last executing test programs: 7m53.210090236s ago: executing program 4 (id=139): socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x0, 0x18, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x1, &(0x7f0000000080)=0x1, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x2, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000dae11c105e0484028fa4010203010902240001000000000904000002437d67000905fc57d4"], 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffd, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/resume', 0x6aa80, 0x10) setuid(0x0) write$cgroup_int(r3, &(0x7f0000000180)=0xfe5f, 0x12) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x141301, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f0000000300)={{0xeeef0000, 0xdddd1000, 0x0, 0x2, 0x8, 0x0, 0x0, 0x2, 0x0, 0x8, 0x9, 0x81}, {0x6000, 0xd000, 0xc, 0x8, 0x0, 0x0, 0x0, 0xb2, 0x8, 0x7, 0x0, 0xff}, {0x3000, 0x0, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x3000, 0xd000, 0x0, 0xe2, 0x0, 0x0, 0xff, 0x0, 0xfe, 0x0, 0x4}, {0xdddd0000, 0xa000, 0x9, 0x0, 0xff, 0x4, 0x6, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x80}, {0x1, 0x0, 0x9, 0x6, 0x0, 0x0, 0x3}, {0x84942f7dcdf75a4f, 0x8000000, 0x0, 0x6, 0x1, 0x1, 0x83, 0xa, 0x26, 0x5}, {0x4000}, {0xdddd1000, 0xff}, 0xddf8ffdb, 0x0, 0x0, 0x70, 0xfffffffffefffffe, 0xd801, 0x0, [0x4, 0x0, 0x1]}) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) ioprio_set$uid(0xad28f3e95b14f48d, 0xee01, 0x3edf50b1fcf3c0dc) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 7m46.663542346s ago: executing program 4 (id=153): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = syz_clone3(&(0x7f0000000080)={0x180801600, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0xc}, 0x0, 0x0, 0x0, 0x0}, 0x58) pidfd_send_signal(r1, 0x21, 0x0, 0x0) sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) r2 = syz_open_dev$usbmon(&(0x7f00000002c0), 0x200, 0x400) ioctl$FITRIM(r2, 0xc0185879, &(0x7f00000003c0)={0x8, 0x0, 0x7}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0xffffffffffffffca, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000400)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x21}, @ptr={0x70742a85, 0x80000, 0x0, 0x0, 0x1, 0x11}, @ptr={0x70742a85, 0x5, 0x0, 0x0, 0x1, 0xca}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) timerfd_gettime(r5, &(0x7f0000000000)) 7m46.394662283s ago: executing program 4 (id=154): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) r1 = syz_open_dev$media(&(0x7f0000001a80), 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000), 0xf, 0x2) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc0287c02, &(0x7f0000000380)={0x80000000, 0x0, &(0x7f0000000c40)=[{{}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc0287c02, &(0x7f0000000200)={r3, 0x0, 0x0}) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r5, 0x8, &(0x7f0000000200)=0x40003) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x1c}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r7 = openat$rtc(0xffffff9c, &(0x7f0000001ec0), 0x0, 0x0) ioctl$RTC_ALM_SET(r7, 0x40247007, &(0x7f0000001f00)={0x26, 0x0, 0x12, 0xd, 0x2, 0x4090, 0x6, 0x4c, 0xffffffffffffffff}) r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r8, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_NUM(r8, 0x4008af10, &(0x7f00000000c0)={0x1, 0x52}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x11e7d, 0x51a23}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FLAGS={0x6, 0x8, 0xf}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @rand_addr=0x64010102}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000000)=@framed={{0x6a, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x53, 0x1}}, &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xffc3, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94) 7m45.30151408s ago: executing program 4 (id=155): bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x6, 0x4, 0x9, 0x8}, 0x50) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8028640c, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000800001000088}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, 0x7, 0x6, 0x401, 0x0, 0x0, {0xa, 0x0, 0x9}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}}, 0x4c880) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000300)={{0x0, 0x2, 0x3}}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000340)={0x750, 0x0, 0x0, 'queue1\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3, 0x3}}) 7m43.185411548s ago: executing program 4 (id=161): r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000080)={@private2, 0x0}, &(0x7f00000000c0)=0x14) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r0, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x8) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x8) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_GET_CPUID2(r3, 0xc008ae91, &(0x7f00000002c0)={0x7, 0x0, [{}, {}, {}, {}, {}, {}, {}]}) (async) ioctl$KVM_GET_CPUID2(r3, 0xc008ae91, &(0x7f00000002c0)={0x7, 0x0, [{}, {}, {}, {}, {}, {}, {}]}) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000400), 0x20002, 0x0) ioctl$TCSETAW(r4, 0x5407, &(0x7f0000000440)={0x3dd, 0xf6, 0x5, 0xbc00, 0x7, "5ca7d82c17735d67"}) (async) ioctl$TCSETAW(r4, 0x5407, &(0x7f0000000440)={0x3dd, 0xf6, 0x5, 0xbc00, 0x7, "5ca7d82c17735d67"}) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000480)=0x0) ptrace$getregset(0x4204, r5, 0x200, &(0x7f00000014c0)={&(0x7f00000004c0)=""/4096, 0x1000}) (async) ptrace$getregset(0x4204, r5, 0x200, &(0x7f00000014c0)={&(0x7f00000004c0)=""/4096, 0x1000}) r6 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000001500)={'dummy0\x00', 0x0}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f0000001540)={0x0, 0x0}) fcntl$lock(r4, 0x24, &(0x7f00000015c0)={0x0, 0x2, 0x0, 0x9, r8}) (async) fcntl$lock(r4, 0x24, &(0x7f00000015c0)={0x0, 0x2, 0x0, 0x9, r8}) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000018c0)={0x6, 0x1d, &(0x7f0000001600)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@map_idx={0x18, 0xa, 0x5, 0x0, 0x2}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x0, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @call={0x85, 0x0, 0x0, 0x14}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001700)='GPL\x00', 0xffffff81, 0xe3, &(0x7f0000001740)=""/227, 0x41000, 0x0, '\x00', r7, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001840)={0x0, 0x10, 0x3ff, 0x6}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001880)=[{0x1, 0x3, 0x5, 0x2}], 0x10, 0x4}, 0x94) ioctl$DVB_DVR_DMX_QUERYBUF(r4, 0xc0186f3d, &(0x7f0000001980)={0x4, 0x7, 0x7, 0x100, 0x14}) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r9, 0x40786e88, &(0x7f0000001d80)={{&(0x7f00000019c0)=[{0x20000000000000, 0x400, 0x5, {0x11, 0x314}, 0x1, 0x8, 0x5}, {0x6, 0x91, 0x6, {0x6f8, 0x4c2}, 0x3, 0xfffffffffffffff9, 0xb0000000}, {0x280, 0xc297, 0x240000, {0x0, 0x3}, 0xffffffffffffff0d, 0x5, 0x8}, {0x9, 0x9, 0x5, {0xfffffffffffffffd, 0x4}, 0x7, 0x1, 0x6}, {0x0, 0x80000000, 0x480, {0x8001, 0x5}, 0x7586, 0x8, 0xfffffffb}, {0x7, 0x100000001, 0x5, {0x3, 0x3}, 0x80, 0x7ff, 0x5}, {0x3, 0xa, 0x7fffffffffffffff, {0x226, 0x814}, 0x3, 0x0, 0x3ff}, {0x7, 0x6, 0x7, {0x2, 0x3ff}, 0xff, 0x8, 0xa}], 0x8, 0x40, 0x5, 0xfffffffffffffffc}, {&(0x7f0000001bc0)=[{0xc}, {0x6, 0x3}], 0x2, 0x10, 0xa85, 0x3}, {&(0x7f0000001c00)=[0x3, 0x4, 0x4], 0x3, 0x8, 0x6, 0x74f}, {&(0x7f0000001c40)=[{0xc24b810, 0x8, 0x0, 0x9, 0xb1}, {0x6, 0x81, 0x8, 0x5, 0x62}, {0x100000001, 0x0, 0x0, 0x48000000, 0x9}, {0x33a, 0x1000, 0x4, 0x2, 0x1}, {0x1fbb, 0x5, 0x2, 0x6f0639a0, 0x3e}, {0x5, 0x6, 0x100, 0x6, 0x7fff}], 0x6, 0x28, 0xfffc, 0x1}, {&(0x7f0000001d40)=[0x8001, 0x7fff, 0x8001, 0x2, 0x8, 0x1], 0x6, 0x8, 0x6d4c, 0xffffffffffffff00}}) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f0000001e00)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, @private2={0xfc, 0x2, '\x00', 0x1}, 0x401, 0x2, 0x8000, 0x400, 0x0, 0x820200, r7}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002080)=@bpf_lsm={0x1d, 0x2, &(0x7f0000001e80)=@raw=[@ldst={0x1, 0x1, 0x3, 0x3, 0x6, 0x0, 0x10}, @alu={0x7, 0x0, 0xd, 0x0, 0x3, 0x10, 0x10}], &(0x7f0000001ec0)='syzkaller\x00', 0x9, 0xaa, &(0x7f0000001f00)=""/170, 0x41100, 0x20, '\x00', r1, 0x1b, r4, 0x8, &(0x7f0000001fc0)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000002000)={0x5, 0xa, 0x10001, 0x10}, 0x10, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002040)=[r4], 0x0, 0x10, 0x8}, 0x94) recvmmsg(r6, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002140)=""/122, 0x7a}], 0x1, &(0x7f0000002200)=""/43, 0x2b}, 0xb31a}, {{0x0, 0x0, &(0x7f0000002640)=[{&(0x7f0000002240)=""/230, 0xe6}, {&(0x7f0000002340)=""/45, 0x2d}, {&(0x7f0000002380)=""/253, 0xfd}, {&(0x7f0000002480)=""/189, 0xbd}, {&(0x7f0000002540)=""/79, 0x4f}, {&(0x7f00000025c0)=""/83, 0x53}], 0x6, &(0x7f00000026c0)=""/198, 0xc6}, 0x5}, {{&(0x7f00000027c0)=@nfc_llcp, 0x80, &(0x7f0000003a00)=[{&(0x7f0000002840)=""/87, 0x57}, {&(0x7f00000028c0)=""/4096, 0x1000}, {&(0x7f00000038c0)=""/101, 0x65}, {&(0x7f0000003940)=""/147, 0x93}], 0x4, &(0x7f0000003a40)=""/53, 0x35}, 0x9}, {{&(0x7f0000003a80)=@rc={0x1f, @fixed}, 0x80, &(0x7f0000003dc0)=[{&(0x7f0000003b00)=""/243, 0xf3}, {&(0x7f0000003c00)=""/193, 0xc1}, {&(0x7f0000003d00)=""/41, 0x29}, {&(0x7f0000003d40)=""/94, 0x5e}], 0x4, &(0x7f0000003e00)=""/172, 0xac}, 0xa0}], 0x4, 0x2100, &(0x7f0000003fc0)={0x0, 0x989680}) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000004000)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0xb, r1}) (async) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000004000)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0xb, r1}) syz_genetlink_get_family_id$team(&(0x7f0000004040), r6) epoll_pwait(r4, &(0x7f0000004080)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0x80000001, &(0x7f0000004100)={[0x401]}, 0x8) (async) epoll_pwait(r4, &(0x7f0000004080)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0x80000001, &(0x7f0000004100)={[0x401]}, 0x8) syz_open_dev$vim2m(&(0x7f0000004140), 0x7ff, 0x2) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000041c0), r4) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r4, &(0x7f00000042c0)={&(0x7f0000004180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000004280)={&(0x7f0000004200)={0x80, r10, 0x403, 0x70bd25, 0x25dfdbfb, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0xfffffff7}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x20000000}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0xfffffffe}]}, 0x80}, 0x1, 0x0, 0x0, 0x4000001}, 0x4844) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r4, &(0x7f00000042c0)={&(0x7f0000004180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000004280)={&(0x7f0000004200)={0x80, r10, 0x403, 0x70bd25, 0x25dfdbfb, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0xfffffff7}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x20000000}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0xfffffffe}]}, 0x80}, 0x1, 0x0, 0x0, 0x4000001}, 0x4844) getsockname$packet(r4, &(0x7f0000004300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000004340)=0x14) (async) getsockname$packet(r4, &(0x7f0000004300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000004340)=0x14) syz_genetlink_get_family_id$devlink(&(0x7f0000004380), r4) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000004380), r4) 7m42.268464067s ago: executing program 4 (id=162): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0xa100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000700)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee6, 0x8031, 0xffffffffffffffff, 0x46b1c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000480), 0x400034f, 0x2, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x5412, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x6, 0x4, 0x1, 0x0, r4}, 0x50) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13}, 0x90) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000140)={r6, r5}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r5}, &(0x7f0000000840), &(0x7f0000000880)=r4}, 0x20) close(r4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r5, &(0x7f0000000900)}, 0x20) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f0000000200)={0x8000, 0xf, 0x0, 0x8, 0x850, 0x3}) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r7, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x1000, &(0x7f0000004000/0x1000)=nil}) 7m26.904852278s ago: executing program 32 (id=162): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0xa100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000700)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee6, 0x8031, 0xffffffffffffffff, 0x46b1c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000480), 0x400034f, 0x2, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x5412, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x6, 0x4, 0x1, 0x0, r4}, 0x50) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13}, 0x90) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000140)={r6, r5}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r5}, &(0x7f0000000840), &(0x7f0000000880)=r4}, 0x20) close(r4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r5, &(0x7f0000000900)}, 0x20) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f0000000200)={0x8000, 0xf, 0x0, 0x8, 0x850, 0x3}) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r7, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x1000, &(0x7f0000004000/0x1000)=nil}) 13.196097269s ago: executing program 0 (id=1398): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7}, 0x50) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000440)={'syztnl1\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x55, 0x8000, 0x11, @private0, @dev={0xfe, 0x80, '\x00', 0x2e}, 0x8, 0x10, 0x6, 0x3}}) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000940)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xbc, 0xbc, 0x3, [@struct={0x0, 0x4, 0x0, 0x4, 0x0, 0xfffff801, [{0xe, 0x5, 0x7aa5}, {0xf, 0x1, 0x9e}, {0x0, 0x5, 0x4}, {0x9, 0x4, 0x4}]}, @decl_tag={0x3, 0x0, 0x0, 0x11, 0x2, 0x5}, @enum64={0x9, 0x2, 0x0, 0x13, 0x0, 0x7, [{0x10, 0x1, 0x760b}, {0x5, 0x200, 0x7fffffff}]}, @decl_tag={0x5, 0x0, 0x0, 0x11, 0x9, 0x3}, @struct={0x3, 0x2, 0x0, 0x4, 0x1, 0x9, [{0x7, 0x1, 0x5}, {0x10, 0x1}]}, @float={0xf, 0x0, 0x0, 0x10, 0xc}, @typedef={0x7, 0x0, 0x0, 0x8, 0x4}]}, {0x0, [0x61]}}, &(0x7f00000007c0)=""/160, 0xd7, 0xa0, 0x0, 0x6, 0x10000}, 0x28) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=@bloom_filter={0x1e, 0x8, 0x1, 0x81, 0x44820, r0, 0x5, '\x00', r1, r2, 0x1, 0x4, 0x2, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000b98cad95850000000100000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000000000200850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c1}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) sendmsg$unix(r5, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x8040) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r8, 0x0, 0xc, &(0x7f0000000500)=0xfffffffc, 0x4) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1f, 0x14, &(0x7f0000000700)=@framed={{}, [@printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFCONF(r10, 0x8912, &(0x7f0000000080)=@req={0x28, &(0x7f0000000040)={'veth1_to_batadv\x00', @ifru_names='syz_tun\x00'}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 12.878427942s ago: executing program 0 (id=1401): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) readv(r0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/157, 0x9d}], 0x1) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountstats\x00') ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0xd401}], 0x1, &(0x7f0000000440)={0x77359400}, &(0x7f0000000480)={[0x3ff]}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$getregset(0x4205, r2, 0x1, &(0x7f0000000080)={0x0}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, 0x0) r3 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)=@chain) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = getpid() r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r6, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r7, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000040)={0x28, 0x4, r7, 0x0, &(0x7f00007d4000/0x4000)=nil, 0x4000, 0xfffffffffffffffe}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r6, 0x3ba0, &(0x7f00000002c0)={0x48, 0x2, r7, 0x0, 0x0, 0x0, 0x0, 0x1}) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) 11.202532287s ago: executing program 0 (id=1405): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff0000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r3 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x100c8a2, 0xc000, 0x3, 0x348}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x21cd, 0x0, &(0x7f0000000680)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x76, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB=')'], 0x50) io_uring_enter(r3, 0x221d, 0xcb75, 0x1f, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0xdc, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}, @qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x9, 0x9, 0x400, 0x6, 0x80000000, 0x9, 0x3, 0xa0000, 0x10000}}}}, @qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_ECN={0x8}]}}, @qdisc_kind_options=@q_codel={{0xa}, {0x1c, 0x2, [@TCA_CODEL_TARGET={0x8}, @TCA_CODEL_INTERVAL={0x8, 0x3, 0x2}, @TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0xbf5e}]}}, @TCA_STAB={0x30, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xb, 0x1, 0x4, 0x1000, 0x2, 0x1e7, 0x6, 0x6}}, {0x10, 0x2, [0x6, 0x5, 0x130, 0x2, 0xfff7, 0x9]}}]}]}, 0xdc}}, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x4}, {}, {0x1, 0xe}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r5, &(0x7f0000000640)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000540)={0xb0, 0x1405, 0x100, 0x70bd2d, 0x25dfdbfb, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x4}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8}, {0x8, 0x3, 0x4}}, {{0x8}, {0x8, 0x3, 0x2}}, {{0x8, 0x1, 0x2}, {0x8, 0x3, 0x4}}, {{0x8, 0x1, 0x2}, {0x8}}, {{0x8, 0x1, 0x6}, {0x8, 0x3, 0x3}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4000010}, 0x34040000) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r4, {0xd, 0xc}, {0x0, 0xfff1}, {0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4049080) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$rtl8150(r6, 0x0, &(0x7f0000000440)={0x2c, &(0x7f00000000c0)={0x40, 0x14, 0x1, "06"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r6, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r6, 0x0, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)=ANY=[@ANYBLOB="0031fcffffffd4"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r6, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="50050100000003"], 0x0, 0x0, 0x0, 0x0}) 9.883222693s ago: executing program 3 (id=1409): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x2) read$FUSE(r0, &(0x7f0000002080)={0x2020}, 0x2020) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) writev(0xffffffffffffffff, &(0x7f00000027c0)=[{&(0x7f00000001c0)="05596a", 0x3}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x3, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="180000000300000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000002080)={'wg0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000600)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000005c0)={&(0x7f0000000500)=@gettclass={0x24, 0x2a, 0x100, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x7, 0xffe0}, {0xffff, 0xb}, {0xe, 0x7}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x8041) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2, 0x3}}, 0x2e) getsockopt(r6, 0x111, 0x5, 0x0, &(0x7f00000001c0)) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = syz_open_procfs(0x0, &(0x7f0000002040)='net/snmp6\x00') read$FUSE(r7, &(0x7f0000000000)={0x2020}, 0xfffffc7a) sendto$x25(r7, &(0x7f0000000140)="95fb278f04afcff59d6bec104fbe2e389b2658312026e08061d52ec39bd1ac261e4053648bee9867e5e935354d2b5cfb7c6c391b58edcc9eff2b628cff761ef8bf8e3ad6fbd2debb3af0b2d7b4eff837acc0d6b9c16c0d109e63bc65", 0x5c, 0x2000c080, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0, 0x0, 0x0, 0x0, 0x4000000}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8, 0x0, 0x0, 0xfffffffe}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x3, &(0x7f0000000340)=""/222, 0x0, 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000000)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) 9.458387885s ago: executing program 1 (id=1413): pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3fb, &(0x7f0000000500)=0x0) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(0xffffffffffffffff, 0x40184150, &(0x7f0000000140)={0x0, &(0x7f0000000080)="432e5d2e61dd7c0f3535bc458e7db8b02f54a8dc45d77360fd678b103d4715ed3c9438419ac8613f2fd7d6ff2d8de584289fa37ee008958736fc38a8681a5c3956a87248e78f2dca43cfb7ace1", 0x4d}) r2 = syz_clone(0x2100000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x280000000000, &(0x7f0000000180)="4f9745fe9369804ff9c29a370b0394c216470e9532c1fdb611963471d34fd024463837a7ecc7b6d34ecabc3607bfdb888cb46b8f127915c22396ec5cc8e187da2be431269042152a18ab2ab8c602a0aae04f57f9897e7ae66197276f9eebf48091655f73233c00a6d85c17f0febeb7c8603b22a195f627c204ebeff6da14d90ceb9393d332f47324a91450bf461c89e441709519164b3d387c1c9f720c34cbf2770f9d838c27b1232fa51cb9b0a3d20f74361df9ed50aa519a07678c299d5fa4259a47ec944e4db826cc068b8ac6f1ebd0") ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r2, 0x200, &(0x7f0000000080)={&(0x7f00000000c0)=""/112, 0x70}) openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r3 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) sendmsg$AUDIT_TTY_SET(0xffffffffffffffff, 0x0, 0x20000001) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) bpf$MAP_CREATE(0x0, 0x0, 0x50) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a00)=@newtaction={0xf0, 0x30, 0xb, 0x0, 0x0, {}, [{0xdc, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80006}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_nat={0x90, 0x3, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0x20000, 0x4, 0x400, 0x9}, @dev={0xac, 0x14, 0x14, 0x3a}, @dev={0xac, 0x14, 0x14, 0x15}, 0xff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x5a233e0e, 0x200, 0x2, 0x0, 0x4}, @broadcast, @empty, 