last executing test programs: 4m2.311794117s ago: executing program 2 (id=617): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @thr={&(0x7f0000000080)="72966cd5c8aadcc866d48ccb254412ab82330dc109be8c978d3469c8b80f39029a638bb7f1d632bac03e38dba0133dd73b80a068d0a08a662d6750e7188bd276bde1135af809e47dee68b1457d68ac154fad563f009b64480aedd74de77db9df3199825bd2e2413e8098cf4ddccbdc91462a560a0fe773ff2179043a08bf6397f0c0ef41021fd99ca5d26894c2d34cf9365e08a44979f0f7133e3b08dcf6e93492fe9b1c22fd047760dd4351beb9aabb51a82902efb1ee9bc88c73cd95da49240a44d9d5800c3fc2e273e93fffc216d1edfd5f56caaf27ed83", &(0x7f0000000240)="cf0ac9d1"}}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x1, 0x0, 0x3ed4, 0x5}) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffe, 0x0, 0x0, 0x5}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000300)=ANY=[@ANYBLOB="b7000000001f0000bfa30000000000000703000018feffff620af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000004d44000000000000630a00fe000000007933000000000000b5040000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727de79be80fb4493a0ee2e85f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fd21e3587b9d9e878c86ba9b66c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffdbb}, 0x48) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) rt_sigtimedwait(&(0x7f0000000180)={[0xffffffffffffff7c]}, &(0x7f00000001c0), 0x0, 0x8) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x0, 0x7fff8000}]}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) close_range(r2, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000004400)=[{{&(0x7f0000000280)=@pptp={0x18, 0x2, {0x0, @multicast2}}, 0x80, &(0x7f0000001140)=[{&(0x7f0000000e40)=""/196, 0xc4}, {&(0x7f0000000f40)=""/49, 0x31}, {&(0x7f0000000f80)=""/226, 0xe2}, {&(0x7f0000001080)=""/158, 0x9e}], 0x4}, 0x8}, {{&(0x7f00000011c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000001280)=[{&(0x7f0000001240)=""/47, 0x2f}], 0x1}, 0x5}, {{&(0x7f00000012c0)=@isdn, 0x80, &(0x7f0000001400)=[{&(0x7f0000001340)=""/158, 0x9e}], 0x1, &(0x7f0000001440)=""/233, 0xe9}, 0xc}, {{&(0x7f0000001540)=@l2tp6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f0000002880)=[{&(0x7f00000015c0)=""/102, 0x66}, {&(0x7f0000001640)=""/73, 0x49}, {&(0x7f0000001880)=""/4096, 0xfffffc1a}, {&(0x7f00000016c0)=""/247, 0xf7}], 0x4, &(0x7f00000028c0)=""/64, 0x40}, 0x80}, {{0x0, 0x0, &(0x7f0000003cc0)=[{&(0x7f0000002900)=""/147, 0x93}, {&(0x7f00000029c0)=""/4, 0x4}, {&(0x7f0000002a00)=""/147, 0x93}, {&(0x7f0000002ac0)=""/50, 0x32}, {&(0x7f0000002b00)=""/214, 0xd6}, {&(0x7f0000002c00)=""/4096, 0x1000}, {&(0x7f0000003c00)=""/123, 0x7b}, {&(0x7f0000003c80)=""/54, 0x36}], 0x8, &(0x7f0000003d40)=""/160, 0xa0}, 0x9}, {{&(0x7f0000003e00)=@rc, 0x80, &(0x7f0000004380)=[{&(0x7f0000003e80)=""/195, 0xc3}, {&(0x7f0000003f80)=""/9, 0x9}, {&(0x7f0000003fc0)=""/60, 0x3c}, {&(0x7f0000004000)=""/172, 0xac}, {&(0x7f00000040c0)=""/8, 0x8}, {&(0x7f0000004100)=""/214, 0xd6}, {&(0x7f0000004200)=""/140, 0x8c}, {&(0x7f00000042c0)=""/141, 0x8d}], 0x8}, 0x3}], 0x6, 0x2100, 0x0) 3m59.051940788s ago: executing program 2 (id=628): syz_emit_ethernet(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x2c240, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000080), 0x8, 0x122c42) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000000440)={r3, 0x2000, {0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, "339f020bbe78b39843d601010000000000080d0ec0c1b4e9b1c4369d03741250ceaac50104000041dd17c18e8438ef2a565ef1e833236500", "a1163939c787a16c1ca43f8539f3d3289737f0374c72a964a0193b3e8772fd29f35239d200", "24431a1e77a68e174f000000000000000010e200"}}) preadv2(r4, &(0x7f0000000200)=[{&(0x7f0000000000)=""/17, 0x11}], 0x1, 0xffffffff, 0x7, 