last executing test programs: 15.697353862s ago: executing program 0 (id=26): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x18, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x4}]}, 0x18}}, 0x8800) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x8, &(0x7f0000000540)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r2}, @map_fd={0x18, 0x3, 0x1, 0x0, r2}, @generic={0xbf, 0x4, 0xa}, @generic={0xb7, 0x5, 0x0, 0x0, 0x8}, @generic={0x85, 0x0, 0x0, 0x0, 0x19}, @generic={0x95}], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mount$afs(&(0x7f0000001080)=@cell={0x23, 'syz1:', 'syz1', '.readonly'}, &(0x7f0000001100)='./file0\x00', &(0x7f0000001140), 0x0, &(0x7f0000001180)={[{@flock_local}], [{@uid_gt={'uid>', 0xffffffffffffffff}}, {@measure}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000130000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x279, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r5, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@beacon, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x14a0}], @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x2}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x4000) socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) lseek(r7, 0x84e, 0x2) syz_usb_connect(0x0, 0x38, &(0x7f0000000000)=ANY=[@ANYBLOB="120110038121e940e60491553994010203010902260001000000000904000002e517bb000905040209000000000905880224"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) 13.956025828s ago: executing program 3 (id=29): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000018"], 0x44}}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c8, &(0x7f0000000100)) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c9, &(0x7f0000000100)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) syz_emit_ethernet(0x56, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_buf(r4, 0x1, 0x37, &(0x7f00000002c0)=""/80, &(0x7f0000000140)=0x50) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000040)='vegas', 0x5) write$binfmt_script(r4, &(0x7f0000000200), 0xfffffd9d) 12.570698526s ago: executing program 0 (id=31): r0 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) fsetxattr$security_evm(r1, &(0x7f0000000080), &(0x7f00000001c0)=@md5={0x1, "0a08e3078bd8565a3444fae0130a9596"}, 0x11, 0x3) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x2, 0x40, 0x7fff0000}]}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x8, [@ptr, @struct={0x0, 0x1, 0x0, 0x4, 0x1, 0x8, [{0x6, 0x1, 0x3}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x44, 0x0, 0x1}, 0x28) syz_emit_ethernet(0x2a, &(0x7f0000002600)=ANY=[@ANYBLOB="aaaa696b00c10d275f1e00000800450c001c000000020011907800000000000000004e234e2400089078"], 0x0) syz_emit_ethernet(0x32, &(0x7f0000000080)={@broadcast, @random="67eaa8fce250", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x2, 0x36, 0x24, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x4, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d000580090001007070747000000000200004801c0001"], 0xbc}}, 0x0) ptrace(0x10, r2) r4 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) fchdir(r5) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x89901) ptrace$peeksig(0x4209, r2, &(0x7f0000000000)={0xfffffffffffffffe, 0x1, 0x1}, &(0x7f0000000040)=[{}]) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) move_mount(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', r5, &(0x7f0000000380)='./file0\x00', 0x20) close(r5) rmdir(&(0x7f0000000640)='./file0\x00') r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) move_mount(r7, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x267) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r7, 0xc040564a, &(0x7f0000000040)={0x1ed, 0x0, 0x1015, 0xffffff01, 0x5, 0x8, 0x1}) ioctl$VIDIOC_S_STD(r0, 0x40085618, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000440)={0xc, [0x36, 0x6aa6, 0xfb, 0x1, 0x0, 0x3, 0x4, 0x81, 0x8, 0x833, 0x1, 0x4, 0x46, 0x6, 0xe2, 0x5, 0x3, 0x7, 0xd, 0x40, 0xf, 0x7ff, 0x1440, 0xac9, 0x5, 0x7, 0x1, 0x8, 0x3, 0x4, 0x4d8d, 0x9, 0x3, 0xfff7, 0x7, 0x8, 0x58, 0xa3, 0x5, 0x7fff, 0x7, 0x3a, 0x7, 0xfff7, 0x7, 0x6, 0xa8a, 0x1], 0x7}) 12.153344987s ago: executing program 0 (id=32): fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000300)) socket$packet(0x11, 0x3, 0x300) syz_io_uring_setup(0x8ce, 0x0, 0x0, &(0x7f0000000080), &(0x7f0000000280)) openat$dsp1(0xffffffffffffff9c, 0x0, 0x88a01, 0x0) writev(0xffffffffffffffff, &(0x7f0000000780)=[{&(0x7f00000003c0)="1dfd71d864192bb2e01c945aae35f1bd51ad8c64b9071fa0a870d49a6e01c42b5028df27c3af10b4ba540b149238d64aaca12eacdd5f6d824920e5f9f7adba3df8c68bd4ebac87aebc176fc3322970cc769cb6e9402c692bb1ae6d526f9a40d5ceca3d183e1b80623735b37406cb606a24721ff853cbd0fce590e88a4e4cb6ba6d06360afe3e0cb8cff746b72bbf8438477adaf0e89dcb2155c6eb102009587b99d48eddc10f8e821e38e56e1d7c9a5fbdfece64732d729b7acb350043d5ea", 0xbf}, {0x0}, {0x0}], 0x3) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) signalfd(r2, &(0x7f0000000340)={[0xabed2e56]}, 0x8) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x1000000}) r3 = io_uring_setup(0x694d, &(0x7f00000000c0)={0x0, 0x41f0b, 0x0, 0x2, 0x253}) io_uring_register$IORING_REGISTER_FILES(r3, 0x1e, 0x0, 0x0) syz_open_dev$sndmidi(0x0, 0xffffffff, 0x161902) socket(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000240)={0x0, 0x9e, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000002060102000034e40000000004000008050005000a000000050001000600000005000400000000000900020073797a310000000011000300686173683a69702c706f727400001f000c00078008000640"], 0x58}, 0x1, 0x0, 0x0, 0x81}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x5c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 11.161142582s ago: executing program 3 (id=34): r0 = open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6) io_setup(0x1006, &(0x7f0000000600)=0x0) r2 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000000)={0x0, 0x4, 0x0, 0x7, 0x0, r2, 0x0}]) write$FUSE_CREATE_OPEN(r0, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x0, 0x5, 0x7, 0x3, 0xfffffffd, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0x5, 0x7}}, {0x0, 0x13}}}, 0xa0) mknodat$null(0xffffffffffffff9c, 0x0, 0x0, 0x103) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x101841, &(0x7f0000000240)=ANY=[@ANYBLOB="67727071756f74612c7065726d69745f646972656374696f2c00cbee9c6be8eae6b91af650eb085be411f5b3df6a062a47669b11bef729731a5176c3145034eb2ac180c657df38251f4166702aae61084f641b67f381fddcb2ebef97108cc466f6d94e13752c215bc2c858f2195d5e3b1ff532cf5631d28a59e4a6ddc1b7d7ea06a91da869"]) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) syz_usb_connect(0x5, 0x24, 0x0, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000000)={&(0x7f0000000180)=[{0xa, 0x0, 0x0, 0x0}, {0x1, 0x4800, 0x0, 0x0}, {0x1, 0x8000, 0x0, 0x0}], 0x3}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') pread64(r5, &(0x7f0000001c00)=""/4108, 0x100c, 0x3) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='V\x00']) read$FUSE(r3, &(0x7f0000004340)={0x2020}, 0x2020) getxattr(&(0x7f0000005140)='./file0\x00', &(0x7f0000000040)=@known='system.posix_acl_access\x00', 0x0, 0x0) 10.090884916s ago: executing program 2 (id=36): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x34, &(0x7f0000000280)={{0x12, 0x1, 0x110, 0x2c, 0x21, 0x9f, 0x8, 0x421, 0x99, 0xcef2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x22, 0x1, 0x6, 0x3, 0x50, 0x8, "", [{{0x9, 0x4, 0x96, 0x1, 0x1, 0x2, 0x2, 0xff, 0x9, [], [{{0x9, 0x5, 0x7, 0x4, 0x10, 0x80, 0x81, 0xe9, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xff, 0x5}]}}]}}]}}]}}, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000140)='cgroup.max.descendants\x00', 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000008000000000000000000910095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r4 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r3, r3, 0x2f, 0x0, @void}, 0x10) pipe(&(0x7f0000000140)) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@bridge_newneigh={0x28, 0x1c, 0x401, 0x70bd2b, 0x25dfdbff, {0x7, 0x0, 0x0, r6, 0x80, 0x1e6, 0x5}, [@NDA_LLADDR={0xa, 0x2, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) close(0x3) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000220000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000000e00000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sched_cls=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000140)={r4, r7, 0x4, r3}, 0x10) write$cgroup_subtree(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB='-', @ANYRESHEX=r1], 0x27) syz_genetlink_get_family_id$nl802154(&(0x7f0000000e80), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000001600)={'wpan0\x00'}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x75, r8}, 0x38) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000003000000000000000240000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000e0000009500000000000000a0d3112b14a43ee491314fe5e1679aff33bb38dcf6f126254ac593974ae98c5fbd3908a8c9931d9767d53f85318751c401949116e6806f4df09b8b47784fb3be11e3d8b2134d730d70d1b965dcf0f0bbade6d6b8a01cd6866d18f85268e1f59d5e0df1309efd9b7e037bae0823baf4a1fdbba4c8cadd656682"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r9, r8}, 0xc) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES8=r9, @ANYBLOB="010025bd7000ffdbdf252100000008000300", @ANYRES32=r10], 0x48}, 0x1, 0x0, 0x0, 0x4811}, 0x0) 9.634340093s ago: executing program 0 (id=37): r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000300000004"], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1, 0x4, 0x7fe2, 0x1, 0x1, 0xffffffffffffffff, 0xfff}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000cc0)={r3}, 0xc) sendmsg$inet6(r0, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @empty, 0xfffffffb}, 0x1c, 0x0}, 0x3400c8d4) 9.466327408s ago: executing program 0 (id=38): r0 = syz_open_dev$dri(&(0x7f0000000000), 0xa, 0x400) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000001c0)={0xffeffffb, 0x0, 0xd}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c00000012009702caed68d399a24fb707", @ANYRES16=r1], 0x2c}}, 0x40000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8002, 0x1000000, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000b, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) set_mempolicy(0x4000, 0x0, 0x4) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/devices/usb2/power/level\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='au', 0x2) r3 = syz_open_dev$usbmon(&(0x7f0000000040), 0x4, 0x4000) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000a0000000000000006000000850000002f000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000010850000000600000095"], 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x34, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000180)=r6, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000005c0)={'bridge0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000240)="09000000e70014000000d97bfbf7", 0xe, 0x200000c4, &(0x7f0000000100)={0x11, 0x3, r7, 0x1, 0xc, 0x6, @broadcast}, 0x14) ioctl$MON_IOCQ_RING_SIZE(r3, 0x9205) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) open(&(0x7f0000000180)='./sys/bus/usb/devices/usb2/power/level\x00', 0x201, 0x20) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a300000000038000000030a010200000000000000000a0000000900030073797a32fc0000000b00070066696c74657200000c0002400000000000000001140000001100010000000000000000000000000a30c26e532baf601b8537bc5f2f466cb14be318abb67b7d87b6c2f96ae61aebd869ac9db4da4e40d231a94c6b614f2d87bab5749ad6e4"], 0x80}}, 0x0) 8.268730665s ago: executing program 1 (id=42): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000002c0)=0x1, 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) sendmmsg$inet(r1, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000240)="c8", 0x1}], 0x1}}], 0x1, 0x2400c042) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000540)=ANY=[@ANYRESOCT=r0, @ANYRESDEC=r0, @ANYRES16=r0, @ANYRES64=r1, @ANYBLOB="32e478668ca16ae6bb65e71d21c8fa7b4dbc61c8872e429e22bfe9c16811c29bce0932898f767a319d4606999b7536f2cf1e7ccf81a0958cc5c28129eb54f6578ababac82004e6d65d2f7a0e52225561b515bc50be3f1658ca9f5a2a370935bd47207aaeb65216d6c876ff8a2fa606e03ac31757ab90db3bffba7d139ac6199e7a008e9c4e108ee042f7bee02c5696a3aad8736f169b586f3635eb20bf0bdc7a0c77038c705aef3af5dcec827f03", @ANYRES32=r1, @ANYRES32=r2], &(0x7f00000002c0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd637f4b22667f2f00db5b686158bbcfe8875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000000)={'wlan1\x00', @random="f8ff00400400"}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_type(r3, &(0x7f0000000100), 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0xffffffffffffffff, 0x0) write$cgroup_type(r4, &(0x7f0000000280), 0x9) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x183001, 0x0) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) openat$cgroup_procs(r3, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) mremap(&(0x7f000016c000/0x4000)=nil, 0x4000, 0x40000000, 0x3, &(0x7f000063c000/0x3000)=nil) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x5, 0x0, 0x0) 8.180739825s ago: executing program 4 (id=43): openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x890b, &(0x7f0000000180)) 7.797594297s ago: executing program 1 (id=44): syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdir(&(0x7f0000000540)='./trace\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./trace\x00', &(0x7f0000000600)='tracefs\x00', 0x0, 0x0) openat(0xffffff9c, &(0x7f0000000640)='./trace/events/mac80211/enable\x00', 0x1, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r0, 0x3, 0x11, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) r4 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000000c00000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000000000b1f8306e05d1e4aab009c16b5c05077115d0749619ca39f89974785ae0619b77c6585f678ac92a3b6b4148f56b43c3dd75d75f97c8f92f60a2def458df05e2fbfb3e849b2b3cffd4f29446ae60dd76654b2639b2bc14350706214a6ab7a712d4317fbc3ca01d0d3ed6110b3775903141a5091a4d3db8eb335414fbdb288aba73aaf6d18000a3a2a069cf7f9402e1425bb6bc370576aa1faea0fe222671ecf99038fce8dba53dcb11f87cca"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)={@ifindex, r4, 0x11}, 0xa) 7.672248462s ago: executing program 4 (id=45): timer_create(0x0, &(0x7f0000000300)={0x0, 0x21, 0x2}, &(0x7f00000005c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0000001d00070f000000000000000007000000", @ANYRES32=r2, @ANYBLOB="00005200060005000100000008000800", @ANYBLOB='Rn'], 0x2c}, 0x1, 0x0, 0x0, 0x4008010}, 0x400c090) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000dc0)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1200000004000000040000001200000000000000", @ANYRES32, @ANYBLOB="0000000000e648f6a9f400"/22, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d80)={&(0x7f0000000600)=ANY=[@ANYBLOB], 0x0, 0x2e}, 0x28) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB="05"], 0x10) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r4}, &(0x7f0000000500), &(0x7f0000000540)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f0000000080)=r5}, 