0xffffff00, 0x1}}]}, {0x17, 0x6, "037b02d7339b2c3d1fd7c0c93a38772f1f8c25"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}, 0xf0}}, 0x0) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) openat$sndtimer(0xffffffffffffff9c, 0x0, 0x102) setns(r6, 0x24020000) mount$bind(0x0, 0x0, 0x0, 0x100000, 0x0) syz_clone(0xb21e0020, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x4040) io_submit(r1, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0, 0x0, 0x4}, &(0x7f00000000c0)={0x0, 0x0, 0x89, 0x0, 0x0, r0, 0x0}]) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x8080, 0x0) 8.26548569s ago: executing program 3 (id=1416): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$unix(0x1, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r4, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) r8 = gettid() r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="200000001e0001030200002000000000010000000c00038008"], 0x20}, 0x1, 0x0, 0x0, 0x81}, 0x4004000) timer_create(0x3, &(0x7f0000000800)={0x0, 0x2c, 0x4, @tid=r8}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r10 = memfd_secret(0x0) connect$unix(r10, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e21}, 0x6e) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) modify_ldt$read_default(0x2, 0xfffffffffffffffd, 0x0) 8.116603278s ago: executing program 1 (id=1417): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socket$pppl2tp(0x18, 0x1, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000000001701000003000000010000000000000000000000000000001701000002000000000000007005baa38d33e2e1650de8f13f421b2d4b60252e76171216e42961c3b08d4d3dacb0a7089ff7cbfd613d46fa95d6e2f6e76ac3266c9b1a531c4bcf0e7071f117cca4e883b4a6eb5dee7a9ab4d05d7ee311ab1c55b817285e0c3714ee6137e3b8553de667701a7c93437583b5f0b285a188098c1ac4ebac40b315ff8db6f736992497879a42b95248fed4d4888970573d0e88ceead26d97e172588a3ad30fbd01b7bbeeaa668e835f7ae3113fe2d949bb47bc0b2c62541714cc0538601ae4bab19d69a5addee134dd447034da6dd89704603d31a3d25b9d5f46cfd43d9e29aac7422920d98e1463256bd4cc929373ad9000000000faf6a95a04ad3b9db9b230f8224a3d6db187a9"], 0x18}], 0x1, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x5000, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 7.378097257s ago: executing program 1 (id=1421): bpf$MAP_CREATE(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r3, 0xae80, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) socket$inet_mptcp(0x2, 0x1, 0x106) 6.766145389s ago: executing program 0 (id=1423): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) (async, rerun: 32) ioctl$SIOCX25SCUDMATCHLEN(r0, 0x89e7, &(0x7f0000000000)={0x9}) (async, rerun: 32) syz_usb_connect(0x5, 0x2d, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100036756a42015140020982b0102030109021b00020c0630ea0904b70c003f7d0f060904e5"], &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0}) 6.291163694s ago: executing program 3 (id=1424): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r1, 0xffffffffffffffff) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='map_files\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xbf5ce000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000001040)=@raw={'raw\x00', 0x3c1, 0x3, 0x360, 0x0, 0x12, 0x600, 0x1c0, 0x202, 0x290, 0x2e8, 0x2e8, 0x290, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth1_to_bond\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "0000000000000019b5115c2aee68d23a465cd431e150c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baeb8989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b500", 0x2}}, @common=@inet=@socket2={{0x28}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c0) getdents64(r3, &(0x7f0000002f40)=""/4098, 0x1002) write$FUSE_NOTIFY_DELETE(r3, &(0x7f0000000040)={0x33, 0x6, 0x0, {0x0, 0x1, 0xa, 0x0, 'map_files\x00'}}, 0x33) getsockopt$inet6_buf(r2, 0x29, 0x3d, &(0x7f0000000280)=""/166, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = epoll_create(0xaf2) epoll_pwait2(r8, &(0x7f0000000d00)=[{}], 0x1, 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x322402, 0x41) syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[], 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r9 = memfd_create(&(0x7f00000002c0)='\x103q}2\x9a\xce\xaf\x03\x86\xe7\xc0\x14\x8f^\xd5\xfd\xa9\r\xac7A\x94\xeb\xcd\t\x00\x90k\xd6\x05\r\x84\x87\x1c\b\x8c`\xea\x13A\x90m\xb6&\xd0\x9daA\xc5\xb8_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2_\xdb\xc0\x8b\x19\x17\xb7Rvd\xcb:\b\xeeC0\xa3\xa6\xcf\x00\x00\xac\xc5h&+\t\x98\'\xfd|\x11\x99\xa2*6{\xd2C>2\x0e\"\xbc\xda\xee\xb0\xd8\xbf\xaf)\xf58c\x189K\x82\xd1(\xceY*\xcb\x9b\xbdn\x8e\x98m\x10L\xec\xfdWF\x7fj\x19\xb8<\xd2\x9d\xf0\xe9Qy\xe32\xed\x16f\xfe&\x1a\xdb\xeb\xad\xaaE\b\xa9\xf8\xa9s\xc4d\xd4\x03\xf1\xb7xO\x99\x804m[Ai\x13\x02\xf0\x84c2s\xd5P\t`\x9b\x12&\x8cx\x8eg\x9d\xe6g', 0x0) ftruncate(r9, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x0, 0x12, r9, 0x1000) userfaultfd(0x80001) 6.059766524s ago: executing program 5 (id=1425): fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x101000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) poll(&(0x7f00000001c0)=[{r1}, {r1}], 0x2, 0x9) close(0xffffffffffffffff) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/sync_on_suspend', 0x2000, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0x5, &(0x7f0000000200)={0x8, 0x40}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f0000000100)={0x0, 0x41, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r4, 0x501, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x21, 0x0, 0x20008001}, 0x140) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r5 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, 0x0) read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000) shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) sendmsg$nl_xfrm(r2, &(0x7f00000006c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4040884}, 0x80) getrlimit(0x2, 0x0) fstat(r2, 0x0) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r2, 0xc0207511, &(0x7f00000004c0)) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b1a, &(0x7f0000000100)={'wlan0\x00'}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x8) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) 5.456520182s ago: executing program 1 (id=1426): ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) r0 = eventfd2(0x43, 0x1) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f00000005c0)={0x0, r0}) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000018105704da0700000000000109022400010000ba0009040000090300000009210000000122220009058103"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{&(0x7f0000000440)=""/131, 0x83}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) 5.362096711s ago: executing program 2 (id=1427): setns(0xc9, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000580)=""/207) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000002bc0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000280)) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @mcast1, 0x9}, 0x1c) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x9584, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x5b4}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000040)=0xfffffdfb, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x8, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x8}, [@map_idx={0x18, 0xb, 0x5, 0x0, 0x7}, @call={0x85, 0x0, 0x0, 0xa2}, @map_idx_val={0x18, 0x57c872943c1efb85, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x5f}], {0x95, 0x0, 0x0, 0x500}}, &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) sendto$inet(r2, 0x0, 0xffef, 0x20048000, &(0x7f0000000240)={0x2, 0x4e22, @remote}, 0x26) 5.17810351s ago: executing program 5 (id=1428): prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x8, 0x3, 0x498, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f0, 0xffffffff, 0xffffffff, 0x3f0, 0xffffffff, 0xb, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x81, 0x0, 0x24, 0x0, 'syz1\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x1a0, 0x208, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x1, 0x0, 'syz0\x00'}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4f8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r2, 0x4038ae7a, &(0x7f0000000000)={0x1, 0xaa4, 0x0, &(0x7f0000000180)="d49a6f7bd9016ee4934948035699458b7328165aacfb9a69e7ce1588eb70154b903f0277b9cfe67e28", 0x0, 0x29}) ioctl$KVM_SET_CLOCK(r2, 0x4188aec6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x20000000000003, 0x1004}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x10004, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f0000000080)="66b9800000c00f326635010000000f3064660f38828e4258660f08676ac744240012e93bf96766c744240201000000f20f78ecf5543e660f3829544e66b9800000c00f326635002000000f300f01df66b805000000f3a5baf80c66b80e5ca48f66efbafc0cec0f01310f019c09000f01c2", 0x71}], 0x1, 0x7d, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r4, &(0x7f0000000300)=""/102400, 0x19000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61154c00000000006113500000000000bfa00000000000001505000008004e002d3501000000000095004100000000006916360000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf530000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076ebae3f55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932c9a6aa57f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000f4000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b30410856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff010404faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202ee1192b81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9b5a8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18487b6feb89752cd600000000abc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18533d4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bbff4bbe0000000000000000000000000044585397feaadda3fcc64e7b0c08f7ac5c64cb190f1712a3b10fc34eb758705f1751d8c8b712eb39d2b8ad44f129c2c9aedb15"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r2, 0x4068aea3, &(0x7f0000000100)={0xbc, 0x0, 0x4}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_open_dev$dvb_frontend(&(0x7f00000001c0), 0x4, 0x90000) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) shmget$private(0x0, 0x3000, 0x2, &(0x7f0000036000/0x3000)=nil) 4.779035102s ago: executing program 5 (id=1429): socket$nl_generic(0x10, 0x3, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) io_uring_setup(0x1b7c, 0x0) r0 = socket$inet(0x2, 0x4, 0x84) timer_create(0x3, 0x0, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000740)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-384\x00'}, 0x58) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) write$P9_RREADLINK(r3, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x400) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r4 = accept$alg(r2, 0x0, 0x0) prlimit64(0x0, 0xd, &(0x7f0000000140)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x0, 0x2, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x2404c814) socket$nl_route(0x10, 0x3, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x58, 0x0) sendmsg$alg(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@assoc={0x18, 0x117, 0x4, 0xd4e5}, @op={0x18, 0x117, 0x3, 0x1}], 0x30}, 0x2000010) write$binfmt_script(r4, &(0x7f00000008c0)={'#! ', '', [], 0xa, "80bf032c08711ad62d6c92403361f210c6a8feeabaa712fd1bcb544a662c333e670aca2f41e223e95a905f1e7215542b409c293bf64732716648016d3706b7dd3cec253eb59bf82da4ce28d8778081218cdd74a9ba91bb01f3591a2f6ab53c2ea4e088b3ec19e8af2e7a79dfe98199ad0467e731318d9da7775e10b80183bd02622e1c3678d493f5c6b4247c9dfa85b5f3ad6ec45f07feda0cc52d6f3539d07cc8fe98ea3fb7a9cc11c34f0d8fce8bc501a8da74534464d68214945f20f8cc3c7c382e"}, 0xc7) recvmmsg(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x20cb, &(0x7f0000008000)={0x0, 0x989680}) timer_settime(r1, 0x1, 0x0, 0x0) ustat(0xad8, 0x0) 4.268871109s ago: executing program 0 (id=1430): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) r0 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r0, 0x501c4814, &(0x7f0000000000)={0x6, 0xffffffff, 0x1000, 0xfffff800, 0x0, 0xfffffffe}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYRESDEC], 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x84, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e20, 0x6, @local, 0x8}}, 0xffff, 0x4}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f0b2ad1eb9769d74e4f1feff374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724190000006f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0ed9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab778c50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b28448692686ac80d81a89f9c29e276800"/2574], &(0x7f0000000140)='GPL\x00'}, 0x48) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r7, 0x89e0, &(0x7f0000000040)={r7, r6}) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x1, 0x40070, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_usb_control_io$uac1(r1, &(0x7f0000000240)={0x14, &(0x7f00000006c0)=ANY=[@ANYBLOB="0010dd000000dd233f6894ed69038cf8c0e372a856094cde2483c053844a56d37136ea0b47fe78fb493dbc4eb83c7dc9b333f521206ac1624a20ca088d0df6b326ea023732a0abf615b26fd8f98043dc41a2a15a4c16624cdb084e91f2f0ca1eba85c02c13935b8d467326cf9d9cbf1237e021811daec400ac19012888bd665f545893601e8398de8a6c59af8ca75447146da7cbb73e3b10913614cc790d3ed4d5aec406d97da615aa075fe1094e1ce43facaa10d61bd093c4ab8c538c1976148cee7e1238049a9a0f9c937b66ddac7d4209a94da926f2881300e8caf71292e6e72736f52099fdc90cdd9a18a6e92394a4524565b2b48c00e6538123a1b25e4372090a4d7f5c3ff9b5b973979fd2b67d4c378fd9eb1b78eb91ad5dc97edfd6a6ca2187ef3eb9e192cc91a275ef06d8aabacd"], &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1007}}}, &(0x7f00000005c0)={0x44, &(0x7f0000000380)={0x40, 0xc, 0x6a, "658102aa145e3c77b46b89b30c3207ffcb861371707a9a7cec233ceeef3cf1b303bd741421f610e14c3fd7fc3c383559cdf101883c433e6fabad3a8e98c8a7193a6df4051eefd3e7dfd99f94384e3d966fb499ab5039371ff9f5f39297d0b8cea12937a33871620d18c6"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000480)=ANY=[], &(0x7f00000004c0)={0x20, 0x82, 0x1, '{'}, &(0x7f0000000500)=ANY=[@ANYBLOB="2083023c5d0f00d9"], &(0x7f0000000540)={0x20, 0x84, 0x4, "5da77d4d"}, &(0x7f0000000580)={0x20, 0x85, 0x3, "e39412"}}) 3.808977295s ago: executing program 2 (id=1431): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socket$pppl2tp(0x18, 0x1, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000000001701000003000000010000000000000000000000000000001701000002000000000000007005baa38d33e2e1650de8f13f421b2d4b60252e76171216e42961c3b08d4d3dacb0a7089ff7cbfd613d46fa95d6e2f6e76ac3266c9b1a531c4bcf0e7071f117cca4e883b4a6eb5dee7a9ab4d05d7ee311ab1c55b817285e0c3714ee6137e3b8553de667701a7c93437583b5f0b285a188098c1ac4ebac40b315ff8db6f736992497879a42b95248fed4d4888970573d0e88ceead26d97e172588a3ad30fbd01b7bbeeaa668e835f7ae3113fe2d949bb47bc0b2c62541714cc0538601ae4bab19d69a5addee134dd447034da6dd89704603d31a3d25b9d5f46cfd43d9e29aac7422920d98e1463256bd4cc929373ad9000000000faf6a95a04ad3b9db9b230f8224a3d6db187a9"], 0x18}], 0x1, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x5000, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 3.110672481s ago: executing program 3 (id=1432): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) readv(r0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/157, 0x9d}], 0x1) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountstats\x00') ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0xd401}], 0x1, &(0x7f0000000440)={0x77359400}, &(0x7f0000000480)={[0x3ff]}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0xfffffffffffffffc, 0x0) ptrace$getregset(0x4205, r2, 0x1, &(0x7f0000000080)={0x0}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, 0x0) r3 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)=@chain) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = getpid() r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000040)={0x28, 0x4, r7, 0x0, &(0x7f00007d4000/0x4000)=nil, 0x4000, 0xfffffffffffffffe}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r6, 0x3ba0, &(0x7f00000002c0)={0x48, 0x2, r7, 0x0, 0x0, 0x0, 0x0, 0x1}) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) 3.108988961s ago: executing program 2 (id=1433): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) splice(r2, &(0x7f00000001c0)=0x1, r1, &(0x7f0000000340)=0x8000, 0x3, 0x4) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_MAC_ACL(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x4040845}, 0x40800) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x400}]}) clock_getres(0x8, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) io_setup(0x1, &(0x7f0000000380)=0x0) io_getevents(r3, 0x7f, 0x3, &(0x7f00000003c0)=[{}, {}, {}], &(0x7f0000000440)={0x77359400}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r8, 0x3ba0, &(0x7f0000000000)={0x48, 0x1, r9, 0x0, 0xfa3a, 0x2001}) ioctl$IOMMU_IOAS_IOVA_RANGES(r8, 0x3b84, &(0x7f0000000280)={0x20, r9, 0x0, 0x0, 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newtfilter={0x3c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x8, 0xfff3}, {}, {0xf, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST_MASK={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) setsockopt$SO_TIMESTAMP(r5, 0x1, 0x40, &(0x7f0000000300)=0xffffff7f, 0x4) getsockopt$SO_TIMESTAMP(r5, 0x1, 0x40, 0x0, &(0x7f0000000ac0)) ioctl$KVM_CHECK_EXTENSION(r4, 0xae03, 0x38) 1.943604717s ago: executing program 2 (id=1434): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000a40)=ANY=[], 0x18}], 0x1, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x5000, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 1.648847724s ago: executing program 3 (id=1435): ioperm(0x0, 0x2, 0x7e) (async) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)={0x30, r2, 0x211, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}, 0x1, 0x0, 0x0, 0xf040}, 0x20004800) timer_settime(0x0, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r0], 0x4c}}, 0x40800) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x6, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200e19}, 0x94) (async) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f00000002c0)=ANY=[@ANYRES64=r1, @ANYRESDEC, @ANYRESDEC=r2], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffff7fff}, 0x94) (async) syz_emit_ethernet(0x3c, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa08"], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) fcntl$lock(r4, 0x26, &(0x7f0000000000)={0x1}) fcntl$lock(r4, 0x7, &(0x7f00000006c0)={0x0, 0x0, 0xac1d}) r8 = getpgrp(0x0) r9 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000280), 0x40c80) ioctl$SNDRV_TIMER_IOCTL_INFO(r9, 0x80e85411, &(0x7f0000000880)) sched_setaffinity(r8, 0x8, &(0x7f0000000040)=0x5) (async) fcntl$lock(r7, 0x25, &(0x7f00000001c0)={0x2, 0x3, 0x8, 0x0, r8}) (async) r10 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r10, &(0x7f0000002640)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="10000000021401002abd7000fbdbdf25e9f1d78007d530213c96b9f2f543126dca84ec8a772b70619c13e9a82bf513a3055062bb7fc8f908df4513284d78db5d0d9e514b2091c27f2efa7221454ad1ef09ab0688f81800fa714c6b9ef0eefaea7b0d76330a0b9d7e00246655f0dcf8b197ba993c43c821ec279be750732fea06fe20f27e6d802ab84d0e6620e9d659615aee3b17c98db7719e04a62b65cf94d02cc53d365ce7db9173e04b339c1b94d7fe9856c250ca920c0899a4361af34e132cb278f8b55409cffaf864f8f1b7bba5cbb8f29ba67e613ff3bdd9a43d19fe8f5d7ae9bf84360f65ea5477799acd4549783a16720fd1f2c252fccfd61a44a2d799a4e1c18c376d4c52cdbfe56b3516be0155f5dacb7286aa263fa93cf74b5c90298f274733646281b506827bbe237602d1d4c85fb41c55415ba06f29c7773543fac5dd91e1af3ea5afcc8a9b1756a60e0b465232cb200c4c4514f0fc129c4faf40b8768bf02f918f6da896e247b5fee5fd175507adc887d258ac0ec8b63b2179f51eec28bf86ee394556623bcde2c72fa383108bbe0bc6eee407d7b4a314358ac79bae5cd33644a2233f103b15137789f657d7699f06b2acb7a8e6"], 0x10}, 0x1, 0x0, 0x0, 0x20100c1}, 0x4850) (async) r11 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000780)={@in={{0x2, 0x4e24, @private=0xa010100}}, 0x0, 0x0, 0x4b, 0x0, "ca9c17745410a7d85d2158cfdaf017e451c06bdd52f98f48a834f3b6d4b86dde1bc20e2c351b292682fb1c09f2bba1e7edae7c6a6db3f68a4a51597ad545c17183227aa11c34ab1059d2572c4901a618"}, 0xd8) (async) syz_usb_control_io$hid(r11, &(0x7f0000000200)={0x24, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0003040000b8e758d9652878000403431935c2de4de684eaa95038937e36f0287d65e32352b0d40885f02f5029e45d4dbe151dc8595e64195db1c637d8c7c9ebf06ba41d4a3f932b6109aa04c45c20e03d88db7774a117e8bad0e3a18469bfcfc417e0156b64"], 0x0, 0x0}, 0x0) (async) syz_usb_ep_write$ath9k_ep1(r11, 0x82, 0xc38, &(0x7f0000000080)=ANY=[@ANYBLOB]) 1.273928733s ago: executing program 5 (id=1436): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x61}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018110000", @ANYRES32, @ANYBLOB="0000000000001c00b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7b184f2cb0bce4a0c03000008000000b70400000000000085000000030000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x400c801}, 0x200080c4) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r2, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000600)={0x1, 0x0, [{0x591384acc3e00258, 0x6c, &(0x7f0000000400)=""/108}]}) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f00000001c0)=0x304008000) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x4080, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f00000003c0)={0x1, r3}) ioctl$USBDEVFS_BULK(r3, 0xc0185502, &(0x7f0000000500)={{{0x4}}, 0xed, 0x2, &(0x7f0000000400)="a6598837779f45f6717f028aa8a0c1475216c1008ca73d9c0045ad23ad4e86b6fbe895a921ba0163fadde8048b23359941f2a1b4aefa8a754d920bc7afed3966dc1f812af41f4ad4501839ea711249ef70ae3ccc5d9a6f7d0a5ad810a4bb1847b97a8f83aa1a9b873faa67e005768faaa20c0e2da41ad3b20f6e023ab1482f972bffb7b7a2884918c9b854f754112e483b2a82a904291a0f7bbce5eb69732324132534ee544b4e2472e2482940b2196e6aa948c31e7c6e18edf17b043714c429d430655fc5f4d886e65b9f0887018445319dbe9b1c5f709d7c0969389f5e7dd6a499330ac6f06aff1249b98e5d"}) syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000430007012abd7000fcdbdf25027c0000180000001400040000000000000000000000000000000000090001"], 0x38}}, 0x2004c000) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000280)={0x60, 0x0, &(0x7f000086b000/0x2000)=nil, &(0x7f00004fa000/0x4000)=nil, 0x8, 0x0, 