0x8) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c0100009a528729a6135d699d2535b7733c834080c1ca212e1d45ea6e629dfbdee9060000009d4e9d675fbd55c6388e90210c793758a8fb2c71b602e0f3bf502c5719e387bbaa5c7df66d4a749856a36924016ffc78d61753b74cfa7a40702a9889872fe69dad0525c1ee39aaeb9c42fa9503a81421f0d6e54896f954f85ac9fecef13ceec460641c73f79ba43d1b50f9d4f54f3f0f33070b684b342d2044d075cc554ceb1a72f73062a16aacd58d47994806042f47bcf0f682805aaa9504651309a24d2fb7d601a864741de3f3bd3f0ba9b0181ac755b88efbd6804fa6926b47d79d138d980bdf63a5c1a54e162fdbebb6c964814b110017b89c5b908f5b1ef6a3448a13fa0ce069590075fa12a912cf76b164b37a8e45968b8376e0d9814c51e372974ef0ce4f59dfbd2f8ecbacef45532c79cdb92932b634b3fb227413c2e81d8775ab17f9349b8e5e0bc383ad4fd9ed8924002f48c21b1475bc8a93ce9b68b1403e35ab8ab30d94a894be0a22c6172e2644dff10e43e7154e7aca4b04edab74909a58f9e505ae4240f6baecb5be4932a3b393cbf81c101d4410a90856c8941f5da70c9028214a11e5dbefdc610d0e73bab301d824070a1ddee14c894b9499578b29c84610850b2cca906832ffff30eb6fc672d29a", @ANYRES16=0x0, @ANYBLOB="04002dbd7000fedbdf2567000000080001006500000008000300", @ANYRES32=r7, @ANYBLOB="8200c50028d0ed3141a86f4bb423402bd06efc195b75d0d7cfe48ab501caef1c44e5f028f2e509f202a667a55699c5efbff7d2611b0e42bd59d9ee24ab162f87e47da81f8b0147f03404744ac7454e7029247e0450e476841821fa33ad48cfcc8882d9c53f10521965b6ba3bdf74892601493ec5ebc0449c36dbd0f38b9cd0d6f48900000800c300080000000800c400040000001f00c5007240cd556b219704343e68feafcc6f46a9310275911cbdc24b2710007a00c500edb5207e86b03206d2b060b08f2497c662a9a6f57b3b348e6eb8879e04612ee73e7f0d029d2614ae079ea9f207d7c35e058bf9da8e21ef596f81b778090da6a95e8bf44f341b357cd76c67a1db17807f172df6bdb6733c9591b1af599d8027efd4bf0cdf08931fdee0f84132dbd7dd48b71f44c5930100000800c3000f000000"], 0x15c}, 0x1, 0x0, 0x0, 0x4}, 0x30000010) socket$kcm(0x1e, 0x5, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000003c0)=0x11) connect$qrtr(0xffffffffffffffff, &(0x7f0000000040), 0xc) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100003f3fdc20221802324a13010203010902"], 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000900)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c0014800800", @ANYRES8=r9], 0x34}, 0x1, 0x0, 0x0, 0x4048010}, 0x8000) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r8, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000", @ANYRES16=r11, @ANYBLOB="0d0726bd7000fbdbdf250408"], 0x14}, 0x1, 0x0, 0x0, 0x4040}, 0x8000) 3m55.434686645s ago: executing program 2 (id=637): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) getpid() (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r1, 0x0, 0x0, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) socket$inet6_sctp(0xa, 0x1, 0x84) openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) (async) bpf$MAP_CREATE(0x0, 0x0, 0x50) (async) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r2, &(0x7f00000001c0)='\\', 0x1) (async) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) ioctl$SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0xa2240, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1d) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) setrlimit(0xf, 0x0) (async) syz_clone(0x2180, 0x0, 0xe4, 0x0, 0x0, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) (async) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) (async) get_mempolicy(0x0, 0x0, 0x3, &(0x7f0000003000/0x2000)=nil, 0x3) (async) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) 3m55.044172433s ago: executing program 2 (id=639): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4048084) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x3}}, 0x0) write$binfmt_misc(r0, &(0x7f0000000000), 0xfffffecc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) r4 = syz_open_dev$radio(&(0x7f0000002100), 0x2, 0x2) ioctl$VIDIOC_S_FREQUENCY(r4, 0x402c5639, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r5 = socket$inet6(0xa, 0x1, 0x0) r6 = dup2(r5, r5) setresuid(0xee01, 0x0, 0x0) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(r7, 0x6, 0x0, 0x0) ioctl$sock_inet6_SIOCDELRT(r6, 0x890c, &(0x7f00000000c0)={@remote, @private0, @empty, 0x40003, 0x40, 0x5, 0x100, 0x0, 0x590043}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040), r8) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18180000000000000000000001000100811212000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890c, 0x0) sendmsg$GTP_CMD_NEWPDP(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x24, r9, 0x1, 0x0, 0x0, {0x3}, [@GTPA_LINK={0x8}, @GTPA_VERSION={0x8}]}, 0x24}}, 0x0) 3m52.728601211s ago: executing program 2 (id=643): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x12, 0x4, 0x4, 0x2, 0x4, 0xffffffffffffffff, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, &(0x7f0000000040)}, 0x20) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x9, &(0x7f0000000040)={0x0, 0x20c8a1, 0x1c881, 0x8, 0xd1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@getqdisc={0x28, 0x26, 0x4, 0x70bd2a, 0x9, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0x1, 0xfff3}, {0xfff7}}, [{0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x20008001) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x2d, 0x0, 0x1f, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x4) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) 3m52.549545785s ago: executing program 2 (id=644): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000380)={'gretap0\x00'}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000b32000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000001c0)=0x40) timer_create(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x4d, 0x40032, 0xf7, 0x2, 0x80, 0x3, 0x7, 0xc, 0x66, 0x4, [0x20040, 0x9, 0x10, 0x40, 0x6, 0x8, 0x5, 0x2174]}}) timer_delete(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x5, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) socket$kcm(0x2b, 0x1, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000e40)=@mangle={'mangle\x00', 0x64, 0x8000000, 0x500, 0x340, 0x0, 0x0, 0x1a0, 0x270, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'veth1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [], [], 'tunl0\x00', 'bridge_slave_1\x00', {}, {0xff}}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x340}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r4, 0x80845663, &(0x7f00000004c0)) madvise(&(0x7f0000735000/0x1000)=nil, 0x1000, 0x65) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="640000000206050000000000000000000000000014000780080011408000000005001500030000000500010006000000050005000200000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574000000002d345d0cbfb92006a12874a9bf94cf262a39856a5938d059c36506ca0a66293f6d591988cb96cfc37dce50d800aa0949ee21a7375da3171c0dfeedb2a3c65c397c865bb91d9439303c08dbceb5d4659fa892388fc86b00ca1507cb073805668f826654462fc7d6f33e2c5facbd0a125cffffafdd16bc10c9bc26e22e9c3b4642654aaa29cadfbcc3d7572d0aa760c4101c4aacfe3686ac0480710c4315b420288d3b707901b6d24020bdd29441fb6310776a63c93dbda8d2e21fec24a8d70e65ca8ca5e89e4f303f2d0e3cf2c765f027b9a6db4910fae6"], 0x64}}, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0) ioctl$BLKZEROOUT(r6, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) r7 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r7, 0x89f8, &(0x7f0000000480)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x80, 0x0, 0x3, 0x8, {{0x9, 0x4, 0x0, 0x33, 0x24, 0x65, 0x0, 0x4, 0x29, 0x0, @multicast2, @multicast1, {[@timestamp_prespec={0x44, 0xc, 0x3c, 0x3, 0x2, [{@empty, 0x8}]}, @noop, @ssrr={0x89, 0x3, 0xb5}]}}}}}) add_key(&(0x7f00000002c0)='asymmetric\x00', &(0x7f0000000340)={'syz', 