last executing test programs: 1m53.779458427s ago: executing program 2 (id=113): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0x1a0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x2, 0x1, 0x1234}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) 1m53.699471746s ago: executing program 2 (id=114): set_mempolicy(0x3, 0x0, 0x40) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r0 = syz_open_dev$evdev(&(0x7f00000002c0), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000300)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x5509, 0x0) r1 = socket(0x5, 0x2, 0xfffffffe) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000100)={0xfffffffc, 0x0, 0x0, 0x4}, 0x10) sendmsg$kcm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="2e00000022008102e00f80ecdb4cb9020a", 0x4a}, {&(0x7f0000000280)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_dev$swradio(0x0, 0x0, 0x2) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x8, 0x3000000000002}, 0x6b7e369c4a37b0ea) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r3, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r6 = accept(r2, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r5, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) 1m50.7090116s ago: executing program 0 (id=131): r0 = socket$nl_generic(0x10, 0x3, 0x10) write(r0, &(0x7f0000000100)="540000002700010002000000000000000601000040000180080002007463700014000100020008010000000000df000000000000200001800800020074637000140001000200080200"/84, 0x54) 1m50.708825961s ago: executing program 0 (id=132): socket$nl_generic(0x10, 0x3, 0x10) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$ndb(&(0x7f0000000200), 0x0, 0x8942) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_usb_connect(0x0, 0x2e, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x644, 0x8047, 0x100, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1c, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x100, 0xa}}]}}]}}]}}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_PMKSA(r3, 0x0, 0x40080) sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, 0x0, 0x24008801) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_usb_control_io$hid(r1, 0x0, 0x0) ioctl(r2, 0xc4c85513, &(0x7f0000000200)) 1m50.47074594s ago: executing program 2 (id=134): r0 = syz_open_dev$MSR(&(0x7f00000003c0), 0x2, 0x0) pread64(r0, &(0x7f00000013c0)=""/136, 0x88, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000080)=0x6, 0x4) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000180)=0x4000000000000200, 0xe50fb6c50bc849c9) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000040), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r6, 0xc0045005, &(0x7f00000000c0)=0x2000) ppoll(&(0x7f0000000100)=[{r6, 0x480}], 0x1, 0x0, 0x0, 0x0) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0xd, 0x11, r6, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000000)={@private0, 0x40, 0x1}) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000540)={0x0, 0x4, 0x0, [0x80000001, 0xff, 0x8, 0x5, 0x3], [0x6, 0xe283, 0x100000001, 0x6, 0x40, 0x9, 0x6, 0x7fff, 0x7ff0000000000, 0x4, 0x6, 0x4eb, 0x7, 0x12f5, 0x0, 0x80000001, 0x192, 0x100000000, 0x44, 0x8, 0x9, 0x400000000000004, 0xff, 0xfffffffffffffffd, 0x4, 0x7, 0x7fffffff, 0xb, 0x0, 0x3, 0x8, 0x8b42, 0x7f, 0x0, 0x5, 0x8, 0x7, 0x8, 0x380, 0x10001, 0xcb, 0xfffffffffffffffc, 0x8, 0x1, 0x7, 0x7, 0x22b9c881, 0x60b, 0x3, 0x1000000000, 0x1bd4, 0x1, 0x7, 0xffff, 0x100000001, 0x0, 0xd93, 0x0, 0xfffffffffffffe00, 0x10000000000, 0x8, 0xb, 0x8, 0x8, 0x5, 0x4, 0x0, 0x7ff, 0x9549, 0x8, 0x5, 0xffffffffffff8000, 0xffffffff, 0x1, 0x8000, 0x80000000, 0x4, 0x1, 0x5, 0x9, 0x1, 0x0, 0xf110, 0x9, 0x100000001, 0x1b, 0x80, 0x4, 0x10000, 0x6, 0x9, 0x84, 0x7dad, 0x2, 0x8, 0x1, 0x4, 0x23b, 0x800, 0x9, 0xac4b, 0x3, 0x0, 0xf3, 0x2, 0xfffffffffffffbe1, 0xfffffffffffffffb, 0xa, 0x9, 0xe23, 0x0, 0x3ff, 0x81be774, 0xd, 0xffffffffffffffff, 0x7, 0x0, 0x6, 0x4, 0xfffffffffffffff4, 0x4]}) ioctl$BTRFS_IOC_DEV_REPLACE(r1, 0xca289435, &(0x7f0000000980)={0x1, 0x7f, @start={r7, 0x1, "8e7693b98366257cdbf0a951d903c1c3d5fbea187daf8ddb1ce321e1c9eddd4bed901bd933cdf4137a652935e1ac08983f7688b32ccfb111d4ce2fa47f7a46301bd9a66cfe5ee878576849503bb8518ca509435c3e8e815dbbf8d9e9ebd4a8d3cde9fda46aa86a46edf9e9a2d6436ee5596b2e6096acdadbbcc3a102881119443be1bfc40f6d99c462dc398bf0c7d4df2c4b4592d60e86fcfc315c83e1192da3fb6bc79d82fb00120f40ab8bc3cfdd3ab79bdd13b7235add0759ca1ce30f3330f22c2624c7a11427044f3ed9c01b930d97d9c9b0c91bdabc0b462fb0c143243a9572773cfb54026b4bfcdc24a66aecb3a68d6854df0f7c70fb8462b3e37ca56cfe1e7f80db34eb375bdf3b81e3df8a8bb2b3c953f3f82f823b58387edea7eb6c773ee9b85ccaa7783e1facb8b80f2309cfef4ed89271bad7f63e9ef1b4261a6c2c2b84596adb6034b51b487604d7d8318caf53a9fb975164d3592d68fbed63020e2a0ad6c783778e9e4197c6481fad6719fe491b8c3fca12988360c73caf34ff8733d49d12e965490720fb0b56bbc0d79278dc40f053282ceb3b73cf1a35843082bd019449b18aac77b1150c70a436288e3d3ba627eaa36ed173c8fb7ec07df1ae038e5911a8333ccb5bac9e8466072a910159433c6bd0c528f09cec644eaebd64e3b50e02d1a7b6d153601f28b2040cddb2ce6a665ddb7f94c95c9b17ab42f2522bf67cdea4f34a745025f2d6b516c82f4b396579c6de911de001db9462ee668ade5f84cdbf3e126c737005412383483ea72ac77bb95d8e52e8568953387c8021ca71bd44af293281fc927094a137c3bf35d0208b843f4423048da1251d5a66a71f69d71020132d557caa066cbdb039fdf8438785545e9471bf2360b4266a9af735d87ce981534477c2b84273454873760fe7006dc3fa391837c47a859debdcb138e4da9fd9cb7f95348caf886bc12a39c61a4022ca0e45a4519a01e0197803128be1a54e92309068ba169e3feda6d65ddd642405eb83ef006d5e35b09dab420b51c669b1d53033a2627c8cb4382ddb09aa768c1d89cda3e82ed742395556ff77a54f5066676feac03f541f6af5e5f98d2f3fad9f3882faa43f6c080209e609f4567000068deee3e15bb9c2f7286f8540538f29a0a87c4a599b233249665e19bab5e3251b7d25a98a2f0cfcf440ec230e8a1e50cdc02024b7e4af75ec3a0d36e13eb6ac5576bb9b235e867181b0a80c1970735ccf3fa34e868dfa89ad57292877e7b1a0512dcd9cb31e77db6fd82f398a460e6aeea3594a8215b36d688eb1749ffa6951dbcdf8b05560adc9515ece788b04e2df71f13e9fd8c29d889ceb6dcf55439ce1c49a59ad873c18e3208d8092025ba66ee518a4c913c882524e73ed2d0a317a760e6a348a0ffb79b4f070753dbae891b7bdd9021b6e163197c13969b098", "3ea7354555fe3a48e7707ee43db24b763a09d6405e883ad3e0e8e793fd1c895055d2754e5650ddf16f0933770b4e99ac6bd75316d47d481e10a6e5d369f66291fa485f4d9dbabb4be54d723bcb89204a82f7fdb972e7cb24a736323f4e0506fcf4c00b9475dcd7862b03023d821aa42f733408d97b253a1ad36f1632eb79f5411c0e510fc2f6933bac31a068cfa1ae2c59afbc20840aa8cb13eb595104fb04531a17d6da461586480ea05170aa701bf4d61b121bb5e302d3e7acc47598f4dcf200851e931b83c909454d256bc899cb2236222fca6caa9ccd098b2878c8dad88ff0385d1b8bcc0af59896e7633df132e73a09a44cc1d475ff51db4c27769fc230908959984ffac5ba028363a276b24b618a4dedda97f0ff1b615f73906f1e589a086b993efb742779c087be447061418e3cd9c276bbb5868d8f1a4b3fc9d1b84b829b0af679500afd563d81ef7ee0827f1ac8ec477c75fcf5a03b4de9e01ada86b1f2e2bdf8c70635198d30c06f8db2a63577bbafd3e2e5d98f110cf794f21baabc6117e93435e7324242f556867aa396ea9858ababe529dca10a4b5b1eb3c7caaa7f58474f91069c0b000e67db224bd1133a3c8dbff68b73821cd733ae601c706b91b6367a3b54848390b8dee60c51ab31a3d3a521160d77606f759c5279391d5003bfe2e9e4850ba539c5b2bed645c7334983e0313f397383490b865da7430db532bafaad6f9ec75d2053d72b587e3421cf28325bec8361a57053b9e613940ffce3fa7416b0d320a9e1f276eb168d3db2ac35ac077dc775edaeb5c876ebd74ff97164d171356a77fe055805275a88752584b7790cabe7cb36bfed1afabca0c026500e4145b7bde3651f1f8a9c2c91149088334046339be71d01202ddcf8de0879abc51200b1d454e2c38918462e9f87810f77eb667d53f8d828165f4ce80c9ede49e6f66567300e2a144616e43ffd4ac1a738cb2e1bb5aed33d405d6ce21f40921fcfb26a977cb676855a594e528f8fa4746b325bb55628f499c2a457dc4d6dba83b2959cb551b9a900d7443e01a693cd0c2443ec91af99f7fe8ac9aec3295fde0a24c9f5b8874814d5b9b5f6789c1928c74d6fddb04285732296eccc084b7fb9406243b624f6c8aecadc1b52b136cb322bae661fb27dddacd159bb51c4a67d7610c8c07911735f0cd411f2baa8d311599dbe26a5e634bc534a2ccea5ea8b19ff7e1c0674d165ea4f9a6264cd461e2b0d132aa63145d31e43d9af8fa8f4c69a8029c62eb56ead5c6edc45918e1e871ae23b2181c8873e636f2e0352e9fe7921228c05f13b707aaa355917943fcf682766ca91636b615cd14977fd2731bec5af3ca46530933550cf3b04feafea1f8854b84ecea3944f700cc8837dee4c69fd4cf0bc5da06743e7996be9f0491ffa733806122e5e7bc591f3c4f45bf6f806cc5012"}, [0x0, 0x8, 0x8, 0xf, 0xda, 0x5, 0x8, 0x7f, 0x4, 0x100000000, 0x3, 0x9, 0x6, 0x1, 0x1, 0x0, 0x0, 0x0, 0x9, 0x200, 0x7, 0x8, 0x6d, 0x2, 0x721, 0x1, 0xfffffffffffffff8, 0x5, 0x2, 0xd15, 0x5, 0x3, 0x7, 0x200, 0x8, 0xfff0000000000000, 0x1, 0x5, 0x0, 0x7fffffffffffffff, 0x1, 0x3, 0x9, 0x8, 0xffffffffffffffff, 0xa8ce, 0x0, 0x1, 0x2, 0x5, 0x60000000, 0xe6, 0x16b00000, 0x5, 0x9, 0x9, 0x4, 0xfff, 0xa143, 0x8, 0x81, 0x9, 0x1, 0x34a1]}) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x24}}, 0x0) r8 = syz_io_uring_setup(0x29d7, &(0x7f0000001480)={0x0, 0x8550, 0xc00, 0x1, 0xf}, &(0x7f0000001500), &(0x7f0000001540)=0x0, &(0x7f0000001580)=0x0) r11 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) syz_io_uring_setup(0xf03, &(0x7f0000001600)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000001680)=0x0, &(0x7f00000016c0), &(0x7f0000001700)) syz_io_uring_submit(r12, r9, r10, &(0x7f0000001740)=@IORING_OP_FGETXATTR={0x2b, 0x2, 0x0, r11, 0x0, &(0x7f00000017c0)='@u', 0x0, 0x0, 0x1}) io_uring_enter(r8, 0x1, 0x1, 0x61, 0x0, 0x0) getsockname$packet(r4, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r13, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) bind$packet(r2, &(0x7f0000000380)={0x11, 0x0, r13, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r2, &(0x7f0000000400)="410309fc1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 1m49.550006845s ago: executing program 2 (id=139): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./nfsd\x00', &(0x7f0000000200)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd/v4_end_grace\x00', 0x2, 0x0) write(r0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e) syz_clone(0x4000, &(0x7f0000000000)="eeec9659354cc8c5589e09a2e20e9d9632300013ec7900a3a2b70ab04491fb5d91525f33136f4b94c6dbaffff72d7a71201eb127fefb87a9d66b516bafd629a5", 0x40, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="8b0ca0736d89b2dc0fe39bd296f726f2b7fb4d48d24540403e8f208e2b27605f6a0c42b718d7b7c84e201e67329465d4e2e8c9d9ef6886877cb0e4a074656cef859f7d02c7547d8a262f45608f2eeb54d566868237aa2221be968af6d92488ff0508cdeef90c4253b2a5c6ec23cb56a6d8ebae240f06c1909f2ffb3ae47c74c1ecc0fdee918d51e51d") userfaultfd(0x801) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000840)='./proc\x00', &(0x7f0000000880)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='100', 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000940)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000980)='./dev\x00', &(0x7f00000009c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./pipe\x00', 0x1ff) mount(0x0, &(0x7f0000000a40)='./pipe\x00', &(0x7f0000000a80)='rpc_pipefs\x00', 0x0, 0x0) 1m48.868358262s ago: executing program 0 (id=142): r0 = socket$kcm(0xa, 0x2, 0x0) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000140)={0x84, @rand_addr=0x64010105, 0x4e22, 0x3, 'fo\x00', 0x30, 0x80001, 0x6e}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa012102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x9, 0x77}, {@remote, 0x4e20, 0x2000, 0xcd, 0x4}}, 0x44) sendmsg$sock(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x4400000000000000) 1m48.818940432s ago: executing program 0 (id=143): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f00000002c0)='./file0\x00') open(&(0x7f0000000040)='.\x00', 0x8000, 0x112) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000580), 0xc8902, 0x0) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000005c0), 0x1b1d42, 0x0) ioctl$CDROMCLOSETRAY(r0, 0x5319) syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, 0x0, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$pokeuser(0x6, r2, 0x388, 0x7ffffffffc) ptrace$pokeuser(0x6, r2, 0x388, 0xffefffffff7f0504) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) getsockopt$inet_buf(r1, 0x0, 0x30, &(0x7f0000000880)=""/4091, 0x0) mkdir(&(0x7f0000001880)='./sys\x00', 0x1bf) mount(0x0, 0x0, &(0x7f00000018c0)='sysfs\x00', 0x8244a2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001900)='./file0\x00', 0x40) mount$9p_virtio(&(0x7f0000001940), &(0x7f0000001980)='./file0\x00', &(0x7f00000019c0), 0x2210088, &(0x7f0000001a00)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) chdir(&(0x7f0000001a80)='./file0\x00') r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001ac0)='blkio.bfq.time\x00', 0x275a, 0x0) mmap(&(0x7f0000784000/0x3000)=nil, 0x3000, 0x2, 0x8010, r3, 0x0) ftruncate(r3, 0x4a8e) write$cgroup_pressure(r3, &(0x7f0000001b00)={'full', 0x20, 0x1, 0x20, 0x6}, 0x2f) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001b40)) 1m48.81867386s ago: executing program 2 (id=144): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xa7e0fc2f8ceabbae}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={{0x14, 0x10, 0x1, 0x0, 0x3000000}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x14}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) 1m48.719353695s ago: executing program 0 (id=145): mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, 0xffffffffffffffff, 0x4000) socket(0x10, 0x803, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000240), 0x1, 0x2) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000280)=0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000e40000000000000000000200000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a010400000000000000000200000a0900010073797a30000000000900030073797a3000000000140004800800014000000003080002400000000048000000060a01040000000000000000020000030900010073797a30000000000900020073797a30000000001c00048018000180080001006c6f67000c00028008000540000000f2"], 0xd0}}, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f00000002c0)={0x0, @bt={0x12, 0x7c5, 0x1, 0x3, 0xd59f80, 0x4, 0x5, 0x7, 0x8, 0x5, 0x722, 0x0, 0x7, 0x8, 0x2e, 0x2d, {0xffff945a, 0x1}, 0x3, 0xed}}) r2 = socket(0xa, 0x3, 0x87) r3 = socket(0xa, 0x3, 0x87) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="6000000054000500010000000000000007000000", @ANYRES32=r5, @ANYBLOB="20000100", @ANYRES32=r6, @ANYBLOB="01000000ef01010100000000000000000ffe0000080000002800028005000300010000001c0002800c000180080001000a0000010c000180080001"], 0x60}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000540)={'veth1_macvtap\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000040)={@local, 0x40, r7}) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@ipv4_getroute={0x6, 0x1a, 0x100, 0x70bd28, 0x25dfdbfb, {0x2, 0x0, 0x20, 0x54, 0xfc, 0x2, 0x0, 0x1}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c040}, 0x4008000) 1m48.377624822s ago: executing program 0 (id=148): r0 = syz_open_dev$vim2m(&(0x7f00000003c0), 0x6, 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000000, 0x10012, r0, 0x2000000) 1m48.313161512s ago: executing program 32 (id=148): r0 = syz_open_dev$vim2m(&(0x7f00000003c0), 0x6, 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000000, 0x10012, r0, 0x2000000) 1m48.258757364s ago: executing program 2 (id=149): bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x4e20, @multicast1}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4800}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a840000000c0a010100002100000000000a0000060900020073797a31000000000900010073797a310000000058000380540000800c00018006000100d103000044000b802c000180090001006c61737400"], 0xac}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x1001}) (async) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', 0x1}) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) (async) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000880)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@TCA_RATE={0x6, 0x5, {0xf, 0x6}}, @TCA_INGRESS_BLOCK={0x8}]}, 0x34}}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newtfilter={0x7c, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x1}, {0x0, 0x86a6bfbcf6e2b158}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x48, 0x2, [@TCA_MATCHALL_ACT={0x44, 0x2, [@m_skbedit={0x40, 0x1, 0x0, 0x0, {{0xc}, {0x14, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x4}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x7}]}, {0x4, 0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x810}, 0x0) (async) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000004c0)='syzkaller0\x00', 0xb) (async, rerun: 64) sendto$inet(r5, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x2, 0x4e20, @loopback}, 0x10) (rerun: 64) mount$tmpfs(0x0, &(0x7f0000000100)='./cgroup\x00', &(0x7f0000000140), 0xc00, &(0x7f0000000180)=ANY=[@ANYBLOB='mpol=prefer']) (async) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f0000000900)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x8, 0x0, 0x0) (async) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF_FLAGS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000940)={0x2, 0xffffffffffffffff, 0x80000}, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f00000009c0)={[0x33, 0x790, 0x80000001, 0x17d, 0x400000004, 0x200, 0xf1, 0x8, 0x0, 0x42, 0x0, 0x3b9, 0xffff, 0x0, 0x0, 0x8], 0x8000000, 0x3c4210}) ioctl$KVM_RUN(r9, 0xae80, 0x0) (async, rerun: 32) r10 = accept4(r6, 0x0, 0x0, 0x800) (rerun: 32) socket$alg(0x26, 0x5, 0x0) (async) bind$pptp(r10, 0x0, 0x0) 1m48.258328197s ago: executing program 33 (id=149): bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x4e20, @multicast1}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4800}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a840000000c0a010100002100000000000a0000060900020073797a31000000000900010073797a310000000058000380540000800c00018006000100d103000044000b802c000180090001006c61737400"], 0xac}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x1001}) (async) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', 0x1}) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) (async) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000880)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@TCA_RATE={0x6, 0x5, {0xf, 0x6}}, @TCA_INGRESS_BLOCK={0x8}]}, 0x34}}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newtfilter={0x7c, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x1}, {0x0, 0x86a6bfbcf6e2b158}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x48, 0x2, [@TCA_MATCHALL_ACT={0x44, 0x2, [@m_skbedit={0x40, 0x1, 0x0, 0x0, {{0xc}, {0x14, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x4}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x7}]}, {0x4, 0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x810}, 0x0) (async) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000004c0)='syzkaller0\x00', 0xb) (async, rerun: 64) sendto$inet(r5, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x2, 0x4e20, @loopback}, 0x10) (rerun: 64) mount$tmpfs(0x0, &(0x7f0000000100)='./cgroup\x00', &(0x7f0000000140), 0xc00, &(0x7f0000000180)=ANY=[@ANYBLOB='mpol=prefer']) (async) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f0000000900)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x8, 0x0, 0x0) (async) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF_FLAGS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000940)={0x2, 0xffffffffffffffff, 0x80000}, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f00000009c0)={[0x33, 0x790, 0x80000001, 0x17d, 0x400000004, 0x200, 0xf1, 0x8, 0x0, 0x42, 0x0, 0x3b9, 0xffff, 0x0, 0x0, 0x8], 0x8000000, 0x3c4210}) ioctl$KVM_RUN(r9, 0xae80, 0x0) (async, rerun: 32) r10 = accept4(r6, 0x0, 0x0, 0x800) (rerun: 32) socket$alg(0x26, 0x5, 0x0) (async) bind$pptp(r10, 0x0, 0x0) 45.38952071s ago: executing program 3 (id=894): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000500)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x10001, 0x3ff, 0x0, 0x100, 0x6b8, 0x0, 0x6, 0x6, 0xffffff4b}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4004084}, 0x480c4) r3 = socket(0x10, 0x803, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000640)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newtfilter={0x54, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x3}, {}, {0x4, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x28, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0xc, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0xebd, 0x1, 0x206, 0x7}]}}]}}]}, 0x54}}, 0x24040084) sendmsg$nl_route_sched(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=@newtfilter={0x54, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x4}, {}, {0x4, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x28, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0xc, 0x6, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0xebd, 0x4, 0x206, 0x4}]}}]}}]}, 0x54}}, 0x24040084) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = syz_open_dev$video(&(0x7f0000000180), 0x7ff, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r8, 0xc034564b, &(0x7f00000004c0)={0x1000000, 0x35315258, 0x780, 0x439, 0x0, @discrete={0x2}}) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x69e, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xfcff}, {}, {0xe, 0x10}}, [@TCA_RATE={0x4}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) r9 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000140), 0x80a41, 0x0) ioctl$CDROMEJECT_SW(r9, 0x530f, 0x1) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000000)={'macvtap0\x00', &(0x7f00000001c0)=@ethtool_per_queue_op={0x4b, 0xf, [0xe, 0x7, 0x8, 0x1, 0xfffffffc, 0x3f8000, 0x3ff, 0x1, 0x2, 0x7, 0x10, 0xff, 0x0, 0x0, 0x6, 0x7, 0x8, 0x10001, 0x9, 0x10001, 0x7fff, 0x9, 0x9, 0x9, 0x3, 0x9, 0x5, 0x2, 0xf, 0x9, 0x800, 0x400, 0x25, 0x7fff, 0xb231, 0xa9a, 0xc3, 0x0, 0xce, 0x4, 0x6, 0x7, 0xdd57, 0x7, 0x4, 0x6, 0x4, 0x8, 0x2, 0xfffffeff, 0x18c3, 0x4a9f, 0x6, 0xffffffff, 0x4, 0x8, 0x10, 0xc, 0x7, 0x8b84, 0x976, 0xc, 0x4f, 0x5, 0x3, 0x4, 0xfffffff7, 0x3, 0xf, 0x4, 0x7fffffff, 0x8, 0xd0c, 0x4, 0x5, 0x7f, 0x9cc, 0x7248, 0x7, 0x0, 0x9, 0x85, 0xfffffff8, 0xe, 0x8000, 0x101, 0x5, 0x1, 0x3, 0x8dc, 0x5, 0x4, 0x19, 0xa, 0x2, 0x3ff, 0x5, 0xffffffff, 0x5, 0x8, 0x8, 0x5, 0x5, 0xffffffff, 0x3, 0x9, 0x3, 0x8, 0x2d0, 0x8, 0x401, 0x2, 0x0, 0x7, 0x4, 0x0, 0xa, 0x5, 0x2, 0xd, 0x4, 0x5, 0x5, 0xa000000, 0x9, 0x2, 0x21, 0x1ff], "5342fbca68af9fccbce5fb3a14b67c825f7ddaba16b854cbeb3781c580d755f66f7edb252193715cbd8bfa4c999701bd7cf75a8b26edd3e7ba72d6b43e18529cb2057854fc58fd333cf94dadfe4412b1764b58292ae53ece80f8c915fcbb442ad1bc53e45153698cd0aed25960aa44546e1ee2d572e0a0716cc4a3e1c760d9ac78cf84bd2f5bfa8af0acb1f176627cca4cb3d1cd2dc573262206b3f2eac20a746add97283dded1442f8dcd07e34650c2f5889d2ec9edb3520b5c267d326f"}}) 45.130509898s ago: executing program 3 (id=898): socket$nl_generic(0x10, 0x3, 0x10) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$ndb(&(0x7f0000000200), 0x0, 0x8942) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_usb_connect(0x0, 0x2e, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x644, 0x8047, 0x100, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1c, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x100, 0xa}}]}}]}}]}}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_PMKSA(r3, 0x0, 0x40080) sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, 0x0, 0x24008801) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_usb_control_io$hid(r1, 0x0, 0x0) ioctl(r2, 0xc4c85513, &(0x7f0000000200)) (fail_nth: 1) 39.020238778s ago: executing program 3 (id=943): mkdirat(0xffffffffffffff9c, &(0x7f0000002740)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000002780)='./trace\x00', &(0x7f00000027c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002800)='./trace/trace_marker\x00', 0x1, 0x102) ioctl$OCFS2_IOC_UNRESVSP(r0, 0x40305829, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffff7, 0x3, 0x6b3e, 0x6}) write(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002740)='./trace\x00', 0x1ff) (async) mount(0x0, &(0x7f0000002780)='./trace\x00', &(0x7f00000027c0)='tracefs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000002800)='./trace/trace_marker\x00', 0x1, 0x102) (async) ioctl$OCFS2_IOC_UNRESVSP(r0, 0x40305829, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffff7, 0x3, 0x6b3e, 0x6}) (async) write(r0, 0x0, 0x0) (async) 38.900579978s ago: executing program 3 (id=944): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) 38.810469715s ago: executing program 3 (id=945): mkdirat(0xffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) getpriority(0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='27', 0x2) ioctl$UBLK_U_CMD_STOP_DEV(r0, 0xc0207507, &(0x7f0000000440)={0x0}) r2 = add_key$user(&(0x7f0000000340), &(0x7f0000000600)={'syz', 0x0}, &(0x7f0000000640)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000001740)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r4, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r4, 0x5b) read$watch_queue(r3, &(0x7f0000001780)=""/1, 0x1) keyctl$revoke(0x3, r2) r5 = syz_clone(0x10000, &(0x7f00000004c0)="b56423564056c2ac23bcb5f707c2031ac15f25049bea3f871776e91c91c45f63d3f30512d5fa93165051807c0bf4a253cf40c3178f87557ef81d62fa97fa0d51daa4a10534a035157beb649d41973e320955bc77f735b51d2fb98ab9e2439a381de9840994f5d649e109d734028b9511958b91c958ccae199134556667cfe55ab63f7c8ec389b3eb0e2cd360054a1185984d1086b92a663740598e2aeb88c4ff99a6", 0xa2, &(0x7f0000000580), &(0x7f00000005c0), &(0x7f00000006c0)="3b49d39940bf03340e092dddcb8a4d7596a4e62f39c1f5e793da65d434ab7f22c18361f2d79e2832214138cc40387cfdd0a26ca685832e9cce7a90d1bf2fbb5f70aca1dd09b24d55d102d8beef8103a37e1d411826d3214830a72f58a3e9e60b368c5286a5e0dbc60610f15f3b89b9abc297a7f95d15eafaf341922fb1ff823292c5cd1e6c92f64353f018620adb0bf54d6a849fa700331e881f810839e359492721684381f6d4bc5757a536871060f71837ad5bc51571cad78027a5acb0c1313df9208fb2e484301c6ae67b84bab2d42060ad8ed65f0b215cd88638b090511a8b4478d72ffab1368ba8363d0a3fe0c25a4b0f353cffa7997fb77adec857a0285413e90d63ba062525118109ed9d945f459a49e1a889d47951225c0dcefa95ee041109de0c5856d1e5cd08f0c4fe3262b4ccdc2585b8115bc0282bd6a1308b235e8279d487feb823bc52cdc79b1363400f715c9eed36452ca0aaae7a90648afa673ba90312372bac8c164c791adfdc57ae34750a44e55ad46cb4738534569afd0c0738aa365ac4c268a4c2e957582ad7cfd26d743812819d794ad934aa76934def52ab3f146d1e727fe65b29343a41618a0d46c87b956884c839fa5a9aaa67a14edbe3d0177b0d798dda9ae804d1b45d1c7c8037069b0115f47bceb96e89cd88cfb376fde056dc1715ff2c557974a7e0a1e0c370f591f5483098f911e1ab4515638f608a21a19de830bee9833384cf985e093019c7ed73e968bf499ff271a729541ce32aeb7fbed704e733f1985fc3edbab22a9b1361bebda0ca28be2f408cf6ec67b8eb51591917a5d2adc424b1b7454ec4bab92e1529a3ac8051676e7e319f8ae20a9d5ef16a5335ce887a05ded9209e4d6ae2c5071fbf87f1ea80259a029ddb10274da86d187c15a481b3bdb1536b9f78aebe2d65f7933df875811913b89b8470af76268568529f5208c9b6ae19116b316bd11235b64e1aaf3eff131a4678eedd93eba8565b6e94ba9936e354562a39f6d541e5027600ba1f094ce886044723ea9aeccafddf54060dded894797f1bf254531efe1374653696086539d2bdcf020a244567c94e4da0d5ce802242a35e4c10eb26a0926b746858639533f5b60c917f99e3fe4b1e8f544e3acd5aa545c78a02abba8af7a01aaf8b20e481ea7a4f3232895a95c4984966d70832fd1003e741fb9df4eaf8f299ce20b0751bc4da0b5838d21d73353b4eb52d8a3e0403de7739d3c4b226336abc7591dc57749accdd32a72c773a1bd9058d8fe2af7f58fcb66ab735ad05bac8d9a4417b23e348d5b1ee184d35bce588b3e50ac010947c53c80ce10f9dac6cb209fd4dcd982d40a8804c15357d093ee24265662858dff072f4ad63e7d8d1032ac823073fce8c7e51623271a00b9caac4dea47c0961a5135ed319905ed3ff4b9a599fdf41884f27c76f6e9e93678c1d86f44b92c03da07b3448dc48d29fdacf4d16879a30692a89e3f23930e002a1ad0bf84f03406867e752d38911b6a07fff61120b2208a856272d157b01008c11660eb51adce19a5829ca1b30f6a27eeb8a0cc8e25fe9e9dd42256677a186be9688e02358b8a3e4faea5c39158952990be61ea30efecd7dafac2d33941dfeaf32e50b6fa3a98375b7388886905d423fd9f9d97ad0b54d11ef0c4ee81e22a386061fd26eab5105a0d49b8d2376a8d27b4be689353437722e8fc61bdeab177e6e8e17bfe8d786c7d276076146ceb7f7fa8529fd69344fe74ef2e28d4d05d4b08f45e97f406da4bafc7fe0eaf0dae02fcd71933d02d61afe22745eaee344c9068559679d39aca7a8f736683932a0d970a69c436ca0a48992d458e7f322256f337bf6363de1d020d114bd81b41ce80f72c60417aec618594f29ef6c2f75be23fd819d5e546720e9fa9c22d6422069ce1ffea085cc444c22411b6c16f8cd26543b0a4839d7ac9eb1df0b2b81a0727762c7275101fc487bbc4dd7d9b1f6eeb8af6d50e5297672f249cc2722f574b7353fd789a6d2ffbbfbc38e045f3187bbb919b7d80471433f51d8e74b22f3f38fe4bb178e7ef9b8a08e5cc72165afa7e65c49c645b086343e63be7677316d3e54b16fcaa5a1f9d3357ab3dd3c6c43e593edfa2e32165e2e8af916fe66a6ef98f8053a82b64a0ec22482e8c79e445492d8092815ecb2f946220c962a929fc826bbc45366b3f10b709a877940d638dee98647d65779e47f85d106cde272c4cadba0860c48047e21fe61e90fee5e930ee3e68d881a0e70c9f6534321baf53d4e4048061cf7fccc38b8f34761714ac4ea45b1befd36ac1c267a17d70c5fe296a15ed515f8f416d996505e47ce1a0a950f73daa3586569d45dfa4b4bbc24b5bf2c847fff6f4fec50463c8195faf2224f4f0befb836cce8efb5881a97dd5de62d2a4cb8b25c98a2631039269f3ac2c58e475a6a316a7aad165f1d10583240c10bc2e8bc70aee2d12ccf2a433d303b26235fa1d272b01ffc8aac6876dffd289475f5ca75f0303a082cf0d8fe404728ee72f5d7b71aa8c189d51c7d6e7688889c39d2780881dca361d23c2f7b5a7ec5b959baa6d2d243c1f4cab1f348204f4bb6de9925b83d3fd1dca3e2e9ba20ed1bd5545118e175379c8deefe626b05a30c6e3e7dffbec6bd558ba1aecbcc6d41432f53ec3184110ca250646971649bf059a8b2fd1ce68a2ea3d2ef88c61ea169e0b8c989c483454874ea4c1777217f19e3d88b492b5bea151e6a80832312a49be61321eea142a3fcf0ec4ba5ae5c6a909714f9926f74bed8346c6ebbfad43cd9f8cafd26f7730ced66e1dc3bbdd7d77e46ed462fbad1cdf891ccaf12a899cda6091a7202b0a06bddffc7faa2421c8c09585d1b9716d7124939c6cf8a68643a6d0287c5fdb0838fa7093e796f302ad727924ae16684bc73313740828ebd0bca3da9ee4be0b8d451482154e7077b923ad0f6f727970f58419ce863ed9ee76efbfe8bb8fac32c12b36c72e83ad16de2d01f54c2c5ed491d1bf7ede69bb023e454cd4251c3d05609e6dca90885e8d0d86398d4e3f87aa7f6d778c0945bd504f9dddbc691879c8364bde1a888527559ccec84dca483a5294a8f8d4cf30c4b7861316e7776e66e2fb9e405248f3377d767345f9123616137a85f9af9bc240399f5bddcda5bff3f432d71f4845192e9d3d1e19cbb8e6b5bfc0c6b000440772d9a05a6f189dbfdba0a5e2932616629a95ef455f15bc946f782af0fbac9500e3624d7177e2ca8ad2787ce0dde31287b57a4ff4198542fb212b562df274a6c4fb395cf6599ed21923bd1b526eddf4d9fa09f163e0afeb5b0349d298234194e23114ab8c376f61956c86a8108619973105615c66b249200adc4391c43ed749ed813d0ad29f90ec6b79da464c6dd80c303181f996cdd697b233cd9d8e58a3d7c45b5632a5728522d9d9e4c7a39996d8a454f1d25482992a52bac54c1a48ebe4b6b3b2f7ab9075a30f69b869e822c1b3bf16eb67e043dddb6f4e62df5773991c53dff4344a8788ee50f92e649b401eb5d25966734e517858d591b25ce5c15c773d95808743bc25485172fde4154dfeb5058ef4e191e8ac914252916f473489de2ea4dbc028f3c047db7e73a26abffa714f5bc928e67af93253b1c9b45a6424aa0e4752ce1d839635156a985c150460827a70c8b6d4eab8733504d0d9eaeb8ba8e6047396cbc482471b760d4080682fc13f0662ed6c11bd412b06c9f7dcb412768fe78ba4f346dac58fd5e47c8c44d2cee0e093da7d5bc43ef2d3c591796fe1d0252c024e9d615cbb55cdc102b2007de2483c0479efa4d2079c5adf78e1722fc5a292cbd1923d3e18c6858bf072d1676f91dd81dff990ec91f1d40b9a2956f13b7eb14520b4b468ea0874af013d1214217ae0ed7a6dc7c5b8660b789bec1749646322a8f4510aca90c29dc80e2b0049e19e83224f4f91766d82a417a6ecfa1d3f79cd0507f889600b08354e2faf998d8d059c1b4f062215f66dfef8f9ac1a5bbcc188fb2506b420a92647e4a0d392b93dd89b8470e7e94c7cfad52b5f1c2558680544212315fd78784ee5aab37d1101fe438be3b8f5e18116a693a0fe4c3cfd20b4a143d4555edc48139373bad5cfd6aa3c0a377fbe8889d5e6ab2c127f00eb97ba1a4d8a240c2ddd62bfef28005754cbda3f2d663f4d5ca7be9f905936039550136ce780a14f1667642302ffff0b0960db13ef3293db6d48f50a17503f5a2b44e0ced8547f9a7d581bcc2a47f7f163316cf0baebee8b5c2b2dd6022d59d0f9d88cc12392ecf2faaf925ad31c2572effdb96504fd76ea251d5b97e9d24716e4f095418acdefb53475d73b1e0fc9beadcc466524f55bd654cf597b04a5a348a5d16cf9d065d68f0066ff9c538449cac02e1637fc39868f0cf64ae8a4da623019f6c35912c82d0d31adffe8c940ad1ada6df6fa35b31bc28ecacad044f1f806ef20a31f4c1cbcb6296c952a461bbe46be4c8c8dda3a5f5e813ff9dd57de1efa79d4f18ec8550344bdaf408ef74126ef93661882d11274ec7f62e24399ca038bf04ac04dc5e93ab194782dbbe020c165c4d466864a53a26e80317e3e2adfa41171894856b8e2797ea0ed2ee986a39502190c35849955a033d9702bd16da3a7d9d1986d6f4f484d4b36b1e8fee8c43dd7c33214813b0347befa96fa61d3c49e454892808546973ab4f2eba2d7886cb3ae7676ce1721846ecc573659d2c54766caea1c8d9b85d9b9b4c06d34087c41c7b77a10c24a744e3d9c47766278284f9b932f3350bf2c5d34411fdf9402e6dfdaac11a889e5985259a37ab442079fa63aca4a542afbf22e4c7bdd96f0090ff49b7583f4ccbe6e523ed2bc975b8e23f22609f37fc577a2e0fe8007b777ee8e3b70d828426075ffb03e5fc1b8747bee13667f5798aa39a5f70fed54ce489cf706eb058a33c6b406bbdabbd84b1bdeaa3c5dbe867985aa6aafa27ea6a3c4f1e8f09f8abbbd837fd6776b035497885b0c05a48099d326831ecd51de113c300af96dfb0ca5abc78ad58e85a9f2f54179582ec7c327d6aefc11dc525e266eb9fd61c2cf97a613a67fc7da72980df7f5ca27b7b6def36735a67ba11eec1462f2742acd48ca0c471d3877746505efee334635c622b19ff6d1e5dd5131284bd9d145844dc28b90e89865bca337696e6b677de53de6cf9cb6fa04b388179e1941ef60176954e89690b94ff14df4914b270204aea33d3156f0ee9d2444e14f39bc23bf027dbcf63819b7c1b129600b7642901cb8e06b8aceeb9b733e2cbd7ffdb1913dbc8b2e40dd4e82dffcc1b99eb81f9e9d8eef1dca362d5312d0c36204287d7551ea68731c0b12f75fe4c9fe33ae90711cc007eb195fad4c5bc4e9bc28b295168f9c22e537e6b255f79583a9d130f37fc9c50ce9fb5765f98d7400402a1210b1319a19849ca78e6ce95fb44ad28fa49ce4dd15e44120fe7a6f52415923752cd17c6dbcb9dfeb38ebdefc2be4e86c30345017d2a71a5269b66c80c4cfabb7c8ed1c0a639de5f3b4781cf925103bbf364ba50a12930b1e216deefce7682a450132efeaa8ec5d366ace2b8922546ec47324b4a77e243f05243c4f29ab02c4fe7f2f7e56766aa752193b52db51d128c5ac244c0eae10dc2988d8e41ef57a8fdb0a5586fc838c8d2348d133c597c028244fc930e3f75568a5084a850e393d8735b828ae821a64a1bef2ebc1751f962e9b73fb99440062669bd08aaa30d349f5eb267f0f5830d0135bb0133c0c03398dd12710f49302a23cc090fc0beea570feaf798076d0a00") ioctl$UBLK_U_CMD_START_DEV(r0, 