last executing test programs: 23m31.98144678s ago: executing program 4 (id=202): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ptrace$getsig(0x4202, 0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0xdb6d4b04508a3c99) accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x1c) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) epoll_create1(0x80000) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xf}, 0x15, 0x3, 'dh\x00', 0x1, 0x6, 0x3d}, 0x2c) r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 23m31.808165066s ago: executing program 4 (id=203): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000100)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c643c, &(0x7f0000000300)={0x0, 0x300, r3}) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000013"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000780)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) recvmsg$unix(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001780)=""/4063, 0xfdf}], 0x1, 0x0, 0x0, 0x406}, 0x40020000) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0xfffe}], 0x1}, 0x0) 23m31.251402885s ago: executing program 4 (id=205): bind$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000280)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000002c0)=0x18) prlimit64(r0, 0xe, &(0x7f00000003c0)={0x2, 0x44000000007}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x0, 0x0, 0x0, 0x8, 0x1}]}}, 0x0, 0x26, 0x0, 0x1}, 0x28) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_dev$dri(&(0x7f0000000440), 0x8000000000000000, 0x585000) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) fstat(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r5, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r5, 0x26, &(0x7f0000000080)={0x1, 0x0, 0x2007, 0x1fd}) fcntl$lock(r5, 0x7, &(0x7f0000000280)={0x1, 0x0, 0x2c, 0x9}) fcntl$lock(r5, 0x7, &(0x7f0000000140)={0x0, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f0000000540)=0x3) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f0000000500)={0x400, 0x5, {r3}, {r4}, 0x6, 0x80000001}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x109000, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000240)={0x3, 0xef, 0x8001, 0x0, 0x5}, 0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000300)={'ip6_vti0\x00', &(0x7f00000000c0)={'ip6gre0\x00', 0x0, 0x29, 0x4, 0x2, 0x7fffffff, 0x80, @empty, @mcast2, 0x10, 0x700, 0x1, 0x401}}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYBLOB="020000000400000004000000"], 0x50) pwrite64(r7, 0x0, 0x0, 0x4) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r9 = dup(r8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000b, 0x13, r9, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) 23m27.23759861s ago: executing program 4 (id=220): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b", 0x63}, {&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb5198643d", 0x68}, {&(0x7f00000000c0)}], 0x3}}], 0x1, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x30, r2, 0x5, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x14, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_NOLEARN={0x5}, @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL={0x6, 0x12, 0x3}]}]}, 0x30}}, 0x20044880) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r5 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f0000000340)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@GTPA_FAMILY={0x5, 0xd, 0x2b}, @GTPA_FLOW={0x6, 0x6, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000880}, 0x20008000) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 23m27.071057045s ago: executing program 4 (id=221): arch_prctl$ARCH_GET_FS(0x1003, &(0x7f00000001c0)) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) sendmsg$nl_route_sched(r3, 0x0, 0x0) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r4, 0x2285, 0x0) fcntl$dupfd(r4, 0x0, r4) r5 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, 0x0) read$FUSE(r5, &(0x7f0000004140)={0x2020}, 0x2020) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x42, 0x0) process_vm_readv(r0, &(0x7f0000003300)=[{&(0x7f0000002140)=""/4096, 0x1000}, {&(0x7f0000003140)=""/141, 0x8d}, {&(0x7f0000003200)=""/243, 0xf3}], 0x3, &(0x7f000000a680)=[{&(0x7f00000033c0)=""/53, 0x35}, {&(0x7f0000003400)=""/101, 0x65}, {&(0x7f0000003480)=""/115, 0x73}, {&(0x7f0000006180)=""/4096, 0x1000}, {&(0x7f0000007180)=""/87, 0x57}, {&(0x7f00000003c0)=""/62, 0x3e}, {&(0x7f00000095c0)=""/4096, 0x1000}, {&(0x7f000000a5c0)=""/84, 0x54}, {&(0x7f000000a640)=""/5, 0x5}], 0x9, 0x0) 23m27.017651405s ago: executing program 0 (id=222): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000340)={r0, &(0x7f00000001c0)=')\x00', 0x0, 0x0, 0x6, &(0x7f0000000280)={@_ha_fsid}, 0x0}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_INTERRUPT(r4, 0x4004ae86, &(0x7f0000000240)=0x4) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) close(0x3) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000001"], 0x6c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r5) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) 23m25.660571617s ago: executing program 4 (id=223): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000e, 0x204031, 0xffffffffffffffff, 0xd0c6f000) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r1 = memfd_create(&(0x7f0000000240)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\xdc\xe2\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xce\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x8000, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfff7fff7}], 0x1c) listen(r2, 0xfffff789) r3 = accept(r2, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0xffff, 0x992f}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x9, 0x8, 0x0, 0x0, 0xd0, 0x6, 0x2}, 0x9c) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) write$UHID_INPUT(r4, &(0x7f0000001040)={0x9, {"a2e3ad21ed0d09f90e3d090987f70e06d038e7ff7fc6e5539b0d5b0e8b099b3f36006e090890e0878f0e1ac6e7f89b334d959b4a9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0a6193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000400000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617679314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec230911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918c91243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac5a4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4b333bd5bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3be3b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ce0700c7e658828163e2d25c4aa348561f927eff7f3aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f05004b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d486046b2c0e2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee6157eb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de225727aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d78749a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29c60acebdbe8ddbd75c2f998d8a57f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95ff80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8870b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513007000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae8489d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60299473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d946a2daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810300000000000000a12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf000000800000000007b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae0e797e8bd1f4108b7807fb36207685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ad50dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b9048017848416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1db44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b00f1000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de9c0587c2cb5fe36d7d3e5db21b013b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cf4b23329072e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06810002000000000000957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f3e90d5943dbc10360a1a49700d1dfbf66d69f6fbafe1e83cdde8bb0d872a02238926407a4eddd5d0fc5a752f900000000000000100", 0x35e}}, 0x1006) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x1000, 0x1000, 0x7ffe, 0x0, 0x2a, 0x4, 0xfc}, 0x9c) mmap(&(0x7f000008a000/0x3000)=nil, 0x3000, 0x2000006, 0x11, r1, 0x2772d000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'vxcan1\x00', 0x0}) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000440)={0x4, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x7, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=r6, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x12, 0xc, &(0x7f0000000100)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xb5b7}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffff5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0xdf10a23e268c8b09}}, @generic={0x37, 0xd, 0x9, 0xfffa, 0x9}], &(0x7f0000000180)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x5d, '\x00', r5, @fallback=0x1, r0, 0x8, &(0x7f0000000200)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000340)={0x3, 0x8, 0x7, 0xd96c}, 0x10, r6, r0, 0x7, &(0x7f0000000380)=[r0], &(0x7f00000003c0)=[{0x4, 0x4, 0x10, 0xa}, {0x5, 0x1, 0x6, 0x9}, {0x0, 0x2, 0xc, 0x9}, {0x1, 0x4, 0xd, 0x8}, {0x1, 0x4, 0xd, 0x7}, {0x3, 0x3, 0x0, 0x7}, {0x5, 0x5, 0x6, 0x6}], 0x10, 0x7}, 0x94) read$FUSE(r0, &(0x7f0000005840)={0x2020}, 0x2020) r7 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$nbd(r7, &(0x7f0000000080)=ANY=[@ANYBLOB="0100040000000000000000000000200082b0cfc4337965941538be020000000000ef663c00000000007400a391793ba7f40000000000fdf70000000d00000000000000"], 0x40) 22m44.441110075s ago: executing program 32 (id=222): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000340)={r0, &(0x7f00000001c0)=')\x00', 0x0, 0x0, 0x6, &(0x7f0000000280)={@_ha_fsid}, 0x0}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_INTERRUPT(r4, 0x4004ae86, &(0x7f0000000240)=0x4) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) close(0x3) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000001"], 0x6c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r5) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) 22m44.305866969s ago: executing program 33 (id=219): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000064010100000000000000000000000000fc01000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000800000000000003000000000000000000000000000000fdfffffffbffffff0000000000000000ffffffffffffffff053b000000000000000000000000000002000000000000005600000000000000feffffffff7f400002000000000000080000000000000000010005000000000044000500ac141426000000000000000000000000000004d53c"], 0xfc}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002ec0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e01f3440cee51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cad32b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337602d3e5a815232f5e16c1b30c3a6abc85018e5ff2c91018afc9ffc2cc788bee1b47683db012469398685211dfbbae3e2ed0a50e7393bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d300006aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7af22e30d46a9d26d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977fb536a9caab37d9ac4cfc1c7b400000000000007ffc826b956ba859ac8e3c177b91bd7d5e41ff83ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d000069a16203a967c1bbe09315c29877a308bcc87dc3addb08142bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8240000e3428d2129369ee1b85af9ffffff0d0df414b315f651c8412392191fa83ee830548f11be359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92000000000f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb74d4ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905de328c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a978ee56c83a3466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342e0eaf6f330e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea95ec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf81700cd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be3827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f969369de47422604e2fc5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293b6c833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b612272d40f522d8c98c879aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbe71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd46dbd61627a2e0a74b5e6aefb7eee403502734137ff47a57f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a125e3af1130d66a7b66837ae7e7123dde7404a067ad0a6a2d6bec9411b61cad4121be3c72ff3a04713042253d438e7becf8120de3895b8ce974958bde39cb8da3427a2e9e2de936431e67fed5ab5684db07de39083d8948cc4c8a2608100000000000000000000aecb8b0b7941088f971ce17427eec32a012295cc0cdd32955176b6ad5a4bb953e58ccfa9428f452cfb5a48a9fda26db3985c8be3c2f99827da074825b01c4a3a71fb59d5798100000000000000c76b05a45d2dd8c20d971e2f3e4369168f5cb83d6ff3a18733fec726034fbfa95624135bee374414b2c8c61f52357a520efd6a10aff244bc8a62ed367981fb4d5d77f7bc093958ff46527499957da4934cd4b370cf76f72dd05fa80cdfb68c836fd81be7a58532e041a87f9222f157610a4bcdc05b2a55308c8e7568b90f7a338557e816a16972aea79dff5becefa6f9c5ce6c58fb38da9e7532dc53cfdc2e789b76f7d32aca1bfea2aa62621b78dded30fc07171866bf3d552900000000a32dda61eeda1750e157c2d569b9d08f583c0ee28daec2e8bb85f3c8e91c4448096ee953def18dc73e55cb30f9cd069d8780b00eaba382f0c3ae391c30a5f1b0f36dd0c2193b791995d2890327a10d7abac76d1202f72e97f0105184d7aaaab8d3e29c9a8d263f076b55cf53c5bb9c0662a3d19a6722d7f83ae4331d3256f90af0857788b380ccc3b266c418e66d1d756d5df6423dd0cea67bc235d3776d22270fc19301ead09f156893e9"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@dev={0xfe, 0x80, '\x00', 0xa}, 0x40000, 0x0, 0x1, 0x4, 0x4, 0xf}, &(0x7f0000000040)=0x20) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xfe, 0x0, &(0x7f0000000100)="b9ff03316844268cb89e1413080047e0ffff00124000632f77fbac14fe16e000030a07080403fe80000020006558845013f2325f1a3901050b038da1880b88481aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0x8024, 0x60000000, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}, 0x2a) 22m44.222744614s ago: executing program 34 (id=224): lsm_get_self_attr(0x0, 0x0, 0x0, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x80000000001) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0xffffffbf) timer_settime(0x0, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="020300030c00000000070000fedbdf250200090040000000000000000000000002000100000000000000050200000000030005000000000002000100ac1414000000000000000000030006000000000002"], 0x60}, 0x1, 0x7}, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000040)={0xf0f023}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="000000000cb384"], 0x14}, 0x1, 0x0, 0x0, 0x4000004}, 0x40000) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r5 = socket$kcm(0x2, 0x0, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) r6 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r6, &(0x7f0000000100)={0x18, 0x0, {0x4, @local, 'ip_vti0\x00'}}, 0x1e) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_tcp_SIOCOUTQ(r7, 0x5411, &(0x7f0000000000)) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) mount$overlay(0x0, &(0x7f0000000580)='.\x00', &(0x7f0000000000), 0x41890, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x5c}, {@redirect_dir_follow}]}) 22m44.125849764s ago: executing program 35 (id=217): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xb, &(0x7f0000000380)={0x9, 0x100008b}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@local}) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x149182) openat$vhost_vsock(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$radio(&(0x7f0000000100), 0x2, 0x2) syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) getsockopt$bt_BT_CHANNEL_POLICY(r2, 0x112, 0xa, 0x0, &(0x7f0000000500)) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x1000000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0x3, 0x80000006}, 0x0, 0x0) 22m44.020425524s ago: executing program 36 (id=223): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000e, 0x204031, 0xffffffffffffffff, 0xd0c6f000) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r1 = memfd_create(&(0x7f0000000240)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\xdc\xe2\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xce\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x8000, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfff7fff7}], 0x1c) listen(r2, 0xfffff789) r3 = accept(r2, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0xffff, 0x992f}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x9, 0x8, 0x0, 0x0, 0xd0, 0x6, 0x2}, 0x9c) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) write$UHID_INPUT(r4, &(0x7f0000001040)={0x9, {"a2e3ad21ed0d09f90e3d090987f70e06d038e7ff7fc6e5539b0d5b0e8b099b3f36006e090890e0878f0e1ac6e7f89b334d959b4a9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0a6193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000400000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617679314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec230911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918c91243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac5a4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4b333bd5bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3be3b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ce0700c7e658828163e2d25c4aa348561f927eff7f3aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f05004b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d486046b2c0e2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee6157eb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de225727aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d78749a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29c60acebdbe8ddbd75c2f998d8a57f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95ff80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8870b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513007000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae8489d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60299473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d946a2daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810300000000000000a12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf000000800000000007b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae0e797e8bd1f4108b7807fb36207685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ad50dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b9048017848416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1db44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b00f1000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de9c0587c2cb5fe36d7d3e5db21b013b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cf4b23329072e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06810002000000000000957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f3e90d5943dbc10360a1a49700d1dfbf66d69f6fbafe1e83cdde8bb0d872a02238926407a4eddd5d0fc5a752f900000000000000100", 0x35e}}, 0x1006) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x1000, 0x1000, 0x7ffe, 0x0, 0x2a, 0x4, 0xfc}, 0x9c) mmap(&(0x7f000008a000/0x3000)=nil, 0x3000, 0x2000006, 0x11, r1, 0x2772d000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'vxcan1\x00', 0x0}) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000440)={0x4, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x7, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=r6, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x12, 0xc, &(0x7f0000000100)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xb5b7}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffff5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0xdf10a23e268c8b09}}, @generic={0x37, 0xd, 0x9, 0xfffa, 0x9}], &(0x7f0000000180)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x5d, '\x00', r5, @fallback=0x1, r0, 0x8, &(0x7f0000000200)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000340)={0x3, 0x8, 0x7, 0xd96c}, 0x10, r6, r0, 0x7, &(0x7f0000000380)=[r0], &(0x7f00000003c0)=[{0x4, 0x4, 0x10, 0xa}, {0x5, 0x1, 0x6, 0x9}, {0x0, 0x2, 0xc, 0x9}, {0x1, 0x4, 0xd, 0x8}, {0x1, 0x4, 0xd, 0x7}, {0x3, 0x3, 0x0, 0x7}, {0x5, 0x5, 0x6, 0x6}], 0x10, 0x7}, 0x94) read$FUSE(r0, &(0x7f0000005840)={0x2020}, 0x2020) r7 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$nbd(r7, &(0x7f0000000080)=ANY=[@ANYBLOB="0100040000000000000000000000200082b0cfc4337965941538be020000000000ef663c00000000007400a391793ba7f40000000000fdf70000000d00000000000000"], 0x40) 13m7.289486695s ago: executing program 8 (id=2059): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000380)={0x353, 0x78, 0x31f, 0x0, 0xa, 0x400, 0x0, 0x0, {}, {}, {0x0, 0x0, 0xfffffffc}, {0x0, 0x400000, 0xfffffffd}, 0x0, 0x0, 0x0, 0x1, 0x1, 0x4, 0x9f6, 0x3, 0x1ff, 0x803d, 0x1, 0x7, 0x5f, 0x202, 0x1, 0xc}) 13m7.156821369s ago: executing program 8 (id=2060): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b", 0x63}, {&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe08", 0x5b}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556e", 0x96}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282", 0x28}, {&(0x7f00000000c0)}], 0x5}}], 0x1, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'veth1_to_bond\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={&(0x7f00000001c0)="5eae7d3b271f9e081891c11a32b252c098cb29684081e4629da0f1c7f163853d280da926c66c9fb800917b87c1e38a1dac7bea10983b0e45d74f236b1f984e", &(0x7f0000000400)}}, &(0x7f0000000000)) r1 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) add_key(0x0, &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="c80cb6dc71bbb6e6fe7389565b0fe703b37fdce8173e60d636428eb484f585a7d271efae1ae456f0eae7563e33", 0x2d, r1) socket$nl_netfilter(0x10, 0x3, 0xc) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x0}, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f00000000c0), &(0x7f0000000200)=0x4) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) r4 = gettid() setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0xfffffe0b) ioprio_set$pid(0x1, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/diskstats\x00', 0x0, 0x0) syz_open_procfs(r4, &(0x7f0000000240)='net/ipv6_route\x00') readv(r5, &(0x7f00000038c0)=[{&(0x7f0000004980)=""/4096, 0x1000}], 0x1) 13m5.415109153s ago: executing program 8 (id=2064): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) ioctl$HIDIOCGFEATURE(r1, 0xc0404807, &(0x7f0000000940)={0x3, "95bc9233a0ffadb335984bb3280b7840ca36304441bfb8b79ebdfe0534843f462a2e51c23b47519839c74c89785759d861f0cbab603459d543d8937b4693682b"}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 13m1.961754593s ago: executing program 8 (id=2076): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x3a09007, 0x0) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)='./file0/file0\x00') r0 = socket(0x23, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r1, &(0x7f0000005a80)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x5, &(0x7f0000000000)=0x7, 0x4) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$inet6(0xa, 0x80001, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, 0x0, 0x310) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000640)={@cgroup, 0x24, 0x0, 0xffff, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)=@deltaction={0x194, 0x31, 0x702, 0x70bd2a, 0x25dfdbfc, {}, [@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}, @TCA_ACT_TAB={0x40, 0x1, [{0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x82e}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}, @TCA_ACT_TAB={0x6c, 0x1, [{0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xb}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}, @TCA_ACT_TAB={0x54, 0x1, [{0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2862d3ff}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffff}}]}, @TCA_ACT_TAB={0x50, 0x1, [{0x10, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x10, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0x14, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}, @TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x840}, 0x40054) r6 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_type(r6, &(0x7f0000000300), 0x9) 13m0.507467864s ago: executing program 8 (id=2080): r0 = syz_open_dev$video4linux(&(0x7f0000000540), 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, 0x0, &(0x7f0000000340)) chdir(0x0) (async) syz_usb_connect(0x2, 0x24, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.current\x00', 0x275a, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) fallocate(r2, 0x0, 0xfea000, 0x2000402) (async) lseek(r2, 0x1, 0x3) (async) creat(&(0x7f0000000280)='./file1\x00', 0xb2) open_by_handle_at(r0, 0x0, 0x5f7543) (async) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x8008af26, &(0x7f0000000240)) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, 0x0, 0x20008000) (async) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000140)={@host}) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f00000001c0)={{@host}, @hyper, 0x0, 0x6, 0x244c, 0x8, 0x101, 0x6, 0x800}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x400, 0x0) (async) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SSUBSCRIP(r7, 0x89e1, &(0x7f0000000540)={'ip_vti0\x00', 0x7, 0xe}) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0x1a) (async) ioctl$VIDIOC_SUBDEV_S_SELECTION(r0, 0xc040563e, &(0x7f0000000000)={0x0, 0x0, 0x103, 0x0, {0x9, 0x6d, 0x4bd, 0x8}}) 12m59.101543947s ago: executing program 8 (id=2086): prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}], 0x1}, 0x0) rmdir(&(0x7f0000000240)='./file0\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f00000000c0)={0x81, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x6, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) r0 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r0, &(0x7f000001aa40)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000001000030429"], 0x20}, 0x1, 0x0, 0x0, 0x4802}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x8, 0xffffffffd24b2432, 0x83, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x8001}}, 0x50) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010025bd7000fcdbdf2503000000180001801400020073797a5f74756e00000000000000000005000200000000000500050003000000050003"], 0x44}, 0x1, 0x0, 0x0, 0x20009085}, 0x40040c4) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc00080005000900000014000400"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e00000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000f00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) 12m58.795135378s ago: executing program 37 (id=2086): prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}], 0x1}, 0x0) rmdir(&(0x7f0000000240)='./file0\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f00000000c0)={0x81, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x6, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) r0 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r0, &(0x7f000001aa40)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000001000030429"], 0x20}, 0x1, 0x0, 0x0, 