last executing test programs: 20.333144917s ago: executing program 1 (id=51): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000c20000fdeb0012cbd5f51cee3a7600b081f9637f6d4735f2dce7657669def6613a90098dca4cae4f47c6843dc7914316ed2e541188c9f3f65ba22578c47c25fafb6cfda16b4db0857d8a0b0cb0d7644437f18a51b73609ea1d4f1c4775c5aa329deda988ffbc78a2b916b585fa5b08968e9b0c875e27df6695735fdc54e65e4cb6cfd85ab9dba6e46f19f51ebb3a553bf55a749690daafbe9772f31b8a6f2e395495638f49a9d4121613bae5754fcfa084e68431e5f594abc9a53bd1fb993554cf4ee3870500fddcd287345461172cf3c480cfd13f63afee36de9847721ad173f547d8f020519f85f5dfc14c4b2d77385f923bde9b52ae8b6a707264114544644079df54d1dc1fed7b207930e8b1a008acab92ca11cf79d3bdc569407d559e415556c186fa921e7f535e170e262aa3cf6221eda62249d9c3067734229489d8d3b2412aa608746e044cde5b28c728c26ae72855cae4e85a51e7510fefc993954e69d4d59e234c34a0488eab767eaa66a6ef20f00dbd7e3a3c5f841139", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x210, 0x3, 0x1, 0x401, 0x0, 0x0, {0x5}, [@CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x101}, @CTA_PROTOINFO={0x50, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4c, 0x1, 0x0, 0x1, [@CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x9, 0x6}}, @CTA_PROTOINFO_TCP_FLAGS_ORIGINAL={0x6, 0x4, {0x0, 0x2}}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x6, 0x6}}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x7, 0x6}}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x8}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x4}, @CTA_PROTOINFO_TCP_STATE={0x5, 0x1, 0x4}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x6}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x0, 0x5, {0x7, 0x2}}]}}, @CTA_TUPLE_ORIG={0x8c, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv4={{0x0, 0x1, @private=0xa010102}, {0x0, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x39}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0xfffffffb}, {0x8, 0x2, @loopback}}}]}, @CTA_TUPLE_MASTER={0x6c, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x0, 0x1, 0x0, 0x1, @ipv4={{0x0, 0x1, @empty}, {0x0, 0x2, @dev={0xac, 0x14, 0x14, 0x22}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00'}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x3}, @CTA_PROTOINFO={0x50, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4c}}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_LABELS={0x8, 0x16, 0x1, 0x0, [0x7]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x210}}, 0x0) ptrace$ARCH_GET_FS(0x1e, r0, &(0x7f0000000880), 0x1003) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r4, 0x8040942d, &(0x7f00000008c0)) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x4a0, 0x0, 0x0, 0xffffffff, 0x338, 0x290, 0x408, 0x408, 0xffffffff, 0x408, 0x408, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010104, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'wg1\x00', {}, {0xff}, 0x16}, 0x0, 0x130, 0x168, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'kmp\x00', "48ae43e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @dev={0xac, 0x14, 0x14, 0x16}, @initdev={0xac, 0x1e, 0x0, 0x0}, @port=0x4e22, @port=0x4e24}}}}, {{@uncond, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'veth1_vlan\x00', 'macvtap0\x00', 0x10, 0x1, 0x6, 0x10000, 0xc, 0x2, {0xfffffffffffffffc}, {0x6}}}, @common=@socket0={{0x20}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xfffc, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x100}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'virt_wifi0\x00', 'batadv_slave_1\x00', {}, {0xff}}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @empty, @icmp_id=0x68, @port=0x4e22}}}}, {{@uncond, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0x4, "1542", 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x500) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) quotactl$Q_GETQUOTA(0xffffffff80000700, &(0x7f0000000000)=@sg0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x15) 19.298382803s ago: executing program 1 (id=52): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000c20000fdeb0012cbd5f51cee3a7600b081f9637f6d4735f2dce7657669def6613a90098dca4cae4f47c6843dc7914316ed2e541188c9f3f65ba22578c47c25fafb6cfda16b4db0857d8a0b0cb0d7644437f18a51b73609ea1d4f1c4775c5aa329deda988ffbc78a2b916b585fa5b08968e9b0c875e27df6695735fdc54e65e4cb6cfd85ab9dba6e46f19f51ebb3a553bf55a749690daafbe9772f31b8a6f2e395495638f49a9d4121613bae5754fcfa084e68431e5f594abc9a53bd1fb993554cf4ee3870500fddcd287345461172cf3c480cfd13f63afee36de9847721ad173f547d8f020519f85f5dfc14c4b2d77385f923bde9b52ae8b6a707264114544644079df54d1dc1fed7b207930e8b1a008acab92ca11cf79d3bdc569407d559e415556c186fa921e7f535e170e262aa3cf6221eda62249d9c3067734229489d8d3b2412aa608746e044cde5b28c728c26ae72855cae4e85a51e7510fefc993954e69d4d59e234c34a0488eab767eaa66a6ef20f00dbd7e3a3c5f841139", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x210, 0x3, 0x1, 0x401, 0x0, 0x0, {0x5}, [@CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x101}, @CTA_PROTOINFO={0x50, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4c, 0x1, 0x0, 0x1, [@CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x9, 0x6}}, @CTA_PROTOINFO_TCP_FLAGS_ORIGINAL={0x6, 0x4, {0x0, 0x2}}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x6, 0x6}}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x7, 0x6}}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x8}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x4}, @CTA_PROTOINFO_TCP_STATE={0x5, 0x1, 0x4}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x6}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x0, 0x5, {0x7, 0x2}}]}}, @CTA_TUPLE_ORIG={0x8c, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv4={{0x0, 0x1, @private=0xa010102}, {0x0, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x39}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0xfffffffb}, {0x8, 0x2, @loopback}}}]}, @CTA_TUPLE_MASTER={0x6c, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x0, 0x1, 0x0, 0x1, @ipv4={{0x0, 0x1, @empty}, {0x0, 0x2, @dev={0xac, 0x14, 0x14, 0x22}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00'}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x3}, @CTA_PROTOINFO={0x50, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4c}}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_LABELS={0x8, 0x16, 0x1, 0x0, [0x7]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x210}}, 0x0) ptrace$ARCH_GET_FS(0x1e, r1, &(0x7f0000000880), 0x1003) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r5, 0x8040942d, &(0x7f00000008c0)) sched_setaffinity(r4, 0x47, &(0x7f0000000200)=0x7) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x4a0, 0x0, 0x0, 0xffffffff, 0x338, 0x290, 0x408, 0x408, 0xffffffff, 0x408, 0x408, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010104, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'wg1\x00', {}, {0xff}, 0x16}, 0x0, 0x130, 0x168, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'kmp\x00', "48ae43e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @dev={0xac, 0x14, 0x14, 0x16}, @initdev={0xac, 0x1e, 0x0, 0x0}, @port=0x4e22, @port=0x4e24}}}}, {{@uncond, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'veth1_vlan\x00', 'macvtap0\x00', 0x10, 0x1, 0x6, 0x10000, 0xc, 0x2, {0xfffffffffffffffc}, {0x6}}}, @common=@socket0={{0x20}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xfffc, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x100}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'virt_wifi0\x00', 'batadv_slave_1\x00', {}, {0xff}}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @empty, @icmp_id=0x68, @port=0x4e22}}}}, {{@uncond, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0x4, "1542", 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x500) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) creat(&(0x7f0000000140)='./file0/file0\x00', 0x66) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) quotactl$Q_GETQUOTA(0xffffffff80000700, &(0x7f0000000000)=@sg0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x17, &(0x7f0000000a00)=ANY=[@ANYBLOB="18000000070000002be27851952fb8e0181100003999", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09000000000000650901000000000066000000060000001801000020756c2500000000002020207b9af8ff000000005d9100000000000037010000f8ffffffb702000008000000b70300000200000056000000060000002c93000000000000b5030000000000008500000078000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 16.681270567s ago: executing program 0 (id=56): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000000)=0x40b, 0x4) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4014}, 0x4010850) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() timer_settime(0x0, 0x1, &(0x7f0000000300)={{0x77359400}}, &(0x7f0000000340)) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x47, &(0x7f0000000200)=0x7) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) 15.667074426s ago: executing program 4 (id=58): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x63a8, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f72, 0x2, 0x3, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) 15.635685598s ago: executing program 0 (id=59): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) syz_open_dev$loop(0x0, 0x75f, 0xa8182) landlock_create_ruleset(&(0x7f0000000080)={0xf4da, 0x1, 0x3}, 0x18, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000180)='P', 0x1}], 0x1, 0x800000, 0x0) ioctl$FAT_IOCTL_GET_VOLUME_ID(0xffffffffffffffff, 0x80047213, &(0x7f00000001c0)) r2 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r2, 0xc0046d00, &(0x7f0000000080)=0x80000000) r3 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x30}, 0x4000010) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r4, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r4, 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="0107000000000000000026000000"], 0x14}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000100), 0x2, 0x862b01) ioctl$EVIOCGKEY(r5, 0x80404518, 0x0) 15.453676723s ago: executing program 4 (id=61): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) syz_open_dev$loop(0x0, 0x75f, 0xa8182) landlock_create_ruleset(&(0x7f0000000080)={0xf4da, 0x1, 0x3}, 0x18, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000180)='P', 0x1}], 0x1, 0x800000, 0x0) ioctl$FAT_IOCTL_GET_VOLUME_ID(0xffffffffffffffff, 0x80047213, &(0x7f00000001c0)) r2 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r2, 0xc0046d00, &(0x7f0000000080)=0x80000000) r3 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x30}, 0x4000010) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r4, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r4, 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="0107000000000000000026000000"], 0x14}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000100), 0x2, 0x862b01) ioctl$EVIOCGKEY(r5, 0x80404518, 0x0) 15.452228108s ago: executing program 3 (id=62): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r1 = memfd_create(&(0x7f0000000840)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\n%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05\x9dR\xde\xf6\xc9!R#\xd7\xc0\xea\x9a\x04v\x85\xbcx\x9ai\xd2\r\x05ZY\x0e\"d\xc7\xd7\x02v32Z\xe0\n3\x8b\xa0\x83z\v\x90\x8ce\x12\xbcw\x1e\x7f \xdaPh: \x8e\x95\xb2\xee\xd9\xd9\xe47\x1c\xab\x97P\x86\x8c\xcb]Q\x83\xaaM\xc0\xd4\tQ\xee\x9c\x98\xe4\x18cb\xbd/\xd8\xe95\x7f\x00\xfd6#\x87\x8c\xf9\xa3\x041U\xb9\x14\xce\x9b', 0x2) ftruncate(r1, 0xffff) fcntl$addseals(r1, 0x409, 0x2) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) ftruncate(r2, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) setxattr$security_ima(0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0) lremovexattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=ANY=[]) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f00000002c0)={r1, 0x0, 0x0, 0x2000}) ioctl$BTRFS_IOC_ENCODED_WRITE(r1, 0x40809440, &(0x7f0000000340)={&(0x7f0000000280)=[{&(0x7f0000000040)="db25228bc055bd33dadb2bde5cfc61f55cde57b637acd82ae142e93c0bc82e2fd54c7171046c9da094bd4e92f6399adcc13fe2e9f216958e6ae7136df968008d0bc32e39071bd55b24589abaf5049799cce196c68897643982cb889797f2adc3e4ee11555baa95d45a3274a2f0800dce16ea9490389d86cee9263d0fd3cce9cde87b8355720fa3b58b1080fdf9c8d19271406c606fb5f5dc9609d334758d518e8881164d9e29810ca843771ac13c97c9958a400671c56144c2c3b03ce69d0f7f6fb74b6a08b5af890406b07b", 0xcc}], 0x1, 0xfffffffffffffffa, 0x0, 0x81, 0x9, 0xfffffffffffffffd, 0x2, 0xc1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000001200010003950000000100000a0900004001000000000000000000000000ffff0000000000000000000000000000ffff"], 0x4c}}, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x63a8, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f72, 0x2, 0x3, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) 13.527480047s ago: executing