0xc0207506, &(0x7f00000016c0)={r1, 0xffff, 0x0, 0x0, r5}) sync_file_range(r0, 0x0, 0xf881, 0x5) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x1b, &(0x7f0000000400)={@remote, 0x4}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./sys\x00', &(0x7f0000000180)='cifs\x00', 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x2) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) syz_open_procfs(0x0, &(0x7f0000000680)='net/softnet_stat\x00') r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r8, 0x3ba0, &(0x7f0000000100)={0x48, 0x5, r9, 0x0, 0xffffffffffffffff, 0x1}) close_range(r7, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='1', 0x1) 38.679510217s ago: executing program 3 (id=946): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) renameat2(0xffffffffffffffff, &(0x7f00000001c0)='./file1\x00', 0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) execve(&(0x7f00000190c0)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x1c3425, 0x0) ioctl$COMEDI_CMDTEST(0xffffffffffffffff, 0x8050640a, &(0x7f0000000480)={0x0, 0x20000, 0x80, 0x0, 0x4, 0x1, 0x20, 0x8a2, 0x80, 0xffffffff, 0x112, 0x1, 0x0, 0x0, &(0x7f00000003c0)="9ea53bbe95795930e5724c77065649d11c1391b7db2810efb14a9572c661393b04402fadbbca6a584ad9403c82466caf4b9796745dee425a1d68c7ed5907f2f19b5deaab36c9d7819361f2dcb34e022a74e9213b535b39d90463a5c2c0c9537b6f3b681234bc7ce8c62f9f4454cd6716ffa23d", 0x73}) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001900010000000000000000001c140000fe000001000000000800", @ANYRES64=r0], 0x24}}, 0x4000000) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000500)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_POLL(r1, &(0x7f0000002540)={0x18, 0xffffffffffffffda, r2, {0x6}}, 0x18) r3 = socket(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000001c0), 0x4000000000001f2, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x80042, 0x4d) fallocate(r4, 0x0, 0x37e9, 0x2f92) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000180)={[&(0x7f0000000300)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\x17g\n\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa1\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV!\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m']}) 23.66951543s ago: executing program 34 (id=946): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) renameat2(0xffffffffffffffff, &(0x7f00000001c0)='./file1\x00', 0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) execve(&(0x7f00000190c0)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x1c3425, 0x0) ioctl$COMEDI_CMDTEST(0xffffffffffffffff, 0x8050640a, &(0x7f0000000480)={0x0, 0x20000, 0x80, 0x0, 0x4, 0x1, 0x20, 0x8a2, 0x80, 0xffffffff, 0x112, 0x1, 0x0, 0x0, &(0x7f00000003c0)="9ea53bbe95795930e5724c77065649d11c1391b7db2810efb14a9572c661393b04402fadbbca6a584ad9403c82466caf4b9796745dee425a1d68c7ed5907f2f19b5deaab36c9d7819361f2dcb34e022a74e9213b535b39d90463a5c2c0c9537b6f3b681234bc7ce8c62f9f4454cd6716ffa23d", 0x73}) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001900010000000000000000001c140000fe000001000000000800", @ANYRES64=r0], 0x24}}, 0x4000000) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000500)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_POLL(r1, &(0x7f0000002540)={0x18, 0xffffffffffffffda, r2, {0x6}}, 0x18) r3 = socket(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000001c0), 0x4000000000001f2, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x80042, 0x4d) fallocate(r4, 0x0, 0x37e9, 0x2f92) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000180)={[&(0x7f0000000300)=' wO\xd5\xce\x82\x89r\xa0\r\xc4Z\x15\xfds\x17g\n\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa1\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV!\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m']}) 14.807688168s ago: executing program 4 (id=1273): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = openat$kvm(0x0, &(0x7f00000001c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_EXCEPTION_PAYLOAD(r3, 0x4068aea3, &(0x7f0000000a00)={0xa4, 0x0, 0x1}) r4 = syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$x86(r4, &(0x7f0000000a80)={0x0, 0x0}) ioctl(r5, 0x4040aea0, &(0x7f0000000ac0)="00045f3b5b77422d4c000000000000000000000010") listen(r1, 0xe) listen(r1, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000480)=@mangle={'mangle\x00', 0x44, 0x6, 0x508, 0x98, 0x208, 0x208, 0x3a0, 0x208, 0x470, 0x470, 0x470, 0x470, 0x470, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x11000000, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {}, 0x6}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x568) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) sendmsg$TIPC_NL_BEARER_DISABLE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="0005a252ed7d76b811f977f19b11638a1a01d6bb1921f0b7d6702ffa5211a73ac1c00823118ca4b8e08be8dd14bbd427a4576fb304c3017e8e6e52fcb020aab9fb820909e21fe93cc41ba90880a2a73076aa7560ed24fc631d3221e86e11bb6f7a07495fa74bead8c58087b26b2cca3fb0e1bcbade7e6a6b642052b59b4759fd7d11fc7e4607ffae50856e48e25e6cd0875ef1a8705ae02965ec25cbd377e99d81785ff14be2dad51a861e8aaffb136f28305f961261637c0afbfa4464aef2c9482d358d2c35aa06095871b8c1e9d197f904f2886a53f15b0536c3f26afbddd02ef5075e681ff0ff1d705a4ac9d8dad33c106eca6e500165b1f7c7ed02da7117f52b6ea01a1bd7cee4b5007da924398443b6d6bcd841fd189b95ec18169c5288091522dbfb8cc91c6b2857e74ab3c702eb4d3706c8bcfb0d65fd4af55de9b273a5b4f1383b8ce68ccf6b944372e98c596d7cd4ea717b888a327f1f04b1a103bf234a23a97c2421fb42bf4c9d7d05361eda11bed770325cc8087df41f57a4651fc40cb06f9631269bef1462838f666cbac600b230d8d1f4bb55b4157ebce07a53dd46aae47ccfe7327d9278a05c52435880b409ef2ced88020a0e339a34e3006e", @ANYRES16=r7, @ANYBLOB="0100000000000000000002000000140001800d0001007564703a73797a3000000000"], 0x28}, 0x1, 0x0, 0x0, 0x40810}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r8, 0x10040) setsockopt$SO_BINDTODEVICE(r8, 0x1, 0x19, &(0x7f0000000b40)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000b80)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000bc0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x68, 0x67, 0x0, 0x7, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x15, 0x20, 0x1, 0x0, 0x0, {[@md5sig={0x13, 0x12, "64a80fffa2c70e94f10b4d712c94ae6e"}, @mptcp=@add_addr={0x1e, 0x12, 0x0, 0x12, 0x3, @rand_addr=0x64010102, 0x9, "540089e05cf48439"}, @mss={0x2, 0x4, 0x3}, @generic={0x8, 0xb, "a72e7e48a061f94264"}, @sack={0x5, 0xa, [0x0, 0x8]}]}}}}}}}, 0x0) 14.670118628s ago: executing program 4 (id=1278): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, r2, 0x72b}, 0x71}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x2c, r4, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0xc, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040887}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xfffffffa}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x8800) 14.669513327s ago: executing program 4 (id=1281): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x8607}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000002200010a00000000000000000000000000000062"], 0x1c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r2 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r2, &(0x7f0000000280)={&(0x7f00000002c0)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000340)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 14.599356201s ago: executing program 4 (id=1284): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000380), &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x2210088, &(0x7f0000000440)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) chdir(&(0x7f00000004c0)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000500)='blkio.throttle.io_service_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x2125099, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x6e) umount2(&(0x7f0000000680)='./file0\x00', 0xb) setns(0xc9, 0x0) r1 = socket(0x2a, 0x2, 0x9) connect(r1, &(0x7f0000000000)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='k', 0x1}], 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0) (async) mount$9p_virtio(&(0x7f0000000380), &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x2210088, &(0x7f0000000440)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) (async) chdir(&(0x7f00000004c0)='./file0\x00') (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000500)='blkio.throttle.io_service_bytes\x00', 0x275a, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x2125099, 0x0) (async) bind$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x6e) (async) umount2(&(0x7f0000000680)='./file0\x00', 0xb) (async) setns(0xc9, 0x0) (async) socket(0x2a, 0x2, 0x9) (async) connect(r1, &(0x7f0000000000)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80) (async) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='k', 0x1}], 0x1) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) 14.519227848s ago: executing program 4 (id=1287): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000600)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000700)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc02, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0x8}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc815}, 0x4890) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000940)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000980)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f00000009c0)={&(0x7f0000000a00)=@xdp={0x2c, 0x8, r5, 0x1b}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000ac0)='z', 0x1}], 0x3e8}, 0x4004890) 13.078788967s ago: executing program 4 (id=1291): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2200, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000800)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000000900010073797a300000000048000000030a01040000000000000000010000000900010073797a30000000000900030073797a31000000001400048008000140000000040800024000000064080007006e6174004c000000060a01040000000000000008010000000900010073797a30000000000900020073797a3100000000200004801c000180090001006d617371000000000c00028008000140000000421400000011000100"], 0xdc}}, 0x8040) sendto$inet6(r1, 0x0, 0x0, 0x20004013, &(0x7f00000009c0)={0xa, 0x2, 0x0, @rand_addr, 0x6}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r5, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)={0x20, 0x1, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x90}, 0x20000080) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000100)="d8df7e23b3b9ce000000b807000000ba000000000f301b8154fea900b9b60a000080321100c4e28ddc8dcd000000c182fd3f0000c850220000b801000000b9a6080000b9800000c00f3235000800000f30ba000000000f300f300fc79d53bf0000c4b9e16dc301012202", 0x6a}], 0x1, 0x10, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000003c0)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x4000, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r8, &(0x7f0000000480)='100', 0x3) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000004c0), 0x284402, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) r10 = syz_open_dev$mtd(&(0x7f00000007c0), 0x46, 0x1) ioctl$MEMGETBADBLOCK(r10, 0x40084d0b, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r9, 0x3ba0, &(0x7f0000000580)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x13, 0x0, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x7a, 0xdb58, 0x9, 0x800, 0x7fe, 0x404, 0xf7c7, 0x800000000000007, 0xfffffffffffffe00, 0x400000ffffffff, 0x7fffffffffffffff, 0x1000000089, 0xc183, 0x0, 0x7f, 0xbe], 0x1, 0x312283}) ioctl$KVM_RUN(r7, 0xae80, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x0, 0x0, 0x0) 12.989865641s ago: executing program 35 (id=1291): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2200, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000800)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000000900010073797a300000000048000000030a01040000000000000000010000000900010073797a30000000000900030073797a31000000001400048008000140000000040800024000000064080007006e6174004c000000060a01040000000000000008010000000900010073797a30000000000900020073797a3100000000200004801c000180090001006d617371000000000c00028008000140000000421400000011000100"], 0xdc}}, 0x8040) sendto$inet6(r1, 0x0, 0x0, 0x20004013, &(0x7f00000009c0)={0xa, 0x2, 0x0, @rand_addr, 0x6}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r5, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)={0x20, 0x1, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x90}, 0x20000080) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000100)="d8df7e23b3b9ce000000b807000000ba000000000f301b8154fea900b9b60a000080321100c4e28ddc8dcd000000c182fd3f0000c850220000b801000000b9a6080000b9800000c00f3235000800000f30ba000000000f300f300fc79d53bf0000c4b9e16dc301012202", 0x6a}], 0x1, 0x10, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000003c0)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x4000, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r8, &(0x7f0000000480)='100', 0x3) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000004c0), 0x284402, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) r10 = syz_open_dev$mtd(&(0x7f00000007c0), 0x46, 0x1) ioctl$MEMGETBADBLOCK(r10, 0x40084d0b, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r9, 0x3ba0, &(0x7f0000000580)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x13, 0x0, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x7a, 0xdb58, 0x9, 0x800, 0x7fe, 0x404, 0xf7c7, 0x800000000000007, 0xfffffffffffffe00, 0x400000ffffffff, 0x7fffffffffffffff, 0x1000000089, 0xc183, 0x0, 0x7f, 0xbe], 0x1, 0x312283}) ioctl$KVM_RUN(r7, 0xae80, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x0, 0x0, 0x0) 3.232580651s ago: executing program 7 (id=1385): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4c881, &(0x7f0000000000)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 3.179640464s ago: executing program 7 (id=1388): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)={0x1c, 0x5f, 0x101, 0x0, 0x0, "", [@typed={0x8, 0x41, 0x0, 0x0, @uid}, @generic="04"]}, 0x1c}], 0x1}, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioprio_get$pid(0x2, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f000000d040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)={0x34, r0, 0x8de13c6b70ae92c3, 0x41003, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) 3.129698925s ago: executing program 7 (id=1390): r0 = socket$kcm(0x10, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d083911000000000000a1180015000600142603600e120900210003000401a80016000400144006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) 3.067898353s ago: executing program 7 (id=1392): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[], 0x48) syz_open_dev$dri(&(0x7f0000000080), 0x3, 0x2) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7000000000000007b5af8ff00000000bfa200000000000007020000d6ffffffb703000008000000b704000000000000850000001400000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0xcc03, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_GEM_FLINK(r2, 0xc008640a, &(0x7f0000000040)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r1, 0x0, 0xe, 0x0, &(0x7f00000007c0)="000000000000c000ee6e3e20630c", 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.067599669s ago: executing program 7 (id=1393): pipe(0x0) r0 = memfd_secret(0x0) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000240)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e24, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xffff, 0xfffffffffffffffd, 0x2}, {0x1, 0x2000, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x5, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r1, &(0x7f00000003c0), 0x0) r2 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000400)=ANY=[], 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x48, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xb, 0x9}, {0x0, 0xfff3}, {0xe, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @mcast1}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20041090}, 0x4000) io_uring_enter(0xffffffffffffffff, 0x6ee9, 0xe329, 0x41, &(0x7f0000000000)={[0x35d]}, 0x8) syz_usb_control_io(r2, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000580)={0x0, 0x0}, 0x8) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000005c0)=r5, 0x4) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000600)={0xaa, 0x181}) ioctl$UFFDIO_WRITEPROTECT(r6, 0xc020aa00, &(0x7f0000000640)={{&(0x7f0000800000/0x800000)=nil, 0x800000}, 0x2}) r7 = fcntl$dupfd(r6, 0x0, r6) ioctl$UFFDIO_CONTINUE(r7, 0xc020aa08, &(0x7f0000000680)={{&(0x7f0000800000/0x800000)=nil, 0x800000}}) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)={0x1b, 0x0, 0x0, 0xb, 0x0, r0, 0x2, '\x00', 0x0, r0, 0x2, 0x4, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1c, 0x19, &(0x7f00000003c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x8001}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000004c0)='syzkaller\x00', 0x81, 0x0, 0x0, 0x41000, 0x10, '\x00', r4, @fallback=0xa, r0, 0x8, &(0x7f0000000500)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000540)={0x1, 0xe, 0x100, 0x9}, 0x10, r5, r0, 0x0, &(0x7f0000000740)=[r0, r7, r8, r0], 0x0, 0x10, 0x2}, 0x94) syz_usb_disconnect(0xffffffffffffffff) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7, 0x4) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) ioctl$XFS_IOC_PATH_TO_HANDLE(r9, 0x604, 0x0) 2.043355079s ago: executing program 6 (id=1408): openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x781200, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x781200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x11) ioctl$KVM_SET_TSC_KHZ_vm(r1, 0xaea2, 0x2) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x105101) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000080)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000140)=[@increfs]}) dup3(r4, r3, 0x0) (async) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f00000001c0)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x8, 0x0, &(0x7f0000000240)=[@acquire]}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}]}) (async) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}]}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000380)}) (async) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000380)}) ioctl$BINDER_THREAD_EXIT(r6, 0x40046208, 0x0) ioctl$DRM_IOCTL_AGP_INFO(r2, 0x80386433, &(0x7f0000000040)) (async) ioctl$DRM_IOCTL_AGP_INFO(r2, 0x80386433, &(0x7f0000000040)) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 2.042437065s ago: executing program 6 (id=1410): r0 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) close(r0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000040)="110000001000"/22, 0x16) write(r1, &(0x7f0000000080)="64cfc6287dc4599168db8e3bd4949304cbba42b6c6df1c496e7dc8bf8e63c6f6c6c710bbd786b2498d40271c0b8c2fe5e25b1a6e13237c87a7779804a4c6feb934c509426e6689830a7d962f8ee236229ec22807f43f4ed7b8dcb0aa1d2ff7539b751968df7f783758bbc89c8c240de73db4b424f4cf1aef64171a201254756b05d799c41013", 0x86) read(r1, &(0x7f0000000180)=""/71, 0x47) 1.980011785s ago: executing program 6 (id=1412): socket$inet6_mptcp(0xa, 0x1, 0x106) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000200), 0x20000, 0x0) r0 = openat$comedi(0xffffff9c, &(0x7f00000000c0)='/dev/comedi1\x00', 0x2180, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000140)={0xc000003, 0x0, &(0x7f0000000180), 0x3, 0x4}) r1 = syz_open_dev$media(&(0x7f0000000180), 0x0, 0x20200) ioctl$MEDIA_IOC_DEVICE_INFO(r1, 0xc1007c00, &(0x7f00000003c0)) r2 = open$dir(&(0x7f00000001c0)='./cgroup.cpu/cgroup.procs\x00', 0xa000, 0x40) openat(r2, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x2000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="0100000042000000060000000800000000000000", @ANYRES32=0x1, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r4}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r5}, 0x38) 1.889987738s ago: executing program 6 (id=1416): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0002}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) fallocate(r0, 0x2, 0x10, 0xd) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000002c0)=[@text32={0x20, &(0x7f0000000240)="99b805000000b9eed500000f01c166baf80c640f01cfef66bafc0cb800000000ef0f3066baf80cb81a53348aef66bafc0cec0f7821d9f80f01c20f00db8fe978cb27", 0x42}], 0x1, 0x43, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000040)=0x4) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) mkdir(&(0x7f00000000c0)='./sys\x00', 0x14a) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/devices/platform/vhci_hcd.0/attach\x00', 0x1, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDDELIO(r5, 0x4b34, 0x3bf) write(r4, &(0x7f0000000200)='0 4 0 2', 0x7) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000340)={{0xeeee8000, 0x2000, 0xb, 0xad, 0x3, 0x4, 0x7c, 0x7, 0x0, 0x2b, 0x9}, {0x2, 0xe000, 0xf, 0x2c, 0x8, 0x0, 0x7f, 0x1, 0x4, 0xf0, 0x9, 0x80}, {0x2, 0x5000, 0x8, 0x5, 0x1, 0x22, 0x0, 0xa, 0x0, 0x5, 0xb, 0x2}, {0xdddd0000, 0xffff1000, 0x0, 0xe7, 0x4, 0x2, 0x1, 0x3c, 0x8, 0x8b, 0xd, 0xed}, {0x4, 0x2000, 0xd, 0x3, 0x5, 0x86, 0x9, 0x7f, 0xa, 0x0, 0xf2, 0x43}, {0x30000, 0x6000, 0xb, 0x7c, 0x2, 0x24, 0x7f, 0xaf, 0x80, 0xc, 0x8, 0x3d}, {0xd000, 0x100002, 0x3, 0x3, 0x8, 0x5, 0x1, 0x7, 0x5, 0x82, 0x3, 0x8}, {0x5000, 0x3000, 0x3, 0x5, 0x89, 0xf, 0x3, 0x37, 0x0, 0x9, 0xf0}, {0xeeee8000, 0x2070}, {0xd000, 0x7}, 0xc000003b, 0x0, 0xeeef0000, 0x2104, 0x4, 0x5100, 0x3000, [0x4, 0x7, 0x7, 0x3]}) r6 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r6, 0x1, 0xe, 0x0, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) 1.679192668s ago: executing program 6 (id=1420): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r0, 0x0, 0x33, &(0x7f0000000000)=0x5, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x2, 0x7, 0x5, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x6}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, 0x7, 0x6, 0x201, 0x0, 0x0, {0x3, 0x0, 0x2}, [@IPSET_ATTR_FLAGS={0x8}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'erspan0\x00', &(0x7f00000002c0)={'sit0\x00', 0x0, 0x8000, 0x20, 0x4, 0x10000, {{0xc, 0x4, 0x1, 0x13, 0x30, 0x66, 0x0, 0x8, 0x2f, 0x0, @remote, @rand_addr=0x64010102, {[@timestamp={0x44, 0x10, 0x73, 0x0, 0x1, [0x6a, 0x10000, 0x4]}, @timestamp_prespec={0x44, 0xc, 0xe2, 0x3, 0x7, [{@private=0xa010102, 0x7}]}]}}}}}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000380)={0x0, @rand_addr, @loopback}, &(0x7f00000003c0)=0xc) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000400)={0x0, @broadcast, @broadcast}, &(0x7f0000000440)=0xc) getpeername$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000004c0)=0x14) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={r1, 0xe0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000500)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000580)=[0x0], 0x0, 0xee, &(0x7f00000005c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000600), &(0x7f0000000640), 0x8, 0xa2, 0x8, 0x8, &(0x7f0000000680)}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000800)={'wg1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000840)={'wg1\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a00)={&(0x7f0000000880)={0x17c, 0x0, 0x8, 0x70bd28, 0x25dfdbfc, {}, [@ETHTOOL_A_DEBUG_HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_DEBUG_HEADER={0x4}, @ETHTOOL_A_DEBUG_HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_DEBUG_HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}, @ETHTOOL_A_DEBUG_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x4040}, 0x4) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) r10 = syz_clone(0x160080, &(0x7f0000000a80)="791de12ee969e89fe8c2e8fb4ca925b87f84485aac3d09b4d76856b17e486ad61a6663428fb056a2769ae13ab752921249bed5ed5a63972c380a870953e10770a0043819a6a1a4d7ade6046bc396b41e647be4c4692d6370469c397cb647172bb3fdc601b2371c6c9b990ad0a75dc569731d72f32e0128c6b37b9256fea1ac4bde37fb8b5a7dec542988e285e6f2c07169b0ddefce150bb5a4aa81421a01573b659c25269cba3e", 0xa7, &(0x7f0000000b40), &(0x7f0000000b80), &(0x7f0000000bc0)="3181f0de400b7d9b45f0cd4ae5e2e7aff8802188d77e3d1f0dc9c5afcc4ac1eb0dbfc9b57cdc3c625a1e38e33f5a251aadb5dc6c4e09213a0a0c0958ec4b48348f08f069221fcfa4286b1de27b01e563cc2cde8eeff914daec00b8c42a5fd7a0536a210cadf67c183d1c9da004f66865b18108350a6ff39f97d4baf0ff996aa2e6a76a36f0e2a98ef009f906839c06ed476a3e49df55d91b8ddb7442a1a961b8accc882565c7ba3fca22907acf8e1cd786d084ff492cb1f2b6f82de3c449e9b9daf166932dda8d0a9ce26d016f8f3991360d02b0516711693cb0aa39b978b27dee047daf6df1d8abc9537f88") r11 = syz_open_procfs(r10, &(0x7f0000000cc0)='personality\x00') write$FUSE_NOTIFY_INVAL_INODE(r11, &(0x7f0000000d00)={0x28, 0x2, 0x0, {0x2, 0x9, 0x9}}, 0x28) write$RDMA_USER_CM_CMD_LISTEN(r11, &(0x7f0000000d40)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x7}}, 0x10) ioctl$UFFDIO_CONTINUE(r11, 0xc020aa07, &(0x7f0000000d80)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}}) ioctl$BTRFS_IOC_ENCODED_READ(r9, 0x80809440, &(0x7f0000000ec0)={&(0x7f0000000e80)=[{&(0x7f0000000dc0)="bb2872a49a006fac0a184637f6550187a35f47cb8c91f1ad4d78906f8a3b5bc20fe20ade95b71cc99440fee11dc4a2b5e3a1ab3c089ce48fe99013e3d1a1f0ad8c65354182083ea0de8beb349498679d1984", 0x52}, {&(0x7f0000000e40)="be5a740e0dc3a0133c61df2d252cbcd257a9331f2f858eaf54280d41d720f80cfa636e76debf821c", 0x28}], 0x2, 0x1, 0x0, 0x1c0, 0x5, 0x1, 0x6, 0xe}) r12 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000f40), 0x802, 0x0) fsetxattr$security_selinux(r12, &(0x7f0000000f80), &(0x7f0000000fc0)='system_u:object_r:net_conf_t:s0\x00', 0x20, 0x1) ioctl$KVM_SET_SREGS(r11, 0x4138ae84, &(0x7f0000001000)={{0x1ff8, 0x10000, 0x8, 0x8, 0x8, 0x0, 0x4, 0x1, 0x0, 0x5, 0x0, 0xf}, {0x54000, 0x2000, 0xf, 0x4, 0x9, 0x1, 0x5, 0x9, 0x6, 0x7, 0x71, 0xc}, {0x54000, 0x54000, 0xe, 0x7f, 0x5, 0x4, 0xfa, 0x7, 0x8, 0x10, 0x5, 0xfa}, {0x9000, 0x60000, 0xb, 0x7, 0x1, 0x7, 0x3, 0xd7, 0xc6, 0x4, 0xbf, 0x98}, {0xf000, 0xffc, 0x0, 0x10, 0x0, 0x80, 0x4, 0x5, 0xf4, 0xb7, 0xf, 0x80}, {0x0, 