0x0, 0x32, 0x20, 0x64, 0xc8, 0x73}) r5 = shmget$private(0x0, 0x4000, 0x1a81, &(0x7f0000ffa000/0x4000)=nil) shmat(r5, &(0x7f0000000000/0x4000)=nil, 0x4000) move_pages(0x0, 0x0, 0x0, &(0x7f0000000040)=[0x4], 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="05000000050000000100000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x16, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0xe, &(0x7f0000000000)=@raw=[@generic={0x0, 0x2, 0x8, 0xfffd, 0x5}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @map_idx={0x18, 0xa, 0x5, 0x0, 0x10}, @cb_func={0x18, 0x1, 0x4, 0x0, 0x400}, @exit, @exit, @alu={0x4, 0x0, 0x1, 0x8, 0x5, 0x30, 0xffffffffffffffff}, @cb_func={0x18, 0x9, 0x4, 0x0, 0x3}, @jmp={0x5, 0x0, 0x4, 0xb, 0xa, 0xffffffffffffffff, 0xffffffffffffffff}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x4}], &(0x7f0000000540)='syzkaller\x00', 0xa, 0x5, &(0x7f0000000140)=""/5, 0x40f00, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x7, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=[r6, r6, r6, r6, r6, r6, r3], 0x0, 0x10, 0xfffffffe}, 0x94) madvise(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x9) syz_emit_vhci(&(0x7f0000000380)=ANY=[@ANYBLOB="04300100c9"], 0x6) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f00000006c0)=ANY=[@ANYBLOB="250a00000000000061119c0000000000180000000000000000000000000000009500000000000000e6a2db825c948ac547234391ee658425ee57a5f513efde06e3cb055c47ed656f1dd48ce1b8700c14bfa66aa540dad54bddca402208aabadc6c0133fffd77818c408f088ccfa5c98c7e5ea1809cda7e582c1451407868beab9fc08a57d37da60e378c782e08c3b9f86a4aadedc78ea679c0cb9bd6afff4ececac1782c7ad21d230c447e80d7670753b388d22391d458cb1664bdd3bbfa4897d9e4f46539ef99ef23f74101e2d73929d6eb63d50b16c01646ac8880bc6eadbfc81178a8ca48892815133805000000774293d942e567c69618a1e698000080fc179cf04ff39490db2dbd9e0da85b4492e6b134d3591b6eada30bb8d111f8de4b2f8df61be8c5a4df7e7a311849e8f5b8bf80294c27881c2d939b101b1390e08107046d305d130845d876cc0adaa1383971d4d0febbd584f975f598328618620e0ef76133351b688b2093f1734d4e01c333fcaa3a580eb0a56f332430f9ff2ec81be2ec3e16336042d09fffb5304fe7555f950d052a2361d01f6c3d79077e22c0ff0456c84793a60c52743072037b7cab"], &(0x7f0000000000)='GPL\x00'}, 0x80) 1.161603914s ago: executing program 1 (id=1437): memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x5174084b65f0b408) quotactl$Q_GETQUOTA(0xffffffff80000701, &(0x7f0000000000)=@loop={'/dev/loop', 0x0}, 0xffffffffffffffff, 0x0) 1.10768077s ago: executing program 3 (id=1438): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r1 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000540)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000006740)=[{{0x0, 0x0, &(0x7f0000002740)=[{0x0}, {&(0x7f0000000100)}, {0x0}, {&(0x7f0000000080)="09ebb34c6e6b9bcb890e8fc488c52697590da70578e206547182de9cd141c0012e4926791de3eea4aa103ad545198bf93c390bbdb6f1faf1c0924adb7ebc658f62f9f47ed5f8d851dea2d62af8d6aa9af055c1975558eef4", 0x58}, {0x0}], 0x5, 0x0, 0x0, 0x240}}, {{0x0, 0x0, 0x0}}], 0x2, 0x2404c845) 1.05563814s ago: executing program 2 (id=1439): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc}) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r1, 0x4) landlock_restrict_self(r1, 0xa) r2 = landlock_create_ruleset(&(0x7f0000000100)={0x100}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f00000003c0)={0x0, 0x20000, 0x1, 0x1, 0x154, 0x0, r7}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x43, 0x0, 0x0}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB=','], 0x2c}}, 0x40) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresuid(0x0, 0xee00, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000740)={0x104085280, 0x0, 0x0, 0x0, {0x22}, 0x0, 0x0, 0x0, 0x0}, 0x58) r8 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f00000002c0)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) socket$inet(0x2, 0x5, 0x0) 986.029093ms ago: executing program 0 (id=1440): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$getregs(0xe, r0, 0x2, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) lseek(r1, 0xa673, 0x1) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='1', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/num_groups\x00', 0x1, 0x0) write(r6, &(0x7f0000000380)='2', 0x1) r7 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/midi1_num_groups\x00', 0x1, 0x0) write(r7, &(0x7f0000000440)='2', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000940)='dummy_udc.0', 0xb) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000000)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r4, @ANYBLOB="05", @ANYRES16=r4, @ANYRES64=r4], 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x51, 0x0, 0x0) 735.337198ms ago: executing program 2 (id=1441): mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$key(0xf, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0x7, &(0x7f00000003c0)={0x7, 0x2}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="050000e3ffffffffffff0500000008000300", @ANYRES32], 0x24}}, 0x0) sendmsg$NL80211_CMD_ABORT_SCAN(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="200000b5", @ANYBLOB="13a608975ed7591a9c2c33c9c95f248e2184a9215b7760ca35ec207e30d8f5d60cb2f58a1a15646d861af9e55da343bc4c04e56c9c8d06edcaf8798a3193dec94fca62d38dc064ad46c7da76d55c2ec7f2d01465c9ce2ebb352948704cbca6fb7c0816e09794c4", @ANYRES64=r2], 0x20}, 0x1, 0x0, 0x0, 0x40080c1}, 0x4000040) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) r3 = syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000540)=0x6) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) ftruncate(r5, 0x6000000) copy_file_range(r5, 0x0, r5, &(0x7f00000004c0)=0x100, 0x9, 0x0) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000980)=ANY=[], 0xef8}, 0x1, 0x7}, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r6, &(0x7f0000000140)=[{{&(0x7f0000000080)={0xa, 0x4e20, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)='\x00', 0x1}], 0x1}}], 0x1, 0x40408d1) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000002c0), r0) sendmsg$IEEE802154_LLSEC_LIST_KEY(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r7, 0x705, 0x70bd2c, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x20000001}, 0x4000810) syz_open_dev$MSR(&(0x7f0000000280), 0x5, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x240088d5) 652.248601ms ago: executing program 1 (id=1442): r0 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/card0/oss_mixer\x00', 0x2, 0x0) syz_io_uring_setup(0x141c, &(0x7f00000000c0)={0x0, 0xf9ee, 0x400, 0x3, 0x212}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000000)=0x0) r4 = openat$ublk_ctrl(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_submit$UBLK(r1, r2, r3, &(0x7f0000000500)=@ublk_get_features_sqe={0x2e, 0x0, 0x0, r4, 0x80207513, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, '\x00', {0x0, 0xffff, 0x0, 0x0}}) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r5 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r5, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, r5, 0x0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r6, &(0x7f0000032680)=""/102392, 0x18ff8) syz_open_dev$vcsa(&(0x7f0000000040), 0x1, 0x48042) write$proc_mixer(r0, &(0x7f0000000280)=[{'VOLUME', @val={' \'', 'Line'}}], 0x23) 264.176189ms ago: executing program 5 (id=1443): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x2) read$FUSE(r0, &(0x7f0000002080)={0x2020}, 0x2020) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) writev(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x3, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="180000000300000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000002080)={'wg0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000600)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000005c0)={&(0x7f0000000500)=@gettclass={0x24, 0x2a, 0x100, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x7, 0xffe0}, {0xffff, 0xb}, {0xe, 0x7}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x8041) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2, 0x3}}, 0x2e) getsockopt(r6, 0x111, 0x5, 0x0, &(0x7f00000001c0)) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = syz_open_procfs(0x0, &(0x7f0000002040)='net/snmp6\x00') read$FUSE(r7, &(0x7f0000000000)={0x2020}, 0xfffffc7a) sendto$x25(r7, &(0x7f0000000140)="95fb278f04afcff59d6bec104fbe2e389b2658312026e08061d52ec39bd1ac261e4053648bee9867e5e935354d2b5cfb7c6c391b58edcc9eff2b628cff761ef8bf8e3ad6fbd2debb3af0b2d7b4eff837acc0d6b9c16c0d109e63bc65", 0x5c, 0x2000c080, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0, 0x0, 0x0, 0x0, 0x4000000}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8, 0x0, 0x0, 0xfffffffe}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x3, &(0x7f0000000340)=""/222, 0x0, 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000000)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) 0s ago: executing program 5 (id=1444): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_MASK={0x8, 0x6, 0x6}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x8000) r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000a00)={'veth1_to_hsr\x00', &(0x7f0000000a40)=@ethtool_eeprom={0xc, 0x5, 0x8}}) r3 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b00000000000000000000000020000000000000", @ANYRES32, @ANYBLOB="b50b00000000000000000000000000000000b4797c17734aa45349be26efc000", @ANYRES32=0x0], 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0xc, 0xb, 0x0, 0x1}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x1, 0x8, 0x2, 0x4, 0x1}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x8, 0x7}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c3a00000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000080000850000002d0000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002180)={0x50, 0x44, 0x1, 0x70bd29, 0x4, {0x2}, [@nested={0x4, 0x48}, @nested={0x38, 0x1, 0x0, 0x1, [@typed={0x8, 0x13a, 0x0, 0x0, @fd=r7}, @typed={0x8, 0xab, 0x0, 0x0, @fd}, @typed={0x8, 0x43, 0x0, 0x0, @pid}, @nested={0x1c, 0x10a, 0x0, 0x1, [@typed={0x8, 0x47, 0x0, 0x0, @ipv4=@multicast1}, @typed={0x8, 0x31, 0x0, 0x0, @ipv4=@broadcast}, @typed={0x8, 0x78, 0x0, 0x0, @str='[@(\x00'}]}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x200048d5}, 0x4008094) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r8}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r9, 0x4) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000090401"], 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/card3/oss_mixer\x00', 0x100, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r11, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000680)={'nat\x00', 0xc6, "2525076db3fe0e356374c8e978e532c91ca090aae7e881af7cd8fc7485a94bfb54bd6763e01f9e77531eb280c8bc84129b2dcfc46970806185a51c6fc632cb06522a108b9e3f7c69f7b12d4912f94bd3434da5155f629ada1a6fc539bb541f0c094897c66ddf7a43e824e2d13c85c9b03e0e2003b82fece64a0bb322422875f52d2f0ddf04ab99cc017749be43f7e0a430083ab931461b6059aca759e38ca564062d61f47ba5ca15e7b2d1306d165ea7e57f196b14fd52b29a0768c3227f54812cf28ebd55fc"}, &(0x7f0000000780)=0xea) kernel console output (not intermixed with test programs): [ 474.965160][ T4980] Dev loop2: unable to read RDB block 7 [ 474.994240][ T4980] loop2: AHDI p1 p2 p3 [ 475.001736][ T4980] loop2: partition table partially beyond EOD, truncated [ 475.020500][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 475.057488][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 475.146177][T12145] ªªªªªª: renamed from vlan0 (while UP) [ 475.202190][ T29] audit: type=1400 audit(1785057819.107:1001): avc: denied { getopt } for pid=12142 comm="syz.3.993" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 475.256362][T12150] netlink: 'syz.2.992': attribute type 21 has an invalid length. [ 475.284795][ T9] asix 2-1:127.57: probe with driver asix failed with error -71 [ 475.305110][ T29] audit: type=1400 audit(1785057819.157:1002): avc: denied { watch watch_reads } for pid=12143 comm="syz.2.992" path="/208" dev="tmpfs" ino=1128 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 475.336475][ T9] usb 2-1: USB disconnect, device number 50 [ 475.437261][T12171] ieee802154 phy0 wpan0: encryption failed: -22 [ 475.628579][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 475.628596][ T29] audit: type=1400 audit(1785057819.537:1006): avc: denied { write } for pid=12172 comm="syz.3.996" name="mice" dev="devtmpfs" ino=917 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 476.159249][ T4980] Dev loop2: unable to read RDB block 7 [ 476.177691][ T4980] loop2: AHDI p1 p2 p3 [ 476.205311][ T5710] IPVS: starting estimator thread 0... [ 476.210485][ T4980] loop2: partition table partially beyond EOD, truncated [ 476.295295][ T29] audit: type=1400 audit(1785057820.047:1007): avc: denied { open } for pid=12172 comm="syz.3.996" path="/dev/input/mice" dev="devtmpfs" ino=917 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 476.321918][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 476.329521][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 476.364978][T12177] IPVS: using max 42 ests per chain, 100800 per kthread [ 476.643712][ T4980] Dev loop2: unable to read RDB block 7 [ 476.663724][ T4980] loop2: AHDI p1 p2 p3 [ 476.676656][ T4980] loop2: partition table partially beyond EOD, truncated [ 476.695115][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 476.711875][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 476.721133][ T29] audit: type=1400 audit(1785057820.617:1008): avc: denied { name_bind } for pid=12192 comm="syz.1.1000" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 477.862912][ T5755] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 478.033215][ T5755] usb 2-1: Using ep0 maxpacket: 32 [ 478.255160][ T5755] usb 2-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 478.615088][ T5755] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.644757][ T5755] usb 2-1: Product: syz [ 478.657049][ T5755] usb 2-1: Manufacturer: syz [ 478.989121][ T5755] usb 2-1: SerialNumber: syz [ 479.025514][ T5755] usb 2-1: config 0 descriptor?? [ 479.284293][T12194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 479.293391][T12194] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 479.368442][ T4980] Dev loop2: unable to read RDB block 7 [ 479.391670][ T4980] loop2: AHDI p1 p2 p3 [ 479.405696][ T4980] loop2: partition table partially beyond EOD, truncated [ 479.427303][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 479.450938][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 479.602769][ T191] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 479.681446][T12252] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1010'. [ 479.704653][T12252] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1010'. [ 479.772835][ T191] usb 6-1: Using ep0 maxpacket: 8 [ 479.780337][ T191] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 480.262108][ T191] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 480.287636][ T191] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.318915][ T191] usb 6-1: config 0 descriptor?? [ 480.345559][ T5755] airspy 2-1:0.0: usb_control_msg() failed -71 request 0a [ 480.447479][ T5755] airspy 2-1:0.0: Could not detect board [ 480.466187][ T5755] airspy 2-1:0.0: probe with driver airspy failed with error -71 [ 480.492469][ T5755] usb 2-1: USB disconnect, device number 51 [ 480.525897][ T4980] Dev loop2: unable to read RDB block 7 [ 480.547704][ T4980] loop2: AHDI p1 p2 p3 [ 480.571423][ T4980] loop2: partition table partially beyond EOD, truncated [ 480.581243][ T191] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 480.600623][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 480.618464][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 480.659366][T12278] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 480.778006][T12245] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 480.789810][ T4980] Dev loop2: unable to read RDB block 7 [ 480.795969][ T4980] loop2: AHDI p1 p2 p3 [ 480.800390][ T4980] loop2: partition table partially beyond EOD, truncated [ 480.806750][T12283] netlink: zone id is out of range [ 480.809894][T12245] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 480.823418][T12283] netlink: zone id is out of range [ 480.832743][T12283] netlink: zone id is out of range [ 480.834471][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 480.844779][T12283] netlink: del zone limit has 4 unknown bytes [ 480.851556][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 480.940453][ T29] audit: type=1400 audit(1785057824.847:1009): avc: denied { mount } for pid=12287 comm="syz.2.1014" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 481.050789][T12301] set match dimension is over the limit! [ 481.212779][ T5741] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 481.220488][ T5755] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 481.236018][T12245] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 481.253750][T12245] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 481.283767][ T191] usb 6-1: USB disconnect, device number 21 [ 481.403003][ T5755] usb 1-1: Using ep0 maxpacket: 32 [ 481.408259][ T5741] usb 3-1: Using ep0 maxpacket: 8 [ 481.429840][ T5741] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 481.444933][ T5755] usb 1-1: config index 0 descriptor too short (expected 35577, got 27) [ 481.464186][ T5755] usb 1-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 481.474530][ T5741] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 481.486446][ T5755] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 481.496875][ T5741] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 481.507020][ T5755] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 481.517600][ T5741] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 481.539765][ T5755] usb 1-1: config 1 has no interface number 0 [ 481.549177][ T5755] usb 1-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 481.564883][ T5755] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.589766][ T5741] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 481.612561][ T5741] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.903177][ T5755] snd_usb_pod 1-1:1.1: Line 6 Pocket POD found [ 481.913353][ T5741] usb 3-1: Product: syz [ 481.933627][ T5741] usb 3-1: Manufacturer: syz [ 481.943330][ T5741] usb 3-1: SerialNumber: syz [ 481.970132][T12289] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 482.011789][ T5741] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 482.041701][ T5741] usbtest 3-1:1.0: Linux user mode ISO test driver [ 482.050121][ T5741] usbtest 3-1:1.0: high-speed {control bulk-in bulk-out} tests (+alt) [ 482.428570][T12289] SET target dimension over the limit! [ 482.784569][ T5755] snd_usb_pod 1-1:1.1: set_interface failed [ 482.802080][T12289] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1014'. [ 482.813233][ T5755] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now disconnected [ 482.829688][ T5755] snd_usb_pod 1-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 482.846966][ T5710] usb 3-1: USB disconnect, device number 44 [ 482.877779][ T5755] usb 1-1: USB disconnect, device number 30 [ 483.546514][ T29] audit: type=1400 audit(1785057827.457:1010): avc: denied { unmount } for pid=5618 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 483.598445][T12366] ieee802154 phy0 wpan0: encryption failed: -22 [ 483.601149][ T4980] Dev loop2: unable to read RDB block 7 [ 483.648620][ T4980] loop2: AHDI p1 p2 p3 [ 483.671568][ T4980] loop2: partition table partially beyond EOD, truncated [ 483.702550][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 483.729374][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 484.273571][ T9] usb 4-1: new full-speed USB device number 41 using dummy_hcd [ 484.431605][ T9] usb 4-1: device descriptor read/64, error -71 [ 484.493659][ T4980] Dev loop2: unable to read RDB block 7 [ 484.499680][ T4980] loop2: AHDI p1 p2 p3 [ 484.506845][ T4980] loop2: partition table partially beyond EOD, truncated [ 484.635680][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 484.723268][ T9] usb 4-1: new full-speed USB device number 42 using dummy_hcd [ 484.747374][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 484.943599][ T9] usb 4-1: device descriptor read/64, error -71 [ 485.079235][ T9] usb usb4-port1: attempt power cycle [ 485.123373][ T29] audit: type=1400 audit(1785057829.027:1011): avc: denied { set_context_mgr } for pid=12397 comm="syz.0.1031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 485.126907][T12398] binder: 12397:12398 ioctl ae9a 0 returned -22 [ 485.224523][T12398] netlink: 39 bytes leftover after parsing attributes in process `syz.0.1031'. [ 485.233000][ T29] audit: type=1400 audit(1785057829.037:1012): avc: denied { append } for pid=12397 comm="syz.0.1031" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 485.258037][ T29] audit: type=1400 audit(1785057829.127:1013): avc: denied { map } for pid=12397 comm="syz.0.1031" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 485.293092][ T29] audit: type=1400 audit(1785057829.147:1014): avc: denied { call } for pid=12397 comm="syz.0.1031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 485.312463][ T29] audit: type=1400 audit(1785057829.147:1015): avc: denied { relabelfrom } for pid=12397 comm="syz.0.1031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 485.332813][ T29] audit: type=1400 audit(1785057829.147:1016): avc: denied { relabelto } for pid=12397 comm="syz.0.1031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 485.432836][ T9] usb 4-1: new full-speed USB device number 43 using dummy_hcd [ 485.473332][ T9] usb 4-1: device descriptor read/8, error -71 [ 485.642104][ T4980] Dev loop2: unable to read RDB block 7 [ 485.654702][ T4980] loop2: AHDI p1 p2 p3 [ 485.663741][ T4980] loop2: partition table partially beyond EOD, truncated [ 485.678845][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 485.692812][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 485.724022][ T9] usb 4-1: new full-speed USB device number 44 using dummy_hcd [ 485.763597][ T9] usb 4-1: device descriptor read/8, error -71 [ 485.872363][T12412] netlink: zone id is out of range [ 485.884949][ T9] usb usb4-port1: unable to enumerate USB device [ 