0x3}, &(0x7f0000000580)="27bbb1597dc47f6337451576aeb8dfb5bd94109520e8e86f17154f1f9cf65ecb99c8d4a09b832e2b06377bd6f3465578f7e4bd03f416c956da02a542dee2d985d0a7b21a2186c034b3296ef41bac2493e03b67e25e273a2f3909399dcfc7b53660e2", 0x62, 0xfffffffffffffff9) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000000)={'ip6_vti0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x7e, 0x21, 0x1, 0x60, @dev={0xfe, 0x80, '\x00', 0x2a}, @loopback={0x300, 0x460c6}, 0x1, 0x8, 0x25a1, 0x40}}) 3m37.224029291s ago: executing program 32 (id=644): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000380)={'gretap0\x00'}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000b32000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000001c0)=0x40) timer_create(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x4d, 0x40032, 0xf7, 0x2, 0x80, 0x3, 0x7, 0xc, 0x66, 0x4, [0x20040, 0x9, 0x10, 0x40, 0x6, 0x8, 0x5, 0x2174]}}) timer_delete(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x5, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) socket$kcm(0x2b, 0x1, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000e40)=@mangle={'mangle\x00', 0x64, 0x8000000, 0x500, 0x340, 0x0, 0x0, 0x1a0, 0x270, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'veth1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [], [], 'tunl0\x00', 'bridge_slave_1\x00', {}, {0xff}}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x340}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r4, 0x80845663, &(0x7f00000004c0)) madvise(&(0x7f0000735000/0x1000)=nil, 0x1000, 0x65) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="640000000206050000000000000000000000000014000780080011408000000005001500030000000500010006000000050005000200000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574000000002d345d0cbfb92006a12874a9bf94cf262a39856a5938d059c36506ca0a66293f6d591988cb96cfc37dce50d800aa0949ee21a7375da3171c0dfeedb2a3c65c397c865bb91d9439303c08dbceb5d4659fa892388fc86b00ca1507cb073805668f826654462fc7d6f33e2c5facbd0a125cffffafdd16bc10c9bc26e22e9c3b4642654aaa29cadfbcc3d7572d0aa760c4101c4aacfe3686ac0480710c4315b420288d3b707901b6d24020bdd29441fb6310776a63c93dbda8d2e21fec24a8d70e65ca8ca5e89e4f303f2d0e3cf2c765f027b9a6db4910fae6"], 0x64}}, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0) ioctl$BLKZEROOUT(r6, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) r7 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r7, 0x89f8, &(0x7f0000000480)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x80, 0x0, 0x3, 0x8, {{0x9, 0x4, 0x0, 0x33, 0x24, 0x65, 0x0, 0x4, 0x29, 0x0, @multicast2, @multicast1, {[@timestamp_prespec={0x44, 0xc, 0x3c, 0x3, 0x2, [{@empty, 0x8}]}, @noop, @ssrr={0x89, 0x3, 0xb5}]}}}}}) add_key(&(0x7f00000002c0)='asymmetric\x00', &(0x7f0000000340)={'syz', 0x3}, &(0x7f0000000580)="27bbb1597dc47f6337451576aeb8dfb5bd94109520e8e86f17154f1f9cf65ecb99c8d4a09b832e2b06377bd6f3465578f7e4bd03f416c956da02a542dee2d985d0a7b21a2186c034b3296ef41bac2493e03b67e25e273a2f3909399dcfc7b53660e2", 0x62, 0xfffffffffffffff9) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000000)={'ip6_vti0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x7e, 0x21, 0x1, 0x60, @dev={0xfe, 0x80, '\x00', 0x2a}, @loopback={0x300, 0x460c6}, 0x1, 0x8, 0x25a1, 0x40}}) 12.076473735s ago: executing program 5 (id=1266): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000580)=ANY=[@ANYBLOB], 0x5c}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, &(0x7f00000014c0)=""/145, &(0x7f0000000000)=0x91) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x40100001, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r5 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c00)={0x14, 0x453, 0x4, 0x70bd39, 0x255fdbfd, "bf"}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000002c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r2, 