0xf000, 0x5, 0x73, 0x7, 0x6, 0x7, 0x80, 0xd3, 0x4, 0x9, 0x7}, {0xffffffff, 0x70000, 0x4, 0x9, 0x1, 0x40, 0x2, 0x9, 0x9, 0x20, 0xff, 0x2}, {0x60000, 0x0, 0xb, 0x10, 0x8, 0xa, 0x3, 0x5, 0x2, 0x24, 0x1, 0x5}, {0x10000, 0x2}, {0x80a0000, 0x55}, 0x0, 0x0, 0x100000, 0xc8, 0x2, 0x100, 0xeeee8000, [0x0, 0x800, 0x4, 0x6]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCGSTAMP(r14, 0x8906, &(0x7f0000001180)) pread64(r14, &(0x7f00000011c0)=""/5, 0x5, 0x9) syz_open_dev$tty20(0xc, 0x4, 0x0) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r13, &(0x7f00000012c0)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001280)={&(0x7f0000001240)={0x14, 0x7, 0x1, 0x801, 0x0, 0x0, {0xa, 0x0, 0x5}, ["", "", "", "", "", ""]}, 0x14}}, 0x20000000) syz_clone(0x200080, &(0x7f0000001300)="1e6144e89f23ee197cac53b01942269724a7640393851c9c7a7ceec099eb510c1d2a6e06b5dc4451874a71a3d85b5213babcc2f0171efb51c5185078e3d846ca623fec1b9d65c9e68040a4a5651d5524913ff2698f7d7bc295b349fcc986962ee9f1e73dfcee1d608b0c4d88863a886808d8722ca6d2f752aee07c3981ad84915e4d2bf6c9094045a7cb4dff0a6dde1706", 0x91, &(0x7f00000013c0), &(0x7f0000001400), &(0x7f0000001440)="efefa49dcf7cf6782cd7ad361a3c403c6f1a799fa2cee6c9d97bba57772872b2246ff240a446eea0d35162b7d82fd489efe7cd6710e4a15a172d90ed268a2f9d8fa22a7f0f35453720f97208eadf814c881004ad195e6fe007c1de0be9a87bf00679fc20875ac255961ac3dbd1ac0b21a72489eb71e7a31eaf935ca8f75d801058222599896943a52adf728e774e8ffddf2aaa5dbaa2d229187e3053b521373747fa5b68370cddd69fc579f517fefd562716ae6534f50314778425fac9fa97430819f438a7ef6942a81a6ae903ea242a1a420e56859eb435c4a85d2fc2a43a576cbd3be7f458bbefe35d9287b1f7b9a3123b3492e8b7c794d8813c89d6e01cef49aa0e128e3c51f78963f0499a8266aff5cfc607c0bab5d9bdf73ff7746e49affca83fa25e252fb1b90fa9dc08497bc00ae9e431468e69ed588f975b18fc7b5ed3bae78ec1c31d0e448873ccde99cd660f8d151de86ca5f6743ab7afd3c985ed7c28b28df8190469aee877589a318097f651bf8fbd6d76c2b25aae194269e3f80228f3fa7525f13b43eb6faeaff4d4620474cd438c3b4d10b84bcca5c5c05f77ed590f4e27074ce8444ba786bda319ee64b5c424a1a7c70c3a12ef377f097b5ed49cca479f87b0c6a596e66ae2691d865c85c648e9c13290daccc1cfed977041c794befd171e8a0541e2d3cb3677807fa8f308ac8acdb40e039e195577c816b5f5d854840acb900d5f3ac129a57345e5d6c9eab3b8f359a61b1ba2e2b22affe2728b8310048a414b07a6e82734705d660f88b58c2be460b819c1e81b09af1c7312b8ca606ac83cee7fb6dcc352e106bca47b85358dcb31fb254a78f9b48279bd55b42ae499dfe4d2ce2270d1ec1306f508f6c7555bdee2dde5693fee810de4a507e99164d5ac0e4a131412864916f3d3dfcf8f04de177f0968d4d99539df9263052ef4dd79d1736d0a2b54b684460de787f10729ac96e754a92357912f39941f6760d54b7f63fd5d27fdeec1e48a2a23825e883b2e42a66059023fdec7637975a8821f50b12c675c6f4c5b381d7c944f6b72f2789fe948a283713589ed6daec879045b3fb968a354d37c943153741e3dcba33d887a0ddf089285358b233db74effca0292a2223602c18605a5cdd755192481e208aeb8bf06f464d6abcb6fc7c9244b70aae5e6d44315ac489913c2532eae474bb218325d1470bb40b3a36ed14f66b38e1472dfc3ba5e1594137b1b326f8d1cbceb9f4eb8a2ca0e19e44035c3039d4898257b8b8f9ced8f464838fdcdee8eeb1ad8f23f9a66d9aa702b83c475c68dc75e51c7fb25c392dca0b82f0745a2f11a4cdc4a1fc8e7a8c2da27800a3489103a7fff42b100963c207bf2c3afd08a7027f093b9f526afb8d516302ac8832c4b7658fe60207ee94cc9b0efd29bc57dea76c5ab8bff3d1fa83cf120f97cf381a97bc01980ecd18dee2bf8f32c065b137d3e29fce78074dd67c3b4133acfd2f2d996eadc102bd4849f79ef18f440c314d4c613eb54d4b211cf8255f23d3d181caee27ef92738be01e8c7300d224bee6fbc2df7fb7799f4d8e12f01c0612977480602cc557da940bc4f32e4e527e954a71951664607cc86dfd600f8473d7bfda4fa102dc076e09abf49b2354e549d9cd38b52d4c30adb43a85dd5aa4ff75470e0a7584c85a02f2d191cb56dc20d8980194213fdeb1df8f74b0e0ad6553ba9c59b571cfee5bb2ff196091893c63b86ff3d7fd790dbde258ee5007c0ffdffa755d873028bc53fc73f39c4ca5c5f471d9b62fcda7b3715e02ae7bd255feace65ffcbacde543f7cfe6d484bfcf2766706647b73b1a46daf67407ab046bd272dc125c373538aa860e5de9cda5584999e65f2555162d1191fb68c2d87de57b67b6eb66b96f316c418bb30225d2aba726fd18d848fa05b1ee26fdb42721d501d7ad1136874176db1631aedc85476605535806643eb448b47635cb1d34284bd0722de3854721ce309683ece4765dba6c51e93942125dc19dc7936e78e24205d01bd1b67c11efbfcbaaadf1f5955a66fbe124a831e28f20b65b7fd439ed45c691131ded9e7ccd0276fcbe0b35561a21e52706d1952b813089e3474d1bba522fdd4fcfe899c8518fd0b666dc17c7446c447facd95e3c38eda7e05d92d19e435f5df24bce4292a5a2c42333ba4bcc35edd8ff11407f0e5f8bb9e5e45e6150a262372809c9074b6f2b0e71eb0fd7d9b2c3880d7fe4b95ea63e6439e86959671f186af6121923dccaa60313a9da0d8f738cd295241eba0e25c9fa1c356dbd85e4f4ab4ef635337ff4fb9db0ab3fdc96e6a117d24d6e491a69d145532d8f7548b09899b24087240d9d6209c7237e1504c319db248e5f20c1a850737de1b4f9ec9bbcee30337af4204a4d640153738cf55552d804dab8b23ee16f673539fb701885667d0e789928921f447880ef8ba93d0b94290fa8685f33833162f3c51c0895659e95ccd6d121463e5d47f7ece331b6edb70527298d114ee59dc08e7aa161f511f96bb9b6aae3c3c10147bad32f24acf51f70269a4d6263c2846493b2a87b2c79ab31838b6af5e0de4de76cd50dcef2d9eed5ff87fd9104c46cd8e0dad95fdfaaa2938272cd6bf987529260bdec05960cd50cdcdfd848e1847e1751264855efd56229b8f510c987e379b1ba0309f26d551c6b2ba53dec6e8a4bc69434b2ead102b923e3e499958e43046753a1074d2aa10a22700165ec4a2abf03f52fe65682ea3e81820fe518800304920f30f3eadc8842e3db590bb3ee360c2b8b0f17aaaeda673a8516114003b5cc7598d41670c77e8ac9d504ecd7dceac3caae5bfcbfc188dc0646e32daf70f1c3c7f6e0b982565fc1f08ef618f38f17dc24db6665c583bccdc2e6dd959ef10eb1487e706036bc6c0dda8051e89d62e4775cc79f1d0c7a7386329e1428ca3f763981229ef80e855e6ed248652096771158212eb9f0b81122b73e95d821c5e28495234fccf290a44bef12306bc10994e72f32eff39f7a48e56ad758ab226afe9448a15b1b62149bddbe614af9642f29039d6fa618745aa4cf9c3474e4bc795b9998cdb1941c8c9d949ab693c8adf83bccb74e4fccfa7e5c430bf044992532b6e02dd2addf3d75ca0fccd3a5a0c9e34e49fd20d77cee89cfd13381da008c8bb8e9c3ccd6badbbe815fe24977e36f2ba9d50b1fa328596f3150083d0a6c38fa654ee48aee1c710172eb53f094a603ff47c17541b9abda962e133e0223f9fa494dcc7bdd885ee35b2ad684c2adaf9fd4805065e67269f078cc22d91c53297a8abcb75d083c43384a080e9c85daf6635c4d60d93d463e979d6423f42ba9298666d4d459401e11eba7a5c837de5812e960ab8045239de13ef7b2ada7a8d8eb4f94daa62eda061f284c6f68659171a61d963d7308dc6403868e9e371f31fcb5ff54fd66fb0a34a3d7773483958bcc6275b13dc86289a88af3fc2740282d396124a77f8e5f180c2bc2908b315fe8d02ce216c734f78ef8f6252d4b3c3975c8c67a41d6b80bb733d16f4bdedc3c5f3717fcfb05f4a067f18995acb13a73d63e1188fd7ebe4c5eb0aa6584003b72884e704873252442e9bad47303fbb16ce60079ce93f25c637472ad86b71e70f7196b3fade87f49f7f6ec9ff98225920119e8beef938a4cd60eca98dab7f756fcbe113ff1577580720b5438f309d2e414e3690895e45e0138c01dffc0fded36247321c22d057ea10934a673d77f54639b1ebbedb1da7f6cc8b3940e27fb53b08837fac188b27951f2e679232ba2bfe59af3a5aa604d0c66f42b7b5c021becfd0957a71d5c7676558829c4355bf899fbb23b53ee285835d2eba2469b2ba83816526888fa6ac99eaec14f1b9b960b75e618a883f297d0bb0fe652aa5b1ab0faf9ad747f3ce593557417a1cfa83c041b6b10a143e3814884aec261fc0e1633314bf117aeec19c4ba260c8c1bbb18c1c70c3bc72173b30f5352f6f0c8f84a4d03b8851296ca6d0cedff8d3ae1512756885202d129e7bb56c24306ceb1b84e7ae217db790d57ea9978956c793724081c080f83f71a5a3a66a65a1b6027d54a75f526e4a9897cf7edb5c342e27be895ff112b48487d1c0b6ad1ea8e818399cf0245e93648ce4bc2423ae5434b2d9486e41e3ccceb61755c3569d65a3f39b16d33b15c6b65fa08f6adadd5a44a5a12f9763fd128b2712d74214acfa5a63bafdd01c0d1ca1a5e3d5ed3e88af689937582de55efbf3b53d89f457fbd88c76e43e7f563eb778a4e9188c543b3ec4a5630e9a8f80a3b9a3a6e81e30a408e5c45a72f7097b0e6dd13b994cf00e7286aecfffa4d7369692a78d3839953194e08b7de4b940316e50be4038a7a345ad1eff6fe1595894d3e5dd9010c43c4e9b6c11c50acf632b4b139e916e2c15b72ab08585764ffb565fe099a86455947b4f42d239ca808478a87d26752dd5f8af943d6449ad93627621ce5234810fa4a1937b59002afa4601834a3882af48aa4d9d16b118d1bf49456f32ef7adef5c9f00e41dd4084c7e3b0aeaee2b52dcc1b5ebe1be783cbb4027c63fd47e9ffd44aee6a5b24a2b10d6ac64544a749e32e2d254044c1a132f31756bf076080017ce30a14e9a87cb60d69ede27ba0cdc8b089772a3f1fa89e697eafeef2d24aeee853c47df67a6684cc6a60161d2a786d4f838926a4291a19fb96c49ec3acb4c11da91fc996ef618983253d5c1f224e3ad1238145869a44de9c18a1bbf78fe7bd4458a1abd8c3b01bf109f26c1ad8acea451b7ec9b76695854b8614366052d7a6f67601dd497166e8aa64bb67d9ce5a44aff8f54410fd83c6e7f147351b9462a6230a271ea1cce9ed7ecfebc74a3bf8054fef9c7542916b759280662e95e9b4381b6cdbb98931360080e0c6fdff076d23767e1fb8a1b31ec14547dcf01f54855c9832bd14c0983b2a2b0670c7fc951768da317f1d921aad02a2201e4acc156800914dd50d597e5e915652aaba4bec1ca5242a383ec6c2f1ebf8f136bb9893f5911f4eee1a1dda367bda7e45664d9262b4c8c6ad082397aafde8ca7ceb3e3001bb82fc7de3895f26ea3609b26643a781a2ffa5598763ce488e6ee22131125cab4291cdfc0ebb6ad8c434dad01a5fe1a774127f9666503bd24baa72adab0fc1c1cb1aea24648d12d88c8fc79482079bec239605e8878c19700ac0e0fb4d0f670793d9e08cd5cf8ee23d06186097f45bcd094968b8461d10ae424512a2d0a5da4bbc419e8a0886089b3bd9becc7acd2757e04dd3968b3e0ea886fcd63fa796a86bc3b8f2cd628adb7e9e45bef05a1795815a5547c6fa790945ce8da1283f1a3116270c7bc4fb769244a848a3a369834ec5b1abdeeaecbf71501dda9cc1dca9c5cb116e1539791c0647b8cfa99fe59d4ec1c2ad7d0c0a01a1a6ea7d57e243ad379237ffb730082cc648b867ae0fc193881430e8a73cc2a42b911a018cc8bac6c4a9fe860ab94330df8556f75cc49cd1df245ccb08f83b2d64094143e3c9c2edaacf90c7d6fd8ce1b6c09eb50b88cad5872e104ea410c98da82cd4235465582ebb5d09cdb6cf7f77eda3f430fd3d1b705ea1d9b75b26136f146c7e56a8d45827dc191162eb14900acd2ba04c377ebca952c591d8bf67426f1b8ee7c2edf42ccca4cd4e564fb0e0fca5f652eab73e1976f1ed1bbbad36de600ea165908df40bee793ba4647d6567c662f7c39d7968727a12366616a8f0078ce208d628afd239523786e11d8698741ef571d0fda199c1e417e941908ecddb2c3ac78d00ac9abf3923aa59f46a") syz_clone(0x2100, &(0x7f0000002440)="d4c222dac8ebd886f9dcd6fb88a57dbeb5964002bce86cac4613a7e26ace28be487f0622ca7e472d185c30c77144abba23161663e0e3c0884917554f5e985674df20248bb4a96832f6c6fbd742b10dcc879a29b39362ded6baa900b05e5dae273e324ebf7c12d6522e4f771ba133a6b369e27e47d9a05926c23439cf502b91", 0x7f, &(0x7f00000024c0), &(0x7f0000002500), &(0x7f0000002540)="19d612f9e38e7d6a1de07bfd23f55448a81dae5770fcc8b9c864533fd73dfa6db0b733e6044e817d84c6fc4883066d424ca87df025e867bc83850d1dc3837875a53dd640490e4dc5cf7804a0b07710281ee194f52a9f60aa17d4b4b412d782c67b6da73d492f6a50dba2335df057b6aad90c4bf006b255bb7d00a0bb640bd6e80b5972192d3810efebabe82d7a4b556682118f7cf07c2a9cad338468aa7507901f97852e89efd972f4d8e3623865854dda9a28e712b6abf1891fc2b7c525b7bc4d5e3aa3ccf74ee7875e4f877d0ce66d431b5778f3894e0f072b584a") 1.609232977s ago: executing program 6 (id=1421): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001a00010028bd7000fedbdf2481808000000000000000000014000100fc020000000000000000000000000000140002"], 0x44}}, 0x26004040) r1 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="12011001000000106d043ac500000000000109022d0001000070060904000504030002000921fcff400122180009058103"], 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001180), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x100) ioctl$KVM_GET_MP_STATE(r5, 0x8004ae98, &(0x7f00000011c0)) listen(r2, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="fa03c67a00", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000004c0)={r6, &(0x7f0000000500), &(0x7f0000000540)=@tcp6=r2}, 0x20) shutdown(r2, 0x0) shutdown(r2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001840)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000001880)='./sec\x00', &(0x7f00000018c0)='securityfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000001900)='./sec/tomoyo/exception_policy\x00', 0x111000, 0x0) write(r7, &(0x7f0000001940)="616464726573735f67726f7570206772703120302e302e302e302d3235352e3235352e3235352e3235350a616464726573735f67726f75702067727031203a3a2d666666663a666666663a666666663a666666663a666666663a666666663a666666663a666666660a61636c5f67726f7570203020826574776f726b20696e65742073747265616d2062696e6420406772703120302d3635353b350a61636c5f67726f75702030206e6574776f726b20696e657420646772616d2062696e6420407fe26772703120302d36353533350a", 0xd0) recvmmsg(r2, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000001700)=""/124, 0x7c}], 0x1}, 0x4}], 0x1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000500)={0x3a, 'syz1', 0x3a, 'E', 0x3a, 0x7, 0x3a, '-@--{\\', 0x3a, '4$%', 0x3a, './debug/file0'}, 0x36) r8 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000001780)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) write$proc_mixer(r8, &(0x7f00000017c0)=ANY=[@ANYBLOB='IMIX \''], 0x2b) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000001800)={'vxcan0\x00'}) close(r8) syz_usb_control_io$hid(r1, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) r9 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x62880) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x48) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000001400000000000018150000", @ANYRES32=r10, @ANYRES8=r0], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0xcc03, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r11, 0x0, 0xe, 0x0, &(0x7f0000000380)="000000000000c000ee6e3e20630c", 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$HIDIOCGREPORT(r9, 0x400c4807, &(0x7f0000000580)={0x1, 0x100, 0x7}) 1.146229938s ago: executing program 1 (id=1425): r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000100)=0x1, 0x4) bind$rds(r0, &(0x7f0000000000)={0x2, 0x4e21, @empty}, 0x10) 1.088417322s ago: executing program 1 (id=1426): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000240)={0x0, &(0x7f0000000280)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x22, {0x0, "4883c8080f22c0d9d0f4"}}, @nested_vmlaunch={0x12f, 0x18}], 0x6a}) ioctl$KVM_RUN(r3, 0xae80, 0x300000000000000) 1.087874164s ago: executing program 1 (id=1428): bind$inet(0xffffffffffffffff, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@mpls_getroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0x1c, 0x14}, [@RTA_DST={0x8, 0x1, {0x7}}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000c0}, 0x0) write(r0, &(0x7f0000000140)="0f0000000401666f6f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006261720000000000000000", 0x10a) 1.030054071s ago: executing program 1 (id=1429): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffdfffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x81, 0xfffffffb, 0xb}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r6, {0x5}, {}, {0xa, 0xa}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x200000, 0x1, 0x9, 0x9, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x100007, 0x8, 0x10, 0x2, 0x6, 0x8001, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xfffffff8, 0xd6, 0x4, 0xfffb, 0x40000007, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0xfffffffe, 0x7, 0x4, 0x99, 0x4000009, 0x5, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x9, 0x1000044, 0x8, 0x8, 0x39e1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x3, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x6, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x7, 0x8, 0x7, 0x1, 0x1, 0x1, 0x5, 0x3c, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0xffffff80, 0x7ffffffc, 0xff, 0x9, 0xa7, 0xf, 0x1, 0x0, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x80485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0x2, 0x6, 0x3ff, 0x40000f04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x50200523, 0xfffffffb, 0x1, 0x0, 0x3, 0x8, 0x5, 0x8, 0x3, 0x0, 0x800, 0x2, 0x8, 0x7ff, 0x1, 0x9, 0x6, 0x4, 0x400001, 0xd, 0x1ff, 0xfffff068, 0x3, 0x429, 0x3, 0x0, 0x200, 0x4, 0x7, 0x2, 0x8, 0x42ba, 0x4, 0x800009, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b1a, 0x9, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x8, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x9, 0x1ff, 0x5, 0x9b4, 0x4, 0x6, 0x0, 0x9, 0x0, 0x9, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7d, 0x7420, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x4, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x7ff, 0x1, 0x1, 0x0, 0x7, 0x196, 0x2, 0x6, 0x0, 0x0, 0x8, 0xc9cd, 0x7f, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x1000000, 0x401, 0x3, 0x6, 0x33, 0x6, 0xfffffffc, 0x8001, 0x6, 0x6, 0x4, 0x5, 0xd, 0x1, 0x2, 0x1, 0x0, 0x3, 0x81, 0x3, 0x3, 0xfffffff5, 0xc9, 0x5, 0x1, 0x10001, 0xc, 0x8001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0x0, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x400, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x8, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x4, 0x9da, 0x4, 0x6, 0xea6, 0x3, 0x5, 0x3, 0x3, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0xf, 0x9, 0xffffffff, 0x5, 0x3, 0x1417, 0x82, 0x7f, 0x9, 0x1, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x9, 0x4, 0x1, 0x7, 0x2, 0xfffffffe, 0x3, 0xb, 0xfffffff7, 0x8, 0xf, 0xc57, 0x5, 0x2, 0x5, 0x8, 0xfffffffc, 0xf, 0xe, 0x1, 0x80000000, 0x5, 0x9, 0x6, 0x8000, 0x40000002, 0x1, 0xffffffff, 0x2, 0x5, 0x4, 0x2, 0x5, 0x5, 0x7, 0x692, 0x7a77, 0x4, 0x0, 0x2, 0x440, 0x1b8c, 0x14, 0x62, 0xc00, 0xa, 0x9, 0x3, 0x8, 0x10001, 0x295, 0x3, 0x9, 0x1, 0xb7e, 0x10001, 0x2, 0x7, 0x4, 0x1, 0x2, 0x103ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d5, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x7ff, 0x7fffffff, 0x80, 0x2, 0x4, 0x2, 0x6, 0x3, 0x270, 0x2, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xbe4, 0xa4a, 0x7, 0x400, 0x20000c, 0xfffffff9, 0x80000000, 0xd, 0x1, 0x9, 0xffe, 0x421, 0x3ff, 0x2, 0x2d, 0x7, 0x5, 0xfffffffc, 0xac, 0x7fff, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000ec0)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000f00)={'syzkaller0\x00', 0x0}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xc, &(0x7f00000002c0)=0x207, 0x4) sendmsg$kcm(r2, &(0x7f0000000f40)={&(0x7f0000000f80)=@xdp={0x2c, 0xdd86, r7, 0x3e}, 0x80, &(0x7f0000001000)=[{&(0x7f0000001040)="80", 0x1}], 0x1}, 0x4) 923.1138ms ago: executing program 1 (id=1430): socket$nl_generic(0x10, 0x3, 0x10) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$ndb(&(0x7f0000000200), 0x0, 0x8942) syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_usb_connect(0x0, 0x2e, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x644, 0x8047, 0x100, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1c, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x100, 0xa}}]}}]}}]}}, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_PMKSA(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x28, 0x0, 0x1, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac}]}, 0x28}, 0x1, 0x0, 0x0, 0xc0000c1}, 0x40080) sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x20, 0x0, 0x300, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x20}}, 0x24008801) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl(r1, 0xc4c85513, &(0x7f0000000200)) 799.610361ms ago: executing program 5 (id=1431): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c4", 0x250}], 0x1}, 0x0) r2 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="e80000001100"], 0xe8}}, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f00000001c0)={0x1, 0x0, &(0x7f0000f4e000/0x3000)=nil}) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) syz_emit_ethernet(0x86, &(0x7f0000000080)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010106, @local}, @redirect={0xb, 0x0, 0x0, @local, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast2, @multicast2, {[@timestamp_addr={0x44, 0xfffffffffffffef7, 0x0, 0x1, 0x0, [{@remote, 0x4e20fffc}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x3, [{@rand_addr=0x64010102}, {@remote}, {@private=0xa010101}, {@private, 0x800}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@empty}]}]}}}}}}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm], 0x1) 799.433424ms ago: executing program 5 (id=1432): setreuid(0xffffffffffffffff, 0xee00) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x9}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f00000000c0)=[{&(0x7f00000002c0)=""/173, 0xad}, {&(0x7f0000000380)=""/4114, 0x1012}], 0x2, 0x800, 0x4000000) syz_80211_inject_frame(&(0x7f00000013c0)=@broadcast, &(0x7f0000001400)=@ctrl_frame=@bar={{}, {0x80}, @device_a, @device_a, @basic={{0x0, 0x0, 0x0, 0x0, 0x3}, {0x6, 0x1}}}, 0x14) syz_80211_inject_frame(&(0x7f0000001440)=@broadcast, &(0x7f0000001480)=@data_frame={@msdu=@type01={{0x0, 0x2, 0x6, 0x0, 0x1, 0x1, 0x1}, {0x4}, @broadcast, @initial, @broadcast, {0x8, 0x9}}, @a_msdu=[{@broadcast}]}, 0x28) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f0000000080)={&(0x7f00000001c0)={0xa, 0x4e21, 0x80000, @dev={0xfe, 0x80, '\x00', 0x19}}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x5e}}}], 0x18}, 0xc4) 379.690627ms ago: executing program 1 (id=1433): futex(0x0, 0x84, 0x0, 0x0, 0x0, 0xb0090199) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fc"], 0x0) syz_usb_connect$cdc_ecm(0x5, 0x6c, &(0x7f0000000740)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5a, 0x1, 0x1, 0x1, 0x20, 0x71, "", [{{0x9, 0x4, 0x0, 0x7, 0x3, 0x2, 0x6, 0x0, 0x4, {{0xa, 0x24, 0x6, 0x0, 0x0, "79c2131df6"}, {0x5, 0x24, 0x0, 0x8b}, {0xd, 0x24, 0xf, 0x1, 0x5, 0x8, 0x1, 0x80}, [@mbim_extended={0x8, 0x24, 0x1c, 0xb, 0x2, 0x6}, @ncm={0x6, 0x24, 0x1a, 0x7fff, 0x18}, @mbim={0xc, 0x24, 0x1b, 0xe, 0x7, 0x80, 0x4d, 0x2, 0x74}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x8, 0x35, 0x7f, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x4, 0x0, 0x2e}}}}}]}}]}}, &(0x7f0000000980)={0xa, &(0x7f00000007c0)={0xa, 0x6, 0x51, 0x2, 0x8, 0x9, 0x10, 0x81}, 0x36, &(0x7f0000000800)={0x5, 0xf, 0x36, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x2, 0x0, 0x9, 0x1}, @ptm_cap={0x3}, @ssp_cap={0x18, 0x10, 0xa, 0x8, 0x3, 0x159a, 0xf00, 0x200, [0x3f3f, 0xffff0f, 0xff3f00]}, @ptm_cap={0x3}, @ssp_cap={0xc, 0x10, 0xa, 0x9, 0x0, 0x9, 0xf00, 0xfa3}]}, 0x3, [{0x9b, &(0x7f0000000840)=@string={0x9b, 0x3, "1cb703395bc2e0d98278205f5a97a50488a6a0c1e6fb1f3cf616b069b49b3d123e799068359a3fa420fa2185ea74bbb2166486bdd6818d3c8d40b77afbfa6581967c31b5e187c8c46b0db8d44bcddfad93f15c5ee440408d79b28c347ab43d161f41dcab04768eaeae13209707e2394d34e48add2006ab72eddaede3a84f0c6288ca744e02ec84958b3801b119cb18b8aa07699d9e86baa7df"}}, {0x3, &(0x7f0000000900)=@string={0x3, 0x3, "91"}}, {0x3d, &(0x7f0000000940)=@string={0x3d, 0x3, "6d40ece63b4086f510f8f9b3a2ac21932ffaecfd812a8bc44d9353708a1f8bd872477e8fc86bb8ec2d8ef62f2188ffb4c4ee6d059b8328f64f6630"}}]}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000100)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000a00)='./proc\x00', &(0x7f0000000a40)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./proc/net/afs/cells\x00', 0x1, 0x0) write$sndseq(r1, &(0x7f0000000ac0)=[{0x80, 0x8b, 0x9, 0x8, @tick=0x2b3, {0x6, 0x2}, {0x7, 0x1}, @raw32={[0xe415, 0xa, 0x2]}}], 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f00000006c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x2c, 0x2c, 0x9, [@var={0x7, 0x0, 0x0, 0xe, 0x3}, @var={0x7, 0x0, 0x0, 0xe, 0x1}, @ptr={0x0, 0x0, 0x0, 0x2, 0x2}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x4d, 0x0, 0x1}, 0x20) syz_usb_connect$midi(0x4, 0xe0, &(0x7f0000000400)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x7cf, 0x6802, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xce, 0x1, 0x1, 0x2, 0x0, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x8, 0x1, 0x3, 0x40, 0x3, [@ms_header={0x7, 0x24, 0x1, 0x3ff, 0x7}], [{{0x9, 0x5, 0x9, 0xc, 0x40, 0x61, 0x5, 0xc6, {0x14, 0x25, 0x1, 0x10, "2250915b8a7661dc31a10e6b00435c4d"}}}, {{0x9, 0x5, 0x2, 0x1, 0x0, 0xa0, 0x54, 0x9, {0x13, 0x25, 0x1, 0xf, "6ccd2c02d5a410ef3651b222cb4f74"}}}, {{0x9, 0x5, 0x917739e0924f495f, 0x3, 0x40, 0x9, 0x7, 0x1, {0xc, 0x25, 0x1, 0x8, "1ea4a2b525f24907"}}}, {{0x9, 0x5, 0x9, 0x2, 0x10, 0x9, 0x8, 0x10, {0x13, 0x25, 0x1, 0xf, "b25238fab6b35250fbe152c87e098f"}}}, {{0x9, 0x5, 0xb, 0x0, 0x40, 0x1a, 0x2b, 0x5, {0x4}}}, {{0x9, 0x5, 0xe, 0xc, 0x400, 0x7, 0x10, 0x8, {0xa, 0x25, 0x1, 0x6, "48ba90fb5b6b"}}}, {{0x9, 0x5, 0x9, 0x10, 0x200, 0x9, 0x1, 0x8, {0xb, 0x25, 0x1, 0x7, "840a5377bfcf25"}}}, {{0x9, 0x5, 0x4, 0x10, 0x200, 0x9, 0x4, 0x7f, {0xe, 0x25, 0x1, 0xa, "f978b1ca9c03e90e581e"}}}]}}}}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x300, 0x4, 0x7, 0x0, 0x8, 0x1}, 0x46, &(0x7f0000000540)={0x5, 0xf, 0x46, 0x6, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x3, 0x3, 0x5}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "c510d5421c8fcf123fea430c8fddb059"}, @generic={0x15, 0x10, 0x2, "85b74162f720e1d29a84baeb6bfd975d2b98"}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x1, 0x1, 0x5}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x2, 0x1, 0x5}]}, 0x1, [{0x4a, &(0x7f00000005c0)=ANY=[@ANYBLOB="4a03eb69510ea478457f5a78171d1a9b49cc470b92e0e6805a991b65e881e31d070a6e1d43f24da9e5db04f0cf11bb12bc2d3ad16be02e83e52b7f665cf4ee3020d270677355824b449c"]}]}) r2 = open(&(0x7f0000000080)='./file0\x00', 0x60840, 0x5a) fcntl$setlease(r2, 0x400, 0x0) r3 = open(&(0x7f00000003c0)='./file0\x00', 0x80140, 0x38) close_range(r3, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x200}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0xc, &(0x7f0000000200)=@framed={{0x18, 0x8}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}, @func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0, @exit]}, &(0x7f0000000280)='GPL\x00'}, 0x1a) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, r4, 0xf962, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x2}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0xefd, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x5, 0x1}, 0x50) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x5b02, 0x0) ioctl$HIDIOCGUSAGE(r5, 0x5b01, 0x0) syz_usb_disconnect(r0) 237.961706ms ago: executing program 5 (id=1434): r0 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000500)=ANY=[], 0x15) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000540)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f0000000580)={0x14c}, 0x137) r3 = syz_io_uring_setup(0x4588, &(0x7f0000000240)={0x0, 0x948e, 0x0, 0x6, 0x38a}, &(0x7f00000002c0)=0x0, &(0x7f0000000340)=0x0, &(0x7f0000000500)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f00000003c0)={0x2e, 0x41, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x57, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xa8}}}, &(0x7f0000000480)) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='//1#7.0.0.1/\xcb7\xcc\b\\\xd0\xe4\x85\xaf\xbb\x97yshare\x00$kV\xd6c\xa5\x19%\xe53\xefV5q\\\xb2.\x86\xd4\xaa\xcd\x05\xc6Z\x12\xb6R?