0x20) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000400)={r3, r4}, 0xc) r7 = fanotify_init(0x4, 0x101000) write$binfmt_elf64(r7, &(0x7f0000000dc0)=ANY=[], 0x40) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r6, &(0x7f0000000100)='$e', 0x2, 0x20008005, &(0x7f00000000c0)={0x2, 0x4e20}, 0x10) readv(r6, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/210, 0xd2}], 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x3, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000300000000000000fcffffff18010000786c6c2500000000002020207b1af8ff00000000bfa1000000000000070100000b914b7cf842f7b445caf8ffffffb702000008000001"], 0x0, 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff7}, 0x94) setns(0xc9, 0x0) r8 = socket(0x2a, 0x2, 0x9) bind$inet(r8, &(0x7f0000000180)={0x2a, 0x4e23, @empty=0x1000000}, 0x10) setsockopt$sock_int(r6, 0x1, 0xa, &(0x7f0000000140)=0x6, 0x4) recvfrom(r6, &(0x7f0000000300)=""/102, 0xfffffffffffffe30, 0x736, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, [@alu={0x7, 0x0, 0x3, 0x0, 0x0, 0x1, 0xfffffff5}]}, &(0x7f00000000c0)='syzkaller\x00', 0x7}, 0x94) 6.80290674s ago: executing program 1 (id=46): r0 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) fsetxattr$security_evm(r1, &(0x7f0000000080), &(0x7f00000001c0)=@md5={0x1, "0a08e3078bd8565a3444fae0130a9596"}, 0x11, 0x3) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x2, 0x40, 0x7fff0000}]}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x8, [@ptr, @struct={0x0, 0x1, 0x0, 0x4, 0x1, 0x8, [{0x6, 0x1, 0x3}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x44, 0x0, 0x1}, 0x28) syz_emit_ethernet(0x2a, &(0x7f0000002600)=ANY=[@ANYBLOB="aaaa696b00c10d275f1e00000800450c001c000000020011907800000000000000004e234e2400089078"], 0x0) syz_emit_ethernet(0x32, &(0x7f0000000080)={@broadcast, @random="67eaa8fce250", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x2, 0x36, 0x24, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x4, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) futimesat(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d000580090001007070747000000000200004801c0001"], 0xbc}}, 0x0) ptrace(0x10, 0x0) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x89901) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000000)={0xfffffffffffffffe, 0x1, 0x1}, &(0x7f0000000040)=[{}]) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) move_mount(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', r4, &(0x7f0000000380)='./file0\x00', 0x20) close(r4) rmdir(&(0x7f0000000640)='./file0\x00') r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) move_mount(r6, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x267) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r6, 0xc040564a, &(0x7f0000000040)={0x1ed, 0x0, 0x1015, 0xffffff01, 0x5, 0x8, 0x1}) ioctl$VIDIOC_S_STD(r0, 0x40085618, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000440)={0xc, [0x36, 0x6aa6, 0xfb, 0x1, 0x0, 0x3, 0x4, 0x81, 0x8, 0x833, 0x1, 0x4, 0x46, 0x6, 0xe2, 0x5, 0x3, 0x7, 0xd, 0x40, 0xf, 0x7ff, 0x1440, 0xac9, 0x5, 0x7, 0x1, 0x8, 0x3, 0x4, 0x4d8d, 0x9, 0x3, 0xfff7, 0x7, 0x8, 0x58, 0xa3, 0x5, 0x7fff, 0x7, 0x3a, 0x7, 0xfff7, 0x7, 0x6, 0xa8a, 0x1], 0x7}) 6.715479869s ago: executing program 3 (id=47): write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x1032}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000400)={'syzkaller0\x00', 0x1}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000000100000000000208004500003a0000000040117cb17f0000017f000001"], 0x48) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x3) accept4$bt_l2cap(r0, &(0x7f0000000200), 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) 6.617959906s ago: executing program 4 (id=48): connect$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x10cf, 0x5, 0x5, 0x2, 0x1, 'syz0\x00'}) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f00000000c0)={0x1bacf914c1bae12, &(0x7f0000002100)=[{@fixed}]}) r1 = socket$can_raw(0x1d, 0x3, 0x1) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r2, &(0x7f0000000240)={0x13, 0x10, 0x7, {0x0, r3, 0x2}}, 0x18) add_key$user(&(0x7f00000003c0), &(0x7f0000000180), &(0x7f00000000c0), 0x75, 0xfffffffffffffffd) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x33c, 0x2) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @local, 0x80000001}, 0x1c) ioctl$vim2m_VIDIOC_PREPARE_BUF(r4, 0xc058565d, &(0x7f0000000440)=@userptr={0x0, 0x2, 0x4, 0x408, 0x3, {}, {0x0, 0x1, 0x0, 0x0, 0xff, 0x14, "c4363c16"}, 0x7, 0x2, {0x0}, 0x7000000}) syz_usb_connect$hid(0x3, 0x0, 0x0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x4001}}]}) r6 = socket$vsock_stream(0x28, 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) setsockopt$sock_int(r6, 0x1, 0x12, &(0x7f0000000400)=0x55e, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000001c0)=@ipv4_newroute={0x42c, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_ENCAP_TYPE={0x6}, @RTA_ENCAP={0x408, 0x16, 0x0, 0x1, @SEG6_IPTUNNEL_SRH={0x404, 0x1, {{}, [@dev, @loopback, @private0, @ipv4={'\x00', '\xff\xff', @private}, @local, @mcast2, @empty, @mcast2, @local, @mcast1, @ipv4={'\x00', '\xff\xff', @multicast1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, @local, @remote, @ipv4={'\x00', '\xff\xff', @broadcast}, @mcast1, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0={0xfc, 0x0, '\x00', 0x1}, @remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, @private0, @remote, @loopback, @mcast2, @private0, @private2, @mcast2, @dev, @dev={0xfe, 0x80, '\x00', 0x37}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, @loopback, @local, @loopback, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, @mcast1, @empty, @local, @private1, @mcast1, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, @ipv4, @mcast2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @loopback, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @remote}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev]}}}]}, 0x42c}}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000000)={0x1, 'ip6erspan0\x00', {}, 0xffa9}) 6.513744544s ago: executing program 1 (id=49): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8c811}, 0x48054) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r3, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r3, 0x0, 0xffffffffffffffff, 0x1}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x202000, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0x2, 0x9}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r10 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r11, {0xffff, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xf4, 0x0, 0x4, 0xb, 0x3}, 0x31}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x884}, 0x40) r12 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r12, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r12, &(0x7f00000000c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, r11, 0x18}, 0x80, &(0x7f00000034c0)=[{&(0x7f00000001c0)="27030200dc0f14000e0005000024c1020000ff88125ce882cbf400930bf4533f", 0x20}, {&(0x7f00000022c0)="ffc9ace87aade11690dd52a158e0", 0xe}], 0x2}, 0x8000) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000080)={0x48, 0x7, r4, 0x0, 0x10000, 0x0, 0x8, 0xdc74, 0x3d4e17}) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000"], 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) 6.465017932s ago: executing program 2 (id=50): pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) r2 = eventfd2(0x7, 0x0) ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0x4) io_submit(r1, 0x3, &(0x7f0000000800)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xff45, r0, &(0x7f0000000340)="d100", 0x2, 0x6, 0x0, 0x5, r2}, 0x0, 0x0]) 5.669022352s ago: executing program 4 (id=51): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x141, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x200, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x25) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') symlink(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unlink(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x14) accept4(r2, &(0x7f0000000080)=@isdn, &(0x7f0000000180)=0x80, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f00000012c0)=""/102376, 0x18fe8) sched_setaffinity(r3, 0x8, &(0x7f0000000100)=0xffffffffffffffff) r5 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x61, &(0x7f00000004c0)={0x0, 0x3, 0x14, 0x3}, 0x8, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_REAPURB(r5, 0x4004550d, &(0x7f0000001080)) 5.666920696s ago: executing program 0 (id=52): socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x6, 0x0, &(0x7f0000000300)) r0 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe}, {0x9, 0x5, 0x2, 0x2, 0x200, 0xc, 0x77, 0x83}, {0x9, 0x5, 0x5, 0x3, 0x20, 0x0, 0x9, 0x32}}}}}}]}}, 0x0) r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="1201000001006704000000673f070102030109021200050000000009044fb4d0ad312a79f90daeda33305e5daf5dd8319b72e31a2488749759ae0193e4ea206a53d9ff0e9e6de1074bcc9b11decfa485a485df5048017a20a233052354b423f0c69ed1eb3235ace0f63081ff4589d2de2b0488fce11ca0e87c60a79b92f965777d03daf122fb252eb8a40cea4190431c4cb6b69eb33e234f57e74f0130988157ae267d6aeeccb2328c0747ceb0b06e3876c250ca37716c1558c2a5392725a99288da44625d3dad80409f8fa7e74dec02f1ed914238211a1c84a00ad1b17c600b568700136a7b31301ad01a93d4c035c5b708aa254286e32ef88af9e6fbf7e9a4654fb0787d7c13b2dbfc19fbb1eb4a7b951fcebe00cc62c343de43160f9b1fc4f8c56e4cef3573cb357b099ddf03ce843f76e02e65ee7d4842232624ff8ccc0d5efc0ba8b78e66091deffae2c358ea2a72be867884d78e789f637d1eeb3abce50afc33185150e2d1d7a4489d0f273f0d8528d486b1828ced5458ee6a7e3be7942f0633bedafc55cbcdc2d941a1"], 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000180)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=@bloom_filter={0x1e, 0xe604, 0x6b1, 0x5, 0x44000, r2, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x5, 0x8}, 0x50) bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r4, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r3, 0x0}]) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000b40)=ANY=[@ANYBLOB="0282000203000000000004000000e800"], 0xfffffffffffffe45}, 0x1, 0x7}, 0x4000000) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @flow_dissector=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) syz_clone3(&(0x7f0000001880)={0x100000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) r6 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000001d00070f000000000000000007000000", @ANYRES32=r8, @ANYBLOB="00005200060005000100000008000800", @ANYRES16=r8], 0x2c}}, 0x20008000) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r6, 0x0, 0x0) fchdir(r9) newfstatat(0xffffffffffffff9c, &(0x7f00000008c0)='./cgroup.cpu/memory.limit_in_bytes\x00', &(0x7f0000000b80), 0x400) syz_usb_control_io$sierra_net(r0, &(0x7f0000000280)={0x14, &(0x7f0000000380)=ANY=[@ANYBLOB="000a2a0000002a9b8ed5de98aa7b5f735377e41c43c793930e6aa355ba568562d4af63c5418ffb81060000006f16c8e2849542bc27d42c2a58d9613e8111935dcc12d8e8654fbe93"], &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x180c}}}, &(0x7f0000000880)={0x1c, &(0x7f00000002c0)=ANY=[@ANYBLOB="400b2f0000009a5d9944d913636202002a8f262aaff33b7bbd0ac429e9f2f0036a826aeb04f62c863e00"/53], &(0x7f0000000400)={0xa1, 0x1, 0x400, "839b7e3ab979126f26d7b032555261e09a1fccd8e4453638d46205da8127a90e23c50949bf90509e7b64753fb1bfd0ca41f68ea248d2be50f10af6256d0235a9a1d398c91cb78574e5d3dfa47e329233ec2722874ca14cc1ff394b2e891e3b098d2a5afe3e34812f33c01ee053bc4a98c2711bbbefeb4daaae5761134ed9ce36a79798ae5d3e95033f757e1e9583655eae5cf875cd834ff92e26d9964774e21b376b22a712615dd732db9011f10bcad2e64799dc6c0ef249fab20af7034e03571ce64865616b3d495e5995b600151cae9a233d72cc1130d79ed49fc2cdd8d3bc2fe2bdf6350f2e746b14b5df188db350b9b03243896223816f2fe8b3084aaad17f9903c458d3540cf0318111675f76f2db1bac035b8b4d9add86f61538a817ab66b2e396134856b1d367e12f7c2ec37f79eaf147c1f8807178eb25ebcd0ddb78c27aa9593b23cf9e5bc7b7171a4e22d0b2ff019e715f7729e7ad1ea6d46feea49ae2d018ba641127a63513f88066210036242cd818433f15a829761b52c11f7b88e6f90cc646988ac321cc587d38c3419c73e9e03002bd1b81964b29e2f77ada61afcf06ea681ac538ba95df75fce29856a297f51ec2deaed4ecee05e414830996ad7015e32fd0f0eced2f7e32a5cff65a59f41292a7f5bcc93af80af5322e0922a011b301a2f0c9826adae154655f6b20f7765a04a0b2834fc29a17b3d6f0789148abbbf1ffb8abf086f7cb84b27371e9cf73b254c0361a0f4d2241185136eceaa56f104464c748bb850c67af9641c850e4383b1c558abff5ea6096b756273dc165a947856e89f92df025fc07a89bedea55a9c4df829ccbfdafe2b952f32ca66c3139bb1883cf9e0098df73f8365088c466bbb55ef09ce68aab10941f297445c5406eeb6869e1bb791d6827db228c6171178941df84968994b946395ab2e26514353c0697b577a3ee603bc95b742a660284361ba836291aff83e81ffdb10570c2b0a1d52a9ff2126ff3cc42c12fac457bb269600130da7f484e007d5801dc768df207525028ab353248598e8d5b91dc651b16df37509c1ef05c002256378196d7439f88bc6277e55fdfd38c237ea8d6c02b2517c9e349b25efb7dfa1a870a90583135d41d910a9474a403235635ffd00f27183c22753c651d5b48d93f825371ab0ddb6d4b4bc9f5d3abc978236ba7e1edf3a932a9a8eff82815a42e46b1791a86ed1a0198348f8cfd7ec14a19c8e507c119359446651ead24f6ad181b10e1b63aa7fdcffeb5a16f4d6bdb8dc3e2a8ee2fb7882fe4e8da5aa69e093534b79b4fdb1b70c565af22f2504bd160887d83956516d3ae660edf5e500d060f394a19c549d29df080ba5ed04f127b69851fb13c94ef89b9196ab49a3be50f1f03e1aa352c74be2fa799bb9da115a67eb61b4278e977d238550e432ccc7e723b860736f2"}, &(0x7f0000000840)={0x21, 0x0, 0x2, 'GR'}}) 5.459478937s ago: executing program 3 (id=53): fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000300)) socket$packet(0x11, 0x3, 0x300) syz_io_uring_setup(0x8ce, 0x0, 0x0, &(0x7f0000000080), &(0x7f0000000280)) openat$dsp1(0xffffffffffffff9c, 0x0, 0x88a01, 0x0) writev(0xffffffffffffffff, &(0x7f0000000780)=[{&(0x7f00000003c0)="1dfd71d864192bb2e01c945aae35f1bd51ad8c64b9071fa0a870d49a6e01c42b5028df27c3af10b4ba540b149238d64aaca12eacdd5f6d824920e5f9f7adba3df8c68bd4ebac87aebc176fc3322970cc769cb6e9402c692bb1ae6d526f9a40d5ceca3d183e1b80623735b37406cb606a24721ff853cbd0fce590e88a4e4cb6ba6d06360afe3e0cb8cff746b72bbf8438477adaf0e89dcb2155c6eb102009587b99d48eddc10f8e821e38e56e1d7c9a5fbdfece64732d729b7acb350043d5ea", 0xbf}, {0x0}, {0x0}], 0x3) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) signalfd(r2, &(0x7f0000000340)={[0xabed2e56]}, 0x8) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x1000000}) r3 = io_uring_setup(0x694d, &(0x7f00000000c0)={0x0, 0x41f0b, 0x0, 0x2, 0x253}) io_uring_register$IORING_REGISTER_FILES(r3, 0x1e, 0x0, 0x0) syz_open_dev$sndmidi(0x0, 0xffffffff, 0x161902) socket(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000002060102000034e40000000004000008050005000a000000050001000600000005000400000000000900020073797a310000000011000300686173683a69702c706f727400001f000c00078008000640"], 0x58}, 0x1, 0x0, 0x0, 0x81}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x5c, 0x9, 0x6, 0x201, 0xffff0000, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 5.452873366s ago: executing program 2 (id=54): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0xf00, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000037000701f3fffffffedbd72501"], 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x8050) 3.813890734s ago: