last executing test programs: 23m17.839289954s ago: executing program 32 (id=41): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x3, 0x9d, 0x0, &(0x7f0000000400)={0x0, 0x0, 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="050f05f8006085d4894bfcec0c95b778126e3e523d821c730623080c53dc78028cdefc30322c89de76b35c7cf6a0c87a8d1c53761ebcd923a0129d80245ac52e1ddf0ab33f31d1ac27a55ec0255b0bf450c05fb731d92c98125f25c3a9a7494bb306f0d5d951a4fb98b6c2f0ca21c3b53d26ca7a0c76381977375b530ae0f39d7ab1eab65dac35a7c1d675e37110e909dbc400bf94341f10e7a90c61c606a3ff9cb5b20b4edab66d37c26d9b3d105a2b"]}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) syz_open_procfs(0x0, &(0x7f0000002100)='net/ptype\x00') 18m54.536168829s ago: executing program 33 (id=826): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x200, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xd, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@TCA_RATE={0x6, 0x5, {0x1}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x3}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x10000}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x40010) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc04, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x40d}, @TCA_CAKE_TARGET={0x8, 0x8, 0x3}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f0000002900)={&(0x7f0000000500)=@xdp={0x2c, 0x8, r5, 0x33}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000380)="da", 0x1}], 0x1}, 0x20000885) socket$unix(0x1, 0x1, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x1c, 0x3e, 0x229, 0x0, 0x25dfdbfc, {0xa}, [@typed={0x8, 0x0, 0x0, 0x0, @pid}]}, 0x1c}}, 0x8000) fcntl$lock(r4, 0x7, &(0x7f0000000040)={0x0, 0x1, 0xfd8b, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000004, 0x10, r4, 0xb320a000) open(&(0x7f00000000c0)='./file0\x00', 0x10001, 0x1a0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r8, 0x29, 0x30, 0x0, 0x5000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r9 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) ioctl$MON_IOCX_GET(r9, 0x40189206, &(0x7f0000000140)={&(0x7f0000000180), 0x0, 0xffffffffffffff2a}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 18m13.876336794s ago: executing program 34 (id=951): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) r0 = socket$kcm(0xa, 0x2, 0x0) r1 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, 0x0, 0x0) syz_init_net_socket$llc(0x1a, 0x801, 0x0) socket$nl_route(0x10, 0x3, 0x0) clock_adjtime(0xffffffd3, 0x0) socket$unix(0x1, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a010400000900000000000a0000010900010073797a31000000004c00048020000180070001006374000014000280080002400000000d08000140000000091800018007000100727400000c0002800800014000000009100001800a0001006c696d69740000000900020073797a32"], 0xa0}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) write$binfmt_register(r4, &(0x7f00000004c0)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x5, 0x3a, '#%\\h*@#Lw\x9e5\x9f>k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xea(J\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{G\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xbd\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132?\xbf\xb2\x93B\x01\'#\xc0v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b~F6\xba\xde44m\x96+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P(<\x1e\xd6\x92\x8c\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xa1W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xeahJ\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{\xc5\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xb5\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132\xf9\xbf7K\x8d\x16\xa6\xbf4\v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde\x13\xdf\xc6Z+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x89\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xd3W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, './file0'}, 0x237) 16m20.462193417s ago: executing program 35 (id=1360): openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001100)=ANY=[@ANYBLOB="140000002a00090027bd7000007e9a000400002c"], 0x14}, 0x1, 0x3000000}, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x2c840, 0x0) writev(r1, &(0x7f0000000940)=[{&(0x7f0000000f80)="56da93", 0x3}], 0x1) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x400000000000027c, &(0x7f0000000080)}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000000) syz_open_dev$vbi(&(0x7f0000000000), 0x2, 0x2) openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) fstat(r3, &(0x7f0000000100)) r4 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r5, &(0x7f0000000140)="30009d", 0x3) 14m57.761850973s ago: executing program 36 (id=1692): syz_usb_connect$uac2(0x6, 0xa3, &(0x7f0000000b40)=ANY=[], 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904"], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c00000040000100fcff070004000000010000000800cb80040008801400018004001080093494c3d097266f1467c4a6ed0fcd001e002af87b5c0000"], 0x3c}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff}) setsockopt$TIPC_IMPORTANCE(r2, 0x10f, 0x7f, 0x0, 0x0) r3 = socket(0x27, 0x800, 0x8) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x4e21, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x104) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r3) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f00000001c0)={0x40, 0x16, 0x4, "90b7a71b"}, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r1) r5 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'gre0\x00', 0x0}) sendmsg$can_raw(r5, &(0x7f0000000140)={&(0x7f0000000000)={0x1d, r6}, 0x10, &(0x7f00000005c0)={0x0}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x1) syz_usb_control_io$sierra_net(r0, &(0x7f00000007c0)={0x14, &(0x7f0000000700)={0x0, 0x23, 0x8e, {0x5b, 0x0, "099ff57396af829c715a4943407f184363bda365e1f50a75788ae87f46c0b0fad1844a9fe3750711d72f3f1ad80e536f521b2d55fbaf6695232c66e715f51810c6c927670ea30e15320c9d8c"}}, &(0x7f0000000780)=ANY=[@ANYBLOB]}, &(0x7f0000001080)={0x1c, &(0x7f0000000800)=ANY=[@ANYBLOB="4009940000004d9dd891582dd88001706f36d8dcae899960b53d2b2ed028e2e9a0dd75e8306fc9f74e4e0f20cea59511eb25ebf2355f75a9d3020f5767632f394509582a50bdb286f7298507665b51268ad39770972a48125c3a28b860aacdb79cd447370ff08ba421371d1dae6ab558319800165f28000e609d3df087c413b4e71470761c832d26a5eff72203a22a9a04d6f20fd1b822d25231"], &(0x7f0000000c00)={0xa1, 0x1, 0x400, "1b168c6e2ba8560672b51b6094ff84e4e7e670e4ba7aeefed21f636a69ea0fd685b091b7fa28c39b89e275bac0c47ebb99c92c109f0d34ff60113d02c923cceeb1952b5597da6cfc4fc38bdebfc274d6d0bd62d99c6fdcb58add6e003a8a05e2b16929cdc87d7d505ce1668433d568dbeda92a6bf4fad3b77eda51fb18c1cc2038b011210c78b73932ca4911b553940b7ed900c4fb8b428d43c06677b21a668d6c9274f77f0e9973c4564cbc32c30955a66e8bda95fde30c67563f436a82e874552f34319b5872d8af2cb9baef1dd0d5707c7cd88a5d459bf37291e887bccb1294a337b9f6597baa2b9985d49f598253e47ffce45eba04d30c505ca628d252e4471670917b2af0db0fff97e23ed155a94c1a6504e3eaff130f1b95e81124ed2d1a23be1137cd66a5f238c59d24ddb96742a6542e7ee5326290fc79253c5d35d904dd09ab29e271f1a2c5f2320c3f9c56d630dcdc4f685fa59b323992f096f2b4f0a8ccb549ee8b0a27aa97c55abfa139e359bf2465b5c22cb7f10592eb1aea5df4fe6ff3925ba65fec2ca2e2b42dbd44fee75aebff0b180800de72f47f9a60b5e4234dc8da3fe2f25666fbdead5cd4bf62d3f69d646af7298eec7f67901438d864b69cf70e88b330a940e898714302eae4c4650c0e49e10c396469e4e8bf45b2bf115af2c0bbcc0e9342c0a0085561602480c923ab2cb8f153fe9b952c06bdb18d2a80540faf78b659047ae1ae8e2da30ad1ea0702125438ed6c39c09a9f7c2261e9efad3bf2da8ab73053b305bf8fa2864cbbbf2796f666b453d6038eaba1cd1c29bbc4a49b69608936ec70474000607409b3fbbbfa9a94c4f5f794633e88b86d629f0784a56ed15ab793cd91747bd99a618d872f38ed5d298a1500b0699627e97511b94d28504c0f2cabc5576ad68426200e0e01c65a07702a2e6c05811c6ed9293cf1c56c0767cb8cbd31b6f470307346fcea37b6f56ccfc4663569b23f86298ca0bf1ae1bb530bf470b33cf8ef25828f2290f1e23f310afb3b005a3e633b9af5e67185c58213d682761e387dcbc48cbfd6567d034810cff9b973bb6ee2cef299774931459f7d479fbace58355b632019041552f3bcdf0d9948e463960282d23f03855f75ea0364a62628de6a75ed9fdec17a0a808ecefc4919da6fd0d22445bd06b218a34121ff3a28755c10ff864c180e1a7fa86e76b0e5dc154399244777e49b2e25acd6aa935cd73666b9e8d4d2d36683f283b97eecf0a0a4f27ea296fc5872c45596dee096ef2839de6ad0d8cd3ea38f9f808be1498852e8238d43db612fcc37f172b8fccc635c3baba2d7f29fb5058c592411a39a051fadc8a8a861d93ffc45d9c3c11c17668ac1f40aec23e0e8b10674dd0e724510875bce2655e323f183b4ec98422c5eadddf02e17826122f5e0e67d9dcd83f24876f6b89832af"}, &(0x7f0000001040)}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)=ANY=[], 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x28, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f00000003c0)={0x3c, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x2, 'lblc\x00', 0x13, 0x6, 0x53}, 0x2c) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="48000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8, @ANYBLOB="0a0001"], 0x48}, 0x1, 0x0, 0x0, 0x45844}, 0x4000080) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x1203, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x2) 13m21.712225392s ago: executing program 37 (id=2009): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x16, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@map_fd={0x18, 0x1, 0x1, 0x0, 0x1}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x1, 0x4, 0x0, 0x4}, @alu={0x4, 0x1, 0xd, 0x7, 0x8, 0x0, 0xfffffffffffffff0}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='GPL\x00', 0x6, 0x0, 0x0, 0x40f00, 0x7b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x2, 0x3}, 0x8, 0x10, &(0x7f00000003c0)={0x1, 0xd, 0xfd03, 0x3}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000400)=[r1, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, r1], &(0x7f0000000440)=[{0x2, 0x2, 0x9, 0x6}], 0x10, 0x6}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="180800000000000000000000000000008500000023000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002a00000095", @ANYRESDEC=r1], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, &(0x7f00000001c0)=r3) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000380)={'macsec0\x00', 0x2}) 9m51.974474474s ago: executing program 38 (id=2353): setresuid(0x0, 0xee00, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$l2tp(0x2, 0x2, 0x73) mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x9, @loopback}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004084) r0 = io_uring_setup(0x895, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101400, 0x80) syz_open_dev$usbfs(0x0, 0x77, 0x41341) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = socket$inet(0x2, 0x3, 0x2) sendto$inet(r2, 0x0, 0x0, 0x810, &(0x7f00000021c0)={0x2, 0x4e24, @multicast1}, 0x10) syz_emit_vhci(&(0x7f0000000680)=ANY=[@ANYBLOB="04"], 0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) 9m48.597176781s ago: executing program 39 (id=2355): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="e9ecdcb0a336629600000000000000002001040000004b00000000000000000064010102000000000000000000000000000000050000000302002000000000f2", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ac00000000000000ff0f000000000000ffffffffffffffff0000000000000000ffffffffffffffffffffff7f0000000000000100000000000200000000000000040a00000000000000000000008040000000000000000008000000000000000001000003000000004400050000000000000000000000000000000000000004d23c"], 0xfc}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="67400f07c40249af4b8bb9800000c00f3235010200000f300f20a366450f769e00000100440f20c03588001d00445b66baf80cb88cf4b684ef66bafc0ced460f01c9c4827d24c366ba4cf0ff07ef87f345a57a43e16806a4", 0x58}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x1000, 0x10000, 0x4, 0xf, 0xfd, 0x99, 0x40, 0x7, 0x0, 0x2b, 0x16}, {0x200000, 0xeeee8000, 0x3, 0x0, 0x40, 0x5, 0x7d, 0x6, 0x7, 0x7, 0x3, 0xb5}, {0xeeef0000, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa8, 0x4, 0x4}, {0x80a0000, 0xeeee0000, 0x8, 0x6, 0x4, 0x42, 0xb, 0xff, 0x8, 0x7, 0xf}, {0x10000, 0xe000, 0x2, 0x3, 0x3, 0x6, 0xab, 0x7e, 0x7, 0x2, 0xdb}, {0x1000, 0x100000, 0xc, 0x7, 0xb1, 0x8, 0x21, 0x80, 0x80, 0x0, 0x1}, {0x3000, 0x8000000, 0x4, 0x1, 0x2, 0x5, 0x7, 0x3, 0x5, 0x81, 0x1, 0xf0}, {0x100000, 0xd000, 0xa, 0x5, 0xd4, 0x4, 0xc, 0x36, 0x2, 0x9, 0xb0, 0x9}, {0x4, 0x1000}, {0x2000, 0x5}, 0x80000031, 0x0, 0x8000000, 0x2024, 0x3, 0x500, 0x3000, [0xf90000000000, 0x4, 0x80, 0xfff]}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000064010100000000000000000000000000fc01000000000000000000000000000000000000000000000a0000"], 0xfc}}, 0x0) r4 = socket$l2tp6(0xa, 0x2, 0x73) sendto$inet6(r4, 0x0, 0x0, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, 0x1c) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r5, &(0x7f0000000000)="9000000000010504000000000000000002000000340001801400018008000100ac1414aa08000200ac1414bb1c00028005000100110000000600020013c400000600030013c40000340002801400018008000100ac1414bb08000200ac1414aa1c00028005000100110000000600020013c400000600030013c400000c0005800800010073697000080007000000012c", 0x90, 0x0, &(0x7f0000000400)=@nl, 0xc) r6 = socket$inet(0x2, 0x2, 0x11) bind$inet(r6, &(0x7f0000000100)={0x2, 0x13c4, @local}, 0x10) sendto$inet(r6, &(0x7f0000000200)='INVITE sip:a@b SIP/2.0\r\nVia: \r\n SIP/2.0/UDP 172.20.20.170:5060\r\n\r\n', 0x42, 0x0, &(0x7f0000000300)={0x2, 0x13c4, @remote}, 0x10) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r7, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) 9m48.457179216s ago: executing program 40 (id=2356): syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0xb0000, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00'}) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001400090527bd7000fddbdf25021f00cb", @ANYRES32=r1, @ANYRES32=r1], 0x48}, 0x1, 0x0, 0x0, 0x40408ad}, 0x0) r2 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) r3 = dup(r2) read$FUSE(r3, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="c7b4b165fab08bd4504c39c9585fa0af10ea65d73cd28471c0134a1c56a6e9287866a86f932f5559d19c840085c9e1337e35c431ee8cdd6f60f0286c85ee014779fecdb4e952a0c194d0768fe2f1009bdf61210e538af6d2f2760ee9e9432e8e2e9dff66d97126cd61302813eccac83f8d27c87248db5eec5974c0951fac2b928285c0dd3c149ba9cd94a95b3321383862b601573ad345e9e37eda1a68bd235df571ade5e6f3b49af2ea366887033dbd5c837f4ee933ac18bf1819669acffbe6803bd8c97707ee358af50517e107bab4664826fc5651a2765c2da08c3f53c979d77a7f13b690c0dac338402e400b69af6f9707e2", @ANYRES64=0x0, @ANYRESDEC=r3], 0x50) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=@newlink={0x4c, 0x10, 0x1, 0x70bd6c, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2944d}, [@IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0x1000, 0xfffffff9, 0xfffffffb}}]}]}, @IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24004800}, 0x4000040) mremap(&(0x7f000007e000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000007f000/0x1000)=nil) getrandom(&(0x7f0000000580)=""/265, 0xffffff3f, 0x3) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r5, 0x0, 0x60, &(0x7f00000008c0)={'filter\x00', 0x7, 0x2, 0x3e0, 0x1f8, 0xe8, 0x0, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28}}, {{@arp={@local, @empty, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {@mac=@multicast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'vxcan1\x00', 'nr0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @broadcast}}}, {{@arp={@remote, @multicast2, 0x0, 0x0, 0x0, 0x0, {@mac}, {@empty, {[0x0, 0xff]}}, 0x0, 0x0, 0x0, 0xfffd, 0x0, 0x0, 'pim6reg\x00', 'vcan0\x00', {}, {0xff}}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "dcbc4f0fcafe5fd600342efa7968d220b64d039e8a81d171eeb2e9630554"}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x100000000000600d, 0x1) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f0000000100)) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$BLKTRACESETUP(r7, 0xc0481273, &(0x7f0000000000)={'\x00', 0xc, 0x2, 0x803fd, 0x1, 0x800}) process_vm_writev(r6, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0xd8d0481}], 0x1, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000200)={{0x7000, 0xd000, 0xe, 0x0, 0x8, 0xee, 0x11, 0xfe, 0x0, 0x0, 0x7, 0xeb}, {0x4000, 0xeeef0000, 0xc, 0x7, 0x41, 0x7, 0x4, 0x14, 0x0, 0x5, 0x8, 0x3}, {0x5000, 0x2000, 0xb, 0xc, 0x26, 0x7, 0x81, 0x3, 0x80, 0x4, 0x1, 0x73}, {0x5000, 0x6000, 0x0, 0xfe, 0x6, 0xaa, 0xc3, 0xfb, 0x0, 0x2, 0x5, 0xe}, {0xb000, 0x80a0000, 0xa, 0xff, 0xc, 0x9, 0x6, 0x7, 0x5, 0x6, 0x28, 0xfc}, {0xffff1000, 0x10000, 0x9, 0xb9, 0x5, 0x5, 0x42, 0x7, 0xac, 0x1, 0x0, 0x10}, {0x8080000, 0x0, 0xf, 0x1, 0xc, 0x8, 0x2, 0x62, 0xe4, 0x1, 0x14, 0x5}, {0xffff1000, 0xeeee8000, 0xa, 0x21, 0xc, 0x8, 0x9, 0x9, 0x6, 0x8, 0x43, 0x3}, {0x58000, 0x5}, {0x4000, 0x6}, 0x40000000, 0x0, 0xeeef0002, 0x200, 0x8, 0x801, 0xeeee0c00, [0x1, 0x1004, 0x5, 0x9]}) r8 = socket$inet6_udp(0xa, 0x2, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0xe}, @IFLA_BOND_ARP_IP_TARGET={0x8, 0x8, 0x0, 0x1, [@multicast1]}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) bind$inet6(r8, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) connect$inet6(r8, &(0x7f0000000140)={0xa, 0x4e20, 0x4, @remote, 0xb}, 0x1c) syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[], 0x0) socket(0x26, 0x80805, 0x0) 9m48.272835707s ago: executing program 41 (id=2346): r0 = socket$rds(0x15, 0x5, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205647, &(0x7f0000000100)={0xf020000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f911, 0x8000, '\x00', @p_u16=&(0x7f0000001b80)=0xa}}) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0xa00, 0x0, 0x101, 0x100}}) connect$rds(r0, &(0x7f0000000700)={0x2, 0x4e20, @multicast2}, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(0xffffffffffffffff, 0x0, 0x15) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000300)=[{&(0x7f0000000100)="580000001400190908000000000000560a1174790000000000000000580000940f6a0325010ebc000024967e5f6c32423478ee1700000000f1681900800004fffeffe809005300f1f5dd00000010000100090c020000000000204e000062737f1beea2a907b03e2d7be6a49af4b46fb16d9e785928d084f1bfc64049b66e5dd09cbaa0a2328ccf755afa73e2f3f59064e3c73dd5fd545a0be90ecb64ec90e04446a297df4fce32afbf1b356e0bb54e39f4aac482cfd200000000000000", 0xfffffffffffffed5}], 0x1) ioctl$HCIINQUIRY(r3, 0x400448ca, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f00000002c0)={[&(0x7f0000000080)='%\\.&\x00', &(0x7f00000000c0)='\x00', &(0x7f00000001c0)='{\xc4*\x16/-\x00', &(0x7f0000000200)='))\'+[$%\xcb@!\x00', &(0x7f0000000240)='!:\\+-!\'@%&(\x00', &(0x7f0000000280)='\x00']}, &(0x7f0000000500)={[&(0x7f0000000340)='-\x00', &(0x7f0000000380)='{\x00', &(0x7f00000003c0)='\x00', &(0x7f0000000400)='!\x00', &(0x7f0000000440)='-/\'\x14]\x00', &(0x7f0000000480)='!{{/)%}\x00', &(0x7f00000004c0)='\x00']}, 0x0) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) socket$inet6_sctp(0xa, 0x1, 0x84) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r5, 0x400448e2, &(0x7f0000000300)) r6 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000003cc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r6, 0x82, 0x40, &(0x7f0000003d40)={[{0x3a, 0x4e00, "de14ed8854e9c687cff5dc2255d6c2ef988aa9b6d13255e0bacf977a4eb58da4f1e18bc0e4caaa773cbda76d50237f2c020fa0315db297b597a6"}]}) 9m48.082386643s ago: executing program 42 (id=2343): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@bridge_delneigh={0x28, 0x1e, 0x1, 0x70bd2a, 0x4, {0xa, 0x0, 0x0, 0x0, 0x0, 0x8}, [@NDA_DST_MAC={0xa, 0x1, @multicast}]}, 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4000004) prlimit64(0x0, 0xf, &(0x7f0000000140)={0x400004, 0x8d}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r2 = mq_open(&(0x7f0000010140)='e_1\x00\xeb\xf0\xbbr\vF\x960\x10w\x81\x1d\x8c\x87\xe2K}\x8b\xdf\xd3[[9', 0x8c2, 0x30, 0x0) mq_timedsend(r2, 0x0, 0x0, 0xdf37, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, 0x0) mq_timedreceive(r2, &(0x7f0000001140)=""/170, 0xaa, 0x0, 0x0) r3 = io_uring_setup(0xf08, &(0x7f00000003c0)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="30000000000000000000000001"], 0x30}], 0x1, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x20, &(0x7f0000000000)=[r3], 0x1) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r5, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=@random={'user.', '/dev/nullb0\x00'}) r6 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x109202) ioctl$USBDEVFS_GETDRIVER(r6, 0x41045508, &(0x7f00000003c0)={0x0, "c25cacd8771e5486e44edb756b1c5d6bdae54790c1178269f1040e91f77011a9ddefde923acb1657adabaa378aa6cf1a217c708f44092ac0be1e878cfb2e61a1ad2eb33bd8670da0e565e3211a93c594901ab7bac217e99d3f4ed101e3b5463d3d8709b94e3875bbef5382ec6d831ecca59be07d1601b8ee7487f8bf675227f4f861e4c582ee09f0ba55662194e19516f736d3c437cfebce34e1a2379cd364c8a8c3cee03dffdc6c6a3a404e567dda7dd283a1e83b8cbfef18cda8cb3d7d8f72e1a018c697bbd1bc0939a94f3b1da8c311fd381ace06a3ccde21c3f20a5a85bc6dc4ea59405ffc3d89fe0ffde0049cf3c78781e500"}) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000200)=ANY=[]) 6m54.328419139s ago: executing program 43 (id=2741): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x123) io_submit(0x0, 0x3, &(0x7f0000001580)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x6, 0xfff, 0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x1}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x3, 0x9, 0xffffffffffffffff, &(0x7f00000002c0)="94f8c1c3b4f9bc13c70d657de19fa6fc88d91f6d0e1bc30e675c9e3c76a5d9a6c2be2fe8", 0x24, 0x4, 0x0, 0x2}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x7, 0xe4, 0xffffffffffffffff, &(0x7f00000003c0)="ef8cbd895dc04e0cff7fbf6369c039d15d0dff518ff90d5a3cf85a132c52fdc9973cc49146ce0ff5e9053cfb77cfa3f583c192732bdeecf2b1b79369e9c46cdb56c39f963973d757e80ca0f3ce4c0059a90eda19f48e7a2f00a97d6cb9868fd6c8fe24b2b8334cdc193641278d2cd1d247bda373b7763db039ea5501f4251c5d518e577d51bb425aa0685434738a359c77e55d294a0c68e0a262cfd54d75c7c1a4629d60efa4f68988a1325f08af7bee93c89e66695b368d6fc8d6b5003a02e999e4a74c67a5d8467ee172a7a1b7bd6482a7b0dd5cc21b5e0b6bc9b03c5985fd3bd2bc31e524768e41ee", 0xea, 0x4, 0x0, 0x3}]) ptrace(0x10, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) 6m22.173581326s ago: executing program 1 (id=2805): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) setrlimit(0x2, &(0x7f00000000c0)={0x0, 0x2400000}) timer_settime(0x0, 0x1, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) getrlimit(0xe, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000480), 0x4) ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x747}], 0x1, 0x0, 0x0, 0x0) mprotect(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000009c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x70bd2b, 0x25dfdbfb, {0x60, 0x0, 0x0, r3, {}, {0x4, 0xa}, {0x1, 0x5}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_LIMIT={0x8, 0x2, 0x1}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x5}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x80c4}, 0xc010) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@getqdisc={0x38, 0x26, 0x400, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x10, 0x8}, {0xf, 0xfff3}, {0xd, 0xffed}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x44) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) r5 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r6, r7, 0x2c, 0x1000) io_uring_enter(r5, 0x7fffdfe, 0xcf28, 0x87, 0x0, 0x0) 6m16.413542847s ago: executing program 1 (id=2812): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) setrlimit(0x2, &(0x7f00000000c0)={0x0, 0x2400000}) timer_settime(0x0, 0x1, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) getrlimit(0xe, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000480), 0x4) ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x747}], 0x1, 0x0, 0x0, 0x0) mprotect(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000009c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x70bd2b, 0x25dfdbfb, {0x60, 0x0, 0x0, r3, {}, {0x4, 0xa}, {0x1, 0x5}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_LIMIT={0x8, 0x2, 0x1}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x5}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x80c4}, 0xc010) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@getqdisc={0x38, 0x26, 0x400, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x10, 0x8}, {0xf, 0xfff3}, {0xd, 0xffed}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x44) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) r5 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r6, r7, 0x2c, 0x1000) io_uring_enter(r5, 0x7fffdfe, 0xcf28, 0x87, 0x0, 0x0) 6m14.64976237s ago: executing program 0 (id=2817): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="60010000100001000000000800000000ac1e0001000000000000000000000000fc01000000000000000000000000000100000000000000000000200000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0a0101010000000000000000000000000000000033000000ac1414aa0000000010000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000008056000000000000000000000000000000010000000000000000000000100000000900000008000000000000000000000002000100c90000000000000008001d00feffffff480001007368613235360000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200017"], 0x160}}, 0x0) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x1, 0x4, 0x4, 0x4, {0xa, 0x4e20, 0x0, @mcast1, 0x31}}}, 0x32) 6m14.448451422s ago: executing program 0 (id=2819): read$FUSE(0xffffffffffffffff, 0x0, 0x0) creat(0x0, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x110) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x800005}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) readv(r0, &(0x7f0000001400)=[{&(0x7f0000000880)=""/240, 0xf0}], 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) sched_setscheduler(0x0, 0x6, &(0x7f0000000080)=0xd) r2 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000000)={0x11, @loopback, 0x0, 0x0, 'lblcr\x00', 0x32, 0x0, 0xfffffffc}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) 6m14.277922574s ago: executing program 1 (id=2820): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100), 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x700000000000000) 6m10.940559097s ago: executing program 0 (id=2822): syz_open_dev$media(&(0x7f0000000000), 0xe, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setparam(r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000400), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000b40)=ANY=[@ANYBLOB="14020000", @ANYRES16=r4, @ANYBLOB="01002bbd7000fbdbdf250100000008000100010000000c0004800500030080ff000008000200010000000400088008000100ffffffff"], 0x214}, 0x1, 0x0, 0x0, 0x1}, 0x48084) io_uring_setup(0xd94, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_GET_INTERFACE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x240000d4}, 0x24048801) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000740)=@newtaction={0x74, 0x30, 0xb, 0x5, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x3ff5, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x80000001, 0x0, 0x0, 0x0, 0x400}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_PORT_MAX={0x6, 0xe, 0x4e24}, @TCA_CT_NAT_PORT_MIN={0x6, 0xd, 0x4e21}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}, 0x74}, 0x1, 0x0, 0x0, 0xc4}, 0x40) 6m10.821652152s ago: executing program 1 (id=2823): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) setrlimit(0x2, &(0x7f00000000c0)={0x0, 0x2400000}) timer_settime(0x0, 0x1, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) getrlimit(0xe, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000480), 0x4) ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x747}], 0x1, 0x0, 0x0, 0x0) mprotect(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000009c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x70bd2b, 0x25dfdbfb, {0x60, 0x0, 0x0, r3, {}, {0x4, 0xa}, {0x1, 0x5}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_LIMIT={0x8, 0x2, 0x1}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x5}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x80c4}, 0xc010) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@getqdisc={0x38, 0x26, 