\xee1\xc5\x80~~h\x95\xbd\xdf\xb2\xe1\x1fK>\xe2\x17\xb6F{\xb9\xd9\x00\x00\x00\x01\xf5+x\n\x1c\x06\xc9\xe1\xd9\xed\x9d3\t\xaa\x93\xcf\x1d\xb0\x02\xc3#\xd4>\x9b\x81/\x8e\v\xd5\xa2\x02_\xfc\x1b\xa7\xe7\x1e\xe4w', 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000005c0)={0x0, 0x1c, &(0x7f0000000380)=[@in6={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, '\x00', 0x33}, 0x6}]}, &(0x7f0000000600)=0x10) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000640)={r7, 0x4}, &(0x7f0000000680)=0x8) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='ip\x00', &(0x7f0000000180)='127.0.0.1\x00', 0x0) syz_open_dev$video(&(0x7f0000000140), 0x0, 0x2) r8 = syz_open_dev$video4linux(&(0x7f00000004c0), 0xf, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(r8, 0xc040563e, &(0x7f0000000200)={0x0, 0x0, 0x3, 0x1, {0x8, 0x4, 0x9, 0x7}}) ioctl$VIDIOC_G_JPEGCOMP(r1, 0x808c563d, &(0x7f00000006c0)) ioctl$VIDIOC_G_SELECTION(r8, 0xc040565e, &(0x7f0000000300)={0x2, 0x0, 0x2, {0x7fffffff, 0x6, 0x9, 0x104d}}) 237.298323ms ago: executing program 5 (id=1435): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_emit_ethernet(0xe, &(0x7f0000000040)={@random="796c9e480769", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}, @void, {@generic={0x892f}}}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = socket$inet6(0xa, 0x3, 0x5) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101a02, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000200)) writev(r4, &(0x7f0000000240)=[{&(0x7f0000000280)="3751f02b82f73ccfc7c431617753f5732f765c975ebce8947e5388c4ff26fa3893119fd147a1576d9456136ab5f15493d175754e4b666e989869d01d418adc376ca22d8077c1b54bea92b5977a41d70ebcc4735ce6c012a5fe5ab7fef98e864216699a235d615ded3292397894b34a794bc14a2edfdc6978c0c97bcb02de69264d", 0x81}, {&(0x7f0000000340)="d0f2c13a3028c25f419badebc5eba629dffd4c836f512ca2b57abe2b67a6665aedfeaa392d738e830b94958751bc4b3721b5f33c04933169a3c1dfb5534eee", 0x3f}], 0x2) fstat(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) openat(r2, &(0x7f0000000380)='./file0\x00', 0x48341, 0x1) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 159.443924ms ago: executing program 5 (id=1436): syz_open_dev$video4linux(&(0x7f0000000200), 0xd, 0x123002) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0x2}, 0x6) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffff, 0x3}, 0x6) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000000140)) fcntl$lock(r1, 0x26, &(0x7f0000000180)={0x1, 0x2, 0x7f, 0x5}) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2d) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000240)="baa000ec6666f20f3066b9f508000066b8536bac1766badac1fc4a0f300f01c83e660f4c8f5f866626660f7ffb653e0f0133660f38815e0d67260fc77801baf80c66b84cbf5a8666efbafc0c66ed", 0x4e}], 0x1, 0x49, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f00000002c0)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x6, 0x0, 0x0) r4 = openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = ioctl$USERFAULTFD_IOC_NEW(r4, 0xaa00) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000340)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x3}) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) mprotect(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0x1) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x1d, &(0x7f00000003c0)=0x62, 0x4) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x28040041, &(0x7f0000000400)={0x2, 0x24e23, @loopback}, 0x10) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r6 = add_key(&(0x7f0000000440)='keyring\x00', &(0x7f0000000480)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r7 = add_key(&(0x7f00000004c0)='asymmetric\x00', 0x0, &(0x7f0000000500)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r6) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r8, 0x0, 0x2a, &(0x7f0000000b00)={0x5, {{0x2, 0x0, @multicast1}}}, 0x88) getsockopt$inet_buf(r8, 0x0, 0x30, &(0x7f0000000bc0)=""/4091, &(0x7f0000001bc0)=0xffb) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000a80)={r7}, &(0x7f0000000ac0)=ANY=[@ANYBLOB='enc=pkcs1 hash=md5)\x00'], 0x0, 0x0) openat$hpet(0xffffffffffffff9c, 0x0, 0x800, 0x0) 159.172654ms ago: executing program 5 (id=1437): ppoll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x4}, {0xffffffffffffffff, 0x4000}], 0x2, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f00000000c0)={[0x8]}, 0xffffffffffffff92) r0 = syz_open_dev$usbfs(&(0x7f0000001380), 0x8000079, 0x301b01) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a40), 0x101400, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000046000/0x18000)=nil, &(0x7f0000000a80)=[@text32={0x20, 0x0}], 0x1, 0x24, 0x0, 0x0) ioctl$KVM_GET_NESTED_STATE(r4, 0xc080aebe, &(0x7f00000013c0)=@vmx={0x2, 0x0, 0x2080, {0x40000, 0x2000, {0x3}, 0x1, 0xfffffffffffffff9}, {"e330483bd2a76f46b241edeef679b0235ac4922d3dc68ceeba9680d17b112b0649f2204758b6318a9aae2d01c53821a3a40ed95541625852dd6f5bfbbc440fc78e0504fd7a75a8d7c45776f928563a404f1c3c2e8e187c059387470731bb9143697bc6c072406d5d77b27de86e5bafb5e25bdc4facbf95b2ced83dfee6d1a2ae097057d60dfae95cbbe87e0aeb0057442e1c67e25c044a511497ac705e303db4e2a668b2a1d7e46196138a9f23af6cf615c0d1bed83278844ebd00bcb48514d3682f9fc2be53bfe011eb7502d9498268543792487d63c46367c7220a64223e3ed47990272d43cd26d8946e248f1d694573969c4c02308036357fcf218e616995e9c4ca9982aee06fe53b7e8eaa8e94deb81435d9b0aafc5868fad4226475c26741e698ff522f8fc56418c6cfc2ced97b4f682f9a78d4ade84e7aed3c7e9c6fe5421438070dfe9f06c79326269ff879fbdefe47e721321554c2d22dc251923c3b4e187eef9233be40a09d7b7c69f5cc5d586f8c427a13d5225e303b5a81fe2764b7f76d4c2ad8585d67e45e02261b8e7647ff2094ca6653366fc648867fbc52e6fda176392f11eaefadc491f3d5753fdaef8637d8a0fe45a85f1be1b8ded9b16acc099e2edc01138fdf058119b6dba8f00286157531922ba0e8482cda53ecb113160be705a794ccb7cf0f41e96755f6f136cec5d9ae77097537b62cb2ac3ef77711c2effb795cf25fbb4b9a7dd8066f39798ed878f1e7275657f7c70e3dedd67767941c9bfd99f051dffc7bee2a1613aedca895e4767124668f7797fed0a388bbc1ba059bc549b65778d26cdee547df0f2c30249cda558c381e11d953b4f3e65d2b27391a8f9179c896afc1233b01b697ffe145bbb61f2179d6206ff68e95fc154f78b6e5f8ab9d6fd18c310193a2a2cc72914daeaf832a36cdc2e01a4636e21c7c4cfc9b0a733e188ee6bf70ddb9fda20339d00451ac177d76f4cbc2af67b9a855b647a9190d5bbc5adc044f148e8e93c5a9594aed71b4e1671c0368eb598ab1605a5c236f1befe688675318dbaa30e02f7eee4409f1e6e04f7c809f19a50ad9979f8166b093d89f89c1564f6119350c38e381c72df1e1411cbb084e03edd9d869195196ccb0c83942cdf9a058bf562baffadd99fec1fd57180207e0106854e7276cd0c2284398fdfafd9c271b39e9fc515d0707cb4680ebd647f3fa3f4edcc9d3f7c9a74abac571749da083e149d29f716100eac48be9e1c36ad22599fe68f77e98e197eb45e586919df031c468104c7d7f132eb9a594ebe9bec9b09d0288e5e0ab995aad4f8af2caf3e97f13c031c11ac4331ecd20c801eabca8100319f54bbb822963380fecb71bf17134b87bc51118e2f8c1bdee2fbaed9637854e3bf2468a32f5842346cf1bc6c61e298379d0d2b081ef278ac3525fadd1eed2d42e912d82a5b71d55f4e193a4e0705614587ffa5fcf782164f63b38bb6a7a352913830116d6125dc84181c0469ed5bf2aabdddc5f7f8e8229f850b0816fa74c8d0ad36c3697ff842dcb79cc6759eb6e3507598bb6ed457e3931b9cfb426b0496512b1fbbe41588064bea53b3771c5cc01af885657ac70bb8f71111c683bacdd71b8c139338dfcfe83b5dcc9de3e58fc3cacac44a0137c570910ac74fe289bc0d54d23d207831ad97870fd0cbe559daef77d11b515054873af3988a904a3479e73fa1d5de954dec2af46e95eb0abe0e312b9b1f42d003edf825a89c3d88be8ffc9b491148acfc7f06c5b5d01461f97ca28f10765d7d7e1a5074d7d9ddea7e1656066964c1ead1cfa9bc8dce0456c41cb8cd1d0956652aa09ca6d7257886fa21fbece01d5b0a679912ec0b39614c0b98ec3b8a648aa7021ffcf7d23e8dd4906c018b55c3e37bba2fe9e19dfd918d48783f7bdea03ea25db097613abc849e8f9041440e0f12b3753f61212d142910a7611629b1fe9df4008867245ffc2f63fc0c8b9db88f16fa8433c6b57ab53e961dc049dc8e370331127fabf810df5cbe51e69659094d4b170d5a59aa20da6729a50b6f9be49752f0e8ae61ff85cd454b150dcfdd446e5acdfad922d74aafc46a42729e745998fbfe93fa34e9928acc883d079e27ab12f8c0e98292567e01a60c8bcad67da010f949dfd8096014747c010cf34cdb0d6e81170318ef492404791c827f5269227b11152cbe91a63cac69cee7c45e5811d8b1790b5e319b6248e49faa45a9b83df19b7a96736805e7aa02c4c4508c9b6fe307ba0f444469f98e9affc738a3ae8880cbf27e32dc2f0798caa06a75bb189eb6da9a14331fd57a750a9b93f0d5c943b3fc1a358b8ec4e4b8dac0b409f25e59c36bff19ed1c7f3054660cbfeeb7497b8e771fd2b6d34bb082cc291ae6a0e71341a07339554c6394e754eb7545471bf1c4bc1f7ef0fd65472c2cd22e4b6c9aab908b6888feea4c5339345197e518c852a9e921c9a3c043e911338f28299e1a87fcd1dbbe7c2582b6207eb21800d268ebf51420966a23ad2dcde42fc8892fa8bac0892ae7675f1930d059c5dbec7b1df65ecee59e3e1c87c3b44ebd8669af044f01005ef157a3004c17a727dd18efe97764a8c5570383da279fc1932f96e0f2c986ae87e99d491de5fc1bfc3176efad11cd5085c45fc92c33c77919161d4f0d035a7b9db217ef69ed1bff8ecd2332c811f52bf54ab0d9e70ae30c04cd8fedb5e69ebe63a3587789fe4604d669a0357cb2e47a6e1f16e4eeadce290678c17a1d0d5efa314fcca86139420014914a627f9741f40e23c0b687102975e47bb699551b1478315ed0122a79604cc43344651e9949948bf0e0133a4872ad306e2382c15779947d5590693af927b7515f72061c518b3de44b6a74465202eed0a8be59dbb6371c118ae014448784f7993b382504401dc161c95966e4d6862b7ed3abb9cf8c512cc9bec1156737981e812014de089d3affa4592641359b08afe42f6b309b0c60359247f95a01dbcdac5d6df6148103b2d08e6ff30d6d92520d18ff8e41ed0ba2d463aeb398ed20bce3fb8878766178246f985c53ce1c0646dad7531b7b4490d37e27537c4c3c3fef82a64a77481bb7820944e70b6e5f34010ac936f63ba56fca9e79b26370de7d48cde03f1c7ff29dd95178641beba009f3f27a9a4c53013661dc18313396210c2ab509d5518fdd09172ebdbcdda4f6d3443100ce2592cee1f548ae790d6f539eae8f6d2f156cfe4fce89773428ec29bdc540d2480069196e020e674997ce092da6fe6425ffda4ba062468b0288555b70a46725d497c2d0a4cb864a60b3a5ba2e0ae7b353ec741c696572f67d8f150e886b2746bace3f66057f06ae208eb8f76609cac7e4f1d42c901090cbfc6ba687dfcffd64e68daecf419cedc7f5cf0c4e4dec27e9056aac484bda8872a1bb3b5c916f6a6a55377cc562888360ffff540a33bd7ea7f03304e2b93998c52ae74663cbf182a24d2b7a01a26609f2e22029445b5ffd4c3016935d62c04062d97b9fb4a5f661e40d8e19834d097713804375d8bbf982bf9ddd0474f6526716c90b2aa114182f8299b317666bc78ac2062467a33cd82aaaa103a255b35c6357b55dfc1d21c7a4f82e99326a5d49ffc943dc9a157bcde9d22caa70006b62002227f01eee22938b7a1abf44f5502893956b14b2debbbd789a6a49b65c1a3957773a83fdee3ccb4b45e6d6bdcb860dd2d886d6ba1e263fcc76c8c0ea90f133635208a4c50b0a54ea63864edd8a53ac222bbc00b02e0cc759289d0b81eeed030ea7115ca3d2c4695afb84cf2a28a978944743b72272e4bff09a8f334019f0523cdc973134ef12e3919e1330de0152eedbe0ce84e92221684ee0a851bc8dc472e479e5ff8dcba65878ecda81f3af004723ef266268b06189e1ea5c83ef91a7bca1c3675e6f8c2f96c0d5cb1911a5586479ca9305375a80a6be69f9e1dedee8651c61dd6483aba447a15190ecb9121051d615cb363c6965ffb7e404ae9bc043aeb263d53f8c94196e38841e8fabb672477a3165ce211b08e7ad60dbaa8c5e0c8ed65073100b9622fcce36c00d18985152e7d08499e78c8cbc286a6b43d50d9a0f8506f162f077d36712047721ea5892ff9aace9d6ade2b1f8b90063509a8dfcaa3724b4115c30d273ed3db06fec36ba635d6f6ab716c1edac1cbee808db939e1c6f01c658c5aaee0c06bb58ce99458907005d5b4038aaf8ddbb869fe75d6e11f3aac85c750cb8f21edd256e5720fe1aa24ada48f23dcba7ce318e5776da4f7998c9d5aa61cf0a2fcbf44721c949522a2b1da1c2cb58a3399e4eb118d00bcaeef139a4a1e979035c03490b9573e38134f2580e8206b8df0ba183d168243a1bd260b4af915aeae25fc7d3c5622e21e8d9cac242b75b08389dac1dc6512304a208e95e333c806f4523287a4723e310e8258740ec84eab3487e4d976f4a7252dbe4b4ba9d3e70a7095431a457039dbe224799d8c8e39b886c45cd493ebef73245baa321b29cf8b4d0864d62d3bfb845eaa6904f924966e017fe4b1e578766cbf67001ea87e358a5439d28f2039595c4519170f4e5e88066ebdaaa82cf8c335f8a88fc5918f2105b330fd34131c57d71b11a442f66c90ca319705b376a30f0460e0119595c36fcc5023502c9c64d71af73b81dd00d9cccd4b3ba2056838a61e349b456f7b4e307ba7b96db3c61e1e6d16ea9bad208298b0b9a7b9af3f16d41f1b804297c4dfe1fc25f37749e5e636bc34a63064feb11fa1b4c7c41b2204951bfc9958b9e399116e737df5e71e8ef72d85d0682a3f14873eaffebe1927428f2c2095d41e92e41088667901f9f284bf384732dcaca75c36aea0cf91c15b8f59f6df1d109fdae08602fa1ca7e4157be6abda48d24d49780ce13bdc823ae3e8e3c1652698ce0b2a2550d0314bc81de54a00f1d5957d26f11cad5320fc5936d476a936e612677f658d9084a42fcbf09f1669be28a139932efaff31d2bc8d3b492500b6e6b4178e378254d758d6d88f7ca1d26f0716e78b4135dceb2ae51c1a1cf29153d90272fa6665267b2cfb0ebbf4213b77c40b4b443051bb2a3594251dc594f54f36254732e7d36440db948c052488e400c6a4f03b5302beb7a2d7902e5d53dbb4cd33cdbfa4ce1044b186098d3f992a3e9e4b32d50f4e9ca20c62e1f9ab8eb4db74e302745dab187370334fd27e81c74070bb5407b2509e7920913f1075c861f66d3e26a6bc0be4d39d4ccd177d7177837bc934ca50900a8cd4de844a28ac30cb68deb681127f00346d6326ac2219f243be9ba6975ad65ad7b40ac1bcc50b77be3c213e510efc8d43963a41c96faf59ceaf839ff5b81d1454e178c2b6e0123bc4695abd6363b9480795a9e9c936ce84ab1feaae3c24a584d3bb09bb5106e861397025be66c1cb8a15bdba0556747938ab6ae851d0826dd3e425d528067f291ae3068a9cda653504eb2869a842759caf07f3781cb4c3b104fc458f0b301429e9c5115c39b3aa2052e107ce73f406774a1735ab34a68b71194be6b7ef41345ecdc5830ec780068bf5550fbf28001819a49f762103850d0e65bf2d1f7265a79d9c4882077f33e9af7591f06a77254632fc0826d13cd8c65dc0ac98b86fd2ad996e11db35adcddcbf048781bbfc124155310133921dcb09502efff3868b693c4e3a8717dc2d8ba8e23cd3d8aefd457cfd52a99be9c89b87bc9d5dd45796d123658f77de4e5e7f7cbb1731fcc68e3e9d8bec8396b6a3366f45f5258ad08cd2acf733ab43eef6d9617576b51f8327a19b06da37ceee4c", "1eaa1116f0d9cd1daf1ebdd267b65e13f17813f1c6c71ce8e842853f1ecad56567d7a7b5a4f267755296bc0b07543617885dd21e1e88d2e799f0dbf9e87be9860b7dc624e890e697ca2319a7a59a0cb2ed4647f572e36370d592d1ce52f7d2c1b62aea35dded940d68dac4bd54ea58714e4054ba2497ed8b9d63ec7243d336a76617688098d57821e6c93bf391e0a6d6a17132a146af6bd7d70c5d0d0abc1c786110ea63b5a8a0f530a6e436077a7721c39e32425909ea048eaa426ce4e0db465b5d6517be720dddf4bfe7c29085a66c903aaaa26f14439be90b411219af108647eb0f8010b7eace5755624d38b5b570796289b17dafeb9f3bf146ea8650afbb4c2abfe040ecac12c516580d3f5aac10b2b5e553df608926ec5fa25dc820d47267d3f1d6a8a6d958ac529d43a381841e6dfc81917fdbc0eb2071806a472cfabbeb44678d6f2471332109169a60a947739cc938cb7a5c0a1e43350b6a782807df96131b70fbf10d7e54dc1c6da9b82dd7adde949377528a44155c53e171179c5c6d94cf60ea39c1d750afc02626eef489886ee5dc759f4cc2381c756f9a1d52c022882821e37a0d399d5b1a248e114712ce70d01363cdc14494a7c7e8bb1589dce1f0bea5a700a6874c11b2c2a0cd8f50d84cc7dd3d04a40ae51a91249a56e3671828f319741caeb1acc440eee0f56e140dc9a70c92510d1ccf8ae780184105e36f6ce9141abafd262752ce74752e33ec8e25d8bc26bceafebb600021a9c7174a6d870c7b2503c6189ecaad01dc44dbeca3649980144532c6db4308407913c67943f7cd0e632bd2f49664607644a9a170700ac88e2e0b2a4b6aeff8634ae318651daedf29a4477aba3d00077321d63bf958aa04e13718d9f6c1d91b3a387f1d94ae55943986dec7dcdad1685a35a82f25ba40b2eee8bc205ac72ca9a8a10f75ff074f92ce6d5c3717e651c31a0aa6cf40076a7e9b0547ebe3cb6f296d1b60d3fd3db9a5ad01f7db2a1f59641cd31387d71d36aae33d958c44ea3883f596d775f56841cd60b2b5268ad3210e2205412c85d94bca39c9e0f485be0ad24babfc6ecf24f82c5cb533473ec2b4c1effa9062c982a2af431d04be8cd06abfb35451758f49f43c962f3499debda32290a65034a78517297c8f689eb023dfddc6b0edca23d8b2e4a938ff14891b3e9140f62e8340dccca84bbd4fcb0de6dd4ee6c7f464ed9b30ea087bdb1def62c3fd38bef7f4ca1a0301bf892d6e6619e05dcf93f648a3cc4980ac88117086485e1dbfbcbd9d8a9030e6131447cae84e5b3baf862f641a6921ce22125af04164dec60a52e88311c93f1a0c2b787b7a4df2bc3c431286665322da7a8c13c53fbfe8ddd325483880dcd24d1cff8b3bf087723ad6336f70f56bed96951cfe6cddf4aa5eaae48a60fd634e1e43ffff785ea74890a93f57024f0d026dadb4d71a92e1d92e615cf20e3c40f50b8f297678dce58a9c7c04836d43ba40475743c48b0b9d832c5f80e3a24edc10d17a9bd33e7ff94fc7bde78ab74cd078319e993d1a4b7464cebdbc1f01d8ec80bf77fb451be31403beaa82fb12f3adc6e1c205bb75f260b551c415fae0f31273ed10c465d9d95062e4a6ffd5416252277e27c250460c31c7e13a146fe2ec0765ca95f1bad84cc9519f96d28237e1815e3e4a3fe73b614caed2805827a0d42431affd2e3da55b315c4111ee6a4ea1c0a868bf54a633b87b5465de127f0bde1157041292660a8618db23155243dce7d6700bd3fbc76716c1efcc707f62942a351edc7f513d5934099e5300ba598a674df51d8c9f37165eb06a639b4f0f9809b98c9d73f49fbae6010b464ac230f04cf6e5a20c8605a197354aa66f908b5b8a79652385eccf0876432179c236f5d80a8fa971832fc15e12a00772ccff130f90989ab2fb7e8ec3d85547af79ba2aef26d018dd74ab4383dd98d5f2b93ae4c594955c09fec7c448465c1f68a5158a8a2ae74f0a1c455e44977d73f38bf6337dc67a7ba30e8f60006aec0f8e9227de92bb9fec0f02940643f48b5a9295c556c214ae2aaafb990af5223e9b959974bd143b050f392ad84b2d071e2f95ff08e23569a4c168f2edc20d4c98d924f9d45b23d72891038c2303ec52e5359adfd3f0cd6d17bc83201ac5b0b671fd9f53a0e37cfe4b0341eed9417ebd13d0a8a5e93e6b53a7680248041ab263506da7a7add676eb2c93062986bade7acedede6c93fab1cc1e4302a297c2f5280a7020dade0080c77810fa408459acfd20a2cc5d4d97f33b59aeed7082a71f055b31b0b12401631d92054866d29920a5b184a90c6cc9672f1bdca807eb231f69683451f73da7287fd5ddb34dc352cfe5c9897fe989b7d9663bb8c9a6f083dd3ee74531da15ae804d3eac193d4ca9ab75cebacd4ab229b77f3b5e640b47b0ea57f749041491d74970da8fedafb60ffc55d7905faa9455b127aff21ffe90b1257e6a03d695d54945879023e92a4333ce3f147a133968b7472b3df227f547fc50b6a484cc6d620ad14fcc5506c2085626fd65437df77a40b7a12ffb006f2c7e9cb01a54e1961037df2bfc102756ef37d32db8b64bb926b9b5874330a599909040f755f2f431af70e1873d2917fd6affd9b618d7e09f3d732bb6e5548f4b7ddd8db69b74a386b7d7fe4131763a8ca89906d070becc00c1bc0b1ca92f783c068d7f22b0f8cf6b3c5d155d15bee82e0c8cbb54b30ea4e2839832a2e4f963a01cccc81307424bb6df61c26810ac3cf9674f957d45591230ee253e19e7f1a798cb108201bd7e338774a14f889718d20f4ecb8e822cea033ff9566cdfcce48eb474ff5558753f3675351e7f9876ba0f645cd549a2f15e8fcdc95210c0033432788b439eba4ea20c3b17fb72e6174df5bcfc8af0db11361a91c3241f7f7a7650a0ccfd786498faddf1b58f7bbdb06926d8ba5a86bbdfaf54e97945a083ed64021518fc846b07ddaf1f154991dd1946bdc99c7ce3262df0d1c8217cdef843c04a31c21bb54ab3b72a8182b97177b92643688dfc9aa08643198cc4222aa6a934bf3fa75afd563d18657ad637a837b0af59fff7e4084e018f646266ee2a33a1186180f101b5c6c5d3e983e30460aab2de39e7f9c9c9e9b6d3a0994dd39d1c17fd1dbea08755f0aff60b36325142d11e2f577a32ecb53485668a9f50dbd16b643f20be336d35f6b77ee240e622d641bd8031510644e41fe2f529bf2d0e84ba513f6000e8391330e82238a57b499f4f6c1d717e2236b96c741becbf64cf7aae457b583c6ce6e2e825154bab680d95f90f672607afc9534ff5f8a4714766b62ab0d067b78ae0d8f1beb5442a33becd31a7d68e4649e73b98e61b1618d75c74ced0403c04c6ed3287abfa5e33d3f3ccaa4e4a835288e8181a8e30afa5c13a5ba172ba9570e72aacb4f567da29c4a44e26b6d18baf777a88b50c89d18c338bbfeb685648ea8f38dc5e40f5c014d34875675db815cc7fcbb7ce9da67326f60eba45ff422ab7c4877f655e5a5a57704c14cf92518ac557a658c6af7cf7ccf33d6eeb01976c5d08b10e662c54d2c7fc6539e7294d6e2c4beec2e8055b6165d919c4ba3b21204e1dcf57ec612dab0821ef7695678d39c7507db75989fa5227caba62874014b63d8fa43776eaa7a36160b35712c7178ba708fa680ed328554502d4ed61de9d1b9a060422c88f2b6dda90c6fe2de4c035c48dd483ca4f4e820d7c447ed065d94f1a8ae7a28a3af3562e134a438c1cc5fc388fb6c944bec58b2258f27346219eea504f004db0156c2264343cf80b0b999250ca6de58c644a51536f64283c8bb8e6a4abfbe58f93bca9e7d5c469d832251fe566735e0a4f12bee290b141b928a7ead8e735166b86c827f6df6885736c42aab8b35f2706a977e61f7a9bf2bd035290312054fd95de14f6ce049c741e9a5b96644210000ff591b638b52699daff8bcd602d01b488bceede446939c3779974081a17e7b90ec002c6f8dbbf0c8e92844bda4fa66d664f943084790c8c81b7988fe82945d8bddd7547f43c321fbb51e7d6be153df11f8db5693c67d816abe20fef21deeb2404bdb9eb9ae81581506c44c11dfda0056bec88f3fe571c93ebeed7587151435416a627b2bbfd8ef988077502691e719fef5a0a71f42fedec82ad48a69a1aa25042a9bade69cbeb66a8db73501d31a35fa441a87485123d96cf121afe308be794ccabaad4804349933a196f2ae5d399fb0904ad4591d55d5c8f03abfa72c1ff50a49b356de8313b0af82e02b292e25f141d6d83a1aac4c8c2a88e8f0107aba80a0a1eb0a02a59c387dc74e345269c1f6f4105b5a58a812b8df69215574d2be5cf522e3014d552237ec3b9c32bcda1974c17681b593744ef8e9edf1d4aa380a76c1de3476124c2e7f78d1924f5979a38ab0511af3d445975194908c01421add726f67aee1b42552c9351cc035e0cf136d8863268c10c8a5faae9dda60c119bb5fa8f653fb0bdb8baa4d300a414e71589ba3fbe4988136f55a0c0a0921c0b6487807218af5074c81d4fca1fc8e2ad9f3c6be06e16946e30ca184b681037ddf2b46daef2c4b6f1c9910efba8613488172d72cebf01d8e8ca87d5af0016a8b99c9cddb9cf8fcf9d8348a37e2eeefb4a730eb06511be9aa22529461592c1537d00c8eb7867bfd6110fec044d617533ad0391389ec6c79776efc39cb90294c8ac99fa29be53c398363bc2e4b59e7ded3f824150561a5626f43ed897eb05647cde2dc99df58f4f3bd3d236ad92f1704e6af87e3d4b31da1565c0360692e9b08838a89a47a096c8e8f26af34f19d4d6214122615fe2e45932847b19a42cc6d51d75f4aa459888f9619dcb96ed3d6d29805cb7091c492396c429c9443c5b6c8f8c3e2cee4697b4063dc4458e10f2a87651314955a60e2781ebb74cdfc831d90feac198c341299959b17c83b21a8590292e357ef7205937e5c30d0d5c7cfcd300d385cc6c4418f671bdd676c40fdd24037fc72b3b8c37c44084ff8b6fca51c6d48815edc4515920ef27668d8cd12289e3de84215f6c2d21db44e84ea5bb176760a5be95975de3489b48dbc083feb5282c7a9b4694042d6b98546d949751e86198efae3ed3e6ec8b883e572f48d1c6edb8f75e3e41e60b7930faff9c95df3b21f378fa1302885bfbd2046f2948137b752ed6245718db4d563c52691ef8e9e22e2c234c26f2b48e12f92e85a8fadc5ef0f1a2bf0d41c2aeb4e231a68d5a35cc5ab8cc01032426ff9185bb8610c1d2557f62272676d8f35747f14a973a5fd719b3bc97fe096f4c21fc43c340e4df309535381cdcf8714973925b653cdb2d9bf82b9c3bc9ea78868699e7a27bc8b1307ca0e8e8e90e86ab03617e842c2b1785af70410ee44eabada4e714b44d1cda39ea1aa882275258a5c06fb45d5830a6d73a32c1c1d1398e0e5ff2d7cc0d795ca164799be8bcec07661ce5218313629532fecbd1e61738244ed3bd3b36d8b637157fd65de263bdee38f7aa262a6481765e64874136f7272aba4ecb4f420aeba1e240b054a07b8b4ca04f239348f332c501160f3edb701f81d62f11ee728e2c02ae875f1c6ca68e7748cee439ed6c5e40e6e2c26cd0cf88aa3651fdefb604dd3aec273da822c47f406f57d9a6eb7bbd1754bb05089ad0c0be78892030e4b48a8a78acf0d4feba606951317a2fc83f59880cf66a53ad10863d0ad16df3f931d3c86a0821abf8f2d206c2aa1c5d106cc0040d9c0c2c2715d7541e5f099f43c9ba3c092d26c1725739f5b9d525d2cc012ce50c13"}}) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000380)={0x0, 0x0}, 0x38) prlimit64(0x0, 0xe, &(0x7f0000000580)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000005c0)=0x8) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000600)=0x2) sched_setscheduler(r5, 0x1, &(0x7f0000000640)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffd000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f00000006c0)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000740), 0x651, 0x0) recvmmsg(r6, &(0x7f0000000780), 0x4000087, 0x2, 0x0) r8 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$MRT6_ADD_MFC(r8, 0x29, 0x22, &(0x7f00000007c0)={{0xa, 0x0, 0x101, @empty}, {0xa, 0x4e22, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x0, {[0x0, 0x0, 0x2, 0xfffffff9, 0x2, 0x1, 0x400]}}, 0x5c) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000840)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000900)=ANY=[@ANYBLOB="b70000000000000095"], &(0x7f0000000940)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x127ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000740), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000780)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r9, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000280)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01002abd7000ffdbdf253900000008000300", @ANYRES32=r11, @ANYBLOB="10005a800c00030005000600000000006af4eade27cd8fb8e7b668a744474f08dcbf5850bdac71c4accd0f8344be89bf5767aa36dd89cf52511bae936191ce1033b667db16751280e2ed7fc1f2887ce7dea6ca249f0bd174c28690010e368effe1fc5fe3c63d73b6c7d90c902486c587c79b29b1090f369ebd4be5915ee83f880689c767029d5cf7ae63f2cb63589432c84635cf6598025434c480234703ebe36a2ecf6dacc7dafbce1d1bdea79fe8dd00b3b60ccaf6cfd02716bb"], 0x2c}, 0x1, 0x0, 0x0, 0x24040887}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000200)={@ipv4={'\x00', '\xff\xff', @empty}, 0x800, 0x0, 0xff, 0x1, 0x0, 0xffff}, 0x20) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e131d"], 0x16) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000100)) ioctl$ECCGETSTATS(0xffffffffffffffff, 0x80104d12, &(0x7f0000000240)) 0s ago: executing program 7 (id=1438): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffdfffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x81, 0xfffffffb, 0xb}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r6, {0x5}, {}, {0xa, 0xa}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x200000, 0x1, 0x9, 0x9, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x100007, 0x8, 0x10, 0x2, 0x6, 0x8001, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xfffffff8, 0xd6, 0x4, 0xfffb, 0x40000007, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0xfffffffe, 0x7, 0x4, 0x99, 0x4000009, 0x5, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x9, 0x1000044, 0x8, 0x8, 0x39e1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x3, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x6, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x7, 0x8, 0x7, 0x1, 0x1, 0x1, 0x5, 0x3c, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0xffffff80, 0x7ffffffc, 0xff, 0x9, 0xa7, 0xf, 0x1, 0x0, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x80485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0x2, 0x6, 0x3ff, 0x40000f04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x50200523, 0xfffffffb, 0x1, 0x0, 0x3, 0x8, 0x5, 0x8, 0x3, 0x0, 0x800, 0x2, 0x8, 0x7ff, 0x1, 0x9, 0x6, 0x4, 0x400001, 0xd, 0x1ff, 0xfffff068, 0x3, 0x429, 0x3, 0x0, 0x200, 0x4, 0x7, 0x2, 0x8, 0x42ba, 0x4, 0x800009, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b1a, 0x9, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x8, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x9, 0x1ff, 0x5, 0x9b4, 0x4, 0x6, 0x0, 0x9, 0x0, 0x9, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7d, 0x7420, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x4, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x7ff, 0x1, 0x1, 0x0, 0x7, 0x196, 0x2, 0x6, 0x0, 0x0, 0x8, 0xc9cd, 0x7f, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x1000000, 0x401, 0x3, 0x6, 0x33, 0x6, 0xfffffffc, 0x8001, 0x6, 0x6, 0x4, 0x5, 0xd, 0x1, 0x2, 0x1, 0x0, 0x3, 0x81, 0x3, 0x3, 0xfffffff5, 0xc9, 0x5, 0x1, 0x10001, 0xc, 0x8001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0x0, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x400, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x8, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x4, 0x9da, 0x4, 0x6, 0xea6, 0x3, 0x5, 0x3, 0x3, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0xf, 0x9, 0xffffffff, 0x5, 0x3, 0x1417, 0x82, 0x7f, 0x9, 0x1, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x9, 0x4, 0x1, 0x7, 0x2, 0xfffffffe, 0x3, 0xb, 0xfffffff7, 0x8, 0xf, 0xc57, 0x5, 0x2, 0x5, 0x8, 0xfffffffc, 0xf, 0xe, 0x1, 0x80000000, 0x5, 0x9, 0x6, 0x8000, 0x40000002, 0x1, 0xffffffff, 0x2, 0x5, 0x4, 0x2, 0x5, 0x5, 0x7, 0x692, 0x7a77, 0x4, 0x0, 0x2, 0x440, 0x1b8c, 0x14, 0x62, 0xc00, 0xa, 0x9, 0x3, 0x8, 0x10001, 0x295, 0x3, 0x9, 0x1, 0xb7e, 0x10001, 0x2, 0x7, 0x4, 0x1, 0x2, 0x103ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d5, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x7ff, 0x7fffffff, 0x80, 0x2, 0x4, 0x2, 0x6, 0x3, 0x270, 0x2, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xbe4, 0xa4a, 0x7, 0x400, 0x20000c, 0xfffffff9, 0x80000000, 0xd, 0x1, 0x9, 0xffe, 0x421, 0x3ff, 0x2, 0x2d, 0x7, 0x5, 0xfffffffc, 0xac, 0x7fff, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000ec0)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000f00)={'syzkaller0\x00', 0x0}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xc, &(0x7f00000002c0)=0x207, 0x4) sendmsg$kcm(r2, &(0x7f0000000f40)={&(0x7f0000000f80)=@xdp={0x2c, 0xdd86, r7, 0x3e}, 0x80, &(0x7f0000001000)=[{&(0x7f0000001040)="80", 0x1}], 0x1}, 0x4) kernel console output (not intermixed with test programs): ASK> [ 124.366857][ T1657] usb 9-1: Using ep0 maxpacket: 16 [ 124.369538][ T1657] usb 9-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 124.370960][ T1657] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 124.370977][ T1657] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 124.372931][ T1657] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.372948][ T1657] usb 9-1: Product: syz [ 124.372959][ T1657] usb 9-1: Manufacturer: syz [ 124.372971][ T1657] usb 9-1: SerialNumber: syz [ 124.376058][ T1657] usb 9-1: config 0 descriptor?? [ 124.409670][ T8656] jffs2: notice: (8656) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 3 of xref (0 dead, 0 orphan) found. [ 124.434273][ T8659] tmpfs: Group quota block hardlimit too large. [ 124.579261][ T8628] comedi comedi2: pcl724: I/O base address or length out of range [ 124.784637][ T8688] jffs2: notice: (8688) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 3 of xref (0 dead, 0 orphan) found. [ 124.787541][ T24] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 124.947605][ T24] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 124.947644][ T24] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 124.948547][ T24] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 124.948582][ T24] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 124.948603][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 124.949439][ T24] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 124.949474][ T24] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 124.949496][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 124.950462][ T24] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 124.950496][ T24] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 124.950517][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 124.951393][ T24] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 124.951428][ T24] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 124.951450][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 124.952354][ T24] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 124.952390][ T24] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 124.952410][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 124.953298][ T24] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 124.953330][ T24] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 124.953350][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 124.954228][ T24] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 124.954263][ T24] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 124.954284][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 124.955137][ T24] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 124.955172][ T24] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 124.955194][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 124.958257][ T24] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 124.958277][ T24] usb 8-1: Product: syz [ 124.958289][ T24] usb 8-1: Manufacturer: syz [ 124.958302][ T24] usb 8-1: SerialNumber: syz [ 124.961661][ T24] usb 8-1: config 0 descriptor?? [ 124.967875][ T24] yurex 8-1:0.0: USB YUREX device now attached to Yurex #0 [ 125.150962][ T5830] syzkaller0: tun_net_xmit 76 [ 125.151209][ T5830] syzkaller0: tun_net_xmit 48 [ 125.152954][ T8698] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 125.152967][ T8698] syzkaller0: Linktype set failed because interface is up [ 125.373919][ T1657] usb 8-1: USB disconnect, device number 16 [ 125.382565][ T1657] yurex 8-1:0.0: USB YUREX #0 now disconnected [ 126.645649][ T43] kauditd_printk_skb: 7 callbacks suppressed [ 126.645669][ T43] audit: type=1400 audit(1792320424.859:945): avc: denied { unmount } for pid=6415 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 126.907393][ T1657] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 126.999617][ T2412] usb 9-1: USB disconnect, device number 15 [ 127.038904][ T1657] usb 10-1: device descriptor read/64, error -71 [ 127.169672][ T8716] Cannot find map_set index 135 as target [ 127.276830][ T1657] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 127.383168][ T8720] jffs2: notice: (8720) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 3 of xref (0 dead, 0 orphan) found. [ 127.406807][ T1657] usb 10-1: device descriptor read/64, error -71 [ 127.517335][ T1657] usb usb10-port1: attempt power cycle [ 127.607686][ T8734] __nla_validate_parse: 3 callbacks suppressed [ 127.607705][ T8734] netlink: 16 bytes leftover after parsing attributes in process `syz.1.849'. [ 127.680159][ T8738] netlink: 'syz.1.851': attribute type 1 has an invalid length. [ 127.722202][ T8738] bond5: entered promiscuous mode [ 127.722611][ T8738] 8021q: adding VLAN 0 to HW filter on device bond5 [ 127.741677][ T8738] vlan4: entered allmulticast mode [ 127.741698][ T8738] bond5: entered allmulticast mode [ 127.757941][ T8738] bond5: (slave bridge2): making interface the new active one [ 127.757965][ T8738] bridge2: entered promiscuous mode [ 127.758094][ T8738] bridge2: entered allmulticast mode [ 127.759406][ T8738] bond5: (slave bridge2): Enslaving as an active interface with an up link [ 127.774124][ T8736] netlink: 8 bytes leftover after parsing attributes in process `syz.3.850'. [ 127.774137][ T8736] netlink: 24 bytes leftover after parsing attributes in process `syz.3.850'. [ 127.845111][ T8743] rxe_eth0 speed is unknown, defaulting to 1000 [ 127.857152][ T1657] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 127.877765][ T1657] usb 10-1: device descriptor read/8, error -71 [ 127.879874][ T8746] netlink: 8 bytes leftover after parsing attributes in process `syz.1.852'. [ 127.906635][ T8748] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_team, syncid = 4, id = 0 [ 127.909948][ T8745] IPVS: stopping backup sync thread 8748 ... [ 128.002101][ T8743] dummy0 speed is unknown, defaulting to 1000 [ 128.116885][ T1657] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 128.137833][ T1657] usb 10-1: device descriptor read/8, error -71 [ 128.250370][ T1657] usb usb10-port1: unable to enumerate USB device [ 128.828142][ T1357] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 128.884844][ T8791] netlink: 12 bytes leftover after parsing attributes in process `syz.1.869'. [ 128.893873][ T8792] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Query Mapping