executing program 2 (id=55): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x129240, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000540)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0}) r4 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r1, 0x5452, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r4, &(0x7f0000000480)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xbc}}, 0x10) close(r4) setns(0xc9, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000002}) r5 = socket(0x8, 0x5, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r5, 0x400261f3, &(0x7f00000006c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f0000000100)={0x28, 0x0, r3, r6, 0x0, 0x0, 0xdead, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000600)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r1, 0x3ba0, &(0x7f0000000640)={0x48, 0xa, 0x0, 0x0, r7}) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) pipe2$9p(0x0, 0x84080) mount$9p_fd(0x0, 0x0, 0x0, 0x200080, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000600)={0xa}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) futex_waitv(&(0x7f0000000180)=[{0x0, &(0x7f0000000000), 0x2}], 0x1, 0x0, 0x0, 0x0) futex(&(0x7f0000000140)=0x2, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f00000002c0)={0x82, 0x2, r9}) ioctl$IOMMU_IOAS_MAP$PAGES(r8, 0x3b85, &(0x7f0000000400)={0x28, 0x2, r9, 0x0, &(0x7f00001f2000/0x2000)=nil, 0x2000, 0x1}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r9}) 3.71396046s ago: executing program 4 (id=56): socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x241, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\x96\xa7f\x9ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\x15n\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z\t\x00\x00\x00\x00\x00\x00\x00\x9b\x01\xf9t\xbb\x1er\x04\xdb\xd3\xcd\xfd\xbdnC\xec#]\xbf\xa2\xa2H\x86\x86[8\x05\xfe\xdc\x11\x04\xa1u\x81', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x111, 0x6}}, 0x20) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r1, 0x4236}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 3.306983937s ago: executing program 1 (id=57): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x3b, {0x0, "49bf563412efbeadde00b80100000048ba00010400000000004889024c89f8488902f4"}}, @nested_vmlaunch={0x12f, 0x18}, @code={0xa, 0x1b, {"49bf0000000000000000"}}, @nested_vmresume={0x130, 0x18}], 0xb6}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r6, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r6, 0x5001, 0x0) ioctl$SNDCTL_DSP_RESET(r6, 0x5000, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0x100000000000001) ioctl$KVM_RUN(r3, 0xae80, 0x0) r7 = syz_io_uring_setup(0x3ee8, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000540)=0x0, &(0x7f0000000240)=0x0, &(0x7f00000000c0)=0x0) r11 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r8, r9, r10, &(0x7f0000000280)=@IORING_OP_BIND=@ipv6={0x38, 0x0, 0x0, r11, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r7, 0x7c65, 0xa334, 0x5, 0x0, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0x1deadbeef123456) ioctl$FAT_IOCTL_GET_VOLUME_ID(r3, 0x80047213, &(0x7f0000000040)) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xffffffffffffffff) 1.814071795s ago: executing program 3 (id=58): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) r3 = eventfd2(0x7, 0x0) ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x4) io_submit(r2, 0x3, &(0x7f0000000800)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xff45, r1, &(0x7f0000000340)="d100", 0x2, 0x6, 0x0, 0x5, r3}, 0x0, 0x0]) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) 1.738097239s ago: executing program 2 (id=59): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1b0000001d00010000000000ffdbdf252d"], 0x1c}}, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x80800) setsockopt$sock_int(r4, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8) bpf$TOKEN_CREATE(0x24, &(0x7f0000000540)={0x0, r3}, 0x8) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000600)={&(0x7f0000000600)=ANY=[], 0x0, 0x37}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="0200000001"], 0x48) syz_emit_vhci(0x0, 0x14) r6 = socket$kcm(0xa, 0x2, 0x0) r7 = socket(0x2, 0x80002, 0x0) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000040)={0x84, @private=0xa010100, 0x4e22, 0x3, 'sh\x00', 0x8, 0x3, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010103, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x0, 0x6, 0x1}}, 0x44) sendmsg$sock(r6, &(0x7f0000000400)={&(0x7f0000000580)=@caif, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 1.217783081s ago: executing program 1 (id=60): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000063116100000000008510000002000000850000a0b13a6f0095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) fcntl$lock(r0, 0x7, &(0x7f0000001140)={0x1, 0x2, 0x6, 0x200}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {r2, 0x1c, 0x0, @in6={0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, '\x00', 0x13}, 0x7}}}, 0x90) socket$nl_route(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x4080) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000400), 0x82042, 0x0) r4 = syz_usb_connect(0x0, 0x36, &(0x7f0000000940)=ANY=[@ANYBLOB="12010000226aa140070ad0001310010203010902240001000000000904000002bd22f00009050303000000000009058aff92"], 0x0) syz_usb_control_io$cdc_ecm(r4, &(0x7f00000005c0)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r5, &(0x7f0000000000)=""/104, 0x68) close_range(r3, 0xffffffffffffffff, 0x0) openat$ttyprintk(0xffffff9c, 0x0, 0x240840, 0x0) ioctl$USERFAULTFD_IOC_NEW(0xffffffffffffffff, 0xaa00) ioctl$HIDIOCGFIELDINFO(0xffffffffffffffff, 0xc038480a, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB="180029dacaf266a66ff9b9440dc5816273a87170000200000007000000", @ANYRES32=r6], 0x18}, 0x1, 0x0, 0x0, 0x22004804}, 0x80c0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000540)=""/176) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x2, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r8, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fcntl$lock(r7, 0x26, &(0x7f0000000380)={0x0, 0x1, 0x101, 0x1}) 1.041465528s ago: executing program 3 (id=61): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth1_macvtap\x00', 0x0}) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2000, 0x103) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101081, 0x30) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$IPSET_CMD_SAVE(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x5c, 0x8, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x4) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r2, 0x0, 0x1, 0xa) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='nfsd\x00', 0x10, 0x0) syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @random="dedea3f675c1", @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "083ff2", 0x14, 0x6, 0x0, @remote, @mcast2, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) getpeername$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x70, 0x10, 0x401, 0xfffffffd, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x31943, 0x14008}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GENEVE_DF={0x5, 0xd, 0x5}, @IFLA_GENEVE_UDP_CSUM={0x5, 0x8, 0x1}, @IFLA_GENEVE_TOS={0x5, 0x4, 0xc6}, @IFLA_GENEVE_COLLECT_METADATA={0x4}, @IFLA_GENEVE_REMOTE={0x8, 0x2, @multicast1}]}}}, @IFLA_LINK_NETNSID={0x8, 0x25, 0x1}, @IFLA_MASTER={0x8, 0xa, r1}, @IFLA_WEIGHT={0x8, 0xf, 0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 35.764253ms ago: executing program 2 (id=62): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000646c6c2500000000002020207b1af8ff000000fb1278b671daff87aa17f4823000bfa100000000000007010000f8ffffffb70200000800000000850000009b000000850000007d0000009500000000000000935feeb80d99007e76207360ef31793a90af61f57b4c5380ba93f8e488c519e0028ad816a56f1d9449229520745b085e8ac50b1f5242d26d424edcc3a01c23be779d73da0600000000000000"], &(0x7f0000000580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000002c0)="d2ff03076003008cb89e08f088a8", 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000280)='dummy_udc.0\n', 0xc) userfaultfd(0x80801) r5 = eventfd2(0x8, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r6 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x6, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0xfff) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000600), 0x2008800, &(0x7f0000000640)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r7, &(0x7f0000002100)={0x2020, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r7, &(0x7f00000062c0)="23db5037805f177d136115e6a1a5903469af39c1fb9cb38215fe64cff9f2f0444a57e22b0cc5cb4f74c9792365400d9e1c68539ea5eff0a5ed0864814d39251bee8dfea69aa052d900bc0c792e1c9752b7d3a3222f6a1ad3e44c1f65617b128aea51911861ca36ba7c96b96b2fba0fdaa49ffb2612f3e81fe565327dd9965a60046442c9dcd0d552c6a00388be3b438a08883c7349761531880294ad9887db97d8c2f74921c57910cf1f5cc528e17bd5c3746b6202f26d621535aac5f7872c2cb3295e42524b5acb249b2d1ac1b53a4e31271decfca3fad2e2f740768adf00875c18cb7d115150f83ceb73f77a1f61f1666c2bb9f6bd9f0fb55b3a619446e32bae2a1d99aa49e5f3822e048f8be44b707f2db10d7916ec9a10a695d573d871cf24959c3d15e61344a68309d186956537c6ea8532fc2e1c7649f8409d8dcde4c8ee1530470ac9c870f9f1837574e444ba6addf5ddb2dec67c0e76df79f265b403818dddb4efc27c90985ed69a48b12056e548f9c99edf80d2b195d26acb1127661727a0600257f4b2546513d03930a0638a71bd3223e51fbb75c832ef737907f2f4d3f0505f431ea02783c798b5c4579c99961fb73dc623a0d99c1b306435464d413b537d42c6444851b36482597140b22fbc0ebc7e795b2f96739bf139f5823bc869ede547da4f394fa1b1787836095e1013264042e53d5006ea059d0488cb2f5ccd44b30d25ea53c2dda71d112d7d441dbfc9f8462c99c098b1958c80b237d83c32f2759c9a9c081d7d7666a477cfda59354309b09f2a8b9f6c3077b0df1e8d0c71ac07232de4f437107cb0eb9b47b2267efe31938a337cf11cadad72ced56895bb14763cca5bdadd245d801e829a1eb3bb4ed851a345918efd2dcf8d38f66badc773068e6a2ef59b2bb838abd8b043cf6ac54550f3fde1bbb9e761095e4b8ef1891757d376be1f778142610c0acbbfc697f51fbb7a1602ed46e82813c74f41ee2bae818174809f3692084bea7310ebec3d6166702ae62aad84313e19b4d145167185ea8d53cb21d099fb592d7d7f8bc305dd375b5c0cd73be44f49ff53cee220085d4706bbf50c6f63b02e7e805e8fa4c73046a57a8700886da29ea53e5a316e7b011c44a0f7be5cc5cb5641ba0069ff591eee18966c7f005ef40046a5fe2bf325b2545b009867761264aa9611d184fa372ba3c5c33d9a50717210f7cec7f6dc4418a87a797eb6aaf6ab3892bd3f559547c88d8c29646c8173fad1588f52beb34ff863be65e7ec1598cfb465f270bd5532fa7035aae077eedbc846058fa19f58ffb1cf0f1863f6d33f2e5c454d18b66be766ca369af2cc9656fa34c6c10e4d4da44ce5e2370aaf60c4e130da331d3489e8f44c600246323409fdd35d11da27128c9d64be65dd3a90c1546a6eb9185cb6d3a4a9cfad0e41ea03896fd2346f745eb3563d7a79fd345b037c040e56f0677840bf9b0d295bcfa98b931464c5ce9fcaf745720deac2d8b4edeffc0fe6f089ed7c3880959fcf8e31f7b7054bc4f5c9d3ed3f66c968d0bc20b2d66c374f030f3f1965f43a98519e527caf693362412d523eeb38c8b016ff77f78f833d7513e4b5a53d5ed5143916673f822ceac9967b8788bc6428283181eaf8d99e48286aacf4f658a903e9f08659450f7f9483807c2e013a1d9d199f18886a8cb4e14d41c71e5731455a4394551281eca12a1bb6ae717f5da2949175d0f1f3d718b761dfc1099c7d9d8928c899ac8e936e69d19fcbfcfdee83b68ef8e15eed41a8ac0d54aa92d7d2ee58bb4799f378225ec9ba4709e5ce2b77208ecc85c22c64967a9ef3360c54d311b8917ceb7b432c90cc5e98de9327c1400f8ec89261b1d77d8874b0bbdd2c5eb59df415705de52b08b0e12c07fb7367c6d461c19f282d51e482cb4fb9ceb0249ac2d6400ca170fbd6c0063224179c616bb030a5c10102aa2eea92f1e6f5828590b250b09e6d1a9535c298a68160b7c281fecdd295dc3396c4e6eb3395d5a677d5fa95a732dfdef81f4346545dd1a74bb3aa9b516699bdf0a59165077ab459a5ffe0dbb3ef8afa7a8382a8441e0c36ffabbed8f93f4bbeb97e5f6a704bf63a0de9ccf8fef643ebc530a80920931002003b027014de317c42f861d98ef4fef66d232d9706e6bd263347384dadadaa43a7e106bbb21bd822d468ace171b3f04b996112135b63dcbd612b5888ec40da583ab549c340ddaf5d7406c3e99322c68874214356c1fd9b5f84348e629cc3487a901d1b7a2fa531b1509ac1c93de3da9f1c3773e3a2aba2b29d2419f240ae6d24ed9f14bf0b9b0f1e740a2db06dab64d6386f950bff4e4c94160ef4b832bbde3af4937b7528658b5c16a51cb22193fe99385721ce5b048d9338e289dcb40683140c413eca52c8e4b64b306f47569477379c864cfb3aa3e349262407d3935ab9a0916eb0f6db2be71a7eb8f9968dfac44995d5bff8ef617fceeaa448f5e5f8d4b39e3512fe7ae9ee1d8a0d5912b6148969ab0325f3f76e2340fbd67ce156bdf638140b3ccdb08e5049db15957915cb05db8901249b10c59cc5c3ff836290e3334eee2df387e44c57b4d6198c3749f5dc57f6c3de115ced6b43cbddd762b58f1fb40b2baf3b381febdc073142e30d2e9a1a69e8d86314221e540f195509d223b206173dc5406865d8064817c30c284c034035a63190ab86df3bae4168c58e01d2251748fd5d9d610024129e83a5730fe83cf0918790e6854ab765c78649b91c06655f0cb9e26d8432df78bbadd99583b6a8afcf177ed6f339e08c0b36a16c6d31d8a24cb6f2bc3ba58d7711b6f8b988dc3e3144be619548457d4f40509f17eeb186cb93a2928ecb951593d1907c8bbb9f4c8999caba3059c8e73dce54ad6f87bcd51d559f7759902b14e68d3b845c0b179b38f4e6f0bd3a89cbcd5ebed9972102048647da1eda5c8456442369f4ae871d4037ba26f27d27371ce57e23adca5af8dc93f934f2ef8d69ad3b2db66657b3868dd839c2b522f5461f24407ef091b77242fc70a48b7eec45f3bcbcfbc6bdc36e4b67295020a345233a32a0a0af4d03a53ef67e69716d5ae35342722afbe7558946475a9ebf5b39c18558a0011f68bc8a78590b0cb63618379a512790c42d94bb239dd3ef5b8d1036cf0391aded8802a7a447c38f231ae611aeeab9bba44cd14369473758b64108d0bc9b6bc9e9b497c2d1d2acbae7c620a55c226cf371331688eaddec61fe961c5fcef71dad45820ed0ac8dc7641d82150f1318ac15aa41e7be585b6a50da1b3cd95239ee61cfde15aba80ae8ebc21ba4540883c6f44cd35b6b97da4640c97f5a2b6efa8d184fec823abc754ab8a0db6c45c2293e90d9c154c4a3e0b9ec2b6113ce6583b80f0d234dec9a9815067244733e2134b9ba93bb9692fb44200bb5501bb109f2401e8baaf0115d795bb0346dfafaf953bed8e9a52a5b9b02d490c55fd89daf311ad5e08b070a9571f696d6df4715c8b69b840e4e03d6f361326e20d9546c47b3a63163e7df9bd260621358c166177ee7c69ed63a8c43dd4a78543aa9f922c0ef527f4aa61ff65bb14595f518412ce25a1e103df89cd4b363593da16c11d80a23a9b5ad8e3a7be8f697cecf82c8fbd889a4f743c839b67f7ba5453b10bbf59b1e4f4e821872c061a4125c0c15c1ca5164efe61a58bb54dcedc849800a6021a448d4660c3b85e2362b7cd8ce95156fbf408a09a30a8ccfc3554004e9f9a35382907eec00617e2ae1f8803146bc8c28b4f3bf3c6b183ae9248e7f05c4adce3e0b7ff29252b5be9b19431e3fe612d471f52c5c34cc12c83049189f4d2e5ca516df78766ba3449d07ef9436c68052c986d9dde8802c931194e2ce34acb8cc26663a09348b15c6c145d26306bded0d1f482803ae6dee26562b03fcb183b69ee4a0491e8776ecdadfca395cb4eac2948d4d64321a4e669f2f663eb54f05f12ed9c685835c3e79f982152dbe701073b9a4ab2932b46ee2424a5e18bbe5f25ce0b898ff6937927f4670defe430ac86021226ae055daf39b535cdc0899fcc99d15e67d66bd2dd89bb21b8d2689a8af10a1b0bd44103c469922c36fc0228d7b6febf5e366dceecf8bb1db385c8ab95d86ff09b76c2fa6282de81fd6864c495a4c8295df61a2548e1b81c3e3f30d7a41216801d6c2d1743f66ae2055756083e8bf403d436b8244ac214f4d84a693d13f299ba267401d094f2df70840e8a980622794212f0992ecf5a47980ab2cf7d5a6f12b0a489af3c3c847ac59bc89f36fbb0e08bf283b68213a17de38b3a45eade6f0b198def408f7711c16367bcc0ded794a9a323c7e7f07fad96ea9c4d7344c26e43844a27c21076b8d7cd07677602d91eac825eb5fd0631755c2dd1dbf7bce3eb3c3f7377fc6080ecd0b894e29769845725943e25932d4249abb4ab78d4e2ff2e2df42c8d884cd6bd13886cef080c6491c217abae0eec6e9d4d49eab6657f15cfd38e6cd6d0bd33198c4685ab302d0f46e42f4a5d5bb7d2840a0a8817b98a856700d4de74351896fe7d7d5a0d1bc57fb4c828aa51f9637807aeb905780f239527ed4affd83f68be8b7ad1e10d9e797ba39