program 1 (id=64): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000140)='0x1d6b\n', 0x7) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='0x0104\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/bcdUSB\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='0x0200\n', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/bcdDevice\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f0000000b40), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='0123456789\n', 0xb) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r3, &(0x7f0000000480)='HID Gadget\n', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x1, 0x0) write(r4, &(0x7f00000006c0)='1\n', 0x2) openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/functions/hid.usb0/subclass\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000007c0)='1\n', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x1, 0x0) write(r5, &(0x7f0000000840), 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x0) write(r6, &(0x7f00000008c0)="05010906a101050719e029e71500250175019508810295017508810395057501050819012905910295017503910395067508150025650507190029658100c0", 0x3f) symlinkat(&(0x7f0000000900)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000980)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r7, &(0x7f0000000a40)='dummy_udc.0\n', 0xc) nanosleep(&(0x7f0000000b00)={0x0, 0x1dcd6500}, 0x0) r8 = syz_open_dev$hidraw(&(0x7f0000000c00), 0x0, 0x2) write$hidraw(r8, &(0x7f0000000c40)="0001", 0x2) 13.437185404s ago: executing program 3 (id=65): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x80042, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) r1 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b00010000000009040800010300000009", @ANYRES64], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) rt_tgsigqueueinfo(0x0, 0x0, 0xb, &(0x7f0000000000)={0x2a, 0x0, 0x3}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000003c0)={0xc}) 11.618014117s ago: executing program 2 (id=66): r0 = userfaultfd(0x80001) syz_open_dev$char_usb(0xc, 0xb4, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x0, 0x0}, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x5, 0x5, 0x401d031, 0xffffffffffffffff, 0x0) socket(0x10, 0x803, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x0, 0x200) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x48500, 0x80) write(r4, &(0x7f0000000000)='3', 0x4e) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r3}, 0xc) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffb, 0x3, 0x0, 0x1, 'syz1\x00'}, 0x6, 0x100, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) r5 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7fce1dca24e3ee4c89a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d83104000000fda542e718f94b929ade", 0x55}], 0x1}, 0x20048000) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) 11.556376452s ago: executing program 1 (id=67): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, &(0x7f0000000000)=@framed, 0x0}, 0x94) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e131d"], 0x16) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_open_dev$sndpcmc(0x0, 0x1, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f00000002c0)=0x80000000000003) openat$ptmx(0xffffffffffffff9c, 0x0, 0x101000, 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001240)=0xffffffffffffffff, 0x4) ioctl$KVM_RUN(r5, 0xae80, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) 9.992556721s ago: executing program 4 (id=68): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, 0x0) rseq(0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r1, 0x0, &(0x7f0000000f00)=""/20}, 0x20) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffd, 0xb) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000000)=0xdfe5) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r2, 0x5) 9.959445956s ago: executing program 2 (id=69): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="6400000010000305160000000000000000008847", @ANYRES32=0x0, @ANYBLOB="00000000000000004400128009000100626f6e6400000000340002800500010004000000050016000000000008001c000000000005000c00000000000a001a"], 0xc3}, 0x1, 0x100000000000000}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000000)={[{@volatile}, {@redirect_dir_on}]}) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macsec0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) kexec_load(0x0, 0x1, &(0x7f0000000480)=[{0x0, 0x0, 0x12008000, 0x1008000}], 0x0) kexec_load(0x6, 0x0, 0x0, 0x0) 9.478852496s ago: executing program 2 (id=70): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(r0, 0x0, 0x4c840) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./debug\x00', 0x1ff) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, 0x0, 0x0, 0x9, 0xba, &(0x7f0000000480)=""/186, 0x41100, 0x76, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f00005cf000/0x3000)=nil, 0x3000, 0x16) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.1\x00', 0x1ff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000001900010000000000000000001c140000fe000001000000000800", @ANYRES64], 0x24}}, 0x4000000) r5 = socket(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newtfilter={0x4c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x5, 0xfff1}, {0x0, 0xfff3}, {0x9, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x805}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x6}, @TCA_FLOWER_KEY_PORT_DST_MIN={0x6, 0x59, 0x4e21}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20041891}, 0x24000010) 9.47670202s ago: executing program 0 (id=71): setns(0xc9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff0800480000340000000000069078ac141400ac1e", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000041ca74169b1edc90780000"], 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000780)=[{&(0x7f00000002c0)="94", 0xfffffcf8}, {0x0}, {&(0x7f0000000600)="1d68d3308919014d5c15f1655981aa7959ea314b3d5a2c62f9870105c0759575291cc28825fb1bb46916bd7bbab37200e4c97c0fb653a766f313a244e1ba64d05c12fea2e650554e"}], 0x2) ioctl$TIOCGPGRP(r0, 0x540f, 0x0) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') open_by_handle_at(r2, &(0x7f0000001300)=ANY=[@ANYBLOB, @ANYRES8=r2], 0x4000) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4040) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000031401002abd8b00fedbdf210900020073797a3500000000080041007369770014003300626f6e6430000000000000000000"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa1000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) fstat(r3, &(0x7f0000000240)) read$FUSE(0xffffffffffffffff, &(0x7f0000002440)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0049a0045a42c77218df4a1d77b3000000000000000014a644c37c21b94e5de4aa31abd7da309a3df02134aaea1900652218f825b92b86d712d5598c079f79a80d23daf32b"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000b40)={&(0x7f0000000500)="b25431aab4590b16069136219342af468e3ec6f161f0e94c9845b45ee6c72017b35a024d5b96b0f18733dde1883b037e1b6e0c9ef00d92f57d1c38fe9576c84309041c4e353d0ab15065e6492777d8ca7d4ceb3cc9385619f6c61beb4291ce6a4ca60dfa3101edea65a738fe853347fc1ac6bb303be779c92c49d3d6ca0aa620743bf46368df344ece0793d5bcebcebe", &(0x7f0000000880)=""/210, &(0x7f0000000980)="d283a47ea77787fb8de28331ef045bcbfe4842c91150ab572e34aaf0cd2c1cabd354351324de9c11508dbf4ccd7cffa2ac65136e4cba50c57c1692246f36f7ce99e3fcc023e163a036d5f245b4709c0e337880c9cba0c4a014e490d8cec4bfea1aff5f5216fb12ab03776bbddd13e75a970255af4abd7900540fcd8ecc50a75b19738bf9a0a64032bf12b63d1b8ab29ee47ebde307cbce3e65b66323e007810a2242c0b1e905ee84c3ee4b4123710056fb6f11b6feb1b905c2d5ea17d4ccef05aed8df9be877042c72a6038aaec56a", &(0x7f0000000a80)="9a4c1c0210b046519f64c7cff6f23384cf57bffe7cbf", 0x0, r5}, 0x38) openat$userio(0xffffffffffffff9c, &(0x7f0000000300), 0x301002, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0), 0xc) prlimit64(r4, 0x3, 0x0, 0x0) 8.983808918s ago: executing program 1 (id=72): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000000)=0x40b, 0x4) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4014}, 0x4010850) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() timer_settime(0x0, 0x1, &(0x7f0000000300)={{0x77359400}}, &(0x7f0000000340)) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x47, &(0x7f0000000200)=0x7) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) 8.854372273s ago: executing program 4 (id=73): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000c20000fdeb0012cbd5f51cee3a7600b081f9637f6d4735f2dce7657669def6613a90098dca4cae4f47c6843dc7914316ed2e541188c9f3f65ba22578c47c25fafb6cfda16b4db0857d8a0b0cb0d7644437f18a51b73609ea1d4f1c4775c5aa329deda988ffbc78a2b916b585fa5b08968e9b0c875e27df6695735fdc54e65e4cb6cfd85ab9dba6e46f19f51ebb3a553bf55a749690daafbe9772f31b8a6f2e395495638f49a9d4121613bae5754fcfa084e68431e5f594abc9a53bd1fb993554cf4ee3870500fddcd287345461172cf3c480cfd13f63afee36de9847721ad173f547d8f020519f85f5dfc14c4b2d77385f923bde9b52ae8b6a707264114544644079df54d1dc1fed7b207930e8b1a008acab92ca11cf79d3bdc569407d559e415556c186fa921e7f535e170e262aa3cf6221eda62249d9c3067734229489d8d3b2412aa608746e044cde5b28c728c26ae72855cae4e85a51e7510fefc993954e69d4d59e234c34a0488eab767eaa66a6ef20f00dbd7e3a3c5f841139", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x210, 0x3, 0x1, 0x401, 0x0, 0x0, {0x5}, [@CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x101}, @CTA_PROTOINFO={0x50, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4c, 0x1, 0x0, 0x1, [@CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x9, 0x6}}, @CTA_PROTOINFO_TCP_FLAGS_ORIGINAL={0x6, 0x4, {0x0, 0x2}}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x6, 0x6}}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x7, 0x6}}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x8}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x4}, @CTA_PROTOINFO_TCP_STATE={0x5, 0x1, 0x4}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x6}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x0, 0x5, {0x7, 0x2}}]}}, @CTA_TUPLE_ORIG={0x8c, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv4={{0x0, 0x1, @private=0xa010102}, {0x0, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x39}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0xfffffffb}, {0x8, 0x2, @loopback}}}]}, @CTA_TUPLE_MASTER={0x6c, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x0, 0x1, 0x0, 0x1, @ipv4={{0x0, 0x1, @empty}, {0x0, 0x2, @dev={0xac, 0x14, 0x14, 0x22}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00'}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x3}, @CTA_PROTOINFO={0x50, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4c}}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_LABELS={0x8, 0x16, 0x1, 0x0, [0x7]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x210}}, 0x0) ptrace$ARCH_GET_FS(0x1e, r1, &(0x7f0000000880), 0x1003) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r5, 0x8040942d, &(0x7f00000008c0)) sched_setaffinity(r4, 0x47, &(0x7f0000000200)=0x7) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x4a0, 0x0, 0x0, 0xffffffff, 0x338, 0x290, 0x408, 0x408, 0xffffffff, 0x408, 0x408, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010104, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'wg1\x00', {}, {0xff}, 0x16}, 0x0, 0x130, 0x168, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'kmp\x00', "48ae43e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @dev={0xac, 0x14, 0x14, 0x16}, @initdev={0xac, 0x1e, 0x0, 0x0}, @port=0x4e22, @port=0x4e24}}}}, {{@uncond, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'veth1_vlan\x00', 'macvtap0\x00', 0x10, 0x1, 0x6, 0x10000, 0xc, 0x2, {0xfffffffffffffffc}, {0x6}}}, @common=@socket0={{0x20}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xfffc, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x100}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'virt_wifi0\x00', 'batadv_slave_1\x00', {}, {0xff}}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @empty, @icmp_id=0x68, @port=0x4e22}}}}, {{@uncond, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0x4, "1542", 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x500) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) creat(&(0x7f0000000140)='./file0/file0\x00', 0x66) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) quotactl$Q_GETQUOTA(0xffffffff80000700, &(0x7f0000000000)=@sg0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x17, &(0x7f0000000a00)=ANY=[@ANYBLOB="18000000070000002be27851952fb8e0181100003999", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09000000000000650901000000000066000000060000001801000020756c2500000000002020207b9af8ff000000005d9100000000000037010000f8ffffffb702000008000000b70300000200000056000000060000002c93000000000000b5030000000000008500000078000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 8.773808167s