+0x13a/0x200 [ 459.630751][ T5743] request_module_async+0x61/0x80 [ 459.635777][ T5743] process_one_work+0xa23/0x1940 [ 459.640698][ T5743] worker_thread+0x5ef/0xe50 [ 459.645270][ T5743] kthread+0x370/0x450 [ 459.649317][ T5743] ret_from_fork+0x72b/0xd50 [ 459.653893][ T5743] ret_from_fork_asm+0x1a/0x30 [ 459.658634][ T5743] [ 459.660936][ T5743] Freed by task 5341: [ 459.664894][ T5743] kasan_save_stack+0x30/0x50 [ 459.669555][ T5743] kasan_save_track+0x14/0x30 [ 459.674229][ T5743] kasan_save_free_info+0x3b/0x70 [ 459.679247][ T5743] __kasan_slab_free+0x5f/0x80 [ 459.683994][ T5743] kfree+0x22b/0x6c0 [ 459.687873][ T5743] kref_put.isra.0+0x53/0x75 [ 459.692446][ T5743] em28xx_v4l2_init.cold+0x280/0x3a40 [ 459.697899][ T5743] em28xx_init_extension+0x13a/0x200 [ 459.703174][ T5743] request_module_async+0x61/0x80 [ 459.708186][ T5743] process_one_work+0xa23/0x1940 [ 459.713104][ T5743] worker_thread+0x5ef/0xe50 [ 459.717676][ T5743] kthread+0x370/0x450 [ 459.721746][ T5743] ret_from_fork+0x72b/0xd50 [ 459.726336][ T5743] ret_from_fork_asm+0x1a/0x30 [ 459.731078][ T5743] [ 459.733380][ T5743] The buggy address belongs to the object at ffff888053e80000 [ 459.733380][ T5743] which belongs to the cache kmalloc-8k of size 8192 [ 459.747408][ T5743] The buggy address is located 528 bytes inside of [ 459.747408][ T5743] freed 8192-byte region [ffff888053e80000, ffff888053e82000) [ 459.761292][ T5743] [ 459.763596][ T5743] The buggy address belongs to the physical page: [ 459.769983][ T5743] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x53e80 [ 459.778730][ T5743] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 459.787216][ T5743] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 459.794751][ T5743] page_type: f5(slab) [ 459.798728][ T5743] raw: 00fff00000000040 ffff88813fe03280 dead000000000100 dead000000000122 [ 459.807306][ T5743] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 459.815878][ T5743] head: 00fff00000000040 ffff88813fe03280 dead000000000100 dead000000000122 [ 459.824554][ T5743] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 459.833203][ T5743] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 459.841863][ T5743] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 459.850506][ T5743] page dumped because: kasan: bad access detected [ 459.857672][ T5743] page_owner tracks the page as allocated [ 459.863358][ T5743] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8640, tgid 8639 (syz.0.725), ts 298821114092, free_ts 298635532677 [ 459.884607][ T5743] post_alloc_hook+0xfd/0x120 [ 459.889273][ T5743] get_page_from_freelist+0xf48/0x3530 [ 459.894712][ T5743] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 459.900585][ T5743] new_slab+0xa2/0x650 [ 459.904633][ T5743] refill_objects+0xe3/0x410 [ 459.909202][ T5743] __pcs_replace_empty_main+0x376/0x680 [ 459.914750][ T5743] __kmalloc_noprof+0x66d/0x820 [ 459.919580][ T5743] cache_create_net+0xa2/0x1f0 [ 459.924325][ T5743] gss_svc_init_net+0x69/0x640 [ 459.929067][ T5743] ops_init+0x1e2/0x5f0 [ 459.933205][ T5743] setup_net+0x118/0x3a0 [ 459.937423][ T5743] copy_net_ns+0x46f/0x7c0 [ 459.941817][ T5743] create_new_namespaces+0x3ea/0xac0 [ 459.947086][ T5743] unshare_nsproxy_namespaces+0xf2/0x220 [ 459.952700][ T5743] ksys_unshare+0x438/0xab0 [ 459.957188][ T5743] __x64_sys_unshare+0x31/0x40 [ 459.961937][ T5743] page last free pid 5607 tgid 5607 stack trace: [ 459.968245][ T5743] __free_frozen_pages+0x79f/0x1090 [ 459.973429][ T5743] qlist_free_all+0x47/0xf0 [ 459.977915][ T5743] kasan_quarantine_reduce+0x1a0/0x1f0 [ 459.983354][ T5743] __kasan_slab_alloc+0x69/0x90 [ 459.988203][ T5743] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 459.993642][ T5743] do_getname+0x35/0x390 [ 459.997881][ T5743] user_path_at+0x26/0x60 [ 460.002189][ T5743] __x64_sys_umount+0x10a/0x1a0 [ 460.007020][ T5743] do_syscall_64+0x115/0x870 [ 460.011596][ T5743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.017480][ T5743] [ 460.019782][ T5743] Memory state around the buggy address: [ 460.025389][ T5743] ffff888053e80100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 460.033433][ T5743] ffff888053e80180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 460.041474][ T5743] >ffff888053e80200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 460.049509][ T5743] ^ [ 460.054074][ T5743] ffff888053e80280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 460.062127][ T5743] ffff888053e80300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 460.070180][ T5743] ================================================================== [ 460.135544][ T29] audit: type=1400 audit(1782641213.069:1014): avc: denied { read } for pid=4957 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 460.179546][ T5743] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 460.186790][ T5743] CPU: 0 UID: 0 PID: 5743 Comm: kworker/0:8 Tainted: G L syzkaller #0 PREEMPT(full) [ 460.197756][ T5743] Tainted: [L]=SOFTLOCKUP [ 460.202067][ T5743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 460.212109][ T5743] Workqueue: usb_hub_wq hub_event [ 460.217133][ T5743] Call Trace: [ 460.220391][ T5743] [ 460.223309][ T5743] dump_stack_lvl+0x100/0x190 [ 460.227970][ T5743] vpanic+0x552/0x970 [ 460.231946][ T5743] ? __pfx_vpanic+0x10/0x10 [ 460.236434][ T5743] ? media_device_unregister+0x59d/0x610 [ 460.242080][ T5743] panic+0xd1/0xe0 [ 460.245844][ T5743] ? __pfx_panic+0x10/0x10 [ 460.250264][ T5743] ? media_device_unregister+0x59d/0x610 [ 460.255913][ T5743] ? preempt_schedule_common+0x42/0xc0 [ 460.261576][ T5743] check_panic_on_warn.cold+0x19/0x34 [ 460.266967][ T5743] end_report.part.0+0x3a/0x90 [ 460.271756][ T5743] kasan_report.cold+0xe/0x18 [ 460.276453][ T5743] ? media_device_unregister+0x59d/0x610 [ 460.282111][ T5743] media_device_unregister+0x59d/0x610 [ 460.287596][ T5743] em28xx_unregister_media_device+0x4e/0xe0 [ 460.293509][ T5743] em28xx_release_resources+0x79/0x1b0 [ 460.298987][ T5743] em28xx_usb_disconnect.cold+0x17d/0x253 [ 460.304730][ T5743] usb_unbind_interface+0x1dd/0x9e0 [ 460.309949][ T5743] ? __pfx_usb_unbind_interface+0x10/0x10 [ 460.315687][ T5743] device_remove+0x12a/0x180 [ 460.320303][ T5743] device_release_driver_internal+0x44e/0x620 [ 460.326395][ T5743] bus_remove_device+0x2bc/0x560 [ 460.331345][ T5743] ? __pfx_bus_remove_device+0x10/0x10 [ 460.336839][ T5743] ? __pfx_device_remove_attrs+0x10/0x10 [ 460.342484][ T5743] device_del+0x376/0x9b0 [ 460.346827][ T5743] ? __pfx_device_del+0x10/0x10 [ 460.351697][ T5743] ? kobject_put+0xb9/0x640 [ 460.356211][ T5743] usb_disable_device+0x367/0x810 [ 460.361238][ T5743] usb_disconnect+0x2e2/0x9a0 [ 460.365907][ T5743] hub_event+0x1d0c/0x4af0 [ 460.370318][ T5743] ? __lock_acquire+0x49f/0x1a40 [ 460.375245][ T5743] ? do_raw_spin_unlock+0x145/0x1e0 [ 460.380434][ T5743] ? __pfx_hub_event+0x10/0x10 [ 460.385200][ T5743] ? debug_object_deactivate+0x2e4/0x3b0 [ 460.390836][ T5743] ? rcu_is_watching+0x12/0xc0 [ 460.395601][ T5743] process_one_work+0xa23/0x1940 [ 460.400533][ T5743] ? __pfx_process_one_work+0x10/0x10 [ 460.405898][ T5743] ? __pfx_hub_event+0x10/0x10 [ 460.410656][ T5743] worker_thread+0x5ef/0xe50 [ 460.415236][ T5743] ? __pfx_worker_thread+0x10/0x10 [ 460.420329][ T5743] ? kthread+0x13a/0x450 [ 460.424554][ T5743] ? __pfx_worker_thread+0x10/0x10 [ 460.429647][ T5743] kthread+0x370/0x450 [ 460.433699][ T5743] ? __pfx_kthread+0x10/0x10 [ 460.438282][ T5743] ret_from_fork+0x72b/0xd50 [ 460.442872][ T5743] ? __pfx_ret_from_fork+0x10/0x10 [ 460.447970][ T5743] ? __switch_to+0x800/0x10f0 [ 460.452630][ T5743] ? __pfx_kthread+0x10/0x10 [ 460.457202][ T5743] ret_from_fork_asm+0x1a/0x30 [ 460.461965][ T5743] [ 460.465196][ T5743] Kernel Offset: disabled [ 460.469497][ T5743] Rebooting in 86400 seconds..