0x4802}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x8, 0xffffffffd24b2432, 0x83, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x8001}}, 0x50) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010025bd7000fcdbdf2503000000180001801400020073797a5f74756e00000000000000000005000200000000000500050003000000050003"], 0x44}, 0x1, 0x0, 0x0, 0x20009085}, 0x40040c4) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc00080005000900000014000400"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e00000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000f00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) 12m44.738708458s ago: executing program 0 (id=2087): r0 = socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000047000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a876d839240d29c035055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7e8dc34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bb44b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334583239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bf4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc508afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd360000000000000000ae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c97a088a22e8b15c3e233db00002e30d46a0024d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c29c5c0ed5bcdf510c3c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ced92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f68fa8d7c2dfb28e1f05e46b0933c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d588afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda6900002a070886df42b27098773b45198b4a34ac97febd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d63521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07afef12ef060cd4403a099f32468f658000b4082d43e12186195cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea209b53b230ef0f2ab85cbdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bd3339403004b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab900000000000000000000d71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdbf24a0c5441ce046078492b53467cfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89cb349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb15f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c00c57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137df47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b558982016b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8b49e3d0168bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85a3009a5d30f479e293a3302e11350ea857b37e76ca3f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c8ffe0d508dcee3070e8b42ac38545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f98117919472b61b20026d7e646174b55d251f7f8ca5ccc22a5efb33b217eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4444e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24000000000000000000000000000000000000cd3211b3842b68a4eddca2eae28529e97a98d7ec3fd902df1ba8fc2ad2377e72d4e7aeacbbccef5614cd965511558f40720025c022bc9c213e407f6bc4b673c55aa8e729299a37fd6339acd906ac861ba56c9fa9b8b12b5e68a3cdadb906355e1f1d336a243172affe50d0fb36c3718a7498eed3d398f405a34d494414e87ef1ce1845510d43d00171d6b4b762f89564c22d542a119878709cd6822c3a3eb47a849b0737929fe9e1eecd1bff5a2b9880e2a6d8a3b3b7e88a673c96cda4455eff1c530db0e6598a2686aa09aeaf0f1aed95aeb8b0a2cc5ca31c0f56285cc05f7090a0e0583cf540d18cd8817e685c7b4ff176178ac1234f23e54445ec20b2689832d78409897a0307e89ebcd5f4ba042a3d10237a5a8a9a6eda36d2f337dc54537b80e8433341b135b4c5bb0173ffde46ccd260e1d4f2c51e8b07bb256f1317912cb1fc9e491e0bb9109e475cc795c23ad9f4f0042c5e9c655a4d865bc4a266e6a1d3d2b7ee53be9efb33a98933b5ba74ee3ac8d34b6af8c1fdbffade3abc80842b74354162f5b994ab5254cb068bc5e2ae242a1d37d0d49947c9317fa1a46c9e259ce0e1f9db992c53f7830a5e8f4fac6b187eb9f15ba61f730f86d7d7b63bbc7a1d9ff37e87a90a14e0655304da069f9009b62717649b6c6af94fcba713f8ee6fcce25aef44d009966614b61be9369ffc589a79051b0a0000000000000003ebd34c41afe268c33c9322c3a783772aec998f51a6e70fb932a8019e72ef5ab127bb30c79ebfd867441083546305fb39449c40a166ea389a6b77b7c87f66e8bf5806726b8fc50b943627314803a12c33312dce0a10f852da3e000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x7}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r1, 0x18000000000002a0, 0x15, 0x0, &(0x7f00000011c0)="b9ffddc1ddc8cdde75537d07007e0d0000bf2dfe44", 0x0, 0x600, 0x60000009, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) r2 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000001480), 0x2, 0x0) r3 = msgget$private(0x0, 0x260) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) connect$bt_sco(r4, &(0x7f0000000440)={0x1f, @none}, 0x8) msgsnd(r3, 0xffffffffffffffff, 0x0, 0x0) write$6lowpan_control(r2, &(0x7f0000000040)='connect aa:aa:aa:aa:aa:10 1', 0x1b) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', 0x0, 0x2f, 0xfe, 0x2, 0x3, 0x0, @private0, @private1, 0x10, 0x8, 0xfb4, 0x101}}) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x20, &(0x7f0000001200)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x60, '\x00', r5, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ffe}, 0x94) r7 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x28c040, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) syz_usb_connect(0x0, 0x10b, &(0x7f0000000000)=ANY=[@ANYBLOB="05010900b24b6a10e6040300770100000001090224000b010000000904000302ccd4280009050b02000000040009058a02"], 0x0) mount$cgroup2(0x0, 0x0, 0x0, 0x2201008, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYRES16=0x0], 0x3c) ioctl$VIDIOC_S_CROP(0xffffffffffffffff, 0x4014563c, &(0x7f0000001400)={0xc, {0x8, 0x8, 0x532a7bce, 0x8001}}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) bind$packet(r4, &(0x7f00000013c0)={0x11, 0x11, r8, 0x1, 0x3, 0x6, @random="a23d2f1fecee"}, 0x14) r10 = bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001200)=ANY=[@ANYRESDEC=r10, @ANYRES32=r7, @ANYRES16=r0, @ANYRESDEC=r9, @ANYRES32, @ANYBLOB="05000000020000000500"/28], 0x50) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000)=r6, 0x4) unshare(0xa000400) shmget(0x1, 0xffffffffff000, 0x200, &(0x7f0000ffb000/0x3000)=nil) r11 = memfd_create(&(0x7f0000000480)='\x85/,\x00', 0x6) pread64(r11, 0x0, 0x0, 0x9) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/uts\x00') sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000001100)=[{&(0x7f00000012c0)="2e0000002400810804fb7fec598f866b0a9a5972130000005e140608000000007a0000a71802dd0fbcf233a5af5899c2998a0c4c0995948a9641dd3d4af4a748220ae99bbd0be189cf04ba560861c667010f41941f0f5c8dfed3c872c89196e9ad9c8dc21d9aa8d2f90ec7d2a440aed5aaeb916e414200fff69fe0aa29aa660d2c4bdcc1e8dbf5708997e546c0803f4ea6f3e41d9b42a9400f39677c0a76043e578a6f357a3f85f0c1054426278d6ab3054f140fb9916eed41707114b54eb6d4dee49455df9390eee52853f61eae831008b416ab5b34139f79c15d605f9891", 0xdf}, {&(0x7f0000001440)="f6e14ed5009418", 0x7}], 0x2}, 0x0) 12m42.130515428s ago: executing program 0 (id=2131): socket$nl_netfilter(0x10, 0x3, 0xc) recvmsg$unix(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000001040)}, 0x100) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3e, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe4000/0x18000)=nil, 0x0, 0x0, 0x43, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) setsockopt$inet6_tcp_int(r2, 0x6, 0x18, &(0x7f0000000240)=0xe, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x100008d}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) 12m41.270995068s ago: executing program 0 (id=2133): ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x101343) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) getpid() ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) sched_setaffinity(0x0, 0x49, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x106, 0x5}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) writev(r1, &(0x7f0000000040), 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x35c, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, 0x0, &(0x7f00000001c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x3}, 0x10}, 0x94) 12m40.898781127s ago: executing program 0 (id=2136): ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) readlink(&(0x7f0000000200)='./file1\x00', &(0x7f00000003c0)=""/33, 0x21) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x16, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000040)='GPL\x00'}, 0x94) r3 = epoll_create1(0x0) r4 = fcntl$dupfd(r3, 0x2, 0xffffffffffffffff) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000400)={@cgroup=r4, r2, 0x13, 0x38, r4}, 0x20) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000040)='GPL\x00'}, 0x80) r6 = epoll_create1(0x0) r7 = fcntl$dupfd(r6, 0x2, 0xffffffffffffffff) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000240)={@cgroup=r0, r5, 0x11, 0x0, r7}, 0x20) fsmount(0xffffffffffffffff, 0x0, 0x8) r8 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r8, 0xc004500a, &(0x7f0000001340)) r9 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)=',..:\x00', 0x0) 12m39.164020925s ago: executing program 0 (id=2139): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@bloom_filter={0x1e, 0x2, 0xd69, 0x40, 0x1008, 0x1, 0x7fffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x1, 0xe}, 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000001c0)={r1, &(0x7f0000000100)="5b21c5138f3409adc99c73c143e6afdff5b21a016c19def89bd20fa01f98", &(0x7f0000000140)=""/91, 0x4}, 0x20) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xd, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xff000000}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x6, 0x0, 0xb}, {0x65}}, [@printk={@lld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xc, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xa8b8}, {0x4}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x19, &(0x7f0000000000)=0x94b, 0x4) syz_emit_ethernet(0x6e, &(0x7f0000000440)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb8000", 0x38, 0x3a, 0xff, @private1, @mcast2, {[], @time_exceed={0x4, 0x1, 0x0, 0x9, '\x00', {0x0, 0x6, "f99063", 0x800, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @ipv4={'\x00', '\xff\xff', @local}, [], "af34000000000000"}}}}}}}, 0x0) recvmmsg(r4, &(0x7f0000001740)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x2000, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r3, 0x0) r5 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f00000ee000/0xc00000)=nil, 0xc00000, 0x1000002, 0x11012, r5, 0x10c000) syz_usb_control_io$hid(r0, 0x0, 0x0) r6 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_CONTEXT(r6, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x3}, 0x8) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f0000000140)={0x14, &(0x7f0000000000)={0x20, 0x9, 0x77, {0x77, 0xa, "3e25bf163e639a6d60908a65f41939cc812bf2b60ec5657c4316dcb0e73b7d4fc2fa16411c22a08025312fa44e955fd585041ec16e536e8215b4186ef32a52387285ba377506ca3c0f73d175ebe76e3838d38fbb7d33098c9ea0a9e69737c194ada05801dd759d9f94756c5115a579582bf336d75f"}}, &(0x7f0000000080)={0x0, 0x3, 0x29, @string={0x29, 0x3, "c7a499afcdd9b150fb65d210c5bc4f234a8e17602e41b7afa2a4726da1ea1dac2536ef6d5718d8"}}}, &(0x7f0000000400)={0x34, &(0x7f0000000180)={0x20, 0x7, 0xf9, "77c9b5f5f09925ad3685cb52fb3ef65a1ada5b13d8804bf59274d3e337c41a5d6971470ada735af5d7ef7613780d84cd4c43fdc6c44813c3e6648903cd30c796d08d18c8a588221d691a1e2075b6c7bc15cefd5586fe09cbba58b2b49022ec288e4c36cf35e291b93d3ced03523cdfaea74ded435da033c64f8ce54a5222b72f0b324c96e167322ef09910ce82b098700f0c3d2eb6df016a9b4ceddcbe7bb61aa57332ec67b43190ba470152e9e2198f8ebe3dbe5c985bfb7a212820cfbfa20b69a95d6e973bc3951f95c76cf70da1e9f43c8183d9a79371b236af332c20d6ba8a5227bdfd09a766efa54043b9fa2355891e3c33c12fde035c"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0xc3}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x40}, &(0x7f0000000340)={0xc0, 0xa1, 0x4, 0x3}, &(0x7f0000000380)={0x40, 0xa0, 0x4, 0x9}, &(0x7f00000003c0)={0xc0, 0xa2, 0x2f, "9ecd4c136701449afc6b434c7933a477e8acc49da796b0fbde1922dd5924d463b62b6f4b9463a2bfc80a8cb9cbfb59"}}) r7 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) ioctl$HIDIOCGFEATURE(r7, 0xc0404807, &(0x7f0000000940)={0xd, "95bc9233a0ffadb335984bb3280b7840ca36304441bfb8b79ebdfe0534843f462a2e51c23b47519839c74c89785759d861f0cbab603459d543d8937b4693682b"}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 12m23.158757118s ago: executing program 38 (id=2139): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@bloom_filter={0x1e, 0x2, 0xd69, 0x40, 0x1008, 0x1, 0x7fffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x1, 0xe}, 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000001c0)={r1, &(0x7f0000000100)="5b21c5138f3409adc99c73c143e6afdff5b21a016c19def89bd20fa01f98", &(0x7f0000000140)=""/91, 0x4}, 0x20) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xd, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xff000000}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x6, 0x0, 0xb}, {0x65}}, [@printk={@lld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xc, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xa8b8}, {0x4}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x19, &(0x7f0000000000)=0x94b, 0x4) syz_emit_ethernet(0x6e, &(0x7f0000000440)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb8000", 0x38, 0x3a, 0xff, @private1, @mcast2, {[], @time_exceed={0x4, 0x1, 0x0, 0x9, '\x00', {0x0, 0x6, "f99063", 0x800, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @ipv4={'\x00', '\xff\xff', @local}, [], "af34000000000000"}}}}}}}, 0x0) recvmmsg(r4, &(0x7f0000001740)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x2000, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r3, 0x0) r5 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f00000ee000/0xc00000)=nil, 0xc00000, 0x1000002, 0x11012, r5, 0x10c000) syz_usb_control_io$hid(r0, 0x0, 0x0) r6 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_CONTEXT(r6, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x3}, 0x8) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f0000000140)={0x14, &(0x7f0000000000)={0x20, 0x9, 0x77, {0x77, 0xa, "3e25bf163e639a6d60908a65f41939cc812bf2b60ec5657c4316dcb0e73b7d4fc2fa16411c22a08025312fa44e955fd585041ec16e536e8215b4186ef32a52387285ba377506ca3c0f73d175ebe76e3838d38fbb7d33098c9ea0a9e69737c194ada05801dd759d9f94756c5115a579582bf336d75f"}}, &(0x7f0000000080)={0x0, 0x3, 0x29, @string={0x29, 0x3, "c7a499afcdd9b150fb65d210c5bc4f234a8e17602e41b7afa2a4726da1ea1dac2536ef6d5718d8"}}}, &(0x7f0000000400)={0x34, &(0x7f0000000180)={0x20, 0x7, 0xf9, "77c9b5f5f09925ad3685cb52fb3ef65a1ada5b13d8804bf59274d3e337c41a5d6971470ada735af5d7ef7613780d84cd4c43fdc6c44813c3e6648903cd30c796d08d18c8a588221d691a1e2075b6c7bc15cefd5586fe09cbba58b2b49022ec288e4c36cf35e291b93d3ced03523cdfaea74ded435da033c64f8ce54a5222b72f0b324c96e167322ef09910ce82b098700f0c3d2eb6df016a9b4ceddcbe7bb61aa57332ec67b43190ba470152e9e2198f8ebe3dbe5c985bfb7a212820cfbfa20b69a95d6e973bc3951f95c76cf70da1e9f43c8183d9a79371b236af332c20d6ba8a5227bdfd09a766efa54043b9fa2355891e3c33c12fde035c"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0xc3}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x40}, &(0x7f0000000340)={0xc0, 0xa1, 0x4, 0x3}, &(0x7f0000000380)={0x40, 0xa0, 0x4, 0x9}, &(0x7f00000003c0)={0xc0, 0xa2, 0x2f, "9ecd4c136701449afc6b434c7933a477e8acc49da796b0fbde1922dd5924d463b62b6f4b9463a2bfc80a8cb9cbfb59"}}) r7 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) ioctl$HIDIOCGFEATURE(r7, 0xc0404807, &(0x7f0000000940)={0xd, "95bc9233a0ffadb335984bb3280b7840ca36304441bfb8b79ebdfe0534843f462a2e51c23b47519839c74c89785759d861f0cbab603459d543d8937b4693682b"}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 7m28.676314913s ago: executing program 6 (id=2972): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_audit(0x10, 0x3, 0x9) fchown(r1, 0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0xfffe, 0x3000001, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='batadv0\x00', 0x10) write(r0, &(0x7f0000000000)="8fcefe00", 0x4) 7m28.447947566s ago: executing program 6 (id=2975): socket$inet6_udp(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000026000100000000000000000006"], 0x14}], 0x1}, 0x0) 7m28.296773277s ago: executing program 6 (id=2978): socket$inet6(0xa, 0x400000000001, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x95) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20008000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xb45fe000) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) symlinkat(0x0, 0xffffffffffffff9c, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) getsockopt$ARPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x0, [0xa1, 0x9, 0x8001]}, &(0x7f0000000180)=0x44) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00') read$FUSE(r3, &(0x7f00000000c0)={0x2020}, 0x2020) 7m16.406775574s ago: executing program 6 (id=3007): socket$inet6(0xa, 0x400000000001, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x95) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20008000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xb45fe000) syz_clone(0x2000, 0x0, 0xff36, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) symlinkat(0x0, 0xffffffffffffff9c, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) getsockopt$ARPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x0, [0xa1, 0x9, 0x8001]}, &(0x7f0000000180)=0x44) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00') read$FUSE(r2, &(0x7f00000000c0)={0x2020}, 0x2020) 7m2.148312188s ago: executing program 6 (id=3047): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r0 = syz_open_dev$video(&(0x7f0000000080), 0x8, 0x101000) ioctl$VIDIOC_G_AUDOUT(r0, 0x80345631, &(0x7f0000000100)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') close(0x3) syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$netlink(0x10, 0x3, 0x1) connect$netlink(r2, &(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x40}, 0xc) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='oom_adj\x00') writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000140)='1', 0x1}], 0x1) syz_open_procfs$userns(0x0, &(0x7f0000000080)) 6m56.430016394s ago: executing program 6 (id=3071): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0x6, 0x0, 0x0, 0x90, 0x0, 0x79, 0x10, 0xb8}, [@ldst={0x5}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) r0 = add_key$keyring(&(0x7f0000001600), &(0x7f0000001640)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000001540)='user\x00', &(0x7f0000001580)={'syz', 0x0}, &(0x7f00000015c0)='[:($]-@.*\x94&$(/^\x00', r0) add_key$user(&(0x7f0000001680), 0x0, &(0x7f0000001700)="dfbf724b37d8", 0x6, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000200)='sysfs\x00', 0x1214040, 0x0) syz_open_dev$ndb(&(0x7f0000000180), 0x0, 0x101000) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[], [], 0x2f}) io_uring_setup(0x7a76, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1b, 0x0, &(0x7f00000007c0)="e3ef7f670000ec6789b42415449400000000000000000000000400", 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}, 0x50) r2 = syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x88003) ioctl$FIBMAP(r2, 0x1, &(0x7f0000000040)=0x85) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4}, &(0x7f0000bbdffc)) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x50) close(r4) ioperm(0x5, 0x6, 0x1) 6m41.271532063s ago: executing program 39 (id=3071): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0x6, 0x0, 0x0, 0x90, 0x0, 0x79, 0x10, 0xb8}, [@ldst={0x5}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) r0 = add_key$keyring(&(0x7f0000001600), &(0x7f0000001640)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000001540)='user\x00', &(0x7f0000001580)={'syz', 0x0}, &(0x7f00000015c0)='[:($]-@.*\x94&$(/^\x00', r0) add_key$user(&(0x7f0000001680), 0x0, &(0x7f0000001700)="dfbf724b37d8", 0x6, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000200)='sysfs\x00', 0x1214040, 0x0) syz_open_dev$ndb(&(0x7f0000000180), 0x0, 0x101000) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[], [], 0x2f}) io_uring_setup(0x7a76, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1b, 0x0, &(0x7f00000007c0)="e3ef7f670000ec6789b42415449400000000000000000000000400", 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}, 0x50) r2 = syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x88003) ioctl$FIBMAP(r2, 0x1, &(0x7f0000000040)=0x85) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4}, &(0x7f0000bbdffc)) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x50) close(r4) ioperm(0x5, 0x6, 0x1) 2m38.113868377s ago: executing program 9 (id=3699): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000100)=0x13) write(r3, &(0x7f00000003c0)="af", 0x1) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000c00)=0x11) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x4, 0x3, 0x0, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x51}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@gettaction={0xc8, 0x32, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x58, 0x1, [{0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0x10, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x14, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x40, 0x1, [{0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0xffffffffffffff73, 0x3, 0xe}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4c}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xa}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x845}, 0x24008004) 2m37.783450469s ago: executing program 9 (id=3702): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x692000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f00000004c0)={0xfffffffffffffef4, 0x2, r1}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f00000002c0)={0x18, r1, 0x1, 0x0, &(0x7f0000000200)=[{0x1, 0x7ff}]}) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r0, 0xc038943b, &(0x7f0000000180)={0x5, 0x28, '\x00', 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) r4 = socket(0x40000000015, 0x5, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000540)=0x0) fcntl$lock(r2, 0x7, &(0x7f0000000300)={0x1, 0x4, 0x8000000000000000, 0x6}) timer_settime(r5, 0x1, &(0x7f0000000040), 0x0) r6 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$llc_int(r6, 0x10c, 0x5, &(0x7f0000000040)=0x3c00, 0x4) recvmmsg(r4, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}}], 0x1, 0x60010000, 0x0) r7 = socket(0x6, 0x80000, 0x9) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="188a032ecee0e31e5c0ca6739ef607f35000006d16000100fdfffffffddfdf270a0000c8", @ANYRESHEX=r0], 0x18}, 0x1, 0x0, 0x0, 0x620080d4}, 0x2c081) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000080)={0x48, 0x5, r3}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r8, 0x8983, &(0x7f0000000400)={0x1, 'vxcan1\x00', {}, 0x3d56}) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x3, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0xfffffffffffffce8, 0x5, 0x8, 0x8001, 0x0, 0xb, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000480)='/proc/partitions\x00', 0x0, 0x0) r11 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r11, r10, &(0x7f00000000c0)=0x5a, 0x5) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r3, 0x0, 0xffffffffffffffff, 0x1}) 2m36.403496593s ago: executing program 9 (id=3707): lgetxattr(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/comedi4\x00', 0xa002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_int(r2, 0x0, 0x13, 0x0, &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) fchdir(r6) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x4}}}, {0x30, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x10, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9, 0x1, "9c979b3226"}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CMP_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xe4}}, 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f00000001c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000140), 0x200800, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@volatile}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1/file0'}}]}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@ipv4_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@RTA_ENCAP={0x14, 0x9, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, @LWTUNNEL_IP_OPT_ERSPAN_VER={0x5, 0x5}}}}]}, 0x30}}, 0x0) ioctl$COMEDI_INSNLIST(r0, 0x8010640b, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x2000000, 0x0, 0x0, 0x0, 0x10000}]}) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0xf08, &(0x7f0000000780)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) 2m35.441761536s ago: executing program 9 (id=3714): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x28040) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) prlimit64(r1, 0xb, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) recvmmsg(r4, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)=""/238, 0xee}], 0x1}, 0xffffffff}], 0x1, 0x40000100, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) setrlimit(0x4, &(0x7f0000000040)={0x1, 0x1}) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r6 = socket$nl_rdma(0x10, 0x3, 0x14) fsetxattr(r6, &(0x7f0000000280)=ANY=[@ANYBLOB="757365722eef"], 0x0, 0x0, 0x1) close_range(r5, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@getnetconf={0x14, 0x52, 0x630, 0x70bd29, 0x25dfdbfb, {}, ["", "", ""]}, 0x14}}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x62, 0x51cfa, 0x0, 0x8000008, 0x3, 0xfffffffe, 0x1, 0x0, 0x7cce8c743ee810df}) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r7, 0x40505330, &(0x7f0000000140)={0x800000, 0x4, 0x80000000, 0x0, 0x10000002, 0x800055a}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2m33.69196887s ago: executing program 9 (id=3719): openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) socket$phonet(0x23, 0x2, 0x1) sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40848}, 0x4004810) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010300000000fdffffff2b0000000c0006"], 0x20}}, 0x40000) 2m33.534155341s ago: executing program 9 (id=3720): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) r2 = io_uring_setup(0x7c34, &(0x7f0000000300)={0x0, 0x581b, 0x4, 0x1, 0x1d7}) io_uring_setup(0x650b, &(0x7f0000000180)={0x0, 0x2c3c, 0x0, 0x21, 0xab, 0x0, r2}) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) r3 = socket$inet_smc(0x2b, 0x1, 0x0) r4 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_QUERYMENU(r4, 0xc02c5625, &(0x7f00000000c0)={0x0, 0x81, @name="5711f532d0cedaa1559b010400000b000000383d093dbadb4e646ec7694ee681"}) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x5) bind$inet(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) io_submit(0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r3, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10) close(r3) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x5, 0x4, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="000000000087eeba5a5bd7890e13678a3a42000fff89b9190a0fb3c0"], 0x1c}, 0x1, 0x0, 0x0, 0x2}, 0x0) 2m18.183146104s ago: executing program 40 (id=3720): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) r2 = io_uring_setup(0x7c34, &(0x7f0000000300)={0x0, 