485.892781][T12412] netlink: zone id is out of range [ 485.913060][T12412] netlink: zone id is out of range [ 485.927404][T12412] netlink: del zone limit has 4 unknown bytes [ 486.313618][ T5710] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 486.493867][ T5710] usb 3-1: Using ep0 maxpacket: 32 [ 486.503423][ T5710] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 486.521232][ T5710] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 486.555137][ T5710] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 486.583631][ T5710] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 486.604418][ T5710] usb 3-1: config 1 has no interface number 0 [ 486.613075][ T5710] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 486.622954][ T5741] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 486.638378][ T5710] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.639480][T12433] Cannot find set identified by id 0 to match [ 486.667495][ T5710] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 486.783078][ T5741] usb 2-1: Using ep0 maxpacket: 32 [ 486.790536][ T5741] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 486.811623][ T5741] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 486.830352][ T5741] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 486.839925][ T5741] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.866084][ T5741] usb 2-1: config 0 descriptor?? [ 486.880308][ T5710] snd_usb_pod 3-1:1.1: set_interface failed [ 486.896114][ T5710] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 486.909538][ T5741] hub 2-1:0.0: USB hub found [ 486.942140][ T5710] snd_usb_pod 3-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 487.035475][T12453] sch_tbf: burst 19872 is lower than device lo mtu (32783) ! [ 487.150007][ T5710] usb 3-1: USB disconnect, device number 45 [ 487.257118][ T5741] hub 2-1:0.0: 1 port detected [ 487.412244][T12426] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.436590][T12426] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.790118][ T4980] Dev loop2: unable to read RDB block 7 [ 487.801498][ T4980] loop2: AHDI p1 p2 p3 [ 487.812471][ T4980] loop2: partition table partially beyond EOD, truncated [ 487.820631][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 487.884051][ T5741] hub 2-1:0.0: hub_ext_port_status failed (err = 0) [ 488.181105][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 488.182341][T12474] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.347874][T12474] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.562195][ T4980] Dev loop2: unable to read RDB block 7 [ 488.577983][ T4980] loop2: AHDI p1 p2 p3 [ 488.595582][ T4980] loop2: partition table partially beyond EOD, truncated [ 488.629172][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 488.651304][ T9] usb 2-1: USB disconnect, device number 52 [ 488.666246][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 488.699759][ T29] audit: type=1400 audit(1785057832.607:1017): avc: denied { read write } for pid=12498 comm="syz.2.1045" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 488.763163][ T5741] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 488.809097][ T29] audit: type=1400 audit(1785057832.607:1018): avc: denied { ioctl open } for pid=12498 comm="syz.2.1045" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 488.862394][ T4980] Dev loop2: unable to read RDB block 7 [ 488.870161][ T4980] loop2: AHDI p1 p2 p3 [ 488.876564][ T4980] loop2: partition table partially beyond EOD, truncated [ 488.884765][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 488.892107][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 489.004936][ T5741] usb 6-1: Using ep0 maxpacket: 8 [ 489.021077][ T5741] usb 6-1: config 254 has 0 interfaces, different from the descriptor's value: 1 [ 489.065142][ T5741] usb 6-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 489.072795][ T9] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 489.088463][ T5741] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.106506][ T5741] usb 6-1: Product: syz [ 489.114430][ T5741] usb 6-1: Manufacturer: syz [ 489.119094][ T5741] usb 6-1: SerialNumber: syz [ 489.192918][ T5710] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 489.325397][ T9] usb 1-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 489.334930][ T5808] usb 2-1: new full-speed USB device number 53 using dummy_hcd [ 489.342986][ T5710] usb 3-1: Using ep0 maxpacket: 8 [ 489.343078][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.361423][ T5710] usb 3-1: config 254 has 0 interfaces, different from the descriptor's value: 1 [ 489.532114][ T9] usb 1-1: Product: syz [ 489.533553][ T5710] usb 3-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 489.551741][ T5710] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.554278][ T9] usb 1-1: Manufacturer: syz [ 489.613652][ T9] usb 1-1: SerialNumber: syz [ 489.620420][ T5710] usb 3-1: Product: syz [ 489.681054][ T5710] usb 3-1: Manufacturer: syz [ 489.683997][ T9] usb 1-1: config 0 descriptor?? [ 489.687446][ T5710] usb 3-1: SerialNumber: syz [ 489.695829][ T5808] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 489.706434][ T5808] usb 2-1: config 0 has no interfaces? [ 489.716483][ T5808] usb 2-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 489.726519][ T5808] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.739013][ T5808] usb 2-1: Product: syz [ 489.749270][ T5808] usb 2-1: Manufacturer: syz [ 489.754619][ T5808] usb 2-1: SerialNumber: syz [ 489.765698][ T5808] usb 2-1: config 0 descriptor?? [ 489.949109][ T9] usb 1-1: ignoring: probably an ADSL modem [ 489.984720][ T5808] usb 2-1: USB disconnect, device number 53 [ 490.138500][T12552] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1052'. [ 490.206510][T12553] ceph: Path missing in source [ 490.355784][ T9] cxacru 1-1:0.0: usbatm_usb_probe: bind failed: -19! [ 490.574089][T12557] netlink: zone id is out of range [ 490.580257][T12557] netlink: zone id is out of range [ 490.586324][T12557] netlink: zone id is out of range [ 490.589059][T12509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.592242][T12557] netlink: del zone limit has 4 unknown bytes [ 490.627560][T12509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.639222][ T9] usb 1-1: USB disconnect, device number 31 [ 490.944045][ T5808] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 491.102830][ T5808] usb 2-1: Using ep0 maxpacket: 32 [ 491.125368][ T5808] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 491.142860][ T5808] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 491.153238][ T5808] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 491.173062][ T5808] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 491.182619][ T5808] usb 2-1: config 1 has no interface number 0 [ 491.188968][ T5808] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 491.210322][ T5808] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.248304][ T5808] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 491.584200][T12591] sch_tbf: burst 19872 is lower than device lo mtu (32783) ! [ 491.797650][ T5710] usb 6-1: USB disconnect, device number 22 [ 491.845382][ T5808] snd_usb_pod 2-1:1.1: set_interface failed [ 491.880265][ T5808] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 491.918873][ T5808] snd_usb_pod 2-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 491.943020][ T9] usb 3-1: USB disconnect, device number 46 [ 491.958512][ T5808] usb 2-1: USB disconnect, device number 54 [ 491.998409][ T4980] Dev loop2: unable to read RDB block 7 [ 492.018746][ T4980] loop2: AHDI p1 p2 p3 [ 492.038325][ T4980] loop2: partition table partially beyond EOD, truncated [ 492.071230][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 492.088380][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 492.109652][ T29] audit: type=1400 audit(1785057836.017:1019): avc: denied { getopt } for pid=12614 comm="syz.2.1061" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 492.349361][ T5710] usb 1-1: new full-speed USB device number 32 using dummy_hcd [ 492.395187][T12631] sch_tbf: burst 19872 is lower than device lo mtu (32783) ! [ 492.598322][ T5710] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 492.631940][ T5710] usb 1-1: config 0 has no interfaces? [ 492.660499][ T5710] usb 1-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 492.686947][ T5710] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.708856][ T5710] usb 1-1: Product: syz [ 492.721023][ T5710] usb 1-1: Manufacturer: syz [ 492.731748][ T5710] usb 1-1: SerialNumber: syz [ 492.739395][ T29] audit: type=1400 audit(1785057836.647:1020): avc: denied { read } for pid=12635 comm="syz.1.1066" path="socket:[34990]" dev="sockfs" ino=34990 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 492.766077][ T5710] usb 1-1: config 0 descriptor?? [ 492.786125][ T4980] Dev loop2: unable to read RDB block 7 [ 492.792094][ T4980] loop2: AHDI p1 p2 p3 [ 492.797656][ T4980] loop2: partition table partially beyond EOD, truncated [ 492.808622][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 492.816343][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 493.064192][ T5710] usb 1-1: USB disconnect, device number 32 [ 493.369877][ T4980] Dev loop2: unable to read RDB block 7 [ 493.389695][ T4980] loop2: AHDI p1 p2 p3 [ 493.404904][ T4980] loop2: partition table partially beyond EOD, truncated [ 493.423145][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 493.439543][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 494.597484][ T4980] Dev loop2: unable to read RDB block 7 [ 494.603628][ T4980] loop2: AHDI p1 p2 p3 [ 494.607905][ T4980] loop2: partition table partially beyond EOD, truncated [ 494.617412][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 494.624911][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 495.151836][T12695] Cannot find set identified by id 0 to match [ 496.646635][ T4980] Dev loop2: unable to read RDB block 7 [ 496.652773][ T4980] loop2: AHDI p1 p2 p3 [ 496.658038][ T4980] loop2: partition table partially beyond EOD, truncated [ 496.669498][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 496.699644][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 496.962415][ T29] audit: type=1400 audit(1785057840.867:1021): avc: denied { mount } for pid=12721 comm="syz.2.1081" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 497.082856][ T5808] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 497.242828][ T5808] usb 2-1: Using ep0 maxpacket: 8 [ 497.260557][ T5808] usb 2-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 497.273042][ T5808] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.281923][ T5808] usb 2-1: Product: syz [ 497.294616][ T5808] usb 2-1: Manufacturer: syz [ 497.299379][ T5808] usb 2-1: SerialNumber: syz [ 497.362758][ T5710] usb 4-1: new full-speed USB device number 45 using dummy_hcd [ 497.535966][ T5710] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 497.563167][ T5710] usb 4-1: config 0 has no interfaces? [ 497.591255][ T5710] usb 4-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 497.606354][ T5710] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.750963][ T5808] mxuport 2-1:254.0: mxuport_recv_ctrl_urb - usb_control_msg failed (-71) [ 497.751749][ T5710] usb 4-1: Product: syz [ 497.766819][ T5710] usb 4-1: Manufacturer: syz [ 497.772569][ T5808] mxuport 2-1:254.0: probe with driver mxuport failed with error -5 [ 497.773497][ T5710] usb 4-1: SerialNumber: syz [ 497.859745][T12749] 0x000000000006-0x000000020000 : "" [ 497.877956][ T29] audit: type=1400 audit(1785057841.757:1022): avc: denied { map } for pid=12743 comm="syz.5.1084" path="socket:[35287]" dev="sockfs" ino=35287 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 497.935445][T12749] ftl_cs: FTL header corrupt! [ 498.181703][ T5808] usb 2-1: USB disconnect, device number 55 [ 498.210103][ T5710] usb 4-1: config 0 descriptor?? [ 498.216241][ T29] audit: type=1400 audit(1785057841.767:1023): avc: denied { write } for pid=12743 comm="syz.5.1084" name="mtd0" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 498.253905][ T29] audit: type=1400 audit(1785057841.767:1024): avc: denied { open } for pid=12743 comm="syz.5.1084" path="/dev/mtd0" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 498.278782][ T29] audit: type=1400 audit(1785057841.767:1025): avc: denied { ioctl } for pid=12743 comm="syz.5.1084" path="/dev/mtd0" dev="devtmpfs" ino=704 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 498.564561][ T5710] usb 4-1: USB disconnect, device number 45 [ 498.675437][ T4980] Dev loop2: unable to read RDB block 7 [ 498.693346][ T4980] loop2: AHDI p1 p2 p3 [ 498.701937][ T4980] loop2: partition table partially beyond EOD, truncated [ 498.716263][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 498.723943][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 498.780251][ T29] audit: type=1400 audit(1785057842.687:1026): avc: denied { setopt } for pid=12777 comm="syz.2.1087" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 498.858288][ T4980] Dev loop2: unable to read RDB block 7 [ 498.871550][ T4980] loop2: AHDI p1 p2 p3 [ 498.882041][ T4980] loop2: partition table partially beyond EOD, truncated [ 498.891524][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 498.900470][ T5808] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 498.908387][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 499.063863][ T29] audit: type=1400 audit(1785057842.967:1027): avc: denied { cmd } for pid=12782 comm="syz.1.1088" path="/dev/ublk-control" dev="devtmpfs" ino=697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 499.084184][ T5808] usb 6-1: Using ep0 maxpacket: 8 [ 499.372106][ T5808] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 499.392580][ T5808] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 499.402940][ T5808] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 499.441662][ T5808] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 499.485739][ T5808] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 499.504268][ T5808] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 499.935509][T12793] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 500.040753][T12814] FAULT_INJECTION: forcing a failure. [ 500.040753][T12814] name failslab, interval 1, probability 0, space 0, times 0 [ 500.085231][ T5808] usb 6-1: GET_CAPABILITIES returned 0 [ 500.088636][T12814] CPU: 1 UID: 0 PID: 12814 Comm: syz.1.1092 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.088669][T12814] Tainted: [L]=SOFTLOCKUP [ 500.088676][T12814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 500.088689][T12814] Call Trace: [ 500.088695][T12814] [ 500.088703][T12814] dump_stack_lvl+0x100/0x190 [ 500.088733][T12814] should_fail_ex.cold+0x5/0xa [ 500.088759][T12814] should_failslab+0xc2/0x120 [ 500.088785][T12814] kmem_cache_alloc_noprof+0x91/0x6a0 [ 500.088810][T12814] ? dst_alloc+0x99/0x1a0 [ 500.088836][T12814] dst_alloc+0x99/0x1a0 [ 500.088860][T12814] rt_dst_alloc+0x35/0x3a0 [ 500.088884][T12814] ip_route_output_key_hash_rcu+0x87a/0x2870 [ 500.088922][T12814] ip_route_output_key_hash+0x118/0x2b0 [ 500.088950][T12814] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 500.088984][T12814] ? find_held_lock+0x2b/0x80 [ 500.089018][T12814] ip_route_output_flow+0x27/0x150 [ 500.089047][T12814] udp_sendmsg+0x198a/0x2720 [ 500.089074][T12814] ? __pfx_udp_sendmsg+0x10/0x10 [ 500.089093][T12814] ? __pfx_avc_has_perm+0x10/0x10 [ 500.089120][T12814] ? rcu_is_watching+0x12/0xc0 [ 500.089153][T12814] ? do_user_addr_fault+0x7de/0x12f0 [ 500.089182][T12814] ? do_user_addr_fault+0x7de/0x12f0 [ 500.089218][T12814] ? __pfx_sock_has_perm+0x10/0x10 [ 500.089262][T12814] ? __pfx_udp_sendmsg+0x10/0x10 [ 500.089282][T12814] inet_sendmsg+0x105/0x140 [ 500.089308][T12814] ____sys_sendmsg+0x9c9/0xbe0 [ 500.089335][T12814] ? __pfx_inet_sendmsg+0x10/0x10 [ 500.089361][T12814] ? __pfx_____sys_sendmsg+0x10/0x10 [ 500.089394][T12814] ? __pfx__kstrtoull+0x10/0x10 [ 500.089419][T12814] ___sys_sendmsg+0x190/0x1e0 [ 500.089452][T12814] ? __pfx____sys_sendmsg+0x10/0x10 [ 500.089494][T12814] ? find_held_lock+0x2b/0x80 [ 500.089542][T12814] __sys_sendmmsg+0x20c/0x440 [ 500.089569][T12814] ? __pfx___sys_sendmmsg+0x10/0x10 [ 500.089592][T12814] ? ksys_write+0x190/0x250 [ 500.089642][T12814] ? fput+0x79/0x100 [ 500.089664][T12814] ? ksys_write+0x1ac/0x250 [ 500.089693][T12814] ? __pfx_ksys_write+0x10/0x10 [ 500.089727][T12814] __x64_sys_sendmmsg+0x9c/0x100 [ 500.089750][T12814] ? lockdep_hardirqs_on+0x78/0x100 [ 500.089772][T12814] do_syscall_64+0x115/0x870 [ 500.089792][T12814] ? clear_bhb_loop+0x40/0x90 [ 500.089815][T12814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.089836][T12814] RIP: 0033:0x7fd464b9de99 [ 500.089853][T12814] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 500.089872][T12814] RSP: 002b:00007fd462dd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 500.089892][T12814] RAX: ffffffffffffffda RBX: 00007fd464e26090 RCX: 00007fd464b9de99 [ 500.089904][T12814] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000007 [ 500.089917][T12814] RBP: 00007fd462dd5090 R08: 0000000000000000 R09: 0000000000000000 [ 500.089930][T12814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 500.089941][T12814] R13: 00007fd464e26128 R14: 00007fd464e26090 R15: 00007fff65646048 [ 500.089969][T12814] [ 500.401066][ T4980] Dev loop2: unable to read RDB block 7 [ 500.413056][ T4980] loop2: AHDI p1 p2 p3 [ 500.458969][ T4980] loop2: partition table partially beyond EOD, truncated [ 500.474341][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 500.503473][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 501.148660][T12850] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1094'. [ 501.452940][ T29] audit: type=1400 audit(1785057845.077:1028): avc: denied { read write } for pid=12849 comm="syz.2.1094" name="uinput" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 501.567403][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.613059][ T5808] usbtmc 6-1:16.0: can't read capabilities [ 501.629217][ T5733] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 501.724415][ T29] audit: type=1400 audit(1785057845.077:1029): avc: denied { open } for pid=12849 comm="syz.2.1094" path="/dev/uinput" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 501.781361][ T5808] usb 6-1: USB disconnect, device number 23 [ 501.832785][ T191] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 501.857903][ T29] audit: type=1400 audit(1785057845.077:1030): avc: denied { ioctl } for pid=12849 comm="syz.2.1094" path="/dev/uinput" dev="devtmpfs" ino=921 ioctlcmd=0x5567 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 501.866526][ T5733] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 501.967460][T12875] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1097'. [ 502.001299][ T5733] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 502.021410][ T191] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 502.041407][T12875] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 502.051457][ T5733] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 502.062220][ T191] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 502.082874][ T5733] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.091528][ T191] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 502.092943][T12877] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1098'. [ 502.137984][ T5733] usb 3-1: config 0 descriptor?? [ 502.148760][ T191] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 212, setting to 64 [ 502.195894][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 502.195912][ T29] audit: type=1400 audit(1785057846.097:1032): avc: denied { connect } for pid=12873 comm="syz.1.1098" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 502.240406][ T191] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 502.291954][ T29] audit: type=1400 audit(1785057846.197:1033): avc: denied { mount } for pid=12883 comm="syz.5.1099" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 502.335468][ T191] usb 1-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 502.426096][T12887] netlink: 'syz.5.1100': attribute type 2 has an invalid length. [ 502.448293][ T191] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.470716][ T191] usb 1-1: Product: syz [ 502.487105][ T191] usb 1-1: Manufacturer: syz [ 502.503513][ T191] usb 1-1: SerialNumber: syz [ 502.521058][ T191] usb 1-1: config 0 descriptor?? [ 502.551814][T12856] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 502.589933][ T5733] usbhid 3-1:0.0: can't add hid device: -71 [ 502.619289][ T5733] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 502.967262][ T5733] usb 3-1: USB disconnect, device number 47 [ 503.023409][T12905] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12905 comm=syz.5.1102 [ 503.072778][ T191] rc_core: IR keymap rc-xbox-dvd not found [ 503.081132][ T191] Registered IR keymap rc-empty [ 503.102494][ T191] rc rc0: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 503.123302][ T191] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input36 [ 503.682252][ T4980] Dev loop2: unable to read RDB block 7 [ 503.690546][ T4980] loop2: AHDI p1 p2 p3 [ 503.699471][ T4980] loop2: partition table partially beyond EOD, truncated [ 503.728556][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 503.757727][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 504.030412][ T4980] Dev loop2: unable to read RDB block 7 [ 504.072510][ T4980] loop2: AHDI p1 p2 p3 [ 504.096545][ T4980] loop2: partition table partially beyond EOD, truncated [ 504.125333][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 504.162189][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 504.446354][ T29] audit: type=1400 audit(1785057848.357:1034): avc: denied { sqpoll } for pid=12954 comm="syz.2.1109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 505.609762][ T4980] Dev loop2: unable to read RDB block 7 [ 505.617789][ T4980] loop2: AHDI p1 p2 p3 [ 505.622213][ T4980] loop2: partition table partially beyond EOD, truncated [ 505.634007][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 505.636141][ T29] audit: type=1400 