response ret = -22) [ 128.896109][ T8791] xt_bpf: check failed: parse error [ 128.988583][ T1357] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 128.989468][ T1357] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 128.989484][ T1357] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 128.989495][ T1357] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 128.990189][ T1357] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.011909][ T1357] usb 9-1: config 0 descriptor?? [ 129.202620][ T43] audit: type=1400 audit(1792320427.419:946): avc: denied { read write } for pid=8828 comm="syz.3.878" name="threads" dev="nfsd" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 129.204943][ T43] audit: type=1400 audit(1792320427.419:947): avc: denied { open } for pid=8828 comm="syz.3.878" path="/187/nfsd/threads" dev="nfsd" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 129.204971][ T43] audit: type=1400 audit(1792320427.419:948): avc: denied { read } for pid=8828 comm="syz.3.878" name="hpet" dev="devtmpfs" ino=630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 129.204992][ T43] audit: type=1400 audit(1792320427.419:949): avc: denied { open } for pid=8828 comm="syz.3.878" path="/dev/hpet" dev="devtmpfs" ino=630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 129.257531][ T43] audit: type=1400 audit(1792320427.479:950): avc: denied { ioctl } for pid=8828 comm="syz.3.878" path="/dev/hpet" dev="devtmpfs" ino=630 ioctlcmd=0x6806 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 129.284803][ T8832] netlink: 48 bytes leftover after parsing attributes in process `syz.1.879'. [ 129.619053][ T8844] netlink: 'syz.3.882': attribute type 21 has an invalid length. [ 129.619094][ T8844] netlink: 'syz.3.882': attribute type 6 has an invalid length. [ 129.619102][ T8844] netlink: 132 bytes leftover after parsing attributes in process `syz.3.882'. [ 129.643273][ T1357] usbhid 9-1:0.0: can't add hid device: -71 [ 129.643328][ T1357] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 129.656798][ T1357] usb 9-1: USB disconnect, device number 16 [ 129.831785][ T8849] fuse: Invalid rootmode [ 130.198967][ T8857] syzkaller0: entered promiscuous mode [ 130.198987][ T8857] syzkaller0: entered allmulticast mode [ 130.445059][ T43] audit: type=1400 audit(1792320429.659:951): avc: denied { read } for pid=8864 comm="syz.4.889" name="trace_options" dev="tracefs" ino=3588 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 130.453915][ T8867] netlink: 96 bytes leftover after parsing attributes in process `syz.3.890'. [ 130.469888][ T8865] sd 0:0:0:0: PR command failed: 1026 [ 130.469928][ T8865] sd 0:0:0:0: Sense Key : Illegal Request [current] [ 130.469964][ T8865] sd 0:0:0:0: Add. Sense: Invalid command operation code [ 130.474586][ T8865] input: syz0 as /devices/virtual/input/input10 [ 130.593188][ T8874] program syz.3.893 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 130.655282][ T8876] netlink: 'syz.3.894': attribute type 16 has an invalid length. [ 130.655297][ T8876] netlink: 'syz.3.894': attribute type 17 has an invalid length. [ 130.665427][ T8876] bridge2: port 1(erspan0) entered disabled state [ 130.710078][ T8876] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.713855][ T8876] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.735239][ T8876] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 130.735265][ T8876] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 130.743077][ T8876] vlan0: left promiscuous mode [ 130.775161][ T8876] ipvlan2: left allmulticast mode [ 130.775184][ T8876] virt_wifi0: left allmulticast mode [ 130.783088][ T8876] vlan2: left allmulticast mode [ 130.783107][ T8876] bridge2: left allmulticast mode [ 130.976887][ T1357] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 131.106843][ T2412] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 131.127983][ T1357] usb 9-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 131.129114][ T1357] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 131.129134][ T1357] usb 9-1: config 1 has no interface number 0 [ 131.131496][ T1357] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.131516][ T1357] usb 9-1: Product: syz [ 131.131529][ T1357] usb 9-1: Manufacturer: syz [ 131.131542][ T1357] usb 9-1: SerialNumber: syz [ 131.151237][ T1357] usb 9-1: 3:1 : does not exist [ 131.151258][ T1357] usb 9-1: 3:2 : does not exist [ 131.258290][ T2412] usb 8-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 131.260799][ T2412] usb 8-1: config 1 has an invalid interface number: 3 but max is 0 [ 131.260820][ T2412] usb 8-1: config 1 has no interface number 0 [ 131.262377][ T2412] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.262395][ T2412] usb 8-1: Product: syz [ 131.262406][ T2412] usb 8-1: Manufacturer: syz [ 131.262417][ T2412] usb 8-1: SerialNumber: syz [ 131.283726][ T2412] usb 8-1: 3:1 : does not exist [ 131.283746][ T2412] usb 8-1: 3:2 : does not exist [ 131.596605][ T8892] overlayfs: failed to clone upperpath [ 131.663482][ T8896] tipc: Enabling of bearer rejected, failed to enable media [ 131.669182][ T8896] tipc: Enabling of bearer rejected, already enabled [ 131.727695][ T1357] logitech-hidpp-device 0003:046D:C082.0005: unknown main item tag 0x0 [ 131.727721][ T1357] logitech-hidpp-device 0003:046D:C082.0005: unknown main item tag 0x0 [ 131.727733][ T1357] logitech-hidpp-device 0003:046D:C082.0005: unknown main item tag 0x0 [ 131.727745][ T1357] logitech-hidpp-device 0003:046D:C082.0005: unknown main item tag 0x0 [ 131.727757][ T1357] logitech-hidpp-device 0003:046D:C082.0005: unknown main item tag 0x0 [ 131.727769][ T1357] logitech-hidpp-device 0003:046D:C082.0005: unknown main item tag 0x0 [ 131.727781][ T1357] logitech-hidpp-device 0003:046D:C082.0005: unknown main item tag 0x0 [ 131.727793][ T1357] logitech-hidpp-device 0003:046D:C082.0005: unknown main item tag 0x0 [ 131.727829][ T1357] logitech-hidpp-device 0003:046D:C082.0005: unknown main item tag 0x0 [ 131.727842][ T1357] logitech-hidpp-device 0003:046D:C082.0005: unknown main item tag 0x0 [ 131.732709][ T1357] logitech-hidpp-device 0003:046D:C082.0005: hidraw2: USB HID v0.00 Device [syz0] on syz0 [ 131.772224][ T43] audit: type=1400 audit(1792320430.989:952): avc: denied { write } for pid=8899 comm="syz.5.904" name="sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 131.775411][ T8903] fido_id[8903]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 131.814184][ T8906] FAULT_INJECTION: forcing a failure. [ 131.814184][ T8906] name failslab, interval 1, probability 0, space 0, times 0 [ 131.814236][ T8906] CPU: 3 UID: 0 PID: 8906 Comm: syz.5.905 Tainted: G L syzkaller #0 PREEMPT(full) [ 131.814263][ T8906] Tainted: [L]=SOFTLOCKUP [ 131.814270][ T8906] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 131.814283][ T8906] Call Trace: [ 131.814290][ T8906] [ 131.814297][ T8906] dump_stack_lvl+0x100/0x190 [ 131.814378][ T8906] should_fail_ex.cold+0x5/0xa [ 131.814414][ T8906] should_failslab+0xc2/0x120 [ 131.814455][ T8906] __kmalloc_cache_noprof+0x91/0x6d0 [ 131.814476][ T8906] ? __kasan_kmalloc+0xaa/0xb0 [ 131.814502][ T8906] ? __v4l2_subdev_state_alloc+0x53/0x410 [ 131.814560][ T8906] __v4l2_subdev_state_alloc+0x53/0x410 [ 131.814589][ T8906] subdev_open+0xa6/0x510 [ 131.814617][ T8906] v4l2_open+0x1d2/0x490 [ 131.814640][ T8906] ? __pfx_v4l2_open+0x10/0x10 [ 131.814663][ T8906] chrdev_open+0x234/0x6a0 [ 131.814690][ T8906] ? __pfx_chrdev_open+0x10/0x10 [ 131.814715][ T8906] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 131.814750][ T8906] do_dentry_open+0x6ab/0x14d0 [ 131.814773][ T8906] ? __pfx_chrdev_open+0x10/0x10 [ 131.814805][ T8906] vfs_open+0x82/0x3f0 [ 131.814836][ T8906] path_openat+0x1a23/0x2450 [ 131.814868][ T8906] ? __pfx_path_openat+0x10/0x10 [ 131.814901][ T8906] do_file_open+0x20e/0x430 [ 131.814930][ T8906] ? __pfx_do_file_open+0x10/0x10 [ 131.814973][ T8906] ? _raw_spin_unlock+0x28/0x50 [ 131.815031][ T8906] ? alloc_fd+0x471/0x7a0 [ 131.815066][ T8906] do_sys_openat2+0x10f/0x1e0 [ 131.815086][ T8906] ? __pfx_do_sys_openat2+0x10/0x10 [ 131.815103][ T8906] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 131.815136][ T8906] __x64_sys_openat+0x12d/0x210 [ 131.815156][ T8906] ? __pfx___x64_sys_openat+0x10/0x10 [ 131.815184][ T8906] do_syscall_64+0x123/0x790 [ 131.815213][ T8906] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.815231][ T8906] RIP: 0033:0x7f956675ed8e [ 131.815248][ T8906] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 131.815264][ T8906] RSP: 002b:00007f95676ccb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 131.815292][ T8906] RAX: ffffffffffffffda RBX: 00007f95676cd6c0 RCX: 00007f956675ed8e [ 131.815305][ T8906] RDX: 0000000000000000 RSI: 00007f95676ccc00 RDI: ffffffffffffff9c [ 131.815316][ T8906] RBP: 00007f95676ccc00 R08: 0000000000000000 R09: 0000000000000000 [ 131.815327][ T8906] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 131.815351][ T8906] R13: 00007f9566a26038 R14: 00007f9566a25fa0 R15: 00007ffca28567c8 [ 131.815375][ T8906] [ 131.819366][ T8907] FAULT_INJECTION: forcing a failure. [ 131.819366][ T8907] name failslab, interval 1, probability 0, space 0, times 0 [ 131.819387][ T8907] CPU: 2 UID: 0 PID: 8907 Comm: syz.3.898 Tainted: G L syzkaller #0 PREEMPT(full) [ 131.819402][ T8907] Tainted: [L]=SOFTLOCKUP [ 131.819407][ T8907] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 131.819415][ T8907] Call Trace: [ 131.819419][ T8907] [ 131.819423][ T8907] dump_stack_lvl+0x100/0x190 [ 131.819453][ T8907] should_fail_ex.cold+0x5/0xa [ 131.819477][ T8907] should_failslab+0xc2/0x120 [ 131.819495][ T8907] __kmalloc_noprof+0xfc/0x840 [ 131.819509][ T8907] ? rcu_is_watching+0x13/0xc0 [ 131.819537][ T8907] ? tomoyo_realpath_from_path+0xb6/0x690 [ 131.819567][ T8907] tomoyo_realpath_from_path+0xb6/0x690 [ 131.819589][ T8907] tomoyo_path_number_perm+0x23c/0x580 [ 131.819611][ T8907] ? tomoyo_path_number_perm+0x22e/0x580 [ 131.819635][ T8907] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 131.819666][ T8907] ? __lock_acquire+0x5c0/0x1f40 [ 131.819698][ T8907] ? __fget_files+0x34/0x3d0 [ 131.819723][ T8907] ? find_held_lock+0x2b/0x80 [ 131.819747][ T8907] ? hook_file_ioctl_common+0x140/0x440 [ 131.819771][ T8907] ? __fget_files+0x21f/0x3d0 [ 131.819799][ T8907] security_file_ioctl+0xd3/0x230 [ 131.819852][ T8907] __x64_sys_ioctl+0xb7/0x210 [ 131.819875][ T8907] do_syscall_64+0x123/0x790 [ 131.819902][ T8907] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.819925][ T8907] RIP: 0033:0x7f8755d9e559 [ 131.819939][ T8907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 131.819955][ T8907] RSP: 002b:00007f8756c79028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 131.819971][ T8907] RAX: ffffffffffffffda RBX: 00007f8756026090 RCX: 00007f8755d9e559 [ 131.819981][ T8907] RDX: 0000200000000200 RSI: 00000000c4c85513 RDI: 000000000000000b [ 131.819991][ T8907] RBP: 00007f8756c79090 R08: 0000000000000000 R09: 0000000000000000 [ 131.820000][ T8907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 131.820010][ T8907] R13: 00007f8756026128 R14: 00007f8756026090 R15: 00007ffd0c7eb338 [ 131.820034][ T8907] [ 131.820041][ T8907] ERROR: Out of memory at tomoyo_realpath_from_path. [ 132.049983][ T8912] syzkaller0: entered promiscuous mode [ 132.050003][ T8912] syzkaller0: entered allmulticast mode [ 132.159026][ T8918] key id 000004d2 not found [ 132.161159][ T8918] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input11 [ 132.989204][ T1442] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.989257][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.997970][ C2] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:1b [ 133.207929][ T8927] openvswitch: netlink: Flow actions attr not present in new flow. [ 133.245610][ T8929] netlink: 28 bytes leftover after parsing attributes in process `syz.1.914'. [ 133.245672][ T8929] netlink: 'syz.1.914': attribute type 8 has an invalid length. [ 133.245681][ T8929] netlink: 16 bytes leftover after parsing attributes in process `syz.1.914'. [ 133.249688][ T8929] erspan0: entered promiscuous mode [ 133.250665][ T8929] gretap0: entered promiscuous mode [ 133.253822][ T8929] erspan0: left promiscuous mode [ 133.257684][ T8929] gretap0: left promiscuous mode [ 133.502885][ T43] audit: type=1400 audit(1792320432.719:953): avc: denied { create } for pid=8941 comm="syz.1.919" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 134.144897][ T8962] ip_tables: iptables: counters copy to user failed while replacing table [ 134.235868][ T8966] overlayfs: missing 'lowerdir' [ 134.878053][ T43] audit: type=1400 audit(1792320434.099:954): avc: denied { watch watch_reads } for pid=8967 comm="syz.1.928" path="/344/file0" dev="tmpfs" ino=1935 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 134.881147][ T8968] CIFS mount error: No usable UNC path provided in device string! [ 134.881147][ T8968] [ 134.881164][ T8968] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 134.907403][ C3] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:1c [ 135.463921][ T8974] netlink: 8 bytes leftover after parsing attributes in process `syz.1.930'. [ 135.516020][ T8975] netlink: 8 bytes leftover after parsing attributes in process `syz.1.930'. [ 135.802197][ T43] audit: type=1400 audit(1792320435.019:955): avc: denied { setattr } for pid=8979 comm="syz.1.931" name="PACKET" dev="sockfs" ino=28259 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 135.938175][ T43] audit: type=1400 audit(1792320435.159:956): avc: denied { lock } for pid=8983 comm="syz.1.933" path="socket:[28860]" dev="sockfs" ino=28860 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 136.046049][ T8992] netlink: 'syz.1.935': attribute type 21 has an invalid length. [ 136.046067][ T8992] IPv6: NLM_F_CREATE should be specified when creating new route [ 136.046144][ T8992] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 136.046151][ T8992] IPv6: NLM_F_CREATE should be set when creating new route [ 136.046175][ T8992] IPv6: NLM_F_CREATE should be set when creating new route [ 136.046186][ T8992] IPv6: NLM_F_CREATE should be set when creating new route [ 136.398534][ T8997] fuse: fd is not a fuse device [ 136.428393][ T8997] jffs2: notice: (8997) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 3 of xref (0 dead, 0 orphan) found. [ 136.431380][ T8997] overlayfs: missing 'lowerdir' [ 136.558211][ T9003] overlayfs: failed to clone upperpath [ 136.656391][ T43] audit: type=1400 audit(1792320435.869:957): avc: denied { ioctl } for pid=9004 comm="syz.1.939" path="socket:[28876]" dev="sockfs" ino=28876 ioctlcmd=0x128b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 136.843936][ T6548] usb 9-1: USB disconnect, device number 17 [ 136.877235][ T24] usb 8-1: USB disconnect, device number 17 [ 136.947041][ T9020] gfs2: not a GFS2 filesystem [ 136.994028][ T43] audit: type=1400 audit(1792320436.209:958): avc: denied { ioctl } for pid=9023 comm="syz.3.943" path="/196/trace/trace_marker" dev="tracefs" ino=3676 ioctlcmd=0x5829 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 137.004933][ T43] audit: type=1400 audit(1792320436.219:959): avc: denied { mounton } for pid=9023 comm="syz.3.943" path="/196/trace" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 137.164964][ T9036] FAULT_INJECTION: forcing a failure. [ 137.164964][ T9036] name failslab, interval 1, probability 0, space 0, times 0 [ 137.164995][ T9036] CPU: 2 UID: 0 PID: 9036 Comm: syz.3.945 Tainted: G L syzkaller #0 PREEMPT(full) [ 137.165016][ T9036] Tainted: [L]=SOFTLOCKUP [ 137.165023][ T9036] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 137.165034][ T9036] Call Trace: [ 137.165040][ T9036] [ 137.165047][ T9036] dump_stack_lvl+0x100/0x190 [ 137.165078][ T9036] should_fail_ex.cold+0x5/0xa [ 137.165099][ T9036] should_failslab+0xc2/0x120 [ 137.165126][ T9036] kmem_cache_alloc_noprof+0x92/0x6a0 [ 137.165151][ T9036] ? alloc_empty_file+0x5b/0x1c0 [ 137.165174][ T9036] alloc_empty_file+0x5b/0x1c0 [ 137.165190][ T9036] alloc_file_clone+0x5f/0x110 [ 137.165210][ T9036] create_pipe_files+0x40e/0x970 [ 137.165239][ T9036] do_pipe2+0xbd/0x1e0 [ 137.165266][ T9036] ? __pfx_do_pipe2+0x10/0x10 [ 137.165310][ T9036] ? xfd_validate_state+0x129/0x190 [ 137.165338][ T9036] __x64_sys_pipe2+0x54/0x80 [ 137.165365][ T9036] do_syscall_64+0x123/0x790 [ 137.165394][ T9036] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.165414][ T9036] RIP: 0033:0x7f8755d9e559 [ 137.165429][ T9036] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.165446][ T9036] RSP: 002b:00007f8756c9a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000125 [ 137.165464][ T9036] RAX: ffffffffffffffda RBX: 00007f8756025fa0 RCX: 00007f8755d9e559 [ 137.165475][ T9036] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 0000200000001740 [ 137.165484][ T9036] RBP: 00007f8755e35ab8 R08: 0000000000000000 R09: 0000000000000000 [ 137.165491][ T9036] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 137.165501][ T9036] R13: 00007f8756026038 R14: 00007f8756025fa0 R15: 00007ffd0c7eb338 [ 137.165526][ T9036] [ 137.233151][ T9037] CIFS mount error: No usable UNC path provided in device string! [ 137.233151][ T9037] [ 137.233165][ T9037] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 137.486237][ T9044] netlink: 'syz.1.949': attribute type 5 has an invalid length. [ 137.573241][ T9051] syzkaller0: entered promiscuous mode [ 137.573256][ T9051] syzkaller0: entered allmulticast mode [ 137.588237][ T5747] Bluetooth: hci3: unexpected event for opcode 0x0428 [ 138.179090][ T43] audit: type=1400 audit(1792320437.399:960): avc: denied { setopt } for pid=9073 comm="syz.4.960" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 138.249596][ T43] audit: type=1400 audit(1792320437.469:961): avc: denied { create } for pid=9076 comm="syz.1.961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 138.250572][ T43] audit: type=1400 audit(1792320437.469:962): avc: denied { bind } for pid=9076 comm="syz.1.961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 138.251073][ T43] audit: type=1400 audit(1792320437.469:963): avc: denied { accept } for pid=9076 comm="syz.1.961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 138.373073][ T43] audit: type=1400 audit(1792320437.589:964): avc: denied { setopt } for pid=9087 comm="syz.4.965" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 138.456853][ T1357] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 138.587709][ T1357] usb 10-1: device descriptor read/64, error -71 [ 138.631109][ T9112] netlink: 12 bytes leftover after parsing attributes in process `syz.1.972'. [ 138.799126][ T5747] Bluetooth: hci0: unexpected event for opcode 0x0c5b [ 138.826878][ T1357] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 138.957083][ T1357] usb 10-1: device descriptor read/64, error -71 [ 139.067457][ T1357] usb usb10-port1: attempt power cycle [ 139.286619][ T9126] netlink: 8 bytes leftover after parsing attributes in process `syz.1.978'. [ 139.303316][ T9126] bond6: entered allmulticast mode [ 139.316086][ T9126] macvlan2: entered promiscuous mode [ 139.316107][ T9126] macvlan2: entered allmulticast mode [ 139.317270][ T9126] bond6: (slave macvlan2): Opening slave failed [ 139.362340][ T43] audit: type=1400 audit(1792320438.579:965): avc: denied { create } for pid=9125 comm="syz.1.978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 139.406883][ T1357] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 139.428564][ T1357] usb 10-1: device descriptor read/8, error -71 [ 139.513344][ T9138] FAULT_INJECTION: forcing a failure. [ 139.513344][ T9138] name failslab, interval 1, probability 0, space 0, times 0 [ 139.513376][ T9138] CPU: 3 UID: 0 PID: 9138 Comm: syz.4.982 Tainted: G L syzkaller #0 PREEMPT(full) [ 139.513403][ T9138] Tainted: [L]=SOFTLOCKUP [ 139.513416][ T9138] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 139.513428][ T9138] Call Trace: [ 139.513434][ T9138] [ 139.513442][ T9138] dump_stack_lvl+0x100/0x190 [ 139.513479][ T9138] should_fail_ex.cold+0x5/0xa [ 139.513507][ T9138] should_failslab+0xc2/0x120 [ 139.513536][ T9138] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 139.513563][ T9138] ? find_held_lock+0x2b/0x80 [ 139.513587][ T9138] ? kasprintf+0xc7/0x100 [ 139.513637][ T9138] kvasprintf+0xbc/0x150 [ 139.513666][ T9138] ? __pfx_kvasprintf+0x10/0x10 [ 139.513695][ T9138] ? __lock_acquire+0x5c0/0x1f40 [ 139.513724][ T9138] kasprintf+0xc7/0x100 [ 139.513752][ T9138] ? __pfx_kasprintf+0x10/0x10 [ 139.513779][ T9138] ? avc_has_perm_noaudit+0x56/0x470 [ 139.513802][ T9138] ? find_held_lock+0x2b/0x80 [ 139.513828][ T9138] ? avc_has_perm_noaudit+0x11e/0x470 [ 139.513856][ T9138] logfc+0x11c/0x4e0 [ 139.513879][ T9138] ? __pfx_logfc+0x10/0x10 [ 139.513914][ T9138] ceph_get_tree+0x1a36/0x1fd0 [ 139.513938][ T9138] ? bpf_lsm_capable+0x9/0x10 [ 139.513957][ T9138] ? security_capable+0x80/0x260 [ 139.513982][ T9138] vfs_get_tree+0x92/0x320 [ 139.514005][ T9138] vfs_cmd_create+0xd7/0x2a0 [ 139.514029][ T9138] __do_sys_fsconfig+0x55a/0xcb0 [ 139.514055][ T9138] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 139.514093][ T9138] do_syscall_64+0x123/0x790 [ 139.514124][ T9138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.514145][ T9138] RIP: 0033:0x7f737e19e559 [ 139.514162][ T9138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 139.514180][ T9138] RSP: 002b:00007f737efd7028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 139.514200][ T9138] RAX: ffffffffffffffda RBX: 00007f737e425fa0 RCX: 00007f737e19e559 [ 139.514211][ T9138] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000008 [ 139.514221][ T9138] RBP: 00007f737e235ab8 R08: 0000000000000000 R09: 0000000000000000 [ 139.514232][ T9138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 139.514242][ T9138] R13: 00007f737e426038 R14: 00007f737e425fa0 R15: 00007ffd3d828548 [ 139.514268][ T9138] [ 139.666865][ T1357] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 139.688745][ T1357] usb 10-1: device descriptor read/8, error -71 [ 139.797201][ T1357] usb usb10-port1: unable to enumerate USB device [ 139.830561][ T9159] syzkaller0: entered promiscuous mode [ 139.830584][ T9159] syzkaller0: entered allmulticast mode [ 139.894244][ T43] audit: type=1400 audit(1792320439.109:966): avc: denied { mount } for pid=9160 comm="syz.1.990" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 139.907600][ T43] audit: type=1400 audit(1792320439.129:967): avc: denied { getopt } for pid=9160 comm="syz.1.990" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 140.027010][ C3] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:0c [ 140.335090][ T9177] xt_hashlimit: size too large, truncated to 1048576 [ 140.465914][ T9183] netlink: 64 bytes leftover after parsing attributes in process `syz.4.999'. [ 140.806427][ T9190] netlink: 'syz.1.1002': attribute type 1 has an invalid length. [ 140.828267][ T9190] bond7: (slave geneve3): making interface the new active one [ 140.828749][ T9190] bond7: (slave geneve3): Enslaving as an active interface with an up link [ 140.831658][ T9190] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1002'. [ 140.835958][ T9190] 8021q: adding VLAN 0 to HW filter on device bond7 [ 140.848690][ T13] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 140.848716][ T13] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 140.848736][ T13] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 140.848754][ T13] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 141.374639][ T9225] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1016'. [ 141.374738][ T9225] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1016'. [ 141.374820][ T9225] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1016'. [ 141.374899][ T9225] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1016'. [ 141.374983][ T9225] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1016'. [ 141.375067][ T9225] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1016'. [ 141.380805][ T9225] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9225 comm=syz.5.1016 [ 141.626979][ T5744] Bluetooth: hci0: command 0x0c13 tx timeout [ 141.627087][ T5747] Bluetooth: hci0: Opcode 0x0c13 failed: -110 [ 142.103686][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 142.103697][ T43] audit: type=1400 audit(1792320441.319:972): avc: denied { watch_mount } for pid=9243 comm="syz.5.1024" path="/145/file0" dev="tmpfs" ino=793 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 142.371054][ T1130] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) [ 142.378268][ T1130] ata1.00: configured for UDMA/100 [ 142.511251][ T5747] Bluetooth: hci4: command 0x1003 tx timeout [ 142.513135][ T5736] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 142.806909][ T5845] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 142.886479][ T43] audit: type=1326 audit(1792320442.099:973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9243 comm="syz.5.1024" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f956679e559 code=0x7fc00000 [ 142.894246][ T43] audit: type=1326 audit(1792320442.099:974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9243 comm="syz.5.1024" exe="/syz-executor" sig=0 arch=c000003e syscall=323 compat=0 ip=0x7f956679e559 code=0x7fc00000 [ 142.894275][ T43] audit: type=1326 audit(1792320442.099:975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9243 comm="syz.5.1024" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f956679e559 code=0x7fc00000 [ 142.894295][ T43] audit: type=1326 audit(1792320442.099:976): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9243 comm="syz.5.1024" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f956679e559 code=0x7fc00000 [ 142.949168][ T5845] usb 9-1: device descriptor read/64, error -71 [ 143.083799][ T9262] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2051 sclass=netlink_route_socket pid=9262 comm=syz.1.1031 [ 143.092193][ T43] audit: type=1804 audit(1792320442.309:977): pid=9262 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.1031" name="file1" dev="tmpfs" ino=2246 res=1 errno=0 [ 143.135098][ T5736] Bluetooth: hci2: ACL packet for unknown connection handle 0 [ 143.198068][ T5845] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 143.227565][ T42] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 143.326933][ T5845] usb 9-1: device descriptor read/64, error -71 [ 143.397546][ T42] usb 10-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 143.400161][ T42] usb 10-1: config 1 has an invalid interface number: 3 but max is 0 [ 143.400174][ T42] usb 10-1: config 1 has no interface number 0 [ 143.402001][ T42] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.402019][ T42] usb 10-1: Product: syz [ 143.402031][ T42] usb 10-1: Manufacturer: syz [ 143.402042][ T42] usb 10-1: SerialNumber: syz [ 143.414059][ T42] usb 10-1: 3:0 : does not exist [ 143.414070][ T42] usb 10-1: 3:0 : does not exist [ 143.443087][ T5845] usb usb9-port1: attempt power cycle [ 143.713630][ T42] usb 10-1: USB disconnect, device number 22 [ 143.787014][ T5845] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 143.807486][ T5845] usb 9-1: device descriptor read/8, error -71 [ 144.056938][ T5845] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 144.077257][ T5845] usb 9-1: device descriptor read/8, error -71 [ 144.198299][ T5845] usb usb9-port1: unable to enumerate USB device [ 144.256193][ T43] audit: type=1400 audit(1792320443.469:978): avc: denied { write } for pid=9276 comm="syz.5.1035" name="snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 144.256364][ T9277] random: crng reseeded on system resumption [ 144.257237][ T43] audit: type=1400 audit(1792320443.469:979): avc: denied { open } for pid=9276 comm="syz.5.1035" path="/dev/snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 144.264361][ T43] audit: type=1400 audit(1792320443.479:980): avc: denied { ioctl } for pid=9276 comm="syz.5.1035" path="/dev/snapshot" dev="devtmpfs" ino=98 ioctlcmd=0x330d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 144.298885][ T9281] FAULT_INJECTION: forcing a failure. [ 144.298885][ T9281] name failslab, interval 1, probability 0, space 0, times 0 [ 144.298907][ T9281] CPU: 3 UID: 0 PID: 9281 Comm: syz.5.1036 Tainted: G L syzkaller #0 PREEMPT(full) [ 144.298923][ T9281] Tainted: [L]=SOFTLOCKUP [ 144.298927][ T9281] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 144.298933][ T9281] Call Trace: [ 144.298938][ T9281] [ 144.298942][ T9281] dump_stack_lvl+0x100/0x190 [ 144.298964][ T9281] should_fail_ex.cold+0x5/0xa [ 144.298981][ T9281] should_failslab+0xc2/0x120 [ 144.299000][ T9281] kmem_cache_alloc_noprof+0x92/0x6a0 [ 144.299015][ T9281] ? __fget_files+0x215/0x3d0 [ 144.299031][ T9281] ? create_new_namespaces+0x30/0xac0 [ 144.299048][ T9281] create_new_namespaces+0x30/0xac0 [ 144.299065][ T9281] __do_sys_setns+0x213/0x1d90 [ 144.299080][ T9281] ? __pfx___do_sys_setns+0x10/0x10 [ 144.299099][ T9281] do_syscall_64+0x123/0x790 [ 144.299117][ T9281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.299129][ T9281] RIP: 0033:0x7f956679e559 [ 144.299139][ T9281] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 144.299151][ T9281] RSP: 002b:00007f95676cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000134 [ 144.299162][ T9281] RAX: ffffffffffffffda RBX: 00007f9566a25fa0 RCX: 00007f956679e559 [ 144.299169][ T9281] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000c9 [ 144.299176][ T9281] RBP: 00007f9566835ab8 R08: 0000000000000000 R09: 0000000000000000 [ 144.299183][ T9281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 144.299189][ T9281] R13: 00007f9566a26038 R14: 