0x581b, 0x4, 0x1, 0x1d7}) io_uring_setup(0x650b, &(0x7f0000000180)={0x0, 0x2c3c, 0x0, 0x21, 0xab, 0x0, r2}) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) r3 = socket$inet_smc(0x2b, 0x1, 0x0) r4 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_QUERYMENU(r4, 0xc02c5625, &(0x7f00000000c0)={0x0, 0x81, @name="5711f532d0cedaa1559b010400000b000000383d093dbadb4e646ec7694ee681"}) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x5) bind$inet(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) io_submit(0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r3, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10) close(r3) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x5, 0x4, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="000000000087eeba5a5bd7890e13678a3a42000fff89b9190a0fb3c0"], 0x1c}, 0x1, 0x0, 0x0, 0x2}, 0x0) 7.621953106s ago: executing program 2 (id=4225): prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x6, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r0, &(0x7f000001aa40)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000001000030429"], 0x20}, 0x1, 0x0, 0x0, 0x4802}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, 0x0, 0x40040c4) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500090000"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 7.502997404s ago: executing program 2 (id=4227): setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000540)=[@in6={0xa, 0x4e20, 0x9, @empty, 0x5}, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e23, 0xff, @local, 0xfff}, @in={0x2, 0x4e23, @rand_addr=0x64010101}, @in6={0xa, 0x4e23, 0x800, @dev={0xfe, 0x80, '\x00', 0x2b}, 0x10001}, @in6={0xa, 0x4e24, 0x1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}], 0xa0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, &(0x7f0000000040)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x4000, 0x0) r2 = syz_io_uring_setup(0x734e, &(0x7f00000002c0)={0x0, 0xecf9, 0x10000, 0x80000, 0x371, 0x0, r1}, &(0x7f0000000180), &(0x7f0000000700), &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x8, 0x0, 0x800, 0x0, 0x100000}, 0x0, &(0x7f0000000240)={0x1f, 0x2, 0xffff, 0x3, 0x4, 0x80000000000000, 0x6a9}, 0x0, 0x0) io_uring_enter(r2, 0x369a, 0x0, 0x1, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000003c0)=0x0) sendmsg$nl_netfilter(r1, &(0x7f0000000c80)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000c40)={&(0x7f0000000740)={0x45c, 0x1, 0x2, 0x201, 0x70bd25, 0x25dfdbff, {0x2, 0x0, 0x2}, [@generic="088254dabf539a2346614c8d7e18747b8035aaad6907f11af68f232be6b4204d40f0", @generic="24081976137ec25e3756c228ab085ff11a04363afd7e393579d0cf765fddcd6d2273c7b1ac6befa5dcf5f8525585489cbbdf4ec589ef779a1698275eb8d7935e7571a7baad8556f856f1663cdd64e0a01f39e5fea9ae0378113b1ea361efb614d49519f8c1753b16589fe24db5d3e43eb29570e7b69e65aca5c4cb5ae47f39a9f2732079cc97f31a950231ca0b3c0d489408e8c738fe5aa750561de3a8cdfb8761c15b8f1c0425f6eefc4ed33cb4b60f6d3c1b18e4674a293b320524841fe0925ea8f88a7e2b594e15a8131e07c08b5f3959aa9db87673c8d30cc7c33bd90ed8e800171e339bc2d4eaa7944bd01bdee866e1b14acd846aaa4c823d", @typed={0x8, 0xdf, 0x0, 0x0, @str='{2\x96\x00'}, @nested={0x24, 0x6b, 0x0, 0x1, [@typed={0x8, 0x15a, 0x0, 0x0, @ipv4=@loopback}, @typed={0x8, 0x5a, 0x0, 0x0, @u32=0x1}, @nested={0x4, 0xc7}, @typed={0x8, 0x112, 0x0, 0x0, @pid=r6}, @typed={0x4, 0xc6, 0x0, 0x0, @binary}]}, @typed={0x8, 0x117, 0x0, 0x0, @u32=0x9}, @generic="b622db0f0582fbd158da12f5f7c419", @nested={0x162, 0x7f, 0x0, 0x1, [@generic="c3dbcb2decedd89c522684990c23a34b50ea3cf9751c39ddb8e3313c326875d2628614edcf07b70fea155a99d4ecf06ba90c7d54ce0c82e64efecec953ed3e83e00bd7ee997def5216f3c4c7f09c57f9fac550de207958811a766722ddf69fed4769b7f227843cd07632069a81e970508ad21f87ab225a6f123edc383f8dff1270d7c67c228bd5aeb2adf58b0e25994ab0c6d033233266fc16d5", @nested={0x4, 0xb5}, @nested={0x4, 0x50}, @generic="cb2f986924108c89c5db5cad4916bb30f0c62f60dedc36399ab42da3e42ff412e516917a6ff9f4cd73da41f3b0ffb1573901a01dc6af81529cb7251f27a309b708574b2bc4d63e815679a83030d89f92145c9c3894002ed945ca3b9a5a10fd4e7aeb386a0805bd039d4fbfcb1248276a307d9aa16da6b809113146e546867d92ede64d467aa46f865ede2da69cb02c45b8e565", @generic="b58210d2b870e7380e9fbff33dcf4bc7bcd6819d10492e52bdcf06e5ed570207b12f2c9bae55c75836"]}, @generic="513a6f87399c1dc0bc2148d31e2670872c16c140a76d4119302a0bd7202513553af461291662d275b13086f52f95152ab27d849279fe1f29dd87a3b0b99efc1df96e6fbaff49b50848d100721bb7dcb81533483599e560dd20148a9f8b5363259a86e8b3e274980ead288a28fb32ed95572956fc522006affea1b9077e6e354ce961fdbbd7c0e5568e982f39965d0e9f98a1ccc8a41b8b711252ede02180ad575fccae49cb1dd999", @nested={0xdc, 0x98, 0x0, 0x1, [@generic="271fe3c1828c4910c25d4cfda041de39f1239d61c901802f1ed667bb4b89cfafdef53282fbea6aecdf2ba8e71ae3", @generic="34ed79a2a70c005a0990e0c0956069ce16cb99babdf08174597c41956694085c268d896ac89e9ca12aa857d62ae48a9494abc5f93b01f9719d14656b2db8291ab2bacc7077806515a8ee974528e4a66f6f9d0d71473f96d83ddacd942b740a3ce9ba05921bf0881e3d114ccb5410807426e4734ef7da06c2172911d8477c73c2080ee2bf73f9be4b2d99eaac2cf8f41ff15ed1858ff09147a3f7fc59793affcc5d9689ea59c8c7a3bb6d"]}]}, 0x45c}}, 0x40) bind$alg(r5, &(0x7f0000000600)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) r7 = accept4(r5, 0x0, 0x0, 0x800) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) dup2(r3, r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000b, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) fchmod(0xffffffffffffffff, 0x106) sendmmsg$unix(r7, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}, {{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x299, 0x0) sendmsg$DEVLINK_CMD_PORT_GET(r3, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="dc000000", @ANYRES16=r4, @ANYBLOB="000325bd7000fedbdf25050000000e0001006e658664657673696d0000000f0002006e657464657673696d30000008000300030000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000300010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000300000000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000300020000000e0001006e65746465f69b696d0000000f0002006e657464657673696d3000000800030003000000"], 0xdc}, 0x1, 0x0, 0x0, 0x14}, 0x4000000) mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4005, &(0x7f0000000040)=0x81, 0x5, 0x0) set_mempolicy_home_node(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={0x0, 0x7}, 0x8) 6.104305856s ago: executing program 5 (id=4230): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r0 = socket$kcm(0xa, 0x5, 0x0) r1 = socket$kcm(0xa, 0x5, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r2 = openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x482, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), 0x21c004, &(0x7f00000008c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000000e8ffffffffffff05000000", @ANYRES32=0x1], 0x48) socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)={r1}) 5.942538313s ago: executing program 5 (id=4232): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) read$dsp(r0, &(0x7f0000002200)=""/207, 0xcf) iopl(0x3) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = mq_open(&(0x7f0000000580)='!\x7f\x00\xca\x00\x00\x00\f\x00vt\x00\x01E!\x05\x99\xb7|`', 0x6e93ebbbcc0884f2, 0x61, &(0x7f0000000480)={0x0, 0x2, 0x7}) mq_timedreceive(r2, &(0x7f0000000700)=""/200, 0xc8, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='mounts\x00') io_setup(0x9, &(0x7f0000000140)=0x0) io_submit(r4, 0x2, &(0x7f0000000580)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x4, r3, 0x0, 0x0, 0x4000000000000010}, 0x0]) r5 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) pread64(0xffffffffffffffff, &(0x7f0000019400)=""/102344, 0xfffffcbb, 0x1c2a) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='attr/current\x00') read$FUSE(r6, &(0x7f00000001c0)={0x2020}, 0x2020) write$P9_RCLUNK(r6, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000640)=0xd) 5.914329944s ago: executing program 3 (id=4233): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, 0x0, &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r0}, 0xc) 5.767529955s ago: executing program 1 (id=4234): socket$inet6(0xa, 0x2, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x600902, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0xfffffffffffffe7e, &(0x7f00000002c0)=0x6) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400018f, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='comm\x00') exit(0x1f52b4ba) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sched_setaffinity(r2, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) mount(&(0x7f0000000280)=@filename='./file0/file0\x00', &(0x7f0000000300)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000100)='trans=rdma,') madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, 0x0, &(0x7f0000000900)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k\xd8\xf2\xe6\"K1Y\xb5%2\xcb\xf5!\x8c\xd5I\xa3~w\b\x1ao\xbd\xa43z\xd5\xbe\x14\x05\x9b\x05\xf8\r?\x9f\xc6\x0e\xd8\xd3\xc4*\xbc\xf0\x1a\xd1Ob*\x8a\xbf\x92@\xb1\x9fq\xd5\x84\x12\xe2\xad5\x03\xec\xb0@\x7f\x9f}\x17\x87\v\xf0\x99\xf7\xc5\x82C\x14\xd3\x05\xba\xd6F-\x06\xfa\x81\x1a\x1eW', 0x0) mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000) madvise(&(0x7f0000f0f000/0x2000)=nil, 0x2000, 0xf) getsockopt$sock_buf(r1, 0x1, 0x3b, &(0x7f00000014c0)=""/145, &(0x7f0000000000)=0x91) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r6, &(0x7f00000001c0)={0x1d, 0x0, 0x0, {0x2, 0x0, 0x6}}, 0x18) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) 5.765838458s ago: executing program 3 (id=4235): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000001600), &(0x7f0000001640)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000001540)='user\x00', &(0x7f0000001580)={'syz', 0x0}, &(0x7f00000015c0)='[:($]-@.*\x94&$(/^\x00', r0) add_key$user(&(0x7f0000001680), 0x0, &(0x7f0000001700)="dfbf724b37d8", 0x6, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000200)='sysfs\x00', 0x1214040, 0x0) syz_open_dev$ndb(&(0x7f0000000180), 0x0, 0x101000) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1b, 0x0, &(0x7f00000007c0)="e3ef7f670000ec6789b42415449400000000000000000000000400", 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}, 0x50) r2 = syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x88003) ioctl$FIBMAP(r2, 0x1, &(0x7f0000000040)=0x85) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4}, &(0x7f0000bbdffc)) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x50) close(r4) ioperm(0x5, 0x6, 0x1) 5.616545755s ago: executing program 2 (id=4236): r0 = syz_usb_connect$lan78xx(0x0, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000700)=ANY=[@ANYBLOB="2561e01c0000"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000140)={0x40, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/partitions\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x20000023896) ppoll(&(0x7f0000000140)=[{r1, 0x4002}], 0x1, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) getsockopt$packet_int(r2, 0x107, 0x11, &(0x7f00000002c0), &(0x7f0000000300)=0x4) sendmsg$DEVLINK_CMD_RATE_GET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="010720000100fcffdfff26000000ec2f243aae835f472f65232fda5002767fcafb68ece7053fda3d7b173ab275a4af2242f5a54a4346d357c4f74c0967289d4f05dfd2e8e94ccaf00e30e71085d20f083d73cb127e0c10b539f3bb758d2d1b1686fbdaf6faf835527e438b0c253069b5729ea1f5bf2ef8b5e614fd7124097cca38cf0ef2fb5299d8dd84bbcc7b1331e513ecb6f7ed3df41030"], 0x14}, 0x1, 0x0, 0x0, 0x24044841}, 0x0) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYRES16=r5, @ANYRES16=r4, @ANYBLOB="000126bd7000ffdbdf251b000000080001006063690011004290650200303030303a30303a31302e300000000008000b0005"], 0x38}, 0x1, 0x0, 0x0, 0x4008010}, 0x4) prctl$PR_SET_DUMPABLE(0x4, 0x0) r6 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x28d80, 0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/wakeup_count', 0x1, 0x50) io_setup(0x100, &(0x7f00000009c0)=0x0) io_submit(r8, 0x1, &(0x7f00000002c0)=[&(0x7f0000000300)={0x0, 0x0, 0x0, 0x7, 0x40, r2, &(0x7f0000000340)="fe35e9f50d", 0x5, 0x10000000005973, 0x0, 0x2}]) ioctl$XFS_IOC_COMMIT_RANGE(r6, 0x40585883, &(0x7f0000000440)={r7, 0x0, 0xfff, 0x4000000000000000, 0xce, 0x8, [0x7, 0x888b, 0x10000, 0xdc, 0x3ff, 0x1]}) r9 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="85e2a94b84c487c1593a0000000000000000000400004e00057ecd000000000000000000000000000000000000000000005b329976d409f3bbdeb683c0679f0c6cc11485375475ba1c35f2bdaafb3cd3ca9ea86ac14fe0ff7ff5c0ea4cd8edf7e629b7651f49a1174b6afe68cc23cc6442788254cb83ecf278a834729ba3429b458e40c0b4b6cc50efb4bd665dec82168b03d2be2245dbc1ae7b5ac2309b8f268984d00aba6e00909a8a02f4", @ANYRES32=0x0, @ANYBLOB="010000000000000000000000002000000800030006010000"], 0x54}}, 0x20000080) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000200)=ANY=[@ANYRES16], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) gettid() syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000400)=ANY=[@ANYBLOB='@0\x00'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) 4.813924019s ago: executing program 1 (id=4237): prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x6, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r0, &(0x7f000001aa40)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000001000030429"], 0x20}, 0x1, 0x0, 0x0, 0x4802}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, 0x0, 0x40040c4) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500090000"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 4.322883404s ago: executing program 1 (id=4239): socket$kcm(0x21, 0x2, 0x2) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x604c804) prlimit64(0x0, 0x1, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x15, 0x0, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x27}, 0x94) syz_open_dev$video(0x0, 0x8, 0x101840) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x2c, r5, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r6}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x40) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000640)=[{{&(0x7f0000000300)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000340)="54c3b1e65bb5f3fed033ed466c932878d5377c20f277cee62a644955874245c298fe9667005f5acc214181770c8d956c5972146497f725630cf5572a1535a3bbbf8502ab1bee1d5151782d307faa5b4155e811cd4cbf6a7d51be0211c9f8de3ddf2a8d5466427eb3d5c1aab07f8cb266d85e7461d64a40707b0ed928a944ea5fc70e84fd15132deb5470b622dc6317c832b7", 0x92}, {&(0x7f0000000400)="3c22b3304f22e6801a4586", 0xb}], 0x2, 0x0, 0xfffffffffffffee6}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000480)="4d2cede08c887f5108bf60483f87f207eb50808b38489b36f6a56fb217e6cc44e6f14ace64ae6fa3bdf11ac3b14a324bf0a1312adf23017a399301430ca1d70b3bb2f7e8964cf4fa7f184609e2c7cc6203bd4b40ce86d4203f943b30c13fd6d937fee723216e3d7a347d0fa8fcb78f13f2771293083e568775a8a24b3c4163335b6b48b236d7a5b47f6e7588a06d1da970f9e9616cbd14ecb6f2fc55bf0bd8a36ecbece56e38d557983b2335d4b104d11cf677", 0xb3}, {&(0x7f0000000080)="611abecd0f2ad1a765539a9802e3d0edd86712b6fe8ccb5fda96d7cd714264d0e76c294bcf47eca72800021e5a51"}], 0x2, &(0x7f0000000600)}}], 0x2, 0x405c880) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r7, 0x29, 0x3b, &(0x7f0000000000)=@fragment={0x88, 0x0, 0x5, 0x1, 0x0, 0x1, 0x8000064}, 0x8) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x80004, 0x0) ioctl$PPPIOCATTACH(r8, 0x4004743d, &(0x7f0000000100)=0x1) connect$inet6(r7, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x185082, 0x0) ioctl$TUNSETVNETBE(r9, 0x400454de, &(0x7f0000000280)) sendmmsg(r7, &(0x7f00000092c0), 0x4ff, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f0000000540)="43e40ada419f69c7cfa0c4d345032488d2176389f0d3cf19ea1c1c24a0f37887249051f760e5675d1b4297d523292351003f477c76672503bc8763938ff1a2ecabdcec886a443f17a42f5c5034b6000000000000000000", 0x57, 0xfffffffffffffffe) socket$inet6(0xa, 0x5, 0x0) 4.262096498s ago: executing program 5 (id=4240): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x15, 0x0, 0x0) r1 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000000)) 4.075818339s ago: executing program 5 (id=4241): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) (async) gettid() socketpair$unix(0x1, 0x5, 0x0, 0x0) (async, rerun: 32) timer_create(0x3, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @thr={&(0x7f00000003c0)="88a583c7495a586fedf21e8aac57e0b3a5e5500a2eb11cf43c6ef41bce8c519137564509632c657f1917f658ed6fd7f59bbadcf0b2fc2ecbea22c5ac49639bff7b39ef36fe87f53d46c013541255baece96478a2e718afd514e2a9ae38", &(0x7f0000000680)="0cf97239b829a3705e62d8241f75bbebc643a464b45987757d1b79b15f71103eb23535e0db8899fb3484fcd22130e7c787dd3922888ebbc5466696cdd1e8918a721475b34d5abc7e9241e2375a566376accaf096030ec9d1719272d9327bc5204867cc02c04468992c5f1d968459d2f9ff817a52097081140fcd18c32153b1fa90691f65d56bbb71e01eb63e39ad0074acf56471842de0dd559b508d1572545da3c354be94b901019b7d"}}, &(0x7f00000000c0)) (async, rerun: 32) syz_open_dev$swradio(&(0x7f0000000040), 0x1, 0x2) r1 = socket$nl_rdma(0x10, 0x3, 0x14) (async) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) (async) socket$netlink(0x10, 0x3, 0x9) (async) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x2) (async) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) (async, rerun: 32) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 32) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000580)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0xa565b8869467b145}) read$msr(r2, &(0x7f000001e580)=""/102384, 0x18ff0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f00000002c0)) (async, rerun: 32) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x100) (rerun: 32) r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_START(r3, 0x6f29) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x200008c0}, 0x40) (async) timer_settime(0x0, 0x0, &(0x7f0000000200)={{}, {0x0, 0x989680}}, 0x0) chdir(0x0) (async, rerun: 32) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6000, 0x1) (async, rerun: 32) r4 = fsopen(&(0x7f0000000100)='securityfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040), 0x0) (async, rerun: 32) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (rerun: 32) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xe) (async) r5 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_SEND_PRIO(r5, 0x6b, 0x3, &(0x7f0000000480)=0x3, 0x4) 3.869689907s ago: executing program 5 (id=4243): mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000009, 0x4082172, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000600)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(camellia-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="ad56b6c5820fae9d6d198669e4db2828c1d762a113da2c63", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x80000) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000a80)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x20000011}, 0x20008801) bind$unix(r0, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x2) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x8, 0x1, 0x80000001, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r4, 0xc01064b3, &(0x7f0000000080)={r5}) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$sierra_net(r3, 0x0, &(0x7f0000001080)={0x1c, &(0x7f0000000380)={0x40, 0x3c, 0x1, 'd'}, 0x0, 0x0}) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="400f0000000097621bea9f9fcdd991ed9bff418fe4eaf1aab9adcc0d2445468022dd187d4ce2589981e38e1f463ca87f77e12de77f2dbe95d2ebb8286975ba88bffe3076f2d5b58c66d05f389af610f7bd298376ca896e2e5d13f4203dac42d69926b60f13052f4f43b2397ac3563ddc2a7c73cde3bc1f5e3c6da867727c7dbe81fda7c42224c3af1a440379dfb281335eecde025d54c4102642c8"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) 3.479591325s ago: executing program 1 (id=4245): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000001000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a6970"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) 3.478973808s ago: executing program 1 (id=4246): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @my=0x0}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) syz_emit_ethernet(0x34e, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa1c86dd6000ed0403183afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000000000000000000000000050aa78c000005dc8080a2030003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af050200010000050000000000260004000018fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1570f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978001d06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670605"], 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=ANY=[@ANYRESOCT=r3, @ANYRESOCT=r2, @ANYRES16=r1, @ANYRESHEX=r0], 0x38}, 0x1, 0x0, 0x0, 0x20004085}, 0x4004080) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) setsockopt$sock_timeval(r1, 0x1, 0x42, &(0x7f0000000280)={0x0, 0x2710}, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280), 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r4}, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000640)=@framed={{}, [@map_fd={0x18, 0x0, 0x2, 0x0, r4}, @ldst={0x1, 0x0, 0x4, 0x0, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000000)='syzkaller\x00'}, 0x94) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000240)={0x1, &(0x7f00000000c0)=[{0xffd4, 0x81, 0x7, 0x7fc00002}]}) sched_setaffinity(0xffffffffffffffff, 0x8, &(0x7f0000000440)=0x8) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0x1bf5f000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f00000003c0)={0x0}) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r7, &(0x7f00000003c0)={&(0x7f0000000100)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0002}}}, 0x14, &(0x7f0000000380)={&(0x7f0000000300)="3e9dcbb3ebe0165d31fda00624aa08a5ad2a92cea0fec5645be9ae8b", 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x800) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r5, 0x40182103, &(0x7f0000000100)={r6, 0x0, r5, 0x0, 0x80000}) ioctl$F2FS_IOC_RESIZE_FS(r0, 0x4008f510, &(0x7f0000000140)=0xfffffffffffffffd) recvmmsg(r1, &(0x7f0000001600)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000180)=""/57, 0x39}], 0x1}, 0x7}], 0x1, 0x0, 0x0) 3.415472928s ago: executing program 1 (id=4247): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0x6, 0x0, 0x0, 0x90, 0x0, 0x79, 0x10, 0xb8}, [@ldst={0x5}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) r0 = add_key$keyring(&(0x7f0000001600), &(0x7f0000001640)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000001540)='user\x00', &(0x7f0000001580)={'syz', 0x0}, 0x0, r0) add_key$user(&(0x7f0000001680), 0x0, &(0x7f0000001700)="dfbf724b37d8", 0x6, r0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000200)='sysfs\x00', 0x1214040, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000180), 0x0, 0x101000) ioctl$BLKGETDISKSEQ(r1, 0x80081280, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={[], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) io_uring_setup(0x7a76, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1b, 0x0, &(0x7f00000007c0)="e3ef7f670000ec6789b42415449400000000000000000000000400", 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}, 0x50) r3 = syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x88003) ioctl$FIBMAP(r3, 0x1, &(0x7f0000000040)=0x85) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) ioctl$TCSBRKP(r4, 0x5425, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4}, &(0x7f0000bbdffc)) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x50) close(r5) ioperm(0x5, 0x6, 0x1) 3.26683833s ago: executing program 3 (id=4248): socket$inet_icmp(0x2, 0x2, 0x1) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) symlink(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000040)='./file0\x00') r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@security={'security\x00', 0x64, 0x4, 0x2a8, 0x100000c, 0xb8, 0x150, 0x0, 0xffffffff, 0xffffffff, 0x210, 0x210, 0x210, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8, 0x0, {0x0, 0x1000000000000}}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz1\x00', {0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x42}}}, {{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x40}, 0xff000000, 0xff, 'veth0_macvtap\x00', 'vcan0\x00', {}, {0xff}, 0x21}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x0, 0x4, 0x2}, {0xffff, 0x5, 0x7}, 0xe, 0x5}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0xff9a) socket$nl_route(0x10, 0x3, 0x0) r2 = fsopen(&(0x7f0000000000)='rpc_pipefs\x00', 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r4 = syz_open_dev$sndctrl(&(0x7f0000000140), 0x4, 0x10103) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r4, 0xc10c5541, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000007c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x160, 0x1170, 0x1398, 0x160, 0x1170, 0x2a0, 0x1398, 0x1398, 0x2a0, 0x1398, 0x3, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x13}, @loopback, [0x0, 0xff000000], [0xffffff00], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x18}, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x21}}, @common=@unspec=@addrtype1={{0x28}, {0x94, 0x804, 0x9}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz1\x00'}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @multicast2}, [], [], 'geneve1\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x0, 0x12}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x40010, r3, 0x1abee000) close(r2) close_range(r1, 0xffffffffffffffff, 0x0) 2.647553466s ago: executing program 3 (id=4250): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2}}, 0x2}, 0x1c) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x7, 0x1, 0x43, 0xc3d, 0x0, 0x2004cb, 0x0, 0xa1d, 0x7, 0x5, 0x79, 0x3, 0x2], 0x3332d000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.607576475s ago: executing program 3 (id=4251): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2}}, 0x2}, 0x1c) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x7, 0x1, 0x43, 0xc3d, 0x0, 0x2004cb, 0x0, 0xa1d, 0x7, 0x5, 0x79, 0x3, 0x2], 0x3332d000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 1) 2.281053116s ago: executing program 3 (id=4252): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socket$unix(0x1, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x4000080) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_ABORT_SCAN(r0, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x1c, 0x0, 0x1, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40088d0}, 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) setsockopt(r4, 0x4, 0x4, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, r3) socket$l2tp(0x2, 0x2, 0x73) socket$inet_mptcp(0x2, 0x1, 0x106) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {0x3}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0xd0}, 0x2) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601fcff00000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00000500070088000000060005404e"], 0x5c}, 0x1, 0x0, 0x0, 0x10000053}, 0x90) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r7], 0x3c}}, 0x0) r8 = socket(0x10, 0x3, 0x0) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000402505a3a440000000010109023b000101010000090400001202eb0000052406000005240000000d240f010000000000001e000009058202"], 