0x400, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x10, 0x8}, {0xf, 0xfff3}, {0xd, 0xffed}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x44) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) io_uring_enter(0xffffffffffffffff, 0x7fffdfe, 0xcf28, 0x87, 0x0, 0x0) 6m10.778909161s ago: executing program 6 (id=2825): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x0) r1 = fanotify_init(0x200, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000403810b61200000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB='@#@'], 0x0, 0x0, 0x0, 0x0}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x2002, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$ttynull(0xffffffffffffff9c, 0x0, 0x8000, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) fanotify_mark(r1, 0x2d, 0x1001, r0, 0x0) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) fanotify_mark(r1, 0x1, 0x4800003e, r0, 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14507e, 0x0) 6m8.63783715s ago: executing program 8 (id=2826): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0xf32, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f00000000c0)=0x81) readv(r0, &(0x7f0000000000)=[{&(0x7f0000002480)=""/4110, 0x100e}], 0x1) r1 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000540)="900000001c001f4d154a817393278bff0a80a57802000000e503740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e00a2c5fed0759cb068d0bf46d32345653667601e", 0x48, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r2 = timerfd_create(0x0, 0x0) read(r2, &(0x7f0000000240)=""/123, 0x7b) 6m6.266288343s ago: executing program 6 (id=2827): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xee00, 0xffffffffffffffff}}, './file0\x00'}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000240)="2e9b3d0007e03dd65193dfb6c575963f8864", 0x12}], 0x1) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000980)={0x4d4, 0x27, 0x9, 0x703d27, 0x1, {0x13}, [@nested={0x481, 0xbf, 0x0, 0x1, [@generic="93ac3bacdad87bcc3d2b69bd087bd363ec07f16c31c5ccfa61e252c60b9426110e7fc8c6c78ee231110f9ef6e2841267e52ea4020c7c64389b430822860b0af6a189f6925002309eadba708c7baa01522433b16a8afff975d860d0f273874a8a54cbc465475c440774df73f94cad0b0388b94feae35c0dd31225e397160779ef4d343332c76ccf7bc350d8269a5fe1a790e3b5e7228b03daa5288f5d275d30f0ce5b7c29d0369438efdcc6a205511faf9ab4dcbe6eec5905ab077b502ac36da8a6abd9b7eb5f5103598fff5a3000d8d63d18cdeb326b16c83252111b48ba8010715fabb5fe18fb7825897f2f777372bfc963f7cfc288", @generic="d22210ce4b1388a78a05b68be8434ba5c6fcb588991385b707cb4322600f52bf4bc63b2067abb9165e5df6b93a46f467c3d7fc4ffdee824f602a76dca1add542a85b8e634961dbfdb59dfd843f7fd6cfba95ec06d6bb736ddf067db63906a0b57ac5205f2e03947b96c23b87a8c148dfd4783a32cdb88d43c139ffdeb99246d050d29d790ce360a576d14633763061b819834f8229e00859d09706e1d6d292feb3fe0fe903c684fa5cbea9afeedf503d334a2428216dc941d9c994d9e8424cfcdfac47293b177ef32afde624ed0c75c719f5daee5749d1430a297bb2508d917945874964bef0628e6dbb392316a7e795249110164f39465a9966ea", @nested={0xc, 0xe9, 0x0, 0x1, [@typed={0x8, 0x62, 0x0, 0x0, @uid=r2}]}, @typed={0x8, 0x145, 0x0, 0x0, @u32=0x2}, @nested={0xfb, 0x1c, 0x0, 0x1, [@nested={0x4, 0x115}, @typed={0x8, 0x146, 0x0, 0x0, @u32=0x3}, @nested={0x4, 0xde}, @nested={0x4, 0x167}, @nested={0x4, 0x14}, @generic="c60c0c88008ec0eba4566e46b4228b73c98e4978ddc398afcca4c13c095a8d2081925062e8081175804c6e3f7abaea55eab7abc648a9a964b8b00d26beab73abc194053f10f01ef0b62c6fd8f8f4343e9f384215e14331c01f9babb10be168479706773df0e881cc51e1516b21a8466580454455dec426f14d102481b86d463f07a1d6c337206f2d80897cd835ced243ebae6bf35ce6621bf649d4ed7fb5ee375406be3cf4beb88ecb873b919c7abaa4d728e5820728e3a1aa7e7c0798990c9ba2c1e1e03ea5d240a4313cd5dab1ffafebceb915923ff44e354c6f2905a780"]}, @typed={0x8, 0x25, 0x0, 0x0, @u32=0x80000001}, @typed={0x8, 0x54, 0x0, 0x0, @uid=0xee00}, @nested={0x168, 0x8, 0x0, 0x1, [@generic="65a13c952d4cb1fcaafe8467717e2b47fc1c426f7f863aad42e015018d6198cd19210fb22afa128e9fa8bd7fd1817ae74df16af1438d2848588c6400ef83ce051dc98364c007ff0d5204d794e31509894958739378391efa3435c271a1679e7d1ec7bb14ca04df6055246ecb60dc04ed05cda3762f805a49a9d9db1080e06b6b9c1f", @generic="5f35c40171e5503616ab521849f3d7e3103eafdcd6ffc07a5f2f3aef444b4907100e84f55a6a1d3345", @generic="1ecfcb36cf0f8c1de7d353f63c28cbbb33367ff6d961b9876e02f93e20bcb41ea88a35a7d2a061aa9355dbc080c96c1beb5f42a8c3b1894505ba8df41b2ba8b887b991efb1df71e5e366a822d38e863a84adef05b04940bbd9a3289e75f7ee3681dcb5e245820c69fd51ba6f7052314f1e04c1812d34c01799ad642136ec79244b27537e4932e12ad23aad1b3e846ee7a1948c1c7528ac17b26b2b0cfb0bce93ddb428ba2e", @typed={0x14, 0xe0, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}}]}, @typed={0x4, 0x148}]}, @typed={0x8, 0x108, 0x0, 0x0, @uid=r2}, @nested={0x31, 0x8, 0x0, 0x1, [@generic="b936b08588792c8d954a0913728ec14a91441e96c6f29c202271109d2a597b302d3cbfeb63779ac1e2cc0f1ddb"]}]}, 0x4d4}, 0x1, 0x0, 0x0, 0x42804}, 0x2000010) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = dup2(r0, r0) sendmsg$NFT_MSG_GETOBJ(r6, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x13, 0xa, 0x3, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x20044800) 6m5.095206511s ago: executing program 8 (id=2828): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40186f40, &(0x7f0000000440)=0x10) r1 = open$dir(&(0x7f0000000400)='./file1\x00', 0x200080, 0x3d) renameat2(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', r1, &(0x7f0000000280)='./file0\x00', 0x2) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000100)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) dup(0xffffffffffffffff) syz_ublk_setup_queues(r0, 0x0, &(0x7f0000000180)={0x0, 0xb892, 0x400, 0x4000, 0x2f6}, 0x0, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) fchdir(0xffffffffffffffff) open(0x0, 0x1031c2, 0x0) r4 = syz_open_dev$swradio(0x0, 0x1, 0x2) r5 = dup(r4) ioctl$VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000000)={0xf0f045}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) modify_ldt$write2(0x11, 0x0, 0x0) poll(&(0x7f0000000180)=[{r4, 0x3}], 0x1, 0x9) timer_delete(0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x202, @empty, 0x4ac2d78a}}, 0x0, 0x0, 0x34, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd460104000000000000131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c388df6"}, 0xd8) 6m4.75763542s ago: executing program 0 (id=2829): bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) socket(0xa, 0x3, 0xff) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xff05, 0x8000000, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0xbc2a4219f6b34c13}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}, 0x1, 0x0, 0x0, 0x1f000000}, 0x20000840) 6m4.03088264s ago: executing program 1 (id=2830): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="6800000042000100000000001000000003010000060000002600010000112233445566778899aabb0800450000140000000001170000010203040506070800000c00020006000600080000000c00030008000c00040001"], 0x68}, 0x1, 0x0, 0x0, 0x400c005}, 0x0) 6m3.697758185s ago: executing program 0 (id=2831): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'trusted:', 'syz', 0x20, 0xffc}, 0x2d, 0xfffffffffffffffa) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='load trusted:'], 0x30, 0xfffffffffffffffa) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001680)) r1 = eventfd2(0x1, 0x80001) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000001c0)={0x0, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001500)=""/184, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x0, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x1}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/4096}) connect$vsock_stream(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000500)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x1, 0x0, 0x3, 0x4, {0xa, 0x4e21, 0xd, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x6}}}, 0x3a) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) syslog(0x1, &(0x7f0000000140)=""/179, 0xb3) 6m2.846719613s ago: executing program 1 (id=2832): r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$video(&(0x7f0000000100), 0x6, 0x2) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4000}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x1f) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r5, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r4, 0x0}]) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x24e380, 0x0) close(r6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @broadcast}) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x3, 0x4}) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000500)=0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x3, 0x101}, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x800) socket$can_j1939(0x1d, 0x2, 0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r7 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) msgget$private(0x0, 0x4d2) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x10, &(0x7f0000000000), 0x0) ioctl$IOMMU_VFIO_IOAS$SET(0xffffffffffffffff, 0x3b88, &(0x7f0000000200)={0xc}) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000019c0)={0xc}) ptrace(0x8, 0x0) 6m1.871017062s ago: executing program 8 (id=2833): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='proc\x00', &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='nfsd 127.0.0.1 999999999 test\n\x00', 0x1e) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt/net/rpc/auth.unix.ip/flush\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='1\n\x00', 0x2) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f0000000100)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3e000000000b03000000000019000000060000040d0001002a2640242a40242f0000140004000100"], 0x28}, 0x1, 0x0, 0x0, 0x20008840}, 0x4001800) sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYRESDEC=r0], 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 6m1.845055053s ago: executing program 6 (id=2834): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='ns\x00') r1 = open_tree(r0, &(0x7f0000000300)='./cgroup\x00', 0x89801) open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x89101) r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, 0x0) syz_open_procfs(0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) write$FUSE_STATFS(r2, &(0x7f0000000340)={0x60, 0x0, 0x0, {{0x9, 0x2, 0x7, 0x101, 0x7f, 0x4, 0x8, 0x800}}}, 0x60) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x11, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)=@newqdisc={0x24, 0x29, 0x1, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x40000) openat$binderfs(0xffffffffffffff9c, 0x0, 0x6, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) r10 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0_to_bond\x00'}) read$msr(r10, &(0x7f0000019680)=""/102392, 0x18ff8) r11 = socket(0x10, 0x2, 0x0) write(r11, &(0x7f0000000480)="1c0000001a009b8a140000003b00"/28, 0x1c) ioctl$FICLONE(r11, 0x40049409, r9) 6m1.510986626s ago: executing program 0 (id=2835): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff0000000705810240"], 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x3, 0x0, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000680)={0x40004000, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {}, {0xc, 0x13, @udp='udp:syz0\x00'}}}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x4044004) r6 = socket$vsock_stream(0x28, 0x1, 0x0) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) bind$vsock_stream(r6, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x14, 0x17, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0xffff}}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x800) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x20, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x6}}, 0x20) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_VMCI_SET_NOTIFY(r8, 0x7cb, &(0x7f0000000040)={0x3, 0x2, 0x3}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000240)={0x14, &(0x7f0000000140)={0x20, 0x24, 0x4e, {0x4e, 0x22, "aeccfc56d9a64a9790ca2a36d4b682c06b5b9f18b14ef3e02cfaedcf03dd092a98bf6a3f6c2b48e5f4e67e7ad62122d39743c6adb2e8af145df32f4e6847851c15d87163a83483a0a380f245"}}, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41f}}}, &(0x7f00000006c0)={0x2c, &(0x7f0000000440)={0x40, 0x14, 0xd9, "c2799e9497d2a5b51fc570d96f57866183c73b7d2a2099ca8906e4e26955c4d41973bf104f63f0d472bf24a6492a0308bfbbaf7f68cdb25b38eb39bff84401aae06ce894edb487b5bf454c2b931496e0ad3e9c1944172bf9d2873e80ddd5298fabe42375f606c416e36c0f63d548922050768d1f4a0cbb84b00da9e7c0101f1b4265b4f303eb8440e2ff851503e40e0dbdb601d2e7be22984f4c177aa0c2841a74f18fa697376cede389f4ad100c4df3b1e4a96f32c40dedf7c18d2e52141fc6c99d71c15fa6c8688cec7a5a506c0795870c180f025a5657b1"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0xab}, &(0x7f00000005c0)={0xc0, 0x5, 0x3, "fa74e4"}, &(0x7f0000000680)={0x40, 0x5, 0x5, "e1b2b86cd8"}}) 6m1.08568535s ago: executing program 8 (id=2836): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000005c0)=ANY=[@ANYBLOB="0227e0e1", @ANYRES16=r1, @ANYBLOB="010a29bd7000fbdbdf253700000008000300", @ANYRES32=r3, @ANYBLOB="0800266a6909004008e24c0300080000"], 0x2c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x4000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102384, 0x18ff0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000200), 0x0, 0xc1) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x4, 0x200000005c831, 0xffffffffffffffff, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000057c0)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) r7 = pidfd_getfd(r6, 0xffffffffffffffff, 0x0) write$FUSE_NOTIFY_STORE(r6, &(0x7f0000000240)={0x2b, 0x4, 0x0, {0x1, 0x8, 0x3, 0x0, [0x0, 0x0, 0x0]}}, 0x2b) syz_ublk_setup_io_uring(0x19, &(0x7f0000000040)={0x0, 0x97b1, 0x0, 0x0, 0x158, 0x0, r7}, &(0x7f0000000100)=0x0, &(0x7f0000000280), &(0x7f00000005c0)) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14, 0x80000) ioctl$ifreq_SIOCGIFINDEX_wireguard(r9, 0x8933, &(0x7f00000003c0)={'wg1\x00', 0x0}) sendto$packet(r10, &(0x7f0000000700)="ea792fe89b2b21c0f5bc6d105e0ae341edfc149a538867c27b479d8dd94d5fbfd97baa3448a4ec4e03b9e943c775cf1010cbadd458010d1d170daa3f0868af31caa190d806208a3dc56ee3e32f2c9d05ecefbbe3067bb2aa78b2ae65971e7c01f2c06c4cceb13c6af55bd464c8dfddb72f981a89fe01005ae426379d1c54f9d51249e6da4c04efd1fc57cfbb381ce9964404be844443f73a70a51ceacebf7f3182557d6898e5d7326723f7ecc043d599e72741adc3abac2b77480742b42409058b1b8e1a6db7d44eac06386dbb2253577fb5758ef8de51d65269373e2ef4d13544e0a7b4d66bfffb68e0e1227d2b0d1f2f2734ebc263dd81f067", 0x55, 0x0, &(0x7f0000000440)={0x11, 0x9, r11, 0x1, 0xf, 0x6, @remote}, 0x14) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="640000001000010429bd700000000000e0000000", @ANYRES32=r8, @ANYBLOB="00010000316f0600300012800b00010067656e657665000020000280080011"], 0x64}}, 0x20000000) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0), r6) sendmsg$IPVS_CMD_SET_DEST(r12, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)=ANY=[@ANYBLOB="5c000080", @ANYRES16=r13, @ANYBLOB="000429bd7000ffdbdf25060000000800040009000000"], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4045) syz_usb_connect(0x5, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120110037a891e08d1125edc6a1f010203010902120001620090090904590b00ff02f92d665d721601"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0}) 5m54.05921369s ago: executing program 8 (id=2837): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000640)=ANY=[@ANYBLOB="fc000000190001002db9700000070000ac050000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000643f8f169af98e86c72d008d06ae", @ANYRES32=0x0, @ANYBLOB="0000000000000000ffffffffffffff7f000000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r0 = socket$inet6(0xa, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) rseq(&(0x7f0000000280), 0x20, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) 5m53.956454054s ago: executing program 6 (id=2838): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={0x0}}, 0x0) syz_usb_connect(0x2, 0xb3, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc020101112402010102000000000000000002000009240302010100010009040100000e0200000e2401"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) 5m53.637786169s ago: executing program 8 (id=2839): syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r1 = open(0x0, 0x10507e, 0xa6) sched_setattr(0x0, &(0x7f0000000380)={0x38, 0x5, 0x4, 0x8001, 0x0, 0x7, 0x1ffffffffffe, 0x7, 0x8, 0x3}, 0x0) read$nci(r1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0x18, 0x30, 0x25, 0x70bd2b, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYRESOCT=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x58015}, 0x800) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16=r5], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001200192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200040010000800014004000000", 0x58}], 0x1) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1f, 0xb, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000040000000000000003000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000180000085000000b700000095"], &(0x7f0000000380)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x38, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1000}, 0x94) sendmsg$ETHTOOL_MSG_COALESCE_SET(r6, &(0x7f0000000580)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, 0x0, 0x100, 0x70bd25, 0x25dfdbfe}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004001) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001f80), r8) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r8, &(0x7f0000002100)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f0000002040)={0x14, r9, 0x1, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8001}, 0x20004000) 5m50.526110814s ago: executing program 6 (id=2840): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/auth.unix.gid/channel\x00', 0x2, 0x0) write(r4, &(0x7f0000000500)='-294967295 2000000\\00 0\n', 0x18) 5m49.379222937s ago: executing program 6 (id=2841): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x4000, @multicast2}, 0x10, &(0x7f0000001080)=[{&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af", 0x32}], 0x1, &(0x7f00000010c0)=[@ip_tos_int={{0x14, 0x29, 0x34}}, @ip_tos_u8={{0x11, 0x29, 0x4}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @remote}}}], 0x50}, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) creat(&(0x7f00000002c0)='./file0\x00', 0x10) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000080)={0x3, 0x40, 0xfa02, {{0x6000000, 0xfffe, 0x7, @local}, {0xa, 0x0, 0x7ffffffe, @mcast1, 0xa8a9}, r4, 0x2}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x0, @mcast2, 0x9}, {0xa, 0x4e23, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7fffffff}, r3, 0x80d}}, 0x48) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f0000000000)={0x12, 0x10, 0xfa00, {0x0, r3, r2}}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r5 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket(0xa, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="44000000fb4131acb6041a2a0700ed36000400ca", @ANYRES32=0x0, @ANYBLOB="2b03000000000000240012800b00010067656e65766500001400028005000a0001000000060005004e230000"], 0x44}}, 0x48000) setsockopt$IP_VS_SO_SET_FLUSH(r6, 0x0, 0x485, 0x0, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40400d4) r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x101200, 0x0) getsockopt$llc_int(r7, 0x10c, 0x4, &(0x7f0000000040), &(0x7f0000000080)=0x4) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0xd0, 0x270, 0xd0, 0x340, 0x340, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x44}, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@local, @loopback, [0x0, 0x0, 0xff000000], [0x0, 0xffffffff], 'tunl0\x00', 'bond_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x340}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @loopback}, @private1, [0xffffffff, 0xffffffff, 0xffffffff, 0xff000000], [0xff000000, 0xff000000, 0xff, 0xffffff00], 'wg1\x00', 'team_slave_1\x00', {0xff}, {}, 0x2f, 0x6b, 0x5}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) syz_genetlink_get_family_id$tipc2(&(0x7f0000001140), r1) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x710, 0x1100, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x0, 0x0, 0x5, 0x2f, 0x0, @empty, @private}}}}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8982, &(0x7f00000016c0)={0x7, 'team_slave_0\x00', {0x52c}, 0xfffe}) 5m47.255772037s ago: executing program 44 (id=2832): r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$video(&(0x7f0000000100), 0x6, 0x2) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4000}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x1f) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r5, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r4, 0x0}]) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x24e380, 0x0) close(r6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @broadcast}) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x3, 0x4}) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000500)=0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x3, 0x101}, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x800) socket$can_j1939(0x1d, 0x2, 0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r7 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) msgget$private(0x0, 0x4d2) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x10, &(0x7f0000000000), 0x0) ioctl$IOMMU_VFIO_IOAS$SET(0xffffffffffffffff, 0x3b88, &(0x7f0000000200)={0xc}) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000019c0)={0xc}) ptrace(0x8, 0x0) 5m45.641689363s ago: executing program 45 (id=2835): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff0000000705810240"], 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x3, 0x0, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000680)={0x40004000, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {}, {0xc, 0x13, @udp='udp:syz0\x00'}}}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x4044004) r6 = socket$vsock_stream(0x28, 0x1, 0x0) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) bind$vsock_stream(r6, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x14, 0x17, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0xffff}}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x800) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x20, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x6}}, 0x20) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_VMCI_SET_NOTIFY(r8, 0x7cb, &(0x7f0000000040)={0x3, 0x2, 0x3}) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000240)={0x14, &(0x7f0000000140)={0x20, 0x24, 0x4e, {0x4e, 0x22, "aeccfc56d9a64a9790ca2a36d4b682c06b5b9f18b14ef3e02cfaedcf03dd092a98bf6a3f6c2b48e5f4e67e7ad62122d39743c6adb2e8af145df32f4e6847851c15d87163a83483a0a380f245"}}, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41f}}}, &(0x7f00000006c0)={0x2c, &(0x7f0000000440)={0x40, 0x14, 0xd9, "c2799e9497d2a5b51fc570d96f57866183c73b7d2a2099ca8906e4e26955c4d41973bf104f63f0d472bf24a6492a0308bfbbaf7f68cdb25b38eb39bff84401aae06ce894edb487b5bf454c2b931496e0ad3e9c1944172bf9d2873e80ddd5298fabe42375f606c416e36c0f63d548922050768d1f4a0cbb84b00da9e7c0101f1b4265b4f303eb8440e2ff851503e40e0dbdb601d2e7be22984f4c177aa0c2841a74f18fa697376cede389f4ad100c4df3b1e4a96f32c40dedf7c18d2e52141fc6c99d71c15fa6c8688cec7a5a506c0795870c180f025a5657b1"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0xab}, &(0x7f00000005c0)={0xc0, 0x5, 0x3, "fa74e4"}, &(0x7f0000000680)={0x40, 0x5, 0x5, "e1b2b86cd8"}}) 5m38.412505054s ago: executing program 46 (id=2839): syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r1 = open(0x0, 0x10507e, 0xa6) sched_setattr(0x0, &(0x7f0000000380)={0x38, 0x5, 0x4, 0x8001, 0x0, 0x7, 0x1ffffffffffe, 0x7, 0x8, 0x3}, 0x0) read$nci(r1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0x18, 0x30, 0x25, 0x70bd2b, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYRESOCT=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x58015}, 0x800) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16=r5], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001200192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200040010000800014004000000", 0x58}], 0x1) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1f, 0xb, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000040000000000000003000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000180000085000000b700000095"], &(0x7f0000000380)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x38, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1000}, 0x94) sendmsg$ETHTOOL_MSG_COALESCE_SET(r6, &(0x7f0000000580)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, 0x0, 0x100, 0x70bd25, 0x25dfdbfe}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004001) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001f80), r8) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r8, &(0x7f0000002100)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f0000002040)={0x14, r9, 0x1, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8001}, 0x20004000) 5m33.964830492s ago: executing program 47 (id=2841): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x4000, @multicast2}, 0x10, &(0x7f0000001080)=[{&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af", 0x32}], 0x1, &(0x7f00000010c0)=[@ip_tos_int={{0x14, 0x29, 0x34}}, @ip_tos_u8={{0x11, 0x29, 0x4}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @remote}}}], 0x50}, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) creat(&(0x7f00000002c0)='./file0\x00', 0x10) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000080)={0x3, 0x40, 0xfa02, {{0x6000000, 0xfffe, 0x7, @local}, {0xa, 0x0, 0x7ffffffe, @mcast1, 0xa8a9}, r4, 0x2}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x0, @mcast2, 0x9}, {0xa, 0x4e23, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7fffffff}, r3, 0x80d}}, 0x48) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f0000000000)={0x12, 0x10, 0xfa00, {0x0, r3, r2}}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r5 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket(0xa, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="44000000fb4131acb6041a2a0700ed36000400ca", @ANYRES32=0x0, @ANYBLOB="2b03000000000000240012800b00010067656e65766500001400028005000a0001000000060005004e230000"], 0x44}}, 0x48000) setsockopt$IP_VS_SO_SET_FLUSH(r6, 0x0, 0x485, 0x0, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40400d4) r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x101200, 0x0) getsockopt$llc_int(r7, 0x10c, 0x4, &(0x7f0000000040), &(0x7f0000000080)=0x4) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0xd0, 0x270, 0xd0, 0x340, 0x340, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x44}, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@local, @loopback, [0x0, 0x0, 0xff000000], [0x0, 0xffffffff], 'tunl0\x00', 'bond_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x340}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @loopback}, @private1, [0xffffffff, 0xffffffff, 0xffffffff, 0xff000000], [0xff000000, 0xff000000, 0xff, 0xffffff00], 'wg1\x00', 'team_slave_1\x00', {0xff}, {}, 0x2f, 0x6b, 0x5}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) syz_genetlink_get_family_id$tipc2(&(0x7f0000001140), r1) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x710, 0x1100, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x0, 0x0, 0x5, 0x2f, 0x0, @empty, @private}}}}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8982, &(0x7f00000016c0)={0x7, 'team_slave_0\x00', {0x52c}, 0xfffe}) 1m21.123701242s ago: executing program 3 (id=3058): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x7a) inotify_init() r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) fcntl$notify(r1, 0x402, 0x1a) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) socket$inet6_tcp(0xa, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x400000, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000740)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f00000000c0)={r3}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000001c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000080)={r4, 