cdee24f7be0a0ab0ac22ea3968dac61eb4bdd522c9ce570edf63a439abfd9954bf6a16c88d86157d05477200a83255cde279b454979cee4de00e81cb44acdc4295c877566a749ab5b91d250f03d46ecc14210c196700338eea028c930ce104f20a9e7fabb0ad1d314ec1a2d97d1d1b9e09114dee0e3e513eacede01971ff85dc98634156073df4e8acd6c3aadd615adaffa7a81573813bc4ca21886ddd532021bba5c84b34c34665534db48d61903a03c1cca4ed955ca92c1e33b7664b494e3db6d1e637a49e537808a2669ebeca301691acd4fab0af197b9c7db01b7862466b568ab3a4712a25210264fb297a6b679dfc3fceb65bddd1a23d5b507a0d6da83d73b716d971c5179a92e57b9b93451eb943845a549de737f2d082a83682c32649b4941e787758ead9d2c256b2b4ed1e0255952ce83cccecc39e5bbdd38490f1960b26e5379943be3d9a64b5149c84d577e5fd099560baa292befa06ce9065fb03ed432a9e055ca4ad0e952f8368b3d230fd5239726f79f4c98a0b4a9648382b245d324cb61049562f765f923fc657ef36747658494d78590a1e27a2d09856acf50c3b26271c6d5aa96e8ff9bdb9043859665e21ea53a050c335cac414bbf27b0328ac2c7450acb26b093bf232358afd1135ee50ac3fb26b5f0256ccdd37033c8a59740607cfd549d4c6540afe4a6b4425ae1f633872dcfb5da8d0547cf0c4888817b71fbc7c45b2a641e9c1a76b6a6be124402422ada35edc02ed997d6b87b361aee95a16d2c528d89a52fe40dfd83434969bd86f02e63fc1ae72941209af39a08cfbb4c320bc47d853f5dbaf0cd60ec54608aadbc382fa6b5cab3e9cac57bea26609f4c79f6a6b4eb4a9336fa95783b0c0c366f36d5d6b8310b3cfdb800207919a131bc7f984f7fa11fd0bf2c89e060e9d1286e453fe97363ef72bd6eba29a85ffeccdc3bee72e12284333a5a40622c01619558d2750fc45abfa22059ebdf743f8e50ad29770d19f84d8a34232d6918514769b3bb2a1ea5e59e9556332ba669675764458e9349a1835c501a93e91dd3b31018979880a9913f54ec1e8526b8cffcb776b97fbb9424faa5c5eb60d2ac74955bba4b5182571d0d9f84f0df1baa722b20a78c9c0011c667f688b58489c9e450d83e40ac5eb41c5564b6d76a226448abe4a3f499927074125aa9c0e7e704c36df5bb110a0f15f8433a470e81db414827d5ce21ca1da1c8d51d746d1e1ca110127c15e92afd75d3cd05ce0b632cfa03745de3cdd4b57373d46676583c89f045c26c6fc5793e5489555ced08f83ba351135834a2028113c319af30cc85bc01a7f8208822d7d607aed0d2e12c80aa009100441b75beaccfe0adbda7e8bb870edf4963158794c8c3a5baacf6eec7b5efaefb7602dab8409d161beeb281cba21f1da0ccdc092d0433fb940d79699ffeb87ea775829a6e7e3b308a2ee0b7aec8ac5f35eed61be374c7c77196f7119a8882deff68230f461cb917b0ccb2b8597efcbdd1003b7b77b2c601ebd4b45c35b8426f7b9138ab3df0ec00819604ab8e1e64cf2aa2282b1269585af127a268cd207f964edff172e555398a16df44bdc52889538c3a27f8fbfffb61f7aeb55b259952bbfea81d73058d8b0f78ece9dc08e660437d21d4e3ec38b19e5afda7a6e33023f9158db8a1c14dabd9b8b307ddc66927f7b19df5e0da2237d98ddd890b81f1963808977d02198e8ae2e97419dbb1f8e51cad36a3424b955500fbdaab6ff8dbf028708b1f951fe43864b59b6c2368b816c98023d4480a91b3f1059e9c214bf55a7f8c7da907f79ff5568fd787d3aa022ab9d03cde551f7e3295f02c4f3aa37e4cebdd968c0f82f09eb004fbdb1a4ef3a0d426691bde3964c29ea65622f5d3ffd854053545ba1ec164495e4bef4845439c058f9438d13be7922b656db499c246ee6176a15b97e6a68e42f0c703033b699504e1f92b43054c7237199bd013d96faab47433b6b3f91dc66368706439d4ef7da3942ce8b9c1c9a9d0643fc4540e7d3f1c3821267e866cacd3e904be9f9df80381eec09eb2b0d745ff03ffb199b917a14fdd8fbfbffe8bfb0cf7023aa7183301a8a41e7097ff9f5247f8b78f7d08bbfc596a81047807cf0929677222e7e9e921b294e04088c3746d8dc19294645f1c093a21b4c5e6d92e54dd90465b11dd5d9d42af849070edff4ec63970f4088daaa33afdebb28d01df5ee043a8150ab1b25d864ef31e20c84696596cfbea92d02ea29c4a3933c41ec68aee7d68d7eea7f30d8920e14e62be42bcf856d7a58f46fdb2438b023e974f77281c5a462553627e9614504cbd3f1cae6e0fd9f7e89d9bce48946d0508616fbe542303dc542982c61d7bb4afbf3e76bf1fb2381cdc99f2175ef944dcd826aabdca2b7678db5262733c69ce504c38e7deb7adfb9b6d8bb00d8e4251e0438417ea615cde58bd76c2427b3d7a0578bbbff9fde2abbc5d60307aff0050b18176158aaedb34e283886378ff798b4f74e0a0c95d64271f1916280dd247304d9201c67f5e2640d9706add8703cac81795a0190107e2bb2941ed13738595da1c86ba0f68e2283a435cb5f162c74071a13dfe2266d05abaef080dd6b1dade115e883e04f0bb4be4d91f535ae6f822b02e814e65d2b7807d199a23d3f26209f6c9f93602a3a93ccfdebb5f8161b7928059674e15820d1848a980c8d1af5a73aadc5c402fbb6e730ba51227913ca27f0d78d331d6325d0a7926c238296b2a22b10a69cdffeb087dfe175511ed8e2cde8d7dae140e4ce92f892b129d9940e4a30b19f822ef7611b8750eaea8e55502604b7d2358c09a217af8be6c86d67cf6ff6130c971c9765d56631fe6224fbe1e833d497b534fbf6b030af93691f59295279aa1bdfb5d5d9d4668d5aea70e2b8fc117df0042e91c7e6225f27329727ed6e14a87c7943c040dfee4e5c06a20251c39a45ab4865951b0daefb9c05571fdcc21d1761945bd2b8047ccedd6f1e708646fbe61e75bb2728e8cee893d7e6f642119e786155a6cbab057d6d83b77716145119e974ad7355179d2adc3d748fa249cb58e32e6791d646240c05da4427b2f359976c8fd1486c604cb7ee647e24633d8fca8314cf1f85110ca6351156a2b26e44b040f7d2810acd36f45a3969c1fafd1a7e0bc14fd9b26593375be8e750c3f6534ffb85904d15d75fba05dac4a673de97f7543ee931724cd35474cd7ff5cf3e8abaf206f3030e92895633fa9d8499ea763601560260109dad18bd64b990531fc5377e6eaa5da050b98e1c6515ea48c7de1a15b63283d4a694cbad379356bfdac50e6c343879e29f6b9ab425600d51f257ceb35d0ca00f83cf5bd734223de716747614666ba1f1a8fa756e5f3ff0fc94fa4bd4073bddb0098cf565ee40af5732ee9218d262e5b64ad6b8118c54eeaf7072f2e15514a401779b425fa89d8abb1750e56cc3108dffdcf2d3fd86b8af4560d56f7ff0702154211f9949e3992d93e66892b297fa2d4bfe18de3fd74e96c9d30eb14fd458fdbc9e9a34e00f3280dd732520147fa2a8fa83e91dd0687501466a300015bf888c03fc08190c2753d7719acf6f84885c4c5642f466c1984f15a7716a9b608ee5f1b395726bcc8519766667d24d11e396e62ea39640c9e73e4e9e9e5076d7019ca1bebbd7097807f46b3b6fcb96ed4b433b25ec551fb176a5fa252ed1d81b0350cfdfb8069c9916495bef3a262b6668910896c0b37eee40547c663a901e92f41b417ac50e88d058d021a8f9a5783bd936cca4962bec1c9886689cc547970f9215232596392515182e563f720bb79d29baaabf0e2697de6500bc677e346847011ee3450358c0b16ca528368b5cbb8df5ab974a3cef072d20c9906fa585e0f3083ec6d8507b8561f64e65aa1aecf825fc47ad1459c87771549fd5c9a9cc094e7b1179ee1e90eff7158f28f59f029d90e708f4ec50b4f67d8b4bb7140065528354a7e25d63e92977183a0284ec22aa923210f0bfea89cca53547137381e5de0f60bc484bc2daf129b0380244f1ed4bfb674eb2791e76dce33cae684ad36620d5d67cb587f840caed316b7439b0e8c3de0e065e62680f3997369be3466670278168c9a1a644d870e3a8d0a79b2b720e8c3c51bb9133532beee64319e98714bb2e6d5c0b723962d923b0ef454361d4b3cb470bf8c39031ed4a75267f499741be15aacac92d8e6afdcb01a2e7d2dbf549ceb2a2108c4079c620f05ca1bd31d631c2c8d35ca0d73155f56ed020c25e389db356edf510ae088d11b5e4fed51d0dce4d3aa04924b09c28200ede5bec1a8f38cc5f081055e0f28d75afc4d588ca0e828d00085d150beafdda17b8df9e7d9218ea7d81f2e076412901c5ae04d6929d717fea2fcc8e5a1e69dbd7b5258799a2fa5eb108b6cc35dfab599fb27e6d75f1030b83f452af8137830337141f031942eba83123d3f87b5f01623d4613e5a44b4952c300baf3d4d3dbbfb0ad024a19b3810a174ef8453d85a25822f66e45eba2490f29de1077683ccc32e3517f88b51e010672a982f7c8591450c9ab1573143aefb61c17ebb0c92dcb0494d116b970c2a827a6b3608ae10d583d1f7d092263fa873de9f31cd59bc9491ff012059b63a9120af89477f2ccc34eee7bd66de60af64730c879128b49d31da6400c2471e0d5abf707e560574b477b8e20ca45d92182d639eb434e14aea1a3f91ad8fb60e4859b77389753990513181ea3a82884235e8520294359435cfba220502b591fc28ac36ec697442657d290bd7aad7fce53a3f1766f2bf7d55c24d7c0e9c7a71d6f1282ea1478e0a36378b50e4fee281f686bc53f50138036e2a5d6199d40caff084fde7b63b3c0a47da0791107c3218330f7c2e2c7609aba202fae5290243b6033379eb15edc572eee452008e04c9b53efd5f3d88327317b38934745bc3de4c55bd818febc7a7953bf03c4029f77177c2a974310f0485aa46252f1000dc71934947287c38ea5854f29c7b82f630afb8caf1fd880670307b155a6e7feddc019cfbbbdc18f3bc03da3bd371d93ccbf56bcb39eea55c2d113efc148127c30089d21ce6a5088dbfbcf8f8d75c19456bc962c371548634a95382acb5a0886efc46a87bdc111dc0d1e54084cea0d58054f00762c91d7fe0f0fbcf4c280f29f9cd5999a5e8c6f507f8080d7c7ea9a8685be50722cf1a082f3728dec8d6152cdc72f8da6b1805643c042f4f6780ba79cc8a2165d9d7acec8ab2f421bc3e77b51c62c4bbb262b5674ea7d2dcf9acb894d050e91b052364322a5b08bd9667249571c004fb495da7e24fc5620adda3af6848ccf238911a52bdbff766e4e279ac274afa2c2302faba25b5fe98d972a04aa13f77c0c05d7dd82b0a19f1ded8cf5f99c80e392b0aab1264a29e9fbcf0b69f6b0a9f2332e09ab74dea7277106d0883bb264e279c67e5bc69009225bf4fd1a8532f9392a011b55a73a7cf8d16a59d695b2a65b57fad64a2041f8c28804ee1a48845c5dab757d04f1d95520aa9ddb69904d6529c0e14bd789dfe37067073b3e0e136ae2aebb1c34c55b94ce942f786be4b45f801f35f7c768d91a460b92ffa57ff675f0b4b00437a07f871a8650f21b2bf7c722c1d9e860e8955fef5699ee53a5f6fe46fb9e5e17a1c69fe2538af4718b7215ad2c00c3d420589a8653ee511b809945451fb8205b19ce377c8d0253b05493c557cf2bd8ef208e8fc01beceea1acca38d025f328f28d69bcfaa3adc6d9573a3832dc3f3c758fe08cf9cd0c32acfddae81b3682869e8aa9725b64336252aeb2ee8eb78f0721aa3158217a3009948adb297c5ea45ec26cb6d963c7be47ee1b93fa136ebe73a21936df0148fa311206f8bca2e80719aeca8745ff74ddaad5182644762c66333f942d9a93c467d5f9fd5d0dbbe57480362d4bb0f760294f4eba3e1b08047d256dbda157635d21a43aff3a71f6ad574b402bb36e5270d7ed082c6fbae07771721513ae9ddb22d23b00733046c898ee6ac05ef8a51ce41919e1f241cb98e0592ace68214620ba1a748ef81131661f58f1635713ca2873e150a3e848c8d2ebd039769fda112b73050efa4d1c35dbb46ca5a7b7ccbed1dcded36af272f6838b4c1e7e6778e7e9ca3d794f275d49c9e32e768097349118d2337e7c031ada38d0cc5c04c286ff93083f6d58d73a821118c93432fda9a8c76fa2cbcc093a7decac8e4f001ecc9f67faf1c2f102120f0618469cf653bbd5fcefd4ef2bae86dc4f5393b840f9f47140cf7f46a186c21878a43612a71d3b540b9994f010ab623f878264cf46c7366d0bec5d43d481b47846091fd3cda73a9a28ceb7f839eca695c9f084a16c812475f6575ef2368c88cc6655f47663ef69ce4779fe3ccc4dd85a07a9e4c6f39f42690d231f5727f45c247a53fd8df029fcefda4f328658435892519c17205a3c715ad6bb7387d09a5e387c83f008daf626f5977c66203af1143ef7b59ccd8e3c17bb156bca317861f0b9f222ea63c044075a3a74beaf05c23d0a75caa60397d831bbe507234fff154960faf0f02776d3f9038c955bf0c1ec9c92523cf0b855c18d6ac3b35d437796420ba3dfd581dc6adac64315c1cb1a2c3a45ec4655bb2bd6e0b4a3082281ed0697a213d1d93142e96b4fd57431d2f4547451d008ab58bcd9765ccf3ca3297becd5de9e2be0263cfca09935c9334b5e687bc7e7057dc2ed03873be22200c9fe32a9497dd00a336cf4c723ead302340b5cd1fef8cd88330a9089fc93af4ef739295b94407b291bf33f4f39c936736e1166106428f8796a4b92805f4dfcf46d8692b54e40a9e8584c0eaac4caada87bb33f553eafeef5051b889402176ab766936a38ddd7e5205d2c87e133a02e84ab24ba2d889a4c4db8cbe18b271455e84da716f4a32acdbc0a5aaba25a2ec757c73847dd1c4ccb2967c651e5257692a4553dde227846bfe2977021805f46a287c835ea8dc5", 0x2000, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x10, 0xffffffffffffffda, 0x3ff, {0x0, 0xb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r7, &(0x7f0000000180)={0x50, 0x0, r8, {0x7, 0x2b, 0xfffffffe, 0x300040ac, 0x0, 0xffff, 0x6, 0xfffffffe, 0x0, 0x0, 0x1, 0x100}}, 0x50) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa8f86, 0x1) close(r7) r9 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) lseek(r9, 0xfffffffffffffff9, 0x4) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x0) write(r5, &(0x7f0000000100)="8492b2bc52621792", 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000010400004000fedbdf2501f80000", @ANYBLOB="01020400000000002800128008000100736974001c00028008000200c6120001060008001900000005000a00fd00000008000400010001"], 0x58}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010424bd7000fbdbdf252e00000008000300", @ANYRES32=r2, @ANYBLOB="0a00340001010101010100001800490008"], 0x50}, 0x1, 0x0, 0x0, 0x20}, 0x0) 0s ago: executing program 4 (id=63): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x700) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi4\x00', 0x8000, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000240)={{0x1, 0x1, 0x18, r0}, 'proc/kallsyms\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) getrlimit(0x6, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x6d) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/kvm/mmu_shadow_zapped\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='0', 0x1) openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x4000, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc/kallsyms\x00', 0x1, 0x0) lseek(r5, 0x186a0, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') kernel console output (not intermixed with test programs): [ 53.166418][ T30] audit: type=1400 audit(1786933417.293:111): avc: denied { write } for pid=5444 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 53.217907][ T30] audit: type=1400 audit(1786933417.343:112): avc: denied { write } for pid=5455 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.236500][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 54.236515][ T30] audit: type=1400 audit(1786933418.363:122): avc: denied { write } for pid=5525 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.412975][ T30] audit: type=1400 audit(1786933418.543:123): avc: denied { write } for pid=5528 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.463734][ T30] audit: type=1400 audit(1786933418.593:124): avc: denied { write } for pid=5539 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.647847][ T30] audit: type=1400 audit(1786933418.773:125): avc: denied { write } for pid=5543 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.703137][ T30] audit: type=1400 audit(1786933418.833:126): avc: denied { write } for pid=5554 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.872226][ T30] audit: type=1400 audit(1786933419.003:127): avc: denied { write } for pid=5557 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.924984][ T30] audit: type=1400 audit(1786933419.053:128): avc: denied { write } for pid=5568 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.0.247' (ED25519) to the list of known hosts. [ 60.573885][ T30] audit: type=1400 audit(1786933424.703:129): avc: denied { mounton } for pid=5579 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 60.597574][ T30] audit: type=1400 audit(1786933424.723:130): avc: denied { mount } for pid=5579 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 60.600432][ T5579] cgroup: Unknown subsys name 'net' [ 60.626624][ T30] audit: type=1400 audit(1786933424.763:131): avc: denied { unmount } for pid=5579 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 60.744612][ T5579] cgroup: Unknown subsys name 'cpuset' [ 60.752103][ T5579] cgroup: Unknown subsys name 'rlimit' [ 60.880085][ T30] audit: type=1400 audit(1786933425.003:132): avc: denied { setattr } for pid=5579 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=819 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 60.903800][ T30] audit: type=1400 audit(1786933425.013:133): avc: denied { create } for pid=5579 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 60.928613][ T30] audit: type=1400 audit(1786933425.013:134): avc: denied { write } for pid=5579 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 60.952902][ T30] audit: type=1400 audit(1786933425.013:135): avc: denied { read } for pid=5579 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 60.973591][ T30] audit: type=1400 audit(1786933425.033:136): avc: denied { mounton } for pid=5579 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 60.998679][ T30] audit: type=1400 audit(1786933425.033:137): avc: denied { mount } for pid=5579 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 61.037459][ T5581] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 61.047881][ T30] audit: type=1400 audit(1786933425.173:138): avc: denied { relabelto } for pid=5581 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 61.987257][ T5579] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 64.088648][ T5607] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 64.097440][ T5607] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 