0x0) sendmsg$nl_route(r8, 0x0, 0x0) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x3c}}, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r11, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.912166238s ago: executing program 7 (id=4254): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r0 = socket$kcm(0xa, 0x5, 0x0) r1 = socket$kcm(0xa, 0x5, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r2 = openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x482, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), 0x21c004, &(0x7f00000008c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, &(0x7f0000000000)={r1}) socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)={r1}) 1.871750212s ago: executing program 7 (id=4255): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x4e, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000005580)=""/102392, 0x18ff8) r7 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r7, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x4, {0x5, @vbi={0x0, 0x1000000, 0x3, 0x0, [], [0x4], 0x1}}}) ioctl$VIDIOC_QBUF(r7, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.829650166s ago: executing program 7 (id=4256): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001a40)={&(0x7f00000008c0)=ANY=[@ANYBLOB="68000000150001002dbd7000fedbdf2500000000000000000000000000000000ffffffff0000000000000000000000004e2300074e2100050200a020"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4c050) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000002400)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1b8, 0x12, 0x600, 0x1b8, 0x202, 0x3b8, 0x2e8, 0x2e8, 0x3b8, 0x2c0, 0x4, 0x0, {[{{@uncond, 0x0, 0x190, 0x1b8, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "0000000000000019b5115c2aee68d23a465cd431e150c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baeb8989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b500", 0x8}}, @common=@inet=@socket2={{0x28}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0xd8, 0x200, 0x0, {}, [@common=@ah={{0x30}, {[0x4d3, 0x4d3], 0xc9, 0x11, 0x3}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x7ff, 'system_u:object_r:crond_initrc_exec_t:s0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4e8) 1.803815094s ago: executing program 2 (id=4257): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$nl_xfrm(r0, 0x0, 0x4040000) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x400, 0x0) r2 = semget$private(0x0, 0x207, 0x0) semctl$GETALL(r2, 0x0, 0xd, &(0x7f0000000240)=""/166) execve(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$key(0xffffffffffffffff, &(0x7f0000000380)={0x270, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYRESOCT=r1], 0x50}}, 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r5 = dup(r4) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x4000, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@posixacl}], [], 0x6b}}) 1.66755204s ago: executing program 7 (id=4258): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000900)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000006020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) sendmsg$unix(r0, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x24000804) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r4 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000300)={'syz', 0x2}, 0x0, 0x0, r3) r5 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x1}, 0x0, 0x0, r4) r6 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r5) r7 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r6) r8 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000680)={'syz', 0x1}, 0x0, 0x0, r7) r9 = add_key$keyring(&(0x7f0000000080), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r8) r10 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000400)={'syz', 0x0}, 0x0, 0x0, r9) keyctl$clear(0x7, r10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r11 = getpid() sched_setscheduler(r11, 0x2, &(0x7f0000000200)=0x7) r12 = getpid() sched_setscheduler(r11, 0x2, &(0x7f0000000700)=0x7) sched_setattr(r12, &(0x7f0000000000)={0x38, 0x3, 0x2000002f, 0x0, 0x207b6d2d, 0xfffffffffffffffe, 0x7, 0x7ff, 0x8, 0x100}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeff, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r13, &(0x7f00000007c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r14, &(0x7f0000000780)=[{{&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000740)=[{&(0x7f0000000480)="13edb360d4b557a2c29f1eff5c4441cd090f3ef5c6be98fd68902fbc4d1c10a5a4b68662548a583fcdc6464b0d0e1afc8b6d81b92e9aaa358f3c567665c0141f7a24ad599d3e2aa9a0d5ade201469e759b1f132d2dd31b34d79255ab164b6496ab56af08ef51edabe32523de245167e52913ef5afbf692f90a516c6d7e86273bc5fe4904a282a754b3ed097e2b906db53e33895d18ae95ec", 0x98}, {&(0x7f0000000580)="65fb86082b67e723e534276c94e69e069d81e50fee123b4fb0c194f69a9f80f29db7b81347f0fd69bdf9afdeff354a831e37ef3c7a0782d1fb0648b7c1072f724e959a58e9d95f848c083042fa6d16a81acff04565167f3c25e55ae324026c7d9ad1ac9e0c12f90e9ee0afb2e6a2d61470dfefcda04bd2070bb321fc64ec33f2b5c4b853355ef6aa92d6d58637b5e3bcc1638a353a1a5e361c", 0x99}, {&(0x7f0000000640)="39ef0bed4f36d361b184e96c379b081866b79235ab284a2db3f08e0ee53a098e44bce9cc8d01bd9efa1505ff8adc987ad294c007ceb51bf1", 0x38}], 0x3}}], 0x1, 0x0) recvmmsg(r13, &(0x7f0000002f80)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000940)=""/239, 0xef}, {&(0x7f0000000a40)=""/22, 0x16}, {&(0x7f0000000a80)=""/106, 0x6a}, {&(0x7f0000000b00)=""/77, 0x4d}, {&(0x7f0000000b80)=""/246, 0xf6}], 0x5, &(0x7f0000000d00)=""/251, 0xfb}, 0x6}, {{&(0x7f0000000e00)=@can, 0x80, &(0x7f0000002d00)=[{&(0x7f0000000e80)=""/201, 0xc9}, {&(0x7f0000000f80)=""/163, 0xa3}, {&(0x7f0000001a40)=""/4094, 0xffe}, {&(0x7f0000002a40)=""/203, 0xcb}, {&(0x7f0000002b40)=""/103, 0x67}, {&(0x7f0000002bc0)=""/131, 0x83}, {&(0x7f0000002c80)=""/72, 0x48}], 0x7}, 0x9}, {{&(0x7f0000002d80)=@rc={0x1f, @none}, 0x80, &(0x7f0000002f40)=[{&(0x7f0000002e00)=""/76, 0x4c}, {&(0x7f0000002e80)=""/140, 0x8c}], 0x2}}], 0x3, 0x12042, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r15 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0600000004000000030000000d00002000000000", @ANYRES32=0x1, @ANYRES64=r3, @ANYRES32=r8, @ANYRES32, @ANYRES16=r6], 0x50) r16 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYRES64, @ANYRES32=r15, @ANYBLOB="0000000000000000b70800000000fc007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000002300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000001a00)={r16}, 0xc) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) 266.56436ms ago: executing program 7 (id=4259): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) openat$mice(0xffffffffffffff9c, 0x0, 0x101) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000001000)={0x73622a85, 0x10b, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x54, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f00000006c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x32}, @fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000bc0)={0x0, 0x28, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x0, 0x1000000, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r5, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x5, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0xfffffc01, 0x0, 0x6, 0x1, 0xfffffffb, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x1, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x482, 0x4800, 0x300000, 0x3, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8000, 0x0, 0x3, 0x0, 0x3, 0xa, 0x8da8, 0x2, 0x200, 0xffffffff, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x243, 0x9, 0x1, 0x199d, 0x6, 0x2, 0x9, 0xffffffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x3, 0x25, 0x5, 0xfffffffc, 0x8, 0x7fff, 0x72c, 0x1c32, 0x3, 0x8, 0x10000, 0x3fe, 0x7ffd, 0x3, 0x3, 0x297, 0x5, 0x0, 0xa, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000003, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffffffff, 0x6, 0x2000008, 0x800, 0xfdff, 0x2, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xc, 0x3, 0xb, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7, 0x1fe, 0x3], [0x401, 0x8000e584, 0xffff, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0x1e86, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0x200003, 0x100, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x3, 0x400004, 0x3, 0x6d7e, 0x9, 0x8, 0x3, 0xbf23, 0x9, 0x9, 0x956, 0x0, 0x5, 0xe, 0x6, 0x100fffd, 0x93, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x80, 0x0, 0x7d, 0x401, 0x5], [0x108f, 0xffff, 0x3, 0x0, 0x88, 0x2, 0x4000000, 0x4, 0x50, 0x2, 0x763, 0xb, 0x406, 0x1, 0x5, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x8000, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x0, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a5, 0x8a, 0x46, 0x409, 0x6, 0x4, 0x4, 0x3, 0x4, 0xffffffff, 0x7fff, 0xffff8a33, 0xfffffff8, 0xf, 0x3, 0x200, 0x7, 0xd4, 0xfffffffd, 0xa, 0xe, 0x101, 0xfff, 0xf, 0x136, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(r5, 0x5501) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000380)=""/137) readv(r5, &(0x7f00000001c0)=[{&(0x7f00000012c0)=""/41, 0x29}], 0x1) write$input_event(r5, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) 253.805922ms ago: executing program 5 (id=4260): openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) close(0x3) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000001, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x1, 0x0) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x66) remap_file_pages(&(0x7f0000250000/0x4000)=nil, 0x4000, 0x0, 0x1ff, 0x800) r0 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x100030, 0xffffffffffffffff, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c0000001f00010029bd7000fedbdf25fc000000000000000000000000000001000004d2020032000a0101020000000000000000000000001b090000000000800c0015"], 0x4c}, 0x1, 0x0, 0x0, 0x8800}, 0xc8) lseek(r0, 0x8000000000000000, 0x4) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) 160.660128ms ago: executing program 2 (id=4261): openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000040), 0x35c, 0x0) 89.95254ms ago: executing program 7 (id=4262): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xc8, &(0x7f0000000300)=""/200, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000480)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x7, 0x90, 0x0, 0xa}, 0x9c) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x40081, 0x0) ioctl$TIOCSTI(r5, 0x5412, &(0x7f00000000c0)=0xf9) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r4, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r4, 0x0, 0x485, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x14, 0x26, 0x9, 0x70bd25, 0x25dfdbfa, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) 0s ago: executing program 2 (id=4263): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r3 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x6) ftruncate(r3, 0x2000000) fcntl$addseals(r3, 0x409, 0x7) ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000000)={r3, 0x1f, 0x0, 0x1000000}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) clock_settime(0x0, &(0x7f0000000240)={0x77359400}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f00000001c0)={"568139cb5050a7a31ebfc4330c2bf68f86101d9a301cbe14b15f4f23031ceb319db01a783479d6b9a1201fb1cc7235f57f425131b1d59b14c7588e103ad23d61fc6b05b60536a1611da4d3a6a06d308650343e59d307e34d8c2ec3ef05629a47f994dd2e9f8b9ce05b338ae7db5267bc4082bd43ca93b78947a7c79e82df466d4fee2b222f1ebde976d2272a4f52329796330ee917cc4f5b3ec45ac1ecdaaf3dffe03c40b7c209e44cfeb08aad00e1b48da4289228d7d82d4f6a661942ace64f115d3cc6ac80f74420c390d89e7ab2133567aa41047d775e333184cc0b468ec5eb9bc3cb0fa00516e5452bf32a9e760f07efd5a5e5eb37eaff28ef92bb59498369808bdd310a4a95a5414a8ff450411ff67d3167eec8372455a19c0c5a608adfebded6974660fd85308a07860e16f62963da37448d6e1218f2092fb3d1662804623b63a07f3e5e881df9a5ac27ce3f1519003118aa6170ff423eb292dc70147bde37963f72d0642660e7107753167886fc10e108631a9ea4d6752145b8646187ba7e152b6bcbcedd6b83fb9435d5c8e8d5d25a3f173745eab94a4a296572d459a50d622c8769dc57a7cdf7efe9f259dc36f538d1836362f1bcb2c4ebceae7e3655d5e98ba481906f284bd03716c15894eca8cbf8302dc8e2c21736b697b5f868e8af96fa8bbb1ae56571616a70ce05970d1e4142f303f7586fd2fc6f0ee3dce1db6524dd6aa28faab046e074df38430a49e8a6dde71028f16539744b7867e19c856e670e8b799d52da435bb07beea6274bf512e7d6ebb8ff8f83a52e4d13602e7d4675a798a12c898ad5b00caa34313ff8fb6c3407cf815eca9795cffd9a24959653cc816851048ebf0772bebdd3ff9b8cfbd2c65c30e41586b00a14943e4815361789158139d440c4f627edb8ed59e1ca0bb0c60106e09635fa9335677337c554db885f75b899638e8df1ea9796f8258de36636346ab768856bbdfc51843a53701423d75c1f43be24469aa03d366bbfb81218b31e5c0ad716efea52175c2fa78317cafb16ee173eb5e9428509ca4c8f9bf798adc7da1758a9c0334e44200c0578495ff805fce84456205caa70f0976a8603f84cb542d0df1416602321c587556785af525ddf5548b4f51113c52a7a17042faf6c8c02d8d1835e0f67f60ab392c20fc12188db029e45bb77cfccc423671d52ec5a92d08c2bb27a676b66f3b89ac084d99e3f516426a015268a1f3fb91b13c8baba49a0765a305c13cd1f47b3ea7a6393182759b614a08d36192a8b68abef6e5c16849452c74af3a9f854e1f2bc1c2eac2f055f8ffd8fdaa6bb04a68850c585f433c0e6b8dba1401fce5aab11d75d2323d8079891175096e31013ca0a3763511c86f2fbc31a33458c52059ebe253dcd3e837fed39765a11842028df450479dd56e1325cd8d088ff12a8f7dd23f2"}) ioctl$KVM_CAP_HYPERV_SYNIC2(r4, 0x4068aea3, &(0x7f0000000140)) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000005c0)={0x2, 0x0, [{0x400000b0, 0x0, 0xffffffffffffffff}, {0x400000b1, 0x0, 0xfffffffffffffff7}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) kernel console output (not intermixed with test programs): arsing attributes in process `syz.7.3774'. [ 1419.175386][T21813] veth0_to_bond: default FDB implementation only supports local addresses [ 1419.207583][T21813] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3774'. [ 1419.249265][ T5625] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1419.274712][ T5625] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1419.278827][T19813] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 1419.308142][ T5625] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1419.332447][ T5625] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1419.340083][ T5625] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1419.378262][T19813] usb 6-1: device descriptor read/8, error -71 [ 1419.390315][T14549] usbhid 2-1:0.0: can't add hid device: -71 [ 1419.414587][T14549] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1419.448814][T14549] usb 2-1: USB disconnect, device number 62 [ 1419.508404][T19813] usb usb6-port1: unable to enumerate USB device [ 1419.847809][T21822] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3773'. [ 1419.856901][T21822] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3773'. [ 1420.156065][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1420.595899][T21827] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3776'. [ 1420.841320][T19572] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1421.186014][T19527] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1421.250153][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1421.399711][ T5620] Bluetooth: hci5: command tx timeout [ 1421.489599][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1421.643707][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1421.670261][T21835] openvswitch: netlink: IPv6 tunnel dst address is zero [ 1421.702825][T21835] 9p: Bad value for 'wfdno' [ 1422.007372][ T30] audit: type=1400 audit(2000000279.780:1441): avc: denied { read write } for pid=21832 comm="syz.2.3778" name="rdma_cm" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1422.204221][ T30] audit: type=1400 audit(2000000279.780:1442): avc: denied { open } for pid=21832 comm="syz.2.3778" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1422.562771][T19813] hid-generic 0000:0000:0000.001A: unknown main item tag 0x0 [ 1422.767911][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1422.844303][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1422.963246][T13490] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1422.980738][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1423.475824][ T5620] Bluetooth: hci5: command tx timeout [ 1424.173569][T19813] hid-generic 0000:0000:0000.001A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1424.197636][T21862] binder: BINDER_SET_CONTEXT_MGR already set [ 1424.210675][T21815] lo speed is unknown, defaulting to 1000 [ 1424.235183][T21862] binder: 21860:21862 ioctl 4018620d 200000000100 returned -16 [ 1424.238423][T21863] FAULT_INJECTION: forcing a failure. [ 1424.238423][T21863] name failslab, interval 1, probability 0, space 0, times 0 [ 1424.445451][T21863] CPU: 1 UID: 0 PID: 21863 Comm: syz.1.3783 Tainted: G L syzkaller #0 PREEMPT(full) [ 1424.445480][T21863] Tainted: [L]=SOFTLOCKUP [ 1424.445487][T21863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1424.445498][T21863] Call Trace: [ 1424.445504][T21863] [ 1424.445511][T21863] dump_stack_lvl+0x100/0x190 [ 1424.445537][T21863] should_fail_ex.cold+0x5/0xa [ 1424.445561][T21863] should_failslab+0xc2/0x120 [ 1424.445582][T21863] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 1424.445615][T21863] ? __alloc_skb+0x140/0x710 [ 1424.445639][T21863] ? __alloc_skb+0x5b7/0x710 [ 1424.445668][T21863] __alloc_skb+0x140/0x710 [ 1424.445692][T21863] ? __alloc_skb+0x5b7/0x710 [ 1424.445716][T21863] ? __pfx___alloc_skb+0x10/0x10 [ 1424.445748][T21863] alloc_skb_with_frags+0xdd/0x760 [ 1424.445767][T21863] ? avc_has_perm_noaudit+0x145/0x3b0 [ 1424.445795][T21863] sock_alloc_send_pskb+0x801/0x980 [ 1424.445828][T21863] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1424.445855][T21863] ? sock_has_perm+0x25a/0x2f0 [ 1424.445875][T21863] ? __pfx_sock_has_perm+0x10/0x10 [ 1424.445897][T21863] hci_sock_sendmsg+0x1c7/0x2620 [ 1424.445925][T21863] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 1424.445953][T21863] sock_write_iter+0x524/0x5a0 [ 1424.445974][T21863] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 1424.445995][T21863] ? __pfx_sock_write_iter+0x10/0x10 [ 1424.446023][T21863] ? bpf_lsm_file_permission+0x9/0x10 [ 1424.446051][T21863] ? security_file_permission+0x76/0x210 [ 1424.446076][T21863] ? rw_verify_area+0xce/0x6d0 [ 1424.446097][T21863] vfs_write+0x6ac/0x1070 [ 1424.446117][T21863] ? __pfx_sock_write_iter+0x10/0x10 [ 1424.446140][T21863] ? __pfx_vfs_write+0x10/0x10 [ 1424.446157][T21863] ? find_held_lock+0x2b/0x80 [ 1424.446192][T21863] ksys_write+0x1f8/0x250 [ 1424.446211][T21863] ? __pfx_ksys_write+0x10/0x10 [ 1424.446233][T21863] ? rcu_is_watching+0x12/0xc0 [ 1424.446264][T21863] do_syscall_64+0x10b/0xf80 [ 1424.446285][T21863] ? clear_bhb_loop+0x40/0x90 [ 1424.446307][T21863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1424.446325][T21863] RIP: 0033:0x7fa33259cdd9 [ 1424.446341][T21863] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1424.446357][T21863] RSP: 002b:00007fa33348f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1424.446375][T21863] RAX: ffffffffffffffda RBX: 00007fa332815fa0 RCX: 00007fa33259cdd9 [ 1424.446387][T21863] RDX: 0000000000000007 RSI: 0000200000000000 RDI: 0000000000000004 [ 1424.446397][T21863] RBP: 00007fa33348f090 R08: 0000000000000000 R09: 0000000000000000 [ 1424.446407][T21863] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1424.446416][T21863] R13: 00007fa332816038 R14: 00007fa332815fa0 R15: 00007ffd1b7778d8 [ 1424.446439][T21863] [ 1424.614108][T21859] fido_id[21859]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1424.991174][T21815] bridge0: port 1(bridge_slave_0) entered blocking state [ 1425.000403][T21815] bridge0: port 1(bridge_slave_0) entered disabled state [ 1425.007679][T21815] bridge_slave_0: entered allmulticast mode [ 1425.017830][T21815] bridge_slave_0: entered promiscuous mode [ 1425.028803][T21815] bridge0: port 2(bridge_slave_1) entered blocking state [ 1425.037944][T21815] bridge0: port 2(bridge_slave_1) entered disabled state [ 1425.045930][T21815] bridge_slave_1: entered allmulticast mode [ 1425.054567][T21815] bridge_slave_1: entered promiscuous mode [ 1425.078001][T14370] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 1425.095106][T21815] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1425.110581][T21815] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1425.240302][T14370] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 1425.257374][T21888] overlayfs: overlapping lowerdir path [ 1425.352710][T14370] usb 2-1: config 0 has no interface number 0 [ 1425.359928][T14370] usb 2-1: config 0 interface 50 has no altsetting 0 [ 1425.371368][T14370] usb 2-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=c4.0e [ 1425.382411][T14370] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1425.391993][T14370] usb 2-1: Product: syz [ 1425.396233][T14370] usb 2-1: Manufacturer: syz [ 1425.403274][T14370] usb 2-1: SerialNumber: syz [ 1425.434650][T21894] program syz.2.3789 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1425.446448][T14370] usb 2-1: config 0 descriptor?? [ 1425.453167][T21815] team0: Port device team_slave_0 added [ 1425.473080][T21890] netlink: 1047 bytes leftover after parsing attributes in process `syz.7.3790'. [ 1425.483145][T21890] veth0_to_bond: default FDB implementation only supports local addresses [ 1425.506190][T21815] team0: Port device team_slave_1 added [ 1425.512358][T21890] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3790'. [ 1425.548139][ T5620] Bluetooth: hci5: command tx timeout [ 1425.609889][T21815] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1425.618737][T21815] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1425.747647][T21815] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1425.813208][T21815] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1425.827236][T21815] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1425.861574][T21815] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1425.873165][ T5346] net_ratelimit: 3 callbacks suppressed [ 1425.873182][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1425.933152][T21898] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3787'. [ 1426.028000][T19527] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1426.092065][T21815] hsr_slave_0: entered promiscuous mode [ 1426.174899][T21815] hsr_slave_1: entered promiscuous mode [ 1426.205912][T21815] debugfs: 'hsr0' already exists in 'hsr' [ 1426.225009][T21815] Cannot create hsr debugfs directory [ 1426.908166][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1427.328860][ T30] audit: type=1400 audit(2000000285.130:1443): avc: denied { accept } for pid=21912 comm="syz.5.3794" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 1427.525248][ T30] audit: type=1400 audit(2000000285.320:1444): avc: denied { write } for pid=21908 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1427.627853][ T5620] Bluetooth: hci5: command tx timeout [ 1427.678335][ T30] audit: type=1400 audit(2000000285.470:1445): avc: denied { write } for pid=21927 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1427.948051][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1428.043265][T14370] usbserial_generic 2-1:0.50: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 1428.054959][T14370] usbserial_generic 2-1:0.50: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 1428.083807][T14370] usbserial_generic 2-1:0.50: device has no bulk endpoints [ 1428.132459][T14370] safe_serial 2-1:0.50: safe_serial converter detected [ 1428.155169][T14370] safe_serial 2-1:0.50: probe with driver safe_serial failed with error -22 [ 1428.663253][ T30] audit: type=1400 audit(2000000286.010:1446): avc: denied { mount } for pid=21932 comm="syz.2.3797" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 1428.796522][T14370] usb 2-1: USB disconnect, device number 63 [ 1428.911510][T21928] netlink: 1047 bytes leftover after parsing attributes in process `syz.5.3796'. [ 1428.948792][T21928] veth0_to_bond: default FDB implementation only supports local addresses [ 1428.982129][T21930] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3796'. [ 1428.991593][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1429.069207][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1429.422896][ T30] audit: type=1400 audit(2000000287.000:1447): avc: denied { create } for pid=21948 comm="syz.7.3799" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 1429.597147][ T30] audit: type=1400 audit(2000000287.030:1448): avc: denied { bind } for pid=21948 comm="syz.7.3799" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 1429.719145][ T30] audit: type=1400 audit(2000000287.500:1449): avc: denied { bind } for pid=21954 comm="syz.7.3800" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1429.875210][ T30] audit: type=1400 audit(2000000287.670:1450): avc: denied { write } for pid=21931 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1429.969691][ T5346] usb 8-1: new high-speed USB device number 100 using dummy_hcd [ 1430.028082][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1430.100952][ T30] audit: type=1400 audit(2000000287.900:1451): avc: denied { write } for pid=21961 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1430.142141][ T5346] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1430.160959][ T5346] usb 8-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1430.195104][ T5346] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1430.223174][ T5346] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1430.252356][ T5346] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1430.290496][ T5346] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1430.306494][ T5346] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1430.325060][ T5346] usb 8-1: Product: syz [ 1430.333496][ T5346] usb 8-1: Manufacturer: syz [ 1430.355822][ T5346] cdc_wdm 8-1:1.0: skipping garbage [ 1430.371038][ T5346] cdc_wdm 8-1:1.0: skipping garbage [ 1430.386901][T21815] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1430.394670][ T5346] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 1430.401682][ T5346] cdc_wdm 8-1:1.0: Unknown control protocol [ 1430.419281][T21815] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1430.437543][T21815] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1430.440097][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1430.468915][T21815] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1430.476981][T21815] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1430.490125][T21815] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1430.499312][T21815] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1430.499982][ T30] audit: type=1400 audit(2000000288.300:1452): avc: denied { write } for pid=21963 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1430.537175][T21815] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1430.664805][ C1] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 1430.665126][T14370] usb 8-1: USB disconnect, device number 100 [ 1430.671448][ C1] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 