audit(1785057849.547:1035): avc: denied { ioctl } for pid=12964 comm="syz.1.1111" path="socket:[34741]" dev="sockfs" ino=34741 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 505.641076][ T4980] loop2: p2 start 1702059890 is beyond EOD, [ 505.938597][ T29] audit: type=1400 audit(1785057849.677:1036): avc: denied { write } for pid=12964 comm="syz.1.1111" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 506.052885][ T4980] truncated [ 506.198690][ T29] audit: type=1400 audit(1785057849.697:1037): avc: denied { open } for pid=12964 comm="syz.1.1111" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 506.350418][ T29] audit: type=1400 audit(1785057849.737:1038): avc: denied { ioctl } for pid=12964 comm="syz.1.1111" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4611 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 506.428592][ T5710] usb 1-1: USB disconnect, device number 33 [ 506.428612][ C0] xbox_remote 1-1:0.0: xbox_remote_irq_in: usb_submit_urb()=-19 [ 506.942884][ T5808] usb 2-1: new full-speed USB device number 56 using dummy_hcd [ 507.115159][ T5808] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 507.137032][ T5808] usb 2-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 507.316567][ T5808] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.508813][ T5808] usb 2-1: Product: syz [ 507.523565][ T5808] usb 2-1: Manufacturer: syz [ 507.538339][ T5808] usb 2-1: SerialNumber: syz [ 507.569956][ T5808] usb 2-1: config 0 descriptor?? [ 507.798615][ T5741] usb 2-1: USB disconnect, device number 56 [ 508.262019][T13022] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 509.032782][ T191] usb 2-1: new full-speed USB device number 57 using dummy_hcd [ 509.088299][T13046] netlink: zone id is out of range [ 509.107087][T13046] netlink: zone id is out of range [ 509.124162][T13046] netlink: zone id is out of range [ 509.133691][T13046] netlink: del zone limit has 4 unknown bytes [ 509.226449][ T191] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 509.282369][ T191] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 509.324797][ T191] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 509.370169][ T191] usb 2-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 509.404933][ T191] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 509.428553][ T191] usb 2-1: config 0 descriptor?? [ 509.495641][ T5808] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 509.662948][ T5808] usb 1-1: Using ep0 maxpacket: 32 [ 509.684991][ T5808] usb 1-1: config index 0 descriptor too short (expected 35577, got 27) [ 509.841358][ T5808] usb 1-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 509.869193][ T5808] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 510.310762][ T5808] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 510.341905][ T5808] usb 1-1: config 1 has no interface number 0 [ 510.348651][ T5808] usb 1-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 510.359192][ T5808] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.383814][ T5808] snd_usb_pod 1-1:1.1: Line 6 Pocket POD found [ 510.622979][ T5808] snd_usb_pod 1-1:1.1: set_interface failed [ 510.639288][ T5808] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now disconnected [ 510.652399][ T5808] snd_usb_pod 1-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 510.675966][ T5808] usb 1-1: USB disconnect, device number 34 [ 510.791529][ T4980] Dev loop2: unable to read RDB block 7 [ 510.809734][ T4980] loop2: AHDI p1 p2 p3 [ 510.825281][ T4980] loop2: partition table partially beyond EOD, truncated [ 510.849415][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 511.007984][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 511.022847][ T5733] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 511.661837][ T5733] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 511.782354][ T5733] usb 4-1: config 1 has no interface number 0 [ 511.807911][T13085] set match dimension is over the limit! [ 511.810900][ T5733] usb 4-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 511.860978][ T5733] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 511.876042][ T4980] Dev loop2: unable to read RDB block 7 [ 511.903064][ T4980] loop2: AHDI p1 p2 p3 [ 511.909263][ T5733] usb 4-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 511.941653][T13087] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1129'. [ 512.015679][ T4980] loop2: partition table partially beyond EOD, truncated [ 512.025852][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 512.044855][T13089] ceph: Path missing in source [ 512.310856][ T5733] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 512.336173][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 512.340694][ T5733] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.411398][ T5733] usb 4-1: Product: syz [ 512.435541][ T5733] usb 4-1: Manufacturer: syz [ 512.452257][ T5733] usb 4-1: SerialNumber: syz [ 512.507166][T13068] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 513.073354][T13068] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 513.336401][ T191] usbhid 2-1:0.0: can't add hid device: -71 [ 513.358162][ T191] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 513.398751][ T191] usb 2-1: USB disconnect, device number 57 [ 513.410934][ T5733] sierra_net 4-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.3-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:07 [ 513.466547][ T4980] Dev loop2: unable to read RDB block 7 [ 513.488484][ T4980] loop2: AHDI p1 p2 p3 [ 513.505318][ T4980] loop2: partition table partially beyond EOD, truncated [ 513.530859][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 513.550835][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 513.633705][ T29] audit: type=1400 audit(1785057857.547:1039): avc: denied { create } for pid=13123 comm="syz.0.1134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 513.703910][ T29] audit: type=1400 audit(1785057857.567:1040): avc: denied { setopt } for pid=13123 comm="syz.0.1134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 513.802878][ T191] usb 2-1: new full-speed USB device number 58 using dummy_hcd [ 514.244987][T13139] netlink: 'syz.2.1135': attribute type 10 has an invalid length. [ 514.283398][T13139] team0: Port device dummy0 added [ 514.343715][T13139] netlink: 'syz.2.1135': attribute type 10 has an invalid length. [ 514.710354][T13139] team0: Port device dummy0 removed [ 514.842043][ T191] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 514.896913][ T191] usb 2-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 514.921773][ T29] audit: type=1400 audit(1785057858.827:1041): avc: denied { read } for pid=5275 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 514.925274][ T191] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.054768][ T5807] usb 4-1: USB disconnect, device number 46 [ 515.063517][ T5807] sierra_net 4-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.3-1, Sierra Wireless USB-to-WWAN Modem [ 515.081995][ T191] usb 2-1: Product: syz [ 515.086642][ T191] usb 2-1: Manufacturer: syz [ 515.091291][ T191] usb 2-1: SerialNumber: syz [ 515.099544][ T4980] Dev loop2: unable to read RDB block 7 [ 515.102287][ T191] usb 2-1: config 0 descriptor?? [ 515.149159][ T4980] loop2: AHDI p1 p2 p3 [ 515.160754][ T4980] loop2: partition table partially beyond EOD, truncated [ 515.172114][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 515.182551][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 515.213422][ T5807] sierra_net 4-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 515.360906][ T29] audit: type=1400 audit(1785057859.267:1042): avc: denied { ioctl } for pid=13123 comm="syz.0.1134" path="socket:[35944]" dev="sockfs" ino=35944 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 515.375594][T13125] netlink: 23 bytes leftover after parsing attributes in process `syz.0.1134'. [ 515.401700][T13172] netlink: zone id is out of range [ 515.411153][T13172] netlink: zone id is out of range [ 515.422021][ T5741] usb 2-1: USB disconnect, device number 58 [ 515.436167][ T29] audit: type=1400 audit(1785057859.277:1043): avc: denied { bind } for pid=13123 comm="syz.0.1134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 515.462941][T13172] netlink: zone id is out of range [ 515.476326][T13172] netlink: del zone limit has 4 unknown bytes [ 515.483996][ T29] audit: type=1400 audit(1785057859.287:1044): avc: denied { create } for pid=13123 comm="syz.0.1134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 515.505493][ T29] audit: type=1400 audit(1785057859.287:1045): avc: denied { write } for pid=13123 comm="syz.0.1134" path="socket:[35788]" dev="sockfs" ino=35788 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 515.783212][ T5710] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 515.808139][ T29] audit: type=1400 audit(1785057859.717:1046): avc: denied { write } for pid=13166 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 515.895867][ T29] audit: type=1400 audit(1785057859.807:1047): avc: denied { write } for pid=13204 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 515.962771][ T5807] usb 4-1: new low-speed USB device number 47 using dummy_hcd [ 515.964134][ T5710] usb 6-1: Using ep0 maxpacket: 32 [ 516.101154][ T5710] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 516.178255][ T5710] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 516.209905][ T5710] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 516.273194][ T5807] usb 4-1: Invalid ep0 maxpacket: 16 [ 516.282803][T13206] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 516.405858][ T5710] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 516.411791][ T4980] Dev loop2: unable to read RDB block 7 [ 516.418425][ T5710] usb 6-1: config 1 has no interface number 0 [ 516.429344][ T5710] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 516.438572][ T5807] usb 4-1: new low-speed USB device number 48 using dummy_hcd [ 516.442047][ T4980] loop2: AHDI p1 p2 p3 [ 516.446796][ T5710] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 516.462365][ T4980] loop2: partition table partially beyond EOD, truncated [ 516.516685][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 516.546890][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 516.561223][ T5710] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 516.583496][ T5807] usb 4-1: Invalid ep0 maxpacket: 16 [ 516.622121][ T5807] usb usb4-port1: attempt power cycle [ 516.782235][ T5710] snd_usb_pod 6-1:1.1: set_interface failed [ 516.803684][ T5710] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 516.825690][ T5710] snd_usb_pod 6-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 516.862132][ T5710] usb 6-1: USB disconnect, device number 24 [ 517.083977][ T5807] usb 4-1: new low-speed USB device number 49 using dummy_hcd [ 517.376321][ T5807] usb 4-1: Invalid ep0 maxpacket: 16 [ 517.442749][ T29] audit: type=1400 audit(1785057861.347:1048): avc: denied { write } for pid=13208 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 517.522847][ T5807] usb 4-1: new low-speed USB device number 50 using dummy_hcd [ 517.553523][ T5807] usb 4-1: Invalid ep0 maxpacket: 16 [ 517.566283][ T5807] usb usb4-port1: unable to enumerate USB device [ 518.703889][ T4980] Dev loop2: unable to read RDB block 7 [ 518.725204][ T4980] loop2: AHDI p1 p2 p3 [ 518.738603][ T4980] loop2: partition table partially beyond EOD, truncated [ 518.762929][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 518.775653][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 519.874846][T13294] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1153'. [ 519.899028][ T4980] Dev loop2: unable to read RDB block 7 [ 519.928725][ T4980] loop2: AHDI p1 p2 p3 [ 519.963487][ T4980] loop2: partition table partially beyond EOD, truncated [ 520.041364][T13296] ceph: Path missing in source [ 520.293304][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 520.300330][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 521.333782][T13323] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 523.326912][ T5807] usb 4-1: new full-speed USB device number 51 using dummy_hcd [ 523.704909][ T5807] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 523.727555][ T5807] usb 4-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 523.748338][ T5807] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.770023][ T5807] usb 4-1: Product: syz [ 523.782866][ T5807] usb 4-1: Manufacturer: syz [ 523.797619][ T5807] usb 4-1: SerialNumber: syz [ 523.821837][ T5807] usb 4-1: config 0 descriptor?? [ 524.112986][ T5807] usb 4-1: USB disconnect, device number 51 [ 524.214343][ T4980] Dev loop2: unable to read RDB block 7 [ 524.230555][ T4980] loop2: AHDI p1 p2 p3 [ 524.245738][ T4980] loop2: partition table partially beyond EOD, truncated [ 524.272963][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 524.289674][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 525.019161][T13379] netlink: 'syz.1.1164': attribute type 4 has an invalid length. [ 525.484811][ T4980] Dev loop2: unable to read RDB block 7 [ 525.490514][ T4980] loop2: AHDI p1 p2 p3 [ 525.495379][ T4980] loop2: partition table partially beyond EOD, truncated [ 525.512462][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 525.555527][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 526.634901][ T4980] Dev loop2: unable to read RDB block 7 [ 526.653615][ T4980] loop2: AHDI p1 p2 p3 [ 526.667278][ T4980] loop2: partition table partially beyond EOD, truncated [ 526.695705][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 526.714866][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 527.321390][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 527.321410][ T29] audit: type=1400 audit(1785057871.227:1050): avc: denied { execute } for pid=13412 comm="syz.2.1171" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=36379 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 527.373473][ T29] audit: type=1400 audit(1785057871.287:1051): avc: denied { ioctl } for pid=13412 comm="syz.2.1171" path="user:[4026531837]" dev="nsfs" ino=4026531837 ioctlcmd=0xb704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 528.420278][ T29] audit: type=1400 audit(1785057872.327:1052): avc: denied { execute_no_trans } for pid=13442 comm="syz.0.1177" path="/213/file2" dev="tmpfs" ino=1174 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 528.496710][T13444] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1177'. [ 528.509504][ T29] audit: type=1400 audit(1785057872.387:1053): avc: denied { create } for pid=13442 comm="syz.0.1177" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 528.547691][T13447] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1177'. [ 528.600177][ T4980] Dev loop2: unable to read RDB block 7 [ 528.627079][ T4980] loop2: AHDI p1 p2 p3 [ 528.641594][ T4980] loop2: partition table partially beyond EOD, truncated [ 528.673999][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 528.692027][T13444] xt_connbytes: Forcing CT accounting to be enabled [ 528.710591][ T4980] loop2: p2 start 1702059890 is beyond EOD, [ 528.712038][T13444] set match dimension is over the limit! [ 528.732734][ T29] audit: type=1400 audit(1785057872.637:1054): avc: denied { append } for pid=13457 comm="syz.5.1179" name="comedi3" dev="devtmpfs" ino=1278 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 528.733897][ T4980] truncated [ 528.924447][ T5733] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 529.096747][ T5733] usb 3-1: Using ep0 maxpacket: 8 [ 529.109286][ T5733] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 529.123182][ T5733] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 529.147166][ T5733] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 529.171747][ T5733] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 529.191375][ T5733] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 529.211142][ T5733] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 529.739183][ T5733] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 529.931145][ T29] audit: type=1400 audit(1785057873.817:1055): avc: denied { mmap_zero } for pid=13469 comm="syz.3.1182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 530.027283][ T29] audit: type=1400 audit(1785057873.907:1056): avc: denied { write } for pid=13469 comm="syz.3.1182" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 530.052610][ T5733] usb 3-1: usb_control_msg returned -32 [ 530.093724][ T5733] usbtmc 3-1:16.0: can't read capabilities [ 530.101285][ T29] audit: type=1400 audit(1785057873.907:1057): avc: denied { open } for pid=13469 comm="syz.3.1182" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 530.693886][ T29] audit: type=1400 audit(1785057873.907:1058): avc: denied { mount } for pid=13469 comm="syz.3.1182" name="/" dev="pstore" ino=1569 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 530.782049][ T29] audit: type=1400 audit(1785057874.687:1059): avc: denied { getopt } for pid=13451 comm="syz.2.1180" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 530.802831][ T191] usb 2-1: new full-speed USB device number 59 using dummy_hcd [ 530.819579][ T5710] usb 3-1: USB disconnect, device number 48 [ 530.965856][ T191] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 530.982566][ T191] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 531.051723][ T191] usb 2-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 531.051758][ T191] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.051782][ T191] usb 2-1: Product: syz [ 531.051796][ T191] usb 2-1: Manufacturer: syz [ 531.051810][ T191] usb 2-1: SerialNumber: syz [ 531.058308][ T191] usb 2-1: config 0 descriptor?? [ 531.366903][T13514] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 531.557406][ T7824] usb 2-1: USB disconnect, device number 59 [ 531.666432][ T4980] Dev loop2: unable to read RDB block 7 [ 531.679325][ T4980] loop2: AHDI p1 p2 p3 [ 531.686541][ T4980] loop2: partition table partially beyond EOD, truncated [ 531.700518][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 531.712975][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 532.053303][ T7824] usb 3-1: new full-speed USB device number 49 using dummy_hcd [ 532.435936][ T7824] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 532.525417][ T7824] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 532.543066][T13546] fuse: Unknown parameter '00000000000000000000' [ 532.574788][ T7824] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 532.612594][ T7824] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 212, setting to 64 [ 532.650231][ T7824] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 532.696289][ T7824] usb 3-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 532.710792][ T7824] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.721433][ T7824] usb 3-1: Product: syz [ 532.741806][ T7824] usb 3-1: Manufacturer: syz [ 532.754971][ T7824] usb 3-1: SerialNumber: syz [ 532.779255][ T7824] usb 3-1: config 0 descriptor?? [ 532.794608][T13531] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 532.933526][ T7824] rc_core: IR keymap rc-xbox-dvd not found [ 532.948683][ T7824] Registered IR keymap rc-empty [ 533.024217][ T7824] rc rc0: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 533.332020][ T7824] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input37 [ 533.661436][T13567] set match dimension is over the limit! [ 534.017697][T13572] syzkaller1: entered promiscuous mode [ 534.037384][T13572] syzkaller1: entered allmulticast mode [ 534.551581][T13581] SELinux: Context system_u:object_r:tmpfs_t:s0 is not valid (left unmapped). [ 534.963317][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 534.963357][ T29] audit: type=1400 audit(1785057878.437:1062): avc: denied { listen } for pid=13578 comm="syz.0.1196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 535.002017][ T29] audit: type=1400 audit(1785057878.457:1063): avc: denied { relabelfrom } for pid=13578 comm="syz.0.1196" name="TCPv6" dev="sockfs" ino=37319 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 535.084145][ T29] audit: type=1400 audit(1785057878.467:1064): avc: denied { relabelto } for pid=13578 comm="syz.0.1196" name="TCPv6" dev="sockfs" ino=37319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=tcp_socket permissive=1 trawcon="system_u:object_r:tmpfs_t:s0" [ 535.730866][ T5733] usb 3-1: USB disconnect, device number 49 [ 535.730983][ C1] xbox_remote 3-1:0.0: xbox_remote_irq_in: usb_submit_urb()=-19 [ 535.909601][ T4980] Dev loop2: unable to read RDB block 7 [ 535.936759][ T4980] loop2: AHDI p1 p2 p3 [ 536.008381][T13607] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 536.176876][ T4980] loop2: partition table partially beyond EOD, truncated [ 536.184110][ T5755] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 536.227490][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 536.235099][T13622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1202'. [ 536.262431][T13622] ceph: Path missing in source [ 536.294671][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 536.404687][ T4980] Dev loop2: unable to read RDB block 7 [ 536.414881][ T5755] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 536.436761][ T4980] loop2: AHDI p1 p2 p3 [ 536.456545][ T4980] loop2: partition table partially beyond EOD, truncated [ 536.463776][ T29] audit: type=1400 audit(1785057880.367:1065): avc: denied { map } for pid=13627 comm="syz.2.1204" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 536.487114][ T5755] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 536.504465][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 536.516048][ T5755] usb 4-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 536.533248][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 536.543089][ T5755] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 536.575541][ T5755] usb 4-1: config 0 descriptor?? [ 536.983620][T13612] tmpfs: Bad value for 'usrquota_inode_hardlimit' [ 537.302858][ T7824] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 537.458435][ T7824] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 537.476820][ T7824] usb 3-1: config 0 has no