64.103002][ T5609] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 64.112403][ T5607] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 64.112910][ T5609] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 64.120626][ T5607] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 64.136175][ T5607] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 64.136531][ T5609] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 64.149515][ T5610] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 64.151283][ T5609] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 64.159208][ T5610] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 64.165013][ T5611] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 64.177203][ T5612] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 64.179020][ T5609] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 64.187493][ T5612] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 64.193632][ T5611] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 64.200176][ T5612] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 64.208463][ T5611] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 64.214368][ T5607] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.220623][ T5613] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 64.228339][ T5607] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 64.236261][ T5612] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 64.250777][ T5601] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 64.258702][ T5611] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 64.267274][ T4913] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 65.519542][ T5590] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.527148][ T5590] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.534514][ T5590] bridge_slave_0: entered allmulticast mode [ 65.541264][ T5590] bridge_slave_0: entered promiscuous mode [ 65.569213][ T5590] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.576379][ T5590] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.583615][ T5590] bridge_slave_1: entered allmulticast mode [ 65.590804][ T5590] bridge_slave_1: entered promiscuous mode [ 65.627274][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.634451][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.641896][ T5593] bridge_slave_0: entered allmulticast mode [ 65.648603][ T5593] bridge_slave_0: entered promiscuous mode [ 65.683816][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.690958][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.698070][ T5593] bridge_slave_1: entered allmulticast mode [ 65.705032][ T5593] bridge_slave_1: entered promiscuous mode [ 65.717158][ T5590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.732938][ T5592] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.740126][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.747370][ T5592] bridge_slave_0: entered allmulticast mode [ 65.754175][ T5592] bridge_slave_0: entered promiscuous mode [ 65.774806][ T5590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.784172][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.791697][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.798792][ T5594] bridge_slave_0: entered allmulticast mode [ 65.805525][ T5594] bridge_slave_0: entered promiscuous mode [ 65.812748][ T5592] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.819807][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.827004][ T5592] bridge_slave_1: entered allmulticast mode [ 65.833843][ T5592] bridge_slave_1: entered promiscuous mode [ 65.860763][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.867972][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.875337][ T5594] bridge_slave_1: entered allmulticast mode [ 65.882057][ T5594] bridge_slave_1: entered promiscuous mode [ 65.896358][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.907348][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 65.907468][ T5591] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.914266][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 65.922018][ T5591] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.934429][ T5591] bridge_slave_0: entered allmulticast mode [ 65.941682][ T5591] bridge_slave_0: entered promiscuous mode [ 65.969027][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.978372][ T5591] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.986097][ T5591] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.994024][ T5591] bridge_slave_1: entered allmulticast mode [ 66.000954][ T5591] bridge_slave_1: entered promiscuous mode [ 66.009163][ T5590] team0: Port device team_slave_0 added [ 66.023096][ T5592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.046834][ T5590] team0: Port device team_slave_1 added [ 66.054303][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.065494][ T5592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.102191][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.118470][ T5593] team0: Port device team_slave_0 added [ 66.126838][ T5591] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.150789][ T5592] team0: Port device team_slave_0 added [ 66.157805][ T5593] team0: Port device team_slave_1 added [ 66.171800][ T5591] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.181507][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.188515][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.214446][ T5590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.236781][ T5592] team0: Port device team_slave_1 added [ 66.255225][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.262289][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.288502][ T5590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.300648][ T4913] Bluetooth: hci4: command tx timeout [ 66.300666][ T5596] Bluetooth: hci3: command tx timeout [ 66.300881][ T5612] Bluetooth: hci1: command tx timeout [ 66.306591][ T5596] Bluetooth: hci2: command tx timeout [ 66.312318][ T5611] Bluetooth: hci0: command tx timeout [ 66.317985][ T5594] team0: Port device team_slave_0 added [ 66.331224][ T5594] team0: Port device team_slave_1 added [ 66.346748][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.353769][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.379663][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.415581][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.422672][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.448878][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.462427][ T5591] team0: Port device team_slave_0 added [ 66.470053][ T5591] team0: Port device team_slave_1 added [ 66.483600][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.490580][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.516716][ T5592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.547009][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.553998][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.579966][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.591508][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.598457][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.624344][ T5592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.648092][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.655355][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.681259][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.706927][ T5590] hsr_slave_0: entered promiscuous mode [ 66.713291][ T5590] hsr_slave_1: entered promiscuous mode [ 66.719815][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.726861][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.752784][ T5591] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.780268][ T5593] hsr_slave_0: entered promiscuous mode [ 66.786304][ T5593] hsr_slave_1: entered promiscuous mode [ 66.792488][ T5593] debugfs: 'hsr0' already exists in 'hsr' [ 66.798242][ T5593] Cannot create hsr debugfs directory [ 66.804337][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.811551][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.837468][ T5591] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.869590][ T5594] hsr_slave_0: entered promiscuous mode [ 66.875880][ T5594] hsr_slave_1: entered promiscuous mode [ 66.881814][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 66.887513][ T5594] Cannot create hsr debugfs directory [ 66.966925][ T5592] hsr_slave_0: entered promiscuous mode [ 66.973072][ T5592] hsr_slave_1: entered promiscuous mode [ 66.978929][ T5592] debugfs: 'hsr0' already exists in 'hsr' [ 66.984989][ T5592] Cannot create hsr debugfs directory [ 67.023920][ T5591] hsr_slave_0: entered promiscuous mode [ 67.030146][ T5591] hsr_slave_1: entered promiscuous mode [ 67.036049][ T5591] debugfs: 'hsr0' already exists in 'hsr' [ 67.041988][ T5591] Cannot create hsr debugfs directory [ 67.335413][ T5594] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 67.348246][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.356307][ T5594] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 67.365236][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.373087][ T5594] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 67.382197][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.390349][ T5594] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 67.399880][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.454154][ T5593] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 67.463512][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.471554][ T5593] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 67.482325][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.491067][ T5593] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 67.501237][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.508928][ T5593] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 67.518101][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.581542][ T5590] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 67.590805][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.606863][ T5590] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 67.616164][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.624527][ T5590] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 67.633024][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.645250][ T5590] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 67.654290][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.720550][ T5592] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 67.729867][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.737939][ T5592] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 67.746463][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.761490][ T5592] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 67.772462][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.788372][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.796772][ T5592] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 67.806498][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.877570][ T5591] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 67.887229][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 67.895665][ T5591] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 67.905343][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 67.914009][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.924239][ T5591] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 67.932877][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 67.940812][ T5591] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 67.949036][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 67.978952][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.986341][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.004594][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.015255][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.022498][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.068668][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.087281][ T95] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.094383][ T95] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.118388][ T95] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.125496][ T95] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.185352][ T5590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.200822][ T5592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.245292][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 68.245307][ T30] audit: type=1400 audit(1786933432.373:153): avc: denied { sys_module } for pid=5594 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 68.306774][ T5590] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.327717][ T95] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.334824][ T95] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.355771][ T5591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.366184][ T5592] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.380494][ T4913] Bluetooth: hci2: command tx timeout [ 68.386531][ T5606] Bluetooth: hci4: command tx timeout [ 68.392361][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.392480][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.400554][ T5612] Bluetooth: hci1: command tx timeout [ 68.412360][ T4913] Bluetooth: hci0: command tx timeout [ 68.412945][ T5606] Bluetooth: hci3: command tx timeout [ 68.421279][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.430394][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.443834][ T5591] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.458815][ T133] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.465906][ T133] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.475066][ T133] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.482168][ T133] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.517287][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.524441][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.928584][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.073626][ T5594] veth0_vlan: entered promiscuous mode [ 69.105885][ T5594] veth1_vlan: entered promiscuous mode [ 69.202172][ T5594] veth0_macvtap: entered promiscuous mode [ 69.239010][ T5594] veth1_macvtap: entered promiscuous mode [ 69.257275][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.298591][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.335582][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.452890][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.495434][ T1043] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.530046][ T1043] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.558201][ T5591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.577001][ T5592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.610500][ T5771] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.624254][ T5590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.693807][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.705709][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.760187][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.768490][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.789017][ T30] audit: type=1400 audit(1786933433.913:154): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/root/syzkaller.pOzP4R/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 69.805694][ T5592] veth0_vlan: entered promiscuous mode [ 69.822332][ T30] audit: type=1400 audit(1786933433.913:155): avc: denied { mount } for pid=5594 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 69.845911][ T30] audit: type=1400 audit(1786933433.913:156): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/root/syzkaller.pOzP4R/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 69.873699][ T5590] veth0_vlan: entered promiscuous mode [ 69.877047][ T5594] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 69.884969][ T5590] veth1_vlan: entered promiscuous mode [ 69.909780][ T30] audit: type=1400 audit(1786933433.913:157): avc: denied { mount } for pid=5594 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 69.922480][ T5591] veth0_vlan: entered promiscuous mode [ 69.937189][ T30] audit: type=1400 audit(1786933433.913:158): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/root/syzkaller.pOzP4R/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 69.949545][ T5591] veth1_vlan: entered promiscuous mode [ 69.969433][ T30] audit: type=1400 audit(1786933433.913:159): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/root/syzkaller.pOzP4R/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=6935 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 69.978404][ T5593] veth0_vlan: entered promiscuous mode [ 69.999540][ T30] audit: type=1400 audit(1786933433.913:160): avc: denied { unmount } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 70.022758][ T30] audit: type=1400 audit(1786933433.953:161): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2780 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 70.031105][ T5592] veth1_vlan: entered promiscuous mode [ 70.046880][ T30] audit: type=1400 audit(1786933433.953:162): avc: denied { mount } for pid=5594 comm="syz-executor" name="/" dev="gadgetfs" ino=6938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 70.065076][ T5590] veth0_macvtap: entered promiscuous mode [ 70.155861][ T5590] veth1_macvtap: entered promiscuous mode [ 70.166881][ T5593] veth1_vlan: entered promiscuous mode [ 70.205709][ T5787] syzkaller0: entered promiscuous mode [ 70.211843][ T5787] syzkaller0: entered allmulticast mode [ 70.233392][ T5787] tipc: Started in network mode [ 70.238802][ T5787] tipc: Node identity b6101138ad72, cluster identity 4711 [ 70.246992][ T5787] tipc: Enabled bearer , priority 0 [ 70.259708][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.287917][ T5593] veth0_macvtap: entered promiscuous mode [ 70.295660][ T5591] veth0_macvtap: entered promiscuous mode [ 70.304760][ T5592] veth0_macvtap: entered promiscuous mode [ 70.313535][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.327956][ T5787] tipc: Resetting bearer [ 70.339468][ T5593] veth1_macvtap: entered promiscuous mode [ 70.348758][ T5591] veth1_macvtap: entered promiscuous mode [ 70.357096][ T5786] tipc: Resetting bearer [ 70.368248][ T5786] tipc: Disabling bearer [ 70.378151][ T5592] veth1_macvtap: entered promiscuous mode [ 70.415434][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.456738][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.464306][ T5612] Bluetooth: hci4: command tx timeout [ 70.464320][ T4913] Bluetooth: hci2: command tx timeout [ 70.469692][ T5606] Bluetooth: hci0: command tx timeout [ 70.475251][ T5596] Bluetooth: hci3: command tx timeout [ 70.480624][ T5612] Bluetooth: hci1: command tx timeout [ 70.496804][ T5771] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.524974][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.553713][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.581727][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.618909][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.659376][ T1043] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.670091][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.673502][ T1043] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.814456][ T5771] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.828617][ T5771] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.845565][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.865129][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.924902][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.943389][ T5771] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.949028][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.970458][ T5771] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.006348][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.048225][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.895519][ T95] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.905355][ T95] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.930267][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.960017][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.075335][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.119591][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.132332][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.141967][ T5804] Zero length message leads to an empty skb [ 72.305146][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.314538][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.781194][ T5606] Bluetooth: hci2: command tx timeout [ 72.786666][ T5612] Bluetooth: hci3: command tx timeout [ 72.792515][ T5606] Bluetooth: hci4: command tx timeout [ 72.798994][ T5612] Bluetooth: hci0: command tx timeout [ 72.799046][ T4913] Bluetooth: hci1: command tx timeout [ 72.827324][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.870976][ T1043] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.060481][ T57] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.104198][ T57] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.253810][ T5822] mmap: syz.3.4 (5822) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 73.372548][ T1043] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.412497][ T30] kauditd_printk_skb: 41 callbacks suppressed [ 73.412515][ T30] audit: type=1400 audit(1786933437.483:204): avc: denied { ioctl } for pid=5817 comm="syz.0.1" path="/dev/iommu" dev="devtmpfs" ino=624 ioctlcmd=0x3b81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 73.448210][ T5820] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 73.448879][ T30] audit: type=1400 audit(1786933437.573:205): avc: denied { create } for pid=5817 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 73.463741][ T1043] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.487288][ T30] audit: type=1400 audit(1786933437.623:206): avc: denied { write } for pid=5815 comm="syz.4.9" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 73.602161][ T30] audit: type=1400 audit(1786933437.693:207): avc: denied { map_create } for pid=5814 comm="syz.3.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 73.633493][ T5705] IPVS: starting estimator thread 0... [ 73.642963][ T30] audit: type=1400 audit(1786933437.773:208): avc: denied { setopt } for pid=5817 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 73.675211][ T1043] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.696889][ T1043] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.741871][ T5828] IPVS: using max 46 ests per chain, 110400 per kthread [ 75.179188][ T30] audit: type=1400 audit(1786933437.783:209): avc: denied { create } for pid=5817 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 75.240140][ T5825] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10'. [ 75.332724][ T30] audit: type=1400 audit(1786933437.803:210): avc: denied { ioctl } for pid=5817 comm="syz.0.1" path="socket:[8114]" dev="sockfs" ino=8114 ioctlcmd=0x61f3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 75.357981][ T30] audit: type=1400 audit(1786933437.943:211): avc: denied { mounton } for pid=5814 comm="syz.3.4" path="/syzcgroup/unified/syz3" dev="cgroup2" ino=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 75.376476][ T5820] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 75.385150][ T30] audit: type=1400 audit(1786933439.293:212): avc: denied { create } for pid=5815 comm="syz.4.9" anonclass=[secretmem] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 75.450036][ T1043] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.695861][ T5844] fuse: Bad value for 'fd' [ 76.266798][ T30] audit: type=1400 audit(1786933439.323:213): avc: denied { create } for pid=5821 comm="syz.1.10" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 76.340377][ T29] cfg80211: failed to load regulatory.db [ 76.358447][ T5820] iommufd_mock iommufd_mock2: Adding to iommu group 2 [ 76.862955][ T5851] process 'syz.0.14' launched './file1' with NULL argv: empty string added [ 76.957778][ T5850] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 77.633053][ T5855] warning: `syz.1.16' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 77.745274][ T5850] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 77.976529][ T5852] iommufd_mock iommufd_mock2: Adding to iommu group 2 [ 78.209093][ T24] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 78.477223][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 78.477238][ T30] audit: type=1400 audit(1786933442.603:234): avc: denied { create } for pid=5853 comm="syz.1.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 78.486539][ T5856] xt_connbytes: Forcing CT accounting to be enabled [ 78.606310][ T30] audit: type=1400 audit(1786933442.733:235): avc: denied { write } for pid=5853 comm="syz.1.16" path="socket:[8764]" dev="sockfs" ino=8764 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 78.630944][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 78.641443][ T5855] 9p: Bad value for 'rfdno' [ 78.643162][ T24] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 78.661708][ T24] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 78.671250][ T24] usb 4-1: config 0 has no interface number 0 [ 78.671416][ T5857] netlink: 'syz.1.16': attribute type 1 has an invalid length. [ 78.679303][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.695881][ T24] usb 4-1: Product: syz [ 78.700535][ T24] usb 4-1: Manufacturer: syz [ 78.705169][ T24] usb 4-1: SerialNumber: syz [ 78.711545][ T5856] Cannot find set identified by id 0 to match [ 78.725007][ T5855] netlink: 52 bytes leftover after parsing attributes in process `syz.1.16'. [ 78.743061][ T24] usb 4-1: config 0 descriptor?? [ 78.755939][ T24] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 78.850321][ T29] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 78.995856][ T24] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 79.072987][ T29] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 79.083036][ T30] audit: type=1400 audit(1786933443.213:236): avc: denied { setopt } for pid=5862 comm="syz.0.18" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 79.179939][ T5864] pim6reg: entered allmulticast mode [ 79.216789][ T29] usb 5-1: config 0 has an invalid interface number: 50 but max is 0 [ 79.289336][ T29] usb 5-1: config 0 has no interface number 0 [ 79.313074][ T29] usb 5-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 79.368092][ T5864] netlink: 'syz.0.18': attribute type 11 has an invalid length. [ 79.376427][ T5864] netlink: 4320 bytes leftover after parsing attributes in process `syz.0.18'. [ 79.409441][ T5864] nfs: Unknown parameter '*]):*' [ 79.465068][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.495514][ T24] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 79.528755][ T29] usb 5-1: Product: syz [ 79.556829][ T29] usb 5-1: Manufacturer: syz [ 79.596165][ T29] usb 5-1: SerialNumber: syz [ 80.275441][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 81.233262][ T30] audit: type=1400 audit(1786933443.393:237): avc: denied { mounton } for pid=5862 comm="syz.0.18" path="/syzcgroup/cpu/syz0/cgroup.procs" dev="cgroup" ino=294 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 81.265947][ T30] audit: type=1400 audit(1786933443.613:238): avc: denied { allowed } for pid=5866 comm="syz.1.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 81.287418][ T30] audit: type=1400 audit(1786933443.863:239): avc: denied { mount } for pid=5866 comm="syz.1.19" name="/" dev="configfs" ino=61 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 81.303702][ T29] usb 5-1: config 0 descriptor?? [ 81.310106][ T30] audit: type=1400 audit(1786933443.873:240): avc: denied { search } for pid=5866 comm="syz.1.19" name="/" dev="configfs" ino=61 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 81.336716][ T30] audit: type=1400 audit(1786933443.873:241): avc: denied { search } for pid=5866 comm="syz.1.19" name="usb_gadget" dev="configfs" ino=3459 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 81.366356][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 81.368851][ T5784] usb 4-1: USB disconnect, device number 2 [ 81.380221][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 81.423155][ T30] audit: type=1400 audit(1786933443.983:243): avc: denied { write } for pid=5845 comm="syz.3.12" path="socket:[8922]" dev="sockfs" ino=8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 81.543719][ T29] yurex 5-1:0.50: USB YUREX device now attached to Yurex #0 [ 81.560136][ T5784] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 81.609631][ T30] audit: type=1400 audit(1786933443.873:242): avc: denied { write search } for pid=5866 comm="syz.1.19" name="usb_gadget" dev="configfs" ino=3459 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 81.677609][ T5784] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 81.763981][ T5705] usb 5-1: USB disconnect, device number 2 [ 81.778852][ T5876] 9pnet_virtio: no channels available for device syz [ 81.782399][ T5705] yurex 5-1:0.50: USB YUREX #0 now disconnected [ 81.875301][ T5784] quatech2 4-1:0.51: device disconnected [ 82.019621][ T5885] ======================================================= [ 82.019621][ T5885] WARNING: The mand mount option has been deprecated and [ 82.019621][ T5885] and is ignored by this kernel. Remove the mand [ 82.019621][ T5885] option from the mount to silence this warning. [ 82.019621][ T5885] ======================================================= [ 82.020146][ T5885] CIFS: VFS: UNC: path must begin with // or \\ [ 82.020183][ T5885] Malformed UNC in devname [ 82.020183][ T5885] [ 82.020287][ T5885] CIFS: VFS: Malformed UNC in devname [ 82.026141][ T5885] netlink: 'syz.1.20': attribute type 1 has an invalid length. [ 82.026217][ T5885] netlink: 12 bytes leftover after parsing attributes in process `syz.1.20'. [ 82.522404][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 82.522458][ T9] usb 3-1: New USB device found, idVendor=16c0, idProduct=75e1, bcdDevice= 0.40 [ 82.522532][ T9] usb 3-1: too many configurations: 