0x3, r2, 0x5}) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r5, 0x800448d2, &(0x7f0000000040)) ioctl$VHOST_VDPA_SET_CONFIG_CALL(r0, 0x4004af77, &(0x7f0000000000)=0xfffffff6) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0xff1d, &(0x7f0000000500)={&(0x7f0000000380)={0x1c, 0x52, 0xa05, 0x0, 0x25dfdbfd, {0xa}, [@typed={0x8, 0x2, 0x0, 0x0, @ipv4=@private=0xa010101}]}, 0x1c}, 0x1, 0x0, 0x0, 0x884}, 0x0) 1m20.068473555s ago: executing program 3 (id=3065): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000100)={0x20002005}) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000040)={0xf0f046}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x6}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000d, 0x11, r0, 0xec776000) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r2, 0x65, 0x7, &(0x7f0000000040)=0x44, 0x4) setsockopt$CAN_RAW_FD_FRAMES(r2, 0x65, 0x5, &(0x7f0000000000), 0x4) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) msync(&(0x7f0000076000/0x4000)=nil, 0x4000, 0x2) sendmmsg$sock(r3, &(0x7f00000029c0)=[{{&(0x7f00000006c0)=@nl=@unspec, 0x80, 0x0}}], 0x1, 0x0) 1m19.734616163s ago: executing program 3 (id=3067): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty, 0x5}, 0x1c) listen(r0, 0xfffffffc) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x204002, 0x0) syz_open_procfs(0x0, &(0x7f00000190c0)='net/route\x00') socket$nl_generic(0x10, 0x3, 0x10) openat$dma_heap(0xffffffffffffff9c, 0x0, 0x82000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00') preadv(r2, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0xc002a0, 0x0) 1m17.070688089s ago: executing program 3 (id=3070): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x1c, r1, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x1c}}, 0x40) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000001500), 0x101000, 0x0) mq_timedsend(r3, 0x0, 0x0, 0x5, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000140)) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x2c, r4, 0x300, 0x70bd21, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2004}, 0xe000840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000500)={0x0, 0xfb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x6, 0x15e, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd756, 0x3000, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x1, 0x2, 0x3fff, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc650, 0x40, 0x82, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r11, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x1, 0x0, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x4014, {0x3c9, 0x0, 0xfffffffc, 0x80000000, 0x3, 0xfff}}) bind$bt_sco(r2, &(0x7f0000000040)={0x1f, @none}, 0x8) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000080)=0x1, &(0x7f00000000c0)=0x4) 1m15.58554809s ago: executing program 3 (id=3073): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty, 0x5}, 0x1c) listen(r0, 0xfffffffc) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x204002, 0x0) syz_open_procfs(0x0, &(0x7f00000190c0)='net/route\x00') socket$nl_generic(0x10, 0x3, 0x10) openat$dma_heap(0xffffffffffffff9c, 0x0, 0x82000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00') preadv(r2, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0xc002a0, 0x0) 1m11.168678411s ago: executing program 3 (id=3084): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x3, &(0x7f0000000140)=[{0x27, '\x00', @data=0x9, 0x7ff}, {0x21, '\x00', @buffer={"39fe1a3a93b891694d0640bd9ca4070dd5a7cfa3d91d12f166162e639e82fd21", 0x20}, 0x400}, {0x5, '\x00', @st={0x4, [{0x1, @svalue=0x401}, {0x0, @uvalue=0x7}, {0x0, @uvalue=0xe80}, {0x2, @svalue=0xe}]}, 0x5}]}) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r1, 0x0, 0x2, &(0x7f00000002c0)="e3", 0x1) getsockopt(r1, 0x0, 0x2, 0x0, &(0x7f0000000000)) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCL_SCROLLCONSOLE(r2, 0x541c, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r3, 0x0, 0x44810) ioctl$KVM_CAP_EXIT_HYPERCALL(0xffffffffffffffff, 0x4068aea3, 0x0) ioctl$TCSETS(r2, 0x545c, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, "43e6323cce19dc42a867c4e745c80552a700"}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000000)=0x8001) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) r7 = socket(0x10, 0x3, 0x0) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r8, &(0x7f00000008c0)=[{{&(0x7f0000000000)={0xa, 0x4e1f, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1}, 0x1c, &(0x7f0000001780)=[{&(0x7f0000000040)="a4", 0x1}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e21, 0x0, @remote, 0x1}, 0x1c, &(0x7f0000000740)=[{&(0x7f0000000500)='l', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r8, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r8, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x7, 0x30, 0x5, 0x5}, &(0x7f00000000c0)=0x18) sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) write$UHID_INPUT(r6, &(0x7f0000002140)={0xf, {"a2e3ad214fc752f91b500e0f30f70e06d038e7ff7fc6e5539b3275078b089b3b08385d090890e0878f0e1ac6e7049b3d6d959bffe8d178708c523c921b1b5b31300d3b5d0736cd3b78130baa61d8e809fc889b0709b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b906000000783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51015f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ff33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f761f13a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a99cc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000029566e78000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ebbd633500", 0x1000}}, 0x1006) syz_emit_ethernet(0x0, 0x0, &(0x7f0000000280)={0x0, 0x3, [0x19a, 0x86c, 0xb04, 0xa72]}) syz_usb_connect$uac2(0x3, 0x98, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003000000401e0400304000010203010902c6000301003003080b000201092006090400000001012000092401020006260003112408030100003382455fa296c46b00000c24030402030103"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) setsockopt$EBT_SO_SET_COUNTERS(r7, 0x0, 0x81, &(0x7f00000004c0)={'filter\x00', 0x0, 0x0, 0x0, [0x81, 0xd, 0xff, 0x2, 0x0, 0x1], 0xa, &(0x7f0000000340)=[{}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x118) ioctl$XFS_IOC_FSGEOMETRY_V1(r0, 0x80705864, &(0x7f00000000c0)) 56.059127872s ago: executing program 48 (id=3084): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x3, &(0x7f0000000140)=[{0x27, '\x00', @data=0x9, 0x7ff}, {0x21, '\x00', @buffer={"39fe1a3a93b891694d0640bd9ca4070dd5a7cfa3d91d12f166162e639e82fd21", 0x20}, 0x400}, {0x5, '\x00', @st={0x4, [{0x1, @svalue=0x401}, {0x0, @uvalue=0x7}, {0x0, @uvalue=0xe80}, {0x2, @svalue=0xe}]}, 0x5}]}) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r1, 0x0, 0x2, &(0x7f00000002c0)="e3", 0x1) getsockopt(r1, 0x0, 0x2, 0x0, &(0x7f0000000000)) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCL_SCROLLCONSOLE(r2, 0x541c, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r3, 0x0, 0x44810) ioctl$KVM_CAP_EXIT_HYPERCALL(0xffffffffffffffff, 0x4068aea3, 0x0) ioctl$TCSETS(r2, 0x545c, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, "43e6323cce19dc42a867c4e745c80552a700"}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000000)=0x8001) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) r7 = socket(0x10, 0x3, 0x0) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r8, &(0x7f00000008c0)=[{{&(0x7f0000000000)={0xa, 0x4e1f, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1}, 0x1c, &(0x7f0000001780)=[{&(0x7f0000000040)="a4", 0x1}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e21, 0x0, @remote, 0x1}, 0x1c, &(0x7f0000000740)=[{&(0x7f0000000500)='l', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r8, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r8, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x7, 0x30, 0x5, 0x5}, &(0x7f00000000c0)=0x18) sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) write$UHID_INPUT(r6, &(0x7f0000002140)={0xf, {"a2e3ad214fc752f91b500e0f30f70e06d038e7ff7fc6e5539b3275078b089b3b08385d090890e0878f0e1ac6e7049b3d6d959bffe8d178708c523c921b1b5b31300d3b5d0736cd3b78130baa61d8e809fc889b0709b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b906000000783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51015f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ff33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f761f13a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a99cc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000029566e78000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ebbd633500", 0x1000}}, 0x1006) syz_emit_ethernet(0x0, 0x0, &(0x7f0000000280)={0x0, 0x3, [0x19a, 0x86c, 0xb04, 0xa72]}) syz_usb_connect$uac2(0x3, 0x98, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003000000401e0400304000010203010902c6000301003003080b000201092006090400000001012000092401020006260003112408030100003382455fa296c46b00000c24030402030103"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) setsockopt$EBT_SO_SET_COUNTERS(r7, 0x0, 0x81, &(0x7f00000004c0)={'filter\x00', 0x0, 0x0, 0x0, [0x81, 0xd, 0xff, 0x2, 0x0, 0x1], 0xa, &(0x7f0000000340)=[{}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x118) ioctl$XFS_IOC_FSGEOMETRY_V1(r0, 0x80705864, &(0x7f00000000c0)) 19.338318147s ago: executing program 2 (id=3222): bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0xe, 0x0, 0x0, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='bic', 0x3) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'lo\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000400}, 0x24000000) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB], 0x48) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c49f8f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000000104010400000000000000000100000605000100010000000a0003000000000003000000"], 0x28}, 0x1, 0x0, 0x0, 0x84}, 0x884c) recvfrom$inet(r0, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2c0, 0x130, 0xc8, 0x8, 0x130, 0x5803, 0x250, 0x2e8, 0x2e8, 0x250, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffff00, 0xffffffff, 0xff], [0xffffff7f, 0xfffffefe, 0xffffffff, 0xffffffff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x84, 0xb7}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2000000000000}}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xc, 0x100, 0x3}}}, {{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, [0xffffff00, 0xff000000, 0xff000000, 0xffffff00], [0xff, 0xffffff00, 0xff, 0xffffffff], 'team0\x00', 'wg2\x00', {}, {}, 0x112, 0x6, 0x4, 0x10}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0x0, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x320) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x28, 0x7, 0x0, 0xa56e}]}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="5c0000000206030000000000000000000a0000000d000300686173683a6e657400000000050001000700000005000500020000000900020073797a30000000000500040000000000140007"], 0x5c}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) r5 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={'\x00', 0xc, 0x200, 0x420, 0x7, 0x1, 0x0}) syz_open_procfs(r6, &(0x7f0000000400)='net/igmp\x00') fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f00000001c0)='xprtsec\x00', &(0x7f0000000200)='mtls\x00', 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, 0x0, 0x800) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000001600)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf200000000000002600020007ffffffbd0310000000000095002000000000006916000000000000bf6700000000000004070000b964b01a4607feff00200000540700000ee61e38bf150000000000000f5700000000000065070000d23700002c030000000000001f75000000000000bf54000000000000070000000400f9ffad430100000000007c000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c4ed68ecf264e0f84f9f17d3c30e3c7bdd2d17f2f175455000078af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd390700000500000000f18c30907d7bee45a0100000fe9de56c9d05000000c6c60bef0d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cac3f1d5af65727546e7c955ccefa1f6ab689ffffff7f63ede202fa4e0a2127b8b83c71a51445dc8dfd13ff15f852a39e5b2ab7bcb8f512036a5ba6d04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916fcecc8158f0200000000c8fb735fd552bdc268694aeb0743e326c819b6cf5c8ac86f8a297dff0445a13d0045fb3cda30a673a6037ed8c85f21ec2c081bdce431e56723888fb126a19bc1172b84b3ebe174aba210d739a018f9bbec63222d20cecac4d03723f1c921b5bbf7949632cacfdd32b3a6aa57f1ad2e99e0e67a993716dbf580469f0f53acbb400001e3738270b315d362ed834f2af97787f696649a462e7e090000000000000045eac1f2014f720e83b7838e3eede14308d582685e1becd6f35154bcb4000000000000000000000000000000bc3af2b170ad3e2b26539cebca8f4ddc211bc3ccf0bd9d42ca019dd5d022cf74686e9fbe2562979eaed840a7afaab43176e65ec1118d46d1e827f3472f4445d353887a5ad103649afa1769080584f800031e03a651bb04000000ab04871bc47287cd31cc43ea0ffb567b4040c1458d0320ce7d0000413a0000000000000000005f37983f84e98a523d80bd56a57fa82b82f639601ae899a559944cb9a62a29ab028acfc1cb26a0f6a5480a55d624a0c544ba0dc828c22fe30000aa391598000000437d57fcf8295f63a70837f5cd4e5e77964522dc7ca3aa3476b7f2d851d27fd4de6eabb43e0799dc8d9fb7dc6c523ffbd74a6a40e4acb1ac872ade9d1f2ab779b8dbe843aeeda0426c767c00327b8c95b2bb6ddb55117669d9598c0f3598073f3a921c76beceff7e4fbf909a2cabf5b8ea5011db9020823b83abe54346c7af0a99fa077ffe7000feb9e44023a1749eb1d0d572b77d6e0d0fcd74031c8ef2629f5ecff4626746d6abe98a255e92c3c4f79bfcd0d91741380000cfeb73dec68ed56b5d3dfdf0cb8b71ad79000000000000000000000000000000dd434a25e95d0ec29d3adaccf89d0888031ecdfdb4dfbe444673be099ece7e4009c76c7108ef0a7e59fd6d906fbc3c9b412e0478cfee4485f423c63f49db43833c92eeeb647cebd4d7a93a17bcbb6bae5ff876375d4fe39cc2d292691672cc18ca372104ceb83a35ecedd97fc191d8f64d2b1d60c6d12911aada66c26aa4802c3514c3d92ec905000000b13f4a2575fbe943a6c40000000000000000000000000000028026b80c3899543223a6079ee96198b9a326db3be3a48af415ca28ca68c502550044ed8e29af8d763ef9b1f31befcad2ce5394601c7cdc233bff7f0000000000009fb3ad650f77e339768924dfdbeead13b88371154d743544a6091ec93e0d3fd5b4dc42911c1ba322fd4d6fbf19e617d51f964727bfd5cc5ba15370f6e1141d2271eded0b15e4316a1e4623272beb249a0928c417720be14c898f397411c88a7bcf3df46ab3efe7cd5e160c2afd3cc945f75011a102d952c7ad17a58d9be691c334ea35bae71e76e160cc2260bd028162917807ce89e11b5f261052ee0dde18efa1d802af2b7bcf6f8af41933cea0d0343261bccf64ca1c81045153eafbefdb91fbdff9ee3307d4a1837963b2dc2a3698d90e7915b098f19392e792adaea86052f4e948184001b6494e906925a092483adc7e9c8f7a29d226763c100aecae7f00619c36bceb9fb6dd7e55487d8485e498fdfc377fd3d266d21d46ab2f6b2ce22cd0aebba9b0ffbfe8ec3143c3734967c90b16ebbeeae1ce2baaae05aed6bf0f40c8a323f9235dc99698bd0b800067a901a79daada03cc77e74feb98b1586946b452764ff917a8ecc10e529c5bea49cad70e22df522c2803b6ef65df70223c6e22c3433e322d8dbd6e9b040065a9d6b3d5ae276cffe935d559bea88e1aa36b4e6c19e78457904297e77370e013b705a96548d47c609a93c45f4d1382b39c05dcc07d5b49ad75ddb3ce5b5b9416e03995da04647aa5e6fc1a6f5d663380967ccef9de49a90ced031335e3219ebd9d06c257a50497ec523f5ff7361261ccfe239d603364a42e2e81fc068fcbb9792b673827fe7018a988fbce55bb74cdb327ced4b77b8743fb3cb72cc280b9f62e4f92f46a19600b802cba88b7d0a938d9e0e6cfe5d66b874c9a0c6c04b96360d6f499d004179e5b6025c0e1050faec7ecd9de190a975db2f8c06a551236278c4766d7e22e3b85168c9851de6266c791252f919b4f8b257b5a786734e5142e4666c67aef5b7b2f88c6640995434aa8636993089c73f196c54ae829ad4307132655b075ae534fa7f1ea9a17e62357b0bd2bd1d62d34bfc1364640250136729ba4f763ff25c33e8acc806611792add8254e705fefd2a44d5b15e3b36f6b75c97c9c04c511d8cf9e24c61c8284a913a381cb1a5628878040000000000000017b68afd95d4abf7920de9ebe1c89661f4adc3d83d72b1b778e30c2bf2efbbcd054cf51f4205ebf9a98a0d9f18135cb1d8d567c3436fa697b72c3b0200000000000079c0b3339debc78352b2e65299223d7ef2bd540e78167b3ac92a4c4f826f6d0e5c4ebf4f7a70c03e2f5ddbebf168586360c3663531eb5995d228f011a10ffc8b17d716b0c528dab6d0c4fe2ee402348104bc5d4012babedee898c6d3e1017be2e9bc759d3ab4d615f5000000000000000000000000000000000000000000007fff0000000000e693e314adf7dc9f517d04f1e6ca367d30d31d3647c6059db6e1e9529eb1623ef99e2d9ac2ab4872f8e784b07a31110bef6d000000a6f9e89e6d50ee06ce716f94da60f1f22d9669560d296287c13c92070000ee7553eb2df17839542fa88d09f000e88a90cf4406b9000000000000000000000000f441d6a6f516c235c6f5863e7f454ee0e16b9aa2593eb31fa3836703e7765aaeb77a8770e518efaa6d3dd85e03b3b133eb749057cea9af75a0e6f633532f2891b8e263cb6eecea691842827bc7c8c0130187081c8d320642389f5f0c42dba0ff68e84d7b130906f17f6aa075a257310f2d92cb1d1e16468949f5675262ee318e735930b01d8f586e34537bcff7d6196f494cdcf3a712078d745db0f5687a78ee6d000b3d171a0f08299b52d207f32e9da311ca090000003a42732808515eec574f892622c5be497fc3d9ca122d7c18b9e54637812c8debc61f0e42d838e44a819b74bce1a56108bb0fde97a02475920532309c55b2c9ae9f281391ec5cc72a5e94cca1cbf1ff01000000000000bdb537a0c52bd45a9f966c25616cec30c3ea3246cb8e6aac7cf273638e6656a3e4ccadc348f0172028c99cc5f6d5c6d09ed65aa54549e73c28b7c8ad06ad3c5e3c27eec0eff1a6c84f1189919eefcee807fc081e004ffb7d3104af00ac92f1080211c4bee74381a0e31021918f27863fdbafb50f70857d52a1f7df51935a80b1980a4778d35f183ea517f55a98095305701ab3f3ae43f06e91bc7d85e3800b46926944fba9805a985e63e53a62232fcd3f01dbe1728f300e247a7ebe344f9749818ff3961b2a42664ccd680a90bbb6ab400e286acc8f9febef64594777f848ed1cf980a3da2f0f7745760a05887d0c28060d613dd6539d392fc21fee0b5131609664b821d7a994e6c5965a4fa1ec1790c54e54586907dcc5e8bac16e79da9c2444420900000000000000f888a94365b99b72796fca1b922fc9aefaf1546c17cbb1d2d2fd12cb1a49cad501a3ca218c595b667b634606c57987ebfb0783a4948e4561d5cda158fe74453ff4a837beeedba483842c57d6005b544b4f80003386edfd3d4a88a667bd41eefe0d808abed08a29e6bc370a80cc0366fb4080bfbaaa946fd47ab662c794846e403950bbc3a48bb276cbb08a8eab145c06221ef16a238e3d50ad18aea9a2cec97d3c2d0569caabe2bffe02506bc9cb7294c5d020536dd5e7a6351642112df3b55d0215aaec7e45598995e79699e47567e353e68b03f82be860b188554b734e1192f9c1a867b815ef52cdc3307c0cc9be05a40fde69c350e59f11f1d26a4d04d8c8b2c4a4d23ec931d14bc7807db773a614b670acf46f83f7c65a0f8d43c5f64705f0d27c46d4b686e867e9b0be76a7978a8f962bb5a070df97f2bf7612115cfe5ebdc7ad0bc5a5f3ace25347d0e5c347279d55aa67a967380000000000000000000000000000000000000000000000ed0942d980c754c6c69ef65c375ad018824f78b260d5f51bc3feba504408a8c8141d84f3f417603b5081680f346ff0ffbe4ae19e936511966965ce268b6345a0001c0f26a32e0a999fc869292e939dcf89b9bfd794f9c12d41959a00688cca43015a9eec58f647796adea520cd2abeb0b55c22949d10e5a05fee4543fdc1e02554a55b5fef2427a6e5708edc38fac53c2f961945a3f83cdf01979939b49bc6b1aef8c733401bbe473de8d64efbe0d123739f387d1c0d9e74f2175c174ada1678c7db79492e8dd0f34e2ccf419cf7f14ffa408b50a52685b36aed14aa22ad928191d5a2697646edc52a1c0c5d720ae690add2b34aed161f51cc1cb424f76098e1e1921e5a405f9d298a8461f2da30e47b7c6ed7c95c84c745f58723e4cddffae3b53b5b947f9435e589f9ae55b30ecd3827b2de5df31976870823da8058c2538c04e397f3d0ef90c11c74da984fa558697ecb57224ce8fa6f79aadbd7dbf3678e74d790bc2ee72769a3ada1dd504f8e4133ce1effd446bc9a2f139e65cc4bd83912af3122352506c7c2191b3705116b2f4fc20d4e93882bdd6ccea97f3a08d3565b0000000000000000000000000000d35fb97c2d7a9374294dcec3da3df9a13c4fc63b00426682534d894caee0b963a3"], &(0x7f0000000100)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x1}, 0x8}, 0x94) 17.161158169s ago: executing program 2 (id=3232): socket(0x1, 0x1, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f0000000000)=0x2, 0x4) r3 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r3, 0x3000) ftruncate(r3, 0x51a9497) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) bind$rds(r2, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000000100)={&(0x7f00000000c0)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/100, 0x1a000}], 0x1, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x1}], 0x18}, 0x4000000) 15.129756156s ago: executing program 5 (id=3242): socket$alg(0x26, 0x5, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x40800) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x402) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x1, 0x400005, 0x5}) 15.00598834s ago: executing program 5 (id=3243): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) socket$kcm(0xa, 0x2, 0x0) r0 = socket(0x2, 0x80805, 0x0) r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000059770c40c009030243d3000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000640)={0x1c, &(0x7f0000000240)=ANY=[@ANYBLOB="001401"], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f00000008c0)={0x2c, &(0x7f00000006c0)={0x40, 0x14, 0x1, "e0"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r1, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, 0x0, 0x0) syz_init_net_socket$llc(0x1a, 0x801, 0x0) socket$nl_route(0x10, 0x3, 0x0) clock_adjtime(0xffffffd3, 0x0) socket$unix(0x1, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, 0x0, 0x4004844) r6 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) read$FUSE(r6, &(0x7f0000000140)={0x2020}, 0x2020) 14.963861195s ago: executing program 2 (id=3244): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x800}, 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x7ff, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0xffc0}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8, 0x20}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/netdevsim/devices/netdevsim0/sriov_numvfs\x00', 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x25dfdbfc, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_XMIT_HASH_POLICY={0x5, 0xe, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x80042, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000080)=0xe) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000040000000200"], 0x0, 0x34}, 0x28) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='configfs\x00', &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) r6 = syz_usb_connect(0x5, 0x46, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000e75f9208c0070515c5b8010203010902340001000080000904ba00038e4ee2000905000000041a06010905010300001007c109050c04400006030f07059acbf5"], 0x0) syz_usb_control_io$cdc_ncm(r6, &(0x7f0000000100)={0x14, 0x0, 0x0}, 0x0) syz_open_dev$loop(&(0x7f0000000180), 0x800000000000006, 0x128202) mmap(&(0x7f000088f000/0x1000)=nil, 0x1000, 0x2000005, 0x13, 0xffffffffffffffff, 0x6bf28000) write$char_usb(0xffffffffffffffff, 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0) write(r7, &(0x7f0000000300)="030000001b0000000800000001000000000b000000010004000000", 0x1b) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write(r3, &(0x7f0000000600)='1', 0x1) ioctl$BTRFS_IOC_SPACE_INFO(r0, 0xc0109414, &(0x7f0000000240)={0x377, 0x6, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x3, &(0x7f0000000140)=[{0x27, '\x00', @data=0x9, 0xb}, {0x21, '\x00', @buffer={"39fe1a3a93b891694d0640bd9ca4070dd5a7cfa3d91d12f166162e639e82fd21", 0x20}, 0x400}, {0x5, '\x00', @st={0x4, [{0x1, @svalue=0x401}, {0x1, @uvalue=0x7}, {0x0, @uvalue=0xe80}, {0x2, @uvalue=0x9}]}, 0x5}]}) 14.11990632s ago: executing program 9 (id=3248): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty, 0x5}, 0x1c) listen(r0, 0xfffffffc) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x204002, 0x0) syz_open_procfs(0x0, &(0x7f00000190c0)='net/route\x00') socket$nl_generic(0x10, 0x3, 0x10) openat$dma_heap(0xffffffffffffff9c, 0x0, 0x82000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00') preadv(r2, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0xc002a0, 0x0) 12.019244271s ago: executing program 9 (id=3251): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setparam(r2, &(0x7f00000006c0)=0x4) socket$inet_udp(0x2, 0x2, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2a, &(0x7f0000000080)={0x5, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x10}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r7 = accept4$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000040)=0x1c, 0x80000) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r9, &(0x7f0000000200)={0x0, 0xfffffffffffffe26, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r8, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xa5}]}, 0x2c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) setsockopt$inet6_opts(r7, 0x29, 0x37, 0x0, 0xffffffffffffff9e) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) 11.829659909s ago: executing program 7 (id=3252): socket(0x1, 0x1, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) cachestat(r3, &(0x7f0000000180)={0x8, 0x9}, &(0x7f00000001c0), 0x0) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f0000000000)=0x2, 0x4) r5 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r5, 0x3000) ftruncate(r5, 0x51a9497) bind$rds(r4, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$rds(r4, &(0x7f0000000100)={&(0x7f00000000c0)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/100, 0x1a000}], 0x1, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x1}], 0x18}, 0x4000000) 10.853859779s ago: executing program 5 (id=3253): socket$alg(0x26, 0x5, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x40800) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x402) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x1, 0x400005, 0x5}) 10.803339829s ago: executing program 9 (id=3254): socket(0x1, 0x1, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f0000000000)=0x2, 0x4) r3 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r3, 0x3000) ftruncate(r3, 0x51a9497) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) bind$rds(r2, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000000100)={&(0x7f00000000c0)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/100, 0x1a000}], 0x1, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x1}], 0x18}, 0x4000000) 10.534580677s ago: executing program 2 (id=3255): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setuid(0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) sendto(0xffffffffffffffff, 0x0, 0x0, 0x4004190, 0x0, 0xfffffffffffffe5c) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0xc) mount$cgroup2(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x2020014, &(0x7f00000002c0)={[{@memory_hugetlb_accounting}, {@favordynmods}, {@subsystem='net'}], [{@uid_eq={'uid', 0x3d, r1}}, {@measure}, {@appraise_type}]}) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000cc0), 0x8a140, 0x0) ioctl$PTP_SYS_OFFSET_PRECISE(r2, 0xc0403d08, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$sock(r4, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000280)="f8", 0x1}], 0x1, &(0x7f0000000a40)=[@timestamping={{0x14, 0x1, 0x4f, 0x3ff}}], 0x18}}], 0x1, 0x40440d1) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000400)={0xffffffffffffffff, 0x8001, 0x9, 0x7f}) r5 = socket$key(0xf, 0x3, 0x2) r6 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000080)={0xffffffffffffffff}, 0x4) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000100)=r6, 0x4) r7 = socket$kcm(0x2, 0x1, 0x84) setsockopt$sock_attach_bpf(r7, 0x84, 0x84, &(0x7f0000000000), 0x90) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) listen(r0, 0xfffffffc) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r8, &(0x7f00000000c0)="1c", 0x10002, 0x0, 0x0, 0x0) 10.350924022s ago: executing program 5 (id=3256): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) sched_setparam(r2, &(0x7f00000006c0)=0x4) dup(0xffffffffffffffff) socket$inet_udp(0x2, 0x2, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2a, &(0x7f0000000080)={0x5, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x10}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r7 = accept4$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000040)=0x1c, 0x80000) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r9, &(0x7f0000000200)={0x0, 0xfffffffffffffe26, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r8, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xa5}]}, 0x2c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) setsockopt$inet6_opts(r7, 0x29, 0x37, 0x0, 0xffffffffffffff9e) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) 9.892649414s ago: executing program 7 (id=3258): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000640)=ANY=[@ANYBLOB="fc000000190001002db9700000070000ac050000000000000000000000000000ac1414aa00"/46, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f000000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r0 = socket$inet6(0xa, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) rseq(&(0x7f0000000280), 0x20, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) 9.853746767s ago: executing program 4 (id=3259): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs\x00') r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000000001010400000000000000000225830000002c00018014000180080001007f00001508000200e00000020c000280050001000000000006008340000300000400"], 0x44}}, 0x8800) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010029bd7000ffdbdf2500000000", @ANYRES32=r3, @ANYBLOB="100804002010000024001280110001006272696467655f736c618c65000000000c000580050019"], 0x44}, 0x1, 0x0, 0x0, 0x404c1}, 0x40040d4) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/65, 0x0, 0xeeef0000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001840)) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x4f}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r11 = socket$netlink(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000180)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r13, {0x4}, {0xffff, 0xffff}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_rr={{0x7}, {0x18, 0x2, {0x10001, "28545781a45da9098d5e47146de09627"}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4005c}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000006c0)=@newqdisc={0x88, 0x28, 0x4ee4e6a52ff56541, 0x70bd27, 0xfffffdfb, {0x0, 0x0, 0x0, r7, {0xffff}, {0xffff, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [0x4, 0xb, 0x4, 0xb, 0x2, 0x8, 0x7, 0x2, 0x3, 0xd, 0x5, 0x3, 0x4, 0x1, 0x8, 0xb], 0x0, [0x6, 0x9, 0x3, 0x7, 0xf801, 0x8, 0x2, 0xfffe, 0x1004, 0x7, 0x8, 0x1ff, 0x61b7, 0x7, 0x5, 0x6], [0x9, 0xfff, 0x9, 0x6, 0x3, 0x4, 0x4, 0x2, 0x100, 0x8, 0xf35, 0x3, 0x4, 0x4, 0x1000, 0xff]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x200484dd}, 0x4000080) r14 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r14, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 9.792138184s ago: executing program 2 (id=3260): timer_create(0x0, 0x0, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {@in6=@remote, 0x1234, 0x6c}, @in6=@local, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000340)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0x40, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, '\x00', 0x20, 0x6c, 0x40, @local, @remote, [], "0000123400000000"}}}}}}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={0xffffffffffffffff, 0x0, 0x30, 0x0, @void}, 0x10) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmmsg$inet(r1, &(0x7f0000003b00)=[{{&(0x7f0000000040)={0x2, 0x0, @empty}, 0x10, 0x0}}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000006600)=[{{&(0x7f0000000440)=@ax25={{0x3, @rose}, [@bcast, @default, @rose, @default, @bcast, @netrom, @rose, @null]}, 0x80, &(0x7f0000002380)=[{&(0x7f00000004c0)=""/191, 0xbf}, {&(0x7f0000000580)=""/7, 0x7}, {&(0x7f00000005c0)=""/16, 0x10}, {&(0x7f0000000600)=""/123, 0x7b}, {&(0x7f0000000680)=""/125, 0x7d}, {&(0x7f0000001300)=""/4096, 0x1000}, {&(0x7f0000002300)=""/111, 0x6f}], 0x7, &(0x7f0000002400)=""/104, 0x68}, 0x2}, {{&(0x7f0000002480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000002580)=[{&(0x7f0000002500)=""/17, 0x11}, {&(0x7f0000002540)=""/1, 0x1}], 0x2, &(0x7f00000025c0)=""/177, 0xb1}, 0xffff}, {{&(0x7f0000002680)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000002bc0)=[{&(0x7f0000002700)=""/95, 0x5f}, {&(0x7f0000002780)=""/38, 0x26}, {&(0x7f00000027c0)=""/13, 0xd}, {&(0x7f0000002800)=""/222, 0xde}, {&(0x7f0000002900)=""/120, 0x78}, {&(0x7f0000002980)}, {&(0x7f00000029c0)=""/80, 0x50}, {&(0x7f0000002a40)=""/224, 0xe0}, {&(0x7f0000002b40)=""/94, 0x5e}], 0x9, &(0x7f0000002c80)=""/89, 0x59}, 0x8000}, {{&(0x7f0000002d00)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x80, &(0x7f0000003000)=[{&(0x7f0000002d80)=""/85, 0x55}, {&(0x7f0000002e00)=""/235, 0xeb}, {&(0x7f0000002f00)=""/107, 0x6b}, {&(0x7f0000002f80)=""/83, 0x53}], 0x4, &(0x7f0000003040)=""/215, 0xd7}, 0x1000}, {{&(0x7f0000003140)=@caif=@rfm, 0x80, &(0x7f0000005740)=[{&(0x7f00000031c0)=""/9, 0x9}, {&(0x7f0000003200)=""/230, 0xe6}, {&(0x7f0000003300)=""/246, 0xf6}, {&(0x7f0000003400)=""/41, 0x29}, {&(0x7f0000003440)=""/4096, 0x1000}, {&(0x7f0000004440)=""/4096, 0x1000}, {&(0x7f0000005440)=""/224, 0xe0}, {&(0x7f0000005540)=""/220, 0xdc}, {&(0x7f0000005640)=""/200, 0xc8}], 0x9}, 0x6}, {{&(0x7f0000005800)=@xdp, 0x80, &(0x7f0000005d40)=[{&(0x7f0000005880)=""/169, 0xa9}, {&(0x7f0000005940)=""/182, 0xb6}, {&(0x7f0000005a00)=""/90, 0x5a}, {&(0x7f0000005a80)=""/178, 0xb2}, {&(0x7f0000005b40)=""/28, 0x1c}, {&(0x7f0000005b80)=""/45, 0x2d}, {&(0x7f0000005bc0)=""/149, 0x95}, {&(0x7f0000005c80)=""/147, 0x93}], 0x8, &(0x7f0000005dc0)=""/20, 0x14}, 0x1}, {{0x0, 0x0, &(0x7f0000005fc0)=[{&(0x7f0000005e00)=""/2, 0x2}, {&(0x7f0000005e40)=""/82, 0x52}, {&(0x7f0000005ec0)=""/52, 0x34}, {&(0x7f0000005f00)=""/147, 0x93}], 0x4, &(0x7f0000006000)=""/204, 0xcc}, 0x7fff}, {{0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000006100)=""/136, 0x88}, {&(0x7f00000061c0)=""/207, 0xcf}, {&(0x7f00000062c0)=""/39, 0x27}, {&(0x7f0000006300)=""/18, 0x12}, {&(0x7f0000006340)=""/223, 0xdf}, {&(0x7f0000006440)=""/232, 0xe8}, {&(0x7f0000006540)=""/32, 0x20}], 0x7}, 0x48477d65}], 0x8, 0x40000000, &(0x7f0000006800)={0x0, 0x3938700}) 9.605589489s ago: executing program 7 (id=3261): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) dup(0xffffffffffffffff) socket$inet_udp(0x2, 0x2, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2a, &(0x7f0000000080)={0x5, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x10}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r7 = accept4$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000040)=0x1c, 0x80000) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r9, &(0x7f0000000200)={0x0, 0xfffffffffffffe26, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r8, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xa5}]}, 0x2c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) setsockopt$inet6_opts(r7, 0x29, 0x37, 0x0, 0xffffffffffffff9e) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) 8.651483429s ago: executing program 5 (id=3262): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00"/11], 0x50) writev(0xffffffffffffffff, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB]) r0 = syz_open_dev$loop(0x0, 0x2, 0x2001) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000180)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x12, &(0x7f0000000280)=@conn_svc_rsp={0x0, 0x0, 0xa, "7212ba8b", {0x3, 0x107, 0x0, 0x5d, 0xfff7, 0x3, 0x1}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) fcntl$getownex(r0, 0x10, 0x0) prlimit64(0x0, 0xc, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_misc(r5, 0x0, 0x0) r6 = semget$private(0x0, 0x4000000009, 0x42a) semtimedop(r6, &(0x7f00000000c0)=[{0x0, 0x3, 0x1800}], 0x1, 0x0) lchown(&(0x7f0000000040)='my_tracefs/events/task/task_rename/filter\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r7, 0x0, 0x0) 8.59627682s ago: executing program 2 (id=3263): select(0x40, &(0x7f0000000040)={0x1, 0x0, 0x10001, 0x1, 0x4, 0x0, 0x3, 0x9}, 0x0, &(0x7f00000000c0)={0x9, 0x7ff, 0x9, 0xc, 0x10000, 0x3, 0x6, 0x3}, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000207d1e512d00000000000109022400010000000009040000010300020009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000bac"], 0x0, 0x0, 0x0, 0x0}, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) openat$dir(0xffffffffffffff9c, 0x0, 0x101000, 0x108) 8.473502531s ago: executing program 7 (id=3264): openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000880)=ANY=[@ANYRES8=r0, @ANYBLOB="2f2f44f258bf37c582e98067c30bcdc02660b8ecd51add8ec7e5d0bd81c26851827c6d42165391f6fb26364801ab2c499e1b1b40813dcfc78c3971d99343c0b11d6377b21cb8a551440907882e7e7788a62197c867e82982a2f367c6153a87bcf0d4da9704f8124545af14717f5db00c06b591247191063a55ea502b7f6839d92102a21112c90d5d4a6c7286d2dee6a08b5d1b12d63d97e4aa5dd9b2d165a69a731aee87d659be3f16c7b1c836f68adbaf77e061b5cf683681b41bd3f894b318063e2d13a340766d902d4d00e3ee71a7adc15348fd2eba5b3c45ecdadb31c8e892b98aab26fd428d5ee3c36987473ea68c33d769f4ddbdcdddc0fc", @ANYBLOB="dd59b975396c911f59aa75f6bc5dda77f654f67ee2f1fb60b7e270027ea880a322b249b0aa72b9a40bf8e369c13deeb2dc04e466ec2c7ed8e8de997a80d53a4f87ec6eed38d3da53d412dc555bbe3a04a6428ee01fc3f84e9a35fd80df6ee3b9d395ac2e140b53f7f04488e0226ddbbec221e5a8f94e2387d21e74db7deded84d7582d6ef3b797bc0be4ba51d14ad1af92cda5a4b8bc3292de64b9cfc1d028e5e4a16be4183203cfd7904d8308fd0c6d67524111f084bce355378e2db4baff258445", @ANYBLOB="5594953da83099af7a2aed9e92baddf95813485d184b84b84cbf847c9cb330"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x6, '\x00', r2, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000080) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYRESDEC=r5, @ANYRES8=r6, @ANYRES64, @ANYRESOCT=r4, @ANYRES32, @ANYBLOB="0000000000000000000b000000000000000000000000353a882a2627d2c0fdaaeb444b0000000000f4"], 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) keyctl$instantiate(0xc, 0x0, 0x0, 0x2a, 0xfffffffffffffffc) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$usbfs(&(0x7f00000000c0), 0x200, 0x402) pselect6(0x40, &(0x7f0000000180)={0x6, 0x0, 0x1fd, 0x5, 0x6, 0x7f, 0x104, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x7a, 0x8}, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x1, 0x2, 0x0) 7.223950137s ago: executing program 7 (id=3265): openat$sequencer2(0xffffffffffffff9c, 0x0, 0x321800, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback, 0x6}, 0x1c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2e) syz_open_dev$ttys(0xc, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x101}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0x9, &(0x7f0000000140)={0x400, 0x20000000000ffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x2, 0x0, 0x9, 0x3, 0x100000000, 0x8000320, 0xffffffff}, 0x0) r3 = socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x3, &(0x7f0000000080)=0x6, 0x5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) mlock(&(0x7f0000ffa000/0x3000)=nil, 0x3000) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) socket$nl_route(0x10, 0x3, 0x0) 7.221010451s ago: executing program 4 (id=3266): socket$alg(0x26, 0x5, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x40800) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x402) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000180)={0x1, 0x400005, 0x5}) 7.011431478s ago: executing program 4 (id=3267): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) lsetxattr$security_selinux(&(0x7f00000005c0)='./sys\x00', &(0x7f0000000600), &(0x7f0000000640)='system_u:object_r:device_t:s0\x00', 0x1e, 0x3) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000000000000000000000000000850000000e0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r0, 0x0, 0xe, 0x0, &(0x7f00000000c0)="e0b9545dd30a2131677b2d0bfa91", 0x0, 0x27cb, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow\x00', 0x0, 0x0) read(r1, &(0x7f0000000100)=""/1024, 0x400) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r1, 0xc0207511, &(0x7f0000000680)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) mq_notify(r1, &(0x7f0000000700)={0x0, 0x3b, 0x1, @tid=r2}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r1, 0xc018937b, &(0x7f0000000500)={{0x1, 0x1, 0x18, r1, {0x0, 0xee00}}, './sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow\x00'}) quotactl$Q_GETINFO(0xffffffff80000502, &(0x7f00000000c0)=@sg0, r3, &(0x7f0000000580)) getsockname(r1, &(0x7f0000000740)=@nl=@proc, &(0x7f00000007c0)=0x80) 6.936614963s ago: executing program 7 (id=3268): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'fl512\x00', [0x100, 0xb, 0x3, 0x2, 0x1, 0x102, 0x3, 0x20000000, 0x8, 0xb, 0xffffffff, 0xb51, 0x80000001, 0x400, 0x3, 0xe, 0x9, 0x9, 0xfe9, 0xff, 0x6, 0x2, 0x6, 0x8, 0x4c, 0x2, 0x6, 0x6a77, 0x8000005, 0x7fffffff, 0xa, 0xfffffffc]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$FS_IOC_READ_VERITY_METADATA(r1, 0xc0286687, &(0x7f00000001c0)={0x2, 0x3, 0x82, &(0x7f00000003c0)=""/130}) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000340)=@arm64={0x9, 0x5, 0x81, '\x00', 0xfffffffffffffff8}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = syz_open_dev$vim2m(&(0x7f0000000040), 0x200000001000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000080)=0x2) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}, 0xe7}) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$nl_xfrm(r3, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000480)=ANY=[@ANYBLOB="20010000100021040000000000000000fe880000000000000000000000000001e000000200"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff010000000000000000000000000001000000002b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000e8000000000000000400000000000000000000000000000000000000000000000000000000d983f8bebddd81870000000000000000000000000000000000000000000200000000000000000a4731950ac70a884718d0c3bd14b40dae7d727c74d5baa529743701de998a8457d9dea8c998e23dd27deb25229067e63d49f889b1b889d7f9e81d8f76d8acf26c14f578f89af8f6fc768456ec57e473023f1409fd035d1cb407701043b34440484f2275ca89"], 0x120}}, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x402) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000180)={0xdff, 0x951, 0x5}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x200000e, 0x11, r5, 0x100000000) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) msgsnd(0x0, &(0x7f00000035c0)=ANY=[], 0x1b, 0x5f005e4c1fdd0237) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x1, @ANYBLOB="00010000000000120000db4a2441d81cf5d20001", @ANYRES32=0x0, @ANYRES32=r6, @ANYBLOB="05000000040000000500"/28], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r8, &(0x7f0000000680)="1cf4f4a5e3230a6ce8a09fbbb8052259005a14a2a99e90c29537e0d23eadc83c730dba311804df23e88e3332c65d92f048cdf7f80f67f7c98259dfcb9845c5bd93d6ecdf8f8e32146c579181ad2a63e0016783236cbf935f6e18521f49efbe3c4a23eec56a7a6c9daabffb3d0b7faf4af3410e8f5c40b88f62f7d43e6bb29646f49a7f5edc30f57e4a3053d1334cf085d8b06dc3a84b389da273174f912df2d39d8ca26c992e1347dcb18f77436f5ebcd6f7388800ffca54709cc42786f568e55bcc17f3fd86f2b6cbaa42da18c385632185fa90a5eed97b3d21c2f8a738a32b12e9738015bc40ca757edac056746422541a249cba9809db25cf1e60cafc2e4f5be10ef8cf86af1785897b80fc982eed2cc13b9cd2c0229ffce3d1f37c523d6c03c96f158c17b1117ed2e176461679d21e131289c6000ba20b6644c1c6b8f9839d8e2807fef6f0ef28b3997853f0abbef767c9ba203e23fcd897f2fb5e719b1f75b466b5dde6aee0a734dfe3a1a6c44d087023c61792440cacd5606cd36a49177bcea4a985820d4b4c92fe871a1f6da06e68c2141dd8ce75b1b27acfd161665ad2ba1198406db5ba6323f6b3c12d7e19aab502bcad4083ea2d2e0604f5f9", 0x0}, 0x20) socket(0x400000000010, 0x6, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0xa08200, 0x0) 6.587953671s ago: executing program 4 (id=3269): r0 = syz_open_dev$vim2m(0x0, 0x7, 0x2) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000100)={0x20002005}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000d, 0x11, r0, 0xec776000) 6.506949512s ago: executing program 9 (id=3270): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x400, 0x2c0, 0x2c0, 0xfeffffff, 0x218, 0x218, 0x368, 0x368, 0xffffffff, 0x368, 0x368, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010102, @multicast2, 0x0, 0xffffff00, 'veth0_to_bond\x00', 'veth1_to_team\x00', {}, {}, 0x6}, 0x0, 0xc8, 0x100, 0x0, {0x300}, [@common=@addrtype={{0x30}, {0x50, 0xe01, 0x1, 0x1}}, @common=@inet=@socket1={{0x28}, 0x1}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x5, @broadcast, @broadcast, @port=0x4e23, @gre_key=0x40}}}}, {{@uncond, 0x0, 0xe0, 0x118, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x600, 0x0, 0x0, 0x0, 0x1], 0x2}}}, @common=@addrtype={{0x30}, {0x1, 0x522, 0x1, 0x1}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x16, @broadcast, @remote, @gre_key=0xff, @port=0x4e20}}}}, {{@ip={@broadcast, @loopback, 0x0, 0x0, 'lo\x00', 'vxcan1\x00'}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id}}}}, {{@ip={@loopback, @broadcast, 0x0, 0x0, 'pim6reg0\x00', 'wlan0\x00', {}, {0xff}}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x10, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x1b}, @icmp_id=0x64, @gre_key=0x1ff}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x460) 6.345493995s ago: executing program 4 (id=3271): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000640)=ANY=[@ANYBLOB="fc000000190001002db9700000070000ac050000000000000000000000000000ac1414aa00"/46, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f000000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006000000"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r0 = socket$inet6(0xa, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) rseq(&(0x7f0000000280), 0x20, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) 6.285030083s ago: executing program 9 (id=3272): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x18002, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xe}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet(0x2, 0x3, 0x7f) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, 0x0) sendmsg$NL80211_CMD_GET_SCAN(r8, 0x0, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) write$binfmt_elf64(r6, &(0x7f0000000100)=ANY=[], 0x78) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) splice(r5, 0x0, r7, 0x0, 0x8000, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r9, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r9, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) sendto$inet(r9, &(0x7f0000000000), 0x0, 0x40, 0x0, 0x0) setsockopt$sock_int(r9, 0x1, 0x12, &(0x7f0000000700)=0xdfffffff, 0x4) 5.887693003s ago: executing program 4 (id=3273): socket(0x1, 0x1, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) cachestat(r3, &(0x7f0000000180)={0x8, 0x9}, &(0x7f00000001c0), 0x0) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f0000000000)=0x2, 0x4) r5 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r5, 0x3000) ftruncate(r5, 0x51a9497) bind$rds(r4, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$rds(r4, &(0x7f0000000100)={&(0x7f00000000c0)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/100, 0x1a000}], 0x1, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x1}], 0x18}, 0x4000000) 4.886853928s ago: executing program 9 (id=3274): mmap(&(0x7f000008f000/0x1000)=nil, 0x1000, 0x2000000, 0x4008031, 0xffffffffffffffff, 0x0) r0 = signalfd(0xffffffffffffffff, &(0x7f00000007c0)={[0xffffffffffffffff]}, 0x8) setresgid(0x0, 0xee01, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) setuid(0xee01) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) setreuid(0xffffffffffffffff, 0xee01) r1 = openat$cgroup(r0, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) r2 = dup(r1) syz_usb_connect$uac1(0x0, 0x81, &(0x7f0000000180)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6f, 0x3, 0x1, 0x5, 0x0, 0x9, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0x19}, [@output_terminal={0x9, 0x24, 0x3, 0x3, 0x402, 0x1, 0x5, 0x5b}, @selector_unit={0x6, 0x24, 0x5, 0x5, 0x0, "bb"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x9, 0x0, 0x1, {0x7, 0x25, 0x1, 0xc, 0x8, 0xe}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x10, 0x45, 0x8, {0x7, 0x25, 0x1, 0xc, 0x3, 0xfffd}}}}}}}}]}}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, 0x0, &(0x7f0000000040)) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYRES16=r0, @ANYRESDEC=r3], 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000001ec0)=ANY=[@ANYBLOB="13120000120091ef"], 0xfe33) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1, 0x4, 0x3ffdcf, 0x7ff, 0x0, 0x1}, 0x48) recvmsg$kcm(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000001f00)=""/4095, 0xfff}, {&(0x7f0000000900)=""/204, 0xcc}, {&(0x7f0000000340)=""/108, 0x6c}, {&(0x7f0000000480)=""/237, 0xed}, {&(0x7f00000001c0)=""/170, 0xaa}, {&(0x7f0000001c40)=""/219, 0xdb}, {&(0x7f00000003c0)=""/180, 0xb4}, {&(0x7f0000000800)=""/192, 0xc0}, {&(0x7f0000000280)=""/124, 0x7c}], 0x9}, 0x102) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000001c0)={0x28, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x16, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @local=@item_012={0x1, 0x2, 0x0, "02"}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x8, "05"}, @local=@item_012={0x1, 0x2, 0x0, '\x00'}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "ff00"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '\a'}, @main=@item_012={0x1, 0x0, 0xb, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$can_j1939(0x1d, 0x2, 0x7) socket$netlink(0x10, 0x3, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) r6 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) r12 = dup(r11) syz_ublk_setup_queues(r12, r10, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xad58, 0x400, 0x2100, 0x10000004, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x20, 0xfffffffe, 0xae, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0x1f0, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) 0s ago: executing program 5 (id=3275): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}, {0x5, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) syz_emit_vhci(0x0, 0xf8) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) syz_emit_vhci(0x0, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010829bd7000000000000b00000008000300", @ANYRES32=r2, @ANYBLOB="60005080110001004abee339084eeef16f162471f40000000800030002ac0f000500020007"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$alg(0x26, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000080)={0x0, 0x9, 0x3, 0x1}, &(0x7f00000000c0)=0x10) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, &(0x7f0000000300)) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) lsetxattr$system_posix_acl(&(0x7f0000000800)='./file0\x00', &(0x7f0000000040)='system.posix_acl_access\x00', 0x0, 0x0, 0x2) kernel console output (not intermixed with test programs): evice strings: Mfr=0, Product=0, SerialNumber=0 [ 1353.647945][T18184] usb 10-1: new full-speed USB device number 30 using dummy_hcd [ 1353.664601][T11343] usb 6-1: new full-speed USB device number 104 using dummy_hcd [ 1353.708842][T11347] usb 8-1: usb_control_msg returned -71 [ 1353.747723][T11347] usbtmc 8-1:16.0: can't read capabilities [ 1353.817563][T11347] usb 8-1: USB disconnect, device number 50 [ 1353.828249][ T29] audit: type=1400 audit(1786069578.624:2907): avc: denied { write } for pid=19351 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1353.868497][T18184] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1353.900607][T11343] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 254, changing to 4 [ 1353.922239][T18184] usb 10-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 1353.933805][T19379] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2930'. [ 1353.965770][T18184] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1353.982500][T11343] usb 6-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice= 0.40 [ 1354.016279][T11343] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1354.029688][T18184] usb 10-1: config 0 descriptor?? [ 1354.156325][T11343] usb 6-1: Product: syz [ 1354.185365][T11343] usb 6-1: Manufacturer: syz [ 1354.201368][ T29] audit: type=1400 audit(1786069578.994:2908): avc: denied { write } for pid=19380 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1354.322257][T11343] usb 6-1: SerialNumber: syz [ 1354.556912][T18184] usbhid 10-1:0.0: can't add hid device: -71 [ 1354.569075][T19362] new mount options do not match the existing superblock, will be ignored [ 1354.585591][T11343] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1354.599978][T18184] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1354.635140][T11343] usb 6-1: unit 255 not found! [ 1354.661276][ T29] audit: type=1400 audit(1786069579.454:2909): avc: denied { mount } for pid=19361 comm="syz.9.2925" name="/" dev="cgroup" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1354.695337][T11343] usb 6-1: unit 5 not found! [ 1354.703261][T18184] usb 10-1: USB disconnect, device number 30 [ 1354.813169][T11343] usb 6-1: USB disconnect, device number 104 [ 1355.045242][T18184] usb 10-1: new high-speed USB device number 31 using dummy_hcd [ 1355.128200][ C0] vcan0: j1939_tp_rxtimer: 0xffff888049961c00: rx timeout, send abort [ 1355.136958][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888049961c00: 0x00100: (3) A timeout occurred and this is the connection abort to close the session. [ 1355.240666][T18184] usb 10-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1355.289876][T18184] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1355.342343][ T29] audit: type=1400 audit(1786069580.134:2910): avc: denied { write } for pid=19387 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1355.382974][T18184] usb 10-1: Product: syz [ 1355.411290][T18184] usb 10-1: Manufacturer: syz [ 1355.450542][T18184] usb 10-1: SerialNumber: syz [ 1355.599607][ T29] audit: type=1400 audit(1786069580.394:2911): avc: denied { write } for pid=19407 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1355.691174][T18184] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1355.773119][T18184] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 1355.811983][ T5258] 8021q: adding VLAN 0 to HW filter on device eth22 [ 1355.878952][T19412] netlink: 'syz.3.2933': attribute type 1 has an invalid length. [ 1356.086416][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1356.718412][T18184] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1356.753819][ T29] audit: type=1400 audit(1786069581.544:2912): avc: denied { unmount } for pid=18724 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1356.778294][T19410] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2933'. [ 1356.865612][T18184] lan78xx 10-1:1.0: probe with driver lan78xx failed with error -32 [ 1356.990137][T18184] usb 10-1: USB disconnect, device number 31 [ 1357.077983][T19412] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1357.158956][ T29] audit: type=1400 audit(1786069581.914:2913): avc: denied { map } for pid=19422 comm="syz.7.2936" path="/dev/iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1357.351531][T19414] bond1: (slave geneve2): making interface the new active one [ 1357.381670][ T29] audit: type=1400 audit(1786069581.914:2914): avc: denied { execute } for pid=19422 comm="syz.7.2936" path="/dev/iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1357.537059][T19414] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 1358.322345][T19421] geneve3: entered promiscuous mode [ 1358.451232][T19421] geneve3: entered allmulticast mode [ 1359.213943][T19446] xt_recent: hitcount (16777216) is larger than allowed maximum (65535) [ 1359.717037][ T29] audit: type=1400 audit(1786069584.514:2915): avc: denied { write } for pid=19418 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1359.798411][ T5785] usb 8-1: new high-speed USB device number 51 using dummy_hcd [ 1359.935127][T11347] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 1359.980498][ T29] audit: type=1400 audit(1786069584.774:2916): avc: denied { write } for pid=19467 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1360.025650][ T5785] usb 8-1: Using ep0 maxpacket: 32 [ 1360.050218][ T5785] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1360.080377][ T5785] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1360.113696][ T5785] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1360.123089][T11347] usb 4-1: Using ep0 maxpacket: 16 [ 1360.138816][T18184] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 1360.148710][ T5258] 8021q: adding VLAN 0 to HW filter on device eth23 [ 1360.162232][T11347] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 1360.177764][T11347] usb 4-1: config 1 has no interface number 0 [ 1360.188006][ T5785] usb 8-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 1360.209949][T11347] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1360.223893][ T5785] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1360.258497][ T5785] usb 8-1: Product: syz [ 1360.264251][T11347] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1360.281524][ T5785] usb 8-1: Manufacturer: syz [ 1360.297519][ T5785] usb 8-1: SerialNumber: syz [ 1360.305076][T18184] usb 5-1: Using ep0 maxpacket: 8 [ 1360.314000][T11347] usb 4-1: config 1 interface 105 has no altsetting 0 [ 1360.329757][T18184] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1360.357611][T18184] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1360.378900][T11347] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 1360.398926][T11347] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1360.413425][T18184] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1360.435954][T11347] usb 4-1: Product: syz [ 1360.449845][T18184] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1360.465392][T11347] usb 4-1: Manufacturer: syz [ 1360.482740][T11347] usb 4-1: SerialNumber: syz [ 1360.508978][T18184] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1360.532853][T19456] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1360.558823][ T5785] usb 8-1: unit 4 not found! [ 1360.572619][T19456] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1360.592654][ T5785] usb 8-1: unit 0 not found! [ 1360.599966][T18184] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1360.628400][T18184] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1360.863640][T11347] aqc111 4-1:1.105: probe with driver aqc111 failed with error -71 [ 1360.874096][T19451] ucsi-stm32g0-i2c 0-0035: i2c read 35, 00 error: 0 [ 1361.033868][T19482] openvswitch: netlink: IP tunnel dst address not specified [ 1361.203713][ T29] audit: type=1400 audit(1786069585.824:2917): avc: denied { read write } for pid=19479 comm="syz.9.2947" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 1361.280387][T18184] usb 5-1: usb_control_msg returned -32 [ 1361.316931][T11347] usb 4-1: USB disconnect, device number 95 [ 1361.348808][T18184] usbtmc 5-1:16.0: can't read capabilities [ 1361.370735][ T5785] usb 8-1: USB disconnect, device number 51 [ 1361.450376][T19451] ucsi-stm32g0-i2c 0-0035: probe with driver ucsi-stm32g0-i2c failed with error -5 [ 1361.613665][ T29] audit: type=1400 audit(1786069586.404:2918): avc: denied { write } for pid=19473 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1361.700749][T19451] i2c i2c-0: new_device: Instantiated device stm32g0-typec at 0x35 [ 1362.980543][T19498] syzkaller0: entered promiscuous mode [ 1362.986481][T19498] syzkaller0: entered allmulticast mode [ 1363.008116][ T29] audit: type=1400 audit(1786069587.804:2919): avc: denied { write } for pid=19496 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1363.189501][ T5258] 8021q: adding VLAN 0 to HW filter on device eth24 [ 1363.416609][T19512] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2955'. [ 1363.434858][T19516] netlink: 'syz.5.2954': attribute type 1 has an invalid length. [ 1363.496356][T19490] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 1363.519019][ T5785] usb 5-1: USB disconnect, device number 20 [ 1363.570548][T19512] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2955'. [ 1363.642893][T19516] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1363.667280][T19510] macvlan2: entered promiscuous mode [ 1363.667302][T19510] macvlan2: entered allmulticast mode [ 1363.769015][T19512] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2955'. [ 1363.771046][T19509] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1364.043114][ T29] audit: type=1400 audit(1786069588.834:2920): avc: denied { write } for pid=19507 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1364.257098][T19541] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2959'. [ 1364.333300][ T29] audit: type=1400 audit(1786069589.124:2921): avc: denied { write } for pid=19546 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1364.509327][ T29] audit: type=1400 audit(1786069589.264:2922): avc: denied { setopt } for pid=19549 comm="syz.3.2962" lport=43879 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1364.701629][T19560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1364.714341][ T29] audit: type=1400 audit(1786069589.274:2923): avc: denied { write } for pid=19549 comm="syz.3.2962" path="socket:[86432]" dev="sockfs" ino=86432 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1364.742189][ T5785] usb 10-1: new high-speed USB device number 32 using dummy_hcd [ 1364.791117][T19560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1364.880172][ T29] audit: type=1400 audit(1786069589.274:2924): avc: denied { remount } for pid=19549 comm="syz.3.2962" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 1364.926609][T18184] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 1364.934917][ T9] usb 8-1: new full-speed USB device number 52 using dummy_hcd [ 1364.950265][ T5785] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1364.982174][ T5785] usb 10-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1365.048544][ T5785] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1365.090206][T19554] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 1365.109077][ T5785] opticon 10-1:1.0: opticon converter detected [ 1365.125035][T18184] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1365.163400][T18184] usb 4-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1365.191683][ T5785] usb 10-1: opticon converter now attached to ttyUSB0 [ 1365.312693][T18184] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1365.528951][T19558] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1365.581879][T18184] opticon 4-1:1.0: opticon converter detected [ 1365.663822][T18184] usb 4-1: opticon converter now attached to ttyUSB1 [ 1365.678377][ T29] audit: type=1400 audit(1786069590.474:2925): avc: denied { write } for pid=19555 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1365.943175][ T29] audit: type=1400 audit(1786069590.554:2926): avc: denied { getopt } for pid=19575 comm="syz.7.2967" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1366.187516][ T29] audit: type=1400 audit(1786069590.984:2927): avc: denied { accept } for pid=19580 comm="syz.5.2968" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1366.251431][T19583] comedi comedi3: comedi_config --init_data is deprecated [ 1366.454210][ T29] audit: type=1400 audit(1786069591.024:2928): avc: denied { write } for pid=19579 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1366.769318][T19594] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2971'. [ 1366.877728][T19594] overlayfs: failed to resolve './file2': -2 [ 1366.956825][T18184] usb 10-1: USB disconnect, device number 32 [ 1367.193166][T18184] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 1367.254231][T18184] opticon 10-1:1.0: device disconnected [ 1367.395393][ T9] usb 8-1: new high-speed USB device number 53 using dummy_hcd [ 1367.565837][ T9] usb 8-1: device descriptor read/64, error -71 [ 1367.752741][T19621] netlink: 48 bytes leftover after parsing attributes in process `syz.9.2976'. [ 1367.933181][ T9] usb 8-1: new high-speed USB device number 54 using dummy_hcd [ 1368.153468][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 1368.153481][ T29] audit: type=1400 audit(1786069592.944:2931): avc: denied { write } for pid=19626 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1368.189432][ T9] usb 8-1: device descriptor read/64, error -71 [ 1368.311855][ T5258] 8021q: adding VLAN 0 to HW filter on device eth29 [ 1368.326330][ T29] audit: type=1400 audit(1786069593.094:2932): avc: denied { mounton } for pid=19633 comm="syz.9.2978" path="/18/sys" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 1368.352103][ T9] usb usb8-port1: attempt power cycle [ 1368.359189][T19634] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1368.825186][ T9] usb 8-1: new high-speed USB device number 55 using dummy_hcd [ 1368.861821][ T29] audit: type=1400 audit(1786069593.644:2933): avc: denied { mount } for pid=19638 comm="syz.4.2980" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 1368.927797][ T9] usb 8-1: device descriptor read/8, error -71 [ 1369.001105][ T5785] usb 4-1: USB disconnect, device number 96 [ 1369.113213][ T29] audit: type=1400 audit(1786069593.764:2934): avc: denied { listen } for pid=19647 comm="syz.5.2982" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1369.234797][ T9] usb 8-1: new high-speed USB device number 56 using dummy_hcd [ 1369.269549][ T5785] opticon ttyUSB1: opticon converter now disconnected from ttyUSB1 [ 1369.304262][T19660] FAULT_INJECTION: forcing a failure. [ 1369.304262][T19660] name failslab, interval 1, probability 0, space 0, times 0 [ 1369.318954][T19660] CPU: 0 UID: 0 PID: 19660 Comm: syz.9.2985 Tainted: G L syzkaller #0 PREEMPT(full) [ 1369.318973][T19660] Tainted: [L]=SOFTLOCKUP [ 1369.318978][T19660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1369.318984][T19660] Call Trace: [ 1369.318990][T19660] [ 1369.318995][T19660] dump_stack_lvl+0x100/0x190 [ 1369.319012][T19660] should_fail_ex.cold+0x5/0xa [ 1369.319026][T19660] should_failslab+0xc2/0x120 [ 1369.319042][T19660] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1369.319058][T19660] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1369.319078][T19660] ? __lock_acquire+0x49f/0x1a40 [ 1369.319092][T19660] ? sctp_get_port_local+0x828/0x1630 [ 1369.319108][T19660] sctp_get_port_local+0x828/0x1630 [ 1369.319125][T19660] ? __pfx_sctp_get_port_local+0x10/0x10 [ 1369.319140][T19660] ? sctp_bind_addr_match+0x19d/0x300 [ 1369.319153][T19660] sctp_do_bind+0x2b9/0x760 [ 1369.319171][T19660] sctp_connect_new_asoc+0x5e7/0x770 [ 1369.319188][T19660] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1369.319213][T19660] sctp_sendmsg+0x1743/0x22e0 [ 1369.319232][T19660] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1369.319247][T19660] ? sock_has_perm+0x25a/0x2f0 [ 1369.319260][T19660] ? __pfx_sock_has_perm+0x10/0x10 [ 1369.319279][T19660] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1369.319296][T19660] inet_sendmsg+0x11c/0x140 [ 1369.319309][T19660] ____sys_sendmsg+0x9c9/0xbe0 [ 1369.319323][T19660] ? __pfx_inet_sendmsg+0x10/0x10 [ 1369.319336][T19660] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1369.319353][T19660] ? __pfx__kstrtoull+0x10/0x10 [ 1369.319371][T19660] ___sys_sendmsg+0x190/0x1e0 [ 1369.319387][T19660] ? __pfx____sys_sendmsg+0x10/0x10 [ 1369.319408][T19660] ? find_held_lock+0x2b/0x80 [ 1369.319431][T19660] __sys_sendmmsg+0x20c/0x440 [ 1369.319445][T19660] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1369.319456][T19660] ? ksys_write+0x190/0x250 [ 1369.319481][T19660] ? fput+0x79/0x100 [ 1369.319492][T19660] ? ksys_write+0x1ac/0x250 [ 1369.319508][T19660] ? __pfx_ksys_write+0x10/0x10 [ 1369.319526][T19660] __x64_sys_sendmmsg+0x9c/0x100 [ 1369.319538][T19660] ? lockdep_hardirqs_on+0x78/0x100 [ 1369.319549][T19660] do_syscall_64+0x115/0x870 [ 1369.319559][T19660] ? clear_bhb_loop+0x40/0x90 [ 1369.319572][T19660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1369.319584][T19660] RIP: 0033:0x7fb66939e0d9 [ 1369.319595][T19660] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1369.319606][T19660] RSP: 002b:00007fb66a309028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1369.319617][T19660] RAX: ffffffffffffffda RBX: 00007fb669625fa0 RCX: 00007fb66939e0d9 [ 1369.319624][T19660] RDX: 0000000000000002 RSI: 0000200000000a40 RDI: 0000000000000003 [ 1369.319630][T19660] RBP: 00007fb66a309090 R08: 0000000000000000 R09: 0000000000000000 [ 1369.319636][T19660] R10: 000000000000c000 R11: 0000000000000246 R12: 0000000000000001 [ 1369.319643][T19660] R13: 00007fb669626038 R14: 00007fb669625fa0 R15: 00007ffeddc88718 [ 1369.319656][T19660] [ 1369.938385][ T9] usb 8-1: device descriptor read/8, error -71 [ 1369.986771][ T5785] opticon 4-1:1.0: device disconnected [ 1370.107037][ T9] usb usb8-port1: unable to enumerate USB device [ 1370.311734][T19674] netlink: 48 bytes leftover after parsing attributes in process `syz.9.2988'. [ 1370.355077][ T29] audit: type=1400 audit(1786069595.144:2935): avc: denied { write } for pid=19639 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1370.444815][ T5785] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 1370.461485][T19682] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2560 sclass=netlink_route_socket pid=19682 comm=syz.7.2989 [ 1370.516666][T19682] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2569 sclass=netlink_route_socket pid=19682 comm=syz.7.2989 [ 1370.577581][ T29] audit: type=1400 audit(1786069595.374:2936): avc: denied { write } for pid=19683 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1370.635502][ T5785] usb 6-1: Using ep0 maxpacket: 8 [ 1370.665100][ T5785] usb 6-1: config index 0 descriptor too short (expected 128, got 36) [ 1370.700286][ T5785] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1370.721938][ T29] audit: type=1400 audit(1786069595.444:2937): avc: denied { unmount } for pid=18506 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 1370.767557][ T5785] usb 6-1: New USB device found, idVendor=04f2, idProduct=1123, bcdDevice= 0.00 [ 1370.785401][ T5258] 8021q: adding VLAN 0 to HW filter on device eth16 [ 1370.801932][ T5785] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1370.851604][ T5785] usb 6-1: config 0 descriptor?? [ 1371.014730][T18184] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 1371.168424][T18184] usb 5-1: Using ep0 maxpacket: 32 [ 1371.228442][T18184] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1371.311459][T18184] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1371.372455][ T29] audit: type=1400 audit(1786069596.164:2938): avc: denied { read } for pid=19699 comm="syz.3.2993" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1371.437735][T18184] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1371.502273][T19707] netlink: 'syz.3.2993': attribute type 10 has an invalid length. [ 1371.532896][T18184] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 1371.553280][ T29] audit: type=1400 audit(1786069596.214:2939): avc: denied { write } for pid=19688 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1371.589051][ T5785] usb 10-1: new full-speed USB device number 33 using dummy_hcd [ 1371.613630][T18184] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1371.690848][T18184] usb 5-1: Product: syz [ 1371.722803][T18184] usb 5-1: Manufacturer: syz [ 1371.752107][T18184] usb 5-1: SerialNumber: syz [ 1371.766042][ T29] audit: type=1400 audit(1786069596.294:2940): avc: denied { bind } for pid=19699 comm="syz.3.2993" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1371.798182][T19707] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1371.806136][ T5785] usb 10-1: device descriptor read/64, error -71 [ 1371.840049][ T5694] usb 6-1: USB disconnect, device number 105 [ 1371.852150][T19707] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 1371.955413][ T9] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 1372.042323][T18184] usb 5-1: unit 4 not found! [ 1372.052644][T18184] usb 5-1: unit 0 not found! [ 1372.065319][ T5785] usb 10-1: new full-speed USB device number 34 using dummy_hcd [ 1372.105909][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1372.126944][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1372.172619][ T9] usb 4-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 1372.208364][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1372.227272][ T5785] usb 10-1: device descriptor read/64, error -71 [ 1372.247234][ T9] usb 4-1: config 0 descriptor?? [ 1372.253318][T19687] Cannot find add_set index 0 as target [ 1372.289210][ T9] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 1372.375069][ T5785] usb usb10-port1: attempt power cycle [ 1373.525130][T19741] netlink: 'syz.5.2998': attribute type 4 has an invalid length. [ 1373.578290][T19742] netlink: 'syz.5.2998': attribute type 4 has an invalid length. [ 1373.609274][ T5785] usb 10-1: new full-speed USB device number 35 using dummy_hcd [ 1374.443952][T19705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2993'. [ 1374.487010][ T5785] usb 10-1: device descriptor read/8, error -71 [ 1374.523235][T19705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2993'. [ 1374.601748][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 1374.601759][ T29] audit: type=1400 audit(1786069599.394:2943): avc: denied { write } for pid=19743 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1374.650626][T19705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2993'. [ 1374.714910][T19705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2993'. [ 1374.779839][T19705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2993'. [ 1374.830133][T19705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2993'. [ 1374.900042][T19705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2993'. [ 1374.946578][ T29] audit: type=1400 audit(1786069599.744:2944): avc: denied { read append } for pid=19749 comm="syz.7.3000" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 1374.989873][T19705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2993'. [ 1375.032422][T19705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2993'. [ 1375.075808][ T5785] usb 10-1: new high-speed USB device number 36 using dummy_hcd [ 1375.177427][ T5785] usb 10-1: Using ep0 maxpacket: 16 [ 1375.253579][ T9] usb 4-1: USB disconnect, device number 97 [ 1375.300047][ T5785] usb 10-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 1375.489371][ T5785] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1375.706769][T19764] netlink: 'syz.5.3002': attribute type 63 has an invalid length. [ 1375.726628][ T5785] usb 10-1: Product: syz [ 1375.742879][ T5785] usb 10-1: Manufacturer: syz [ 1375.760889][T19764] __nla_validate_parse: 43 callbacks suppressed [ 1375.760902][T19764] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3002'. [ 1375.787085][ T5785] usb 10-1: SerialNumber: syz [ 1375.807865][ T5785] usb 10-1: config 0 descriptor?? [ 1375.861964][ T5785] usb 10-1: selecting invalid altsetting 1 [ 1375.913236][ T5785] technisat-usb2: could not set alternate setting to 0 [ 1375.971025][T18184] usb 5-1: USB disconnect, device number 21 [ 1376.058534][T19772] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3004'. [ 1376.079518][ T5785] technisat-usb2: firmware version: 0.0 [ 1376.093085][ T29] audit: type=1400 audit(1786069600.894:2945): avc: denied { write } for pid=19748 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1376.127630][T19774] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1376.197326][ T5785] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 1376.231456][T18423] udevd[18423]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1376.372041][T19774] bond3 (unregistering): Released all slaves [ 1376.439446][ T29] audit: type=1400 audit(1786069601.234:2946): avc: denied { write } for pid=19781 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1376.508258][ T5785] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1376.630446][ T5785] dvbdev: DVB: registering new adapter (Technisat SkyStar USB HD (DVB-S/S2)) [ 1376.727706][ T5785] usb 10-1: media controller created [ 1376.762755][ T5785] technisat-usb2: i2c-error: out failed 53 = -22 [ 1376.838153][ T5785] dvb-usb: MAC address reading failed. [ 1376.948222][ T5785] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1377.056878][T19793] netlink: 'syz.7.3009': attribute type 1 has an invalid length. [ 1377.182722][T19802] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3010'. [ 1377.271835][T19793] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1377.319421][ T5785] DVB: Unable to find symbol stv090x_attach() [ 1377.367361][ T5785] dvb-usb: no frontend was attached by 'Technisat SkyStar USB HD (DVB-S/S2)' [ 1378.216501][T19815] netlink: 'syz.3.3012': attribute type 4 has an invalid length. [ 1378.269911][T19816] netlink: 'syz.3.3012': attribute type 4 has an invalid length. [ 1378.302887][T19803] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1378.595208][ T5785] rc_core: IR keymap rc-technisat-usb2 not found [ 1379.232344][ T5785] Registered IR keymap rc-empty [ 1379.279936][ T5785] rc rc0: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.9/usb10/10-1/rc/rc0 [ 1379.320848][T19803] bond2: (slave gre1): The slave device specified does not support setting the MAC address [ 1379.359845][ T5785] input: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.9/usb10/10-1/rc/rc0/input37 [ 1379.386527][ T29] audit: type=1400 audit(1786069604.174:2947): avc: denied { write } for pid=19786 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1379.450931][ T5785] dvb-usb: schedule remote query interval to 100 msecs. [ 1379.467352][T19803] bond2: (slave gre1): Error -95 calling set_mac_address [ 1379.526399][ T29] audit: type=1400 audit(1786069604.324:2948): avc: denied { write } for pid=19828 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1379.614947][T19804] gretap1: entered promiscuous mode [ 1379.679558][T19804] bond2: (slave gretap1): making interface the new active one [ 1379.715571][T18184] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 1379.762053][T19804] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 1379.802614][T19802] bridge0: port 2(bridge_slave_1) entered disabled state [ 1379.810052][T19802] bridge0: port 1(bridge_slave_0) entered disabled state [ 1379.857399][T18184] usb 5-1: device descriptor read/64, error -71 [ 1379.876918][T19793] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 1379.886744][ T5785] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully initialized and connected. [ 1379.905202][T19825] bond2 (unregistering): (slave gretap1): Releasing active interface [ 1379.928834][ T9] dvb-usb: error -71 while querying for an remote control event. [ 1379.970562][T19825] bond2 (unregistering): Released all slaves [ 1380.039404][ T5785] usb 10-1: USB disconnect, device number 36 [ 1380.056906][T19841] FAULT_INJECTION: forcing a failure. [ 1380.056906][T19841] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1380.186218][T18184] usb 5-1: new full-speed USB device number 23 using dummy_hcd [ 1380.230881][ T29] audit: type=1400 audit(1786069605.024:2949): avc: denied { write } for pid=19830 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1380.271422][ T5785] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully deinitialized and disconnected. [ 1380.341529][T19841] CPU: 0 UID: 0 PID: 19841 Comm: syz.9.3015 Tainted: G L syzkaller #0 PREEMPT(full) [ 1380.341549][T19841] Tainted: [L]=SOFTLOCKUP [ 1380.341553][T19841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1380.341560][T19841] Call Trace: [ 1380.341564][T19841] [ 1380.341568][T19841] dump_stack_lvl+0x100/0x190 [ 1380.341585][T19841] should_fail_ex.cold+0x5/0xa [ 1380.341598][T19841] copy_fpstate_to_sigframe+0x82d/0xae0 [ 1380.341614][T19841] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 1380.341630][T19841] ? posixtimer_deliver_signal+0x19d/0x6e0 [ 1380.341647][T19841] ? x86_task_fpu+0x5f/0x90 [ 1380.341665][T19841] get_sigframe+0x3fb/0x940 [ 1380.341678][T19841] ? __pfx_get_sigframe+0x10/0x10 [ 1380.341688][T19841] ? rcu_is_watching+0x12/0xc0 [ 1380.341705][T19841] ? siginfo_layout+0x156/0x290 [ 1380.341720][T19841] x64_setup_rt_frame+0x12f/0xce0 [ 1380.341734][T19841] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1380.341746][T19841] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 1380.341764][T19841] ? fput+0x79/0x100 [ 1380.341777][T19841] arch_do_signal_or_restart+0x5ee/0x7e0 [ 1380.341789][T19841] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1380.341804][T19841] ? fput+0x79/0x100 [ 1380.341819][T19841] exit_to_user_mode_loop+0x139/0x6f0 [ 1380.341833][T19841] ? rcu_is_watching+0x12/0xc0 [ 1380.341849][T19841] do_syscall_64+0x666/0x870 [ 1380.341860][T19841] ? clear_bhb_loop+0x40/0x90 [ 1380.341873][T19841] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1380.341884][T19841] RIP: 0033:0x7fb66939e0d9 [ 1380.341893][T19841] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1380.341904][T19841] RSP: 002b:00007fb66a309028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1380.341915][T19841] RAX: 0000000007fffdfe RBX: 00007fb669625fa0 RCX: 00007fb66939e0d9 [ 1380.341922][T19841] RDX: 000000000000cf28 RSI: 0000000007fffdfe RDI: 0000000000000003 [ 1380.341929][T19841] RBP: 00007fb66a309090 R08: 0000000000000000 R09: 0000000000000000 [ 1380.341935][T19841] R10: 0000000000000087 R11: 0000000000000246 R12: 0000000000000001 [ 1380.341941][T19841] R13: 00007fb669626038 R14: 00007fb669625fa0 R15: 00007ffeddc88718 [ 1380.341955][T19841] [ 1380.570265][T19848] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3017'. [ 1380.581615][T19848] overlayfs: failed to resolve './file2': -2 [ 1380.902574][ T29] audit: type=1400 audit(1786069605.684:2950): avc: denied { write } for pid=19851 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1380.928769][T19860] netlink: 48 bytes leftover after parsing attributes in process `syz.9.3021'. [ 1380.956267][T18184] usb 5-1: device descriptor read/64, error -71 [ 1381.079196][ T5694] usb 8-1: new full-speed USB device number 57 using dummy_hcd [ 1381.096240][T18184] usb usb5-port1: attempt power cycle [ 1381.123082][T19866] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3022'. [ 1381.165765][T19866] 8021q: adding VLAN 0 to HW filter on device team1 [ 1381.317734][ T5694] usb 8-1: New USB device found, idVendor=18d1, idProduct=502d, bcdDevice= 0.00 [ 1381.343567][T19870] kernel read not supported for file /memory.swap.current (pid: 19870 comm: syz.5.3023) [ 1381.354206][ T5694] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1381.389993][ T5694] usb 8-1: config 0 descriptor?? [ 1381.415921][ T29] audit: type=1800 audit(1786069606.214:2951): pid=19870 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.3023" name="memory.swap.current" dev="mqueue" ino=87821 res=0 errno=0 [ 1381.464894][T18184] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 1381.550443][T18184] usb 5-1: device descriptor read/8, error -71 [ 1381.728007][ T5694] usb 8-1: string descriptor 0 read error: -71 [ 1382.469817][T19878] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3024'. [ 1382.524759][ T5694] usbhid 8-1:0.0: can't add hid device: -71 [ 1382.554885][T18184] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 1382.603174][ T5694] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 1383.623027][T18184] usb 5-1: device not accepting address 25, error -71 [ 1383.667218][T18184] usb usb5-port1: unable to enumerate USB device [ 1383.816580][T19886] netlink: 'syz.5.3025': attribute type 4 has an invalid length. [ 1383.828889][T19886] netlink: 'syz.5.3025': attribute type 4 has an invalid length. [ 1383.880541][ T5694] usb 8-1: USB disconnect, device number 57 [ 1384.865192][T19906] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 1385.151795][T11347] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 1385.260298][ T5694] usb 8-1: new high-speed USB device number 58 using dummy_hcd [ 1385.292359][ T29] audit: type=1400 audit(1786069610.084:2952): avc: denied { write } for pid=19868 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1385.357175][T11347] usb 4-1: Using ep0 maxpacket: 32 [ 1385.415506][T11347] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1385.444156][T11347] usb 4-1: can't read configurations, error -22 [ 1385.498755][ T5694] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1385.528059][T19917] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3035'. [ 1385.562114][ T5694] usb 8-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1385.585477][ T29] audit: type=1400 audit(1786069610.374:2953): avc: denied { write } for pid=19916 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1385.628227][T11347] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 