1430.671473][ C1] cdc_wdm 8-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1430.773213][T21815] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1430.833848][T21815] 8021q: adding VLAN 0 to HW filter on device team0 [ 1430.864097][T13490] bridge0: port 1(bridge_slave_0) entered blocking state [ 1430.871313][T13490] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1430.904687][T13490] bridge0: port 2(bridge_slave_1) entered blocking state [ 1430.911909][T13490] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1431.060235][T15215] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 1431.076574][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1431.230048][T15215] usb 2-1: Using ep0 maxpacket: 16 [ 1431.257095][T15215] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1431.290193][T15215] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1431.310355][T15215] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1431.365097][T15215] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1431.398562][T15215] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1432.296230][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1432.304424][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1432.315032][T15215] usb 2-1: config 0 descriptor?? [ 1432.742032][T15215] microsoft 0003:045E:07DA.001B: invalid report_count 32222 [ 1432.768661][T22028] netlink: 'syz.2.3807': attribute type 4 has an invalid length. [ 1432.791522][T15215] microsoft 0003:045E:07DA.001B: item 0 2 1 9 parsing failed [ 1432.825139][T15215] microsoft 0003:045E:07DA.001B: parse failed [ 1432.875915][T15215] microsoft 0003:045E:07DA.001B: probe with driver microsoft failed with error -22 [ 1432.987960][T17207] block nbd1: Possible stuck request ffff888027e2e000: control (read@0,1024B). Runtime 60 seconds [ 1432.998700][T17207] block nbd1: Possible stuck request ffff888027e2e1c0: control (read@1024,1024B). Runtime 60 seconds [ 1433.009707][T17207] block nbd1: Possible stuck request ffff888027e2e380: control (read@2048,1024B). Runtime 60 seconds [ 1433.020939][T17207] block nbd1: Possible stuck request ffff888027e2e540: control (read@3072,1024B). Runtime 60 seconds [ 1433.224610][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 1433.224847][ T30] audit: type=1400 audit(2000000290.900:1458): avc: denied { setattr } for pid=21984 comm="syz.1.3802" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 1433.327058][T21815] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1433.339440][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1433.506082][ T30] audit: type=1400 audit(2000000291.300:1459): avc: denied { write } for pid=22021 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1433.648888][T21815] veth0_vlan: entered promiscuous mode [ 1433.710597][ T30] audit: type=1400 audit(2000000291.510:1460): avc: denied { write } for pid=22043 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1433.734388][T21815] veth1_vlan: entered promiscuous mode [ 1433.860818][T21815] veth0_macvtap: entered promiscuous mode [ 1433.907628][T21815] veth1_macvtap: entered promiscuous mode [ 1433.976143][T21815] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1434.006460][T21815] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1434.042779][T19572] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1434.077969][T19572] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1434.113606][T19572] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1434.132304][T19572] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1434.352528][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1434.408823][T19572] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1434.446732][T19572] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1434.525239][T13481] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1434.556072][T13481] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1434.687048][ T30] audit: type=1400 audit(2000000292.480:1461): avc: denied { write } for pid=22045 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1434.728331][ T991] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 1434.898892][ T30] audit: type=1400 audit(2000000292.700:1462): avc: denied { write } for pid=22061 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1434.899716][ T991] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1435.097414][T14370] usb 2-1: USB disconnect, device number 64 [ 1435.130220][ T991] usb 3-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 1435.191582][ T991] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1435.256519][ T991] usb 3-1: Product: syz [ 1435.296083][T22064] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.3775'. [ 1435.308628][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1435.316136][T22064] veth0_to_bond: default FDB implementation only supports local addresses [ 1435.341677][ T991] usb 3-1: Manufacturer: syz [ 1435.356442][ T991] usb 3-1: SerialNumber: syz [ 1435.377076][ T991] usb 3-1: config 0 descriptor?? [ 1435.390629][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1435.553497][T22064] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3775'. [ 1435.837832][ T991] usb 2-1: new full-speed USB device number 65 using dummy_hcd [ 1435.938157][T15215] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 1436.023961][ T30] audit: type=1400 audit(2000000293.800:1463): avc: denied { write } for pid=22067 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1436.162295][ T991] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 1436.205402][ T991] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1436.274356][T15215] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1436.286755][ T991] usb 2-1: config 0 has no interface number 0 [ 1436.310328][ T30] audit: type=1400 audit(2000000294.110:1464): avc: denied { write } for pid=22085 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1436.373578][ T991] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1436.391824][T15215] usb 6-1: config 0 has no interfaces? [ 1436.405457][ T991] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1436.430296][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1436.446632][T15215] usb 6-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 1436.476888][ T991] usb 2-1: Product: syz [ 1436.503486][T15215] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1436.512690][ T991] usb 2-1: Manufacturer: syz [ 1436.519098][ T991] usb 2-1: SerialNumber: syz [ 1436.533059][T15215] usb 6-1: config 0 descriptor?? [ 1436.556845][ T991] usb 2-1: config 0 descriptor?? [ 1436.602980][ T991] hub 2-1:0.31: bad descriptor, ignoring hub [ 1436.629073][ T991] hub 2-1:0.31: probe with driver hub failed with error -5 [ 1436.760797][ T991] uvcvideo 2-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 1436.792584][ T991] uvcvideo 2-1:0.31: Entity type for entity Output 32774 was not initialized! [ 1436.818111][ T991] uvcvideo 2-1:0.31: Failed to create links for entity 32774 [ 1436.825824][ T991] uvcvideo 2-1:0.31: Failed to register entities (-22). [ 1437.126495][ T29] usb 6-1: USB disconnect, device number 100 [ 1437.305570][ T30] audit: type=1400 audit(2000000295.100:1465): avc: denied { write } for pid=22087 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1437.343704][ T991] usb 2-1: USB disconnect, device number 65 [ 1437.399689][ T30] audit: type=1400 audit(2000000295.200:1466): avc: denied { write } for pid=22104 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1437.476422][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1437.602728][ T29] usb 3-1: USB disconnect, device number 24 [ 1437.668593][T22112] overlayfs: overlapping lowerdir path [ 1437.779010][T22118] program syz.7.3812 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1438.185804][ T30] audit: type=1400 audit(2000000295.980:1467): avc: denied { create } for pid=22129 comm="syz.1.3816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1438.275659][ T30] audit: type=1400 audit(2000000296.020:1468): avc: denied { write } for pid=22106 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1438.348242][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1438.511096][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1438.511887][ T30] audit: type=1400 audit(2000000296.310:1469): avc: denied { write } for pid=22137 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1438.786367][T22147] netlink: 'syz.5.3819': attribute type 4 has an invalid length. [ 1438.794606][T22147] netlink: 17 bytes leftover after parsing attributes in process `syz.5.3819'. [ 1438.833374][ T991] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 1439.552188][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1440.189924][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1440.198107][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1440.208858][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1440.229570][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1440.349381][ T991] usb 4-1: config 0 has an invalid interface number: 50 but max is 0 [ 1440.357980][ T991] usb 4-1: config 0 has no interface number 0 [ 1440.394174][ T991] usb 4-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1440.432197][ T991] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 1440.442690][ T991] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1440.526439][ T991] usb 4-1: Product: syz [ 1440.537862][ T991] usb 4-1: Manufacturer: syz [ 1440.542591][ T991] usb 4-1: SerialNumber: syz [ 1440.566428][ T991] usb 4-1: config 0 descriptor?? [ 1440.590380][ T991] yurex 4-1:0.50: USB YUREX device now attached to Yurex #0 [ 1440.797760][ T991] usb 4-1: USB disconnect, device number 7 [ 1440.814332][ T991] yurex 4-1:0.50: USB YUREX #0 now disconnected [ 1440.877057][ T30] audit: type=1400 audit(2000000298.670:1470): avc: denied { write } for pid=22146 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1441.085108][ T30] audit: type=1400 audit(2000000298.880:1471): avc: denied { write } for pid=22172 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1441.671010][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1441.721824][T22176] netlink: 'syz.2.3826': attribute type 11 has an invalid length. [ 1441.764442][T22180] syzkaller0: entered promiscuous mode [ 1441.765785][T19527] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1441.774082][T22180] syzkaller0: entered allmulticast mode [ 1442.264163][T22174] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1442.470240][T22191] overlayfs: overlapping lowerdir path [ 1442.527035][T22195] FAULT_INJECTION: forcing a failure. [ 1442.527035][T22195] name failslab, interval 1, probability 0, space 0, times 0 [ 1442.539896][T22195] CPU: 0 UID: 0 PID: 22195 Comm: syz.3.3830 Tainted: G L syzkaller #0 PREEMPT(full) [ 1442.539931][T22195] Tainted: [L]=SOFTLOCKUP [ 1442.539938][T22195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1442.539949][T22195] Call Trace: [ 1442.539956][T22195] [ 1442.539963][T22195] dump_stack_lvl+0x100/0x190 [ 1442.539989][T22195] should_fail_ex.cold+0x5/0xa [ 1442.540016][T22195] should_failslab+0xc2/0x120 [ 1442.540036][T22195] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 1442.540062][T22195] ? security_file_alloc+0x34/0x2c0 [ 1442.540087][T22195] ? trace_kmem_cache_alloc+0xd5/0x100 [ 1442.540112][T22195] security_file_alloc+0x34/0x2c0 [ 1442.540136][T22195] init_file+0x95/0x480 [ 1442.540162][T22195] alloc_empty_file+0x79/0x1c0 [ 1442.540189][T22195] path_openat+0xe8/0x31a0 [ 1442.540210][T22195] ? kasan_save_stack+0x3f/0x50 [ 1442.540242][T22195] ? kasan_save_stack+0x30/0x50 [ 1442.540268][T22195] ? kasan_save_track+0x14/0x30 [ 1442.540282][T22195] ? __kasan_slab_alloc+0x89/0x90 [ 1442.540299][T22195] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 1442.540324][T22195] ? do_getname+0x35/0x390 [ 1442.540348][T22195] ? do_sys_openat2+0xc5/0x1e0 [ 1442.540382][T22195] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1442.540405][T22195] ? __pfx_path_openat+0x10/0x10 [ 1442.540437][T22195] do_file_open+0x20e/0x430 [ 1442.540462][T22195] ? __pfx_do_file_open+0x10/0x10 [ 1442.540501][T22195] ? alloc_fd+0x476/0x790 [ 1442.540527][T22195] ? do_getname+0x191/0x390 [ 1442.540555][T22195] do_sys_openat2+0x10d/0x1e0 [ 1442.540580][T22195] ? __pfx_do_sys_openat2+0x10/0x10 [ 1442.540605][T22195] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1442.540638][T22195] __x64_sys_openat+0x12d/0x210 [ 1442.540664][T22195] ? __pfx___x64_sys_openat+0x10/0x10 [ 1442.540697][T22195] ? rcu_is_watching+0x12/0xc0 [ 1442.540723][T22195] ? exit_to_user_mode_loop+0xdd/0x4a0 [ 1442.540748][T22195] ? rcu_is_watching+0x12/0xc0 [ 1442.540778][T22195] do_syscall_64+0x10b/0xf80 [ 1442.540798][T22195] ? clear_bhb_loop+0x40/0x90 [ 1442.540820][T22195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1442.540838][T22195] RIP: 0033:0x7f9cf919cdd9 [ 1442.540854][T22195] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1442.540872][T22195] RSP: 002b:00007f9cf9fbc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1442.540891][T22195] RAX: ffffffffffffffda RBX: 00007f9cf9416180 RCX: 00007f9cf919cdd9 [ 1442.540904][T22195] RDX: 0000000000141a82 RSI: 0000200000000300 RDI: ffffffffffffff9c [ 1442.540921][T22195] RBP: 00007f9cf9fbc090 R08: 0000000000000000 R09: 0000000000000000 [ 1442.540932][T22195] R10: 0000000000000104 R11: 0000000000000246 R12: 0000000000000001 [ 1442.540942][T22195] R13: 00007f9cf9416218 R14: 00007f9cf9416180 R15: 00007ffdc4fee588 [ 1442.540967][T22195] [ 1442.837010][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1442.905294][T22199] program syz.5.3831 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1443.364635][ T30] audit: type=1400 audit(2000000301.160:1472): avc: denied { write } for pid=22205 comm="syz.3.3834" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1443.869011][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1444.062288][ T30] audit: type=1400 audit(2000000301.860:1473): avc: denied { write } for pid=22186 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1444.294664][T22232] netlink: 'syz.7.3838': attribute type 11 has an invalid length. [ 1444.679248][ T30] audit: type=1400 audit(2000000302.480:1474): avc: denied { write } for pid=22234 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1444.834618][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1444.911641][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1445.401645][T22257] netlink: 'syz.5.3842': attribute type 11 has an invalid length. [ 1445.758853][ T30] audit: type=1400 audit(2000000303.560:1475): avc: denied { write } for pid=22239 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1445.794745][T13483] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1445.814678][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1445.827086][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1445.846292][T22246] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.3833'. [ 1445.859896][T22246] veth0_to_bond: default FDB implementation only supports local addresses [ 1445.975658][T22246] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3833'. [ 1446.001603][ T30] audit: type=1400 audit(2000000303.800:1476): avc: denied { write } for pid=22272 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1446.455707][ T30] audit: type=1400 audit(2000000304.250:1477): avc: denied { create } for pid=22275 comm="syz.3.3846" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1446.737985][ T30] audit: type=1400 audit(2000000304.320:1478): avc: denied { ioctl } for pid=22275 comm="syz.3.3846" path="socket:[76243]" dev="sockfs" ino=76243 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1446.875447][ T30] audit: type=1400 audit(2000000304.340:1479): avc: denied { write } for pid=22275 comm="syz.3.3846" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1446.924893][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1447.068752][ T991] usb 8-1: new high-speed USB device number 101 using dummy_hcd [ 1447.237754][ T991] usb 8-1: Using ep0 maxpacket: 32 [ 1447.281509][ T30] audit: type=1400 audit(2000000305.070:1480): avc: denied { write } for pid=22285 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1447.372016][ T991] usb 8-1: config index 0 descriptor too short (expected 35577, got 27) [ 1447.431643][ T991] usb 8-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1447.530149][ T991] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1447.584858][ T30] audit: type=1400 audit(2000000305.380:1481): avc: denied { write } for pid=22309 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1447.607418][ T991] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1447.642598][ T991] usb 8-1: config 1 has no interface number 0 [ 1447.672068][ T991] usb 8-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1447.701458][T22312] fuse: Bad value for 'fd' [ 1447.733349][ T991] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1447.778096][ T991] snd_usb_pod 8-1:1.1: Line 6 Pocket POD found [ 1447.869486][T19527] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1447.948362][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1447.959219][T22297] FAULT_INJECTION: forcing a failure. [ 1447.959219][T22297] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 1448.005969][T22297] CPU: 0 UID: 0 PID: 22297 Comm: syz.7.3852 Tainted: G L syzkaller #0 PREEMPT(full) [ 1448.006002][T22297] Tainted: [L]=SOFTLOCKUP [ 1448.006009][T22297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1448.006019][T22297] Call Trace: [ 1448.006026][T22297] [ 1448.006034][T22297] dump_stack_lvl+0x100/0x190 [ 1448.006060][T22297] should_fail_ex.cold+0x5/0xa [ 1448.006084][T22297] ? prepare_alloc_pages+0x16d/0x5f0 [ 1448.006108][T22297] should_fail_alloc_page+0xeb/0x140 [ 1448.006130][T22297] prepare_alloc_pages+0x1f0/0x5f0 [ 1448.006155][T22297] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 1448.006183][T22297] ? __kernel_text_address+0xd/0x30 [ 1448.006206][T22297] ? unwind_get_return_address+0x59/0xa0 [ 1448.006233][T22297] ? arch_stack_walk+0xa6/0xf0 [ 1448.006270][T22297] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1448.006297][T22297] ? __pfx_stack_trace_save+0x10/0x10 [ 1448.006317][T22297] ? stack_depot_save_flags+0x27/0x9d0 [ 1448.006335][T22297] ? xa_load+0x149/0x2c0 [ 1448.006358][T22297] ? look_up_lock_class+0x64/0x120 [ 1448.006382][T22297] ? __kasan_slab_alloc+0x89/0x90 [ 1448.006398][T22297] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 1448.006423][T22297] ? security_inode_alloc+0x3b/0x2c0 [ 1448.006454][T22297] ? __lock_acquire+0x4a5/0x2630 [ 1448.006473][T22297] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1448.006495][T22297] ? policy_nodemask+0xed/0x4f0 [ 1448.006515][T22297] alloc_pages_mpol+0x1fb/0x540 [ 1448.006535][T22297] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 1448.006551][T22297] ? do_raw_spin_lock+0x128/0x260 [ 1448.006574][T22297] ? find_held_lock+0x2b/0x80 [ 1448.006590][T22297] ? inode_doinit_with_dentry+0x70b/0x1320 [ 1448.006617][T22297] alloc_pages_noprof+0x1a/0x160 [ 1448.006639][T22297] get_free_pages_noprof+0x10/0xb0 [ 1448.006658][T22297] inode_doinit_with_dentry+0x788/0x1320 [ 1448.006686][T22297] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 1448.006712][T22297] ? __pfx_inode_doinit_with_dentry+0x10/0x10 [ 1448.006734][T22297] ? ktime_get_coarse_real_ts64_mg+0x249/0x300 [ 1448.006768][T22297] selinux_d_instantiate+0x26/0x40 [ 1448.006791][T22297] security_d_instantiate+0x14c/0x1b0 [ 1448.006820][T22297] d_splice_alias_ops+0xd7/0x1320 [ 1448.006844][T22297] ? do_raw_spin_unlock+0x145/0x1e0 [ 1448.006870][T22297] ? __pfx_d_splice_alias_ops+0x10/0x10 [ 1448.006892][T22297] ? set_nlink+0xb4/0x190 [ 1448.006920][T22297] proc_lookup_de+0x29c/0x360 [ 1448.006951][T22297] proc_lookup+0xcf/0x110 [ 1448.006977][T22297] proc_root_lookup+0x3b/0x70 [ 1448.007004][T22297] __lookup_slow+0x251/0x460 [ 1448.007032][T22297] ? __pfx___lookup_slow+0x10/0x10 [ 1448.007080][T22297] lookup_slow+0x50/0x70 [ 1448.007108][T22297] link_path_walk+0x1377/0x1cc0 [ 1448.007137][T22297] path_openat+0x1be/0x31a0 [ 1448.007158][T22297] ? kasan_save_stack+0x3f/0x50 [ 1448.007183][T22297] ? kasan_save_stack+0x30/0x50 [ 1448.007208][T22297] ? kasan_save_track+0x14/0x30 [ 1448.007223][T22297] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 1448.007256][T22297] ? __pfx_path_openat+0x10/0x10 [ 1448.007290][T22297] do_file_open+0x20e/0x430 [ 1448.007314][T22297] ? __pfx_do_file_open+0x10/0x10 [ 1448.007357][T22297] ? alloc_fd+0x476/0x790 [ 1448.007383][T22297] ? do_getname+0x191/0x390 [ 1448.007412][T22297] do_sys_openat2+0x10d/0x1e0 [ 1448.007441][T22297] ? __pfx_do_sys_openat2+0x10/0x10 [ 1448.007462][T22297] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1448.007487][T22297] ? __fget_files+0x21f/0x3d0 [ 1448.007515][T22297] __x64_sys_openat+0x12d/0x210 [ 1448.007539][T22297] ? __pfx___x64_sys_openat+0x10/0x10 [ 1448.007562][T22297] ? ksys_write+0x1ac/0x250 [ 1448.007585][T22297] ? rcu_is_watching+0x12/0xc0 [ 1448.007616][T22297] do_syscall_64+0x10b/0xf80 [ 1448.007637][T22297] ? clear_bhb_loop+0x40/0x90 [ 1448.007660][T22297] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1448.007679][T22297] RIP: 0033:0x7f8d5639cdd9 [ 1448.007694][T22297] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1448.007710][T22297] RSP: 002b:00007f8d57218028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1448.007727][T22297] RAX: ffffffffffffffda RBX: 00007f8d56615fa0 RCX: 00007f8d5639cdd9 [ 1448.007738][T22297] RDX: 0000000000000100 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 1448.007750][T22297] RBP: 00007f8d57218090 R08: 0000000000000000 R09: 0000000000000000 [ 1448.007761][T22297] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1448.007772][T22297] R13: 00007f8d56616038 R14: 00007f8d56615fa0 R15: 00007ffda6f686e8 [ 1448.007798][T22297] [ 1448.541406][ T991] snd_usb_pod 8-1:1.1: set_interface failed [ 1448.547656][T22324] program syz.5.3856 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1448.562934][ T991] snd_usb_pod 8-1:1.1: Line 6 Pocket POD now disconnected [ 1448.570268][ T991] snd_usb_pod 8-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 1448.582212][ T991] usb 8-1: USB disconnect, device number 101 [ 1448.999449][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1449.116633][ T30] audit: type=1400 audit(2000000306.910:1482): avc: denied { write } for pid=22317 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1449.400020][ T30] audit: type=1400 audit(2000000307.200:1483): avc: denied { write } for pid=22345 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1449.609130][T14549] usb 2-1: new full-speed USB device number 66 using dummy_hcd [ 1449.628402][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1449.809433][T14549] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 1449.829877][T14549] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1449.869749][T14549] usb 2-1: config 0 has no interface number 0 [ 1449.876136][T22360] 9p: Bad value for 'wfdno' [ 1449.884920][ T30] audit: type=1400 audit(2000000563.667:1484): avc: denied { mounton } for pid=22356 comm="syz.3.3864" path="/syzcgroup/unified/syz3/pids.max" dev="cgroup2" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 1449.923623][T14549] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1449.940825][T14549] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1449.978779][T14549] usb 2-1: Product: syz [ 1449.994417][T14549] usb 2-1: Manufacturer: syz [ 1450.009412][T14549] usb 2-1: SerialNumber: syz [ 1450.029028][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1450.042243][T14549] usb 2-1: config 0 descriptor?? [ 1450.075665][T14549] hub 2-1:0.31: bad descriptor, ignoring hub [ 1450.091442][T14549] hub 2-1:0.31: probe with driver hub failed with error -5 [ 1450.120694][T14549] uvcvideo 2-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 1450.130913][T14549] uvcvideo 2-1:0.31: Entity type for entity Output 32774 was not initialized! [ 1450.179418][T14549] uvcvideo 2-1:0.31: Failed to create links for entity 32774 [ 1450.210965][T14549] uvcvideo 2-1:0.31: Failed to register entities (-22). [ 1450.734048][ T30] audit: type=1400 audit(2000000564.527:1485): avc: denied { write } for pid=22355 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1450.790339][ T991] usb 2-1: USB disconnect, device number 66 [ 1450.920466][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1450.963543][T22384] netlink: 'syz.2.3868': attribute type 11 has an invalid length. [ 1451.050883][T22386] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=22386 comm=syz.7.3867 [ 1451.399789][ T30] audit: type=1400 audit(2000000565.187:1486): avc: denied { write } for pid=22385 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1451.424547][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1451.568800][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1451.577639][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1451.616424][ T30] audit: type=1400 audit(2000000565.407:1487): avc: denied { node_bind } for pid=22394 comm="syz.5.3870" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 1451.724146][T22389] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3869'. [ 1451.733174][T22389] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3869'. [ 1452.042514][ T30] audit: type=1400 audit(2000000565.837:1488): avc: denied { write } for pid=22391 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1452.267808][ T30] audit: type=1400 audit(2000000566.017:1489): avc: denied { write } for pid=22419 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1452.387291][T22427] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3876'. [ 1452.669505][T14549] net_ratelimit: 1 callbacks suppressed [ 1452.669529][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1454.017864][T22442] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3877'. [ 1454.229716][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1454.242211][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1456.072582][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1456.541815][T22456] No source specified [ 1456.851307][ T30] audit: type=1400 audit(2000000570.647:1490): avc: denied { write } for pid=22423 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1457.149191][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1457.308469][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1457.317254][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1457.340985][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1457.375474][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1457.417802][ T30] audit: type=1400 audit(2000000571.207:1491): avc: denied { write } for pid=22471 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1457.647801][T15215] usb 8-1: new high-speed USB device number 102 using dummy_hcd [ 1457.716503][T22470] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.3885'. [ 1457.727820][T22470] veth0_to_bond: default FDB implementation only supports local