interface number 0 [ 537.501309][ T7824] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 537.538263][ T7824] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 537.554523][ T7824] usb 3-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 537.592530][ T7824] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 537.679536][ T7824] usb 3-1: config 0 descriptor?? [ 538.018076][ T5755] usbhid 4-1:0.0: can't add hid device: -71 [ 538.266706][ T5755] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 538.536193][ T5755] usb 4-1: USB disconnect, device number 52 [ 538.962571][T13680] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1211'. [ 539.088860][T13683] RDS: rds_bind could not find a transport for ::ffff:172.20.20.187, load rds_tcp or rds_rdma? [ 539.104313][T13683] FAULT_INJECTION: forcing a failure. [ 539.104313][T13683] name failslab, interval 1, probability 0, space 0, times 0 [ 539.117078][T13683] CPU: 0 UID: 0 PID: 13683 Comm: syz.1.1211 Tainted: G L syzkaller #0 PREEMPT(full) [ 539.117112][T13683] Tainted: [L]=SOFTLOCKUP [ 539.117120][T13683] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 539.117132][T13683] Call Trace: [ 539.117141][T13683] [ 539.117150][T13683] dump_stack_lvl+0x100/0x190 [ 539.117170][T13683] should_fail_ex.cold+0x5/0xa [ 539.117184][T13683] should_failslab+0xc2/0x120 [ 539.117208][T13683] __kvmalloc_node_noprof+0x116/0x970 [ 539.117235][T13683] ? xt_alloc_entry_offsets+0x42/0x60 [ 539.117264][T13683] xt_alloc_entry_offsets+0x42/0x60 [ 539.117283][T13683] translate_table+0x229/0x16c0 [ 539.117302][T13683] ? __pfx_translate_table+0x10/0x10 [ 539.117318][T13683] do_ip6t_set_ctl+0x689/0xd00 [ 539.117329][T13683] ? nf_sockopt_find.isra.0+0x222/0x290 [ 539.117346][T13683] ? nf_sockopt_find.isra.0+0x222/0x290 [ 539.117373][T13683] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 539.117395][T13683] ? __mutex_unlock_slowpath+0x35d/0x930 [ 539.117423][T13683] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 539.117443][T13683] ? nf_sockopt_find.isra.0+0x222/0x290 [ 539.117457][T13683] nf_setsockopt+0x8d/0xf0 [ 539.117471][T13683] ipv6_setsockopt+0x135/0x170 [ 539.117488][T13683] tcp_setsockopt+0xa7/0x100 [ 539.117517][T13683] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 539.117549][T13683] do_sock_setsockopt+0xf3/0x1d0 [ 539.117575][T13683] __sys_setsockopt+0x195/0x220 [ 539.117590][T13683] __x64_sys_setsockopt+0xbd/0x160 [ 539.117602][T13683] ? do_syscall_64+0x90/0x870 [ 539.117614][T13683] ? lockdep_hardirqs_on+0x78/0x100 [ 539.117625][T13683] do_syscall_64+0x115/0x870 [ 539.117643][T13683] ? clear_bhb_loop+0x40/0x90 [ 539.117668][T13683] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.117690][T13683] RIP: 0033:0x7fd464b9de99 [ 539.117708][T13683] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 539.117721][T13683] RSP: 002b:00007fd462db4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 539.117732][T13683] RAX: ffffffffffffffda RBX: 00007fd464e26180 RCX: 00007fd464b9de99 [ 539.117740][T13683] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000006 [ 539.117747][T13683] RBP: 00007fd462db4090 R08: 0000000000000310 R09: 0000000000000000 [ 539.117753][T13683] R10: 0000200000000680 R11: 0000000000000246 R12: 0000000000000001 [ 539.117760][T13683] R13: 00007fd464e26218 R14: 00007fd464e26180 R15: 00007fff65646048 [ 539.117776][T13683] [ 539.662795][ T5733] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 539.777770][ T7824] usbhid 3-1:0.1: can't add hid device: -71 [ 539.793216][ T7824] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 539.915847][ T5733] usb 1-1: Using ep0 maxpacket: 8 [ 539.921636][T13693] netlink: zone id is out of range [ 539.933800][ T5733] usb 1-1: config 2 has an invalid interface number: 118 but max is 0 [ 539.942761][ T5733] usb 1-1: config 2 has no interface number 0 [ 539.948939][ T5733] usb 1-1: config 2 interface 118 has no altsetting 0 [ 539.958012][ T5733] usb 1-1: New USB device found, idVendor=04dd, idProduct=8005, bcdDevice=d9.fa [ 540.386104][ T7824] usb 3-1: USB disconnect, device number 50 [ 540.423533][ T5733] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 540.431592][ T29] audit: type=1400 audit(1785057883.947:1066): avc: denied { read } for pid=13688 comm="syz.1.1213" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 540.461813][T13693] netlink: zone id is out of range [ 540.471207][ T5733] usb 1-1: Product: syz [ 540.478980][T13693] netlink: zone id is out of range [ 540.489044][T13693] netlink: del zone limit has 4 unknown bytes [ 540.503603][ T5733] usb 1-1: Manufacturer: syz [ 540.519074][ T5733] usb 1-1: SerialNumber: syz [ 540.583723][T13704] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1212'. [ 540.739506][ T29] audit: type=1400 audit(1785057884.647:1067): avc: denied { create } for pid=13702 comm="syz.5.1212" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 540.751055][ T5733] usb 1-1: unsupported MDLM descriptors [ 540.781104][ T4980] Dev loop2: unable to read RDB block 7 [ 540.801717][ T4980] loop2: AHDI p1 p2 p3 [ 540.806945][ T29] audit: type=1400 audit(1785057884.727:1068): avc: denied { create } for pid=13712 comm="syz.1.1215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 540.830872][ T4980] loop2: partition table partially beyond EOD, truncated [ 540.831116][ T5733] usb 1-1: USB disconnect, device number 35 [ 540.851558][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 540.863834][ T191] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 540.881571][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 540.894574][ T29] audit: type=1400 audit(1785057884.757:1069): avc: denied { ioctl } for pid=13712 comm="syz.1.1215" path="socket:[36799]" dev="sockfs" ino=36799 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 540.975528][ T29] audit: type=1400 audit(1785057884.757:1070): avc: denied { write } for pid=13712 comm="syz.1.1215" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=socket permissive=1 [ 541.127617][ T191] usb 4-1: Using ep0 maxpacket: 32 [ 541.168371][ T191] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 541.187158][ T191] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 541.437456][ T191] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 541.464973][ T191] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 541.484223][ T191] usb 4-1: config 1 has no interface number 0 [ 541.502024][ T191] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 541.529008][ T191] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 541.574774][ T191] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 542.063063][ T191] snd_usb_pod 4-1:1.1: set_interface failed [ 542.078829][ T191] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 542.093987][ T4980] Dev loop2: unable to read RDB block 7 [ 542.100234][ T191] snd_usb_pod 4-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 542.111100][ T4980] loop2: AHDI p1 p2 p3 [ 542.128430][ T4980] loop2: partition table partially beyond EOD, truncated [ 542.140679][ T191] usb 4-1: USB disconnect, device number 53 [ 542.153334][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 542.169888][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 543.070004][ T29] audit: type=1326 audit(1785057886.977:1071): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13748 comm="syz.2.1219" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc4b79de99 code=0x7ffc0000 [ 543.475324][ T29] audit: type=1326 audit(1785057887.007:1072): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13748 comm="syz.2.1219" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc4b79de99 code=0x7ffc0000 [ 543.583212][ T29] audit: type=1326 audit(1785057887.077:1073): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13748 comm="syz.2.1219" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc4b79de99 code=0x7ffc0000 [ 543.626735][ T29] audit: type=1326 audit(1785057887.077:1075): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13748 comm="syz.2.1219" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=36 compat=0 ip=0x7fbc4b79de99 code=0x7ffc0000 [ 543.683413][ T29] audit: type=1326 audit(1785057887.077:1076): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13748 comm="syz.2.1219" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc4b79de99 code=0x7ffc0000 [ 543.763749][T13778] netlink: 'syz.1.1226': attribute type 46 has an invalid length. [ 543.802842][ T5755] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 543.841369][T13781] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1227'. [ 543.922794][T13782] ceph: Path missing in source [ 543.933312][ T5755] usb 4-1: device descriptor read/64, error -71 [ 544.252784][ T5755] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 544.339407][T13785] bridge2: entered promiscuous mode [ 544.382875][ T5755] usb 4-1: device descriptor read/64, error -71 [ 544.420715][T13748] [U] ^@ [ 544.734879][ T5755] usb usb4-port1: attempt power cycle [ 544.844667][ T4980] Dev loop2: unable to read RDB block 7 [ 544.868596][ T4980] loop2: AHDI p1 p2 p3 [ 544.882241][ T4980] loop2: partition table partially beyond EOD, truncated [ 544.942754][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 545.242817][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 545.251477][ T5755] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 545.302259][ T5755] usb 4-1: device descriptor read/8, error -71 [ 545.418191][ T4980] Dev loop2: unable to read RDB block 7 [ 545.437120][ T4980] loop2: AHDI p1 p2 p3 [ 545.446760][ T4980] loop2: partition table partially beyond EOD, truncated [ 545.455371][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 545.462508][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 545.563467][ T5755] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 545.638055][ T5755] usb 4-1: device descriptor read/8, error -71 [ 545.688856][ T7824] usb 6-1: new full-speed USB device number 25 using dummy_hcd [ 545.903272][ T5755] usb usb4-port1: unable to enumerate USB device [ 546.274834][ T7824] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 546.293854][ T7824] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 546.311704][ T7824] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 546.347930][ T4980] Dev loop2: unable to read RDB block 7 [ 546.362370][ T7824] usb 6-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 546.376996][ T4980] loop2: AHDI p1 p2 p3 [ 546.385159][T13828] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1237'. [ 546.398784][ T4980] loop2: partition table partially beyond EOD, truncated [ 546.406093][ T7824] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 546.418701][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 546.450294][T13830] ceph: Path missing in source [ 546.452038][ T7824] usb 6-1: config 0 descriptor?? [ 546.460342][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 546.854134][ T29] kauditd_printk_skb: 70 callbacks suppressed [ 546.854152][ T29] audit: type=1400 audit(1785057890.757:1146): avc: denied { write } for pid=13835 comm="syz.2.1238" name="sg0" dev="devtmpfs" ino=741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 546.959483][ T29] audit: type=1400 audit(1785057890.767:1147): avc: denied { ioctl } for pid=13835 comm="syz.2.1238" path="/dev/sg0" dev="devtmpfs" ino=741 ioctlcmd=0x2285 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 547.025773][ T29] audit: type=1400 audit(1785057890.857:1148): avc: denied { mounton } for pid=13841 comm="syz.3.1239" path="/255/file0" dev="tmpfs" ino=1357 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 547.217475][ T29] audit: type=1400 audit(1785057891.127:1149): avc: denied { read } for pid=13847 comm="syz.1.1242" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 547.286896][T13849] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 547.305524][ T29] audit: type=1400 audit(1785057891.127:1150): avc: denied { open } for pid=13847 comm="syz.1.1242" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 547.597868][T13861] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 548.169264][T13870] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 548.236333][ T29] audit: type=1400 audit(1785057892.147:1151): avc: denied { create } for pid=13875 comm="syz.1.1245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 548.259461][T13836] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1238'. [ 548.562894][ T5733] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 548.843881][T13897] netlink: 'syz.0.1248': attribute type 1 has an invalid length. [ 548.867490][ T7824] usbhid 6-1:0.0: can't add hid device: -71 [ 548.883907][ T7824] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 548.909797][ T7824] usb 6-1: USB disconnect, device number 25 [ 548.970395][ T5733] usb 3-1: unable to get BOS descriptor or descriptor too short [ 549.284780][ T5733] usb 3-1: string descriptor 0 read error: -22 [ 549.293305][ T5733] usb 3-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice= 0.40 [ 549.309797][T13897] 8021q: adding VLAN 0 to HW filter on device bond1 [ 549.331167][ T5733] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.386246][ T5733] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 549.450181][T13903] bond1: (slave geneve2): making interface the new active one [ 549.465050][T13903] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 549.533707][T13956] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1252'. [ 549.610583][T13958] ceph: Path missing in source [ 549.755929][ T5733] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 550.138163][T13970] Bluetooth: MGMT ver 1.23 [ 550.500153][T13867] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 550.532100][T13867] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 551.287687][ T5733] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 551.324859][ T5733] usb 3-1: USB disconnect, device number 51 [ 551.536566][ T5885] udevd[5885]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 551.739943][ T4980] Dev loop2: unable to read RDB block 7 [ 551.825566][ T4980] loop2: AHDI p1 p2 p3 [ 551.851171][ T4980] loop2: partition table partially beyond EOD, truncated [ 551.870615][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 551.885883][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 552.289604][ T5710] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 552.635672][ T5710] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 552.652923][ T5710] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 552.663639][ T5710] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 552.680205][ T5710] usb 4-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 552.693087][ T5710] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.722158][ T5710] usb 4-1: config 0 descriptor?? [ 552.749268][T14044] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1266'. [ 553.437092][T14052] FAULT_INJECTION: forcing a failure. [ 553.437092][T14052] name failslab, interval 1, probability 0, space 0, times 0 [ 553.451680][T14052] CPU: 0 UID: 0 PID: 14052 Comm: syz.1.1267 Tainted: G L syzkaller #0 PREEMPT(full) [ 553.451714][T14052] Tainted: [L]=SOFTLOCKUP [ 553.451721][T14052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 553.451734][T14052] Call Trace: [ 553.451743][T14052] [ 553.451752][T14052] dump_stack_lvl+0x100/0x190 [ 553.451798][T14052] should_fail_ex.cold+0x5/0xa [ 553.451826][T14052] should_failslab+0xc2/0x120 [ 553.451846][T14052] __kmalloc_noprof+0xfc/0x820 [ 553.451859][T14052] ? rcu_is_watching+0x12/0xc0 [ 553.451875][T14052] ? tomoyo_realpath_from_path+0xb6/0x690 [ 553.451890][T14052] tomoyo_realpath_from_path+0xb6/0x690 [ 553.451910][T14052] tomoyo_path_number_perm+0x23c/0x580 [ 553.451938][T14052] ? tomoyo_path_number_perm+0x22e/0x580 [ 553.451975][T14052] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 553.451996][T14052] ? __pfx___schedule+0x10/0x10 [ 553.452010][T14052] ? preempt_schedule_thunk+0x16/0x40 [ 553.452031][T14052] ? __rcu_read_unlock+0x26a/0x5e0 [ 553.452044][T14052] ? rcu_is_watching+0x12/0xc0 [ 553.452072][T14052] ? hook_file_ioctl_common+0x140/0x440 [ 553.452098][T14052] ? __rcu_read_unlock+0x27f/0x5e0 [ 553.452126][T14052] ? __fget_files+0x21f/0x3d0 [ 553.452143][T14052] security_file_ioctl+0xd3/0x230 [ 553.452161][T14052] __x64_sys_ioctl+0xb7/0x210 [ 553.452177][T14052] do_syscall_64+0x115/0x870 [ 553.452189][T14052] ? clear_bhb_loop+0x40/0x90 [ 553.452213][T14052] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.452236][T14052] RIP: 0033:0x7fd464b9de99 [ 553.452254][T14052] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 553.452273][T14052] RSP: 002b:00007fd462dd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 553.452286][T14052] RAX: ffffffffffffffda RBX: 00007fd464e26090 RCX: 00007fd464b9de99 [ 553.452294][T14052] RDX: 0000200000000280 RSI: 0000000040605346 RDI: 0000000000000008 [ 553.452301][T14052] RBP: 00007fd462dd5090 R08: 0000000000000000 R09: 0000000000000000 [ 553.452307][T14052] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 553.452314][T14052] R13: 00007fd464e26128 R14: 00007fd464e26090 R15: 00007fff65646048 [ 553.452330][T14052] [ 553.452360][T14052] ERROR: Out of memory at tomoyo_realpath_from_path. [ 554.103731][ T4980] Dev loop2: unable to read RDB block 7 [ 554.135114][ T4980] loop2: AHDI p1 p2 p3 [ 554.156947][ T4980] loop2: partition table partially beyond EOD, truncated [ 554.187899][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 554.208206][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 554.636964][T14066] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 555.702174][T14079] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 555.966277][ T4980] Dev loop2: unable to read RDB block 7 [ 555.981875][ T4980] loop2: AHDI p1 p2 p3 [ 555.995162][ T4980] loop2: partition table partially beyond EOD, truncated [ 556.025872][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 556.057294][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 556.682338][ T5710] usbhid 4-1:0.0: can't add hid device: -71 [ 556.698794][ T5710] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 556.996349][ T5710] usb 4-1: USB disconnect, device number 58 [ 557.630915][ T4980] Dev loop2: unable to read RDB block 7 [ 557.650024][ T4980] loop2: AHDI p1 p2 p3 [ 557.671923][ T4980] loop2: partition table partially beyond EOD, truncated [ 557.707021][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 557.730057][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 558.338949][ T29] audit: type=1400 audit(1785057902.247:1152): avc: denied { create } for pid=14122 comm="syz.2.1281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 558.573016][T14125] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 558.662044][ T29] audit: type=1400 audit(1785057902.247:1153): avc: denied { ioctl } for pid=14122 comm="syz.2.1281" path="socket:[39032]" dev="sockfs" ino=39032 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 558.801951][ T29] audit: type=1400 audit(1785057902.707:1154): avc: denied { bind } for pid=14140 comm="syz.1.1286" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 558.892079][ T29] audit: type=1400 audit(1785057902.747:1155): avc: denied { read } for pid=14140 comm="syz.1.1286" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 559.855764][ T4980] Dev loop2: unable to read RDB block 7 [ 559.912000][ T4980] loop2: AHDI p1 p2 p3 [ 559.956872][ T4980] loop2: partition table partially beyond EOD, truncated [ 560.086827][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 560.174641][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 561.361491][T14194] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1293'. [ 561.617011][ T4980] Dev loop2: unable to read RDB block 7 [ 561.705994][ T4980] loop2: AHDI p1 p2 p3 [ 561.727689][ T4980] loop2: partition table partially beyond EOD, truncated [ 561.761591][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 561.800514][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 562.373273][ T5733] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 562.846915][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.858196][ T5733] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 562.977230][ T5733] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 563.020588][ T5733] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 563.553681][ T5733] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 563.579370][ T5733] usb 1-1: SerialNumber: syz [ 563.592015][ T4980] Dev loop2: unable to read RDB block 7 [ 563.605313][ T4980] loop2: AHDI p1 p2 p3 [ 563.611022][ T4980] loop2: partition table partially beyond EOD, truncated [ 563.621166][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 563.629914][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 563.834950][ T5733] usb 1-1: 0:2 : does not exist [ 563.850890][ T5733] usb 1-1: unit 5 not found! [ 563.876093][ T29] audit: type=1400 audit(1785057907.787:1156): avc: denied { read } for pid=14250 comm="syz.2.1303" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 564.242287][ T5733] usb 1-1: USB disconnect, device number 36 [ 564.250991][ T4980] Dev loop2: unable to read RDB block 7 [ 564.263931][ T4980] loop2: AHDI p1 p2 p3 [ 564.268677][ T4980] loop2: partition table partially beyond EOD, truncated [ 564.786529][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 564.798103][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 564.830533][ T5885] udevd[5885]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 565.909820][ T29] audit: type=1400 audit(1785057909.817:1157): avc: denied { nlmsg_read } for pid=14309 comm="syz.5.1312" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 565.947496][ T5807] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 566.404161][ T5807] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 566.416544][ T5807] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 566.428045][ T29] audit: type=1400 audit(1785057910.337:1158): avc: denied { create } for pid=14315 comm="syz.5.1313" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 566.429384][ T5807] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 566.493992][ T5807] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 566.545740][ T5807] usb 