00007f9566a25fa0 R15: 00007ffca28567c8 [ 144.299204][ T9281] [ 144.513357][ T9285] __nla_validate_parse: 31 callbacks suppressed [ 144.513370][ T9285] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1037'. [ 144.515679][ T43] audit: type=1400 audit(1792320443.729:981): avc: denied { watch_mount } for pid=9284 comm="syz.1.1037" path="/403" dev="tmpfs" ino=2263 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 144.609075][ T9300] mac80211_hwsim hwsim5 c@0Ù: renamed from wlan0 (while UP) [ 144.675423][ T9305] tmpfs: Unknown parameter 'usrquotait' [ 144.689070][ T9307] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1043'. [ 145.431159][ T9338] netlink: 'syz.5.1052': attribute type 2 has an invalid length. [ 145.441235][ T9338] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 145.636459][ T9343] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1055'. [ 145.636475][ T9343] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 145.970863][ T9350] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1057'. [ 146.095789][ T9360] Invalid argument reading file caps for ./file0 [ 146.209911][ T9372] ptrace attach of "/syz-executor exec"[9374] was attempted by "/syz-executor exec"[9372] [ 146.466817][ T5822] usb 9-1: new full-speed USB device number 22 using dummy_hcd [ 146.618645][ T5822] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 146.619647][ T5822] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 146.619670][ T5822] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 146.619700][ T5822] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.885566][ T5822] usb 9-1: usb_control_msg returned -32 [ 146.885593][ T5822] usbtmc 9-1:16.0: can't read capabilities [ 147.259496][ T43] kauditd_printk_skb: 9 callbacks suppressed [ 147.259510][ T43] audit: type=1400 audit(1792320446.479:991): avc: denied { write } for pid=9400 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 147.345182][ T43] audit: type=1400 audit(1792320446.559:992): avc: denied { write } for pid=9404 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 147.428839][ T43] audit: type=1400 audit(1792320446.649:993): avc: denied { write } for pid=9412 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 147.517609][ T43] audit: type=1400 audit(1792320446.739:994): avc: denied { write } for pid=9416 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 147.702592][ T42] usb 9-1: USB disconnect, device number 22 [ 147.730177][ T9421] 9p: Could not find request transport: virtioAa [ 148.065878][ T9446] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 148.066352][ T9446] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 148.310112][ T5736] Bluetooth: hci3: unexpected event for opcode 0x0c57 [ 148.423259][ T43] audit: type=1400 audit(1792320447.639:995): avc: denied { append } for pid=9470 comm="syz.4.1086" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 148.446981][ T9473] capability: warning: `syz.1.1085' uses 32-bit capabilities (legacy support in use) [ 148.696427][ T9479] netlink: 'syz.4.1088': attribute type 28 has an invalid length. [ 148.745288][ T9483] FAULT_INJECTION: forcing a failure. [ 148.745288][ T9483] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 148.745320][ T9483] CPU: 0 UID: 0 PID: 9483 Comm: syz.4.1090 Tainted: G L syzkaller #0 PREEMPT(full) [ 148.745336][ T9483] Tainted: [L]=SOFTLOCKUP [ 148.745340][ T9483] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 148.745352][ T9483] Call Trace: [ 148.745362][ T9483] [ 148.745368][ T9483] dump_stack_lvl+0x100/0x190 [ 148.745421][ T9483] should_fail_ex.cold+0x5/0xa [ 148.745454][ T9483] _copy_to_user+0x32/0xd0 [ 148.745482][ T9483] get_array_info+0x6eb/0x960 [ 148.745509][ T9483] ? __pfx_get_array_info+0x10/0x10 [ 148.745525][ T9483] ? blkdev_common_ioctl+0x515/0x2b80 [ 148.745545][ T9483] md_ioctl+0xbb1/0x36d0 [ 148.745564][ T9483] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 148.745584][ T9483] ? __pfx_md_ioctl+0x10/0x10 [ 148.745600][ T9483] ? do_vfs_ioctl+0x226/0x13e0 [ 148.745620][ T9483] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 148.745633][ T9483] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 148.745658][ T9483] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 148.745677][ T9483] ? __fget_files+0x34/0x3d0 [ 148.745695][ T9483] ? __pfx_md_ioctl+0x10/0x10 [ 148.745712][ T9483] blkdev_ioctl+0x5ad/0x6f0 [ 148.745728][ T9483] ? __pfx_blkdev_ioctl+0x10/0x10 [ 148.745744][ T9483] ? selinux_file_ioctl+0x13b/0x290 [ 148.745760][ T9483] ? selinux_file_ioctl+0xb6/0x290 [ 148.745777][ T9483] ? __pfx_blkdev_ioctl+0x10/0x10 [ 148.745794][ T9483] __x64_sys_ioctl+0x18e/0x210 [ 148.745808][ T9483] do_syscall_64+0x123/0x790 [ 148.745849][ T9483] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.745861][ T9483] RIP: 0033:0x7f737e19e559 [ 148.745871][ T9483] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 148.745881][ T9483] RSP: 002b:00007f737efd7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 148.745898][ T9483] RAX: ffffffffffffffda RBX: 00007f737e425fa0 RCX: 00007f737e19e559 [ 148.745905][ T9483] RDX: 0000000000000000 RSI: 0000000080480911 RDI: 0000000000000004 [ 148.745911][ T9483] RBP: 00007f737efd7090 R08: 0000000000000000 R09: 0000000000000000 [ 148.745918][ T9483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 148.745924][ T9483] R13: 00007f737e426038 R14: 00007f737e425fa0 R15: 00007ffd3d828548 [ 148.745938][ T9483] [ 148.838727][ T9486] openvswitch: netlink: Encap mask attribute is set for non-VLAN frame. [ 148.916593][ T43] audit: type=1400 audit(1792320448.129:996): avc: denied { ioctl } for pid=9489 comm="syz.5.1093" path="socket:[31832]" dev="sockfs" ino=31832 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 148.919843][ T43] audit: type=1400 audit(1792320448.139:997): avc: denied { connect } for pid=9489 comm="syz.5.1093" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 149.001547][ T43] audit: type=1400 audit(1792320448.219:998): avc: denied { write } for pid=9491 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 149.063415][ T43] audit: type=1400 audit(1792320448.279:999): avc: denied { write } for pid=9498 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 149.085196][ T9505] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1098'. [ 149.088616][ T9505] ipvlan2: entered allmulticast mode [ 149.088628][ T9505] batadv0: entered allmulticast mode [ 149.090794][ T9505] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 149.154808][ T43] audit: type=1400 audit(1792320448.369:1000): avc: denied { write } for pid=9506 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 ./file0[ 149.391554][ T9526] null_blk: my_zoned_dev: using native zone append [ 149.434923][ T9526] null_blk: disk my_zoned_dev created [ 149.696835][ T9533] serio: Serial port ptm0 [ 150.256982][ T24] usb 9-1: new full-speed USB device number 23 using dummy_hcd [ 150.407514][ T24] usb 9-1: New USB device found, idVendor=28de, idProduct=1205, bcdDevice= 0.00 [ 150.408605][ T24] usb 9-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 150.408630][ T24] usb 9-1: config 0 interface 0 has no altsetting 0 [ 150.408655][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.417028][ T24] usb 9-1: config 0 descriptor?? [ 150.417803][ T9538] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 150.888480][ T24] hid_parser_main: 26 callbacks suppressed [ 150.888497][ T24] hid-steam 0003:28DE:1205.0006: unknown main item tag 0x3 [ 150.888511][ T24] hid-steam 0003:28DE:1205.0006: unknown main item tag 0x0 [ 150.888523][ T24] hid-steam 0003:28DE:1205.0006: unknown main item tag 0x0 [ 150.888535][ T24] hid-steam 0003:28DE:1205.0006: unknown main item tag 0x0 [ 150.888546][ T24] hid-steam 0003:28DE:1205.0006: unknown main item tag 0x0 [ 150.888558][ T24] hid-steam 0003:28DE:1205.0006: unknown main item tag 0x0 [ 150.888569][ T24] hid-steam 0003:28DE:1205.0006: unknown main item tag 0x0 [ 150.888581][ T24] hid-steam 0003:28DE:1205.0006: unknown main item tag 0x0 [ 150.892750][ T24] hid-steam 0003:28DE:1205.0006: : USB HID v0.04 Device [HID 28de:1205] on usb-dummy_hcd.4-1/input0 [ 150.947435][ T24] hid-steam 0003:28DE:1205.0006: steam_register:steam_get_attributes failed with error -22 [ 150.947460][ T24] hid-steam 0003:28DE:1205.0006: Steam Deck 'XXXXXXXXXX' connected [ 150.974688][ T24] input: Steam Deck as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/0003:28DE:1205.0006/input/input13 [ 151.069197][ T24] input: Steam Deck Motion Sensors as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/0003:28DE:1205.0006/input/input14 [ 151.089784][ T24] hid-steam 0003:28DE:1205.0007: unknown main item tag 0x3 [ 151.089803][ T24] hid-steam 0003:28DE:1205.0007: unknown main item tag 0x0 [ 151.135910][ T24] hid-steam 0003:28DE:1205.0007: hidraw2: USB HID v0.04 Device [HID 28de:1205] on usb-dummy_hcd.4-1/input0 [ 151.242798][ T1357] usb 9-1: USB disconnect, device number 23 [ 151.279538][ T1357] hid-steam 0003:28DE:1205.0006: Steam Deck 'XXXXXXXXXX' disconnected [ 151.310657][ T9563] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 151.395025][ T9560] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1113'. [ 151.435744][ T9569] tipc: Enabled bearer , priority 0 [ 151.460913][ T9569] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1116'. [ 151.736148][ T9588] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 151.743163][ T9588] fuse: fd is not a fuse device [ 151.831772][ T9592] rxe_eth0 speed is unknown, defaulting to 1000 [ 151.976426][ T9592] dummy0 speed is unknown, defaulting to 1000 [ 152.156465][ T9598] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1128'. [ 152.156482][ T9598] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1128'. [ 152.161611][ T9598] syzkaller0: entered promiscuous mode [ 152.161624][ T9598] syzkaller0: entered allmulticast mode [ 152.201581][ T9598] CIFS: VFS: Unknown vers= option specified: -òBÓÑ]Ä…RB š,éûˆØgâúWyø‚ã‹ 2"/›­>å4Z Ò„Fö¹YcßIGQ B±*0Ðâ‘’ãÔV&‹S…«“ÉåØmZîÓö)`sååÓAík!OwëìØåë¶zª»ôª‰"õ°RãLÆLñ°|ZuWG4&Þº²á[G [ 152.202680][ T9598] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1128'. [ 152.202704][ T9598] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1128'. [ 152.202718][ T9598] netlink: 'syz.5.1128': attribute type 2 has an invalid length. [ 152.218721][ T9602] bridge_slave_0: left allmulticast mode [ 152.218739][ T9602] bridge_slave_0: left promiscuous mode [ 152.218871][ T9602] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.256389][ T9606] netlink: 'syz.1.1131': attribute type 29 has an invalid length. [ 152.257816][ T9606] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1131'. [ 152.565141][ T5747] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 152.571737][ T5747] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 152.572739][ T5747] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 152.573594][ T5747] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 152.574231][ T5747] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 152.743380][ T9610] ntfs3(sr0): Primary boot signature is not NTFS. [ 152.743751][ T9610] ntfs3(sr0): try to read out of volume at offset 0xf800 [ 152.874254][ T9612] rxe_eth0 speed is unknown, defaulting to 1000 [ 152.945254][ T9604] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input15 [ 153.154868][ T9612] dummy0 speed is unknown, defaulting to 1000 [ 153.433879][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 153.433892][ T43] audit: type=1400 audit(1792320452.649:1011): avc: denied { mounton } for pid=9670 comm="syz.4.1144" path="/196/file0" dev="tmpfs" ino=1087 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 153.437958][ T43] audit: type=1400 audit(1792320452.659:1012): avc: denied { open } for pid=9670 comm="syz.4.1144" path="/dev/ptyqc" dev="devtmpfs" ino=139 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 153.438862][ T43] audit: type=1400 audit(1792320452.659:1013): avc: denied { ioctl } for pid=9670 comm="syz.4.1144" path="/dev/ptyqc" dev="devtmpfs" ino=139 ioctlcmd=0x4b60 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 153.504177][ T9612] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.504360][ T9612] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.504455][ T9612] bridge_slave_0: entered allmulticast mode [ 153.505744][ T9612] bridge_slave_0: entered promiscuous mode [ 153.508297][ T9612] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.508410][ T9612] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.508499][ T9612] bridge_slave_1: entered allmulticast mode [ 153.509819][ T9612] bridge_slave_1: entered promiscuous mode [ 153.526026][ T9612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 153.528300][ T9612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 153.541762][ T9612] team0: Port device team_slave_0 added [ 153.544646][ T9612] team0: Port device team_slave_1 added [ 153.555333][ T9676] FAULT_INJECTION: forcing a failure. [ 153.555333][ T9676] name failslab, interval 1, probability 0, space 0, times 0 [ 153.555355][ T9676] CPU: 0 UID: 0 PID: 9676 Comm: syz.4.1145 Tainted: G L syzkaller #0 PREEMPT(full) [ 153.555372][ T9676] Tainted: [L]=SOFTLOCKUP [ 153.555376][ T9676] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 153.555384][ T9676] Call Trace: [ 153.555389][ T9676] [ 153.555394][ T9676] dump_stack_lvl+0x100/0x190 [ 153.555429][ T9676] should_fail_ex.cold+0x5/0xa [ 153.555453][ T9676] should_failslab+0xc2/0x120 [ 153.555473][ T9676] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 153.555490][ T9676] ? __alloc_skb+0x140/0x710 [ 153.555510][ T9676] __alloc_skb+0x140/0x710 [ 153.555520][ T9676] ? __alloc_skb+0x5b7/0x710 [ 153.555530][ T9676] ? __pfx___alloc_skb+0x10/0x10 [ 153.555540][ T9676] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 153.555557][ T9676] ? pfkey_xfrm_policy2msg_size+0x207/0x250 [ 153.555589][ T9676] pfkey_send_policy_notify+0x14e/0x8c0 [ 153.555606][ T9676] ? __pfx_pfkey_send_policy_notify+0x10/0x10 [ 153.555625][ T9676] km_policy_notify+0xb3/0x240 [ 153.555640][ T9676] xfrm_add_policy+0x452/0x6c0 [ 153.555657][ T9676] ? rcu_is_watching+0x13/0xc0 [ 153.555675][ T9676] ? __pfx_xfrm_add_policy+0x10/0x10 [ 153.555695][ T9676] ? __nla_parse+0x40/0x60 [ 153.555749][ T9676] ? __pfx_xfrm_add_policy+0x10/0x10 [ 153.555767][ T9676] xfrm_user_rcv_msg+0x483/0xd80 [ 153.555785][ T9676] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 153.555800][ T9676] ? kfree_skbmem+0x19f/0x210 [ 153.555817][ T9676] ? consume_skb+0xd6/0x110 [ 153.555849][ T9676] ? rcu_is_watching+0x13/0xc0 [ 153.555871][ T9676] ? trace_contention_end+0x126/0x160 [ 153.555887][ T9676] ? __mutex_lock+0x26c/0x1bd0 [ 153.555915][ T9676] netlink_rcv_skb+0x159/0x420 [ 153.555928][ T9676] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 153.555942][ T9676] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 153.555964][ T9676] xfrm_netlink_rcv+0x71/0x90 [ 153.555977][ T9676] netlink_unicast+0x65f/0x950 [ 153.555992][ T9676] ? __pfx_netlink_unicast+0x10/0x10 [ 153.556008][ T9676] netlink_sendmsg+0x8b0/0xda0 [ 153.556022][ T9676] ? __pfx_netlink_sendmsg+0x10/0x10 [ 153.556035][ T9676] ? selinux_socket_sendmsg+0x198/0x2f0 [ 153.556061][ T9676] ____sys_sendmsg+0xa4d/0xbe0 [ 153.556075][ T9676] ? __pfx_netlink_sendmsg+0x10/0x10 [ 153.556088][ T9676] ? __pfx_____sys_sendmsg+0x10/0x10 [ 153.556106][ T9676] ? plist_check_list+0x1b8/0x280 [ 153.556119][ T9676] ? plist_del+0x308/0x510 [ 153.556134][ T9676] ___sys_sendmsg+0x190/0x1e0 [ 153.556151][ T9676] ? __pfx____sys_sendmsg+0x10/0x10 [ 153.556167][ T9676] ? futex_wake+0x220/0x5e0 [ 153.556187][ T9676] ? find_held_lock+0x2b/0x80 [ 153.556214][ T9676] __sys_sendmsg+0x160/0x210 [ 153.556227][ T9676] ? __pfx___sys_sendmsg+0x10/0x10 [ 153.556248][ T9676] do_syscall_64+0x123/0x790 [ 153.556265][ T9676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.556278][ T9676] RIP: 0033:0x7f737e19e559 [ 153.556288][ T9676] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 153.556299][ T9676] RSP: 002b:00007f737efd7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 153.556317][ T9676] RAX: ffffffffffffffda RBX: 00007f737e425fa0 RCX: 00007f737e19e559 [ 153.556324][ T9676] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 153.556332][ T9676] RBP: 00007f737e235ab8 R08: 0000000000000000 R09: 0000000000000000 [ 153.556339][ T9676] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 153.556346][ T9676] R13: 00007f737e426038 R14: 00007f737e425fa0 R15: 00007ffd3d828548 [ 153.556363][ T9676] [ 153.578634][ T9612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 153.578645][ T9612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 153.578658][ T9612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 153.579546][ T9612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 153.579554][ T9612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 153.579567][ T9612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 153.614825][ T9612] hsr_slave_0: entered promiscuous mode [ 153.617001][ T9612] hsr_slave_1: entered promiscuous mode [ 153.617519][ T9612] debugfs: 'hsr0' already exists in 'hsr' [ 153.617532][ T9612] Cannot create hsr debugfs directory [ 153.792947][ T9612] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 153.795379][ T9612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 153.796017][ T9612] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 153.801127][ T9612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 153.802574][ T9612] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 153.805659][ T9612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 153.806145][ T9612] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 153.812550][ T9612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 153.858881][ T9612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 153.874284][ T9612] 8021q: adding VLAN 0 to HW filter on device team0 [ 153.883151][ T7974] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.883238][ T7974] bridge0: port 1(bridge_slave_0) entered forwarding state [ 153.892592][ T7974] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.892639][ T7974] bridge0: port 2(bridge_slave_1) entered forwarding state [ 153.919056][ T9700] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 153.919593][ T9696] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 153.983837][ T9710] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 153.998465][ T9705] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1152'. [ 154.167328][ T9612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 154.343235][ T9612] veth0_vlan: entered promiscuous mode [ 154.350870][ T9612] veth1_vlan: entered promiscuous mode [ 154.371296][ T9612] veth0_macvtap: entered promiscuous mode [ 154.375070][ T9612] veth1_macvtap: entered promiscuous mode [ 154.386459][ T9612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 154.392633][ T9612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 154.443940][ T5830] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.444184][ T5830] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.444457][ T5830] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.444487][ T5830] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.513164][ T7977] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 154.513182][ T7977] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 154.538993][ T7974] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 154.539012][ T7974] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 154.678302][ T5736] Bluetooth: hci4: command tx timeout [ 154.906928][ T6548] usb 11-1: new low-speed USB device number 2 using dummy_hcd [ 155.009110][ T9751] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 155.036833][ T6548] usb 11-1: device descriptor read/64, error -71 [ 155.226151][ T9776] overlayfs: failed to clone upperpath [ 155.231352][ T43] audit: type=1400 audit(1792320454.449:1014): avc: denied { getopt } for pid=9775 comm="syz.1.1172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 155.276881][ T6548] usb 11-1: new low-speed USB device number 3 using dummy_hcd [ 155.330883][ T43] audit: type=1400 audit(1792320454.549:1015): avc: denied { write } for pid=9782 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 155.399987][ T43] audit: type=1400 audit(1792320454.619:1016): avc: denied { write } for pid=9791 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 155.407571][ T6548] usb 11-1: device descriptor read/64, error -71 [ 155.458114][ T9800] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1177'. [ 155.458164][ T9800] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1177'. [ 155.506194][ T43] audit: type=1400 audit(1792320454.719:1017): avc: denied { write } for pid=9801 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 155.531617][ T6548] usb usb11-port1: attempt power cycle [ 155.561683][ T43] audit: type=1400 audit(1792320454.779:1018): avc: denied { write } for pid=9805 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 155.584322][ T9808] fuse: Bad value for 'fd' [ 155.660084][ T43] audit: type=1400 audit(1792320454.879:1019): avc: denied { write } for pid=9809 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 155.703205][ T43] audit: type=1400 audit(1792320454.919:1020): avc: denied { write } for pid=9821 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 155.842582][ T9833] batadv_slave_0: entered promiscuous mode [ 155.843116][ T9833] batadv_slave_0: left promiscuous mode [ 155.866955][ T6548] usb 11-1: new low-speed USB device number 4 using dummy_hcd [ 155.887637][ T6548] usb 11-1: device descriptor read/8, error -71 [ 155.950970][ T9839] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 155.969174][ T9842] fuse: Bad value for 'fd' [ 156.147465][ T6548] usb 11-1: new low-speed USB device number 5 using dummy_hcd [ 156.168670][ T6548] usb 11-1: device descriptor read/8, error -71 [ 156.277186][ T6548] usb usb11-port1: unable to enumerate USB device [ 156.283316][ T9862] nbd: must specify at least one socket [ 156.321000][ T9865] i2c i2c-1: Frontend requested software zigzag, but didn't set the frequency step size [ 156.405141][ T9867] CacheFiles: Failed to register: -95 [ 156.431161][ T9869] nvme_rdma: malformed address passed: 1:4420 [ 156.606842][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.630285][ T9886] tipc: Started in network mode [ 156.630297][ T9886] tipc: Node identity 4, cluster identity 5 [ 156.630303][ T9886] tipc: Node number set to 4 [ 156.631129][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.654784][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.674007][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.693026][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.712619][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.737300][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.757802][ T5736] Bluetooth: hci4: command tx timeout [ 156.764240][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.793077][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.810880][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.827433][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.843209][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.862023][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.881622][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.898370][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.920173][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.939018][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.956690][ T9905] fuse: fd is not a fuse device [ 156.965005][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 156.989430][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.011064][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.032730][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.053741][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.074524][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.095498][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.118555][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.146638][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.168229][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.188588][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.217185][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.249958][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.278657][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.306474][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.326626][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.348619][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.365133][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.381625][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.403060][ T9876] nvme_rdma: malformed address passed: 1:4420 [ 157.737870][ T9944] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 157.858592][ T9956] warning: `syz.6.1216' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 157.906916][ T2412] usb 10-1: new high-speed USB device number 23 using dummy_hcd [ 158.058511][ T2412] usb 10-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 158.059596][ T2412] usb 10-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 158.063720][ T2412] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.063739][ T2412] usb 10-1: Product: syz [ 158.063752][ T2412] usb 10-1: Manufacturer: syz [ 158.063764][ T2412] usb 10-1: SerialNumber: syz [ 158.172450][ T9974] netlink: 'syz.1.1224': attribute type 1 has an invalid length. [ 158.203164][ T9974] ipvlan3: entered allmulticast mode [ 158.203180][ T9974] bridge0: entered allmulticast mode [ 158.203355][ T9974] bond8: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 158.203366][ T9974] bond8: (slave ipvlan3): The slave device specified does not support setting the MAC address [ 158.203374][ T9974] bond8: (slave ipvlan3): Setting fail_over_mac to active for active-backup mode [ 158.237007][ T9977] rxe_eth0 speed is unknown, defaulting to 1000 [ 158.274395][ T9938] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.274717][ T9938] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.276549][ T2412] usb 10-1: Cannot retrieve CPort count: -32 [ 158.276571][ T2412] usb 10-1: Cannot retrieve CPort count: -32 [ 158.276584][ T2412] es2_ap_driver 10-1:1.0: probe with driver es2_ap_driver failed with error -32 [ 158.394195][ T9977] dummy0 speed is unknown, defaulting to 1000 [ 158.625924][ T9998] netlink: 'syz.6.1233': attribute type 4 has an invalid length. [ 158.625944][ T9998] __nla_validate_parse: 2 callbacks suppressed [ 158.625957][ T9998] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1233'. [ 158.728656][T10013] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1239'. [ 158.728680][T10013] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1239'. [ 158.769106][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 158.769119][ T43] audit: type=1400 audit(1792320457.979:1025): avc: denied { mount } for pid=10006 comm="syz.6.1237" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 158.804001][ T43] audit: type=1400 audit(1792320458.019:1026): avc: denied { read } for pid=6413 comm="syz-executor" name="loop4" dev="devtmpfs" ino=660 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 158.804239][T10012] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 158.804320][ T43] audit: type=1400 audit(1792320458.019:1027): avc: denied { open } for pid=6413 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=660 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 158.804599][ T43] audit: type=1400 audit(1792320458.019:1028): avc: denied { ioctl } for pid=6413 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=660 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 158.827184][ T5736] Bluetooth: hci4: command tx timeout [ 158.856138][T10024] syzkaller0: entered promiscuous mode [ 158.856157][T10024] syzkaller0: entered allmulticast mode [ 158.858990][ T13] 0: reclassify loop, rule prio 0, protocol 700 [ 158.892224][T10024] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 158.957995][T10026] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1241'. [ 158.959634][ T43] audit: type=1400 audit(1792320459.184:1029): avc: denied { mounton } for pid=10025 comm="syz.6.1241" path="/13/proc" dev="tmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 158.960492][T10026] FAULT_INJECTION: forcing a failure. [ 158.960492][T10026] name failslab, interval 1, probability 0, space 0, times 0 [ 158.960513][T10026] CPU: 2 UID: 0 PID: 10026 Comm: syz.6.1241 Tainted: G L syzkaller #0 PREEMPT(full) [ 158.960529][T10026] Tainted: [L]=SOFTLOCKUP [ 158.960533][T10026] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 158.960540][T10026] Call Trace: [ 158.960545][T10026] [ 158.960550][T10026] dump_stack_lvl+0x100/0x190 [ 158.960573][T10026] should_fail_ex.cold+0x5/0xa [ 158.960591][T10026] should_failslab+0xc2/0x120 [ 158.960610][T10026] __kmalloc_noprof+0xfc/0x840 [ 158.960624][T10026] ? load_msg+0x118/0x4a0 [ 158.960640][T10026] load_msg+0x118/0x4a0 [ 158.960653][T10026] do_msgsnd+0x1ad/0x1790 [ 158.960669][T10026] ? __pfx_do_msgsnd+0x10/0x10 [ 158.960682][T10026] ? find_held_lock+0x2b/0x80 [ 158.960699][T10026] ? __might_fault+0xc5/0x140 [ 158.960710][T10026] ? __might_fault+0xc5/0x140 [ 158.960726][T10026] ? __x64_sys_msgsnd+0xe5/0x130 [ 158.960738][T10026] __x64_sys_msgsnd+0xe5/0x130 [ 158.960752][T10026] do_syscall_64+0x123/0x790 [ 158.960771][T10026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.960783][T10026] RIP: 0033:0x7f935699e559 [ 158.960793][T10026] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.960804][T10026] RSP: 