1385.662548][T19920] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=19920 comm=syz.4.3035 [ 1385.677128][ T5694] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1385.709700][T19898] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1385.759917][ T5694] opticon 8-1:1.0: opticon converter detected [ 1385.777767][ T29] audit: type=1400 audit(1786069610.494:2954): avc: denied { bind } for pid=19919 comm="syz.5.3036" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1385.844799][T11347] usb 4-1: Using ep0 maxpacket: 32 [ 1385.861078][ T5694] usb 8-1: opticon converter now attached to ttyUSB0 [ 1385.880378][T11347] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1385.942820][T19917] gretap0: entered promiscuous mode [ 1385.962440][T11347] usb 4-1: can't read configurations, error -22 [ 1385.991221][T11347] usb usb4-port1: attempt power cycle [ 1385.997332][ T29] audit: type=1400 audit(1786069610.524:2955): avc: denied { map } for pid=19919 comm="syz.5.3036" path="socket:[87992]" dev="sockfs" ino=87992 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1386.133823][T19917] macvlan2: entered allmulticast mode [ 1386.151958][ T29] audit: type=1400 audit(1786069610.524:2956): avc: denied { read write } for pid=19919 comm="syz.5.3036" path="socket:[87992]" dev="sockfs" ino=87992 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1386.253917][T19917] gretap0: entered allmulticast mode [ 1386.390342][ T29] audit: type=1800 audit(1786069610.874:2957): pid=19930 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.3035" name="blocks" dev="configfs" ino=88018 res=0 errno=0 [ 1386.412680][T11347] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 1386.489337][T11347] usb 4-1: Using ep0 maxpacket: 32 [ 1386.496607][T19937] netlink: 48 bytes leftover after parsing attributes in process `syz.9.3037'. [ 1386.547132][T11347] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1386.622861][T11347] usb 4-1: can't read configurations, error -22 [ 1386.835415][T11347] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1386.895702][T11347] usb 4-1: Using ep0 maxpacket: 32 [ 1386.952301][T11347] usb 4-1: device descriptor read/all, error -71 [ 1387.023177][T11347] usb usb4-port1: unable to enumerate USB device [ 1387.099903][ T29] audit: type=1400 audit(1786069611.894:2958): avc: denied { write } for pid=19929 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1387.178428][T19948] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3038'. [ 1387.566916][ T29] audit: type=1400 audit(1786069612.354:2959): avc: denied { write } for pid=19950 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1388.889292][T19945] Bluetooth: hci1: command 0x0406 tx timeout [ 1389.637571][T11347] usb 8-1: USB disconnect, device number 58 [ 1389.711787][T11347] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 1389.794323][T11347] opticon 8-1:1.0: device disconnected [ 1390.820449][ T29] audit: type=1400 audit(1786069615.604:2960): avc: denied { ioctl } for pid=19975 comm="syz.3.3045" path="/dev/sg0" dev="devtmpfs" ino=739 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1390.898056][T19974] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 1390.937315][T19978] netlink: 7 bytes leftover after parsing attributes in process `syz.3.3045'. [ 1391.272370][ T29] audit: type=1400 audit(1786069616.064:2961): avc: denied { write } for pid=19963 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1391.443422][T11347] usb 8-1: new high-speed USB device number 59 using dummy_hcd [ 1391.480653][ T29] audit: type=1400 audit(1786069616.274:2962): avc: denied { read } for pid=19989 comm="syz.4.3048" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 1391.626428][ T29] audit: type=1400 audit(1786069616.274:2963): avc: denied { open } for pid=19989 comm="syz.4.3048" path="/31/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 1391.652825][T19998] netlink: 'syz.3.3049': attribute type 3 has an invalid length. [ 1391.673442][T11347] usb 8-1: Using ep0 maxpacket: 8 [ 1391.716589][T11347] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 1391.762728][T11347] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1391.841460][ T29] audit: type=1400 audit(1786069616.354:2964): avc: denied { write } for pid=19992 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1391.882719][T11347] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1391.922486][T20005] netlink: 20 bytes leftover after parsing attributes in process `syz.9.3051'. [ 1391.988709][T11347] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1392.017530][T20002] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x7830 instead [ 1392.028815][T20005] overlayfs: failed to resolve './file2': -2 [ 1392.045128][T11347] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1392.081149][T20002] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x3030 instead [ 1392.092892][ T29] audit: type=1400 audit(1786069616.874:2965): avc: denied { write } for pid=19999 comm="syz.4.3050" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1392.141335][T11347] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1392.172324][T20002] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0x3030 instead [ 1392.205693][T18184] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1392.225248][T11347] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1392.328625][T20002] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000000c: 0x3030 instead [ 1392.375758][T20002] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0x3931 instead [ 1392.418447][T20002] jffs2: notice: (20002) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 1392.477343][T18184] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1392.507432][T18184] usb 4-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1392.552505][T11347] usb 8-1: usb_control_msg returned -32 [ 1392.567410][T18184] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1392.590923][T11347] usbtmc 8-1:16.0: can't read capabilities [ 1392.618100][ T29] audit: type=1400 audit(1786069617.414:2966): avc: denied { write } for pid=20001 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1392.649168][T20006] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1392.693834][T18184] opticon 4-1:1.0: opticon converter detected [ 1392.730900][T18184] usb 4-1: opticon converter now attached to ttyUSB0 [ 1392.821327][ T29] audit: type=1400 audit(1786069617.614:2967): avc: denied { write } for pid=20022 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1393.914885][T20026] usbtmc 8-1:16.0: usb_control_msg returned -32 [ 1394.106845][T19945] Bluetooth: hci7: command 0x0406 tx timeout [ 1394.570504][T11347] usb 8-1: USB disconnect, device number 59 [ 1396.134037][T11347] usb 4-1: USB disconnect, device number 102 [ 1396.203846][T11347] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 1396.300361][T11347] opticon 4-1:1.0: device disconnected [ 1396.391677][ T29] audit: type=1400 audit(1786069621.184:2968): avc: denied { read } for pid=20055 comm="syz.9.3059" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1396.588898][ T29] audit: type=1400 audit(1786069621.264:2969): avc: denied { write } for pid=20027 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1396.767450][ T29] audit: type=1400 audit(1786069621.554:2970): avc: denied { write } for pid=20067 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1396.816318][T18184] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 1396.996977][T18184] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1397.021507][T18184] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1397.053657][T18184] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1397.086000][T11347] usb 8-1: new high-speed USB device number 60 using dummy_hcd [ 1397.111525][ T29] audit: type=1400 audit(1786069621.904:2971): avc: denied { write } for pid=20075 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1397.137117][T18184] usb 6-1: config 0 descriptor?? [ 1397.285242][T11347] usb 8-1: Using ep0 maxpacket: 32 [ 1397.294176][T11347] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1397.320149][ T29] audit: type=1400 audit(1786069622.114:2972): avc: denied { map } for pid=20087 comm="syz.3.3065" path="/dev/video7" dev="devtmpfs" ino=950 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1397.358766][T11347] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1397.406945][T11347] usb 8-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1397.466102][ T29] audit: type=1400 audit(1786069622.114:2973): avc: denied { execute } for pid=20087 comm="syz.3.3065" path="/dev/video7" dev="devtmpfs" ino=950 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1397.499391][T11347] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1397.566870][T11347] usb 8-1: config 0 descriptor?? [ 1397.596205][ T5694] usb 10-1: new high-speed USB device number 37 using dummy_hcd [ 1397.683313][ T29] audit: type=1400 audit(1786069622.144:2974): avc: denied { write } for pid=20089 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1397.815759][ T5694] usb 10-1: Using ep0 maxpacket: 32 [ 1397.857741][ T5694] usb 10-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 1397.891108][ T5694] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1397.958346][ T5694] usb 10-1: Product: syz [ 1397.983570][ T5694] usb 10-1: Manufacturer: syz [ 1397.988575][ T9] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 1398.022734][ T5694] usb 10-1: SerialNumber: syz [ 1398.096464][ T5694] usb 10-1: config 0 descriptor?? [ 1398.130860][T11347] savu 0003:1E7D:2D5A.0012: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.7-1/input0 [ 1398.166088][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 1398.172835][ T5694] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 1398.208428][ T9] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1398.246168][T18184] ath6kl: Failed to submit usb control message: -110 [ 1398.271031][ T9] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1398.301817][T18184] ath6kl: unable to send the bmi data to the device: -110 [ 1398.369960][T18184] ath6kl: Unable to send get target info: -110 [ 1398.381301][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1398.435978][T18184] ath6kl: Failed to init ath6kl core: -110 [ 1398.458466][T20074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1398.482714][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1398.511007][T18184] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1398.915043][ T5694] gspca_topro: reg_w err -110 [ 1398.994865][T20074] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1399.206217][ T29] audit: type=1400 audit(1786069623.334:2975): avc: denied { write } for pid=20101 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1399.488550][ T9] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1399.526129][ T5694] gspca_topro: Sensor soi763a [ 1399.563782][T20093] bond2: entered allmulticast mode [ 1399.589856][ T9] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1399.605425][ T5695] usb 8-1: reset high-speed USB device number 60 using dummy_hcd [ 1399.683477][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1399.777067][T20093] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=272 sclass=netlink_route_socket pid=20093 comm=syz.9.3066 [ 1399.810754][ T29] audit: type=1400 audit(1786069624.594:2976): avc: denied { write } for pid=20132 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1399.890936][ T5694] usb 6-1: USB disconnect, device number 106 [ 1399.939116][T11343] usb 10-1: USB disconnect, device number 37 [ 1399.979266][ T9] usb 5-1: usb_control_msg returned -32 [ 1400.012610][ T9] usbtmc 5-1:16.0: can't read capabilities [ 1400.257737][ T29] audit: type=1400 audit(1786069625.054:2977): avc: denied { cmd } for pid=20142 comm="iou-wrk-20149" path="socket:[88734]" dev="sockfs" ino=88734 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1401.544319][T18184] usb 8-1: USB disconnect, device number 60 [ 1402.459517][T20166] netlink: 'syz.7.3072': attribute type 4 has an invalid length. [ 1402.473205][T20166] netlink: 'syz.7.3072': attribute type 4 has an invalid length. [ 1402.627488][T11343] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 1402.731264][T18184] usb 5-1: USB disconnect, device number 26 [ 1402.837589][T20176] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3076'. [ 1402.868516][ T29] audit: type=1400 audit(1786069627.654:2978): avc: denied { write } for pid=20139 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1402.908002][T11343] usb 6-1: Using ep0 maxpacket: 8 [ 1402.932013][T20176] overlayfs: failed to resolve './file2': -2 [ 1402.950445][T11343] usb 6-1: config 0 has an invalid interface number: 186 but max is 0 [ 1403.060050][T11343] usb 6-1: config 0 has no interface number 0 [ 1403.110829][T18365] ffs_data_put(): freeing [ 1403.128801][T11343] usb 6-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1403.246816][T11343] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1403.407416][ T29] audit: type=1400 audit(1786069628.204:2979): avc: denied { write } for pid=20182 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1404.155689][T20188] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3080'. [ 1404.197213][T11343] usb 6-1: string descriptor 0 read error: -71 [ 1404.227292][ T5694] usb 10-1: new high-speed USB device number 38 using dummy_hcd [ 1404.257015][T11343] usb 6-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 1404.451846][T11343] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1404.465803][ T29] audit: type=1400 audit(1786069628.944:2980): avc: denied { ioctl } for pid=20184 comm="syz.4.3080" path="socket:[88856]" dev="sockfs" ino=88856 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1404.522460][T11347] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 1404.554040][T11343] usb 6-1: config 0 descriptor?? [ 1404.575999][ T5694] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1405.431177][T11343] usb 6-1: can't set config #0, error -71 [ 1405.461102][T11347] hid-generic 0000:0000:0000.0013: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1405.493226][ T5694] usb 10-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1405.537663][T11343] usb 6-1: USB disconnect, device number 107 [ 1405.553222][ T29] audit: type=1400 audit(1786069628.954:2981): avc: denied { connect } for pid=20184 comm="syz.4.3080" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1405.593373][ T5694] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1405.660547][T20185] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 1405.704303][ T5694] opticon 10-1:1.0: opticon converter detected [ 1405.714753][T11347] usb 8-1: new full-speed USB device number 61 using dummy_hcd [ 1405.732421][ T29] audit: type=1400 audit(1786069629.314:2982): avc: denied { read write } for pid=20196 comm="syz.4.3082" name="uhid" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 1405.790715][ T5694] usb 10-1: opticon converter now attached to ttyUSB0 [ 1405.892864][ T29] audit: type=1400 audit(1786069629.314:2983): avc: denied { open } for pid=20196 comm="syz.4.3082" path="/dev/uhid" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 1405.943023][T11343] usb 6-1: new full-speed USB device number 108 using dummy_hcd [ 1405.965560][T11347] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 254, changing to 4 [ 1406.048033][T11347] usb 8-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice= 0.40 [ 1406.074595][T11347] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1406.093076][ T29] audit: type=1400 audit(1786069630.794:2984): avc: denied { ioctl } for pid=20196 comm="syz.4.3082" path="/dev/uhid" dev="devtmpfs" ino=1270 ioctlcmd=0x5451 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 1406.141274][T11343] usb 6-1: not running at top speed; connect to a high speed hub [ 1406.156738][T11347] usb 8-1: Product: syz [ 1406.170962][T11347] usb 8-1: Manufacturer: syz [ 1406.186555][T11343] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1406.204861][T11347] usb 8-1: SerialNumber: syz [ 1406.233865][T11343] usb 6-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 1406.281751][T11343] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1406.353998][ T29] audit: type=1400 audit(1786069631.144:2985): avc: denied { write } for pid=20198 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1406.435417][T11343] uvcvideo 6-1:1.0: Found UVC 1.00 device (046d:0825) [ 1406.518916][T11343] uvcvideo 6-1:1.0: No streaming interface found for terminal 32770. [ 1406.599683][T20195] overlayfs: missing 'lowerdir' [ 1406.657101][ T5695] usb 10-1: USB disconnect, device number 38 [ 1406.659194][ T5695] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 1406.659481][ T5695] opticon 10-1:1.0: device disconnected [ 1406.662420][T11343] usb 6-1: USB disconnect, device number 108 [ 1406.783000][T11347] usb 8-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1406.793361][ T29] audit: type=1400 audit(1786069631.574:2986): avc: denied { write } for pid=20220 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1406.801887][T11347] usb 8-1: unit 255 not found! [ 1406.801903][T11347] usb 8-1: unit 5 not found! [ 1406.906912][T11347] usb 8-1: USB disconnect, device number 61 [ 1406.911557][T20224] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1407.030103][T19864] udevd[19864]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1407.099729][ T5694] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1407.259634][ T5694] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1407.330354][T11343] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 1407.351888][ T5694] usb 4-1: config index 0 descriptor too short (expected 198, got 134) [ 1407.351908][ T5694] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1407.351919][ T5694] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1407.486439][T11343] usb 5-1: Using ep0 maxpacket: 8 [ 1407.486604][T20244] netlink: 'syz.5.3088': attribute type 1 has an invalid length. [ 1407.490912][T11343] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1407.490941][T11343] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1407.490955][T11343] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1407.490968][T11343] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1407.490982][T11343] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1407.491023][T11343] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1407.491036][T11343] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1407.926285][T11343] usb 5-1: usb_control_msg returned -32 [ 1407.926311][T11343] usbtmc 5-1:16.0: can't read capabilities [ 1408.004853][T11347] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 1408.494818][T11347] usb 6-1: device descriptor read/64, error -71 [ 1408.713021][ T5694] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 1408.713042][ T5694] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1408.713054][ T5694] usb 4-1: Product: syz [ 1408.713064][ T5694] usb 4-1: Manufacturer: syz [ 1408.713073][ T5694] usb 4-1: SerialNumber: syz [ 1408.844218][T11347] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 1408.978882][T20244] bond4: entered promiscuous mode [ 1409.136155][T11347] usb 6-1: device descriptor read/64, error -71 [ 1409.194883][ T29] audit: type=1400 audit(1786069633.984:2987): avc: denied { write } for pid=20228 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1409.345062][T11347] usb usb6-port1: attempt power cycle [ 1409.430494][T20244] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1409.744004][T11347] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 1409.828776][T11347] usb 6-1: device descriptor read/8, error -71 [ 1409.975990][ T5694] usb 4-1: 0:1 : does not exist [ 1410.012557][T20248] bond4: (slave veth5): making interface the new active one [ 1410.012574][T20248] veth5: entered promiscuous mode [ 1410.013015][T20248] bond4: (slave veth5): Enslaving as an active interface with an up link [ 1410.065283][T11347] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 1410.087682][T11347] usb 6-1: device descriptor read/8, error -71 [ 1410.095500][ T5695] libceph: connect (1)[c::]:6789 error -101 [ 1410.096707][ T5695] libceph: mon0 (1)[c::]:6789 connect error [ 1410.121984][T20246] ceph: No mds server is up or the cluster is laggy [ 1410.200116][T11347] usb usb6-port1: unable to enumerate USB device [ 1410.333788][ T29] audit: type=1400 audit(1786069635.134:2988): avc: denied { write } for pid=20261 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1410.387980][T20264] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3092'. [ 1410.979195][T20265] overlayfs: missing 'lowerdir' [ 1411.637522][T11347] usb 5-1: USB disconnect, device number 27 [ 1411.887188][T11343] usb 8-1: new high-speed USB device number 62 using dummy_hcd [ 1412.137439][T20277] netlink: 5 bytes leftover after parsing attributes in process `syz.9.3096'. [ 1412.137511][T20277] 0ªî{X¹¦: renamed from gretap0 (while UP) [ 1412.152393][T20277] 0ªî{X¹¦: entered allmulticast mode [ 1412.152710][T20277] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 1412.197155][T11343] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1412.197185][T11343] usb 8-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1412.197199][T11343] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1412.199292][T20268] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 1412.225085][T11343] opticon 8-1:1.0: opticon converter detected [ 1412.240690][T11343] usb 8-1: opticon converter now attached to ttyUSB0 [ 1412.497534][T20287] netlink: 'syz.9.3098': attribute type 4 has an invalid length. [ 1412.508142][T20287] netlink: 'syz.9.3098': attribute type 4 has an invalid length. [ 1413.095558][T11347] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 1413.275601][T11347] usb 6-1: Using ep0 maxpacket: 8 [ 1413.290571][T11347] usb 6-1: config 0 has an invalid interface number: 186 but max is 0 [ 1413.290592][T11347] usb 6-1: config 0 has no interface number 0 [ 1413.290611][T11347] usb 6-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1413.290625][T11347] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1413.290639][T11347] usb 6-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 1413.290706][T11347] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 112, changing to 7 [ 1413.290721][T11347] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x8A has invalid maxpacket 10102, setting to 1024 [ 1413.290735][T11347] usb 6-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1413.307032][T11347] usb 6-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 1413.307052][T11347] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1413.307064][T11347] usb 6-1: Product: syz [ 1413.307074][T11347] usb 6-1: Manufacturer: syz [ 1413.307135][T11347] usb 6-1: SerialNumber: syz [ 1413.309450][T11347] usb 6-1: config 0 descriptor?? [ 1413.319038][T11347] iowarrior 6-1:0.186: no interrupt-in endpoint found [ 1413.363960][T20293] exFAT-fs (nbd4): unable to read boot sector [ 1413.363986][T20293] exFAT-fs (nbd4): failed to read boot sector [ 1413.363992][T20293] exFAT-fs (nbd4): failed to recognize exfat type [ 1413.788479][T15127] usb 8-1: USB disconnect, device number 62 [ 1413.790999][T15127] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 1413.791285][T15127] opticon 8-1:1.0: device disconnected [ 1413.945935][T20280] read descriptors [ 1413.945947][T20280] bcdVersion must be 0x0100, stored in Little Endian order. Userspace driver should be fixed, accepting 0x0001 for compatibility. [ 1413.949548][T20302] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3102'. [ 1414.145060][T20307] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1414.162725][T20307] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1414.225990][T20308] erspan0: entered promiscuous mode [ 1414.241632][T20308] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3103'. [ 1414.925849][ T5695] usb 8-1: new high-speed USB device number 63 using dummy_hcd [ 1415.062576][ T5694] usb 4-1: unit 0 not found! [ 1415.086433][ T5695] usb 8-1: Using ep0 maxpacket: 8 [ 1415.089416][ T5695] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 1415.089445][ T5695] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1415.089459][ T5695] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1415.089473][ T5695] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1415.089486][ T5695] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1415.089508][ T5695] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1415.089522][ T5695] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1415.238897][ T9] usb 6-1: USB disconnect, device number 113 [ 1415.323326][ T5695] usb 8-1: usb_control_msg returned -32 [ 1415.323352][ T5695] usbtmc 8-1:16.0: can't read capabilities [ 1415.352560][T18365] ffs_data_put(): freeing [ 1416.175146][T20329] netlink: 'syz.9.3108': attribute type 4 has an invalid length. [ 1416.177255][T20329] netlink: 'syz.9.3108': attribute type 4 has an invalid length. [ 1418.090240][T20336] netlink: 'syz.5.3110': attribute type 4 has an invalid length. [ 1418.093864][T20336] netlink: 'syz.5.3110': attribute type 4 has an invalid length. [ 1418.098413][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1418.739524][T20348] input: syz0 as /devices/virtual/input/input39 [ 1418.903451][T20357] netlink: 20 bytes leftover after parsing attributes in process `syz.9.3116'. [ 1419.126742][T18184] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 1419.275976][T18184] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1419.276002][T18184] usb 5-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1419.276016][T18184] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1419.282151][T20356] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1419.396643][T18184] opticon 5-1:1.0: opticon converter detected [ 1419.776050][T18184] usb 5-1: opticon converter now attached to ttyUSB0 [ 1420.012485][T18184] usb 8-1: USB disconnect, device number 63 [ 1420.906684][T20368] netlink: 'syz.5.3118': attribute type 4 has an invalid length. [ 1420.910208][T20368] netlink: 'syz.5.3118': attribute type 4 has an invalid length. [ 1420.963947][ T29] audit: type=1400 audit(1786069645.754:2989): avc: denied { ioctl } for pid=20366 comm="syz.9.3120" path="/dev/ppp" dev="devtmpfs" ino=708 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1420.971109][T20365] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3119'. [ 1421.430742][ T29] audit: type=1400 audit(1786069646.224:2990): avc: denied { relabelfrom } for pid=20379 comm="syz.7.3124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1421.455407][ T29] audit: type=1400 audit(1786069646.244:2991): avc: denied { relabelto } for pid=20379 comm="syz.7.3124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1421.482838][T20380] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3124'. [ 1421.593260][T19945] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1421.599562][T19945] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1421.600266][T19945] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1421.601846][T19945] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1421.602124][T19945] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1421.790649][ T29] audit: type=1400 audit(1786069646.584:2992): avc: denied { listen } for pid=20390 comm="syz.5.3126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1421.950297][T20400] size and base must be multiples of 4 kiB [ 1421.950312][T20400] CPU: 0 UID: 0 PID: 20400 Comm: syz.9.3127 Tainted: G L syzkaller #0 PREEMPT(full) [ 1421.950328][T20400] Tainted: [L]=SOFTLOCKUP [ 1421.950331][T20400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1421.950338][T20400] Call Trace: [ 1421.950342][T20400] [ 1421.950346][T20400] dump_stack_lvl+0x100/0x190 [ 1421.950363][T20400] mtrr_add.cold+0x74/0x87 [ 1421.950376][T20400] mtrr_ioctl+0x25a/0xcf0 [ 1421.950390][T20400] ? __pfx_mtrr_ioctl+0x10/0x10 [ 1421.950412][T20400] ? __pfx_mtrr_ioctl+0x10/0x10 [ 1421.950425][T20400] proc_reg_unlocked_ioctl+0x229/0x320 [ 1421.950439][T20400] ? __pfx_proc_reg_unlocked_ioctl+0x10/0x10 [ 1421.950453][T20400] __x64_sys_ioctl+0x18e/0x210 [ 1421.950469][T20400] do_syscall_64+0x115/0x870 [ 1421.950481][T20400] ? clear_bhb_loop+0x40/0x90 [ 1421.950493][T20400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1421.950507][T20400] RIP: 0033:0x7fb66939e0d9 [ 1421.950516][T20400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1421.950527][T20400] RSP: 002b:00007fb66a309028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1421.950538][T20400] RAX: ffffffffffffffda RBX: 00007fb669625fa0 RCX: 00007fb66939e0d9 [ 1421.950545][T20400] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000003 [ 1421.950551][T20400] RBP: 00007fb669435024 R08: 0000000000000000 R09: 0000000000000000 [ 1421.950558][T20400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1421.950564][T20400] R13: 00007fb669626038 R14: 00007fb669625fa0 R15: 00007ffeddc88718 [ 1421.950578][T20400] [ 1422.316580][T20403] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3128'. [ 1422.416239][T20331] usb 10-1: new high-speed USB device number 39 using dummy_hcd [ 1423.271546][T20415] netlink: 'syz.5.3131': attribute type 4 has an invalid length. [ 1423.275564][T20415] netlink: 'syz.5.3131': attribute type 4 has an invalid length. [ 1423.293500][T20414] fuse: Bad value for 'group_id' [ 1423.293515][T20414] fuse: Bad value for 'group_id' [ 1423.294790][T20331] usb 10-1: Using ep0 maxpacket: 8 [ 1423.298000][T20331] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 1423.298028][T20331] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1423.298041][T20331] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1423.298056][T20331] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1423.298069][T20331] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1423.298091][T20331] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1423.298104][T20331] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1423.371049][T18184] usb 5-1: USB disconnect, device number 28 [ 1423.474234][T18184] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 1423.474996][T18184] opticon 5-1:1.0: device disconnected [ 1423.512112][T20331] usb 10-1: usb_control_msg returned -32 [ 1423.512142][T20331] usbtmc 10-1:16.0: can't read capabilities [ 1423.565226][ T5719] usb 8-1: new high-speed USB device number 64 using dummy_hcd [ 1423.582074][T20419] netlink: 'syz.5.3133': attribute type 5 has an invalid length. [ 1423.684834][T19945] Bluetooth: hci4: command tx timeout [ 1423.725662][ T5719] usb 8-1: Using ep0 maxpacket: 32 [ 1423.729971][ T5719] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1423.729992][ T5719] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1423.730013][ T5719] usb 8-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1423.730027][ T5719] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1423.731322][ T5719] usb 8-1: config 0 descriptor?? [ 1423.734113][ T5719] hub 8-1:0.0: USB hub found [ 1424.591214][ T5719] hub 8-1:0.0: 1 port detected [ 1425.009195][T20435] usbtmc 10-1:16.0: usb_control_msg returned -32 [ 1425.010764][T15127] usb 10-1: USB disconnect, device number 39 [ 1425.019978][T20414] netlink: 4768 bytes leftover after parsing attributes in process `syz.7.3132'. [ 1425.059502][T20414] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1425.059717][T20414] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1425.085195][ T5719] usb 8-1: USB disconnect, device number 64 [ 1425.769382][T19945] Bluetooth: hci4: command tx timeout [ 1426.743530][T20444] netlink: 20 bytes leftover after parsing attributes in process `syz.9.3136'. [ 1427.155965][T20331] usb 10-1: new high-speed USB device number 40 using dummy_hcd [ 1428.148596][T19945] Bluetooth: hci4: command tx timeout [ 1428.164927][T20331] usb 10-1: Using ep0 maxpacket: 32 [ 1428.175759][T20331] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1428.178122][T20331] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1428.178138][T20331] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1428.184699][T20331] usb 10-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 1428.184716][T20331] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1428.184728][T20331] usb 10-1: Product: syz [ 1428.184737][T20331] usb 10-1: Manufacturer: syz [ 1428.184746][T20331] usb 10-1: SerialNumber: syz [ 1428.418252][T20331] usb 10-1: unit 4 not found! [ 1428.418269][T20331] usb 10-1: unit 0 not found! [ 1428.503202][T20386] bridge0: port 1(bridge_slave_0) entered blocking state [ 1428.503247][T20386] bridge0: port 1(bridge_slave_0) entered disabled state [ 1428.503352][T20386] bridge_slave_0: entered allmulticast mode [ 1428.510247][T20386] bridge_slave_0: entered promiscuous mode [ 1428.513522][T20386] bridge0: port 2(bridge_slave_1) entered blocking state [ 1428.516372][T20386] bridge0: port 2(bridge_slave_1) entered disabled state [ 1428.516513][T20386] bridge_slave_1: entered allmulticast mode [ 1428.525490][T20386] bridge_slave_1: entered promiscuous mode [ 1428.591961][T20386] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1428.594114][T20386] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1428.619750][T20457] Cannot find add_set index 0 as target [ 1428.638731][T15127] usb 8-1: new high-speed USB device number 65 using dummy_hcd [ 1428.690167][T20386] team0: Port device team_slave_0 added [ 1428.698691][T20386] team0: Port device team_slave_1 added [ 1428.767557][T20386] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1428.767569][T20386] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1428.767584][T20386] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1428.774031][T20386] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1428.774043][T20386] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1428.774072][T20386] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1428.813648][T15127] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1428.813690][T15127] usb 8-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1428.813703][T15127] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1428.817101][T20477] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 1428.819764][T15127] opticon 8-1:1.0: opticon converter detected [ 1428.833185][T15127] usb 8-1: opticon converter now attached to ttyUSB0 [ 1428.927061][T20386] hsr_slave_0: entered promiscuous mode [ 1428.940762][T20386] hsr_slave_1: entered promiscuous mode [ 1428.941130][T20386] debugfs: 'hsr0' already exists in 'hsr' [ 1428.941142][T20386] Cannot create hsr debugfs directory [ 1428.949584][T20457] kvm: kvm [20456]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x10000008b [ 1428.962753][T20457] kvm: kvm [20456]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x100002785 [ 1428.979738][T20457] kvm: kvm [20456]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x3a39 [ 1428.979825][T20457] kvm: kvm [20456]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 1428.979959][T20457] kvm: kvm [20456]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0xdcf9 [ 1428.980006][T20457] kvm: kvm [20456]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 1429.807383][ T29] audit: type=1400 audit(1786069654.604:2993): avc: denied { setopt } for pid=20498 comm="syz.5.3144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1430.173300][T15139] Bluetooth: hci0: command 0x0406 tx timeout [ 1430.173337][T15139] Bluetooth: hci4: command tx timeout [ 1430.272061][T20331] usb 10-1: USB disconnect, device number 40 [ 1430.378056][T19864] udevd[19864]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1431.193346][T20511] netlink: 'syz.9.3145': attribute type 4 has an invalid length. [ 1431.210630][T20511] netlink: 'syz.9.3145': attribute type 4 has an invalid length. [ 1431.275546][ T5694] usb 6-1: new high-speed USB device number 114 using dummy_hcd [ 1431.435384][ T5694] usb 6-1: Using ep0 maxpacket: 8 [ 1431.469518][ T5694] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1431.469546][ T5694] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1431.469560][ T5694] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1431.469574][ T5694] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1431.469588][ T5694] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1431.469621][ T5694] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1431.469634][ T5694] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1431.707846][ T5694] usb 6-1: usb_control_msg returned -32 [ 1431.707874][ T5694] usbtmc 6-1:16.0: can't read capabilities [ 1432.068858][T20535] md: serialize_policy is only effective for raid1 [ 1432.958055][ T29] audit: type=1400 audit(1786069657.754:2994): avc: denied { write } for pid=20520 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1433.080013][T20536] usbtmc 6-1:16.0: INITIATE_ABORT_BULK_IN returned 0 [ 1433.179793][T20542] CacheFiles: No cache directory specified [ 1433.249674][ T29] audit: type=1400 audit(1786069658.044:2995): avc: denied { write } for pid=20543 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1433.283288][T11343] usb 6-1: USB disconnect, device number 114 [ 1434.178049][T20559] netlink: 'syz.4.3154': attribute type 8 has an invalid length. [ 1434.626343][T20386] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1434.702956][T20386] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1434.830912][T20386] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1434.932745][ T29] audit: type=1400 audit(1786069659.724:2996): avc: denied { write } for pid=20549 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1434.991426][T19945] Bluetooth: hci2: command 0x0406 tx timeout [ 1435.057430][T20386] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1435.144227][ T29] audit: type=1400 audit(1786069659.934:2997): avc: denied { associate } for pid=20570 comm="syz.5.3157" name="pfkey" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 1435.193894][T15140] Bluetooth: hci7: ACL packet for unknown connection handle 12 [ 1435.252521][T20386] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1435.271021][T20519] usb 4-1: USB disconnect, device number 103 [ 1435.338392][T20386] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1435.393695][ T29] audit: type=1400 audit(1786069660.184:2998): avc: denied { write } for pid=20575 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1435.439635][T20386] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1435.546389][T20386] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1435.910980][T20594] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3160'. [ 1436.279856][ T63] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1436.328063][T20592] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3158'. [ 1436.524123][ T5719] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 1436.601017][ T63] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1436.643583][T20613] netlink: 5 bytes leftover after parsing attributes in process `syz.5.3164'. [ 1436.685725][T20613] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3164'. [ 1436.717059][ T5719] usb 5-1: Using ep0 maxpacket: 8 [ 1436.739057][ T5719] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1436.774253][T20613] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3164'. [ 1436.792179][ T5719] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1436.838767][ T5719] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1436.889363][ T5719] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1436.967593][ T5719] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1437.053462][ T5719] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1437.093714][ T63] bond0: (slave netdevsim1): Releasing backup interface [ 1437.114047][ T5719] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1437.153289][ T29] audit: type=1400 audit(1786069661.944:2999): avc: denied { write } for pid=20603 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1437.199680][ T63] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1437.400982][ T5719] usb 5-1: usb_control_msg returned -32 [ 1437.431211][ T5719] usbtmc 5-1:16.0: can't read capabilities [ 1437.447878][ T29] audit: type=1400 audit(1786069662.244:3000): avc: denied { write } for pid=20628 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1437.508930][ T63] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1437.612830][T20386] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1437.739547][T20386] 8021q: adding VLAN 0 to HW filter on device team0 [ 1437.934744][T20519] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1438.929654][ T8293] bridge0: port 1(bridge_slave_0) entered blocking state [ 1438.936819][ T8293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1439.088364][T20637] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 1439.111716][T11343] usb 8-1: USB disconnect, device number 65 [ 1439.124899][T20519] usb 6-1: Using ep0 maxpacket: 8 [ 1439.140177][ T8293] bridge0: port 2(bridge_slave_1) entered blocking state [ 1439.147354][ T8293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1439.162336][T20643] overlayfs: missing 'lowerdir' [ 1439.179636][T20519] usb 6-1: config 0 has an invalid interface number: 186 but max is 0 [ 1439.199717][T11343] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 1439.228344][T20519] usb 6-1: config 0 has no interface number 0 [ 1439.252977][T11343] opticon 8-1:1.0: device disconnected [ 1439.292865][T20519] usb 6-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1439.368367][T20646] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3169'. [ 1439.385732][T20641] netlink: 20 bytes leftover after parsing attributes in process `syz.9.3168'. [ 1439.397029][T18184] usb 5-1: USB disconnect, device number 29 [ 1439.417686][T20519] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1439.483827][T20519] usb 6-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 1439.567913][T20519] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 112, changing to 10 [ 1439.660074][T20519] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x8A has invalid maxpacket 10102, setting to 1024 [ 1439.741930][T20519] usb 6-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1440.103061][T20519] usb 6-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 1440.124755][ T29] audit: type=1400 audit(1786069664.914:3001): avc: denied { write } for pid=20636 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1440.199449][T20519] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1440.267701][T20519] usb 6-1: Product: syz [ 1440.321175][T20519] usb 6-1: Manufacturer: syz [ 1440.354104][T20519] usb 6-1: SerialNumber: syz [ 1440.436846][T18365] ffs_data_put(): freeing [ 1440.448817][T20519] usb 6-1: config 0 descriptor?? [ 1441.306136][T20669] netlink: 'syz.4.3172': attribute type 4 has an invalid length. [ 1441.329504][ T29] audit: type=1400 audit(1786069666.124:3002): avc: denied { write } for pid=20665 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1441.355692][T20519] usb 6-1: can't set config #0, error -71 [ 1441.365071][T20670] netlink: 'syz.4.3172': attribute type 4 has an invalid length. [ 1441.431895][T20519] usb 6-1: USB disconnect, device number 115 [ 1442.050845][ T63] bridge_slave_1: left allmulticast mode [ 1442.195932][ T63] bridge_slave_1: left promiscuous mode [ 1442.559578][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 1442.647807][ T63] bridge_slave_0: left allmulticast mode [ 1442.675221][T20331] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 1442.696683][ T63] bridge_slave_0: left promiscuous mode [ 1442.731324][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 1442.929559][T20331] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1442.975436][T20691] netlink: 156 bytes leftover after parsing attributes in process `syz.7.3179'. [ 1442.999239][T20331] usb 5-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1443.060448][T20331] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1443.097039][T20686] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1443.148025][T20331] opticon 5-1:1.0: opticon converter detected [ 1443.203496][T20331] usb 5-1: opticon converter now attached to ttyUSB0 [ 1443.283304][ T5695] usb 10-1: new high-speed USB device number 41 using dummy_hcd [ 1443.358621][ T63] bond1 (unregistering): (slave geneve2): Releasing active interface [ 1443.441495][ T63] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1443.478331][ T5695] usb 10-1: Using ep0 maxpacket: 32 [ 1443.493560][ T5695] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1443.516224][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1443.547522][ T5695] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1443.566230][ T63] bond0 (unregistering): Released all slaves [ 1443.595002][ T5695] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1443.627141][ T63] bond1 (unregistering): Released all slaves [ 1443.638437][ T5695] usb 10-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 1443.665674][ T5695] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1443.717549][ T5695] usb 10-1: Product: syz [ 1443.728119][ T5695] usb 10-1: Manufacturer: syz [ 1443.758582][ T5695] usb 10-1: SerialNumber: syz [ 1443.863241][T20696] macsec1: entered promiscuous mode [ 1444.032359][ T5695] usb 10-1: unit 4 not found! [ 1444.091497][ T5695] usb 10-1: unit 0 not found! [ 1444.155256][T20519] usb 5-1: USB disconnect, device number 30 [ 1444.195478][T20703] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3181'. [ 1444.207380][T20519] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 1444.216524][T20694] Cannot find add_set index 0 as target [ 1444.274302][T20519] opticon 5-1:1.0: device disconnected [ 1444.377682][ T29] audit: type=1400 audit(1786069669.164:3003): avc: denied { remount } for pid=20704 comm="syz.7.3182" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1444.467828][T20709] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1444.483542][ T29] audit: type=1400 audit(1786069669.234:3004): avc: denied { setopt } for pid=20704 comm="syz.7.3182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1444.511394][T15140] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 1444.520824][T20709] bond7: (slave bond8): Enslaving as an active interface with an up link [ 1444.520910][T15140] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 1444.538456][T15140] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 1444.609993][ T63] hsr_slave_0: left promiscuous mode [ 1444.641870][ T63] hsr_slave_1: left promiscuous mode [ 1444.688874][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1444.736218][ T63] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1444.785168][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1444.826416][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1444.873595][ T63] veth1_macvtap: left promiscuous mode [ 1444.900846][ T29] audit: type=1400 audit(1786069669.694:3005): avc: denied { write } for pid=20699 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1445.757777][ T63] veth0_macvtap: left promiscuous mode [ 1445.799156][T20734] netlink: 'syz.4.3184': attribute type 4 has an invalid length. [ 1445.823900][ T63] veth1_vlan: left promiscuous mode [ 1445.852155][T20735] netlink: 'syz.4.3184': attribute type 4 has an invalid length. [ 1445.877222][ T63] veth0_vlan: left promiscuous mode [ 1445.999591][ T29] audit: type=1400 audit(1786069670.794:3006): avc: denied { write } for pid=20737 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1446.194820][T18184] usb 6-1: new full-speed USB device number 116 using dummy_hcd [ 1446.310500][ T63] team0 (unregistering): Port device team_slave_1 removed [ 1446.330891][ T63] team0 (unregistering): Port device team_slave_0 removed [ 1446.355456][T18184] usb 6-1: device descriptor read/64, error -71 [ 1446.590489][ T5695] usb 10-1: USB disconnect, device number 41 [ 1446.611429][T18184] usb 6-1: new full-speed USB device number 117 using dummy_hcd [ 1446.636120][T20748] FAULT_INJECTION: forcing a failure. [ 1446.636120][T20748] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1446.725234][T19864] udevd[19864]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1446.780439][T20748] CPU: 0 UID: 0 PID: 20748 Comm: syz.7.3187 Tainted: G L syzkaller #0 PREEMPT(full) [ 1446.780458][T20748] Tainted: [L]=SOFTLOCKUP [ 1446.780462][T20748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1446.780469][T20748] Call Trace: [ 1446.780473][T20748] [ 1446.780478][T20748] dump_stack_lvl+0x100/0x190 [ 1446.780496][T20748] should_fail_ex.cold+0x5/0xa [ 1446.780514][T20748] _copy_from_user+0x2e/0xd0 [ 1446.780528][T20748] video_usercopy+0xe71/0x1730 [ 1446.780541][T20748] ? __pfx___video_do_ioctl+0x10/0x10 [ 1446.780554][T20748] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1446.780570][T20748] ? __pfx_video_usercopy+0x10/0x10 [ 1446.780591][T20748] v4l2_ioctl+0x1bd/0x250 [ 1446.780603][T20748] ? __pfx_v4l2_ioctl+0x10/0x10 [ 1446.780616][T20748] __x64_sys_ioctl+0x18e/0x210 [ 1446.780633][T20748] do_syscall_64+0x115/0x870 [ 1446.780644][T20748] ? clear_bhb_loop+0x40/0x90 [ 1446.780657][T20748] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.780668][T20748] RIP: 0033:0x7f13ddd9e0d9 [ 1446.780678][T20748] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1446.780689][T20748] RSP: 002b:00007f13ded1b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1446.780700][T20748] RAX: ffffffffffffffda RBX: 00007f13de025fa0 RCX: 00007f13ddd9e0d9 [ 1446.780707][T20748] RDX: 00002000000002c0 RSI: 00000000c0d05604 RDI: 0000000000000003 [ 1446.780720][T20748] RBP: 00007f13ded1b090 R08: 0000000000000000 R09: 0000000000000000 [ 1446.780726][T20748] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1446.780733][T20748] R13: 00007f13de026038 R14: 00007f13de025fa0 R15: 00007ffe672f79f8 [ 1446.780746][T20748] [ 1446.969896][T18184] usb 6-1: device descriptor read/64, error -71 [ 1447.224105][T18184] usb usb6-port1: attempt power cycle [ 1447.969127][ T5330] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 1448.117266][ T5695] usb 10-1: new high-speed USB device number 42 using dummy_hcd [ 1448.203525][ T5330] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1448.217577][ T5330] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1448.266584][ T5330] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1448.284927][T18184] usb 6-1: new full-speed USB device number 118 using dummy_hcd [ 1448.303139][ T5695] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 1448.328600][T18184] usb 6-1: device descriptor read/8, error -71 [ 1448.336846][ T5330] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1448.352983][ T5695] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 32 [ 1448.368217][ T29] audit: type=1400 audit(1786069673.164:3007): avc: denied { write } for pid=20746 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1448.413347][ T5695] usb 10-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00 [ 1448.423578][ T5330] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1448.462770][ T5695] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1448.484032][ T5330] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1448.518036][ T5330] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1448.534811][ T29] audit: type=1400 audit(1786069673.304:3008): avc: denied { write } for pid=20769 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1448.571375][T20752] raw-gadget.2 gadget.9: fail, usb_ep_enable returned -22 [ 1448.582199][T20752] raw-gadget.2 gadget.9: fail, usb_ep_enable returned -22 [ 1448.599163][ T5330] usb 5-1: Product: syz [ 1448.618007][T18184] usb 6-1: new full-speed USB device number 119 using dummy_hcd [ 1448.630921][ T5330] usb 5-1: Manufacturer: syz [ 1448.638823][ T5695] cyberjack 10-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 1448.668654][T18184] usb 6-1: device descriptor read/8, error -71 [ 1448.703540][ T5330] cdc_wdm 5-1:1.0: skipping garbage [ 1448.715340][ T5695] usb 10-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1448.751501][T20386] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1448.770729][ T5330] cdc_wdm 5-1:1.0: skipping garbage [ 1448.799387][T18184] usb usb6-port1: unable to enumerate USB device [ 1448.828110][ T5330] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 1448.883302][ T5330] cdc_wdm 5-1:1.0: Unknown control protocol [ 1449.068558][T20386] veth0_vlan: entered promiscuous mode [ 1449.112046][ T29] audit: type=1400 audit(1786069673.904:3009): avc: denied { setopt } for pid=20751 comm="syz.9.3188" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1449.192990][T20754] syzkaller0: entered promiscuous mode [ 1449.226913][T20754] syzkaller0: entered allmulticast mode [ 1449.290315][T20386] veth1_vlan: entered promiscuous mode [ 1449.393332][ T5695] usb 10-1: USB disconnect, device number 42 [ 1449.419470][ T5695] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1449.486559][T18184] usb 5-1: USB disconnect, device number 31 [ 1449.511405][ T5695] cyberjack 10-1:1.0: device disconnected [ 1449.547278][T20386] veth0_macvtap: entered promiscuous mode [ 1449.598179][T20386] veth1_macvtap: entered promiscuous mode [ 1449.658555][T20386] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1449.692814][T20386] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1449.747172][ T29] audit: type=1400 audit(1786069674.544:3010): avc: denied { write } for pid=20777 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1449.773775][ T63] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1449.808317][ T63] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1449.854863][T15127] usb 8-1: new high-speed USB device number 66 using dummy_hcd [ 1449.892755][ T8286] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1450.013762][ T63] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1450.037167][T15127] usb 8-1: device descriptor read/64, error -71 [ 1450.083467][ T29] audit: type=1400 audit(1786069674.884:3011): avc: denied { write } for pid=20802 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1450.222279][ T5976] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1450.271580][ T5976] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1450.307334][T20808] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1450.315129][ T5694] IPVS: starting estimator thread 0... [ 1450.326721][T19945] Bluetooth: hci3: command 0x0405 tx timeout [ 1450.354940][T15127] usb 8-1: new high-speed USB device number 67 using dummy_hcd [ 1450.434902][T18184] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 1450.443776][ T5976] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1450.458464][ T29] audit: type=1400 audit(1786069675.254:3012): avc: denied { setopt } for pid=20815 comm="syz.5.3198" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1450.483264][T20809] IPVS: using max 78 ests per chain, 187200 per kthread [ 1450.507345][T20816] binder: BINDER_SET_CONTEXT_MGR already set [ 1450.517304][T15127] usb 8-1: device descriptor read/64, error -71 [ 1450.539564][ T5976] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1450.563956][T20816] binder: 20815:20816 ioctl 4018620d 200000000040 returned -16 [ 1450.665166][T15127] usb usb8-port1: attempt power cycle [ 1450.674743][T18184] usb 5-1: Using ep0 maxpacket: 32 [ 1451.387545][T18184] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1451.546957][T18184] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1451.628002][T18184] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1451.670337][T20828] netlink: 'syz.5.3200': attribute type 4 has an invalid length. [ 1451.684156][T20827] netlink: 'syz.2.3121': attribute type 1 has an invalid length. [ 1451.702939][T18184] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 