80, using maximum allowed: 8 [ 82.523752][ T9] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 82.523771][ T9] usb 3-1: can't read configurations, error -71 [ 82.819136][ T5894] loop7: detected capacity change from 0 to 7 [ 82.822273][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 82.822335][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 82.822764][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 82.822797][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 82.822871][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 82.822900][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 82.822967][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 82.822994][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 82.823068][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 82.823094][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 82.823165][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 82.823191][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 82.823278][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 82.823305][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 82.823325][ T5894] ldm_validate_partition_table(): Disk read failed. [ 82.823390][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 82.823416][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 82.823483][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 82.823509][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 82.823574][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 82.823600][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 82.823699][ T5894] Dev loop7: unable to read RDB block 0 [ 82.824638][ T5894] loop7: unable to read partition table [ 82.824729][ T5894] loop7: partition table beyond EOD, truncated [ 82.824745][ T5894] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 82.849030][ T5882] syz.3.22 uses obsolete (PF_INET,SOCK_PACKET) [ 82.892802][ T5894] netlink: 20 bytes leftover after parsing attributes in process `syz.4.25'. [ 82.893066][ T5894] 8021q: VLANs not supported on ip6tnl0 [ 83.583624][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 83.583639][ T30] audit: type=1400 audit(1786933447.713:264): avc: denied { unmount } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 83.777108][ T5784] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 84.063160][ T5905] netlink: 4 bytes leftover after parsing attributes in process `syz.4.28'. [ 84.111881][ T5784] usb 1-1: unable to get BOS descriptor or descriptor too short [ 84.169264][ T5784] usb 1-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 84.259102][ T30] audit: type=1400 audit(1786933448.083:265): avc: denied { write } for pid=5903 comm="syz.4.28" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 84.343598][ T5784] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.399212][ T5784] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 9 [ 84.472920][ T5784] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 36 [ 84.553344][ T5784] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.638089][ T5784] usb 1-1: Product: syz [ 84.679395][ T5784] usb 1-1: Manufacturer: syz [ 84.724501][ T5784] usb 1-1: SerialNumber: syz [ 84.787829][ T5910] syzkaller0: entered promiscuous mode [ 84.858845][ T5910] syzkaller0: entered allmulticast mode [ 84.976073][ T5784] usb 1-1: config 0 descriptor?? [ 85.039468][ T5901] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 85.083333][ T5901] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 85.101372][ T30] audit: type=1400 audit(1786933449.223:266): avc: denied { write } for pid=5907 comm="syz.2.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 85.152172][ C0] usb 1-1: NFC: Urb failure (status -71) [ 85.172624][ C0] usb 1-1: NFC: Urb failure (status -71) [ 85.186920][ T5784] usb 1-1: NFC: Unable to get FW version [ 85.204705][ T5784] pn533_usb 1-1:0.0: probe with driver pn533_usb failed with error -71 [ 85.369995][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 85.419412][ T5784] usb 1-1: USB disconnect, device number 2 [ 85.531156][ T9] usb 3-1: New USB device found, idVendor=041e, idProduct=400c, bcdDevice=af.98 [ 85.542847][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.555672][ T9] usb 3-1: config 0 descriptor?? [ 85.569393][ T9] pwc: Creative Labs Webcam 5 detected. [ 85.614522][ T30] audit: type=1400 audit(1786933449.743:267): avc: denied { mount } for pid=5916 comm="syz.4.30" name="/" dev="hugetlbfs" ino=9099 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 85.938535][ T5897] netlink: 'syz.1.24': attribute type 1 has an invalid length. [ 86.082230][ T30] audit: type=1400 audit(1786933450.213:268): avc: denied { setattr } for pid=5920 comm="syz.0.31" name="NETLINK" dev="sockfs" ino=9105 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 86.152120][ T30] audit: type=1400 audit(1786933450.253:269): avc: denied { getopt } for pid=5896 comm="syz.1.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 86.183587][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 86.205492][ T9] pwc: recv_control_msg error -32 req 02 val 2700 [ 86.216732][ T30] audit: type=1400 audit(1786933450.353:270): avc: denied { create } for pid=5896 comm="syz.1.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 86.254198][ T30] audit: type=1400 audit(1786933450.383:271): avc: denied { write } for pid=5896 comm="syz.1.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 86.310804][ T5921] netlink: 24 bytes leftover after parsing attributes in process `syz.0.31'. [ 86.332277][ T30] audit: type=1400 audit(1786933450.463:272): avc: denied { mount } for pid=5920 comm="syz.0.31" name="/" dev="ramfs" ino=9107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 86.435114][ T9] pwc: recv_control_msg error -71 req 02 val 2c00 [ 86.447289][ T30] audit: type=1400 audit(1786933450.503:273): avc: denied { mounton } for pid=5920 comm="syz.0.31" path="/file0" dev="ramfs" ino=9108 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 86.478305][ T9] pwc: recv_control_msg error -71 req 04 val 1000 [ 86.500791][ T9] pwc: recv_control_msg error -71 req 04 val 1300 [ 86.533131][ T9] pwc: recv_control_msg error -71 req 04 val 1400 [ 86.554499][ T9] pwc: recv_control_msg error -71 req 02 val 2000 [ 86.562927][ T9] pwc: recv_control_msg error -71 req 02 val 2100 [ 86.628227][ T9] pwc: recv_control_msg error -71 req 06 val 0600 [ 86.744333][ T9] pwc: recv_control_msg error -71 req 04 val 1500 [ 86.792421][ T9] pwc: recv_control_msg error -71 req 02 val 2500 [ 86.896888][ T9] pwc: recv_control_msg error -71 req 02 val 2400 [ 86.936825][ T9] pwc: recv_control_msg error -71 req 02 val 2600 [ 86.993368][ T9] pwc: recv_control_msg error -71 req 02 val 2900 [ 87.067991][ T9] pwc: recv_control_msg error -71 req 02 val 2800 [ 87.222670][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 87.292685][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 87.438735][ T9] pwc: Failed to power off camera (-71) [ 88.073843][ T9] pwc: Registered as video103. [ 88.545474][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input5 [ 88.624945][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 88.624960][ T30] audit: type=1400 audit(1786933452.743:275): avc: denied { create } for pid=5932 comm="syz.1.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 88.664557][ T5930] xt_hashlimit: size too large, truncated to 1048576 [ 88.677366][ T30] audit: type=1400 audit(1786933452.793:276): avc: denied { write } for pid=5932 comm="syz.1.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 88.731058][ T30] audit: type=1400 audit(1786933452.803:277): avc: denied { nlmsg_write } for pid=5932 comm="syz.1.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 88.768606][ T9] usb 3-1: USB disconnect, device number 4 [ 88.794942][ T5940] fuse: Bad value for 'group_id' [ 88.802804][ T5940] fuse: Bad value for 'group_id' [ 88.948469][ T5942] netlink: 4892 bytes leftover after parsing attributes in process `syz.1.35'. [ 89.047715][ T5928] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 89.151108][ T30] audit: type=1400 audit(1786933453.273:278): avc: denied { read append } for pid=5947 comm="syz.0.38" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 89.186457][ T30] audit: type=1400 audit(1786933453.273:279): avc: denied { open } for pid=5947 comm="syz.0.38" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 89.220311][ T30] audit: type=1400 audit(1786933453.343:280): avc: denied { ioctl } for pid=5947 comm="syz.0.38" path="/dev/dri/card0" dev="devtmpfs" ino=627 ioctlcmd=0x640b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 89.300004][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 89.376344][ T5952] Mass Storage Function, version: 2009/09/11 [ 89.382630][ T5952] LUN: removable file: (no medium) [ 89.382951][ T30] audit: type=1400 audit(1786933453.503:281): avc: denied { write } for pid=5951 comm="syz.1.40" name="functions" dev="configfs" ino=8924 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 89.424454][ T30] audit: type=1400 audit(1786933453.543:282): avc: denied { write } for pid=5951 comm="syz.1.40" name="num_buffers" dev="configfs" ino=10335 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 89.457458][ T30] audit: type=1400 audit(1786933453.543:283): avc: denied { open } for pid=5951 comm="syz.1.40" path="/8/config/usb_gadget/g1/functions/mass_storage.usb0/num_buffers" dev="configfs" ino=10335 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 89.490899][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 89.694700][ T30] audit: type=1400 audit(1786933453.553:284): avc: denied { create } for pid=5951 comm="syz.1.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 90.101651][ T9] usb 3-1: New USB device found, idVendor=0421, idProduct=0099, bcdDevice=ce.f2 [ 90.120981][ T9] usb 3-1: config 6 has an invalid interface number: 150 but max is 0 [ 90.129597][ T9] usb 3-1: config 6 has no interface number 0 [ 90.136511][ T9] usb 3-1: config 6 interface 150 has no altsetting 0 [ 90.153706][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.162003][ T9] usb 3-1: Product: syz [ 90.166358][ T9] usb 3-1: Manufacturer: syz [ 90.171363][ T9] usb 3-1: SerialNumber: syz [ 91.478547][ T9] rndis_host 3-1:6.150: skipping garbage [ 91.485173][ T9] rndis_host 3-1:6.150: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 91.496459][ T9] cdc_acm 3-1:6.150: skipping garbage [ 91.832079][ T9] usb 3-1: USB disconnect, device number 5 [ 91.981515][ T5978] netlink: 24 bytes leftover after parsing attributes in process `syz.1.46'. [ 92.080042][ T4913] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 92.094392][ T4913] CPU: 0 UID: 0 PID: 4913 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 92.094426][ T4913] Tainted: [L]=SOFTLOCKUP [ 92.094433][ T4913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 92.094445][ T4913] Workqueue: hci1 hci_rx_work [ 92.094470][ T4913] Call Trace: [ 92.094477][ T4913] [ 92.094484][ T4913] dump_stack_lvl+0x100/0x190 [ 92.094512][ T4913] sysfs_warn_dup.cold+0x1c/0x28 [ 92.094541][ T4913] sysfs_create_dir_ns+0x24b/0x2b0 [ 92.094562][ T4913] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 92.094581][ T4913] ? find_held_lock+0x2b/0x80 [ 92.094600][ T4913] ? kobject_add_internal+0x25f/0x930 [ 92.094626][ T4913] ? kobject_add_internal+0x25f/0x930 [ 92.094655][ T4913] ? do_raw_spin_unlock+0x145/0x1e0 [ 92.094684][ T4913] kobject_add_internal+0x2c8/0x930 [ 92.094714][ T4913] kobject_add+0x16a/0x1e0 [ 92.094739][ T4913] ? __pfx_kobject_add+0x10/0x10 [ 92.094764][ T4913] ? class_to_subsys+0x10f/0x150 [ 92.094795][ T4913] ? kobject_put+0xb9/0x640 [ 92.094818][ T4913] ? _raw_spin_unlock+0x28/0x50 [ 92.094844][ T4913] device_add+0x294/0x1970 [ 92.094872][ T4913] ? __pfx_dev_set_name+0x10/0x10 [ 92.094891][ T4913] ? __pfx_device_add+0x10/0x10 [ 92.094918][ T4913] ? mgmt_send_event_skb+0x2fb/0x460 [ 92.094946][ T4913] hci_conn_add_sysfs+0x1a3/0x260 [ 92.094970][ T4913] le_conn_complete_evt+0x11eb/0x1f60 [ 92.094996][ T4913] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 92.095015][ T4913] ? hci_event_packet+0x186/0xcd0 [ 92.095040][ T4913] hci_le_conn_complete_evt+0x23c/0x3a0 [ 92.095060][ T4913] ? skb_pull_data+0x15f/0x1e0 [ 92.095081][ T4913] hci_le_meta_evt+0x34a/0x5f0 [ 92.095101][ T4913] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 92.095124][ T4913] hci_event_packet+0x51c/0xcd0 [ 92.095144][ T4913] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 92.095165][ T4913] ? __pfx_hci_event_packet+0x10/0x10 [ 92.095187][ T4913] ? kcov_remote_start+0x384/0x670 [ 92.095209][ T4913] ? lockdep_hardirqs_on+0x78/0x100 [ 92.095244][ T4913] hci_rx_work+0x451/0xfc0 [ 92.095269][ T4913] process_one_work+0xa23/0x1940 [ 92.095303][ T4913] ? __pfx_process_one_work+0x10/0x10 [ 92.095334][ T4913] ? __pfx_hci_rx_work+0x10/0x10 [ 92.095357][ T4913] worker_thread+0x5ef/0xe50 [ 92.095386][ T4913] ? __pfx_worker_thread+0x10/0x10 [ 92.095408][ T4913] ? kthread+0x13a/0x450 [ 92.095425][ T4913] ? __pfx_worker_thread+0x10/0x10 [ 92.095444][ T4913] kthread+0x370/0x450 [ 92.095462][ T4913] ? __pfx_kthread+0x10/0x10 [ 92.095482][ T4913] ret_from_fork+0x72b/0xd50 [ 92.095510][ T4913] ? __pfx_ret_from_fork+0x10/0x10 [ 92.095536][ T4913] ? __switch_to+0x800/0x10f0 [ 92.095554][ T4913] ? __pfx_kthread+0x10/0x10 [ 92.095572][ T4913] ret_from_fork_asm+0x1a/0x30 [ 92.095607][ T4913] [ 92.095694][ T4913] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 92.388028][ T4913] Bluetooth: hci1: failed to register connection device [ 92.664242][ T5987] syzkaller0: entered promiscuous mode [ 92.669783][ T5987] syzkaller0: entered allmulticast mode [ 94.221778][ T5991] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 94.229201][ T5991] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 94.418265][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 94.418288][ T30] audit: type=1400 audit(1786933458.343:311): avc: denied { append } for pid=5990 comm="syz.4.51" name="001" dev="devtmpfs" ino=744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 94.708878][ T5996] netlink: 8 bytes leftover after parsing attributes in process `syz.2.54'. [ 94.771823][ T30] audit: type=1400 audit(1786933458.903:312): avc: denied { unmount } for pid=5593 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 96.103818][ T6000] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 96.119303][ T30] audit: type=1400 audit(1786933460.243:313): avc: denied { unmount } for pid=5592 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 96.665435][ T6001] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 96.696228][ T6001] iommufd_mock iommufd_mock2: Adding to iommu group 2 [ 96.925861][ T30] audit: type=1400 audit(1786933461.053:314): avc: denied { create } for pid=6011 comm="syz.2.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 96.984886][ T5705] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 97.026917][ T30] audit: type=1400 audit(1786933461.073:315): avc: denied { bind } for pid=6011 comm="syz.2.