1-1: SerialNumber: syz [ 566.819921][ T5807] usb 1-1: 0:2 : does not exist [ 566.967108][ T5807] usb 1-1: unit 5 not found! [ 567.508103][ T5807] usb 1-1: USB disconnect, device number 37 [ 567.577803][T14338] FAULT_INJECTION: forcing a failure. [ 567.577803][T14338] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 567.590988][T14338] CPU: 0 UID: 0 PID: 14338 Comm: syz.1.1315 Tainted: G L syzkaller #0 PREEMPT(full) [ 567.591008][T14338] Tainted: [L]=SOFTLOCKUP [ 567.591012][T14338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 567.591019][T14338] Call Trace: [ 567.591023][T14338] [ 567.591027][T14338] dump_stack_lvl+0x100/0x190 [ 567.591047][T14338] should_fail_ex.cold+0x5/0xa [ 567.591062][T14338] _copy_from_user+0x2e/0xd0 [ 567.591077][T14338] generic_map_update_batch+0x452/0x800 [ 567.591099][T14338] ? __pfx_generic_map_update_batch+0x10/0x10 [ 567.591119][T14338] ? __pfx_generic_map_update_batch+0x10/0x10 [ 567.591136][T14338] bpf_map_do_batch+0x66f/0x6d0 [ 567.591176][T14338] __sys_bpf+0x4ce/0x4e80 [ 567.591190][T14338] ? __pfx___sys_bpf+0x10/0x10 [ 567.591201][T14338] ? find_held_lock+0x2b/0x80 [ 567.591217][T14338] ? get_pid_task+0xfc/0x250 [ 567.591234][T14338] ? get_pid_task+0xfc/0x250 [ 567.591255][T14338] ? find_held_lock+0x2b/0x80 [ 567.591274][T14338] ? rcu_read_lock_any_held+0x6a/0xa0 [ 567.591285][T14338] ? find_held_lock+0x2b/0x80 [ 567.591300][T14338] ? ksys_write+0x190/0x250 [ 567.591316][T14338] ? ksys_write+0x190/0x250 [ 567.591342][T14338] ? fput+0x79/0x100 [ 567.591357][T14338] ? __x64_sys_bpf+0xce/0x140 [ 567.591367][T14338] __x64_sys_bpf+0xce/0x140 [ 567.591378][T14338] ? do_syscall_64+0x90/0x870 [ 567.591391][T14338] do_syscall_64+0x115/0x870 [ 567.591402][T14338] ? clear_bhb_loop+0x40/0x90 [ 567.591415][T14338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.591426][T14338] RIP: 0033:0x7fd464b9de99 [ 567.591437][T14338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 567.591448][T14338] RSP: 002b:00007fd462df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 567.591460][T14338] RAX: ffffffffffffffda RBX: 00007fd464e25fa0 RCX: 00007fd464b9de99 [ 567.591468][T14338] RDX: 0000000000000038 RSI: 0000200000000280 RDI: 000000000000001a [ 567.591474][T14338] RBP: 00007fd462df6090 R08: 0000000000000000 R09: 0000000000000000 [ 567.591481][T14338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 567.591490][T14338] R13: 00007fd464e26038 R14: 00007fd464e25fa0 R15: 00007fff65646048 [ 567.591515][T14338] [ 569.161519][T14359] bond0: (slave bond_slave_0): Releasing backup interface [ 570.329917][T14379] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1323'. [ 570.469364][T14373] syz.0.1322 (14373): drop_caches: 2 [ 570.783902][T14382] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 571.273401][ T4980] Dev loop2: unable to read RDB block 7 [ 571.387604][ T4980] loop2: AHDI p1 p2 p3 [ 571.414278][ T4980] loop2: partition table partially beyond EOD, truncated [ 571.484571][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 571.512428][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 571.634920][T14404] FAULT_INJECTION: forcing a failure. [ 571.634920][T14404] name failslab, interval 1, probability 0, space 0, times 0 [ 571.647850][T14404] CPU: 0 UID: 0 PID: 14404 Comm: syz.1.1328 Tainted: G L syzkaller #0 PREEMPT(full) [ 571.647870][T14404] Tainted: [L]=SOFTLOCKUP [ 571.647874][T14404] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 571.647882][T14404] Call Trace: [ 571.647886][T14404] [ 571.647890][T14404] dump_stack_lvl+0x100/0x190 [ 571.647909][T14404] should_fail_ex.cold+0x5/0xa [ 571.647925][T14404] should_failslab+0xc2/0x120 [ 571.647940][T14404] __kmalloc_noprof+0xfc/0x820 [ 571.647954][T14404] ? tomoyo_encode2+0xfb/0x3c0 [ 571.647968][T14404] tomoyo_encode2+0xfb/0x3c0 [ 571.647980][T14404] tomoyo_encode+0x29/0x50 [ 571.647990][T14404] tomoyo_realpath_from_path+0x18c/0x690 [ 571.648004][T14404] tomoyo_mount_acl+0x1b6/0x8b0 [ 571.648020][T14404] ? is_bpf_text_address+0x8a/0x1a0 [ 571.648035][T14404] ? bpf_ksym_find+0x128/0x1c0 [ 571.648051][T14404] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 571.648064][T14404] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 571.648079][T14404] ? kernel_text_address+0x8d/0x100 [ 571.648093][T14404] ? unwind_get_return_address+0x59/0xa0 [ 571.648119][T14404] ? tomoyo_domain+0xb2/0x150 [ 571.648131][T14404] ? tomoyo_profile+0x47/0x60 [ 571.648144][T14404] tomoyo_mount_permission+0x214/0x460 [ 571.648159][T14404] ? tomoyo_mount_permission+0x1f6/0x460 [ 571.648177][T14404] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 571.648202][T14404] security_sb_mount+0xdd/0x270 [ 571.648218][T14404] path_mount+0x158/0x23d0 [ 571.648235][T14404] ? __pfx_path_mount+0x10/0x10 [ 571.648247][T14404] ? lockdep_hardirqs_on+0x78/0x100 [ 571.648261][T14404] ? putname+0xb1/0x110 [ 571.648273][T14404] ? kmem_cache_free+0x127/0x6b0 [ 571.648289][T14404] ? __x64_sys_mount+0x293/0x310 [ 571.648301][T14404] __x64_sys_mount+0x293/0x310 [ 571.648315][T14404] ? __pfx___x64_sys_mount+0x10/0x10 [ 571.648333][T14404] do_syscall_64+0x115/0x870 [ 571.648344][T14404] ? clear_bhb_loop+0x40/0x90 [ 571.648358][T14404] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.648369][T14404] RIP: 0033:0x7fd464b9de99 [ 571.648380][T14404] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 571.648396][T14404] RSP: 002b:00007fd462df6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 571.648408][T14404] RAX: ffffffffffffffda RBX: 00007fd464e25fa0 RCX: 00007fd464b9de99 [ 571.648415][T14404] RDX: 0000200000000080 RSI: 0000200000000040 RDI: 0000200000000900 [ 571.648422][T14404] RBP: 00007fd462df6090 R08: 0000000000000000 R09: 0000000000000000 [ 571.648429][T14404] R10: 0000000001408009 R11: 0000000000000246 R12: 0000000000000001 [ 571.648436][T14404] R13: 00007fd464e26038 R14: 00007fd464e25fa0 R15: 00007fff65646048 [ 571.648451][T14404] [ 571.648463][T14404] ERROR: Out of memory at tomoyo_realpath_from_path. [ 572.871858][ T4980] Dev loop2: unable to read RDB block 7 [ 572.878696][ T4980] loop2: AHDI p1 p2 p3 [ 572.885727][ T4980] loop2: partition table partially beyond EOD, truncated [ 572.894778][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 573.454680][T14418] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1331'. [ 573.947250][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 575.068361][ T29] audit: type=1326 audit(1785057918.977:1159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14437 comm="syz.3.1336" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883059de99 code=0x7ffc0000 [ 575.157499][ T4980] Dev loop2: unable to read RDB block 7 [ 575.176714][ T4980] loop2: AHDI p1 p2 p3 [ 575.183329][ T4980] loop2: partition table partially beyond EOD, truncated [ 575.190947][ T29] audit: type=1326 audit(1785057919.007:1160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14437 comm="syz.3.1336" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883059de99 code=0x7ffc0000 [ 575.220404][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 575.228542][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 575.259936][ T29] audit: type=1326 audit(1785057919.007:1161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14437 comm="syz.3.1336" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7f883059de99 code=0x7ffc0000 [ 575.309119][ T29] audit: type=1326 audit(1785057919.007:1162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14437 comm="syz.3.1336" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883059de99 code=0x7ffc0000 [ 575.353664][ T29] audit: type=1326 audit(1785057919.017:1163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14437 comm="syz.3.1336" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883059de99 code=0x7ffc0000 [ 575.395641][ T29] audit: type=1326 audit(1785057919.017:1164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14437 comm="syz.3.1336" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=227 compat=0 ip=0x7f883059de99 code=0x7ffc0000 [ 575.424014][ T29] audit: type=1326 audit(575.089:1165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14437 comm="syz.3.1336" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883059de99 code=0x7ffc0000 [ 575.460531][ T29] audit: type=1326 audit(575.089:1166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14437 comm="syz.3.1336" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883059de99 code=0x7ffc0000 [ 575.491993][ T5808] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 575.523224][ T29] audit: type=1326 audit(575.089:1167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14437 comm="syz.3.1336" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883059de99 code=0x7ffc0000 [ 575.553303][ T29] audit: type=1326 audit(575.089:1168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14437 comm="syz.3.1336" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883059de99 code=0x7ffc0000 [ 575.652711][ T5808] usb 4-1: Using ep0 maxpacket: 16 [ 575.661361][ T5808] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 575.675595][ T5808] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 575.693960][ T5808] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 575.718364][ T5808] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 575.736298][ T5808] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 575.756582][ T5808] usb 4-1: config 0 descriptor?? [ 575.766807][T14462] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5134 sclass=netlink_route_socket pid=14462 comm=syz.1.1334 [ 575.852872][ T5755] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 576.003459][ T5755] usb 1-1: Using ep0 maxpacket: 32 [ 576.086500][ T5755] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 576.158489][ T5755] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 576.206199][ T5755] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 576.270390][ T5755] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 576.398824][ T5755] usb 1-1: config 0 descriptor?? [ 576.421778][ T5755] hub 1-1:0.0: USB hub found [ 576.512758][ T5808] usbhid 4-1:0.0: can't add hid device: -71 [ 576.526374][ T5808] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 576.535498][T14482] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1343'. [ 576.548342][ T5808] usb 4-1: USB disconnect, device number 59 [ 576.581194][ T4980] Dev loop2: unable to read RDB block 7 [ 576.587179][ T4980] loop2: AHDI p1 p2 p3 [ 576.591540][ T4980] loop2: partition table partially beyond EOD, truncated [ 576.604759][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 576.611596][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 576.630381][ T5755] hub 1-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 576.670652][T14495] Cannot find set identified by id 0 to match [ 577.585670][ T4980] Dev loop2: unable to read RDB block 7 [ 577.592839][T14457] syzkaller1: entered promiscuous mode [ 577.606011][ T4980] loop2: AHDI p1 p2 p3 [ 577.612098][T14457] syzkaller1: entered allmulticast mode [ 577.628394][ T4980] loop2: partition table partially beyond EOD, truncated [ 577.655381][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 577.675278][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 577.692605][ T5755] hid-generic 0003:046D:C31C.000A: item fetching failed at offset 0/1 [ 577.727305][ T5755] hid-generic 0003:046D:C31C.000A: probe with driver hid-generic failed with error -22 [ 578.563377][ T4980] Dev loop2: unable to read RDB block 7 [ 578.572329][ T4980] loop2: AHDI p1 p2 p3 [ 578.580332][ T4980] loop2: partition table partially beyond EOD, truncated [ 578.698132][ T5808] usb 1-1: USB disconnect, device number 38 [ 578.704645][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 578.729060][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 579.246631][ T4980] Dev loop2: unable to read RDB block 7 [ 579.253419][ T4980] loop2: AHDI p1 p2 p3 [ 579.260903][ T4980] loop2: partition table partially beyond EOD, truncated [ 579.269785][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 579.284077][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 579.900112][T14572] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=22042 sclass=netlink_route_socket pid=14572 comm=syz.0.1355 [ 580.247751][ T4980] Dev loop2: unable to read RDB block 7 [ 580.253659][ T4980] loop2: AHDI p1 p2 p3 [ 580.259833][ T4980] loop2: partition table partially beyond EOD, truncated [ 580.268452][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 580.276582][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 580.873483][ T4980] Dev loop2: unable to read RDB block 7 [ 580.879251][ T4980] loop2: AHDI p1 p2 p3 [ 580.888524][ T4980] loop2: partition table partially beyond EOD, truncated [ 580.895778][ T5808] usb 2-1: new full-speed USB device number 60 using dummy_hcd [ 580.927274][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 580.936732][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 581.034361][ T5808] usb 2-1: device descriptor read/64, error -71 [ 581.095147][T14598] ceph: Path missing in source [ 581.450726][ T4980] Dev loop2: unable to read RDB block 7 [ 581.457039][ T4980] loop2: AHDI p1 p2 p3 [ 581.463459][ T4980] loop2: partition table partially beyond EOD, truncated [ 581.473258][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 581.480214][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 581.512912][ T5808] usb 2-1: new full-speed USB device number 61 using dummy_hcd [ 581.662756][ T5808] usb 2-1: device descriptor read/64, error -71 [ 581.784535][ T5808] usb usb2-port1: attempt power cycle [ 582.053140][ T7824] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 582.152842][ T5808] usb 2-1: new full-speed USB device number 62 using dummy_hcd [ 582.599163][ T7824] usb 3-1: device descriptor read/64, error -71 [ 582.603502][ T5808] usb 2-1: device descriptor read/8, error -71 [ 582.893242][ T7824] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 582.960160][ T5808] usb 2-1: new full-speed USB device number 63 using dummy_hcd [ 583.063440][ T7824] usb 3-1: device descriptor read/64, error -71 [ 583.076105][ T5808] usb 2-1: device descriptor read/8, error -71 [ 583.187682][ T7824] usb usb3-port1: attempt power cycle [ 583.293620][ T5808] usb usb2-port1: unable to enumerate USB device [ 583.553304][ T7824] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 583.834275][ T7824] usb 3-1: device descriptor read/8, error -71 [ 584.129994][ T7824] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 584.242119][ T5808] usb 4-1: new full-speed USB device number 60 using dummy_hcd [ 584.335637][T14654] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 584.345592][ T7824] usb 3-1: device descriptor read/8, error -71 [ 584.462986][ T7824] usb usb3-port1: unable to enumerate USB device [ 584.495214][ T5808] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 584.517110][ T5808] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 584.537524][ T5808] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 584.562876][ T5808] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 212, setting to 64 [ 584.577284][ T5808] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 584.688657][ T5808] usb 4-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 584.704164][ T5808] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 584.722364][ T5808] usb 4-1: Product: syz [ 584.965633][ T4980] Dev loop2: unable to read RDB block 7 [ 584.971455][T14664] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1373'. [ 584.983006][ T5808] usb 4-1: Manufacturer: syz [ 584.987758][ T5808] usb 4-1: SerialNumber: syz [ 584.993134][ T4980] loop2: AHDI p1 p2 p3 [ 585.001120][ T4980] loop2: partition table partially beyond EOD, truncated [ 585.001590][ T5808] usb 4-1: config 0 descriptor?? [ 585.030166][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 585.037445][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 585.049746][T14648] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 585.157017][T14684] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1373'. [ 585.193198][ T5808] rc_core: IR keymap rc-xbox-dvd not found [ 585.209048][ T5808] Registered IR keymap rc-empty [ 585.250287][ T5808] rc rc0: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 585.273234][ T5733] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 585.286847][ T5808] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input38 [ 585.752759][ T5733] usb 3-1: Using ep0 maxpacket: 16 [ 585.774597][ T5733] usb 3-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 585.810182][ T5733] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 585.873807][ T5733] usb 3-1: Product: syz [ 585.906645][ T5733] usb 3-1: Manufacturer: syz [ 585.911581][ T5733] usb 3-1: SerialNumber: syz [ 585.949680][ T5733] usb 3-1: config 0 descriptor?? [ 586.217686][T14676] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1374'. [ 587.162546][T14676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 587.203321][T14676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 587.779691][ T29] kauditd_printk_skb: 98 callbacks suppressed [ 587.779712][ T29] audit: type=1400 audit(587.749:1267): avc: denied { search } for pid=14710 comm="syz.0.1377" name="/" dev="configfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 587.887424][ T29] audit: type=1400 audit(587.789:1268): avc: denied { search } for pid=14710 comm="syz.0.1377" name="usb_gadget" dev="configfs" ino=3689 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 587.969832][ T29] audit: type=1400 audit(587.789:1269): avc: denied { search } for pid=14710 comm="syz.0.1377" name="/" dev="configfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 588.080337][ T29] audit: type=1400 audit(587.789:1270): avc: denied { search } for pid=14710 comm="syz.0.1377" name="usb_gadget" dev="configfs" ino=3689 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 588.114961][ T7824] usb 3-1: USB disconnect, device number 56 [ 588.349235][ T29] audit: type=1400 audit(587.789:1271): avc: denied { search } for pid=14710 comm="syz.0.1377" name="g1" dev="configfs" ino=15319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 588.567200][ T29] audit: type=1400 audit(587.789:1272): avc: denied { search } for pid=14710 comm="syz.0.1377" name="configs" dev="configfs" ino=15321 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 588.679385][ T5741] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 588.803260][ T29] audit: type=1400 audit(587.789:1273): avc: denied { write search } for pid=14710 comm="syz.0.1377" name="configs" dev="configfs" ino=15321 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 589.105990][ T29] audit: type=1400 audit(587.789:1274): avc: denied { add_name } for pid=14710 comm="syz.0.1377" name="c.1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 589.132264][ T5741] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 589.201466][T14716] f_midi2: Invalid MIDI1 group definitions for block 0:0 [ 589.289261][ T5741] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 589.434030][ T5741] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 589.449300][ T29] audit: type=1400 audit(587.809:1275): avc: denied { create } for pid=14710 comm="syz.0.1377" name="c.1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 589.546778][ T5741] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 589.649169][ T5741] usb 1-1: SerialNumber: syz [ 589.664712][ T29] audit: type=1400 audit(587.809:1276): avc: denied { search } for pid=14710 comm="syz.0.1377" name="/" dev="configfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 589.765125][ T5755] usb 4-1: USB disconnect, device number 60 [ 589.765158][ C0] xbox_remote 4-1:0.0: xbox_remote_irq_in: usb_submit_urb()=-19 [ 589.946476][ T4980] Dev loop2: unable to read RDB block 7 [ 589.959813][ T4980] loop2: AHDI p1 p2 p3 [ 589.972173][ T4980] loop2: partition table partially beyond EOD, truncated [ 589.986119][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 589.993574][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 590.042822][ T5710] usb 2-1: new full-speed USB device number 64 using dummy_hcd [ 590.061831][ T5741] usb 1-1: 0:2 : does not exist [ 590.259970][T14802] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 590.334738][ T5741] usb 1-1: USB disconnect, device number 39 [ 590.547079][ T5710] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.591547][ T5710] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 590.646452][ T5710] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 590.663741][ T5885] udevd[5885]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 590.686217][ T5733] usb 4-1: new full-speed USB device number 61 using dummy_hcd [ 590.707254][ T5710] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 590.738389][ T5710] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 590.776054][ T5710] usb 2-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 590.805441][ T5710] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.832381][ T5710] usb 2-1: Product: syz [ 590.849647][ T5710] usb 2-1: Manufacturer: syz [ 590.871968][ T5733] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.903145][ T4980] Dev loop2: unable to read RDB block 7 [ 590.912906][ T5710] usb 2-1: SerialNumber: syz [ 590.915440][ T5733] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 590.929419][ T4980] loop2: AHDI p1 p2 p3 [ 590.929449][ T4980] loop2: partition table partially beyond EOD, truncated [ 590.929670][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 590.929689][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 590.966097][ T5733] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 590.979120][ T5733] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 212, setting to 64 [ 590.990414][ T5733] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 590.995679][ T5710] usb 2-1: config 0 descriptor?? [ 591.046862][ T5733] usb 4-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 591.063386][ T5733] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 591.074657][ T5710] xbox_remote_probe: endpoint_in message size==0? [ 591.087675][ T5733] usb 4-1: Product: syz [ 591.092011][ T5733] usb 4-1: Manufacturer: syz [ 