addresses [ 1457.797456][T22470] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3885'. [ 1457.831752][T15215] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1457.843524][T15215] usb 8-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1457.856645][T15215] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1457.899209][T15215] usb 8-1: config 0 descriptor?? [ 1458.427994][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1458.440503][T15215] usbhid 8-1:0.0: can't add hid device: -71 [ 1458.460371][T15215] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 1458.521984][T15215] usb 8-1: USB disconnect, device number 102 [ 1458.575124][ T30] audit: type=1400 audit(2000000572.367:1492): avc: denied { write } for pid=22477 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1458.764004][T22492] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3886'. [ 1458.773291][T22492] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3886'. [ 1459.392171][T19527] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1460.349021][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1460.406400][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1460.451594][ T30] audit: type=1400 audit(2000000574.247:1493): avc: denied { write } for pid=22494 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1460.517647][T22499] netlink: 1047 bytes leftover after parsing attributes in process `syz.5.3888'. [ 1460.527069][T22499] veth0_to_bond: default FDB implementation only supports local addresses [ 1460.575333][T22499] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3888'. [ 1461.863986][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1462.527783][ T991] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 1462.717843][ T30] audit: type=1400 audit(2000000576.497:1494): avc: denied { write } for pid=22507 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1462.798084][ T991] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1462.839096][ T991] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1462.861587][ T30] audit: type=1400 audit(2000000576.657:1495): avc: denied { write } for pid=22529 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1462.867033][ T991] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1462.909164][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1462.945471][ T30] audit: type=1400 audit(2000000576.737:1496): avc: denied { write } for pid=22531 comm="syz.7.3894" path="socket:[77915]" dev="sockfs" ino=77915 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1463.044538][ T991] usb 4-1: config 0 descriptor?? [ 1463.068665][T17207] block nbd1: Possible stuck request ffff888027e2e000: control (read@0,1024B). Runtime 90 seconds [ 1463.080312][T17207] block nbd1: Possible stuck request ffff888027e2e1c0: control (read@1024,1024B). Runtime 90 seconds [ 1463.092995][T17207] block nbd1: Possible stuck request ffff888027e2e380: control (read@2048,1024B). Runtime 90 seconds [ 1463.104188][T17207] block nbd1: Possible stuck request ffff888027e2e540: control (read@3072,1024B). Runtime 90 seconds [ 1463.283641][ T30] audit: type=1400 audit(2000000577.077:1497): avc: denied { setattr } for pid=22538 comm="syz.5.3896" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1463.332117][ T991] usbhid 4-1:0.0: can't add hid device: -71 [ 1463.352800][ T991] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1463.381031][ T991] usb 4-1: USB disconnect, device number 8 [ 1463.469608][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1463.948372][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1464.281224][T22557] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3892'. [ 1464.290661][T22557] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3892'. [ 1465.035501][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1466.415836][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1466.469810][T22570] uprobe: syz.1.3903:22570 failed to unregister, leaking uprobe [ 1466.550473][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1466.554588][T22566] overlayfs: overlapping lowerdir path [ 1466.914448][ T991] kernel write not supported for file /input/mice (pid: 991 comm: kworker/0:3) [ 1467.009055][T22566] program syz.7.3902 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1467.139963][T22582] macvtap1: entered allmulticast mode [ 1467.145473][T22582] dummy0: entered allmulticast mode [ 1467.163495][T22582] dummy0: entered promiscuous mode [ 1467.240336][T22582] dummy0: left allmulticast mode [ 1467.468619][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1467.539952][ T991] dummy0: left promiscuous mode [ 1467.967615][T22602] program syz.3.3911 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1468.510242][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1468.828403][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1469.846586][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1469.866454][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1470.240389][T22624] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3916'. [ 1470.371618][T22628] overlayfs: failed to clone lowerpath [ 1470.908537][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1471.095044][T22648] dlm: Unknown command passed to DLM device : 8 [ 1471.095044][T22648] [ 1471.324525][T22654] overlayfs: overlapping lowerdir path [ 1471.441935][T22657] program syz.5.3925 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1471.494909][T22656] program syz.7.3926 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1471.948494][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1472.047977][ T29] usb 2-1: new full-speed USB device number 67 using dummy_hcd [ 1472.207904][ T29] usb 2-1: device descriptor read/64, error -71 [ 1472.458843][ T29] usb 2-1: new full-speed USB device number 68 using dummy_hcd [ 1472.619416][ T29] usb 2-1: device descriptor read/64, error -71 [ 1472.739399][ T29] usb usb2-port1: attempt power cycle [ 1472.803537][T22681] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3932'. [ 1472.908921][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1472.992166][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1473.108504][ T29] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 1473.138631][ T29] usb 2-1: device descriptor read/8, error -71 [ 1473.167909][T14549] usb 8-1: new high-speed USB device number 103 using dummy_hcd [ 1473.339526][T14549] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1473.365891][T14549] usb 8-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1473.384400][T22700] nbd: must specify a device to reconfigure [ 1473.387578][T14549] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1473.393769][T22700] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3938'. [ 1473.399930][ T29] usb 2-1: new full-speed USB device number 70 using dummy_hcd [ 1473.430166][T14549] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1473.449696][ T29] usb 2-1: device descriptor read/8, error -71 [ 1473.461040][T22694] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1473.476199][T14549] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 1473.577971][ T29] usb usb2-port1: unable to enumerate USB device [ 1473.890649][T14549] usb 8-1: USB disconnect, device number 103 [ 1474.031527][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1474.067026][ T30] audit: type=1400 audit(2000000587.857:1498): avc: denied { sys_admin } for pid=22709 comm="syz.2.3940" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 1474.114022][T22705] netlink: 112 bytes leftover after parsing attributes in process `syz.7.3937'. [ 1474.612609][ T30] audit: type=1400 audit(2000000588.407:1499): avc: denied { ioctl } for pid=22716 comm="syz.3.3942" path="socket:[79013]" dev="sockfs" ino=79013 ioctlcmd=0x894c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1474.877860][ T29] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 1475.027763][ T29] usb 4-1: Using ep0 maxpacket: 32 [ 1475.034750][ T29] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1475.047474][ T29] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1475.056989][ T29] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1475.065527][ T29] usb 4-1: Product: syz [ 1475.072782][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1475.084504][ T29] usb 4-1: Manufacturer: syz [ 1475.089801][ T29] usb 4-1: SerialNumber: syz [ 1475.110504][ T29] usb 4-1: config 0 descriptor?? [ 1475.118510][T22717] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1475.687661][T22734] Cannot find add_set index 0 as target [ 1475.982875][T22734] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 1475.991496][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1476.108726][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1476.120838][T22741] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3950'. [ 1476.154579][ T5346] usb 4-1: USB disconnect, device number 9 [ 1476.878205][ T5346] usb 8-1: new high-speed USB device number 104 using dummy_hcd [ 1477.152040][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1477.267772][ T5346] usb 8-1: device descriptor read/64, error -71 [ 1477.404775][T22760] FAULT_INJECTION: forcing a failure. [ 1477.404775][T22760] name failslab, interval 1, probability 0, space 0, times 0 [ 1477.418662][T22760] CPU: 1 UID: 0 PID: 22760 Comm: syz.1.3957 Tainted: G L syzkaller #0 PREEMPT(full) [ 1477.418681][T22760] Tainted: [L]=SOFTLOCKUP [ 1477.418685][T22760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1477.418692][T22760] Call Trace: [ 1477.418696][T22760] [ 1477.418700][T22760] dump_stack_lvl+0x100/0x190 [ 1477.418719][T22760] should_fail_ex.cold+0x5/0xa [ 1477.418734][T22760] should_failslab+0xc2/0x120 [ 1477.418747][T22760] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 1477.418763][T22760] ? skb_clone+0x190/0x400 [ 1477.418782][T22760] skb_clone+0x190/0x400 [ 1477.418799][T22760] netlink_deliver_tap+0xaed/0xcc0 [ 1477.418815][T22760] netlink_unicast+0x62b/0x850 [ 1477.418830][T22760] ? __pfx_netlink_unicast+0x10/0x10 [ 1477.418842][T22760] ? __build_skb_around+0x278/0x390 [ 1477.418859][T22760] netlink_sendmsg+0x8b0/0xda0 [ 1477.418875][T22760] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1477.418887][T22760] ? pti_set_user_pgtbl+0x30/0x50 [ 1477.418912][T22760] ____sys_sendmsg+0x9e1/0xb70 [ 1477.418931][T22760] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1477.418954][T22760] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1477.418983][T22760] ___sys_sendmsg+0x190/0x1e0 [ 1477.418998][T22760] ? __pfx____sys_sendmsg+0x10/0x10 [ 1477.419028][T22760] __sys_sendmsg+0x170/0x220 [ 1477.419045][T22760] ? __pfx___sys_sendmsg+0x10/0x10 [ 1477.419066][T22760] ? fd_install+0x24f/0x580 [ 1477.419080][T22760] ? rcu_is_watching+0x12/0xc0 [ 1477.419098][T22760] do_syscall_64+0x10b/0xf80 [ 1477.419111][T22760] ? clear_bhb_loop+0x40/0x90 [ 1477.419128][T22760] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1477.419140][T22760] RIP: 0033:0x7fa33259cdd9 [ 1477.419150][T22760] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1477.419160][T22760] RSP: 002b:00007fa33348f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1477.419172][T22760] RAX: ffffffffffffffda RBX: 00007fa332815fa0 RCX: 00007fa33259cdd9 [ 1477.419178][T22760] RDX: 000000000000c000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1477.419185][T22760] RBP: 00007fa33348f090 R08: 0000000000000000 R09: 0000000000000000 [ 1477.419191][T22760] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1477.419197][T22760] R13: 00007fa332816038 R14: 00007fa332815fa0 R15: 00007ffd1b7778d8 [ 1477.419211][T22760] [ 1477.705909][T22760] netlink: set zone limit has 4 unknown bytes [ 1477.717822][ T5346] usb 8-1: new high-speed USB device number 105 using dummy_hcd [ 1477.738449][T19813] usb 6-1: new full-speed USB device number 101 using dummy_hcd [ 1477.848981][ T5346] usb 8-1: device descriptor read/64, error -71 [ 1477.866416][T22765] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3959'. [ 1477.867868][T19813] usb 6-1: device descriptor read/64, error -71 [ 1478.127885][T15215] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 1478.247085][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1478.256901][ T5346] usb usb8-port1: attempt power cycle [ 1478.287790][T15215] usb 2-1: Using ep0 maxpacket: 32 [ 1478.294376][T15215] usb 2-1: config 0 has an invalid interface number: 146 but max is 0 [ 1478.302738][T15215] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1478.313092][T15215] usb 2-1: config 0 has no interface number 0 [ 1478.319731][T15215] usb 2-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0x1C, changing to 0xC [ 1478.331614][T15215] usb 2-1: config 0 interface 146 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 1478.342379][T15215] usb 2-1: config 0 interface 146 altsetting 0 bulk endpoint 0xC has invalid maxpacket 0 [ 1478.354899][T15215] usb 2-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1478.366668][T15215] usb 2-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1478.377773][T19813] usb 6-1: new full-speed USB device number 102 using dummy_hcd [ 1478.378323][T15215] usb 2-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1478.395893][T15215] usb 2-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1478.407626][T15215] usb 2-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1478.417871][T15215] usb 2-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1478.428700][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1478.438475][T15215] usb 2-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1478.447557][T15215] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1478.455704][T15215] usb 2-1: Product: syz [ 1478.460053][T15215] usb 2-1: Manufacturer: syz [ 1478.464715][T15215] usb 2-1: SerialNumber: syz [ 1478.471380][T15215] usb 2-1: config 0 descriptor?? [ 1478.476912][T22765] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1478.486892][T15215] usb 2-1: will this work? Command EP is not usually 12 [ 1478.494049][T15215] usb 2-1: will this work? Response EP is not usually 3 [ 1478.501110][T15215] usb 2-1: will this work? Image data EP is not usually 2 [ 1478.508044][T19813] usb 6-1: device descriptor read/64, error -71 [ 1478.516116][T15215] scsi host1: microtekX6 [ 1478.526501][T13490] usb 2-1: error -90 submitting URB [ 1478.550519][ T25] usb 2-1: error -90 submitting URB [ 1478.598091][ T25] usb 2-1: error -90 submitting URB [ 1478.603485][ T5346] usb 8-1: new high-speed USB device number 106 using dummy_hcd [ 1478.623492][T19813] usb usb6-port1: attempt power cycle [ 1478.649543][ T25] usb 2-1: error -90 submitting URB [ 1478.676699][ T5346] usb 8-1: device descriptor read/8, error -71 [ 1478.725422][T22774] fuse: fd is not a fuse device [ 1478.735252][ T30] audit: type=1400 audit(2000000592.527:1500): avc: denied { read write } for pid=22772 comm="getty" name="utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 1478.800108][ T30] audit: type=1400 audit(2000000592.557:1501): avc: denied { open } for pid=22772 comm="getty" path="/run/utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 1478.822983][ T30] audit: type=1400 audit(2000000592.557:1502): avc: denied { lock } for pid=22772 comm="getty" path="/run/utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 1478.827584][ T991] usb 2-1: USB disconnect, device number 71 [ 1478.856256][ T30] audit: type=1400 audit(2000000592.557:1503): avc: denied { read } for pid=22772 comm="getty" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 syzkaller syzkaller login: [ 1478.970165][ T5346] usb 8-1: new high-speed USB device number 107 using dummy_hcd [ 1478.979196][ T30] audit: type=1400 audit(2000000592.747:1504): avc: denied { create } for pid=22777 comm="syz.2.3963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1478.987960][T19813] usb 6-1: new full-speed USB device number 103 using dummy_hcd [ 1479.009634][ T5346] usb 8-1: device descriptor read/8, error -71 [ 1479.021003][T15215] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 1479.048585][T19813] usb 6-1: device descriptor read/8, error -71 [ 1479.072220][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1479.081009][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 1479.144220][ T5346] usb usb8-port1: unable to enumerate USB device [ 1479.199104][T15215] usb 4-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 1479.208426][T15215] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1479.218963][T15215] usb 4-1: config 0 descriptor?? [ 1479.287819][T19813] usb 6-1: new full-speed USB device number 104 using dummy_hcd [ 1479.309512][T19813] usb 6-1: device descriptor read/8, error -71 [ 1479.318002][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1479.418838][T19813] usb usb6-port1: unable to enumerate USB device [ 1479.869899][ T30] audit: type=1400 audit(2000000593.667:1505): avc: denied { write } for pid=22792 comm="syz.7.3968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1479.892765][T22793] netlink: 84 bytes leftover after parsing attributes in process `syz.7.3968'. [ 1479.904472][T22793] nbd: must specify at least one socket [ 1479.911404][ T30] audit: type=1400 audit(2000000593.667:1506): avc: denied { read } for pid=22792 comm="syz.7.3968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1480.039829][T15215] hackrf 4-1:0.0: usb_control_msg() failed -71 request 0e [ 1480.073196][T15215] hackrf 4-1:0.0: Could not detect board [ 1480.097134][T15215] hackrf 4-1:0.0: probe with driver hackrf failed with error -71 [ 1480.130161][T15215] usb 4-1: USB disconnect, device number 10 [ 1480.360039][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1480.858334][T22809] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3969'. [ 1481.389235][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1481.851407][ T30] audit: type=1400 audit(2000000595.647:1507): avc: denied { read } for pid=22830 comm="syz.5.3981" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1481.958654][ T30] audit: type=1400 audit(2000000595.647:1508): avc: denied { open } for pid=22830 comm="syz.5.3981" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1482.039192][ T30] audit: type=1400 audit(2000000595.647:1509): avc: denied { ioctl } for pid=22830 comm="syz.5.3981" path="/dev/dri/card1" dev="devtmpfs" ino=628 ioctlcmd=0x64a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1482.108884][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1482.227828][ T5346] usb 2-1: new full-speed USB device number 72 using dummy_hcd [ 1482.432549][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1482.477832][ T5346] usb 2-1: device descriptor read/64, error -71 [ 1482.546674][T22845] overlay: ./file0 is not a directory [ 1483.223729][ T30] audit: type=1400 audit(2000000597.017:1510): avc: denied { write } for pid=22856 comm="syz.7.3987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1483.316540][ T5346] usb 2-1: new full-speed USB device number 73 using dummy_hcd [ 1483.367872][ T30] audit: type=1400 audit(2000000597.017:1511): avc: denied { nlmsg_write } for pid=22856 comm="syz.7.3987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1483.408252][T22860] tmpfs: Bad value for 'mpol' [ 1483.470096][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1483.528775][ T5346] usb 2-1: device descriptor read/64, error -71 [ 1483.640751][ T5346] usb usb2-port1: attempt power cycle [ 1483.702221][T22873] lo speed is unknown, defaulting to 1000 [ 1483.997797][ T5346] usb 2-1: new full-speed USB device number 74 using dummy_hcd [ 1484.069386][ T30] audit: type=1326 audit(2000000597.857:1512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22872 comm="syz.3.3993" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9cf919cdd9 code=0x0 [ 1484.100869][ T5346] usb 2-1: device descriptor read/8, error -71 [ 1484.174679][T22888] overlayfs: overlapping lowerdir path [ 1484.247243][T22891] program syz.7.3996 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1484.348126][ T5346] usb 2-1: new full-speed USB device number 75 using dummy_hcd [ 1484.388326][ T5346] usb 2-1: device descriptor read/8, error -71 [ 1484.508560][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1484.517088][ T5346] usb usb2-port1: unable to enumerate USB device [ 1484.608354][T19813] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 1484.779411][T19813] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1484.796081][T19813] usb 6-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 1484.823758][T19813] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1484.856604][T19813] usb 6-1: config 0 descriptor?? [ 1485.085651][T22904] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.4001'. [ 1485.100310][T22904] veth0_to_bond: default FDB implementation only supports local addresses [ 1485.140572][T22907] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4001'. [ 1485.167339][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1485.300846][T19813] hid_mf 0003:0079:1846.001C: unknown main item tag 0x0 [ 1485.343857][T19813] hid_mf 0003:0079:1846.001C: unknown main item tag 0x0 [ 1485.373525][T19813] hid_mf 0003:0079:1846.001C: unknown main item tag 0x0 [ 1485.402151][T19813] hid_mf 0003:0079:1846.001C: unknown main item tag 0x0 [ 1485.432778][T19813] hid_mf 0003:0079:1846.001C: unknown main item tag 0x0 [ 1485.464808][T19813] hid_mf 0003:0079:1846.001C: unknown main item tag 0x0 [ 1485.492243][T19813] hid_mf 0003:0079:1846.001C: invalid report_count 12610 [ 1485.520778][T22893] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3997'. [ 1485.532246][T19813] hid_mf 0003:0079:1846.001C: item 0 2 1 9 parsing failed [ 1485.562367][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1485.573266][T19813] hid_mf 0003:0079:1846.001C: HID parse failed. [ 1485.600099][T19813] hid_mf 0003:0079:1846.001C: probe with driver hid_mf failed with error -22 [ 1485.629250][T22893] bond1: entered promiscuous mode [ 1485.654358][T22893] bond1: entered allmulticast mode [ 1485.689087][T14370] usb 6-1: USB disconnect, device number 105 [ 1485.822329][T22910] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.4002'. [ 1485.859444][T22910] veth0_to_bond: default FDB implementation only supports local addresses [ 1485.984168][T22909] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4002'. [ 1486.588612][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1487.665809][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1487.928100][ T991] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 1488.044683][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1488.139051][ T991] usb 6-1: Using ep0 maxpacket: 16 [ 1488.150850][ T991] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 1488.160837][ T991] usb 6-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 1488.172292][ T991] usb 6-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 1488.504133][T22969] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1488.512820][T22969] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 1488.523386][T22969] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1488.531173][T22969] F2FS-fs (loop7): Can't find valid F2FS filesystem in 2th superblock [ 1488.544227][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1488.553158][ T991] usb 6-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 1488.563518][ T991] usb 6-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 1488.600501][ T991] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1488.609569][ T991] usb 6-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 1488.618895][ T991] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1488.635131][ T991] ums-sddr09 6-1:1.0: USB Mass Storage device detected [ 1488.668663][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1488.969063][T22958] __vm_enough_memory: pid: 22958, comm: syz.5.4016, bytes: 4503599627366400 not enough memory for the allocation [ 1489.015320][T22958] netlink: 10 bytes leftover after parsing attributes in process `syz.5.4016'. [ 1489.408696][ T30] audit: type=1400 audit(2000000602.957:1513): avc: denied { ioctl } for pid=22984 comm="syz.3.4023" path="socket:[79674]" dev="sockfs" ino=79674 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1489.711979][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1490.304435][ T991] ums-sddr09 6-1:1.0: probe with driver ums-sddr09 failed with error -22 [ 1490.573253][ T991] usb 6-1: USB disconnect, device number 106 [ 1490.999033][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1491.547973][ T7000] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1491.753885][T23004] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.4027'. [ 1491.828933][T23004] veth0_to_bond: default FDB implementation only supports local addresses [ 1491.936493][T23004] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4027'. [ 1492.032088][ T991] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 1492.050995][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1492.080916][T23013] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1492.363197][ T991] usb 2-1: Using ep0 maxpacket: 16 [ 1492.380827][ T991] usb 2-1: config index 0 descriptor too short (expected 65, got 36) [ 1492.394213][ T991] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1492.624363][ T991] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1492.648078][ T991] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1492.677252][ T991] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1492.695542][ T991] usb 2-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 1492.717396][ T991] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1492.727089][T23025] FAULT_INJECTION: forcing a failure. [ 1492.727089][T23025] name failslab, interval 1, probability 0, space 0, times 0 [ 1492.735467][ T991] usb 2-1: config 0 descriptor?? [ 1492.746126][T23008] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1492.749638][T23025] CPU: 1 UID: 0 PID: 23025 Comm: syz.5.4032 Tainted: G L syzkaller #0 PREEMPT(full) [ 1492.749666][T23025] Tainted: [L]=SOFTLOCKUP [ 1492.749672][T23025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1492.749681][T23025] Call Trace: [ 1492.749687][T23025] [ 1492.749693][T23025] dump_stack_lvl+0x100/0x190 [ 1492.749718][T23025] should_fail_ex.cold+0x5/0xa [ 1492.749740][T23025] ? tomoyo_encode2+0xfb/0x3c0 [ 1492.749761][T23025] should_failslab+0xc2/0x120 [ 1492.749778][T23025] __kmalloc_noprof+0xe0/0x850 [ 1492.749800][T23025] ? d_absolute_path+0x136/0x1b0 [ 1492.749821][T23025] tomoyo_encode2+0xfb/0x3c0 [ 1492.749844][T23025] tomoyo_encode+0x29/0x50 [ 1492.749863][T23025] tomoyo_realpath_from_path+0x18c/0x690 [ 1492.749888][T23025] tomoyo_path_number_perm+0x23c/0x580 [ 1492.749905][T23025] ? tomoyo_path_number_perm+0x22e/0x580 [ 1492.749924][T23025] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1492.749963][T23025] ? find_held_lock+0x2b/0x80 [ 1492.749979][T23025] ? __fget_files+0x215/0x3d0 [ 1492.749997][T23025] ? hook_file_ioctl_common+0x149/0x410 [ 1492.750018][T23025] ? __fget_files+0x215/0x3d0 [ 