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 97.126939][ T24] IPVS: starting estimator thread 0... [ 97.135577][ T30] audit: type=1400 audit(1786933461.073:316): avc: denied { setopt } for pid=6011 comm="syz.2.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 97.196009][ T30] audit: type=1400 audit(1786933461.073:317): avc: denied { accept } for pid=6011 comm="syz.2.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 97.252729][ T6019] IPVS: using max 45 ests per chain, 108000 per kthread [ 97.259867][ T30] audit: type=1400 audit(1786933461.073:318): avc: denied { write } for pid=6011 comm="syz.2.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 97.267943][ T5705] usb 1-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 97.299805][ T30] audit: type=1400 audit(1786933461.133:319): avc: denied { read } for pid=6011 comm="syz.2.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 97.356712][ T5705] usb 1-1: config 1 has an invalid interface number: 7 but max is 0 [ 97.464960][ T5705] usb 1-1: config 1 has no interface number 0 [ 97.531764][ T5705] usb 1-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 97.645187][ T5705] usb 1-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 97.735632][ T5705] usb 1-1: config 1 interface 7 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 98.073915][ T6023] netlink: 'syz.1.60': attribute type 4 has an invalid length. [ 98.154576][ T30] audit: type=1400 audit(1786933462.173:320): avc: denied { create } for pid=6022 comm="syz.3.61" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 98.329295][ T5705] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.350129][ T5705] usb 1-1: Product: syz [ 98.365145][ T5705] usb 1-1: Manufacturer: syz [ 98.369777][ T5705] usb 1-1: SerialNumber: syz [ 98.378536][ T6007] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 98.582974][ T5705] usb 1-1: Error in usbnet_get_endpoints (-71) [ 98.592765][ T5784] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 98.601349][ T5705] usb 1-1: USB disconnect, device number 3 [ 98.620941][ T4913] Bluetooth: hci1: command 0x0406 tx timeout [ 98.660561][ T2159] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 98.668423][ T6007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 98.682352][ T6007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 98.752324][ T5784] usb 4-1: not running at top speed; connect to a high speed hub [ 98.770045][ T5784] usb 4-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 98.785454][ T5784] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 98.785788][ T6007] ================================================================== [ 98.800187][ T6031] netlink: 16 bytes leftover after parsing attributes in process `syz.2.62'. [ 98.803605][ T6007] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 98.815344][ T5784] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.819274][ T6007] Read of size 1 at addr ffff88802d1090e0 by task syz.0.52/6007 [ 98.819292][ T6007] [ 98.819306][ T6007] CPU: 1 UID: 0 PID: 6007 Comm: syz.0.52 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.819328][ T6007] Tainted: [L]=SOFTLOCKUP [ 98.819333][ T6007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 98.819343][ T6007] Call Trace: [ 98.819349][ T6007] [ 98.819356][ T6007] dump_stack_lvl+0x100/0x190 [ 98.819379][ T6007] print_report+0x13d/0x4b0 [ 98.819401][ T6007] ? __virt_addr_valid+0x239/0x430 [ 98.819422][ T6007] ? string+0x471/0x4d0 [ 98.819436][ T6007] kasan_report+0xdf/0x1c0 [ 98.819458][ T6007] ? string+0x471/0x4d0 [ 98.819474][ T6007] string+0x471/0x4d0 [ 98.819488][ T6007] ? __pfx_string+0x10/0x10 [ 98.819505][ T6007] vsnprintf+0x422/0x1300 [ 98.819524][ T6007] ? __pfx_vsnprintf+0x10/0x10 [ 98.819539][ T6007] ? kernel_text_address+0x8d/0x100 [ 98.819557][ T6007] ? __kernel_text_address+0xd/0x30 [ 98.819573][ T6007] ? unwind_get_return_address+0x59/0xa0 [ 98.819591][ T6007] snprintf+0xc7/0x100 [ 98.819607][ T6007] ? __pfx_snprintf+0x10/0x10 [ 98.819624][ T6007] ? stack_trace_save+0x8e/0xc0 [ 98.819640][ T6007] ? __pfx_stack_trace_save+0x10/0x10 [ 98.819656][ T6007] ? stack_depot_save_flags+0x27/0x9d0 [ 98.819679][ T6007] dev_vprintk_emit+0x375/0x3e0 [ 98.819700][ T6007] ? __pfx_dev_vprintk_emit+0x10/0x10 [ 98.819717][ T6007] ? raw_ioctl+0x13a5/0x2b80 [ 98.819744][ T6007] dev_printk_emit+0xd2/0x10d [ 98.819762][ T6007] ? __pfx_dev_printk_emit+0x10/0x10 [ 98.819781][ T6007] ? __lock_acquire+0x49f/0x1a40 [ 98.819803][ T6007] __dev_printk+0xcb/0x100 [ 98.819821][ T6007] _dev_err+0xef/0x127 [ 98.819839][ T6007] ? __pfx__dev_err+0x10/0x10 [ 98.819857][ T6007] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 98.819879][ T6007] ? dummy_enable+0x354/0x960 [ 98.819900][ T6007] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 98.819920][ T6007] raw_ioctl.cold+0x10e/0x3a6 [ 98.819943][ T6007] ? __pfx_raw_ioctl+0x10/0x10 [ 98.819965][ T6007] ? selinux_file_ioctl+0x13b/0x290 [ 98.819988][ T6007] ? selinux_file_ioctl+0xb6/0x290 [ 98.820011][ T6007] ? __pfx_raw_ioctl+0x10/0x10 [ 98.820033][ T6007] __x64_sys_ioctl+0x18e/0x210 [ 98.820056][ T6007] do_syscall_64+0x115/0x870 [ 98.820073][ T6007] ? clear_bhb_loop+0x70/0xc0 [ 98.820090][ T6007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.820111][ T6007] RIP: 0033:0x7fd98e79dd6b [ 98.820124][ T6007] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 98.820139][ T6007] RSP: 002b:00007fd98f6dbef0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 98.820154][ T6007] RAX: ffffffffffffffda RBX: 00007fd98eb50320 RCX: 00007fd98e79dd6b [ 98.820164][ T6007] RDX: 00007fd98eb5034c RSI: 0000000040095505 RDI: 0000000000000004 [ 98.820173][ T6007] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000007 [ 98.820182][ T6007] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 98.820191][ T6007] R13: 00007fd98eb50530 R14: 0000000000000000 R15: 00007fd98eb5034e [ 98.820206][ T6007] [ 98.820211][ T6007] [ 98.838392][ T5784] usb 4-1: Product: syz [ 98.847816][ T6007] Allocated by task 1: [ 98.847832][ T6007] kasan_save_stack+0x30/0x50 [ 98.847856][ T6007] kasan_save_track+0x14/0x30 [ 98.847872][ T6007] __kasan_kmalloc+0xaa/0xb0 [ 98.847888][ T6007] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 98.847908][ T6007] kvasprintf+0xbc/0x150 [ 98.847929][ T6007] kvasprintf_const+0x66/0x1a0 [ 98.847949][ T6007] kobject_set_name_vargs+0x5a/0x140 [ 98.847971][ T6007] dev_set_name+0xc7/0x100 [ 98.847984][ T6007] usb_add_gadget+0x520/0x920 [ 99.184571][ T6007] usb_add_gadget_udc+0x26/0x70 [ 99.189415][ T6007] dummy_udc_probe+0x69e/0x960 [ 99.194154][ T6007] platform_probe+0x106/0x1d0 [ 99.198812][ T6007] really_probe+0x241/0xa60 [ 99.203297][ T6007] __driver_probe_device+0x20e/0x450 [ 99.208576][ T6007] driver_probe_device+0x4a/0x140 [ 99.213580][ T6007] __device_attach_driver+0x1df/0x320 [ 99.218939][ T6007] bus_for_each_drv+0x159/0x1e0 [ 99.223768][ T6007] __device_attach+0x1e4/0x4d0 [ 99.228512][ T6007] device_initial_probe+0xaf/0xd0 [ 99.233520][ T6007] bus_probe_device+0x64/0x160 [ 99.238264][ T6007] device_add+0x121d/0x1970 [ 99.242749][ T6007] platform_device_add+0x35a/0x800 [ 99.248062][ T6007] dummy_hcd_init+0x803/0xc00 [ 99.252729][ T6007] do_one_initcall+0x11d/0x700 [ 99.257487][ T6007] kernel_init_freeable+0x6ea/0x7b0 [ 99.262664][ T6007] kernel_init+0x1f/0x1e0 [ 99.266987][ T6007] ret_from_fork+0x72b/0xd50 [ 99.271564][ T6007] ret_from_fork_asm+0x1a/0x30 [ 99.276311][ T6007] [ 99.278609][ T6007] Freed by task 6031: [ 99.282561][ T6007] kasan_save_stack+0x30/0x50 [ 99.287233][ T6007] kasan_save_track+0x14/0x30 [ 99.291890][ T6007] kasan_save_free_info+0x3b/0x70 [ 99.296890][ T6007] __kasan_slab_free+0x5f/0x80 [ 99.301637][ T6007] kfree+0x22b/0x6c0 [ 99.305510][ T6007] kfree_const+0x5a/0x70 [ 99.309731][ T6007] kobject_put+0x218/0x640 [ 99.314130][ T6007] put_device+0x1f/0x30 [ 99.318264][ T6007] platform_remove+0x5f/0x80 [ 99.322844][ T6007] device_remove+0xcb/0x180 [ 99.327328][ T6007] device_release_driver_internal+0x44e/0x620 [ 99.333376][ T6007] unbind_store+0xf8/0x110 [ 99.337769][ T6007] drv_attr_store+0x74/0xb0 [ 99.342255][ T6007] sysfs_kf_write+0xf2/0x150 [ 99.346822][ T6007] kernfs_fop_write_iter+0x3e0/0x5f0 [ 99.352092][ T6007] vfs_write+0x6ac/0x1050 [ 99.356395][ T6007] ksys_write+0x12a/0x250 [ 99.360701][ T6007] do_syscall_64+0x115/0x870 [ 99.365271][ T6007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.371142][ T6007] [ 99.373445][ T6007] The buggy address belongs to the object at ffff88802d1090e0 [ 99.373445][ T6007] which belongs to the cache kmalloc-16 of size 16 [ 99.387315][ T6007] The buggy address is located 0 bytes inside of [ 99.387315][ T6007] freed 16-byte region [ffff88802d1090e0, ffff88802d1090f0) [ 99.400825][ T6007] [ 99.403129][ T6007] The buggy address belongs to the physical page: [ 99.409513][ T6007] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d109 [ 99.418249][ T6007] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 99.425333][ T6007] page_type: f5(slab) [ 99.429292][ T6007] raw: 00fff00000000000 ffff88801c022640 dead000000000100 dead000000000122 [ 99.437864][ T6007] raw: 0000000000000000 0000000800800080 00000000f5000000 0000000000000000 [ 99.446430][ T6007] page dumped because: kasan: bad access detected [ 99.452817][ T6007] page_owner tracks the page as allocated [ 99.458504][ T6007] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8461766621, free_ts 8461250068 [ 99.478277][ T6007] post_alloc_hook+0xfd/0x120 [ 99.482938][ T6007] get_page_from_freelist+0xf48/0x3530 [ 99.488389][ T6007] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 99.494271][ T6007] new_slab+0xa2/0x640 [ 99.498317][ T6007] refill_objects+0xe3/0x410 [ 99.502883][ T6007] __pcs_replace_empty_main+0x376/0x680 [ 99.508410][ T6007] __kmalloc_node_track_caller_noprof+0x679/0x830 [ 99.514815][ T6007] kvasprintf+0xbc/0x150 [ 99.519043][ T6007] kvasprintf_const+0x66/0x1a0 [ 99.523788][ T6007] kobject_set_name_vargs+0x5a/0x140 [ 99.529070][ T6007] dev_set_name+0xc7/0x100 [ 99.533465][ T6007] usb_set_configuration+0xb15/0x1c60 [ 99.538816][ T6007] usb_generic_driver_probe+0xa1/0xe0 [ 99.544167][ T6007] usb_probe_device+0xef/0x400 [ 99.548912][ T6007] really_probe+0x241/0xa60 [ 99.553394][ T6007] __driver_probe_device+0x20e/0x450 [ 99.558661][ T6007] page last free pid 95 tgid 95 stack trace: [ 99.564619][ T6007] __free_frozen_pages+0x79f/0x1090 [ 99.569804][ T6007] __kasan_populate_vmalloc+0x1ea/0x210 [ 99.575336][ T6007] alloc_vmap_area+0x95d/0x2bb0 [ 99.580171][ T6007] __get_vm_area_node+0x1ca/0x330 [ 99.585184][ T6007] __vmalloc_node_range_noprof+0x228/0x1630 [ 99.591065][ T6007] __vmalloc_node_noprof+0xad/0xf0 [ 99.596158][ T6007] copy_process+0x7fb/0x8030 [ 99.600729][ T6007] kernel_clone+0x176/0x9d0 [ 99.605226][ T6007] user_mode_thread+0xcc/0x110 [ 99.609972][ T6007] call_usermodehelper_exec_work+0xcb/0x180 [ 99.615844][ T6007] process_one_work+0xa23/0x1940 [ 99.620758][ T6007] worker_thread+0x5ef/0xe50 [ 99.625328][ T6007] kthread+0x370/0x450 [ 99.629371][ T6007] ret_from_fork+0x72b/0xd50 [ 99.633945][ T6007] ret_from_fork_asm+0x1a/0x30 [ 99.638693][ T6007] [ 99.640995][ T6007] Memory state around the buggy address: [ 99.646599][ T6007] ffff88802d108f80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 99.654635][ T6007] ffff88802d109000: 00 04 fc fc 00 00 fc fc 00 04 fc fc 00 04 fc fc [ 99.662677][ T6007] >ffff88802d109080: 00 04 fc fc 00 01 fc fc 00 01 fc fc fa fb fc fc [ 99.670713][ T6007] ^ [ 99.677879][ T6007] ffff88802d109100: 00 04 fc fc 00 04 fc fc fa fb fc fc fa fb fc fc [ 99.685918][ T6007] ffff88802d109180: 00 04 fc fc 00 00 fc fc 00 04 fc fc 00 04 fc fc [ 99.693953][ T6007] ================================================================== [ 99.701991][ T6007] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 99.709175][ T6007] CPU: 1 UID: 0 PID: 6007 Comm: syz.0.52 Tainted: G L syzkaller #0 PREEMPT(full) [ 99.719828][ T6007] Tainted: [L]=SOFTLOCKUP [ 99.724128][ T6007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 99.734167][ T6007] Call Trace: [ 99.737427][ T6007] [ 99.740343][ T6007] dump_stack_lvl+0x100/0x190 [ 99.745030][ T6007] vpanic+0x552/0x970 [ 99.748994][ T6007] ? __pfx_vpanic+0x10/0x10 [ 99.753474][ T6007] ? __pfx_vprintk_emit+0x10/0x10 [ 99.758497][ T6007] ? string+0x471/0x4d0 [ 99.762634][ T6007] panic+0xd1/0xe0 [ 99.766341][ T6007] ? __pfx_panic+0x10/0x10 [ 99.770740][ T6007] ? end_report.part.0+0x23/0x90 [ 99.775666][ T6007] ? rcu_is_watching+0x12/0xc0 [ 99.780419][ T6007] ? end_report.part.0+0x23/0x90 [ 99.785364][ T6007] check_panic_on_warn.cold+0x19/0x34 [ 99.790719][ T6007] end_report.part.0+0x3a/0x90 [ 99.795474][ T6007] kasan_report.cold+0xe/0x18 [ 99.800136][ T6007] ? string+0x471/0x4d0 [ 99.804274][ T6007] string+0x471/0x4d0 [ 99.808237][ T6007] ? __pfx_string+0x10/0x10 [ 99.812722][ T6007] vsnprintf+0x422/0x1300 [ 99.817041][ T6007] ? __pfx_vsnprintf+0x10/0x10 [ 99.821787][ T6007] ? kernel_text_address+0x8d/0x100 [ 99.826970][ T6007] ? __kernel_text_address+0xd/0x30 [ 99.832173][ T6007] ? unwind_get_return_address+0x59/0xa0 [ 99.837790][ T6007] snprintf+0xc7/0x100 [ 99.841858][ T6007] ? __pfx_snprintf+0x10/0x10 [ 99.846691][ T6007] ? stack_trace_save+0x8e/0xc0 [ 99.851521][ T6007] ? __pfx_stack_trace_save+0x10/0x10 [ 99.856875][ T6007] ? stack_depot_save_flags+0x27/0x9d0 [ 99.862325][ T6007] dev_vprintk_emit+0x375/0x3e0 [ 99.867163][ T6007] ? __pfx_dev_vprintk_emit+0x10/0x10 [ 99.872518][ T6007] ? raw_ioctl+0x13a5/0x2b80 [ 99.877102][ T6007] dev_printk_emit+0xd2/0x10d [ 99.881759][ T6007] ? __pfx_dev_printk_emit+0x10/0x10 [ 99.887030][ T6007] ? __lock_acquire+0x49f/0x1a40 [ 99.891955][ T6007] __dev_printk+0xcb/0x100 [ 99.896354][ T6007] _dev_err+0xef/0x127 [ 99.900406][ T6007] ? __pfx__dev_err+0x10/0x10 [ 99.905069][ T6007] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 99.910426][ T6007] ? dummy_enable+0x354/0x960 [ 99.915089][ T6007] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 99.920969][ T6007] raw_ioctl.cold+0x10e/0x3a6 [ 99.925633][ T6007] ? __pfx_raw_ioctl+0x10/0x10 [ 99.930387][ T6007] ? selinux_file_ioctl+0x13b/0x290 [ 99.935574][ T6007] ? selinux_file_ioctl+0xb6/0x290 [ 99.940847][ T6007] ? __pfx_raw_ioctl+0x10/0x10 [ 99.945599][ T6007] __x64_sys_ioctl+0x18e/0x210 [ 99.950361][ T6007] do_syscall_64+0x115/0x870 [ 99.954940][ T6007] ? clear_bhb_loop+0x70/0xc0 [ 99.959600][ T6007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.965486][ T6007] RIP: 0033:0x7fd98e79dd6b [ 99.969884][ T6007] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 99.989479][ T6007] RSP: 002b:00007fd98f6dbef0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 99.997876][ T6007] RAX: ffffffffffffffda RBX: 00007fd98eb50320 RCX: 00007fd98e79dd6b [ 100.005829][ T6007] RDX: 00007fd98eb5034c RSI: 0000000040095505 RDI: 0000000000000004 [ 100.013778][ T6007] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000007 [ 100.021728][ T6007] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 100.029764][ T6007] R13: 00007fd98eb50530 R14: 0000000000000000 R15: 00007fd98eb5034e [ 100.037830][ T6007] [ 100.041027][ T6007] Kernel Offset: disabled [ 100.045323][ T6007] Rebooting in 86400 seconds..