002b:00007f9357843028 EFLAGS: 00000246 ORIG_RAX: 0000000000000045 [ 158.960816][T10026] RAX: ffffffffffffffda RBX: 00007f9356c25fa0 RCX: 00007f935699e559 [ 158.960823][T10026] RDX: 0000000000002000 RSI: 0000200000000500 RDI: 0000000000000000 [ 158.960830][T10026] RBP: 00007f9356a35ab8 R08: 0000000000000000 R09: 0000000000000000 [ 158.960837][T10026] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000 [ 158.960843][T10026] R13: 00007f9356c26038 R14: 00007f9356c25fa0 R15: 00007ffe4d1339b8 [ 158.960859][T10026] [ 158.961213][T10026] netlink: 'syz.6.1241': attribute type 21 has an invalid length. [ 159.140312][T10030] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1243'. [ 159.140347][T10030] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1243'. [ 159.140675][T10030] FAULT_INJECTION: forcing a failure. [ 159.140675][T10030] name failslab, interval 1, probability 0, space 0, times 0 [ 159.140710][T10030] CPU: 0 UID: 0 PID: 10030 Comm: syz.4.1243 Tainted: G L syzkaller #0 PREEMPT(full) [ 159.140757][T10030] Tainted: [L]=SOFTLOCKUP [ 159.140765][T10030] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 159.140777][T10030] Call Trace: [ 159.140785][T10030] [ 159.140794][T10030] dump_stack_lvl+0x100/0x190 [ 159.140829][T10030] should_fail_ex.cold+0x5/0xa [ 159.140860][T10030] should_failslab+0xc2/0x120 [ 159.140891][T10030] __kmalloc_cache_noprof+0x91/0x6d0 [ 159.140914][T10030] ? __debug_object_init+0x2de/0x3d0 [ 159.140935][T10030] ? hsr_add_port+0x261/0xcb0 [ 159.140964][T10030] hsr_add_port+0x261/0xcb0 [ 159.140992][T10030] ? __pfx_hsr_add_port+0x10/0x10 [ 159.141015][T10030] ? lockdep_init_map_type+0x5c/0x250 [ 159.141042][T10030] ? timer_init_key+0x150/0x310 [ 159.141072][T10030] hsr_dev_finalize+0x645/0xd60 [ 159.141104][T10030] hsr_newlink+0x45b/0xa90 [ 159.141129][T10030] ? __pfx_hsr_newlink+0x10/0x10 [ 159.141152][T10030] ? rtnl_create_link+0xa4b/0xf80 [ 159.141179][T10030] ? __pfx_hsr_newlink+0x10/0x10 [ 159.141201][T10030] rtnl_newlink+0x1697/0x2620 [ 159.141233][T10030] ? __pfx_rtnl_newlink+0x10/0x10 [ 159.141254][T10030] ? avc_has_perm_noaudit+0x56/0x470 [ 159.141278][T10030] ? find_held_lock+0x2b/0x80 [ 159.141305][T10030] ? avc_has_perm_noaudit+0x11e/0x470 [ 159.141327][T10030] ? avc_has_perm_noaudit+0x11e/0x470 [ 159.141376][T10030] ? lock_acquire+0x1d1/0x380 [ 159.141399][T10030] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 159.141422][T10030] ? find_held_lock+0x2b/0x80 [ 159.141449][T10030] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 159.141472][T10030] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 159.141497][T10030] ? __pfx_rtnl_newlink+0x10/0x10 [ 159.141520][T10030] rtnetlink_rcv_msg+0x95e/0xe90 [ 159.141548][T10030] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 159.141575][T10030] ? __lock_acquire+0x5c0/0x1f40 [ 159.141637][T10030] netlink_rcv_skb+0x159/0x420 [ 159.141659][T10030] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 159.141685][T10030] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 159.141721][T10030] ? netlink_deliver_tap+0x1ae/0xcc0 [ 159.141756][T10030] netlink_unicast+0x65f/0x950 [ 159.141782][T10030] ? __pfx_netlink_unicast+0x10/0x10 [ 159.141810][T10030] netlink_sendmsg+0x8b0/0xda0 [ 159.141836][T10030] ? __pfx_netlink_sendmsg+0x10/0x10 [ 159.141860][T10030] ? selinux_socket_sendmsg+0x198/0x2f0 [ 159.141893][T10030] ____sys_sendmsg+0xa4d/0xbe0 [ 159.141918][T10030] ? __pfx_netlink_sendmsg+0x10/0x10 [ 159.141941][T10030] ? __pfx_____sys_sendmsg+0x10/0x10 [ 159.141978][T10030] ___sys_sendmsg+0x190/0x1e0 [ 159.142008][T10030] ? __pfx____sys_sendmsg+0x10/0x10 [ 159.142035][T10030] ? futex_wait+0x11e/0x370 [ 159.142070][T10030] ? find_held_lock+0x2b/0x80 [ 159.142118][T10030] __sys_sendmsg+0x160/0x210 [ 159.142141][T10030] ? __pfx___sys_sendmsg+0x10/0x10 [ 159.142178][T10030] do_syscall_64+0x123/0x790 [ 159.142209][T10030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.142230][T10030] RIP: 0033:0x7f737e19e559 [ 159.142248][T10030] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.142268][T10030] RSP: 002b:00007f737efd7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 159.142288][T10030] RAX: ffffffffffffffda RBX: 00007f737e425fa0 RCX: 00007f737e19e559 [ 159.142304][T10030] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000008 [ 159.142315][T10030] RBP: 00007f737e235ab8 R08: 0000000000000000 R09: 0000000000000000 [ 159.142328][T10030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 159.142339][T10030] R13: 00007f737e426038 R14: 00007f737e425fa0 R15: 00007ffd3d828548 [ 159.142369][T10030] [ 159.165148][T10030] rxe_eth0 speed is unknown, defaulting to 1000 [ 159.289711][T10030] dummy0 speed is unknown, defaulting to 1000 [ 159.335144][ T43] audit: type=1400 audit(1792320459.544:1030): avc: denied { getopt } for pid=10033 comm="syz.1.1244" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 159.454939][ T43] audit: type=1400 audit(1792320459.664:1031): avc: denied { watch } for pid=10040 comm="syz.4.1247" path="/dev/pts/0" dev="devpts" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_devpts_t tclass=chr_file permissive=1 [ 159.600496][T10047] netlink: 'syz.6.1248': attribute type 15 has an invalid length. [ 159.616247][T10047] vxlan0: entered promiscuous mode [ 159.616262][T10047] vxlan0: entered allmulticast mode [ 159.626889][ T5546] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 31488 - 0 [ 159.626922][ T5546] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 31488 - 0 [ 159.626941][ T5546] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 31488 - 0 [ 159.626962][ T5546] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 31488 - 0 [ 159.708541][ T43] audit: type=1400 audit(1792320459.924:1032): avc: denied { listen } for pid=10050 comm="syz.4.1250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 159.721737][T10052] openvswitch: netlink: IPv4 tunnel dst address is zero [ 159.755618][T10054] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5127 sclass=netlink_route_socket pid=10054 comm=syz.5.1209 [ 159.766997][T10056] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 159.772150][ T43] audit: type=1326 audit(1792320459.984:1033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10055 comm="syz.4.1252" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f737e19e559 code=0x0 [ 159.841559][T10060] FAULT_INJECTION: forcing a failure. [ 159.841559][T10060] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 159.841581][T10060] CPU: 3 UID: 0 PID: 10060 Comm: syz.6.1254 Tainted: G L syzkaller #0 PREEMPT(full) [ 159.841597][T10060] Tainted: [L]=SOFTLOCKUP [ 159.841601][T10060] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 159.841609][T10060] Call Trace: [ 159.841613][T10060] [ 159.841617][T10060] dump_stack_lvl+0x100/0x190 [ 159.841638][T10060] should_fail_ex.cold+0x5/0xa [ 159.841655][T10060] _copy_to_user+0x32/0xd0 [ 159.841673][T10060] simple_read_from_buffer+0xcb/0x170 [ 159.841705][T10060] proc_fail_nth_read+0x1af/0x230 [ 159.841723][T10060] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 159.841741][T10060] ? rw_verify_area+0xce/0x6d0 [ 159.841753][T10060] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 159.841770][T10060] vfs_read+0x1e4/0xb40 [ 159.841784][T10060] ? lock_acquire+0x1d1/0x380 [ 159.841799][T10060] ? __fget_files+0x34/0x3d0 [ 159.841821][T10060] ? __pfx_vfs_read+0x10/0x10 [ 159.841839][T10060] ? find_held_lock+0x2b/0x80 [ 159.841867][T10060] ? __fget_files+0x215/0x3d0 [ 159.841897][T10060] ? __fget_files+0x21f/0x3d0 [ 159.841921][T10060] ksys_read+0x12a/0x250 [ 159.841934][T10060] ? __pfx_ksys_read+0x10/0x10 [ 159.841957][T10060] do_syscall_64+0x123/0x790 [ 159.841976][T10060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.841988][T10060] RIP: 0033:0x7f935695ed8e [ 159.841997][T10060] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 159.842008][T10060] RSP: 002b:00007f9357842fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 159.842019][T10060] RAX: ffffffffffffffda RBX: 00007f93578436c0 RCX: 00007f935695ed8e [ 159.842026][T10060] RDX: 000000000000000f RSI: 00007f93578430a0 RDI: 0000000000000004 [ 159.842032][T10060] RBP: 00007f9357843090 R08: 0000000000000000 R09: 0000000000000000 [ 159.842039][T10060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 159.842045][T10060] R13: 00007f9356c26038 R14: 00007f9356c25fa0 R15: 00007ffe4d1339b8 [ 159.842060][T10060] [ 159.878470][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 159.882051][T10063] evm: overlay not supported [ 159.911096][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911108][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911173][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911180][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911242][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911249][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911310][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911317][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911389][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911396][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911459][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911466][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911528][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911535][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911597][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911603][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911666][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911701][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911769][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911775][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911838][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911844][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911908][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911915][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.911982][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.911988][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912051][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912058][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912120][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912127][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912191][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912197][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912264][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912270][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912339][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912346][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912408][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912416][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912479][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912485][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912590][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912597][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912661][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912667][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912730][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912736][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912799][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912806][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912869][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912876][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.912940][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.912947][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.913010][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.913016][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.913077][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.913084][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.913149][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.913155][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917193][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917205][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917278][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917285][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917354][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917361][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917425][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917431][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917495][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917501][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917562][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917568][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917629][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917636][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917703][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917709][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917769][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917775][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917837][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917843][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917907][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917913][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.917978][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.917984][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918047][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918053][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918116][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918122][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918185][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918191][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918255][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918261][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918329][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918335][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918397][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918404][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918469][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918475][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918541][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918547][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918611][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918617][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918680][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918686][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918751][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918757][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918824][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918830][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918894][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918900][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.918962][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.918968][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.919032][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.919039][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.919104][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.919110][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.919173][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.919179][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.919293][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.919300][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.919370][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.919376][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.924235][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.924245][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.924302][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.924307][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.924364][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.924370][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.924424][T10064] binder: BINDER_SET_CONTEXT_MGR already set [ 159.924429][T10064] binder: 10061:10064 ioctl 4018620d 200000000240 returned -16 [ 159.924573][T10064] binder: 10061:10064 ioctl c0306201 200000000340 returned -14 [ 159.926542][T10064] binder_alloc: binder_alloc_mmap_handler: 10061 200000ffd000-200001000000 already mapped failed -16 [ 159.926826][T10064] binder_alloc: binder_alloc_mmap_handler: 10061 200000ffd000-200001000000 already mapped failed -16 [ 159.926929][T10064] binder_alloc: binder_alloc_mmap_handler: 10061 200000ffd000-200001000000 already mapped failed -16 [ 159.927027][T10064] binder_alloc: binder_alloc_mmap_handler: 10061 200000ffd000-200001000000 already mapped failed -16 [ 159.927123][T10064] binder_alloc: binder_alloc_mmap_handler: 10061 200000ffd000-200001000000 already mapped failed -16 [ 159.927350][T10064] binder_alloc: binder_alloc_mmap_handler: 10061 200000ffd000-200001000000 already mapped failed -16 [ 159.927451][T10064] binder_alloc: binder_alloc_mmap_handler: 10061 200000ffd000-200001000000 already mapped failed -16 [ 159.927548][T10064] binder_alloc: binder_alloc_mmap_handler: 10061 200000ffd000-200001000000 already mapped failed -16 [ 159.927646][T10064] binder_alloc: binder_alloc_mmap_handler: 10061 200000ffd000-200001000000 already mapped failed -16 [ 159.927771][T10064] binder_alloc: binder_alloc_mmap_handler: 10061 200000ffd000-200001000000 already mapped failed -16 [ 159.931358][T10068] binder: 10061:10068 ioctl c0306201 200000000440 returned -14 [ 159.932704][T10064] binder_alloc: 10061: binder_alloc_buf, no vma [ 159.960548][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 159.964500][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 159.971350][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.032990][T10072] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1256'. [ 160.037534][T10072] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1256'. [ 160.281906][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.290494][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.291398][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.298259][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.305456][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.309758][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.315529][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.318517][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.322211][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.326672][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.329930][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.332491][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.334750][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.339967][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.341429][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.343252][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.345631][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.350622][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.353025][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.355950][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.358841][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.361072][T10078] fuse: fd is not a fuse device [ 160.361461][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.364356][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.366720][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.390631][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.396111][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.402661][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.404438][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.406579][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.407421][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.407901][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.408492][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.422168][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.422662][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.423153][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.423588][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.424083][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.424465][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.424913][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.425361][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.425724][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.426068][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.426515][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.429445][ T43] audit: type=1400 audit(1792320460.644:1034): avc: denied { read } for pid=10081 comm="syz.1.1259" laddr=fe80::641f:30ff:fe7a:1bb5 lport=58 faddr=ff02::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 160.430383][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.431884][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.434030][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.436289][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.438413][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.440604][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.442892][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.444987][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.447248][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.449342][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.451528][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.458427][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.460603][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.462822][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.464962][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.469481][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.471527][T10062] overlay: filesystem on ./file0 not supported as upperdir [ 160.785930][ T5845] usb 10-1: USB disconnect, device number 23 [ 160.881849][T10098] 9pnet_virtio: no channels available for device syz [ 160.887435][T10097] bridge_slave_1: default FDB implementation only supports local addresses [ 160.918231][ T5736] Bluetooth: hci4: command tx timeout [ 161.014986][T10107] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1266'. [ 161.205145][T10124] binder: binder_mmap: 10123 200000000000-200000200000 bad vm_flags failed -1 [ 161.213833][T10122] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 161.376086][ T42] bridge0: entered promiscuous mode [ 161.429361][T10148] 9pnet_virtio: no channels available for device syz [ 161.450324][T10145] syzkaller0: entered promiscuous mode [ 161.450340][T10145] syzkaller0: entered allmulticast mode [ 161.465374][T10162] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 162.978471][ T5807] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 31488 - 0 [ 162.978494][ T5807] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 163.069263][ T5807] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 31488 - 0 [ 163.069285][ T5807] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 163.103030][ T5747] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 163.104554][ T5747] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 163.106020][ T5747] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 163.114867][ T5747] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 163.116247][ T5747] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 163.135035][T10185] xt_socket: unknown flags 0x48 [ 163.190686][ T5807] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 31488 - 0 [ 163.191968][ T5807] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 163.195307][T10188] 8021q: VLANs not supported on gre0 [ 163.264213][ T5807] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 31488 - 0 [ 163.264239][ T5807] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 163.272756][T10206] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 163.301865][T10210] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.1301'. [ 163.305916][T10213] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 163.326959][T10213] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 163.389049][T10211] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 163.390540][T10211] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 163.390606][T10211] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 163.390662][T10211] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 163.390718][T10211] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 163.390773][T10211] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 163.390829][T10211] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 163.390884][T10211] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 163.390940][T10211] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 163.391001][T10211] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 163.426011][T10189] rxe_eth0 speed is unknown, defaulting to 1000 [ 163.593060][ T5807] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 163.593342][ T5807] bond_slave_0: left allmulticast mode [ 163.594513][ T5807] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 163.594875][ T5807] bond_slave_1: left allmulticast mode [ 163.595398][ T5807] bond0 (unregistering): Released all slaves [ 163.604098][T10189] dummy0 speed is unknown, defaulting to 1000 [ 163.617721][ T2412] usb 11-1: new high-speed USB device number 6 using dummy_hcd [ 163.704484][ T5807] tipc: Left network mode [ 163.767523][ T2412] usb 11-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 163.768861][ T2412] usb 11-1: config 1 has an invalid interface number: 3 but max is 0 [ 163.768874][ T2412] usb 11-1: config 1 has no interface number 0 [ 163.770460][ T5447] 8021q: adding VLAN 0 to HW filter on device eth8 [ 163.770693][ T2412] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.770706][ T2412] usb 11-1: Product: syz [ 163.770713][ T2412] usb 11-1: Manufacturer: syz [ 163.770720][ T2412] usb 11-1: SerialNumber: syz [ 163.778768][ T2412] usb 11-1: 3:0 : does not exist [ 163.778780][ T2412] usb 11-1: 3:0 : does not exist [ 163.905014][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 163.905033][ T43] audit: type=1400 audit(1792320464.114:1045): avc: denied { write } for pid=10233 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 163.950513][ T43] audit: type=1400 audit(1792320464.164:1046): avc: denied { write } for pid=10238 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 163.999623][ T5447] 8021q: adding VLAN 0 to HW filter on device eth9 [ 164.101190][ T6066] usb 11-1: USB disconnect, device number 6 [ 164.117927][T10189] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.117998][T10189] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.118092][T10189] bridge_slave_0: entered allmulticast mode [ 164.122989][T10189] bridge_slave_0: entered promiscuous mode [ 164.126266][T10189] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.126414][T10189] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.126506][T10189] bridge_slave_1: entered allmulticast mode [ 164.177828][T10189] bridge_slave_1: entered promiscuous mode [ 164.253580][ T43] audit: type=1400 audit(1792320464.464:1047): avc: denied { write } for pid=10247 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 164.303749][T10189] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 164.312855][T10189] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 164.326991][ T43] audit: type=1400 audit(1792320464.544:1048): avc: denied { write } for pid=10254 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 164.355218][ T5807] hsr_slave_0: left promiscuous mode [ 164.355761][ T5807] hsr_slave_1: left promiscuous mode [ 164.356144][ T5807] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 164.356155][ T5807] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 164.368537][ T5807] veth0_macvtap: left promiscuous mode [ 164.368592][ T5807] veth1_vlan: left promiscuous mode [ 164.368624][ T5807] veth0_vlan: left promiscuous mode [ 164.482692][T10263] ip_tables: iptables: counters copy to user failed while replacing table [ 164.535260][ T5807] team0 (unregistering): Port device team_slave_1 removed [ 164.555933][ T5807] team0 (unregistering): Port device team_slave_0 removed [ 164.671011][ T5447] 8021q: adding VLAN 0 to HW filter on device eth10 [ 164.689728][T10189] team0: Port device team_slave_0 added [ 164.692175][T10189] team0: Port device team_slave_1 added [ 164.709336][T10189] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 164.709347][T10189] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 164.709360][T10189] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 164.710153][T10189] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 164.710160][T10189] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 164.710173][T10189] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 164.749872][T10189] hsr_slave_0: entered promiscuous mode [ 164.750319][T10189] hsr_slave_1: entered promiscuous mode [ 164.750636][T10189] debugfs: 'hsr0' already exists in 'hsr' [ 164.750648][T10189] Cannot create hsr debugfs directory [ 164.799313][T10270] __nla_validate_parse: 65 callbacks suppressed [ 164.799326][T10270] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1312'. [ 164.866466][T10280] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 164.931073][ T43] audit: type=1400 audit(1792320465.144:1049): avc: denied { write } for pid=10281 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 165.031165][ T43] audit: type=1400 audit(1792320465.244:1050): avc: denied { write } for pid=10288 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 165.060179][ T43] audit: type=1400 audit(1792320465.274:1051): avc: denied { watch } for pid=10292 comm="syz.1.1317" path="/526" dev="tmpfs" ino=2922 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 165.079611][ T5447] 8021q: adding VLAN 0 to HW filter on device eth11 [ 165.098854][ T5807] IPVS: stop unused estimator thread 0... [ 165.147033][ T5736] Bluetooth: hci0: command tx timeout [ 165.163947][T10300] netlink: 'syz.5.1320': attribute type 1 has an invalid length. [ 165.190854][T10300] 8021q: adding VLAN 0 to HW filter on device bond3 [ 165.219081][T10304] netlink: 'syz.1.1321': attribute type 4 has an invalid length. [ 165.234702][T10189] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 165.243495][T10189] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 165.245537][T10189] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 165.250990][T10189] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 165.256559][T10304] netlink: 'syz.1.1321': attribute type 4 has an invalid length. [ 165.260460][T10189] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 165.273509][T10189] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 165.273926][T10189] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 165.283143][T10189] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 165.352669][T10189] 8021q: adding VLAN 0 to HW filter on device bond0 [ 165.359000][T10189] 8021q: adding VLAN 0 to HW filter on device team0 [ 165.374006][ T7967] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.374086][ T7967] bridge0: port 1(bridge_slave_0) entered forwarding state [ 165.385814][ T7967] bridge0: port 2(bridge_slave_1) entered blocking state [ 165.385897][ T7967] bridge0: port 2(bridge_slave_1) entered forwarding state [ 165.413442][T10189] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 165.422030][T10316] misc userio: Invalid payload size [ 165.476219][T10323] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1320'. [ 165.561365][T10327] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1325'. [ 165.775841][T10189] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 165.913850][T10352] CIFS: Attempting to mount //127.0.0.1/share [ 165.928874][T10189] veth0_vlan: entered promiscuous mode [ 165.941367][T10189] veth1_vlan: entered promiscuous mode [ 165.970508][T10189] veth0_macvtap: entered promiscuous mode [ 165.975154][T10189] veth1_macvtap: entered promiscuous mode [ 165.989379][T10189] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 166.002242][T10189] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 166.039309][ T5830] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 166.039610][ T5830] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 166.039844][ T5830] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 166.067432][ T13] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 166.138428][ T7967] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 166.138443][ T7967] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 166.154812][ T7967] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 166.154824][ T7967] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 166.219224][ T24] wacom 0003:056A:003F.0008: hidraw1: USB HID v0.00 Gamepad [syz0] on syz0 [ 166.298062][ T43] audit: type=1400 audit(1792320466.514:1052): avc: denied { append } for pid=10356 comm="syz.7.1293" name="uprobe_events" dev="tracefs" ino=3078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 166.557981][ T43] audit: type=1400 audit(1792320466.774:1053): avc: denied { name_bind } for pid=10372 comm="syz.5.1334" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 166.613664][ T43] audit: type=1400 audit(1792320466.824:1054): avc: denied { accept } for pid=10372 comm="syz.5.1334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 166.623525][T10365] kvm: pic: non byte write [ 166.625839][T10365] kvm: pic: non byte write [ 166.626147][T10365] kvm: pic: non byte write [ 166.628569][T10365] kvm: pic: non byte write [ 166.629061][T10365] kvm: pic: non byte write [ 166.629379][T10365] kvm: pic: non byte write [ 166.629677][T10365] kvm: pic: non byte write [ 166.629975][T10365] kvm: pic: non byte write [ 166.630287][T10365] kvm: pic: non byte write [ 166.630711][T10365] kvm: pic: non byte write [ 166.747104][T10352] CIFS: VFS: cifs_mount failed w/return code = -512 [ 167.008176][T10395] syzkaller0: entered promiscuous mode [ 167.008197][T10395] syzkaller0: entered allmulticast mode [ 167.126055][T10399] vlan2: entered promiscuous mode [ 167.126070][T10399] bridge0: entered promiscuous mode [ 167.236862][ T5736] Bluetooth: hci0: command tx timeout [ 167.314888][T10408] netlink: 'syz.7.1343': attribute type 11 has an invalid length. [ 167.314909][T10408] netlink: 'syz.7.1343': attribute type 4 has an invalid length. [ 167.425105][T10415] Bluetooth: MGMT ver 1.23 [ 167.425128][T10415] Bluetooth: hci0: invalid len left 17, exp >= 20 [ 167.452003][T10417] Format for deleting device is "id" (uint). [ 167.458805][T10419] Format for deleting device is "id" (uint). [ 167.520834][T10424] netlink: 64 bytes leftover after parsing attributes in process `syz.7.1344'. [ 167.524830][T10424] overlayfs: statfs failed on './file0' [ 167.559530][T10429] netlink: 'syz.1.1348': attribute type 2 has an invalid length. [ 167.663292][T10439] bond0: option ad_select: unable to set because the bond device is up [ 168.293291][T10458] netlink: Conntrack attr type has unexpected length (type=0, length=8, expected=0) [ 168.293314][T10458] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 168.294874][T10458] FAULT_INJECTION: forcing a failure. [ 168.294874][T10458] name failslab, interval 1, probability 0, space 0, times 0 [ 168.294908][T10458] CPU: 0 UID: 0 PID: 10458 Comm: syz.6.1356 Tainted: G L syzkaller #0 PREEMPT(full) [ 168.294924][T10458] Tainted: [L]=SOFTLOCKUP [ 168.294928][T10458] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.294935][T10458] Call Trace: [ 168.294947][T10458] [ 168.294952][T10458] dump_stack_lvl+0x100/0x190 [ 168.295008][T10458] should_fail_ex.cold+0x5/0xa [ 168.295032][T10458] should_failslab+0xc2/0x120 [ 168.295060][T10458] __kmalloc_noprof+0xfc/0x840 [ 168.295076][T10458] ? load_msg+0x118/0x4a0 [ 168.295096][T10458] load_msg+0x118/0x4a0 [ 168.295109][T10458] do_msgsnd+0x1ad/0x1790 [ 168.295125][T10458] ? __pfx_do_msgsnd+0x10/0x10 [ 168.295137][T10458] ? find_held_lock+0x2b/0x80 [ 168.295178][T10458] ? __might_fault+0xc5/0x140 [ 168.295191][T10458] ? __might_fault+0xc5/0x140 [ 168.295207][T10458] ? __x64_sys_msgsnd+0xe5/0x130 [ 168.295221][T10458] __x64_sys_msgsnd+0xe5/0x130 [ 168.295235][T10458] do_syscall_64+0x123/0x790 [ 168.295280][T10458] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.295293][T10458] RIP: 0033:0x7f935699e559 [ 168.295303][T10458] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 168.295315][T10458] RSP: 002b:00007f9357843028 EFLAGS: 00000246 ORIG_RAX: 0000000000000045 [ 168.295332][T10458] RAX: ffffffffffffffda RBX: 00007f9356c25fa0 RCX: 00007f935699e559 [ 168.295340][T10458] RDX: 0000000000002000 RSI: 0000200000000500 RDI: 0000000000000000 [ 168.295347][T10458] RBP: 00007f9356a35ab8 R08: 0000000000000000 R09: 0000000000000000 [ 168.295353][T10458] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000 [ 168.295360][T10458] R13: 00007f9356c26038 R14: 00007f9356c25fa0 R15: 00007ffe4d1339b8 [ 168.295375][T10458] [ 168.295767][T10458] netlink: 'syz.6.1356': attribute type 21 has an invalid length. [ 168.408978][T10460] rxe_eth0 speed is unknown, defaulting to 1000 [ 168.492278][ T24] libceph: connect (1)[c::]:6789 error -101 [ 168.494145][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 168.613769][T10460] dummy0 speed is unknown, defaulting to 1000 [ 168.767653][ T24] libceph: connect (1)[c::]:6789 error -101 [ 168.767807][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 168.901673][T10479] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1362'. [ 169.144546][T10494] netlink: 'syz.6.1367': attribute type 1 has an invalid length. [ 169.155884][T10494] 8021q: adding VLAN 0 to HW filter on device bond1 [ 169.277923][ T24] libceph: connect (1)[c::]:6789 error -101 [ 169.282397][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 169.282797][T10497] netlink: 56 bytes leftover after parsing attributes in process `syz.6.1367'. [ 169.290744][T10462] ceph: No mds server is up or the cluster is laggy [ 169.401503][ T43] kauditd_printk_skb: 12 callbacks suppressed [ 169.401522][ T43] audit: type=1400 audit(1792320470.619:1067): avc: denied { append } for pid=10500 comm="syz.5.1369" name="pmem0" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 169.916546][T10538] ip_tables: iptables: counters copy to user failed while replacing table [ 169.954752][ T43] audit: type=1400 audit(1792320471.169:1068): avc: denied { wake_alarm } for pid=10540 comm="syz.5.1379" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 170.037650][ T5736] Bluetooth: hci3: unexpected event for opcode 0x2d6f [ 170.049844][T10543] overlayfs: missing 'lowerdir' [ 170.426982][ T5829] usb 11-1: new high-speed USB device number 7 using dummy_hcd [ 170.587050][ T5829] usb 11-1: Using ep0 maxpacket: 8 [ 170.587792][ T5829] usb 11-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 170.588725][ T5829] usb 11-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 170.588748][ T5829] usb 11-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 170.588782][ T5829] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 170.588812][ T5829] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.624771][ T5829] hub 11-1:1.0: bad descriptor, ignoring hub [ 170.624792][ T5829] hub 11-1:1.0: probe with driver hub failed with error -5 [ 170.633347][ T5829] cdc_wdm 11-1:1.0: skipping garbage [ 170.633374][ T5829] cdc_wdm 11-1:1.0: skipping garbage [ 170.643525][ T5829] cdc_wdm 11-1:1.0: cdc-wdm0: USB WDM device [ 170.643543][ T5829] cdc_wdm 11-1:1.0: Unknown control protocol [ 170.824866][ T43] audit: type=1400 audit(1792320472.039:1069): avc: denied { read write } for pid=10554 comm="syz.6.1383" name="cdc-wdm0" dev="devtmpfs" ino=3365 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 170.825287][ T43] audit: type=1400 audit(1792320472.039:1070): avc: denied { open } for pid=10554 comm="syz.6.1383" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3365 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 170.909389][ T5736] Bluetooth: hci2: command 0x0406 tx timeout [ 171.127211][ T43] audit: type=1400 audit(1792320472.349:1071): avc: denied { map } for pid=10554 comm="syz.6.1383" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3365 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 171.195454][T10556] VFS: Mount too revealing [ 172.693928][T10525] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 172.913963][T10584] bridge0: port 4(vlan3) entered blocking state [ 172.914103][T10584] bridge0: port 4(vlan3) entered disabled state [ 172.914207][T10584] vlan3: entered allmulticast mode [ 172.914221][T10584] geneve0: entered allmulticast mode [ 172.915607][T10584] vlan3: entered promiscuous mode [ 172.915646][T10584] geneve0: entered promiscuous mode [ 172.928920][ T5845] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:0c [ 173.186999][ T6066] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 173.188062][ C3] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 173.188381][ C3] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 173.189436][ T6548] usb 11-1: USB disconnect, device number 7 [ 173.191339][ C3] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 173.191351][ C3] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 173.191358][ C3] cdc_wdm 11-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 173.316880][ T6066] usb 12-1: device descriptor read/64, error -71 [ 173.378598][ T7972] IPVS: starting estimator thread 0... [ 173.434159][ T5747] Bluetooth: hci3: unexpected event for opcode 0x202a [ 173.466878][T10611] IPVS: using max 22 ests per chain, 52800 per kthread [ 173.556890][ T6066] usb 12-1: new high-speed USB device number 3 using dummy_hcd [ 173.686871][ T6066] usb 12-1: device descriptor read/64, error -71 [ 173.707229][ T5845] batman_adv: batadv0: Local translation table size (68) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:0c [ 173.797042][ T6066] usb usb12-port1: attempt power cycle [ 173.932211][ T43] audit: type=1400 audit(1792320475.149:1072): avc: denied { write } for pid=10623 comm="syz.6.1408" name="card0" dev="devtmpfs" ino=635 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 173.972718][ T43] audit: type=1400 audit(1792320475.189:1073): avc: denied { read } for pid=10628 comm="syz.6.1410" path="socket:[38341]" dev="sockfs" ino=38341 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 174.086805][T10642] rxe_eth0 speed is unknown, defaulting to 1000 [ 174.146872][ T6066] usb 12-1: new high-speed USB device number 4 using dummy_hcd [ 174.167274][ T6066] usb 12-1: device descriptor read/8, error -71 [ 174.181872][T10646] vhci_hcd vhci_hcd.0: failed to lookup sock [ 174.189305][T10653] fuse: fd is not a fuse device [ 174.231527][T10642] dummy0 speed is unknown, defaulting to 1000 [ 174.299420][T10657] SELinux: Context system_u:object_r:net_conf_t:s0 is not valid (left unmapped). [ 174.300790][ T43] audit: type=1400 audit(1792320475.519:1074): avc: denied { relabelto } for pid=10656 comm="syz.6.1420" name="ptmx" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:net_conf_t:s0" [ 174.301334][ T43] audit: type=1400 audit(1792320475.519:1075): avc: denied { associate } for pid=10656 comm="syz.6.1420" name="ptmx" dev="devtmpfs" ino=623 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 srawcon="system_u:object_r:net_conf_t:s0" [ 174.406952][ T6066] usb 12-1: new high-speed USB device number 5 using dummy_hcd [ 174.429803][ T6066] usb 12-1: device descriptor read/8, error -71 [ 174.536922][ T6066] usb usb12-port1: unable to enumerate USB device [ 174.606823][ T24] usb 11-1: new high-speed USB device number 8 using dummy_hcd [ 174.756907][ T24] usb 11-1: Using ep0 maxpacket: 16 [ 174.757477][ T24] usb 11-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 174.758307][ T24] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 174.758329][ T24] usb 11-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 174.758342][ T24] usb 11-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 174.758353][ T24] usb 11-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 174.758366][ T24] usb 11-1: config 0 interface 0 has no altsetting 0 [ 174.758389][ T24] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 174.759983][ T24] usb 11-1: config 0 descriptor?? [ 175.254063][ T24] logitech-djreceiver 0003:046D:C53A.0009: hiddev0,hidraw1: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.6-1/input0 [ 175.639562][ T43] audit: type=1400 audit(1792320476.859:1076): avc: denied { write } for pid=10686 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 175.693939][ T43] audit: type=1400 audit(1792320476.909:1077): avc: denied { write } for pid=10691 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 175.707232][ T5747] Bluetooth: hci0: Opcode 0x0c3a failed: -110 [ 175.707291][ T5736] Bluetooth: hci0: command 0x0419 tx timeout [ 175.818102][ T43] audit: type=1400 audit(1792320477.039:1078): avc: denied { lock } for pid=10698 comm="syz.5.1436" path="socket:[39045]" dev="sockfs" ino=39045 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 176.039950][T10706] syzkaller0: entered promiscuous mode [ 176.039965][T10706] syzkaller0: entered allmulticast mode [ 176.060029][ T5736] Bluetooth: hci3: Unable to find connection for big 0x00 [ 176.293750][ T5736] [ 176.294579][ T5736] ====================================================== [ 176.297145][ T5736] WARNING: possible circular locking dependency detected [ 176.299413][ T5736] syzkaller #0 Tainted: G L [ 176.301402][ T5736] ------------------------------------------------------ [ 176.303838][ T5736] kworker/u34:2/5736 is trying to acquire lock: [ 176.305811][ T5736] ffffffff91f84dc0 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_security_cfm+0x3f/0x4b0 [ 176.308815][ T5736] [ 176.308815][ T5736] but task is already holding lock: [ 176.311112][ T5736] ffffffff91f57f00 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_key_refresh_complete_evt+0x670/0x1030 [ 176.315302][ T5736] [ 176.315302][ T5736] which lock already depends on the new lock. [ 176.315302][ T5736] [ 176.319425][ T5736] [ 176.319425][ T5736] the existing dependency chain (in reverse order) is: [ 176.322975][ T5736] [ 176.322975][ T5736] -> #2 (hci_cb_list_lock){+.+.}-{4:4}: [ 176.326060][ T5736] lock_acquire+0x1d1/0x380 [ 176.328122][ T5736] __mutex_lock+0x1a4/0x1bd0 [ 176.330186][ T5736] hci_remote_features_evt+0x485/0x9b0 [ 176.332567][ T5736] hci_event_packet+0x8e9/0xcd0 [ 176.334711][ T5736] hci_rx_work+0x451/0xfc0 [ 176.336727][ T5736] process_one_work+0xac7/0x1b10 [ 176.338897][ T5736] worker_thread+0x5ef/0xe50 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 176.340796][ T5736] kthread+0x373/0x450 [ 176.342762][ T5736] ret_from_fork+0x730/0xd60 [ 176.344840][ T5736] ret_from_fork_asm+0x1a/0x30 [ 176.346976][ T5736] [ 176.346976][ T5736] -> #1 (&hdev->lock){+.+.}-{4:4}: [ 176.349905][ T5736] lock_acquire+0x1d1/0x380 [ 176.351937][ T5736] __mutex_lock+0x1a4/0x1bd0 [ 176.354011][ T5736] hci_release_dev+0x160/0x630 [ 176.356165][ T5736] bt_host_release+0x6b/0xb0 [ 176.358237][ T5736] device_release+0xd2/0x270 [ 176.360326][ T5736] kobject_put+0x1f7/0x640 [ 176.362324][ T5736] put_device+0x1f/0x30 [ 176.364216][ T5736] device_release+0xd2/0x270 [ 176.366285][ T5736] kobject_put+0x1f7/0x640 [ 176.368307][ T5736] put_device+0x1f/0x30 [ 176.370213][ T5736] l2cap_chan_put+0x352/0x3f0 [ 176.372312][ T5736] l2cap_sock_release+0x1db/0x280 [ 176.374533][ T5736] sock_release+0x91/0x1c0 [ 176.376584][ T5736] rfcomm_session_del.isra.0+0x16b/0x250 [ 176.379051][ T5736] rfcomm_run+0x6f6/0x5550 [ 176.381052][ T5736] kthread+0x373/0x450 [ 176.382913][ T5736] ret_from_fork+0x730/0xd60 [ 176.384982][ T5736] ret_from_fork_asm+0x1a/0x30 [ 176.387149][ T5736] [ 176.387149][ T5736] -> #0 (rfcomm_mutex){+.+.}-{4:4}: [ 176.390082][ T5736] check_prev_add+0xeb/0xe60 [ 176.392137][ T5736] __lock_acquire+0x1528/0x1f40 [ 176.394284][ T5736] lock_acquire+0x1d1/0x380 [ 176.396327][ T5736] __mutex_lock+0x1a4/0x1bd0 [ 176.398394][ T5736] rfcomm_security_cfm+0x3f/0x4b0 [ 176.400609][ T5736] hci_key_refresh_complete_evt+0x6ea/0x1030 [ 176.403215][ T5736] hci_event_packet+0x8e9/0xcd0 [ 176.405372][ T5736] hci_rx_work+0x451/0xfc0 [ 176.407383][ T5736] process_one_work+0xac7/0x1b10 [ 176.409558][ T5736] worker_thread+0x5ef/0xe50 [ 176.411611][ T5736] kthread+0x373/0x450 [ 176.413481][ T5736] ret_from_fork+0x730/0xd60 [ 176.415540][ T5736] ret_from_fork_asm+0x1a/0x30 [ 176.417712][ T5736] [ 176.417712][ T5736] other info that might help us debug this: [ 176.417712][ T5736] [ 176.421719][ T5736] Chain exists of: [ 176.421719][ T5736] rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock [ 176.421719][ T5736] [ 176.426608][ T5736] Possible unsafe locking scenario: [ 176.426608][ T5736] [ 176.429542][ T5736] CPU0 CPU1 [ 176.431693][ T5736] ---- ---- [ 176.433826][ T5736] lock(hci_cb_list_lock); [ 176.435671][ T5736] lock(&hdev->lock); [ 176.438265][ T5736] lock(hci_cb_list_lock); [ 176.441038][ T5736] lock(rfcomm_mutex); [ 176.442712][ T5736] [ 176.442712][ T5736] *** DEADLOCK *** [ 176.442712][ T5736] [ 176.445905][ T5736] locks held by kworker/u34:2/5736: 4, last CPU#0: [ 176.448510][ T5736] #0: ffff88806154e940 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 176.452617][ T5736] #1: ffffc90003087d08 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 176.457205][ T5736] #2: ffff88804e9ec0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_key_refresh_complete_evt+0x3d/0x1030 [ 176.461294][ T5736] #3: ffffffff91f57f00 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_key_refresh_complete_evt+0x670/0x1030 [ 176.465587][ T5736] [ 176.465587][ T5736] stack backtrace: [ 176.468019][ T5736] CPU: 0 UID: 0 PID: 5736 Comm: kworker/u34:2 Tainted: G L syzkaller #0 PREEMPT(full) [ 176.472376][ T5736] Tainted: [L]=SOFTLOCKUP [ 176.474097][ T5736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 176.478069][ T5736] Workqueue: hci0 hci_rx_work [ 176.479975][ T5736] Call Trace: [ 176.481326][ T5736] [ 176.482517][ T5736] dump_stack_lvl+0x100/0x190 [ 176.484391][ T5736] print_circular_bug.cold+0x178/0x1be [ 176.486599][ T5736] check_noncircular+0x146/0x160 [ 176.488609][ T5736] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 176.491066][ T5736] ? lock_acquire+0x1d1/0x380 [ 176.492976][ T5736] check_prev_add+0xeb/0xe60 [ 176.494843][ T5736] __lock_acquire+0x1528/0x1f40 [ 176.496827][ T5736] ? l2cap_security_cfm+0x90b/0x1240 [ 176.498939][ T5736] lock_acquire+0x1d1/0x380 [ 176.500776][ T5736] ? rfcomm_security_cfm+0x3f/0x4b0 [ 176.502866][ T5736] ? __pfx___might_resched+0x10/0x10 [ 176.504995][ T5736] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 176.507421][ T5736] __mutex_lock+0x1a4/0x1bd0 [ 176.509307][ T5736] ? rfcomm_security_cfm+0x3f/0x4b0 [ 176.511390][ T5736] ? rfcomm_security_cfm+0x3f/0x4b0 [ 176.513443][ T5736] ? l2cap_security_cfm+0x910/0x1240 [ 176.515529][ T5736] ? __pfx___mutex_lock+0x10/0x10 [ 176.517467][ T5736] ? __pfx___mutex_lock+0x10/0x10 [ 176.519054][ T5736] ? lock_acquire+0x1d1/0x380 [ 176.520847][ T5736] ? rfcomm_security_cfm+0x3f/0x4b0 [ 176.522922][ T5736] rfcomm_security_cfm+0x3f/0x4b0 [ 176.524559][ T5736] hci_key_refresh_complete_evt+0x6ea/0x1030 [ 176.526682][ T5736] ? __pfx_rfcomm_security_cfm+0x10/0x10 [ 176.528928][ T5736] hci_event_packet+0x8e9/0xcd0 [ 176.530672][ T5736] ? __pfx_hci_key_refresh_complete_evt+0x10/0x10 [ 176.532978][ T5736] ? __pfx_hci_event_packet+0x10/0x10 [ 176.535222][ T5736] ? lockdep_hardirqs_on+0x7d/0x110 [ 176.537345][ T5736] hci_rx_work+0x451/0xfc0 [ 176.538755][ T5736] process_one_work+0xac7/0x1b10 [ 176.540579][ T5736] ? __pfx_process_one_work+0x10/0x10 [ 176.542735][ T5736] ? lock_acquire+0x1d1/0x380 [ 176.544390][ T5736] ? __pfx_hci_rx_work+0x10/0x10 [ 176.546037][ T5736] worker_thread+0x5ef/0xe50 [ 176.547912][ T5736] ? kthread+0x13a/0x450 [ 176.549630][ T5736] ? __pfx_worker_thread+0x10/0x10 [ 176.551705][ T5736] kthread+0x373/0x450 [ 176.553019][ T5736] ? __pfx_kthread+0x10/0x10 [ 176.554519][ T5736] ret_from_fork+0x730/0xd60 [ 176.556404][ T5736] ? __pfx_ret_from_fork+0x10/0x10 [ 176.558458][ T5736] ? __switch_to+0x800/0x10f0 [ 176.560371][ T5736] ? __pfx_kthread+0x10/0x10 [ 176.562237][ T5736] ret_from_fork_asm+0x1a/0x30 [ 176.564177][ T5736] [ 176.689782][ T43] audit: type=1400 audit(1792320477.909:1079): avc: denied { write } for pid=10710 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 176.711048][ T24] usb 11-1: reset high-speed USB device number 8 using dummy_hcd [ 176.800834][ T43] audit: type=1400 audit(1792320478.009:1080): avc: denied { write } for pid=10713 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 177.070084][ T5807] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.100057][ T43] audit: type=1400 audit(1792320478.319:1081): avc: denied { write } for pid=10716 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 177.101816][ T5807] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.126326][ T43] audit: type=1400 audit(1792320478.339:1082): avc: denied { write } for pid=10719 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 177.179559][ T5807] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.272036][ T5807] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.310773][ T43] audit: type=1400 audit(1792320478.529:1083): avc: denied { write } for pid=10722 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 177.378189][ T43] audit: type=1400 audit(1792320478.599:1084): avc: denied { write } for pid=10725 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 177.385547][ T5807] bridge_slave_1: left allmulticast mode [ 177.385562][ T5807] bridge_slave_1: left promiscuous mode [ 177.385633][ T5807] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.386515][ T5807] bridge_slave_0: left allmulticast mode [ 177.386525][ T5807] bridge_slave_0: left promiscuous mode [ 177.386594][ T5807] bridge0: port 1(bridge_slave_0) entered disabled state [ 177.438445][ T5807] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 177.439950][ T5807] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 177.440770][ T5807] bond0 (unregistering): Released all slaves [ 177.487496][ T41] usb 11-1: USB disconnect, device number 8 [ 177.500702][ T43] audit: type=1400 audit(1792320478.719:1085): avc: denied { write } for pid=10729 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 177.547092][ T5447] 8021q: adding VLAN 0 to HW filter on device eth12 [ 177.637238][ T5447] 8021q: adding VLAN 0 to HW filter on device eth13 [ 177.659841][ T5807] hsr_slave_0: left promiscuous mode [ 177.660204][ T5807] hsr_slave_1: left promiscuous mode [ 177.660450][ T5807] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 177.660459][ T5807] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 177.660700][ T5807] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 177.660709][ T5807] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 177.662203][ T5807] veth1_macvtap: left promiscuous mode [ 177.662217][ T5807] veth0_macvtap: left promiscuous mode [ 177.662245][ T5807] veth1_vlan: left promiscuous mode [ 177.662266][ T5807] veth0_vlan: left promiscuous mode [ 177.737002][ T5807] team0 (unregistering): Port device team_slave_1 removed [ 177.740289][ T5807] team0 (unregistering): Port device team_slave_0 removed [ 177.773003][ T5447] 8021q: adding VLAN 0 to HW filter on device eth15 [ 177.874644][ T5447] 8021q: adding VLAN 0 to HW filter on device eth14 [ 178.021784][ T5807] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.060613][ T5807] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.113971][ T5807] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.171051][ T5807] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.208155][ T5807] vlan3: left allmulticast mode [ 178.208169][ T5807] geneve0: left allmulticast mode [ 178.208178][ T5807] vlan3: left promiscuous mode [ 178.208184][ T5807] geneve0: left promiscuous mode [ 178.208302][ T5807] bridge0: port 4(vlan3) entered disabled state [ 178.208992][ T5807] bridge0: port 3(batadv0) entered disabled state [ 178.211165][ T5807] bridge_slave_1: left allmulticast mode [ 178.211176][ T5807] bridge_slave_1: left promiscuous mode [ 178.211230][ T5807] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.214799][ T5807] bridge_slave_0: left allmulticast mode [ 178.214816][ T5807] bridge_slave_0: left promiscuous mode [ 178.214911][ T5807] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.272207][ T5807] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 178.272383][ T5807] bond_slave_0: left allmulticast mode [ 178.273140][ T5807] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 178.273366][ T5807] bond_slave_1: left allmulticast mode [ 178.273651][ T5807] bond0 (unregistering): Released all slaves [ 178.275311][ T5807] bond1 (unregistering): Released all slaves [ 178.282875][ T5807] bond2 (unregistering): Released all slaves [ 178.286379][ T5807] bond3 (unregistering): Released all slaves [ 178.349910][ T5807] : left promiscuous mode [ 178.416027][ T5447] 8021q: adding VLAN 0 to HW filter on device eth16 [ 178.518570][ T5447] 8021q: adding VLAN 0 to HW filter on device eth17 [ 178.550698][ T5807] hsr_slave_0: left promiscuous mode [ 178.559482][ T5807] hsr_slave_1: left promiscuous mode [ 178.559924][ T5807] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 178.559939][ T5807] batadv0: mtu less than device minimum [ 178.560353][ T5807] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 178.560778][ T5807] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 178.561188][ T5807] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 178.561605][ T5807] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 178.562041][ T5807] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 178.562453][ T5807] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 178.562873][ T5807] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 178.563286][ T5807] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 178.563726][ T5807] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 178.586848][ T5807] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 178.593620][ T5807] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 178.598152][ T5807] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 178.602280][ T5807] batman_adv: batadv0: Interface deactivated: dummy0 [ 178.602289][ T5807] batman_adv: batadv0: Removing interface: dummy0 [ 178.610693][ T5807] veth1_macvtap: left promiscuous mode [ 178.610719][ T5807] veth0_macvtap: left promiscuous mode [ 178.610748][ T5807] veth1_vlan: left promiscuous mode [ 178.610769][ T5807] veth0_vlan: left promiscuous mode [ 178.676536][ T5807] team0 (unregistering): Port device team_slave_1 removed [ 178.681008][ T5807] team0 (unregistering): Port device team_slave_0 removed [ 178.815885][ T5447] 8021q: adding VLAN 0 to HW filter on device eth18 [ 178.926784][ T5447] 8021q: adding VLAN 0 to HW filter on device eth19