591.099159][ T5733] usb 4-1: SerialNumber: syz [ 591.634102][ T5733] usb 4-1: config 0 descriptor?? [ 591.662138][T14790] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 591.702382][ T5807] usb 2-1: USB disconnect, device number 64 [ 591.853477][ T5733] rc_core: IR keymap rc-xbox-dvd not found [ 591.871387][ T5733] Registered IR keymap rc-empty [ 592.008652][ T5733] rc rc0: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 592.047041][T14837] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 592.140035][ T4980] Dev loop2: unable to read RDB block 7 [ 592.309249][ T5733] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input39 [ 592.333848][ T4980] loop2: AHDI p1 p2 p3 [ 592.339850][ T4980] loop2: partition table partially beyond EOD, truncated [ 592.369792][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 592.399715][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 592.519997][T14853] Cannot find set identified by id 0 to match [ 592.773408][T14861] binder: BINDER_SET_CONTEXT_MGR already set [ 592.789411][T14861] binder: 14860:14861 ioctl 4018620d 200000000100 returned -16 [ 592.841132][T14861] binder: BINDER_SET_CONTEXT_MGR already set [ 592.862419][T14861] binder: 14860:14861 ioctl 4018620d 200000004a80 returned -16 [ 592.898537][ T4980] Dev loop2: unable to read RDB block 7 [ 592.924632][ T4980] loop2: AHDI p1 p2 p3 [ 592.942319][ T4980] loop2: partition table partially beyond EOD, truncated [ 592.966595][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 593.179070][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 594.201583][T14880] ceph: Path missing in source [ 595.077198][ T4980] Dev loop2: unable to read RDB block 7 [ 595.101395][ T4980] loop2: AHDI p1 p2 p3 [ 595.119432][ T4980] loop2: partition table partially beyond EOD, truncated [ 595.142171][T14882] macvlan2: entered allmulticast mode [ 595.149828][T14882] bond0: (slave macvlan2): Opening slave failed [ 595.193423][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 595.242820][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 595.443411][ T5741] usb 3-1: new full-speed USB device number 57 using dummy_hcd [ 595.627045][ T5741] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 596.245607][ T5710] usb 4-1: USB disconnect, device number 61 [ 596.245637][ C0] xbox_remote 4-1:0.0: xbox_remote_irq_in: usb_submit_urb()=-19 [ 596.612461][ T5741] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 596.629204][ T5741] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 596.643756][ T5741] usb 3-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 596.653410][ T5741] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 596.863779][T14924] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 597.099210][ T5741] usb 3-1: config 0 descriptor?? [ 597.357571][ T29] kauditd_printk_skb: 13 callbacks suppressed [ 597.357589][ T29] audit: type=1400 audit(597.299:1290): avc: denied { write } for pid=14931 comm="syz.3.1403" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 598.043678][ T5733] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 598.374230][ T5733] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 598.384259][ T5733] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.393195][ T5733] usb 1-1: Product: syz [ 598.397471][ T5733] usb 1-1: Manufacturer: syz [ 598.402182][ T5733] usb 1-1: SerialNumber: syz [ 598.421003][ T5733] usb 1-1: config 0 descriptor?? [ 598.691857][ T5741] usbhid 3-1:0.0: can't add hid device: -71 [ 598.702424][ T5741] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 598.718211][ T5741] usb 3-1: USB disconnect, device number 57 [ 600.045150][ T4980] Dev loop2: unable to read RDB block 7 [ 600.059486][ T4980] loop2: AHDI p1 p2 p3 [ 600.072157][ T4980] loop2: partition table partially beyond EOD, truncated [ 600.089822][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 600.130362][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 600.189631][ T5733] usb 1-1: Firmware version (0.0) predates our first public release. [ 600.201250][ T5733] usb 1-1: Please update to version 0.2 or newer [ 600.271709][T14996] syzkaller0: entered promiscuous mode [ 600.289858][T14996] syzkaller0: entered allmulticast mode [ 600.393903][T14996] netlink: 'syz.3.1416': attribute type 3 has an invalid length. [ 600.421039][ T4980] Dev loop2: unable to read RDB block 7 [ 600.516482][ T4980] loop2: AHDI p1 p2 p3 [ 600.523042][ T4980] loop2: partition table partially beyond EOD, truncated [ 600.530067][T15002] overlayfs: failed to clone upperpath [ 600.530526][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 600.552196][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 600.892128][ T5733] usb 1-1: USB disconnect, device number 40 [ 601.661504][T15036] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1422'. [ 601.709658][T15036] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1422'. [ 602.107677][ T29] audit: type=1400 audit(602.079:1291): avc: denied { ioctl } for pid=15035 comm="syz.5.1422" path="socket:[41052]" dev="sockfs" ino=41052 ioctlcmd=0x5872 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 602.392774][T15058] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 602.864692][ T5733] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 602.878233][ T5710] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 602.988665][T15065] syz.5.1425 (15065) used greatest stack depth: 19768 bytes left [ 603.019484][ T4980] Dev loop2: unable to read RDB block 7 [ 603.029644][ T4980] loop2: AHDI p1 p2 p3 [ 603.041837][ T4980] loop2: partition table partially beyond EOD, truncated [ 603.052365][ T5733] usb 1-1: Using ep0 maxpacket: 32 [ 603.060161][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 603.074356][ T5733] usb 1-1: unable to get BOS descriptor or descriptor too short [ 603.085065][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 603.099221][ T5733] usb 1-1: config 12 has an invalid interface number: 183 but max is 1 [ 603.121557][ T5733] usb 1-1: config 12 has an invalid interface number: 229 but max is 1 [ 603.157377][ T5733] usb 1-1: config 12 has no interface number 0 [ 603.188165][ T5733] usb 1-1: config 12 has no interface number 1 [ 603.209410][ T5733] usb 1-1: config 12 interface 183 has no altsetting 0 [ 603.232733][ T5733] usb 1-1: New USB device found, idVendor=1415, idProduct=2000, bcdDevice=2b.98 [ 603.257620][ T5733] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.279613][ T5733] usb 1-1: Product: syz [ 603.293539][ T5733] usb 1-1: Manufacturer: syz [ 603.309961][ T5733] usb 1-1: SerialNumber: syz [ 603.372952][ T5808] usb 2-1: new full-speed USB device number 65 using dummy_hcd [ 603.552035][ T5808] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 603.570754][ T5733] usb 1-1: USB disconnect, device number 41 [ 603.604745][ T5808] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 603.647037][ T5808] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 603.691956][ T5808] usb 2-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 603.720509][ T5808] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.757796][ T5808] usb 2-1: config 0 descriptor?? [ 603.897314][T15077] xt_hashlimit: size too large, truncated to 1048576 [ 604.482839][ T5741] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 604.586158][ T4980] Dev loop2: unable to read RDB block 7 [ 604.607181][ T4980] loop2: AHDI p1 p2 p3 [ 604.617616][ T4980] loop2: partition table partially beyond EOD, truncated [ 604.634409][ T5741] usb 1-1: device descriptor read/64, error -71 [ 604.640270][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 604.660798][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 605.182952][ T5741] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 605.284134][ T4980] Dev loop2: unable to read RDB block 7 [ 605.289831][ T4980] loop2: AHDI p1 p2 p3 [ 605.296042][ T4980] loop2: partition table partially beyond EOD, truncated [ 605.314858][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 605.334898][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 605.383027][ T5741] usb 1-1: device descriptor read/64, error -71 [ 605.678187][ T5741] usb usb1-port1: attempt power cycle [ 606.113461][ T29] audit: type=1326 audit(605.629:1292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15126 comm="syz.2.1433" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbc4b79de99 code=0x0 [ 606.251198][ T29] audit: type=1400 audit(605.799:1293): avc: denied { setopt } for pid=15126 comm="syz.2.1433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 606.257545][T15134] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 606.371081][ T5808] usbhid 2-1:0.0: can't add hid device: -71 [ 606.433464][ T4980] Dev loop2: unable to read RDB block 7 [ 606.452848][ T5808] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 606.472106][ T4980] loop2: AHDI p1 p2 p3 [ 606.526471][ T5741] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 606.569593][ T4980] loop2: partition table partially beyond EOD, truncated [ 606.730194][ T5808] usb 2-1: USB disconnect, device number 65 [ 606.731543][ T5741] usb 1-1: device descriptor read/8, error -71 [ 606.744901][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 606.773329][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 607.255058][ T5741] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 607.303061][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 607.310334][ T5741] usb 1-1: device descriptor read/8, error -32 [ 607.351384][ T4980] Dev loop2: unable to read RDB block 7 [ 607.375894][ T4980] loop2: AHDI p1 p2 p3 [ 607.389573][ T4980] loop2: partition table partially beyond EOD, truncated [ 607.410550][ T4980] loop2: p1 start 1601398130 is beyond EOD, truncated [ 607.423029][ T5741] usb usb1-port1: unable to enumerate USB device [ 607.513610][ T4980] loop2: p2 start 1702059890 is beyond EOD, truncated [ 607.733357][T15161] netlink: 'syz.5.1436': attribute type 1 has an invalid length. [ 607.901183][ T29] audit: type=1400 audit(607.869:1294): avc: denied { write } for pid=15166 comm="syz.3.1438" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 607.955603][ T29] audit: type=1400 audit(607.919:1295): avc: denied { write } for pid=15176 comm="syz.0.1440" name="c.1" dev="configfs" ino=40322 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 608.000811][ T29] audit: type=1400 audit(607.969:1296): avc: denied { write } for pid=15176 comm="syz.0.1440" name="c.1" dev="configfs" ino=40322 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 608.479117][T15195] netlink: zone id is out of range [ 608.512504][T15195] netlink: zone id is out of range [ 608.533023][T15195] netlink: zone id is out of range [ 608.560977][T15195] netlink: del zone limit has 4 unknown bytes [ 609.021719][T15190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 609.042930][T15190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 609.232703][ T5741] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 609.409482][ T5741] usb 1-1: Dual-Role OTG device on HNP port [ 609.426075][ T5741] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0000, bcdDevice= 7.02 [ 609.455677][ T5741] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.504294][ C1] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN NOPTI [ 609.516381][ C1] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 609.524775][ C1] CPU: 1 UID: 0 PID: 15201 Comm: syz.2.1441 Tainted: G L syzkaller #0 PREEMPT(full) [ 609.535694][ C1] Tainted: [L]=SOFTLOCKUP [ 609.539997][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 609.550037][ C1] RIP: 0010:f_midi2_free_ep_reqs+0x56/0x2b0 [ 609.555931][ C1] Code: 85 6a 02 00 00 49 8b 45 00 48 89 44 24 18 48 05 30 07 00 00 48 89 c2 48 89 44 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e b5 01 00 00 48 8b 44 24 18 31 [ 609.575525][ C1] RSP: 0018:ffffc90000a089e8 EFLAGS: 00010002 [ 609.581570][ C1] RAX: dffffc0000000000 RBX: ffff888057910000 RCX: ffffffff87e79339 [ 609.589514][ C1] RDX: 00000000000000e6 RSI: ffffffff87e79176 RDI: ffff888057910128 [ 609.597469][ C1] RBP: ffff888057910128 R08: 0000000000000004 R09: 0000000000000020 [ 609.605426][ C1] R10: 0000000000000020 R11: 0000000000000000 R12: ffff8880579100f0 [ 609.613376][ C1] R13: ffff888057910128 R14: ffff888057910740 R15: 0000000000000001 [ 609.621320][ C1] FS: 00007fbc4c6bb6c0(0000) GS:ffff888123ede000(0000) knlGS:0000000000000000 [ 609.630248][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 609.636812][ C1] CR2: 0000001b338e2ff8 CR3: 000000003804d000 CR4: 00000000003526f0 [ 609.644771][ C1] Call Trace: [ 609.648034][ C1] [ 609.650863][ C1] f_midi2_set_alt+0x444/0x5f0 [ 609.655609][ C1] composite_setup+0x16f8/0x9290 [ 609.660530][ C1] ? __lock_acquire+0x49f/0x1a40 [ 609.665445][ C1] ? __pfx_composite_setup+0x10/0x10 [ 609.670706][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 609.676062][ C1] ? do_raw_spin_lock+0x128/0x260 [ 609.681063][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 609.686417][ C1] ? configfs_composite_setup+0xfb/0x130 [ 609.692018][ C1] configfs_composite_setup+0xfb/0x130 [ 609.697468][ C1] dummy_timer+0x2062/0x36c0 [ 609.702040][ C1] ? do_raw_spin_lock+0x128/0x260 [ 609.707053][ C1] ? find_held_lock+0x2b/0x80 [ 609.711715][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 609.717501][ C1] ? debug_object_deactivate+0x2e4/0x3b0 [ 609.723112][ C1] ? __pfx_debug_object_deactivate+0x10/0x10 [ 609.729069][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 609.733983][ C1] ? mark_held_locks+0x40/0x70 [ 609.738723][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 609.744508][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 609.749426][ C1] __hrtimer_run_queues+0x462/0x9c0 [ 609.754621][ C1] hrtimer_run_softirq+0x17d/0x2c0 [ 609.759720][ C1] handle_softirqs+0x1ea/0x9b0 [ 609.764464][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 609.769725][ C1] ? _raw_spin_unlock+0x28/0x50 [ 609.774559][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 609.780174][ C1] __irq_exit_rcu+0x162/0x210 [ 609.784834][ C1] irq_exit_rcu+0x9/0x30 [ 609.789057][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 609.794670][ C1] [ 609.797595][ C1] [ 609.800505][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 609.806478][ C1] RIP: 0010:finish_task_switch.isra.0+0x2cd/0x10c0 [ 609.812977][ C1] Code: ab 0a 00 00 41 c7 87 20 0e 00 00 00 00 00 00 e9 47 04 00 00 49 8d 7f 48 e8 30 d4 e7 09 e8 1b a9 3c 00 fb 48 8d bb f8 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 [ 609.832567][ C1] RSP: 0018:ffffc90005756378 EFLAGS: 00000206 [ 609.838615][ C1] RAX: 000000000000689f RBX: ffff8880326c2540 RCX: 0000000000000040 [ 609.846565][ C1] RDX: 0000000000000000 RSI: ffffffff8e1a55a5 RDI: ffff8880326c3c38 [ 609.854516][ C1] RBP: ffffc900057563d0 R08: 0000000000000001 R09: 0000000000000000 [ 609.862466][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88801eaca540 [ 609.870414][ C1] R13: 0000000000000001 R14: ffffffff9122a1a4 R15: ffff8880b853b4c0 [ 609.878369][ C1] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 609.884249][ C1] __schedule+0x1264/0x6730 [ 609.888725][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 609.894079][ C1] ? __pfx___schedule+0x10/0x10 [ 609.898909][ C1] ? mark_held_locks+0x40/0x70 [ 609.903656][ C1] preempt_schedule_irq+0x50/0x90 [ 609.908660][ C1] irqentry_exit+0x205/0xa00 [ 609.913227][ C1] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 609.918660][ C1] RIP: 0010:kasan_check_range+0x74/0x1e0 [ 609.924274][ C1] Code: 89 fd 48 b8 00 00 00 00 00 fc ff df 4d 89 d1 48 c1 ed 03 49 c1 e9 03 48 01 c5 49 01 c1 48 89 e8 49 8d 59 01 48 89 da 48 29 ea <48> 83 fa 10 0f 8e db 00 00 00 41 89 eb 41 83 e3 07 0f 85 94 00 00 [ 609.943860][ C1] RSP: 0018:ffffc90005756658 EFLAGS: 00000202 [ 609.949908][ C1] RAX: ffffed1027fff7e7 RBX: ffffed1027fff7e8 RCX: ffffffff826cba4d [ 609.957854][ C1] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88813fffbf38 [ 609.965801][ C1] RBP: ffffed1027fff7e7 R08: 0000000000000000 R09: ffffed1027fff7e7 [ 609.973763][ C1] R10: ffff88813fffbf3f R11: ffff88813fffb940 R12: ffff88813fffd940 [ 609.981707][ C1] R13: 0000000000000000 R14: ffff88813fffc190 R15: dffffc0000000000 [ 609.989655][ C1] ? get_page_from_freelist+0x8cd/0x3530 [ 609.995272][ C1] get_page_from_freelist+0x8cd/0x3530 [ 610.000710][ C1] ? __pfx_get_page_from_freelist+0x10/0x10 [ 610.006580][ C1] ? prepare_alloc_pages+0x1f0/0x5f0 [ 610.011846][ C1] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 610.017714][ C1] ? hrtimer_start_range_ns_common+0x78e/0x18b0 [ 610.023946][ C1] ? find_held_lock+0x2b/0x80 [ 610.028606][ C1] ? finish_task_switch.isra.0+0x2c0/0x10c0 [ 610.034491][ C1] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 610.040800][ C1] ? lockdep_hardirqs_on+0x78/0x100 [ 610.045981][ C1] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 610.051864][ C1] ? do_raw_spin_lock+0x128/0x260 [ 610.056889][ C1] ? __lock_acquire+0x49f/0x1a40 [ 610.061820][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 610.067002][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 610.072885][ C1] ? policy_nodemask+0xed/0x4f0 [ 610.077715][ C1] alloc_pages_mpol+0x1fb/0x540 [ 610.082544][ C1] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 610.087907][ C1] ? do_raw_spin_lock+0x128/0x260 [ 610.092914][ C1] folio_alloc_mpol_noprof+0x36/0x260 [ 610.098267][ C1] shmem_alloc_folio+0x135/0x160 [ 610.103186][ C1] shmem_alloc_and_add_folio+0x371/0xd40 [ 610.108806][ C1] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 610.114962][ C1] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 610.120930][ C1] shmem_get_folio_gfp+0x6ad/0x1910 [ 610.126111][ C1] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 610.131730][ C1] ? timestamp_truncate+0x22e/0x2f0 [ 610.136923][ C1] shmem_write_begin+0x1a4/0x420 [ 610.141843][ C1] ? __pfx_shmem_write_begin+0x10/0x10 [ 610.147291][ C1] ? rcu_is_watching+0x12/0xc0 [ 610.152058][ C1] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 610.158899][ C1] generic_perform_write+0x292/0xa40 [ 610.164175][ C1] ? __pfx_generic_perform_write+0x10/0x10 [ 610.169957][ C1] ? __mark_inode_dirty+0x55c/0x16e0 [ 610.175227][ C1] ? mnt_put_write_access_file+0x4e/0x100 [ 610.180925][ C1] ? file_update_time_flags+0x373/0x500 [ 610.186448][ C1] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 610.192234][ C1] shmem_file_write_iter+0x10e/0x140 [ 610.197502][ C1] __kernel_write_iter+0x2ac/0x930 [ 610.202619][ C1] ? __pfx___kernel_write_iter+0x10/0x10 [ 610.208256][ C1] ? __up_read+0x333/0x980 [ 610.212665][ C1] ? dump_user_range+0x65e/0xad0 [ 610.217587][ C1] ? copy_mc_enhanced_fast_string+0x6/0xf [ 610.223292][ C1] dump_user_range+0x3f9/0xad0 [ 610.228041][ C1] ? __pfx_dump_user_range+0x10/0x10 [ 610.233310][ C1] ? __pfx_writenote+0x10/0x10 [ 610.238050][ C1] ? elf_core_dump+0x1f25/0x3d20 [ 610.242967][ C1] elf_core_dump+0x2d68/0x3d20 [ 610.247715][ C1] ? __pfx_elf_core_dump+0x10/0x10 [ 610.252804][ C1] ? kasan_save_stack+0x3f/0x50 [ 610.257632][ C1] ? kasan_save_stack+0x30/0x50 [ 610.262458][ C1] ? kasan_save_track+0x14/0x30 [ 610.267283][ C1] ? __kasan_kmalloc+0xaa/0xb0 [ 610.272023][ C1] ? vfs_coredump+0x22a6/0x56f0 [ 610.276851][ C1] ? get_signal+0x1f2a/0x21e0 [ 610.281508][ C1] ? arch_do_signal_or_restart+0x91/0x7e0 [ 610.287207][ C1] ? 0xffffffffff600000 [ 610.291351][ C1] ? vfs_coredump+0x294b/0x56f0 [ 610.296192][ C1] vfs_coredump+0x294b/0x56f0 [ 610.300853][ C1] ? __pfx_vfs_coredump+0x10/0x10 [ 610.305863][ C1] ? __lock_acquire+0x49f/0x1a40 [ 610.310791][ C1] ? bpf_ksym_find+0x128/0x1c0 [ 610.315541][ C1] ? unwind_get_return_address+0x59/0xa0 [ 610.321149][ C1] ? arch_stack_walk+0xa6/0xf0 [ 610.325898][ C1] ? __sigqueue_free+0xbe/0x2a0 [ 610.330735][ C1] ? stack_trace_save+0x8e/0xc0 [ 610.335560][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 610.340915][ C1] ? stack_depot_save_flags+0x27/0x9d0 [ 610.346370][ C1] ? proc_coredump_connector+0x2d3/0x4f0 [ 610.351992][ C1] ? __pfx_proc_coredump_connector+0x10/0x10 [ 610.357963][ C1] ? rcu_is_watching+0x12/0xc0 [ 610.362717][ C1] get_signal+0x1f2a/0x21e0 [ 610.367205][ C1] ? __pfx_get_signal+0x10/0x10 [ 610.372031][ C1] ? __pfx_force_sig_fault+0x10/0x10 [ 610.377294][ C1] arch_do_signal_or_restart+0x91/0x7e0 [ 610.382814][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 610.388945][ C1] irqentry_exit+0x402/0xa00 [ 610.393518][ C1] asm_exc_page_fault+0x26/0x30 [ 610.398453][ C1] RIP: 0033:0x7fbc4b79dea1 [ 610.402880][ C1] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 610.422483][ C1] RSP: 002b:0000000000000030 EFLAGS: 00010217 [ 610.428548][ C1] RAX: 0000000000000000 RBX: 00007fbc4ba26090 RCX: 00007fbc4b79de99 [ 610.436510][ C1] RDX: 0000000000000000 RSI: 0000000000000030 RDI: 0000000000000600 [ 610.444462][ C1] RBP: 00007fbc4b833eaf R08: 0000000000000000 R09: 0000000000000000 [ 610.452406][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 610.460355][ C1] R13: 00007fbc4ba26128 R14: 00007fbc4ba26090 R15: 00007fff27aabc68 [ 610.468311][ C1] [ 610.471318][ C1] Modules linked in: [ 610.475195][ C1] ---[ end trace 0000000000000000 ]--- [ 610.480623][ C1] RIP: 0010:f_midi2_free_ep_reqs+0x56/0x2b0 [ 610.486501][ C1] Code: 85 6a 02 00 00 49 8b 45 00 48 89 44 24 18 48 05 30 07 00 00 48 89 c2 48 89 44 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e b5 01 00 00 48 8b 44 24 18 31 [ 610.506088][ C1] RSP: 0018:ffffc90000a089e8 EFLAGS: 00010002 [ 610.512132][ C1] RAX: dffffc0000000000 RBX: ffff888057910000 RCX: ffffffff87e79339 [ 610.520079][ C1] RDX: 00000000000000e6 RSI: ffffffff87e79176 RDI: ffff888057910128 [ 610.528023][ C1] RBP: ffff888057910128 R08: 0000000000000004 R09: 0000000000000020 [ 610.535978][ C1] R10: 0000000000000020 R11: 0000000000000000 R12: ffff8880579100f0 [ 610.543921][ C1] R13: ffff888057910128 R14: ffff888057910740 R15: 0000000000000001 [ 610.551866][ C1] FS: 00007fbc4c6bb6c0(0000) GS:ffff888123ede000(0000) knlGS:0000000000000000 [ 610.560771][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 610.567331][ C1] CR2: 0000001b338e2ff8 CR3: 000000003804d000 CR4: 00000000003526f0 [ 610.575293][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 610.582701][ C1] Kernel Offset: disabled [ 610.587004][ C1] Rebooting in 86400 seconds..