ago: executing program 2 (id=74): socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x6, 0x371, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) mq_open(0x0, 0x800, 0x40, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r3, &(0x7f00000000c0)={0x1d, r4, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r3, &(0x7f0000000140)={0x1d, r4, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r3, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) sendmsg$kcm(r2, &(0x7f00000001c0)={0x0, 0x18, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001206", 0x2e}], 0x1}, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x8000000004) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x4, 0xc, &(0x7f0000000400)=ANY=[@ANYRES8=r0], &(0x7f0000000200)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r5 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0xc441) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f0000000040)=0xfffffffe) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f0000000080)) socket(0x848000000015, 0x805, 0x0) 8.761932289s ago: executing program 3 (id=75): quotactl$Q_GETQUOTA(0xffffffff80000700, &(0x7f0000000000)=@sg0, 0x0, 0x0) 8.697751496s ago: executing program 3 (id=76): r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$MEMREADOOB(r0, 0xc00c4d04, &(0x7f0000000640)={0x5, 0x0, &(0x7f0000000400)}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000500)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x12, 0x3, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000003000000000000000300000095000000000000007000c01f84d37a21f7364fd967aab05d20d2e06fa3ae2d441d1eebb8f62dc3430c3496089d8c7496ab86816393279c076518869f5dffd85b4081b9b70c628809adeab44f967acfedc5aeeb510920d3e5a402ee8ff6eb738445c3406ed3a5709a1824c71f3762141ae4b1bf72b3d5ee7fd3c60ccac5a8cfabebdd303a74d946665e29a14f92b103cb2cbf6c24ccbfbee224bf64df5569a650c249cdd1ed24f696aef9ac667bb03a8af88c73b189a65752"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000340)=ANY=[]) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, 0x0) r5 = socket(0x10, 0x3, 0x0) write(r5, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) openat$dsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x9640, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000c40), 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000140)={0x0, 0x6}, 0x8) dup2(r5, r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='efs\x00', 0x0, 0x0) 7.812931115s ago: executing program 4 (id=77): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000140)='0x1d6b\n', 0x7) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='0x0104\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/bcdUSB\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='0x0200\n', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/bcdDevice\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f0000000b40), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='0123456789\n', 0xb) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r3, &(0x7f0000000480)='HID Gadget\n', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x1, 0x0) write(r4, &(0x7f00000006c0)='1\n', 0x2) openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/functions/hid.usb0/subclass\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000007c0)='1\n', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x1, 0x0) write(r5, &(0x7f0000000840), 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x0) write(r6, &(0x7f00000008c0)="05010906a101050719e029e71500250175019508810295017508810395057501050819012905910295017503910395067508150025650507190029658100c0", 0x3f) symlinkat(&(0x7f0000000900)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000980)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r7, &(0x7f0000000a40)='dummy_udc.0\n', 0xc) nanosleep(&(0x7f0000000b00)={0x0, 0x1dcd6500}, 0x0) r8 = syz_open_dev$hidraw(&(0x7f0000000c00), 0x0, 0x2) write$hidraw(r8, &(0x7f0000000c40)="0001", 0x2) 6.139311114s ago: executing program 3 (id=78): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000000)=0x40b, 0x4) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4014}, 0x4010850) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() timer_settime(0x0, 0x1, &(0x7f0000000300)={{0x77359400}}, &(0x7f0000000340)) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x47, &(0x7f0000000200)=0x7) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0) write(r6, &(0x7f0000000040)='add syz0 ::', 0xb) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x3c, 0x3000001, 0x50, r6, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) dup3(r7, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 6.069736249s ago: executing program 0 (id=79): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000c20000fdeb0012cbd5f51cee3a7600b081f9637f6d4735f2dce7657669def6613a90098dca4cae4f47c6843dc7914316ed2e541188c9f3f65ba22578c47c25fafb6cfda16b4db0857d8a0b0cb0d7644437f18a51b73609ea1d4f1c4775c5aa329deda988ffbc78a2b916b585fa5b08968e9b0c875e27df6695735fdc54e65e4cb6cfd85ab9dba6e46f19f51ebb3a553bf55a749690daafbe9772f31b8a6f2e395495638f49a9d4121613bae5754fcfa084e68431e5f594abc9a53bd1fb993554cf4ee3870500fddcd287345461172cf3c480cfd13f63afee36de9847721ad173f547d8f020519f85f5dfc14c4b2d77385f923bde9b52ae8b6a707264114544644079df54d1dc1fed7b207930e8b1a008acab92ca11cf79d3bdc569407d559e415556c186fa921e7f535e170e262aa3cf6221eda62249d9c3067734229489d8d3b2412aa608746e044cde5b28c728c26ae72855cae4e85a51e7510fefc993954e69d4d59e234c34a0488eab767eaa66a6ef20f00dbd7e3a3c5f841139", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x210, 0x3, 0x1, 0x401, 0x0, 0x0, {0x5}, [@CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x101}, @CTA_PROTOINFO={0x50, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4c, 0x1, 0x0, 0x1, [@CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x9, 0x6}}, @CTA_PROTOINFO_TCP_FLAGS_ORIGINAL={0x6, 0x4, {0x0, 0x2}}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x6, 0x6}}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x7, 0x6}}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x8}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x4}, @CTA_PROTOINFO_TCP_STATE={0x5, 0x1, 0x4}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x6}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x0, 0x5, {0x7, 0x2}}]}}, @CTA_TUPLE_ORIG={0x8c, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv4={{0x0, 0x1, @private=0xa010102}, {0x0, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x39}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0xfffffffb}, {0x8, 0x2, @loopback}}}]}, @CTA_TUPLE_MASTER={0x6c, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x0, 0x1, 0x0, 0x1, @ipv4={{0x0, 0x1, @empty}, {0x0, 0x2, @dev={0xac, 0x14, 0x14, 0x22}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00'}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x3}, @CTA_PROTOINFO={0x50, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4c}}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_LABELS={0x8, 0x16, 0x1, 0x0, [0x7]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x210}}, 0x0) ptrace$ARCH_GET_FS(0x1e, r0, &(0x7f0000000880), 0x1003) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r4, 0x8040942d, &(0x7f00000008c0)) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x4a0, 0x0, 0x0, 0xffffffff, 0x338, 0x290, 0x408, 0x408, 0xffffffff, 0x408, 0x408, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010104, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'wg1\x00', {}, {0xff}, 0x16}, 0x0, 0x130, 0x168, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'kmp\x00', "48ae43e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @dev={0xac, 0x14, 0x14, 0x16}, @initdev={0xac, 0x1e, 0x0, 0x0}, @port=0x4e22, @port=0x4e24}}}}, {{@uncond, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'veth1_vlan\x00', 'macvtap0\x00', 0x10, 0x1, 0x6, 0x10000, 0xc, 0x2, {0xfffffffffffffffc}, {0x6}}}, @common=@socket0={{0x20}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xfffc, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x100}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'virt_wifi0\x00', 'batadv_slave_1\x00', {}, {0xff}}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @empty, @icmp_id=0x68, @port=0x4e22}}}}, {{@uncond, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0x4, "1542", 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x500) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) creat(&(0x7f0000000140)='./file0/file0\x00', 0x66) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) quotactl$Q_GETQUOTA(0xffffffff80000700, &(0x7f0000000000)=@sg0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x15) 4.037091987s ago: executing program 0 (id=80): r0 = userfaultfd(0x80001) syz_open_dev$char_usb(0xc, 0xb4, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x0, 0x0}, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x5, 0x5, 0x401d031, 0xffffffffffffffff, 0x0) socket(0x10, 0x803, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x0, 0x200) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x48500, 0x80) write(r4, &(0x7f0000000000)='3', 0x4e) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r3}, 0xc) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffb, 0x3, 0x0, 0x1, 'syz1\x00'}, 0x6, 0x100, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) r5 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7fce1dca24e3ee4c89a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d83104000000fda542e718f94b929ade", 0x55}], 0x1}, 0x20048000) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) 3.056076002s ago: executing program 3 (id=81): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="6400000010000305160000000000000000008847", @ANYRES32=0x0, @ANYBLOB="00000000000000004400128009000100626f6e6400000000340002800500010004000000050016000000000008001c000000000005000c00000000000a001a"], 0xc3}, 0x1, 0x100000000000000}, 0x0) socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000000)={[{@volatile}, {@redirect_dir_on}]}) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'macsec0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) kexec_load(0x0, 0x1, &(0x7f0000000480)=[{0x0, 0x0, 0x12008000, 0x1008000}], 0x0) kexec_load(0x6, 0x0, 0x0, 0x0) 2.977047927s ago: executing program 2 (id=82): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, &(0x7f0000000000)=@framed, 0x0}, 0x94) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e131d"], 0x16) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_open_dev$sndpcmc(0x0, 0x1, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f00000002c0)=0x80000000000003) openat$ptmx(0xffffffffffffff9c, 0x0, 0x101000, 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001240)=0xffffffffffffffff, 0x4) ioctl$KVM_RUN(r5, 0xae80, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) 959.215632ms ago: executing program 1 (id=83): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, 0x0) rseq(0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r1, 0x0, &(0x7f0000000f00)=""/20}, 0x20) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffd, 0xb) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000000)=0xdfe5) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r2, 0x5) 142.052667ms ago: executing program 0 (id=84): socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r1}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000007c0)={0x28, 0x7, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1004000}) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r0, 0x3ba0, &(0x7f0000000880)={0x48, 0x4, 0x0, 0x0, 0x1000, &(0x7f0000ffc000), 0x1}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x38, r5, 0x1, 0x70dd2d, 0x25dfdbff, {{0x2}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x47, 0x4d}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1450}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}]]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="5c0000000206050800000000000000000000000005000400000000000900020073797a30000000001400078008001340000000000800064000000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x44, 0x9, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x1}, @IPSET_ATTR_ADT={0x14, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_ETHER={0xa, 0x11, @local}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) 32.658017ms ago: executing program 2 (id=85): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(r0, 0x0, 0x4c840) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./debug\x00', 0x1ff) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, 0x0, 0x0, 0x9, 0xba, &(0x7f0000000480)=""/186, 0x41100, 0x76, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f00005cf000/0x3000)=nil, 0x3000, 0x16) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.1\x00', 