1451.739769][T18184] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1451.787089][T18184] usb 5-1: Product: syz [ 1451.814103][T18184] usb 5-1: Manufacturer: syz [ 1451.841840][T18184] usb 5-1: SerialNumber: syz [ 1451.848013][T15127] usb 8-1: new high-speed USB device number 68 using dummy_hcd [ 1451.905677][T15127] usb 8-1: device descriptor read/8, error -71 [ 1452.260322][T15127] usb 8-1: new high-speed USB device number 69 using dummy_hcd [ 1452.301120][T20806] Cannot find add_set index 0 as target [ 1452.830424][T18184] usb 5-1: unit 4 not found! [ 1452.976871][T18184] usb 5-1: unit 0 not found! [ 1453.110508][T20842] CacheFiles: Failed to register: -95 [ 1453.237248][T15127] usb 8-1: device not accepting address 69, error -71 [ 1453.287621][T15127] usb usb8-port1: unable to enumerate USB device [ 1453.294827][ T5719] usb 10-1: new high-speed USB device number 43 using dummy_hcd [ 1453.569118][ T29] audit: type=1400 audit(1786069678.364:3013): avc: denied { write } for pid=20824 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1453.640466][T18184] usb 5-1: USB disconnect, device number 32 [ 1453.714938][ T5719] usb 10-1: Using ep0 maxpacket: 8 [ 1453.730486][ T5719] usb 10-1: config 0 has an invalid interface number: 186 but max is 0 [ 1453.763331][ T5719] usb 10-1: config 0 has no interface number 0 [ 1453.787781][ T29] audit: type=1400 audit(1786069678.574:3014): avc: denied { write } for pid=20858 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1453.814933][ T5719] usb 10-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1453.869822][ T5719] usb 10-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1453.909495][ T5719] usb 10-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 1453.949123][T15127] usb 8-1: new full-speed USB device number 70 using dummy_hcd [ 1453.971671][ T5258] 8021q: adding VLAN 0 to HW filter on device eth8 [ 1453.999632][ T5719] usb 10-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 112, changing to 10 [ 1454.088345][ T5719] usb 10-1: config 0 interface 186 altsetting 0 endpoint 0x8A has invalid maxpacket 10229, setting to 1024 [ 1454.140515][T15127] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1454.181042][ T5719] usb 10-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1454.211208][T15127] usb 8-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1454.293323][ T5719] usb 10-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 1454.309247][T15127] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1454.346341][ T5719] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1454.386423][T15127] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1454.408119][ T5719] usb 10-1: Product: syz [ 1454.423158][T15127] usb 8-1: Product: syz [ 1454.436432][ T5719] usb 10-1: Manufacturer: syz [ 1454.458484][T15127] usb 8-1: Manufacturer: syz [ 1454.469421][ T5719] usb 10-1: SerialNumber: syz [ 1454.490999][T15127] usb 8-1: SerialNumber: syz [ 1454.518539][ T5719] usb 10-1: config 0 descriptor?? [ 1454.552396][T20844] raw-gadget.2 gadget.9: fail, usb_ep_enable returned -22 [ 1454.748244][T20857] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1454.768533][T18724] ffs_data_put(): freeing [ 1454.775019][ T5719] iowarrior 10-1:0.186: IOWarrior product=0x1505, serial= interface=186 now attached to iowarrior0 [ 1454.839099][T20857] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1454.895110][ T5719] usb 10-1: USB disconnect, device number 43 [ 1454.935878][T15127] cdc_ether 8-1:1.0: GUID doesn't match [ 1454.971439][ T29] audit: type=1400 audit(1786069679.764:3015): avc: denied { write } for pid=20860 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1455.031919][T15127] usb 8-1: USB disconnect, device number 70 [ 1455.283971][ T29] audit: type=1400 audit(1786069680.074:3016): avc: denied { write } for pid=20883 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1455.770343][T20897] netlink: 28 bytes leftover after parsing attributes in process `syz.9.3214'. [ 1455.930382][T20901] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3216'. [ 1455.983504][T20901] overlay: Unknown parameter '`' [ 1456.395166][T11347] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 1456.479911][ T29] audit: type=1400 audit(1786069681.264:3017): avc: denied { write } for pid=20896 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1456.605291][T11347] usb 5-1: Using ep0 maxpacket: 32 [ 1456.634913][ T5695] usb 10-1: new high-speed USB device number 44 using dummy_hcd [ 1456.648014][T11347] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1456.673547][ T29] audit: type=1400 audit(1786069681.404:3018): avc: denied { getopt } for pid=20919 comm="syz.5.3219" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1456.719896][T11347] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1456.784310][T11347] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1456.843007][ T29] audit: type=1400 audit(1786069681.534:3019): avc: denied { map } for pid=20921 comm="syz.7.3220" path="pipe:[92285]" dev="pipefs" ino=92285 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 1456.876818][ T5695] usb 10-1: Using ep0 maxpacket: 32 [ 1456.899911][T11347] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 1456.926796][ T5695] usb 10-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 1456.962676][T11347] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1457.001921][ T5695] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1457.026882][T11347] usb 5-1: Product: syz [ 1457.048823][ T29] audit: type=1400 audit(1786069681.534:3020): avc: denied { execute } for pid=20921 comm="syz.7.3220" path="pipe:[92285]" dev="pipefs" ino=92285 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 1457.072550][ T5695] usb 10-1: New USB device found, idVendor=1b1c, idProduct=1c09, bcdDevice= 0.00 [ 1457.090488][T11347] usb 5-1: Manufacturer: syz [ 1457.122838][T11347] usb 5-1: SerialNumber: syz [ 1457.139703][ T5695] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1457.202919][ T5695] usb 10-1: config 0 descriptor?? [ 1457.248696][ T29] audit: type=1400 audit(1786069681.624:3021): avc: denied { write } for pid=20926 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1457.376690][T11347] usb 5-1: unit 4 not found! [ 1457.411033][T11347] usb 5-1: unit 0 not found! [ 1457.576104][T20911] Cannot find add_set index 0 as target [ 1459.012784][T20958] netlink: 'syz.2.3222': attribute type 3 has an invalid length. [ 1459.183828][ T29] audit: type=1400 audit(1786069683.974:3022): avc: denied { write } for pid=20933 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1459.221960][T11347] usb 5-1: USB disconnect, device number 33 [ 1459.356218][ T5695] usbhid 10-1:0.0: can't add hid device: -71 [ 1459.397771][ T5695] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1459.506743][ T5695] usb 10-1: USB disconnect, device number 44 [ 1459.564813][ T29] audit: type=1400 audit(1786069684.354:3023): avc: denied { write } for pid=20969 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1459.687307][T20973] netlink: 156 bytes leftover after parsing attributes in process `syz.7.3227'. [ 1459.706331][T20973] macsec1: entered promiscuous mode [ 1459.869565][T20976] lo: entered allmulticast mode [ 1459.901956][ T29] audit: type=1400 audit(1786069684.694:3024): avc: denied { write } for pid=20978 comm="syz.5.3228" name="functions" dev="configfs" ino=10187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1459.957672][T20976] SELinux: failure in sel_netif_sid_slow(), invalid network interface (0) [ 1459.966262][T20976] mroute: pending queue full, dropping entries [ 1460.038770][T20975] lo: left allmulticast mode [ 1460.065166][ T29] audit: type=1400 audit(1786069684.694:3025): avc: denied { add_name } for pid=20978 comm="syz.5.3228" name="uvc.usb0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1460.234910][T11347] usb 8-1: new high-speed USB device number 71 using dummy_hcd [ 1460.296484][ T29] audit: type=1400 audit(1786069684.694:3026): avc: denied { create } for pid=20978 comm="syz.5.3228" name="uvc.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 1460.504759][T11347] usb 8-1: Using ep0 maxpacket: 32 [ 1460.521527][T11347] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1460.562628][T11347] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1460.643747][T11347] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1460.701886][T11347] usb 8-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 1460.761557][T11347] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1460.836406][T11347] usb 8-1: Product: syz [ 1460.866485][T11347] usb 8-1: Manufacturer: syz [ 1460.981377][T11347] usb 8-1: SerialNumber: syz [ 1461.026349][ T29] audit: type=1400 audit(1786069685.824:3027): avc: denied { write } for pid=20985 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1461.289687][T11347] usb 8-1: unit 4 not found! [ 1461.328666][T11347] usb 8-1: unit 0 not found! [ 1461.370818][ T29] audit: type=1400 audit(1786069686.164:3028): avc: denied { write } for pid=21017 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1461.433800][T20983] Cannot find add_set index 0 as target [ 1461.865369][ T5695] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 1461.914172][T11347] usb 8-1: USB disconnect, device number 71 [ 1462.074898][ T5695] usb 5-1: Using ep0 maxpacket: 32 [ 1462.119310][ T5695] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1462.167927][ T5695] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1462.245059][ T5695] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1462.315010][ T5695] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 1462.349898][ T5695] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1462.386362][ T5695] usb 5-1: Product: syz [ 1462.408587][ T5695] usb 5-1: Manufacturer: syz [ 1462.437732][ T5695] usb 5-1: SerialNumber: syz [ 1462.504904][T18184] usb 6-1: new full-speed USB device number 120 using dummy_hcd [ 1462.535489][ T29] audit: type=1400 audit(1786069687.324:3029): avc: denied { write } for pid=21027 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1462.728448][ T5695] usb 5-1: unit 4 not found! [ 1462.739641][T18184] usb 6-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 1462.765469][ T5695] usb 5-1: unit 0 not found! [ 1462.781305][T18184] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1462.808418][T21050] netlink: 156 bytes leftover after parsing attributes in process `syz.7.3245'. [ 1462.830249][T21050] macsec1: entered promiscuous mode [ 1462.848916][ T29] audit: type=1400 audit(1786069687.644:3030): avc: denied { write } for pid=21051 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1462.902994][T21025] Cannot find add_set index 0 as target [ 1462.910354][T18184] usb 6-1: config 0 descriptor?? [ 1462.951545][T18184] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 1463.025151][ T5694] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 1463.153188][T18184] gp8psk: usb in 128 operation failed. [ 1463.225978][ T5694] usb 3-1: Using ep0 maxpacket: 8 [ 1463.246196][ T5694] usb 3-1: config 0 has an invalid interface number: 186 but max is 0 [ 1463.275277][ T5694] usb 3-1: config 0 has no interface number 0 [ 1463.298913][ T5694] usb 3-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1463.370435][ T5694] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1463.386304][T18184] gp8psk: usb in 146 operation failed. [ 1463.415198][ T5695] usb 5-1: USB disconnect, device number 34 [ 1463.432102][T18184] gp8psk: failed to get FW version [ 1463.447229][ T5694] usb 3-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 1463.478548][T18184] gp8psk: usb in 149 operation failed. [ 1463.497736][T18184] gp8psk: failed to get FPGA version [ 1463.509422][ T5694] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 112, changing to 10 [ 1463.577002][ T5694] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x8A has invalid maxpacket 10229, setting to 1024 [ 1463.627408][ T5694] usb 3-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1463.745211][T18184] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1463.766059][ T5694] usb 3-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 1463.781387][T18184] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 1463.793095][ T5694] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1463.815490][ T5694] usb 3-1: Product: syz [ 1463.849800][ T5694] usb 3-1: Manufacturer: syz [ 1463.878644][ T5694] usb 3-1: SerialNumber: syz [ 1463.911347][ T5694] usb 3-1: config 0 descriptor?? [ 1463.938127][T21040] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1464.110230][ T29] audit: type=1400 audit(1786069688.904:3031): avc: denied { write } for pid=21064 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1464.272613][T21077] NILFS (nullb0): couldn't find nilfs on the device [ 1464.447347][T21040] read descriptors [ 1465.161508][T21040] bcdVersion must be 0x0100, stored in Little Endian order. Userspace driver should be fixed, accepting 0x0001 for compatibility. [ 1465.235364][T11347] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 1466.189512][T21090] netlink: 'syz.9.3251': attribute type 4 has an invalid length. [ 1466.206116][T21090] netlink: 'syz.9.3251': attribute type 4 has an invalid length. [ 1466.301035][ T5695] usb 6-1: USB disconnect, device number 120 [ 1466.366924][T11347] usb 5-1: config 0 has too many interfaces: 129, using maximum allowed: 32 [ 1466.534269][ T29] audit: type=1400 audit(1786069691.324:3032): avc: denied { write } for pid=21089 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1466.591312][T11347] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 129 [ 1466.647065][T20386] ffs_data_put(): freeing [ 1466.761639][T11347] usb 5-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 1466.795960][ T5694] iowarrior 3-1:0.186: IOWarrior product=0x1505, serial= interface=186 now attached to iowarrior0 [ 1466.863320][T11347] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1466.978812][ T5694] usb 3-1: USB disconnect, device number 83 [ 1467.011894][T11347] usb 5-1: Product: syz [ 1467.037873][ T29] audit: type=1400 audit(1786069691.834:3033): avc: denied { setopt } for pid=21102 comm="syz.2.3255" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1467.073675][T11347] usb 5-1: Manufacturer: syz [ 1467.087260][T21106] netlink: 'syz.5.3256': attribute type 4 has an invalid length. [ 1467.097991][T21106] netlink: 'syz.5.3256': attribute type 4 has an invalid length. [ 1467.151208][T11347] usb 5-1: SerialNumber: syz [ 1467.212822][T11347] usb 5-1: config 0 descriptor?? [ 1467.336894][T11347] usb 5-1: can't set config #0, error -71 [ 1467.418668][T11347] usb 5-1: USB disconnect, device number 35 [ 1467.625182][T21121] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3259'. [ 1468.477171][T21124] netlink: 'syz.7.3261': attribute type 4 has an invalid length. [ 1468.489851][T21124] netlink: 'syz.7.3261': attribute type 4 has an invalid length. [ 1468.525600][T21126] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3259'. [ 1468.894794][ T5694] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 1468.921637][T11343] usb 6-1: new high-speed USB device number 121 using dummy_hcd [ 1469.223857][ T29] audit: type=1326 audit(1786069693.574:3034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21133 comm="syz.7.3264" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f13ddd9e0d9 code=0x7ffc0000 [ 1469.945329][ T29] audit: type=1326 audit(1786069693.574:3035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21133 comm="syz.7.3264" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f13ddd9e0d9 code=0x7ffc0000 [ 1469.989648][ T5694] usb 3-1: Using ep0 maxpacket: 32 [ 1470.028208][T11343] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1470.051130][ T5694] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1470.096816][T11343] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1470.120978][ T5694] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1470.171524][T11343] usb 6-1: Product: syz [ 1470.201735][ T29] audit: type=1326 audit(1786069693.574:3036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21133 comm="syz.7.3264" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7f13ddd9e0d9 code=0x7ffc0000 [ 1470.230823][T11343] usb 6-1: Manufacturer: syz [ 1470.240643][ T5694] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 1470.272999][T11343] usb 6-1: SerialNumber: syz [ 1470.297380][T21148] SELinux: Context system_u:object_r:device_t:s0 is not valid (left unmapped). [ 1470.310212][T21149] comedi comedi3: comedi_config --init_data is deprecated [ 1470.320214][ T5694] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1470.412690][T11347] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1470.434168][ T5694] usb 3-1: config 0 descriptor?? [ 1470.496157][ T29] audit: type=1326 audit(1786069693.574:3037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21133 comm="syz.7.3264" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f13ddd9e0d9 code=0x7ffc0000 [ 1470.623552][T21149] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3268'. [ 1470.721368][ T29] audit: type=1326 audit(1786069693.574:3038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21133 comm="syz.7.3264" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f13ddd9e0d9 code=0x7ffc0000 [ 1470.785088][T21159] Cannot find set identified by id 0 to match [ 1470.892996][ T5694] koneplus 0003:1E7D:2D51.0014: unknown main item tag 0x0 [ 1471.067176][ T29] audit: type=1326 audit(1786069693.574:3039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21133 comm="syz.7.3264" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f13ddd9e0d9 code=0x7ffc0000 [ 1471.270296][ T5694] koneplus 0003:1E7D:2D51.0014: unknown main item tag 0x0 [ 1472.265949][T11347] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1472.280614][ T5694] koneplus 0003:1E7D:2D51.0014: unknown main item tag 0x0 [ 1480.303454][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1503.406418][T11347] ath9k_htc: Failed to initialize the device [ 1543.824692][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1581.644641][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1581.651590][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P18365/1:b..l [ 1581.660217][ C0] rcu: (detected by 0, t=10502 jiffies, g=259437, q=1582 ncpus=1) [ 1581.668093][ C0] task:syz-executor state:R running task stack:22184 pid:18365 tgid:18365 ppid:18358 task_flags:0x400140 flags:0x00080000 [ 1581.682977][ C0] Call Trace: [ 1581.686255][ C0] [ 1581.689169][ C0] __schedule+0x125c/0x6730 [ 1581.693664][ C0] ? is_bpf_text_address+0x94/0x1a0 [ 1581.698850][ C0] ? arch_stack_walk+0xa6/0xf0 [ 1581.703611][ C0] ? __pfx___schedule+0x10/0x10 [ 1581.708446][ C0] ? mark_held_locks+0x40/0x70 [ 1581.713193][ C0] preempt_schedule_irq+0x50/0x90 [ 1581.718191][ C0] irqentry_exit+0x205/0xa00 [ 1581.722751][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1581.728699][ C0] RIP: 0010:lock_release+0x19e/0x310 [ 1581.733954][ C0] Code: ff 65 0f c1 05 a3 8b 7d 12 83 f8 01 0f 85 27 01 00 00 9c 58 f6 c4 02 0f 85 12 01 00 00 41 f7 c6 00 02 00 00 0f 85 c8 00 00 00 <48> 8b 44 24 10 65 48 2b 05 ad 44 7d 12 0f 85 4d 01 00 00 48 83 c4 [ 1581.753544][ C0] RSP: 0018:ffffc90003667590 EFLAGS: 00000206 [ 1581.759587][ C0] RAX: 0000000000000046 RBX: ffffffff8ebe8200 RCX: ffffc9000366759c [ 1581.767529][ C0] RDX: 0000000000000002 RSI: ffffffff8e1810a7 RDI: ffffffff8c3ffa80 [ 1581.775470][ C0] RBP: ffffffff81b856be R08: 0000000000000001 R09: 0000000000000007 [ 1581.783418][ C0] R10: 0000000000000200 R11: 0000000000018566 R12: ffff88802a160000 [ 1581.791365][ C0] R13: ffffc90003667648 R14: 0000000000000202 R15: 0000000000000003 [ 1581.799315][ C0] ? unwind_next_frame+0x3be/0x2090 [ 1581.804501][ C0] unwind_next_frame+0x3c3/0x2090 [ 1581.809494][ C0] ? save_stack+0x162/0x1e0 [ 1581.813969][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1581.820101][ C0] arch_stack_walk+0x94/0xf0 [ 1581.824668][ C0] ? __reset_page_owner+0x84/0x190 [ 1581.829764][ C0] stack_trace_save+0x8e/0xc0 [ 1581.834424][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 1581.839779][ C0] ? __lock_acquire+0x49f/0x1a40 [ 1581.844689][ C0] ? __lock_acquire+0x49f/0x1a40 [ 1581.849831][ C0] save_stack+0x162/0x1e0 [ 1581.854130][ C0] ? __pfx_save_stack+0x10/0x10 [ 1581.858966][ C0] ? page_ext_put+0x3e/0xd0 [ 1581.863445][ C0] __reset_page_owner+0x84/0x190 [ 1581.868367][ C0] __free_frozen_pages+0x79f/0x1090 [ 1581.873540][ C0] qlist_free_all+0x47/0xf0 [ 1581.878013][ C0] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1581.883461][ C0] __kasan_kmalloc+0x8a/0xb0 [ 1581.888024][ C0] __kmalloc_noprof+0x322/0x820 [ 1581.892845][ C0] ? tomoyo_encode2+0xfb/0x3c0 [ 1581.897606][ C0] tomoyo_encode2+0xfb/0x3c0 [ 1581.902172][ C0] tomoyo_encode+0x29/0x50 [ 1581.906559][ C0] tomoyo_realpath_from_path+0x18c/0x690 [ 1581.912167][ C0] tomoyo_path_perm+0x276/0x460 [ 1581.916998][ C0] ? tomoyo_path_perm+0x262/0x460 [ 1581.921994][ C0] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 1581.927347][ C0] ? lockdep_hardirqs_on+0x78/0x100 [ 1581.932526][ C0] ? putname+0xb1/0x110 [ 1581.936650][ C0] ? kmem_cache_free+0x127/0x6b0 [ 1581.941574][ C0] security_inode_getattr+0x116/0x280 [ 1581.946928][ C0] vfs_fstat+0x4b/0xe0 [ 1581.950969][ C0] __do_sys_newfstat+0x8b/0x110 [ 1581.955806][ C0] ? __pfx___do_sys_newfstat+0x10/0x10 [ 1581.961257][ C0] ? __pfx___x64_sys_umount+0x10/0x10 [ 1581.966603][ C0] do_syscall_64+0x115/0x870 [ 1581.971163][ C0] ? clear_bhb_loop+0x40/0x90 [ 1581.975830][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1581.981713][ C0] RIP: 0033:0x7f531a59c6e7 [ 1581.986113][ C0] RSP: 002b:00007ffc0eb71108 EFLAGS: 00000206 ORIG_RAX: 0000000000000005 [ 1581.994499][ C0] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f531a59c6e7 [ 1582.002443][ C0] RDX: 0000000000000000 RSI: 00007ffc0eb71110 RDI: 0000000000000005 [ 1582.010396][ C0] RBP: 00007ffc0eb72370 R08: 00007ffc0eb73370 R09: 00000000ffffffff [ 1582.018340][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffc0eb72370 [ 1582.026292][ C0] R13: 00007f531a634474 R14: 00000000001672fd R15: 00007ffc0eb73440 [ 1582.034339][ C0] [ 1582.037348][ C0] rcu: rcu_preempt kthread starved for 1052 jiffies! g259437 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 1582.048534][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1582.058482][ C0] rcu: RCU grace-period kthread stack dump: [ 1582.064352][ C0] task:rcu_preempt state:R running task stack:27592 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1582.077800][ C0] Call Trace: [ 1582.081052][ C0] [ 1582.083969][ C0] __schedule+0x125c/0x6730 [ 1582.088470][ C0] ? __pfx___schedule+0x10/0x10 [ 1582.093292][ C0] ? find_held_lock+0x2b/0x80 [ 1582.097944][ C0] ? schedule+0x225/0x2c0 [ 1582.102263][ C0] schedule+0xdd/0x2c0 [ 1582.106309][ C0] schedule_timeout+0x127/0x280 [ 1582.111143][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1582.116500][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1582.121792][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1582.127613][ C0] ? prepare_to_swait_event+0xdf/0x4a0 [ 1582.133066][ C0] rcu_gp_fqs_loop+0x1a9/0x900 [ 1582.137820][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1582.143095][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 1582.148009][ C0] ? rcu_is_watching+0x12/0xc0 [ 1582.152759][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1582.158575][ C0] rcu_gp_kthread+0x179/0x230 [ 1582.163254][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1582.168455][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1582.174260][ C0] ? __kthread_parkme+0x18c/0x230 [ 1582.179289][ C0] ? kthread+0x13a/0x450 [ 1582.183514][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1582.188683][ C0] kthread+0x370/0x450 [ 1582.192733][ C0] ? __pfx_kthread+0x10/0x10 [ 1582.197294][ C0] ret_from_fork+0x72b/0xd50 [ 1582.201859][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1582.206943][ C0] ? __switch_to+0x800/0x10f0 [ 1582.211590][ C0] ? __pfx_kthread+0x10/0x10 [ 1582.216160][ C0] ret_from_fork_asm+0x1a/0x30 [ 1582.220905][ C0] [ 1582.223896][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 1582.230196][ C0] CPU: 0 UID: 0 PID: 3213 Comm: kworker/R-bat_e Tainted: G L syzkaller #0 PREEMPT(full) [ 1582.241444][ C0] Tainted: [L]=SOFTLOCKUP [ 1582.245738][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1582.255777][ C0] Workqueue: bat_events batadv_dat_purge [ 1582.261388][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 1582.267781][ C0] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 f6 e0 29 f6 48 89 df e8 7e 30 2a f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 05 3e 19 f6 65 8b 05 4e 27 a7 08 85 c0 74 16 5b [ 1582.287370][ C0] RSP: 0018:ffffc90000007c68 EFLAGS: 00000246 [ 1582.293416][ C0] RAX: 0000000000000006 RBX: ffff88802aa9c000 RCX: 0000000000000004 [ 1582.301372][ C0] RDX: 0000000000000000 RSI: ffffffff8e1a6eb5 RDI: ffffffff8c3ffa80 [ 1582.309411][ C0] RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000000 [ 1582.317352][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88814ec04010 [ 1582.325291][ C0] R13: ffff88814ec04008 R14: ffff88802ad294a3 R15: ffff88802ad29410 [ 1582.333241][ C0] FS: 0000000000000000(0000) GS:ffff888123ded000(0000) knlGS:0000000000000000 [ 1582.342141][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1582.348695][ C0] CR2: 00007f3098400020 CR3: 000000007251d000 CR4: 00000000003526f0 [ 1582.356655][ C0] DR0: 0000000000010000 DR1: 00000000000001f8 DR2: 0000000000000002 [ 1582.364598][ C0] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1582.372538][ C0] Call Trace: [ 1582.375790][ C0] [ 1582.378619][ C0] dummy_timer+0x1d91/0x36f0 [ 1582.383199][ C0] ? find_held_lock+0x2b/0x80 [ 1582.387849][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 1582.393467][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 1582.399082][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1582.404860][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 1582.410466][ C0] ? __pfx_debug_object_deactivate+0x10/0x10 [ 1582.416417][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 1582.421326][ C0] ? mark_held_locks+0x40/0x70 [ 1582.426061][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1582.431840][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 1582.436761][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 1582.441947][ C0] hrtimer_run_softirq+0x17d/0x2c0 [ 1582.447040][ C0] handle_softirqs+0x1ea/0x9b0 [ 1582.451777][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 1582.458007][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 1582.463276][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 1582.468885][ C0] ? __batadv_dat_purge.part.0+0x294/0x3c0 [ 1582.474677][ C0] ? __pfx_batadv_dat_to_purge+0x10/0x10 [ 1582.480311][ C0] do_softirq+0xac/0xe0 [ 1582.484466][ C0] [ 1582.487373][ C0] [ 1582.490276][ C0] __local_bh_enable_ip+0xf8/0x120 [ 1582.495371][ C0] __batadv_dat_purge.part.0+0x294/0x3c0 [ 1582.500990][ C0] batadv_dat_purge+0x4b/0xa0 [ 1582.505648][ C0] process_one_work+0xa23/0x1940 [ 1582.510574][ C0] ? __pfx_process_one_work+0x10/0x10 [ 1582.515929][ C0] ? __pfx_batadv_dat_purge+0x10/0x10 [ 1582.521273][ C0] rescuer_thread+0x905/0x14a0 [ 1582.526010][ C0] ? rescuer_thread+0x240/0x14a0 [ 1582.530918][ C0] ? rescuer_thread+0x118/0x14a0 [ 1582.535833][ C0] ? __pfx_rescuer_thread+0x10/0x10 [ 1582.541009][ C0] ? __kthread_parkme+0x18c/0x230 [ 1582.546008][ C0] ? kthread+0x13a/0x450 [ 1582.550233][ C0] ? __pfx_rescuer_thread+0x10/0x10 [ 1582.555399][ C0] kthread+0x370/0x450 [ 1582.559446][ C0] ? __pfx_kthread+0x10/0x10 [ 1582.564014][ C0] ret_from_fork+0x72b/0xd50 [ 1582.568588][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1582.573679][ C0] ? __switch_to+0x800/0x10f0 [ 1582.578349][ C0] ? __pfx_kthread+0x10/0x10 [ 1582.582927][ C0] ret_from_fork_asm+0x1a/0x30 [ 1582.587706][ C0]