1492.750040][T23025] ? __fget_files+0x21f/0x3d0 [ 1492.750062][T23025] security_file_ioctl+0xd3/0x230 [ 1492.750083][T23025] __x64_sys_ioctl+0xb7/0x210 [ 1492.750101][T23025] do_syscall_64+0x10b/0xf80 [ 1492.750120][T23025] ? clear_bhb_loop+0x40/0x90 [ 1492.750139][T23025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1492.750155][T23025] RIP: 0033:0x7f11a599cdd9 [ 1492.750168][T23025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1492.750183][T23025] RSP: 002b:00007f11a67cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1492.750200][T23025] RAX: ffffffffffffffda RBX: 00007f11a5c15fa0 RCX: 00007f11a599cdd9 [ 1492.750214][T23025] RDX: 00002000000000c0 RSI: 00000000c0304d18 RDI: 0000000000000004 [ 1492.750224][T23025] RBP: 00007f11a67cc090 R08: 0000000000000000 R09: 0000000000000000 [ 1492.750233][T23025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1492.750242][T23025] R13: 00007f11a5c16038 R14: 00007f11a5c15fa0 R15: 00007ffe5c7b6f98 [ 1492.750264][T23025] [ 1492.750279][T23025] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1492.776627][ T991] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input73 [ 1493.068085][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1493.158767][T17207] block nbd1: Possible stuck request ffff888027e2e000: control (read@0,1024B). Runtime 120 seconds [ 1493.169846][T17207] block nbd1: Possible stuck request ffff888027e2e1c0: control (read@1024,1024B). Runtime 120 seconds [ 1493.180925][T17207] block nbd1: Possible stuck request ffff888027e2e380: control (read@2048,1024B). Runtime 120 seconds [ 1493.193576][T17207] block nbd1: Possible stuck request ffff888027e2e540: control (read@3072,1024B). Runtime 120 seconds [ 1493.796144][T23043] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=23043 comm=syz.2.4036 [ 1493.847922][T23044] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=23044 comm=syz.2.4036 [ 1493.900191][T23043] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 1494.038657][ T30] audit: type=1400 audit(2000000607.837:1514): avc: denied { append } for pid=23006 comm="syz.1.4029" name="event0" dev="devtmpfs" ino=918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1494.067515][ T30] audit: type=1400 audit(2000000607.857:1515): avc: denied { append } for pid=23006 comm="syz.1.4029" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1494.103045][T23029] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4029'. [ 1494.112496][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1494.441480][T23050] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.4039'. [ 1494.480466][T23050] veth0_to_bond: default FDB implementation only supports local addresses [ 1494.546690][T23050] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4039'. [ 1494.589057][T13485] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1494.600716][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1494.627210][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1495.373974][T19572] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1495.394358][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1495.669738][T23029] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1495.709924][T14549] usb 2-1: USB disconnect, device number 76 [ 1495.717312][T23029] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1495.750611][T23058] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.4041'. [ 1495.793127][T23029] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1495.820324][T23058] veth0_to_bond: default FDB implementation only supports local addresses [ 1495.829420][T23062] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4041'. [ 1496.112168][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1496.183478][T23068] Non-string source [ 1496.267793][ T5620] Bluetooth: hci1: command 0x0405 tx timeout [ 1496.381350][T23029] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1496.872311][T23029] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1496.920801][T23029] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1496.928036][T23029] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1496.955604][T23029] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1497.045480][T23029] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1497.149070][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1497.225975][T23029] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1497.716141][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1497.743165][T13483] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1497.752597][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1497.774474][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1497.789734][ T5620] Bluetooth: hci2: command 0x0406 tx timeout [ 1498.154767][T23102] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 1498.190324][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1498.427914][ T5620] Bluetooth: hci3: command 0x0406 tx timeout [ 1498.988094][ T5620] Bluetooth: hci5: command 0x0c1a tx timeout [ 1498.988176][ T5620] Bluetooth: hci4: command 0x0406 tx timeout [ 1499.234422][T19813] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1499.243949][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1499.419264][T19813] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1499.429947][T19813] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1499.441369][T19813] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1499.450723][T19813] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1499.459998][T19813] usb 4-1: Product: syz [ 1499.464709][T19813] usb 4-1: Manufacturer: syz [ 1499.493610][T19813] usb 4-1: SerialNumber: syz [ 1499.527357][T19813] usb 4-1: config 0 descriptor?? [ 1499.539683][T23117] netlink: 1047 bytes leftover after parsing attributes in process `syz.5.4055'. [ 1499.551164][T23117] veth0_to_bond: default FDB implementation only supports local addresses [ 1499.567519][T19813] usb 4-1: selecting invalid altsetting 0 [ 1499.586994][T23117] netlink: 48 bytes leftover after parsing attributes in process `syz.5.4055'. [ 1499.878102][T23114] Bluetooth: hci2: command 0x0406 tx timeout [ 1499.976996][T15215] usb 4-1: USB disconnect, device number 11 [ 1499.999845][T23131] overlayfs: failed to clone lowerpath [ 1500.010731][T23130] fuse: Bad value for 'fd' [ 1500.513519][T23114] Bluetooth: hci3: command 0x0406 tx timeout [ 1501.067747][T23114] Bluetooth: hci4: command 0x0406 tx timeout [ 1501.073801][ T5625] Bluetooth: hci5: command 0x0c1a tx timeout [ 1501.393011][T19814] net_ratelimit: 5 callbacks suppressed [ 1501.393030][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1501.478298][T19572] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1501.487161][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1501.497111][ T991] usb 8-1: new high-speed USB device number 108 using dummy_hcd [ 1501.497243][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1501.547884][T19813] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 1501.697778][T19813] usb 2-1: Using ep0 maxpacket: 32 [ 1501.704463][T19813] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1501.715750][T19813] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1501.733009][ T991] usb 8-1: config 1 interface 0 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1502.142552][T19813] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1502.151783][T19813] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1502.162872][T19813] usb 2-1: config 0 descriptor?? [ 1502.178790][ T991] usb 8-1: config 1 interface 0 has no altsetting 0 [ 1502.192739][ T991] usb 8-1: string descriptor 0 read error: -22 [ 1502.194533][T19813] hub 2-1:0.0: USB hub found [ 1502.205637][ T991] usb 8-1: New USB device found, idVendor=050d, idProduct=3201, bcdDevice= 0.40 [ 1502.216336][ T991] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1502.510071][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1502.936554][ T7000] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1503.157807][T23114] Bluetooth: hci5: command 0x0c1a tx timeout [ 1503.225110][T23168] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1503.235461][T23168] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1503.249450][ T991] belkin 0003:050D:3201.001D: reserved main item tag 0xd [ 1503.264178][ T991] belkin 0003:050D:3201.001D: bogus close delimiter [ 1503.271614][ T991] belkin 0003:050D:3201.001D: item 0 0 2 10 parsing failed [ 1503.279910][ T991] belkin 0003:050D:3201.001D: parse failed [ 1503.285822][ T991] belkin 0003:050D:3201.001D: probe with driver belkin failed with error -22 [ 1503.388852][T13479] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1503.397362][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1503.409661][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1503.418111][ T7000] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1503.451162][T14549] usb 8-1: USB disconnect, device number 108 [ 1503.548367][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1503.557069][T19814] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 1503.571520][ T7000] usb 4-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 25 [ 1503.597746][ T7000] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1503.609578][ T7000] usb 4-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 1503.627718][ T7000] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1503.649720][ T7000] usb 4-1: config 0 descriptor?? [ 1503.720815][T19814] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1503.732347][T19814] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1503.742625][T19814] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1503.765826][T19814] usb 6-1: config 0 descriptor?? [ 1504.022677][T19814] usbhid 6-1:0.0: can't add hid device: -71 [ 1504.041154][T19814] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1504.063339][T19814] usb 6-1: USB disconnect, device number 107 [ 1504.088224][ T7000] usbhid 4-1:0.0: can't add hid device: -71 [ 1504.104441][ T7000] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1504.126521][ T7000] usb 4-1: USB disconnect, device number 12 [ 1504.219048][T19813] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 1504.236069][T19813] usbhid 2-1:0.0: can't add hid device: -71 [ 1504.244593][T19813] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1504.292182][T19813] usb 2-1: USB disconnect, device number 77 [ 1504.327784][T14370] usb 8-1: new high-speed USB device number 109 using dummy_hcd [ 1504.339352][T23175] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4069'. [ 1504.349039][T23175] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4069'. [ 1505.919472][T14370] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1506.434489][ T7000] net_ratelimit: 1 callbacks suppressed [ 1506.434507][ T7000] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1506.467437][T14370] usb 8-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1506.575188][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1506.582798][T14370] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1506.592495][T13488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1506.601452][ T7000] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1506.648617][T14370] usb 8-1: config 0 descriptor?? [ 1506.899708][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1507.349404][T14370] usbhid 8-1:0.0: can't add hid device: -71 [ 1507.433413][T14370] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 1507.471633][T14370] usb 8-1: USB disconnect, device number 109 [ 1507.714928][ T30] audit: type=1400 audit(2000000621.437:1516): avc: denied { create } for pid=23193 comm="syz.7.4076" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1507.948304][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1508.987980][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1509.149197][T19572] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1509.184699][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1509.193615][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1509.812338][T23219] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1511.017611][T23238] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.4088'. [ 1511.072448][T23238] veth0_to_bond: default FDB implementation only supports local addresses [ 1511.111136][T23238] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4088'. [ 1511.267845][ T7000] usb 8-1: new high-speed USB device number 110 using dummy_hcd [ 1511.336097][T23243] netlink: 1047 bytes leftover after parsing attributes in process `syz.5.4089'. [ 1511.351312][T23243] veth0_to_bond: default FDB implementation only supports local addresses [ 1511.459305][ T7000] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1511.491089][T23243] netlink: 48 bytes leftover after parsing attributes in process `syz.5.4089'. [ 1511.501038][ T7000] usb 8-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1511.520446][ T7000] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1511.536808][ T7000] usb 8-1: config 0 descriptor?? [ 1511.561360][T23248] netlink: 'syz.2.4093': attribute type 11 has an invalid length. [ 1511.885945][ T7000] usbhid 8-1:0.0: can't add hid device: -71 [ 1511.950247][ T30] audit: type=1400 audit(2000000625.747:1517): avc: denied { append } for pid=23256 comm="syz.1.4095" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 1511.952727][ T7000] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 1512.034328][T23259] 9p: Bad value for 'rfdno' [ 1512.108602][T14549] net_ratelimit: 3 callbacks suppressed [ 1512.108616][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1512.235450][T23260] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4090'. [ 1512.244660][T23260] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4090'. [ 1512.282026][ T7000] usb 8-1: USB disconnect, device number 110 [ 1512.354578][T19572] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1512.568489][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1513.474581][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1513.537860][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1513.569603][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1514.278148][T14549] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 1514.437801][T14549] usb 2-1: Using ep0 maxpacket: 8 [ 1514.458175][T14549] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1514.488489][T14549] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1514.520932][T14549] usb 2-1: Product: syz [ 1514.536684][T14549] usb 2-1: Manufacturer: syz [ 1514.547885][ T7000] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1514.553199][T14549] usb 2-1: SerialNumber: syz [ 1514.588184][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1514.605833][T14549] usb 2-1: config 0 descriptor?? [ 1514.643280][T23277] overlayfs: failed to resolve '/': -2 [ 1514.760812][ T7000] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1514.777466][ T7000] usb 4-1: can't read configurations, error -22 [ 1514.985619][ T6646] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1514.998144][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1515.014904][T14549] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1515.095056][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1515.107848][ T7000] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1515.260470][ T7000] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1515.272770][ T7000] usb 4-1: can't read configurations, error -22 [ 1515.286846][ T7000] usb usb4-port1: attempt power cycle [ 1515.647880][ T7000] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1515.691507][ T7000] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1515.717522][ T7000] usb 4-1: can't read configurations, error -22 [ 1515.869061][ T7000] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1515.901914][ T7000] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1515.918830][ T7000] usb 4-1: can't read configurations, error -22 [ 1515.932870][ T7000] usb usb4-port1: unable to enumerate USB device [ 1516.745882][T14549] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1516.969057][ T30] audit: type=1400 audit(2000000630.707:1518): avc: denied { setopt } for pid=23294 comm="syz.7.4105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1517.198225][T14549] usb 2-1: USB disconnect, device number 78 [ 1517.492873][T23303] netlink: 'syz.5.4108': attribute type 11 has an invalid length. [ 1517.724795][T14549] net_ratelimit: 3 callbacks suppressed [ 1517.724814][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1517.779912][T23300] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.4107'. [ 1517.790926][T23300] veth0_to_bond: default FDB implementation only supports local addresses [ 1517.997881][T23307] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4107'. [ 1518.218885][T23314] dns_resolver: Unsupported content type (152) [ 1518.325724][T23313] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1518.667970][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1518.748519][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1519.788123][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1520.028499][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1520.115346][T23334] overlayfs: overlapping lowerdir path [ 1520.200490][T23335] program syz.5.4117 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1520.274671][ T30] audit: type=1400 audit(2000000634.067:1519): avc: denied { read write } for pid=23338 comm="syz.3.4119" name="btrfs-control" dev="devtmpfs" ino=1315 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 1520.306746][ T30] audit: type=1400 audit(2000000634.067:1520): avc: denied { open } for pid=23338 comm="syz.3.4119" path="/dev/btrfs-control" dev="devtmpfs" ino=1315 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 1520.599230][T23346] 9p: Bad value for 'wfdno' [ 1520.668581][T13473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1520.677090][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1520.689251][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1520.828789][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1521.077120][T23355] 9p: Bad value for 'rfdno' [ 1521.254110][ T30] audit: type=1400 audit(2000000635.047:1521): avc: denied { create } for pid=23359 comm="syz.1.4127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 1521.718084][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1522.106527][T23378] fuse: fd is not a fuse device [ 1522.172525][T23383] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1522.217519][T23383] FAULT_INJECTION: forcing a failure. [ 1522.217519][T23383] name failslab, interval 1, probability 0, space 0, times 0 [ 1522.230497][T23383] CPU: 0 UID: 0 PID: 23383 Comm: syz.1.4130 Tainted: G L syzkaller #0 PREEMPT(full) [ 1522.230525][T23383] Tainted: [L]=SOFTLOCKUP [ 1522.230531][T23383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1522.230542][T23383] Call Trace: [ 1522.230550][T23383] [ 1522.230558][T23383] dump_stack_lvl+0x100/0x190 [ 1522.230585][T23383] should_fail_ex.cold+0x5/0xa [ 1522.230610][T23383] should_failslab+0xc2/0x120 [ 1522.230630][T23383] __kmalloc_cache_noprof+0x7a/0x6f0 [ 1522.230654][T23383] ? kobject_uevent_env+0x263/0x18b0 [ 1522.230683][T23383] ? irqentry_exit+0x246/0x790 [ 1522.230709][T23383] kobject_uevent_env+0x263/0x18b0 [ 1522.230746][T23383] __kobject_del+0x168/0x220 [ 1522.230772][T23383] kobject_put+0x348/0x640 [ 1522.230799][T23383] software_node_notify_remove+0x1bf/0x230 [ 1522.230831][T23383] device_del+0x38e/0x9b0 [ 1522.230862][T23383] ? __pfx_device_del+0x10/0x10 [ 1522.230887][T23383] ? iommufd_hw_pagetable_detach+0x26f/0x680 [ 1522.230921][T23383] device_unregister+0x1d/0xe0 [ 1522.230953][T23383] iommufd_selftest_destroy+0xbe/0xf0 [ 1522.230975][T23383] iommufd_fops_release+0x1aa/0x3f0 [ 1522.231000][T23383] ? __pfx_iommufd_fops_release+0x10/0x10 [ 1522.231023][T23383] ? __pfx___might_resched+0x10/0x10 [ 1522.231049][T23383] ? ima_file_free+0xc6/0x340 [ 1522.231074][T23383] ? __pfx_iommufd_fops_release+0x10/0x10 [ 1522.231096][T23383] __fput+0x3ff/0xb50 [ 1522.231127][T23383] fput_close_sync+0x118/0x250 [ 1522.231153][T23383] ? __pfx_fput_close_sync+0x10/0x10 [ 1522.231186][T23383] __x64_sys_close+0x8b/0x120 [ 1522.231213][T23383] do_syscall_64+0x10b/0xf80 [ 1522.231233][T23383] ? clear_bhb_loop+0x40/0x90 [ 1522.231256][T23383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1522.231275][T23383] RIP: 0033:0x7fa33259cdd9 [ 1522.231291][T23383] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1522.231308][T23383] RSP: 002b:00007fa33344d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1522.231326][T23383] RAX: ffffffffffffffda RBX: 00007fa332816180 RCX: 00007fa33259cdd9 [ 1522.231338][T23383] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009 [ 1522.231348][T23383] RBP: 00007fa33344d090 R08: 0000000000000000 R09: 0000000000000000 [ 1522.231358][T23383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1522.231369][T23383] R13: 00007fa332816218 R14: 00007fa332816180 R15: 00007ffd1b7778d8 [ 1522.231395][T23383] [ 1522.479097][T19813] usb 4-1: new low-speed USB device number 17 using dummy_hcd [ 1522.619213][T19813] usb 4-1: device descriptor read/64, error -71 [ 1523.260254][ T5346] net_ratelimit: 1 callbacks suppressed [ 1523.260273][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1523.273564][T17207] block nbd1: Possible stuck request ffff888027e2e000: control (read@0,1024B). Runtime 150 seconds [ 1523.291800][T17207] block nbd1: Possible stuck request ffff888027e2e1c0: control (read@1024,1024B). Runtime 150 seconds [ 1523.302970][T17207] block nbd1: Possible stuck request ffff888027e2e380: control (read@2048,1024B). Runtime 150 seconds [ 1523.315978][T17207] block nbd1: Possible stuck request ffff888027e2e540: control (read@3072,1024B). Runtime 150 seconds [ 1523.397860][T19813] usb 4-1: new low-speed USB device number 18 using dummy_hcd [ 1523.400900][ T30] audit: type=1400 audit(2000000637.177:1522): avc: denied { read write } for pid=23395 comm="syz.1.4137" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 1523.430858][ T30] audit: type=1400 audit(2000000637.197:1523): avc: denied { open } for pid=23395 comm="syz.1.4137" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 1523.557995][T19813] usb 4-1: device descriptor read/64, error -71 [ 1523.678077][T19813] usb usb4-port1: attempt power cycle [ 1524.010395][T23403] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4139'. [ 1524.019448][T23403] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4139'. [ 1524.152155][T23415] kvm: pic: non byte read [ 1524.158483][T23415] kvm: pic: non byte read [ 1524.163018][T23415] kvm: pic: non byte read [ 1524.167434][T23415] kvm: pic: non byte read [ 1524.172302][T23415] kvm: pic: non byte read [ 1524.176902][T23415] kvm: pic: non byte read [ 1524.182475][T23415] kvm: pic: non byte read [ 1524.187055][T23415] kvm: pic: non byte read [ 1524.192139][T23415] kvm: pic: non byte read [ 1524.196568][T23415] kvm: pic: non byte read [ 1524.249366][T19813] usb 4-1: new low-speed USB device number 19 using dummy_hcd [ 1524.268103][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1524.278217][T19813] usb 4-1: device descriptor read/8, error -71 [ 1524.549805][T19813] usb 4-1: new low-speed USB device number 20 using dummy_hcd [ 1524.858872][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1524.920419][T19813] usb 4-1: device descriptor read/8, error -71 [ 1525.063757][T19813] usb usb4-port1: unable to enumerate USB device [ 1525.543826][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1525.898862][ T30] audit: type=1400 audit(2000000639.687:1524): avc: denied { accept } for pid=23438 comm="syz.1.4148" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1525.965424][T23433] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.4146'. [ 1526.083460][T23433] veth0_to_bond: default FDB implementation only supports local addresses [ 1526.438017][T13473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1526.511954][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1526.520872][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1526.546878][T23433] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4146'. [ 1526.591286][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1526.664117][T23456] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4151'. [ 1527.181239][ T30] audit: type=1400 audit(2000000640.977:1525): avc: denied { write } for pid=23422 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1527.278569][T23467] netlink: 48 bytes leftover after parsing attributes in process `syz.7.4155'. [ 1527.351224][T23470] netlink: 209852 bytes leftover after parsing attributes in process `syz.7.4155'. [ 1527.436836][T23467] bond1: Unable to set peer notification delay as MII monitoring is disabled [ 1527.526107][T23467] bond1 (unregistering): Released all slaves [ 1527.627945][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1527.734655][ T30] audit: type=1400 audit(2000000641.527:1526): avc: denied { write } for pid=23473 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1527.868180][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1528.314214][T23484] netlink: 'syz.1.4156': attribute type 11 has an invalid length. [ 1528.681171][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1528.752468][ T30] audit: type=1400 audit(2000000642.547:1527): avc: denied { ioctl } for pid=23492 comm="syz.5.4159" path="socket:[81391]" dev="sockfs" ino=81391 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1528.793845][ T30] audit: type=1400 audit(2000000642.587:1528): avc: denied { write } for pid=23476 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1529.377548][ T991] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 1529.417224][T23486] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4157'. [ 1529.426378][T23486] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4157'. [ 1529.469359][ T30] audit: type=1400 audit(2000000643.267:1529): avc: denied { write } for pid=23496 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1529.624954][ T991] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1529.637338][ T991] usb 2-1: string descriptor 0 read error: -22 [ 1529.645509][ T991] usb 2-1: New USB device found, idVendor=04fc, idProduct=05d8, bcdDevice= 0.40 [ 1529.665447][ T991] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1530.215616][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1530.589140][ T991] sunplus 0003:04FC:05D8.001E: reserved main item tag 0xd [ 1530.621932][ T991] sunplus 0003:04FC:05D8.001E: unknown global tag 0xc [ 1530.651899][ T991] sunplus 0003:04FC:05D8.001E: item 0 2 1 12 parsing failed [ 1530.681290][ T991] sunplus 0003:04FC:05D8.001E: probe with driver sunplus failed with error -22 [ 1530.908974][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1531.228705][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1532.923184][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1532.973658][T13481] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1532.986274][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1533.280239][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1533.652586][ T991] usb 2-1: USB disconnect, device number 79 [ 1533.691249][ T30] audit: type=1400 audit(2000000647.487:1530): avc: denied { bind } for pid=23548 comm="syz.5.4174" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1533.691682][T23549] netlink: 'syz.5.4174': attribute type 10 has an invalid length. [ 1533.742298][T23551] 9p: Bad value for 'rfdno' [ 1533.784464][ T30] audit: type=1400 audit(2000000647.487:1531): avc: denied { setopt } for pid=23548 comm="syz.5.4174" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1533.948338][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1533.956489][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1534.988440][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1534.997592][T23562] syzkaller0: entered promiscuous mode [ 1535.004083][T23562] syzkaller0: entered allmulticast mode [ 1535.228700][T23564] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4179'. [ 1535.237918][T23564] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4179'. [ 1535.281911][T23570] netlink: 'syz.5.4181': attribute type 11 has an invalid length. [ 1535.398110][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1535.466383][T23582] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4183'. [ 1535.884240][T23587] overlayfs: failed to clone upperpath [ 1536.029296][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1537.027729][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1537.080449][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1538.126243][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1538.593547][T13485] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1538.623163][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1538.923313][T23590] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1539.150235][T14549] net_ratelimit: 1 callbacks suppressed [ 1539.150256][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1540.033959][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1540.188447][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1540.509977][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 1540.839788][ T5346] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 1541.099149][ T5346] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1541.119413][ T5346] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1541.142944][ T5346] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1541.172977][ T5346] usb 2-1: config 0 descriptor?? [ 1541.237641][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1541.288662][T19813] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 1541.480566][ T5346] usbhid 2-1:0.0: can't add hid device: -71 [ 1541.495875][T19813] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1541.518057][ T5346] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1541.537754][T19813] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1541.557900][ T5346] usb 2-1: USB disconnect, device number 80 [ 1541.568885][T19813] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1541.608281][T19813] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1541.637738][T19813] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1541.698933][T19813] usb 6-1: config 0 descriptor?? [ 1542.320319][T23644] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4195'. [ 1542.329902][T23644] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4195'. [ 1542.397925][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1543.068023][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1543.646577][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1543.660347][T19813] plantronics 0003:047F:FFFF.001F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 1543.676807][T19813] usb 6-1: USB disconnect, device number 108 [ 1543.833003][T23651] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.4201'. [ 1543.943047][T23651] veth0_to_bond: default FDB implementation only supports local addresses [ 1544.964798][T23651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4201'. [ 1544.981904][T23649] fido_id[23649]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 1544.999993][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1545.191139][T23675] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.4208'. [ 1545.304218][T23675] veth0_to_bond: default FDB implementation only supports local addresses [ 1545.381278][T23686] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4208'. [ 1545.432740][ T30] audit: type=1400 audit(2000000659.217:1532): avc: denied { write } for pid=23647 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1545.449488][T15215] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 1545.627411][ T30] audit: type=1400 audit(2000000659.417:1533): avc: denied { write } for pid=23699 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1545.696087][ T30] audit: type=1326 audit(2000000659.467:1534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23703 comm="syz.2.4213" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f29e719cdd9 code=0x0 [ 1545.826371][T15215] usb 4-1: config 0 has an invalid interface number: 64 but max is 0 [ 1545.888793][T15215] usb 4-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 1545.963929][T23683] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4206'. [ 1545.976996][T15215] usb 4-1: config 0 has no interface number 0 [ 1545.999421][T15215] usb 4-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 1546.029064][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1546.039897][T15215] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1546.057309][T15215] usb 4-1: Product: syz [ 1546.078560][T15215] usb 4-1: Manufacturer: syz [ 1546.104795][T15215] usb 4-1: SerialNumber: syz [ 1546.116025][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1546.151637][T15215] usb 4-1: config 0 descriptor?? [ 1547.068431][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1547.498131][T23679] syzkaller0: entered promiscuous mode [ 1547.531705][T23679] syzkaller0: entered allmulticast mode [ 1547.578052][ C1] 0: reclassify loop, rule prio 0, protocol 800 [ 1547.595931][T15215] uvcvideo 4-1:0.64: Found UVC 0.00 device syz (046d:0823) [ 1548.187973][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1548.233236][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1548.247093][T23725] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.4216'. [ 1548.266775][T15215] uvcvideo 4-1:0.64: No valid video chain found. [ 1548.287558][T23725] veth0_to_bond: default FDB implementation only supports local addresses [ 1548.299862][T15215] usb 4-1: USB disconnect, device number 21 [ 1548.317444][T23725] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4216'. [ 1548.348067][ C1] 0: reclassify loop, rule prio 0, protocol 800 [ 1548.419228][ T30] audit: type=1400 audit(2000000662.217:1535): avc: denied { write } for pid=23713 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1548.468205][ T30] audit: type=1400 audit(2000000662.267:1536): avc: denied { setopt } for pid=23733 comm="syz.5.4218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 1548.543189][ T30] audit: type=1400 audit(2000000662.337:1537): avc: denied { write } for pid=23737 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1548.586259][T23740] overlayfs: failed to clone lowerpath [ 1549.217198][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1549.311699][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1549.377079][T23756] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4224'. [ 1549.617569][T23761] netlink: 'syz.2.4225': attribute type 11 has an invalid length. [ 1549.625457][T23761] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4225'. [ 1550.028493][T23773] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4228'. [ 1550.037429][T23773] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4228'. [ 1550.059458][T23773] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4228'. [ 1550.845922][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1551.130266][T23778] 9p: Bad value for 'rfdno' [ 1551.168659][ T30] audit: type=1400 audit(2000000664.967:1538): avc: denied { append } for pid=23779 comm="syz.1.4231" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1551.483687][T23793] overlayfs: overlapping lowerdir path [ 1552.192004][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1552.307449][T15215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1552.321425][T23791] program syz.3.4235 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1552.620161][T23808] netlink: 'syz.1.4237': attribute type 11 has an invalid length. [ 1552.628395][T23808] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4237'. [ 1553.033307][T23815] trusted_key: encrypted_key: insufficient parameters specified [ 1553.241073][T19813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1553.308209][T17207] block nbd1: Possible stuck request ffff888027e2e000: control (read@0,1024B). Runtime 180 seconds [ 1553.319056][T17207] block nbd1: Possible stuck request ffff888027e2e1c0: control (read@1024,1024B). Runtime 180 seconds [ 1553.330146][T17207] block nbd1: Possible stuck request ffff888027e2e380: control (read@2048,1024B). Runtime 180 seconds [ 1553.347897][T17207] block nbd1: Possible stuck request ffff888027e2e540: control (read@3072,1024B). Runtime 180 seconds [ 1553.371194][T23822] 9p: Bad value for 'rfdno' [ 1553.494344][T23828] netlink: 'syz.7.4244': attribute type 4 has an invalid length. [ 1553.649455][T19813] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 1553.703206][ T30] audit: type=1400 audit(2000000667.497:1539): avc: denied { ioctl } for pid=23831 comm="syz.1.4246" path="socket:[82127]" dev="sockfs" ino=82127 ioctlcmd=0xf510 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1553.807916][T19813] usb 6-1: device descriptor read/64, error -71 [ 1553.859090][T23835] program syz.1.4247 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1554.060807][ T30] audit: type=1400 audit(2000000667.857:1540): avc: denied { mount } for pid=23836 comm="syz.3.4248" name="/" dev="rpc_pipefs" ino=82141 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 1554.067735][T19813] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 1554.367840][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1554.518043][T19813] usb 6-1: device descriptor read/64, error -71 [ 1554.571660][T23848] FAULT_INJECTION: forcing a failure. [ 1554.571660][T23848] name failslab, interval 1, probability 0, space 0, times 0 [ 1554.585011][T23848] CPU: 0 UID: 0 PID: 23848 Comm: syz.3.4251 Tainted: G L syzkaller #0 PREEMPT(full) [ 1554.585031][T23848] Tainted: [L]=SOFTLOCKUP [ 1554.585035][T23848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1554.585041][T23848] Call Trace: [ 1554.585046][T23848] [ 1554.585051][T23848] dump_stack_lvl+0x100/0x190 [ 1554.585069][T23848] should_fail_ex.cold+0x5/0xa [ 1554.585084][T23848] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1554.585100][T23848] should_failslab+0xc2/0x120 [ 1554.585112][T23848] __kmalloc_noprof+0xe0/0x850 [ 1554.585128][T23848] ? kfree+0x1dd/0x6c0 [ 1554.585144][T23848] tomoyo_realpath_from_path+0xb6/0x690 [ 1554.585162][T23848] tomoyo_path_number_perm+0x23c/0x580 [ 1554.585175][T23848] ? tomoyo_path_number_perm+0x22e/0x580 [ 1554.585188][T23848] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1554.585214][T23848] ? find_held_lock+0x2b/0x80 [ 1554.585225][T23848] ? __fget_files+0x215/0x3d0 [ 1554.585239][T23848] ? hook_file_ioctl_common+0x149/0x410 [ 1554.585255][T23848] ? __fget_files+0x215/0x3d0 [ 1554.585270][T23848] ? __fget_files+0x21f/0x3d0 [ 1554.585285][T23848] security_file_ioctl+0xd3/0x230 [ 1554.585300][T23848] __x64_sys_ioctl+0xb7/0x210 [ 1554.585313][T23848] do_syscall_64+0x10b/0xf80 [ 1554.585326][T23848] ? clear_bhb_loop+0x40/0x90 [ 1554.585339][T23848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1554.585351][T23848] RIP: 0033:0x7f9cf919cdd9 [ 1554.585361][T23848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1554.585372][T23848] RSP: 002b:00007f9cf9ffe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1554.585383][T23848] RAX: ffffffffffffffda RBX: 00007f9cf9415fa0 RCX: 00007f9cf919cdd9 [ 1554.585390][T23848] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 1554.585396][T23848] RBP: 00007f9cf9ffe090 R08: 0000000000000000 R09: 0000000000000000 [ 1554.585402][T23848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1554.585408][T23848] R13: 00007f9cf9416038 R14: 00007f9cf9415fa0 R15: 00007ffdc4fee588 [ 1554.585422][T23848] [ 1554.585428][T23848] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1554.794040][T19813] usb usb6-port1: attempt power cycle [ 1554.951536][T23852] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4252'. [ 1555.154532][T19813] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 1555.207777][T15215] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 1555.208448][T19813] usb 6-1: device descriptor read/8, error -71 [ 1555.261865][T23856] 9p: Bad value for 'rfdno' [ 1555.309604][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1555.343017][T23860] netlink: 24 bytes leftover after parsing attributes in process `syz.7.4256'. [ 1555.352197][ T30] audit: type=1400 audit(2000000669.137:1541): avc: denied { nlmsg_read } for pid=23859 comm="syz.7.4256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1555.376399][T15215] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1555.388800][T14549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1555.389049][T15215] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 104 [ 1555.407504][T15215] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 1555.428706][T15215] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 1555.449257][T15215] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1555.462534][T15215] usb 4-1: SerialNumber: syz [ 1555.467811][T19813] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 1555.580076][T23852] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1556.547845][ T991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1556.600607][ T5346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1556.622162][T19813] usb 6-1: device descriptor read/8, error -71 [ 1557.028726][T19813] usb usb6-port1: unable to enumerate USB device [ 1557.096562][T23852] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1545 sclass=netlink_route_socket pid=23852 comm=syz.3.4252 [ 1557.155948][ T31] INFO: task syz.9.3720:21614 blocked for more than 143 seconds. [ 1557.186068][ T31] Tainted: G L syzkaller #0 [ 1557.200759][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1557.219347][ T31] task:syz.9.3720 state:D stack:27816 pid:21614 tgid:21609 ppid:19550 task_flags:0x400640 flags:0x00080002 [ 1557.254952][ T31] Call Trace: [ 1557.262166][ T31] [ 1557.269732][ T31] __schedule+0x10e9/0x6820 [ 1557.279778][ T31] ? __pfx___schedule+0x10/0x10 [ 1557.295022][ T31] ? find_held_lock+0x2b/0x80 [ 1557.305916][ T31] ? schedule+0x2bf/0x390 [ 1557.316000][ T31] schedule+0xdd/0x390 [ 1557.364539][ T31] schedule_timeout+0x1b2/0x280 [ 1557.387151][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1557.399272][ T31] ? __wait_for_common+0x2da/0x4c0 [ 1558.356147][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1558.364276][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1558.387729][ T31] ? rcu_is_watching+0x12/0xc0 [ 1558.392713][ T31] __wait_for_common+0x2e7/0x4c0 [ 1558.399562][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1558.782535][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 1558.798177][ T31] ? __pfx_try_to_wake_up+0x10/0x10 [ 1558.804918][ T31] ? vfs_coredump+0x7e0/0x5770 [ 1558.817747][ T31] ? rcu_is_watching+0x12/0xc0 [ 1558.828066][ T31] wait_for_completion_state+0x1c/0x40 [ 1558.837714][ T31] vfs_coredump+0x80d/0x5770 [ 1558.847742][ T31] ? __lock_acquire+0x4a5/0x2630 [ 1558.857940][ T31] ? __pfx_vfs_coredump+0x10/0x10 [ 1558.867718][ T31] ? __lock_acquire+0x4a5/0x2630 [ 1558.877748][ T31] ? lock_acquire+0x1b1/0x370 [ 1558.888008][ T31] ? lock_acquire+0x1b1/0x370 [ 1558.897716][ T31] ? find_held_lock+0x2b/0x80 [ 1558.907738][ T31] ? is_bpf_text_address+0x8a/0x1a0 [ 1558.917908][ T31] ? is_bpf_text_address+0x8a/0x1a0 [ 1558.927736][ T31] ? bpf_ksym_find+0x128/0x1c0 [ 1558.937724][ T31] ? __kernel_text_address+0xd/0x30 [ 1558.949487][ T31] ? unwind_get_return_address+0x59/0xa0 [ 1558.967728][ T31] ? arch_stack_walk+0xa6/0xf0 [ 1558.972542][ T31] ? __sigqueue_free+0xbe/0x2a0 [ 1558.977385][ T31] ? stack_trace_save+0x8e/0xc0 [ 1558.997731][ T31] ? __pfx_stack_trace_save+0x10/0x10 [ 1559.003138][ T31] ? stack_depot_save_flags+0x27/0x9d0 [ 1559.017701][ T31] ? __lock_acquire+0x4a5/0x2630 [ 1559.027748][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1559.037951][ T31] ? proc_coredump_connector+0x2d3/0x4f0 [ 1559.057734][ T31] ? __pfx_proc_coredump_connector+0x10/0x10 [ 1559.063756][ T31] ? rcu_is_watching+0x12/0xc0 [ 1559.077715][ T31] get_signal+0x1f2a/0x21e0 [ 1559.082321][ T31] ? __pfx_get_signal+0x10/0x10 [ 1559.087222][ T31] arch_do_signal_or_restart+0x91/0x7a0 [ 1559.107707][ T31] ? force_sig_info_to_task+0x4d2/0x660 [ 1559.117740][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1559.137726][ T31] ? rcu_is_watching+0x12/0xc0 [ 1559.142567][ T31] exit_to_user_mode_loop+0x86/0x4a0 [ 1559.157927][ T31] ? do_syscall_64+0x52d/0xf80 [ 1559.162730][ T31] do_syscall_64+0x706/0xf80 [ 1559.167321][ T31] ? clear_bhb_loop+0x40/0x90 [ 1559.188052][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1559.194006][ T31] RIP: 0033:0x7eff7059cdd9 [ 1559.207701][ T31] RSP: 002b:00007eff714400e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1559.227766][ T31] RAX: 00000000000000ca RBX: 00007eff70816098 RCX: 00007eff7059cdd9 [ 1559.235800][ T31] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007eff7081609c [ 1559.257704][ T31] RBP: 00007eff70816090 R08: 0000000000000001 R09: 0000000000000000 [ 1559.277917][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1559.285931][ T31] R13: 00007eff70816128 R14: 00007ffef3427780 R15: 00007ffef3427868 [ 1559.307939][ T31] [ 1559.311063][ T31] [ 1559.311063][ T31] Showing all locks held in the system: [ 1559.327764][ T31] 1 lock held by khungtaskd/31: [ 1559.338090][ T31] #0: ffffffff8e7e54e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 1559.368504][ T31] 2 locks held by kworker/0:3/991: [ 1559.374684][ T31] 3 locks held by kworker/u8:13/13479: [ 1559.383521][ T31] #0: ffff88813fe94140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 [ 1559.398088][T19814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1559.411811][ T31] #1: ffffc900061bfd08 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 [ 1559.446742][ T31] #2: ffffffff9060b6e0 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 [ 1559.467889][ T31] 4 locks held by kworker/0:5/15215: [ 1559.474723][ T31] #0: ffff888020ad5140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 [ 1559.487942][ T31] #1: ffffc9000622fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 [ 1559.499805][ T31] #2: ffff88802b33b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 [ 1559.509108][ T31] #3: ffff88802b5281d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 [ 1559.521961][ T31] 4 locks held by udevd/19082: [ 1559.526841][ T31] #0: ffff8880a05d4878 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 [ 1559.536229][ T31] #1: ffff888079340480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 [ 1559.546018][ T31] #2: ffff88803b8c1788 (kn->active#34){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 [ 1559.556420][ T31] #3: ffff88802b5281d8 (&dev->mutex){....}-{4:4}, at: serial_show+0x26/0xa0 [ 1559.565607][ T31] 1 lock held by udevd/19096: [ 1559.570607][ T31] #0: ffff888027cbc350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 1559.581306][ T31] 2 locks held by getty/22772: [ 1559.586179][ T31] #0: ffff888037a1f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1559.596404][ T31] #1: ffffc900061a32e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14f0 [ 1559.606863][ T31] 1 lock held by syz.1.4247/23834: [ 1559.612378][ T31] #0: ffff888027cbc350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 1559.622357][ T31] 3 locks held by syz.3.4252/23851: [ 1559.628005][T14370] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1559.628373][ T31] #0: ffffffff8f997528 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x113/0x2c0 [ 1559.646330][ T31] #1: ffffffff9060b6e0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8bb/0x2380 [ 1559.655776][ T31] #2: ffffffff8e7f1028 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 1559.666154][ T31] 2 locks held by syz.3.4252/23852: [ 1559.671734][ T31] #0: ffffffff8f997528 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x113/0x2c0 [ 1559.682559][ T31] #1: ffffffff9060b6e0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8bb/0x2380 [ 1559.698174][ T31] [ 1559.703379][ T31] ============================================= [ 1559.703379][ T31] [ 1559.737039][ T31] NMI backtrace for cpu 1 [ 1559.737061][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1559.737082][ T31] Tainted: [L]=SOFTLOCKUP [ 1559.737087][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1559.737096][ T31] Call Trace: [ 1559.737101][ T31] [ 1559.737109][ T31] dump_stack_lvl+0x100/0x190 [ 1559.737136][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 1559.737156][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1559.737174][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 1559.737200][ T31] sys_info+0x141/0x190 [ 1559.737218][ T31] watchdog+0xcb1/0x1030 [ 1559.737239][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1559.737255][ T31] ? __pfx_watchdog+0x10/0x10 [ 1559.737272][ T31] ? __kthread_parkme+0x18c/0x230 [ 1559.737288][ T31] ? kthread+0x13a/0x450 [ 1559.737304][ T31] ? __pfx_watchdog+0x10/0x10 [ 1559.737318][ T31] kthread+0x370/0x450 [ 1559.737334][ T31] ? __pfx_kthread+0x10/0x10 [ 1559.737351][ T31] ret_from_fork+0x72b/0xd50 [ 1559.737379][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1559.737397][ T31] ? __switch_to+0x800/0x1100 [ 1559.737418][ T31] ? __pfx_kthread+0x10/0x10 [ 1559.737436][ T31] ret_from_fork_asm+0x1a/0x30 [ 1559.737470][ T31] [ 1559.737486][ T31] Sending NMI from CPU 1 to CPUs 0: [ 1559.871141][ C0] NMI backtrace for cpu 0 [ 1559.871161][ C0] CPU: 0 UID: 0 PID: 991 Comm: kworker/0:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 1559.871183][ C0] Tainted: [L]=SOFTLOCKUP [ 1559.871188][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1559.871197][ C0] Workqueue: events cleanup_vm_area_work [ 1559.871222][ C0] RIP: 0010:__lock_acquire+0x4f8/0x2630 [ 1559.871242][ C0] Code: 95 80 0b 00 00 85 c9 0f 84 97 01 00 00 c7 44 24 08 00 00 00 00 48 89 13 8b 85 88 0b 00 00 85 c0 74 18 48 8b 3c 24 48 8d 04 80 <0f> b6 44 c7 f9 32 43 21 a8 60 0f 85 70 08 00 00 48 89 d0 89 d6 48 [ 1559.871256][ C0] RSP: 0018:ffffc9000538f8a0 EFLAGS: 00000002 [ 1559.871267][ C0] RAX: 000000000000000a RBX: ffff8880285a55e0 RCX: 0000000000000002 [ 1559.871276][ C0] RDX: 72127f729c6bf4de RSI: ffff8880285a55e0 RDI: ffff8880285a5590 [ 1559.871285][ C0] RBP: ffff8880285a4a00 R08: 0000000000000001 R09: 0000000000000000 [ 1559.871294][ C0] R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000 [ 1559.871303][ C0] R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000005 [ 1559.871311][ C0] FS: 0000000000000000(0000) GS:ffff888124376000(0000) knlGS:0000000000000000 [ 1559.871326][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1559.871335][ C0] CR2: 00007f11a5bea2f8 CR3: 00000000758b0000 CR4: 00000000003526f0 [ 1559.871344][ C0] Call Trace: [ 1559.871349][ C0] [ 1559.871356][ C0] ? mark_held_locks+0x40/0x70 [ 1559.871372][ C0] ? irqentry_exit+0x246/0x790 [ 1559.871388][ C0] ? lockdep_hardirqs_on+0x78/0x100 [ 1559.871402][ C0] ? irqentry_exit+0x246/0x790 [ 1559.871418][ C0] lock_acquire+0x1b1/0x370 [ 1559.871434][ C0] ? debug_check_no_obj_freed+0x1c9/0x630 [ 1559.871454][ C0] ? _raw_spin_lock_irqsave+0x52/0x60 [ 1559.871469][ C0] _raw_spin_lock_irqsave+0x3a/0x60 [ 1559.871482][ C0] ? debug_check_no_obj_freed+0x1c9/0x630 [ 1559.871500][ C0] debug_check_no_obj_freed+0x1c9/0x630 [ 1559.871519][ C0] ? __pfx_debug_check_no_obj_freed+0x10/0x10 [ 1559.871539][ C0] ? _raw_spin_unlock+0x28/0x50 [ 1559.871552][ C0] ? find_unlink_vmap_area+0x306/0x3f0 [ 1559.871567][ C0] remove_vm_area+0x1b0/0x390 [ 1559.871583][ C0] vfree+0x6f/0x8d0 [ 1559.871598][ C0] ? lock_acquire+0x5e/0x370 [ 1559.871615][ C0] cleanup_vm_area_work+0x4c/0x100 [ 1559.871632][ C0] process_one_work+0xa0e/0x1980 [ 1559.871659][ C0] ? __pfx_process_one_work+0x10/0x10 [ 1559.871678][ C0] ? __pfx_cleanup_vm_area_work+0x10/0x10 [ 1559.871695][ C0] worker_thread+0x5ef/0xe50 [ 1559.871714][ C0] ? __pfx_worker_thread+0x10/0x10 [ 1559.871731][ C0] ? kthread+0x13a/0x450 [ 1559.871747][ C0] ? __pfx_worker_thread+0x10/0x10 [ 1559.871763][ C0] kthread+0x370/0x450 [ 1559.871778][ C0] ? __pfx_kthread+0x10/0x10 [ 1559.871794][ C0] ret_from_fork+0x72b/0xd50 [ 1559.871811][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1559.871828][ C0] ? __switch_to+0x800/0x1100 [ 1559.871848][ C0] ? __pfx_kthread+0x10/0x10 [ 1559.871863][ C0] ret_from_fork_asm+0x1a/0x30 [ 1559.871887][ C0] [ 1560.172420][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1560.179315][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1560.190009][ T31] Tainted: [L]=SOFTLOCKUP [ 1560.194345][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1560.204403][ T31] Call Trace: [ 1560.207694][ T31] [ 1560.210618][ T31] dump_stack_lvl+0x100/0x190 [ 1560.215304][ T31] vpanic+0x552/0x970 [ 1560.219269][ T31] ? __pfx_vpanic+0x10/0x10 [ 1560.223759][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 1560.229921][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 1560.236065][ T31] panic+0xd1/0xe0 [ 1560.239774][ T31] ? __pfx_panic+0x10/0x10 [ 1560.244179][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 1560.250323][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 1560.256469][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 1560.262629][ T31] ? watchdog.cold+0x1ec/0x234 [ 1560.267396][ T31] ? watchdog+0xcc1/0x1030 [ 1560.271812][ T31] watchdog.cold+0x1fd/0x234 [ 1560.276403][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1560.282207][ T31] ? __pfx_watchdog+0x10/0x10 [ 1560.286896][ T31] ? __kthread_parkme+0x18c/0x230 [ 1560.291924][ T31] ? kthread+0x13a/0x450 [ 1560.296161][ T31] ? __pfx_watchdog+0x10/0x10 [ 1560.300825][ T31] kthread+0x370/0x450 [ 1560.304881][ T31] ? __pfx_kthread+0x10/0x10 [ 1560.309458][ T31] ret_from_fork+0x72b/0xd50 [ 1560.314042][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1560.319140][ T31] ? __switch_to+0x800/0x1100 [ 1560.323811][ T31] ? __pfx_kthread+0x10/0x10 [ 1560.328386][ T31] ret_from_fork_asm+0x1a/0x30 [ 1560.333152][ T31] [ 1560.336638][ T31] Kernel Offset: disabled [ 1560.340943][ T31] Rebooting in 86400 seconds..