0x1ff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000001900010000000000000000001c140000fe000001000000000800", @ANYRES64], 0x24}}, 0x4000000) r5 = socket(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newtfilter={0x4c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x5, 0xfff1}, {0x0, 0xfff3}, {0x9, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x805}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x6}, @TCA_FLOWER_KEY_PORT_DST_MIN={0x6, 0x59, 0x4e21}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20041891}, 0x24000010) 0s ago: executing program 4 (id=86): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x80042, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) r1 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYRES64], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x1a01, 0x0) rt_tgsigqueueinfo(0x0, 0x0, 0xb, &(0x7f0000000000)={0x2a, 0x0, 0x3}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000003c0)={0xc}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.152' (ED25519) to the list of known hosts. [ 358.190635][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 358.190651][ T30] audit: type=1400 audit(1789819659.808:129): avc: denied { mounton } for pid=5632 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 358.191741][ T30] audit: type=1400 audit(1789819659.808:130): avc: denied { mount } for pid=5632 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 358.193326][ T5632] cgroup: Unknown subsys name 'net' [ 358.194431][ T30] audit: type=1400 audit(1789819659.808:131): avc: denied { unmount } for pid=5632 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 358.300357][ T5632] cgroup: Unknown subsys name 'cpuset' [ 358.302627][ T5632] cgroup: Unknown subsys name 'rlimit' [ 358.427065][ T30] audit: type=1400 audit(1789819660.038:132): avc: denied { setattr } for pid=5632 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 358.427494][ T30] audit: type=1400 audit(1789819660.038:133): avc: denied { create } for pid=5632 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 358.451206][ T30] audit: type=1400 audit(1789819660.048:134): avc: denied { write } for pid=5632 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 358.451249][ T30] audit: type=1400 audit(1789819660.048:135): avc: denied { read } for pid=5632 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 358.451284][ T30] audit: type=1400 audit(1789819660.058:136): avc: denied { mounton } for pid=5632 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 358.451320][ T30] audit: type=1400 audit(1789819660.058:137): avc: denied { mount } for pid=5632 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 358.522897][ T5634] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 358.540771][ T30] audit: type=1400 audit(1789819660.138:138): avc: denied { relabelto } for pid=5634 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 359.515994][ T5632] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 361.623774][ T5645] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 361.637520][ T5650] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 361.638472][ T5650] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 361.639734][ T5650] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 361.645756][ T5651] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 361.646075][ T5651] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 361.646437][ T5651] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 361.647717][ T5651] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 361.648140][ T5651] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 361.648344][ T5651] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 361.648685][ T5651] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 361.650583][ T5651] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 361.652416][ T5651] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 361.674366][ T5651] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 361.698901][ T5651] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 361.743759][ T4917] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 361.745166][ T4917] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 361.745735][ T4917] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 361.752640][ T4917] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 361.755623][ T4917] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 361.775387][ T4917] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 361.777829][ T4917] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 361.778424][ T4917] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 361.779132][ T4917] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 361.779821][ T4917] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 363.122134][ T5652] bridge0: port 1(bridge_slave_0) entered blocking state [ 363.122696][ T5652] bridge0: port 1(bridge_slave_0) entered disabled state [ 363.122853][ T5652] bridge_slave_0: entered allmulticast mode [ 363.123668][ T5652] bridge_slave_0: entered promiscuous mode [ 363.154277][ T5643] bridge0: port 1(bridge_slave_0) entered blocking state [ 363.154340][ T5643] bridge0: port 1(bridge_slave_0) entered disabled state [ 363.154415][ T5643] bridge_slave_0: entered allmulticast mode [ 363.155516][ T5643] bridge_slave_0: entered promiscuous mode [ 363.157336][ T5642] bridge0: port 1(bridge_slave_0) entered blocking state [ 363.157440][ T5642] bridge0: port 1(bridge_slave_0) entered disabled state [ 363.158090][ T5642] bridge_slave_0: entered allmulticast mode [ 363.159276][ T5642] bridge_slave_0: entered promiscuous mode [ 363.161046][ T5652] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.161117][ T5652] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.161195][ T5652] bridge_slave_1: entered allmulticast mode [ 363.162320][ T5652] bridge_slave_1: entered promiscuous mode [ 363.180989][ T5643] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.181057][ T5643] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.181147][ T5643] bridge_slave_1: entered allmulticast mode [ 363.182925][ T5643] bridge_slave_1: entered promiscuous mode [ 363.184254][ T5642] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.184318][ T5642] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.184557][ T5642] bridge_slave_1: entered allmulticast mode [ 363.185883][ T5642] bridge_slave_1: entered promiscuous mode [ 363.209807][ T5642] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 363.212112][ T5642] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 363.307763][ T5648] bridge0: port 1(bridge_slave_0) entered blocking state [ 363.308558][ T5648] bridge0: port 1(bridge_slave_0) entered disabled state [ 363.308646][ T5648] bridge_slave_0: entered allmulticast mode [ 363.310047][ T5648] bridge_slave_0: entered promiscuous mode [ 363.338904][ T5652] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 363.339064][ T5648] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.339155][ T5648] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.339241][ T5648] bridge_slave_1: entered allmulticast mode [ 363.340409][ T5648] bridge_slave_1: entered promiscuous mode [ 363.362301][ T5643] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 363.364626][ T5642] team0: Port device team_slave_0 added [ 363.367188][ T5652] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 363.406139][ T5643] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 363.407394][ T5642] team0: Port device team_slave_1 added [ 363.419426][ T5652] team0: Port device team_slave_0 added [ 363.422632][ T5648] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 363.425058][ T5648] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 363.425178][ T5660] bridge0: port 1(bridge_slave_0) entered blocking state [ 363.425282][ T5660] bridge0: port 1(bridge_slave_0) entered disabled state [ 363.425363][ T5660] bridge_slave_0: entered allmulticast mode [ 363.426502][ T5660] bridge_slave_0: entered promiscuous mode [ 363.442906][ T5652] team0: Port device team_slave_1 added [ 363.452841][ T5660] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.452910][ T5660] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.453153][ T5660] bridge_slave_1: entered allmulticast mode [ 363.458880][ T5660] bridge_slave_1: entered promiscuous mode [ 363.480217][ T5643] team0: Port device team_slave_0 added [ 363.516760][ T5643] team0: Port device team_slave_1 added [ 363.518988][ T5660] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 363.529782][ T5660] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 363.555932][ T5648] team0: Port device team_slave_0 added [ 363.557372][ T5660] team0: Port device team_slave_0 added [ 363.566985][ T5652] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 363.566998][ T5652] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.567016][ T5652] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 363.570224][ T5652] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 363.570237][ T5652] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.570255][ T5652] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 363.570933][ T5642] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 363.570941][ T5642] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.570958][ T5642] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 363.572824][ T5642] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 363.572835][ T5642] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.572852][ T5642] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 363.575134][ T5648] team0: Port device team_slave_1 added [ 363.608814][ T5643] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 363.608829][ T5643] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.608847][ T5643] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 363.625138][ T5660] team0: Port device team_slave_1 added [ 363.643768][ T5643] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 363.643783][ T5643] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.643802][ T5643] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 363.671031][ T5648] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 363.671046][ T5648] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.671064][ T5648] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 363.687579][ T5652] hsr_slave_0: entered promiscuous mode [ 363.688521][ T5652] hsr_slave_1: entered promiscuous mode [ 363.696266][ T5642] hsr_slave_0: entered promiscuous mode [ 363.696987][ T5642] hsr_slave_1: entered promiscuous mode [ 363.697465][ T5642] debugfs: 'hsr0' already exists in 'hsr' [ 363.697531][ T5642] Cannot create hsr debugfs directory [ 363.698534][ T4917] Bluetooth: hci3: command tx timeout [ 363.698649][ T4917] Bluetooth: hci2: command tx timeout [ 363.712309][ T5660] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 363.712322][ T5660] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.712339][ T5660] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 363.715944][ T5648] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 363.715955][ T5648] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.715973][ T5648] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 363.787785][ T52] Bluetooth: hci0: command tx timeout [ 363.808764][ T5660] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 363.808777][ T5660] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.808795][ T5660] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 363.858121][ T4917] Bluetooth: hci4: command tx timeout [ 363.858377][ T52] Bluetooth: hci1: command tx timeout [ 364.083156][ T5643] hsr_slave_0: entered promiscuous mode [ 364.083613][ T5643] hsr_slave_1: entered promiscuous mode [ 364.083925][ T5643] debugfs: 'hsr0' already exists in 'hsr' [ 364.083940][ T5643] Cannot create hsr debugfs directory [ 364.136101][ T5648] hsr_slave_0: entered promiscuous mode [ 364.136536][ T5648] hsr_slave_1: entered promiscuous mode [ 364.136838][ T5648] debugfs: 'hsr0' already exists in 'hsr' [ 364.136854][ T5648] Cannot create hsr debugfs directory [ 364.201793][ T5660] hsr_slave_0: entered promiscuous mode [ 364.202766][ T5660] hsr_slave_1: entered promiscuous mode [ 364.203072][ T5660] debugfs: 'hsr0' already exists in 'hsr' [ 364.203087][ T5660] Cannot create hsr debugfs directory [ 364.484620][ T5642] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 364.490116][ T5642] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 364.490855][ T5642] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 364.497304][ T5642] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 364.500128][ T5642] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 364.506551][ T5642] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 364.507153][ T5642] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 364.515483][ T5642] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 364.580601][ T5652] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 364.587247][ T5652] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 364.606500][ T5652] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 364.612645][ T5652] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 364.615612][ T5652] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 364.625017][ T5652] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 364.629235][ T5652] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 364.643075][ T5652] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 364.708292][ T5643] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 364.711665][ T5643] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 364.717032][ T5643] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 364.724194][ T5643] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 364.724826][ T5643] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 364.728377][ T5643] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 364.730468][ T5643] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 364.739738][ T5643] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 364.752208][ T5642] 8021q: adding VLAN 0 to HW filter on device bond0 [ 364.820230][ T5642] 8021q: adding VLAN 0 to HW filter on device team0 [ 364.832867][ T5648] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 364.843870][ T5648] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 364.845999][ T5648] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 364.850839][ T5648] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 364.875122][ T5648] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 364.884940][ T5648] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 364.885655][ T5648] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 364.889239][ T5648] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 364.900592][ T5677] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.900689][ T5677] bridge0: port 1(bridge_slave_0) entered forwarding state [ 364.946373][ T5664] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.946422][ T5664] bridge0: port 2(bridge_slave_1) entered forwarding state [ 364.968972][ T5660] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 364.970893][ T5660] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 364.971418][ T5660] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 364.973248][ T5660] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 364.973997][ T5660] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 364.975916][ T5660] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 364.976563][ T5660] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 364.981712][ T5660] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 365.090217][ T5652] 8021q: adding VLAN 0 to HW filter on device bond0 [ 365.109283][ T5643] 8021q: adding VLAN 0 to HW filter on device bond0 [ 365.162232][ T5648] 8021q: adding VLAN 0 to HW filter on device bond0 [ 365.164941][ T5652] 8021q: adding VLAN 0 to HW filter on device team0 [ 365.202942][ T5677] bridge0: port 1(bridge_slave_0) entered blocking state [ 365.203028][ T5677] bridge0: port 1(bridge_slave_0) entered forwarding state [ 365.208138][ T5643] 8021q: adding VLAN 0 to HW filter on device team0 [ 365.219196][ T5664] bridge0: port 2(bridge_slave_1) entered blocking state [ 365.219271][ T5664] bridge0: port 2(bridge_slave_1) entered forwarding state [ 365.222865][ T5648] 8021q: adding VLAN 0 to HW filter on device team0 [ 365.247330][ T5664] bridge0: port 1(bridge_slave_0) entered blocking state [ 365.247407][ T5664] bridge0: port 1(bridge_slave_0) entered forwarding state [ 365.272442][ T5664] bridge0: port 1(bridge_slave_0) entered blocking state [ 365.272532][ T5664] bridge0: port 1(bridge_slave_0) entered forwarding state [ 365.276187][ T5664] bridge0: port 2(bridge_slave_1) entered blocking state [ 365.276270][ T5664] bridge0: port 2(bridge_slave_1) entered forwarding state [ 365.299143][ T4721] bridge0: port 2(bridge_slave_1) entered blocking state [ 365.299218][ T4721] bridge0: port 2(bridge_slave_1) entered forwarding state [ 365.359507][ T5660] 8021q: adding VLAN 0 to HW filter on device bond0 [ 365.432009][ T5660] 8021q: adding VLAN 0 to HW filter on device team0 [ 365.452641][ T5664] bridge0: port 1(bridge_slave_0) entered blocking state [ 365.452727][ T5664] bridge0: port 1(bridge_slave_0) entered forwarding state [ 365.490286][ T5664] bridge0: port 2(bridge_slave_1) entered blocking state [ 365.490373][ T5664] bridge0: port 2(bridge_slave_1) entered forwarding state [ 365.771487][ T52] Bluetooth: hci2: command tx timeout [ 365.771517][ T52] Bluetooth: hci3: command tx timeout [ 365.848452][ T4917] Bluetooth: hci0: command tx timeout [ 365.926774][ T5642] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 365.928174][ T4917] Bluetooth: hci1: command tx timeout [ 365.928200][ T4917] Bluetooth: hci4: command tx timeout [ 366.114971][ T5642] veth0_vlan: entered promiscuous mode [ 366.144301][ T5642] veth1_vlan: entered promiscuous mode [ 366.203065][ T5642] veth0_macvtap: entered promiscuous mode [ 366.226254][ T5642] veth1_macvtap: entered promiscuous mode [ 366.275837][ T5648] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 366.297954][ T5642] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 366.321776][ T5642] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 366.380983][ T5652] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 366.398129][ T5643] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 366.507524][ T5648] veth0_vlan: entered promiscuous mode [ 366.558994][ T5648] veth1_vlan: entered promiscuous mode [ 366.567574][ T5660] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 366.587897][ T4721] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 366.587918][ T4721] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 366.633028][ T5643] veth0_vlan: entered promiscuous mode [ 366.647891][ T50] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.648020][ T50] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.649975][ T5788] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.650020][ T5788] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.707184][ T5677] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 366.707205][ T5677] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 366.742171][ T5648] veth0_macvtap: entered promiscuous mode [ 366.747593][ T5643] veth1_vlan: entered promiscuous mode [ 366.754737][ T5648] veth1_macvtap: entered promiscuous mode [ 366.756299][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 366.756312][ T30] audit: type=1400 audit(1789819668.368:154): avc: denied { mounton } for pid=5642 comm="syz-executor" path="/root/syzkaller.DFTUS2/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 366.759064][ T30] audit: type=1400 audit(1789819668.368:155): avc: denied { mount } for pid=5642 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 366.766794][ T30] audit: type=1400 audit(1789819668.388:156): avc: denied { mounton } for pid=5642 comm="syz-executor" path="/root/syzkaller.DFTUS2/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 366.774679][ T30] audit: type=1400 audit(1789819668.398:157): avc: denied { mount } for pid=5642 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 366.780180][ T5648] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 366.785340][ T30] audit: type=1400 audit(1789819668.398:158): avc: denied { mounton } for pid=5642 comm="syz-executor" path="/root/syzkaller.DFTUS2/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 366.785382][ T30] audit: type=1400 audit(1789819668.398:159): avc: denied { mounton } for pid=5642 comm="syz-executor" path="/root/syzkaller.DFTUS2/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=8060 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 366.786411][ T5648] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 366.794193][ T30] audit: type=1400 audit(1789819668.398:160): avc: denied { unmount } for pid=5642 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 366.860176][ T30] audit: type=1400 audit(1789819668.468:161): avc: denied { mounton } for pid=5642 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2780 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 366.860221][ T30] audit: type=1400 audit(1789819668.468:162): avc: denied { mount } for pid=5642 comm="syz-executor" name="/" dev="gadgetfs" ino=6662 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 366.860252][ T30] audit: type=1400 audit(1789819668.468:163): avc: denied { mount } for pid=5642 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 366.908891][ T5660] veth0_vlan: entered promiscuous mode [ 366.917421][ T5642] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 367.010101][ T5788] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.022472][ T5660] veth1_vlan: entered promiscuous mode [ 367.064892][ T5652] veth0_vlan: entered promiscuous mode [ 367.127239][ T1056] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 367.134754][ T1056] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 367.144936][ T5643] veth0_macvtap: entered promiscuous mode [ 367.162331][ T52] Bluetooth: hci1: Unable to find connection for big 0x00 [ 367.163366][ T5652] veth1_vlan: entered promiscuous mode [ 367.190626][ T5643] veth1_macvtap: entered promiscuous mode [ 367.207883][ T5788] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.208575][ T5788] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.208630][ T5788] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.214487][ T1056] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 367.214514][ T1056] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 367.222022][ T5660] veth0_macvtap: entered promiscuous mode [ 367.273030][ T5660] veth1_macvtap: entered promiscuous mode [ 367.310983][ T5643] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 367.341720][ T5660] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 367.342803][ T5652] veth0_macvtap: entered promiscuous mode [ 367.344892][ T5643] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 367.376034][ T5660] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 368.336408][ T52] Bluetooth: hci3: command tx timeout [ 368.336453][ T52] Bluetooth: hci2: command tx timeout [ 368.336473][ T52] Bluetooth: hci0: command tx timeout [ 368.336492][ T52] Bluetooth: hci4: command tx timeout [ 368.336511][ T52] Bluetooth: hci1: command tx timeout [ 368.383745][ T5652] veth1_macvtap: entered promiscuous mode [ 368.407866][ T50] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.408275][ T50] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.426382][ T5652] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 368.433121][ T5652] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 368.463235][ T50] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.463482][ T50] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.464167][ T50] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.465313][ T50] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.537505][ T4917] Bluetooth: hci2: Unable to find connection for big 0x00 [ 369.528481][ T5677] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.542341][ T50] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.542380][ T50] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.542406][ T50] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.542433][ T50] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.542458][ T50] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.568848][ T4721] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.568872][ T4721] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 369.739975][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.739989][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 369.779788][ T4721] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.779804][ T4721] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 369.900015][ T4721] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.900028][ T4721] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 370.056558][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.056574][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 370.792405][ T4917] Bluetooth: hci1: command tx timeout [ 370.792439][ T4917] Bluetooth: hci4: command tx timeout [ 370.792457][ T4917] Bluetooth: hci0: command tx timeout [ 370.792476][ T4917] Bluetooth: hci2: command tx timeout [ 370.792494][ T4917] Bluetooth: hci3: command tx timeout [ 370.955262][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.955283][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.518197][ T5646] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 371.690319][ T5646] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 371.696545][ T5646] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.696572][ T5646] usb 5-1: Product: syz [ 371.696587][ T5646] usb 5-1: Manufacturer: syz [ 371.696601][ T5646] usb 5-1: SerialNumber: syz [ 371.903608][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 371.903629][ T30] audit: type=1400 audit(1789819673.458:190): avc: denied { map } for pid=5861 comm="syz.3.6" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8789 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 371.903692][ T30] audit: type=1400 audit(1789819673.458:191): avc: denied { read write } for pid=5861 comm="syz.3.6" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8789 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 371.903745][ T30] audit: type=1400 audit(1789819673.458:192): avc: denied { map } for pid=5861 comm="syz.3.6" path="socket:[8788]" dev="sockfs" ino=8788 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 372.225114][ T5868] netlink: 144 bytes leftover after parsing attributes in process `syz.1.10'. [ 372.225263][ T30] audit: type=1400 audit(1789819673.838:193): avc: denied { write } for pid=5866 comm="syz.1.10" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 372.397575][ T5869] netlink: 144 bytes leftover after parsing attributes in process `syz.2.8'. [ 373.084838][ T5870] Cannot find add_set index 2 as target [ 373.508256][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 373.508522][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 373.510582][ T30] audit: type=1400 audit(1789819674.568:194): avc: denied { ioctl } for pid=5867 comm="syz.2.8" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x942d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 373.510609][ T30] audit: type=1400 audit(1789819674.758:195): avc: denied { create } for pid=5867 comm="syz.2.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 374.059735][ T5872] Cannot find add_set index 2 as target [ 374.198117][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 374.626588][ T5646] rtl8150 5-1:1.0: couldn't reset the device [ 374.626991][ T5646] rtl8150 5-1:1.0: probe with driver rtl8150 failed with error -5 [ 374.677188][ T5646] usb 5-1: USB disconnect, device number 2 [ 374.801190][ T30] audit: type=1400 audit(1789819676.418:196): avc: denied { append } for pid=5877 comm="syz.3.13" name="comedi3" dev="devtmpfs" ino=1276 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 374.806861][ T5879] genirq: Flags mismatch irq 32. 00200000 (pcmmio) vs. 00200000 (virtio1-output.0) [ 374.897752][ T5837] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 375.148290][ T5837] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 375.149304][ T5837] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 375.149330][ T5837] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 375.149349][ T5837] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 375.149379][ T5837] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 375.226555][ T5837] usb 1-1: config 0 descriptor?? [ 375.250802][ T30] audit: type=1400 audit(1789819676.868:197): avc: denied { setopt } for pid=5883 comm="syz.3.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 375.815359][ T30] audit: type=1400 audit(1789819677.428:198): avc: denied { unmount } for pid=5642 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 375.823268][ T5837] plantronics 0003:047F:FFFF.0001: reserved main item tag 0xd [ 375.890260][ T5837] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 377.015221][ T30] audit: type=1400 audit(1789819678.228:199): avc: denied { write } for pid=5887 comm="syz.3.16" name="cells" dev="proc" ino=4026533540 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 377.015270][ T30] audit: type=1400 audit(1789819678.388:200): avc: denied { create } for pid=5887 comm="syz.3.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 377.149882][ T5838] usb 1-1: USB disconnect, device number 2 [ 377.481333][ T30] audit: type=1400 audit(1789819679.098:201): avc: denied { watch watch_reads } for pid=5881 comm="syz.4.14" path="/1" dev="tmpfs" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 377.504878][ T5899] netlink: 144 bytes leftover after parsing attributes in process `syz.1.12'. [ 377.523214][ T5901] netlink: 144 bytes leftover after parsing attributes in process `syz.2.18'. [ 377.577947][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 378.066359][ T5902] Cannot find add_set index 2 as target [ 378.995801][ T5904] Cannot find add_set index 2 as target [ 379.317676][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 379.556581][ T52] Bluetooth: hci1: Unable to find connection for big 0x00 [ 381.483288][ T5919] netlink: 144 bytes leftover after parsing attributes in process `syz.3.24'. [ 382.021948][ T5920] Cannot find add_set index 2 as target [ 382.287797][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 382.617977][ T5923] netlink: 144 bytes leftover after parsing attributes in process `syz.4.26'. [ 383.965716][ T5929] netlink: 144 bytes leftover after parsing attributes in process `syz.2.20'. [ 384.847762][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 385.138622][ T5934] netlink: 144 bytes leftover after parsing attributes in process `syz.0.22'. [ 385.695670][ T5936] Cannot find add_set index 2 as target [ 386.357597][ T5836] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 386.453339][ T52] Bluetooth: hci2: Unable to find connection for big 0x00 [ 386.518341][ T5836] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 386.857679][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 387.457671][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 387.648597][ T5836] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.648621][ T5836] usb 2-1: Product: syz [ 387.648634][ T5836] usb 2-1: Manufacturer: syz [ 387.648647][ T5836] usb 2-1: SerialNumber: syz [ 388.147803][ T5951] warning: `syz.3.31' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 389.184338][ T5836] rtl8150 2-1:1.0: couldn't reset the device [ 389.184562][ T5836] rtl8150 2-1:1.0: probe with driver rtl8150 failed with error -5 [ 389.237393][ T5957] netlink: 144 bytes leftover after parsing attributes in process `syz.1.32'. [ 389.791508][ T5958] Cannot find add_set index 2 as target [ 389.967729][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 390.183350][ T5836] usb 2-1: USB disconnect, device number 2 [ 390.577586][ T30] audit: type=1400 audit(1789819692.188:202): avc: denied { map } for pid=5960 comm="syz.4.33" path="/5/proc/18/net/afs/cells" dev="proc" ino=4026533500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 391.637559][ T5967] netlink: 144 bytes leftover after parsing attributes in process `syz.0.30'. [ 392.527747][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 392.665025][ T30] audit: type=1400 audit(1789819694.278:203): avc: denied { read } for pid=5970 comm="syz.3.38" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 392.665306][ T30] audit: type=1400 audit(1789819694.278:204): avc: denied { open } for pid=5970 comm="syz.3.38" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 392.714675][ T30] audit: type=1400 audit(1789819694.298:205): avc: denied { ioctl } for pid=5970 comm="syz.3.38" path="socket:[8931]" dev="sockfs" ino=8931 ioctlcmd=0x4d04 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 392.768250][ T30] audit: type=1400 audit(1789819694.378:206): avc: denied { read write } for pid=5970 comm="syz.3.38" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 392.769708][ T30] audit: type=1400 audit(1789819694.388:207): avc: denied { open } for pid=5970 comm="syz.3.38" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 392.862221][ T30] audit: type=1400 audit(1789819694.468:208): avc: denied { connect } for pid=5970 comm="syz.3.38" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 392.863630][ T5972] netlink: 4 bytes leftover after parsing attributes in process `syz.3.38'. [ 392.863911][ T5972] bridge_slave_1: left allmulticast mode [ 392.863937][ T5972] bridge_slave_1: left promiscuous mode [ 392.865443][ T5972] bridge0: port 2(bridge_slave_1) entered disabled state [ 393.077703][ T5972] bridge_slave_0: left allmulticast mode [ 393.077731][ T5972] bridge_slave_0: left promiscuous mode [ 393.078460][ T5972] bridge0: port 1(bridge_slave_0) entered disabled state [ 393.902989][ T52] Bluetooth: hci4: Unable to find connection for big 0x00 [ 394.196450][ T30] audit: type=1400 audit(1789819695.808:209): avc: denied { mmap_zero } for pid=5979 comm="syz.3.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 394.568387][ T5984] netlink: 144 bytes leftover after parsing attributes in process `syz.4.37'. [ 395.114494][ T5985] Cannot find add_set index 2 as target [ 395.918062][ T52] Bluetooth: hci2: Unable to find connection for big 0x00 [ 397.008768][ T30] audit: type=1400 audit(1789819698.628:210): avc: denied { ioctl } for pid=5993 comm="syz.0.39" path="socket:[9305]" dev="sockfs" ino=9305 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 397.046407][ T30] audit: type=1400 audit(1789819698.638:211): avc: denied { bind } for pid=5993 comm="syz.0.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 397.046463][ T30] audit: type=1400 audit(1789819698.638:212): avc: denied { connect } for pid=5993 comm="syz.0.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 397.046498][ T30] audit: type=1400 audit(1789819698.638:213): avc: denied { write } for pid=5993 comm="syz.0.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 397.303038][ T30] audit: type=1400 audit(1789819698.918:214): avc: denied { append } for pid=5993 comm="syz.0.39" name="video1" dev="devtmpfs" ino=930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 397.304715][ T30] audit: type=1400 audit(1789819698.918:215): avc: denied { open } for pid=5993 comm="syz.0.39" path="/dev/video1" dev="devtmpfs" ino=930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 397.343561][ T30] audit: type=1400 audit(1789819698.958:216): avc: denied { create } for pid=5993 comm="syz.0.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 399.507545][ T30] audit: type=1400 audit(1789819701.118:217): avc: denied { read write } for pid=6007 comm="syz.1.45" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 399.532896][ T30] audit: type=1400 audit(1789819701.128:218): avc: denied { open } for pid=6007 comm="syz.1.45" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 399.594567][ T30] audit: type=1400 audit(1789819701.208:219): avc: denied { read write } for pid=6007 comm="syz.1.45" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 399.599780][ T6012] CacheFiles: Empty directory specified [ 399.603464][ T6012] ======================================================= [ 399.603464][ T6012] WARNING: The mand mount option has been deprecated and [ 399.603464][ T6012] and is ignored by this kernel. Remove the mand [ 399.603464][ T6012] option from the mount to silence this warning. [ 399.603464][ T6012] ======================================================= [ 399.815686][ T6014] netlink: 144 bytes leftover after parsing attributes in process `syz.0.47'. [ 400.617860][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 401.137549][ T6020] Zero length message leads to an empty skb [ 401.835483][ T6024] netlink: 144 bytes leftover after parsing attributes in process `syz.1.51'. [ 402.407669][ T6027] Cannot find add_set index 2 as target [ 402.716107][ T5771] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 402.947312][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 402.947335][ T30] audit: type=1400 audit(1789819704.558:225): avc: denied { ioctl } for pid=6028 comm="syz.3.46" path="/dev/vhost-net" dev="devtmpfs" ino=1271 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 403.012852][ T5771] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 403.066516][ T5771] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.066546][ T5771] usb 5-1: Product: syz [ 403.066608][ T5771] usb 5-1: Manufacturer: syz [ 403.066642][ T5771] usb 5-1: SerialNumber: syz [ 404.896296][ T5771] rtl8150 5-1:1.0: couldn't reset the device [ 404.896424][ T5771] rtl8150 5-1:1.0: probe with driver rtl8150 failed with error -5 [ 405.026614][ T52] Bluetooth: hci1: Unable to find connection for big 0x00 [ 405.348192][ T30] audit: type=1400 audit(1789819706.968:226): avc: denied { mount } for pid=6044 comm="syz.0.55" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 405.353163][ T30] audit: type=1400 audit(1789819706.968:227): avc: denied { setopt } for pid=6044 comm="syz.0.55" lport=257 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 405.353823][ T30] audit: type=1400 audit(1789819706.968:228): avc: denied { read } for pid=6044 comm="syz.0.55" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 405.354141][ T30] audit: type=1400 audit(1789819706.968:229): avc: denied { open } for pid=6044 comm="syz.0.55" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 405.357302][ T30] audit: type=1400 audit(1789819706.968:230): avc: denied { create } for pid=6044 comm="syz.0.55" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 405.362136][ T30] audit: type=1400 audit(1789819706.978:231): avc: denied { write } for pid=6044 comm="syz.0.55" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 405.367027][ T6044] ima: policy update failed [ 405.367146][ T30] audit: type=1802 audit(1789819706.978:232): pid=6044 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=failed comm="syz.0.55" res=0 errno=0 [ 405.380636][ T30] audit: type=1400 audit(1789819707.008:233): avc: denied { unmount } for pid=5643 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 406.406063][ T5836] usb 5-1: USB disconnect, device number 3 [ 406.655518][ T6059] netlink: 144 bytes leftover after parsing attributes in process `syz.2.60'. [ 407.213201][ T6063] Cannot find add_set index 2 as target [ 407.624969][ T6065] netlink: 144 bytes leftover after parsing attributes in process `syz.1.52'. [ 408.185502][ T6068] Cannot find add_set index 2 as target [ 408.817794][ T5771] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 408.968391][ T5771] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 408.969338][ T5771] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.971487][ T5771] usb 5-1: config 0 descriptor?? [ 409.007975][ T5750] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 409.158494][ T5750] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 409.159447][ T5750] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 409.159488][ T5750] usb 4-1: config 0 has no interface number 0 [ 409.159520][ T5750] usb 4-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 409.160889][ T5750] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 409.160911][ T5750] usb 4-1: Product: syz [ 409.160925][ T5750] usb 4-1: SerialNumber: syz [ 409.165475][ T5750] usb 4-1: config 0 descriptor?? [ 409.227445][ T5771] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 409.251022][ T5750] usbhid 4-1:0.8: couldn't find an input interrupt endpoint [ 409.295432][ T30] audit: type=1400 audit(1789819710.908:234): avc: denied { mount } for pid=6075 comm="syz.1.64" name="/" dev="configfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 409.296337][ T30] audit: type=1400 audit(1789819710.908:235): avc: denied { search } for pid=6075 comm="syz.1.64" name="/" dev="configfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 409.296532][ T30] audit: type=1400 audit(1789819710.908:236): avc: denied { search } for pid=6075 comm="syz.1.64" name="usb_gadget" dev="configfs" ino=171 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 409.298165][ T30] audit: type=1400 audit(1789819710.908:237): avc: denied { write search } for pid=6075 comm="syz.1.64" name="usb_gadget" dev="configfs" ino=171 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 409.301619][ T6078] netlink: 144 bytes leftover after parsing attributes in process `syz.2.63'. [ 409.957387][ T6080] Cannot find add_set index 2 as target [ 410.434718][ T30] audit: type=1400 audit(1789819712.048:238): avc: denied { add_name } for pid=6075 comm="syz.1.64" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 410.435044][ T30] audit: type=1400 audit(1789819712.048:239): avc: denied { create } for pid=6075 comm="syz.1.64" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 410.475038][ T984] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 410.509539][ T5771] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 1 [ 410.509564][ T5771] [drm] Initialized udl on minor 1 [ 410.526362][ T30] audit: type=1400 audit(1789819712.138:240): avc: denied { unmount } for pid=5660 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 410.612242][ T52] Bluetooth: hci4: Unable to find connection for big 0x00 [ 410.626030][ T30] audit: type=1400 audit(1789819712.238:241): avc: denied { write } for pid=6060 comm="syz.4.61" name="event2" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 410.626358][ T30] audit: type=1400 audit(1789819712.238:242): avc: denied { open } for pid=6060 comm="syz.4.61" path="/dev/input/event2" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 410.630356][ T984] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 410.631839][ T984] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.635497][ T984] usb 1-1: config 0 descriptor?? [ 410.640659][ T30] audit: type=1400 audit(1789819712.258:243): avc: denied { ioctl } for pid=6060 comm="syz.4.61" path="/dev/input/event2" dev="devtmpfs" ino=921 ioctlcmd=0x4518 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 410.678475][ T5771] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 410.735952][ T5771] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 410.750652][ T5750] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 410.768582][ T5750] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 410.772201][ T5750] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 410.772592][ T5771] usb 5-1: USB disconnect, device number 4 [ 410.845946][ T984] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 411.612857][ T984] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 2 [ 411.612874][ T984] [drm] Initialized udl on minor 2 [ 411.647921][ T984] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 411.648240][ T984] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 411.652019][ T44] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 411.652624][ T44] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 411.652798][ T44] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 411.654383][ T984] usb 1-1: USB disconnect, device number 3 [ 411.805479][ T6092] netlink: 'syz.2.66': attribute type 4 has an invalid length. [ 411.805664][ T6092] netlink: 17 bytes leftover after parsing attributes in process `syz.2.66'. [ 412.203097][ T6097] netlink: 4 bytes leftover after parsing attributes in process `syz.2.69'. [ 412.247464][ T6097] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 412.247475][ T6097] overlayfs: missing 'lowerdir' [ 413.025649][ T6107] smbdirect: ib_dev[syz5]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 413.025696][ T6107] smbdirect: ib_dev[syz5]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 413.025741][ T6107] smbdirect: ib_dev[syz5]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 413.037111][ T6107] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 413.220363][ T5771] usb 4-1: USB disconnect, device number 2 [ 413.379207][ T6107] infiniband syz5: RDMA CMA: cma_listen_on_dev, error -98 [ 413.408330][ T6112] netlink: 144 bytes leftover after parsing attributes in process `syz.4.73'. [ 414.404361][ T6119] netlink: 4 bytes leftover after parsing attributes in process `syz.3.76'. [ 417.106968][ T6129] netlink: 144 bytes leftover after parsing attributes in process `syz.0.79'. [ 419.136563][ T52] Bluetooth: hci2: Unable to find connection for big 0x00 [ 421.197164][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 421.197182][ T30] audit: type=1400 audit(1789819722.808:254): avc: denied { write } for pid=6148 comm="syz.4.77" name="idProduct" dev="configfs" ino=9203 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 421.233783][ T30] audit: type=1400 audit(1789819722.848:255): avc: denied { open } for pid=6148 comm="syz.4.77" path="/12/config/usb_gadget/g1/idProduct" dev="configfs" ino=9203 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 421.265767][ T30] audit: type=1400 audit(1789819722.878:256): avc: denied { write } for pid=6148 comm="syz.4.77" name="strings" dev="configfs" ino=9401 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 421.365078][ T30] audit: type=1400 audit(1789819722.978:257): avc: denied { write } for pid=6148 comm="syz.4.77" name="configs" dev="configfs" ino=9400 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 421.384176][ T30] audit: type=1400 audit(1789819722.998:258): avc: denied { write } for pid=6148 comm="syz.4.77" name="functions" dev="configfs" ino=9399 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 421.462174][ T30] audit: type=1400 audit(1789819723.078:259): avc: denied { write } for pid=6148 comm="syz.4.77" name="c.1" dev="configfs" ino=9209 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 421.462478][ T30] audit: type=1400 audit(1789819723.078:260): avc: denied { create } for pid=6148 comm="syz.4.77" name="hid.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 421.463245][ T30] audit: type=1400 audit(1789819723.078:261): avc: denied { write } for pid=6148 comm="syz.4.77" name="c.1" dev="configfs" ino=9209 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 421.630658][ T6155] netlink: 'syz.0.80': attribute type 4 has an invalid length. [ 421.630709][ T6155] netlink: 17 bytes leftover after parsing attributes in process `syz.0.80'. [ 421.918002][ T5750] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 421.954553][ T30] audit: type=1400 audit(1789819723.568:262): avc: denied { mount } for pid=6157 comm="syz.3.81" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 421.955306][ T30] audit: type=1400 audit(1789819723.568:263): avc: denied { read write } for pid=6157 comm="syz.3.81" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 421.957589][ T6158] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 421.957603][ T6158] overlayfs: missing 'lowerdir' [ 422.098287][ T5750] usb 1-1: New USB device found, idVendor=0000, idProduct=0104, bcdDevice= 7.03 [ 422.098864][ T5750] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 422.099931][ T5750] usb 1-1: Dual-Role OTG device on HNP port [ 422.100171][ T5750] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.100190][ T5750] usb 1-1: Product: HID Gadget [ 422.100205][ T5750] usb 1-1: SerialNumber: 0123456789 [ 422.129104][ T6161] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 422.162070][ C0] ------------[ cut here ]------------ [ 422.162083][ C0] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0 [ 422.162098][ C0] WARNING: drivers/usb/gadget/udc/core.c:124 at usb_ep_enable+0x3e6/0x490, CPU#0: kworker/0:5/5750 [ 422.184807][ C0] Modules linked in: [ 422.188707][ C0] CPU: 0 UID: 0 PID: 5750 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) [ 422.198081][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 422.208147][ C0] Workqueue: usb_hub_wq hub_event [ 422.213283][ C0] RIP: 0010:usb_ep_enable+0x3f8/0x490 [ 422.218678][ C0] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d fa 2e 74 09 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 c0 11 da 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 60 04 da 8c [ 422.238298][ C0] RSP: 0018:ffffc90000007a00 EFLAGS: 00010046 [ 422.244376][ C0] RAX: dffffc0000000000 RBX: ffff88802a76c0e0 RCX: ffffffff8cda4860 [ 422.252357][ C0] RDX: 0000000000000081 RSI: ffffffff8cda11c0 RDI: ffffffff9152a2b0 [ 422.260328][ C0] RBP: 0000000000000081 R08: ffffffff8cda04a0 R09: 0000000000000000 [ 422.268305][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8cda04a0 [ 422.276284][ C0] R13: 0000000000000000 R14: ffff88802a76c0e0 R15: ffff888031dbe918 [ 422.282448][ T6161] Set syz0 is full, maxelem 0 reached [ 422.289615][ C0] FS: 0000000000000000(0000) GS:ffff888123b56000(0000) knlGS:0000000000000000 [ 422.298558][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 422.305156][ C0] CR2: 00007f274dffc184 CR3: 00000000738f2000 CR4: 00000000003526f0 [ 422.313140][ C0] Call Trace: [ 422.316449][ C0] [ 422.319293][ C0] hidg_set_alt+0x190/0xa10 [ 422.323807][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 422.329027][ C0] ? rcu_is_watching+0x13/0xc0 [ 422.333811][ C0] composite_setup+0x2ccf/0x9290 [ 422.338754][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 422.343708][ C0] ? __pfx_composite_setup+0x10/0x10 [ 422.348987][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 422.354373][ C0] ? do_raw_spin_lock+0x128/0x260 [ 422.359407][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 422.364829][ C0] ? configfs_composite_setup+0xfb/0x130 [ 422.370473][ C0] configfs_composite_setup+0xfb/0x130 [ 422.375937][ C0] dummy_timer+0x2039/0x3700 [ 422.380538][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 422.386352][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 422.391995][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 422.396934][ C0] ? mark_held_locks+0x40/0x70 [ 422.401700][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 422.407516][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 422.412461][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 422.417679][ C0] hrtimer_run_softirq+0x1ca/0x360 [ 422.422832][ C0] handle_softirqs+0x1e6/0x9d0 [ 422.427612][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 422.432906][ C0] ? _raw_spin_unlock+0x28/0x50 [ 422.437769][ C0] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 422.443421][ C0] __irq_exit_rcu+0x16a/0x210 [ 422.448109][ C0] irq_exit_rcu+0x9/0x30 [ 422.452362][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 422.458022][ C0] [ 422.460952][ C0] [ 422.463884][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 422.469875][ C0] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 [ 422.475721][ C0] Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 ba 1a 13 f6 48 89 df e8 42 71 13 f6 e8 8d 3c 40 f6 fb bf 01 00 00 00 a2 67 02 f6 65 48 83 3d 81 65 b8 08 00 74 06 5b c3 cc cc cc cc [ 422.495344][ C0] RSP: 0018:ffffc90004be6f48 EFLAGS: 00000202 [ 422.497710][ T984] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 422.508858][ C0] RAX: 000000000000ab7f RBX: ffff8880b843ae40 RCX: 0000000000000040 [ 422.516855][ C0] RDX: 0000000000000001 RSI: ffffffff8e38c97b RDI: 0000000000000001 [ 422.524832][ C0] RBP: 1ffff9200097cdeb R08: 0000000000000001 R09: 0000000000000000 [ 422.532815][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880b843ae40 [ 422.540777][ C0] R13: 0000000000000001 R14: ffff88802c50cb00 R15: dffffc0000000000 [ 422.548746][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 422.553938][ C0] wq_worker_sleeping+0x276/0x2d0 [ 422.558949][ C0] ? __pfx_wq_worker_sleeping+0x10/0x10 [ 422.564495][ C0] schedule+0x244/0x2c0 [ 422.568637][ C0] schedule_timeout+0x127/0x280 [ 422.573475][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 422.578833][ C0] ? __pfx_process_timeout+0x10/0x10 [ 422.584116][ C0] ? mark_held_locks+0x40/0x70 [ 422.588881][ C0] __wait_for_common+0x2e7/0x4c0 [ 422.593809][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 422.599167][ C0] ? __pfx___wait_for_common+0x10/0x10 [ 422.604624][ C0] usb_start_wait_urb+0x2ae/0x580 [ 422.609640][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 422.615179][ C0] ? __asan_memset+0x23/0x50 [ 422.619754][ C0] usb_control_msg+0x328/0x4b0 [ 422.624506][ C0] ? __pfx_usb_control_msg+0x10/0x10 [ 422.629868][ C0] usb_control_msg_send+0xca/0x130 [ 422.634970][ C0] usb_set_configuration+0xb8f/0x1c60 [ 422.640346][ C0] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 422.646399][ C0] usb_generic_driver_probe+0xa1/0xe0 [ 422.651758][ C0] usb_probe_device+0xef/0x400 [ 422.656508][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 422.661868][ C0] really_probe+0x241/0xa60 [ 422.666360][ C0] __driver_probe_device+0x210/0x460 [ 422.671639][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 422.677435][ C0] driver_probe_device+0x4a/0x140 [ 422.682445][ C0] __device_attach_driver+0x1df/0x320 [ 422.687803][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 422.693682][ C0] bus_for_each_drv+0x159/0x1e0 [ 422.698522][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 422.703887][ C0] ? lockdep_hardirqs_on+0x7d/0x110 [ 422.709075][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 422.714872][ C0] __device_attach+0x1e4/0x4d0 [ 422.719623][ C0] ? __pfx___device_attach+0x10/0x10 [ 422.724896][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 422.730090][ C0] device_initial_probe+0xaf/0xd0 [ 422.735105][ C0] bus_probe_device+0x64/0x160 [ 422.739865][ C0] device_add+0x121d/0x1970 [ 422.744361][ C0] ? __pfx_device_add+0x10/0x10 [ 422.749200][ C0] ? add_device_randomness+0xc9/0x110 [ 422.754568][ C0] usb_new_device.part.0+0xcc2/0x1686 [ 422.759945][ C0] ? __pfx_usb_new_device.part.0+0x10/0x10 [ 422.765746][ C0] ? mark_held_locks+0x40/0x70 [ 422.770497][ C0] hub_event.cold+0x1e3/0xe90 [ 422.775180][ C0] ? __pfx_hub_event+0x10/0x10 [ 422.779943][ C0] ? lockdep_count_backward_deps+0x1b0/0x200 [ 422.785911][ C0] ? lock_acquire+0x1d1/0x380 [ 422.790568][ C0] ? process_one_work+0xa2c/0x1b10 [ 422.795676][ C0] ? process_one_work+0x906/0x1b10 [ 422.800777][ C0] ? process_one_work+0x906/0x1b10 [ 422.805893][ C0] process_one_work+0xac7/0x1b10 [ 422.810826][ C0] ? __pfx_process_one_work+0x10/0x10 [ 422.816188][ C0] ? lock_acquire+0x1d1/0x380 [ 422.820851][ C0] ? __pfx_hub_event+0x10/0x10 [ 422.825607][ C0] worker_thread+0x5ef/0xe50 [ 422.830193][ C0] ? __pfx_worker_thread+0x10/0x10 [ 422.835317][ C0] ? kthread+0x13a/0x450 [ 422.839559][ C0] ? __pfx_worker_thread+0x10/0x10 [ 422.844660][ C0] kthread+0x373/0x450 [ 422.848722][ C0] ? __pfx_kthread+0x10/0x10 [ 422.853303][ C0] ret_from_fork+0x730/0xd60 [ 422.857878][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 422.862984][ C0] ? __switch_to+0x800/0x10f0 [ 422.867649][ C0] ? __pfx_kthread+0x10/0x10 [ 422.872246][ C0] ret_from_fork_asm+0x1a/0x30 [ 422.877005][ C0] [ 422.880008][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 422.887267][ C0] CPU: 0 UID: 0 PID: 5750 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) [ 422.896616][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 422.906653][ C0] Workqueue: usb_hub_wq hub_event [ 422.911670][ C0] Call Trace: [ 422.914929][ C0] [ 422.917760][ C0] dump_stack_lvl+0x100/0x190 [ 422.922427][ C0] vpanic+0x553/0x970 [ 422.926390][ C0] ? __pfx_vpanic+0x10/0x10 [ 422.930881][ C0] panic+0xd1/0xe0 [ 422.934585][ C0] ? __pfx_panic+0x10/0x10 [ 422.938992][ C0] check_panic_on_warn.cold+0x19/0x34 [ 422.944351][ C0] ? usb_ep_enable+0x3e6/0x490 [ 422.949105][ C0] __warn.cold+0x191/0x318 [ 422.953520][ C0] __report_bug+0x30f/0x440 [ 422.958015][ C0] ? usb_ep_enable+0x3e6/0x490 [ 422.962772][ C0] ? __pfx___report_bug+0x10/0x10 [ 422.967783][ C0] ? try_to_wake_up+0x158/0x1c90 [ 422.972725][ C0] report_bug_entry+0xe2/0x290 [ 422.977482][ C0] ? usb_ep_enable+0x3f8/0x490 [ 422.982233][ C0] handle_bug+0x1cd/0x2a0 [ 422.986545][ C0] exc_invalid_op+0x17/0x50 [ 422.991029][ C0] asm_exc_invalid_op+0x1a/0x20 [ 422.995866][ C0] RIP: 0010:usb_ep_enable+0x3f8/0x490 [ 423.001231][ C0] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d fa 2e 74 09 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 c0 11 da 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 60 04 da 8c [ 423.020819][ C0] RSP: 0018:ffffc90000007a00 EFLAGS: 00010046 [ 423.026873][ C0] RAX: dffffc0000000000 RBX: ffff88802a76c0e0 RCX: ffffffff8cda4860 [ 423.034835][ C0] RDX: 0000000000000081 RSI: ffffffff8cda11c0 RDI: ffffffff9152a2b0 [ 423.042788][ C0] RBP: 0000000000000081 R08: ffffffff8cda04a0 R09: 0000000000000000 [ 423.050739][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8cda04a0 [ 423.058693][ C0] R13: 0000000000000000 R14: ffff88802a76c0e0 R15: ffff888031dbe918 [ 423.066659][ C0] hidg_set_alt+0x190/0xa10 [ 423.071145][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 423.076592][ C0] ? rcu_is_watching+0x13/0xc0 [ 423.081436][ C0] composite_setup+0x2ccf/0x9290 [ 423.086355][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 423.091307][ C0] ? __pfx_composite_setup+0x10/0x10 [ 423.096581][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 423.101940][ C0] ? do_raw_spin_lock+0x128/0x260 [ 423.106970][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 423.112333][ C0] ? configfs_composite_setup+0xfb/0x130 [ 423.117953][ C0] configfs_composite_setup+0xfb/0x130 [ 423.123420][ C0] dummy_timer+0x2039/0x3700 [ 423.128033][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 423.133831][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 423.139457][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 423.144402][ C0] ? mark_held_locks+0x40/0x70 [ 423.149151][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 423.154949][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 423.159867][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 423.165073][ C0] hrtimer_run_softirq+0x1ca/0x360 [ 423.170188][ C0] handle_softirqs+0x1e6/0x9d0 [ 423.174939][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 423.180217][ C0] ? _raw_spin_unlock+0x28/0x50 [ 423.185066][ C0] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 423.190691][ C0] __irq_exit_rcu+0x16a/0x210 [ 423.195361][ C0] irq_exit_rcu+0x9/0x30 [ 423.199588][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 423.205220][ C0] [ 423.208139][ C0] [ 423.211144][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 423.217112][ C0] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 [ 423.222910][ C0] Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 ba 1a 13 f6 48 89 df e8 42 71 13 f6 e8 8d 3c 40 f6 fb bf 01 00 00 00 a2 67 02 f6 65 48 83 3d 81 65 b8 08 00 74 06 5b c3 cc cc cc cc [ 423.242502][ C0] RSP: 0018:ffffc90004be6f48 EFLAGS: 00000202 [ 423.248556][ C0] RAX: 000000000000ab7f RBX: ffff8880b843ae40 RCX: 0000000000000040 [ 423.256523][ C0] RDX: 0000000000000001 RSI: ffffffff8e38c97b RDI: 0000000000000001 [ 423.264489][ C0] RBP: 1ffff9200097cdeb R08: 0000000000000001 R09: 0000000000000000 [ 423.272445][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880b843ae40 [ 423.280485][ C0] R13: 0000000000000001 R14: ffff88802c50cb00 R15: dffffc0000000000 [ 423.288468][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 423.293668][ C0] wq_worker_sleeping+0x276/0x2d0 [ 423.298685][ C0] ? __pfx_wq_worker_sleeping+0x10/0x10 [ 423.304225][ C0] schedule+0x244/0x2c0 [ 423.308368][ C0] schedule_timeout+0x127/0x280 [ 423.313211][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 423.318594][ C0] ? __pfx_process_timeout+0x10/0x10 [ 423.323878][ C0] ? mark_held_locks+0x40/0x70 [ 423.328630][ C0] __wait_for_common+0x2e7/0x4c0 [ 423.333561][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 423.338920][ C0] ? __pfx___wait_for_common+0x10/0x10 [ 423.344386][ C0] usb_start_wait_urb+0x2ae/0x580 [ 423.349404][ C0] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 423.354953][ C0] ? __asan_memset+0x23/0x50 [ 423.359547][ C0] usb_control_msg+0x328/0x4b0 [ 423.364312][ C0] ? __pfx_usb_control_msg+0x10/0x10 [ 423.369601][ C0] usb_control_msg_send+0xca/0x130 [ 423.374716][ C0] usb_set_configuration+0xb8f/0x1c60 [ 423.380093][ C0] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 423.386163][ C0] usb_generic_driver_probe+0xa1/0xe0 [ 423.391549][ C0] usb_probe_device+0xef/0x400 [ 423.396312][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 423.401694][ C0] really_probe+0x241/0xa60 [ 423.406191][ C0] __driver_probe_device+0x210/0x460 [ 423.411462][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 423.417262][ C0] driver_probe_device+0x4a/0x140 [ 423.422277][ C0] __device_attach_driver+0x1df/0x320 [ 423.427643][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 423.433524][ C0] bus_for_each_drv+0x159/0x1e0 [ 423.438374][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 423.443739][ C0] ? lockdep_hardirqs_on+0x7d/0x110 [ 423.448929][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 423.454744][ C0] __device_attach+0x1e4/0x4d0 [ 423.459523][ C0] ? __pfx___device_attach+0x10/0x10 [ 423.464810][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 423.470002][ C0] device_initial_probe+0xaf/0xd0 [ 423.475032][ C0] bus_probe_device+0x64/0x160 [ 423.479795][ C0] device_add+0x121d/0x1970 [ 423.484294][ C0] ? __pfx_device_add+0x10/0x10 [ 423.489145][ C0] ? add_device_randomness+0xc9/0x110 [ 423.494514][ C0] usb_new_device.part.0+0xcc2/0x1686 [ 423.499882][ C0] ? __pfx_usb_new_device.part.0+0x10/0x10 [ 423.505680][ C0] ? mark_held_locks+0x40/0x70 [ 423.510446][ C0] hub_event.cold+0x1e3/0xe90 [ 423.515130][ C0] ? __pfx_hub_event+0x10/0x10 [ 423.519896][ C0] ? lockdep_count_backward_deps+0x1b0/0x200 [ 423.525863][ C0] ? lock_acquire+0x1d1/0x380 [ 423.530522][ C0] ? process_one_work+0xa2c/0x1b10 [ 423.535641][ C0] ? process_one_work+0x906/0x1b10 [ 423.540745][ C0] ? process_one_work+0x906/0x1b10 [ 423.545854][ C0] process_one_work+0xac7/0x1b10 [ 423.550791][ C0] ? __pfx_process_one_work+0x10/0x10 [ 423.556168][ C0] ? lock_acquire+0x1d1/0x380 [ 423.560836][ C0] ? __pfx_hub_event+0x10/0x10 [ 423.565610][ C0] worker_thread+0x5ef/0xe50 [ 423.570213][ C0] ? __pfx_worker_thread+0x10/0x10 [ 423.575320][ C0] ? kthread+0x13a/0x450 [ 423.579552][ C0] ? __pfx_worker_thread+0x10/0x10 [ 423.584763][ C0] kthread+0x373/0x450 [ 423.588824][ C0] ? __pfx_kthread+0x10/0x10 [ 423.593405][ C0] ret_from_fork+0x730/0xd60 [ 423.597982][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 423.603092][ C0] ? __switch_to+0x800/0x10f0 [ 423.607762][ C0] ? __pfx_kthread+0x10/0x10 [ 423.612348][ C0] ret_from_fork_asm+0x1a/0x30 [ 423.617111][ C0] [ 423.620329][ C0] Kernel Offset: disabled [ 423.624631][ C0] Rebooting in 86400 seconds..