0xc06864a2, &(0x7f0000000300)={&(0x7f0000001180)=[r10], 0x1, r8, r9, 0x3, 0x0, 0x3, 0x802, {0xac7c, 0x1, 0x7, 0x69, 0xf4b, 0x2, 0x2, 0x45, 0x412f, 0xe154, 0x1000, 0x7, 0xb2bf, 0x3, "fe1d00003413000000000000000caa000000090000000000000004b427180010"}}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) r11 = socket$inet_sctp(0x2, 0x5, 0x84) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x408000, 0x21) sendmsg$inet_sctp(r11, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="20000000000000db0db69b00"/28, @ANYRES32=0x0], 0x20, 0x4048800}, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[], 0x0) 9.240198394s ago: executing program 1 (id=1275): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000003e00070100000000fcdbdf25047c000004000000140001800674405c57"], 0x2c}}, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000bc0)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x40, 0x3a, 0x0, @remote, @local, {[], @pkt_toobig={0x3, 0x2, 0x0, 0x0, {0x0, 0x6, "020810", 0xfffe, 0x11, 0x0, @private1, @empty, [@dstopts={0x0, 0x0, '\x00', [@pad1]}]}}}}}}}, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x8000, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000cc0)={0x6, 0x3, &(0x7f0000000b40)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) syz_usb_control_io(r1, &(0x7f0000000300)={0x2c, &(0x7f0000000100)={0x40, 0x8, 0x6a, {0x6a, 0xe, "bb074a5ebe68f2f92010caf5d75254f61a9f53b8d093ad5bdfa48ce3dd4e94ecaa130066acbd534f0f9feda850068dd7a4341f26cb8d24b3db8d0cb8c762fd4f8a6c21b86739012e0363731ed00ff71989c3d166c056051f9eccadde212f3f86a0860f48c5aab407"}}, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x827}}, &(0x7f00000001c0)={0x0, 0xf, 0x5c, {0x5, 0xf, 0x5c, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0xdc, "7769e97020dfa55e177b1d9b1f80635c"}, @ptm_cap={0x3}, @generic={0x22, 0x10, 0xa, "96722ef52107dbd135e3f1118efc80754317cf492555310c1e54bc7994d751"}, @ss_container_id={0x14, 0x10, 0x4, 0x90, "c37ad793cbc9904540e365eb1fbd92ca"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xc, 0x0, 0x8, 0x8000}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x0, 0x9, 0x3, "5967ea59", "ee696543"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x60, 0x4, 0x0, 0x3, 0xd0f, 0x7ff}}}, &(0x7f0000000a40)={0x84, &(0x7f00000003c0)={0x40, 0x4, 0x6c, "86817b9a03723382421001d78a372ecc945f72a29f1288679d71a213f0d4b2ba00c9868cd674eecaa81981ea65cb95722a7d2fcd2c57da9f7a64229893fb27af1538c07d8727df352be33c16e6d93dc1e7aadcf9a68d4fa20e539c20dbce5c024a68a367ab035e9ed46be735"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0xba}, &(0x7f00000006c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000700)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f0000000740)={0x20, 0x0, 0x4, {0x20, 0x20}}, &(0x7f0000000780)={0x40, 0x7, 0x2, 0xb492}, &(0x7f00000007c0)={0x40, 0x9, 0x1, 0xf}, &(0x7f0000000800)={0x40, 0xb, 0x2, "e44c"}, &(0x7f0000000840)={0x40, 0xf, 0x2}, &(0x7f0000000880)={0x40, 0x13, 0x6, @remote}, &(0x7f00000008c0)={0x40, 0x17, 0x6, @broadcast}, &(0x7f0000000900)={0x40, 0x19, 0x2, "97a9"}, &(0x7f0000000940)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000980)={0x40, 0x1c, 0x1, 0x7}, &(0x7f00000009c0)={0x40, 0x1e, 0x1, 0x5}, &(0x7f0000000a00)={0x40, 0x21, 0x1, 0x9}}) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) socket$nl_xfrm(0x10, 0x3, 0x6) 8.592687401s ago: executing program 3 (id=1278): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = syz_io_uring_setup(0x231, &(0x7f0000000340)={0x0, 0x3, 0x10101}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_WRITE={0x17, 0x0, 0x4004, @fd=r0, 0xffffffffffffffff, 0x0, 0x0, 0xe, 0x1}) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x20980, 0x0) pread64(r4, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@var, @volatile, @volatile, @volatile={0x0, 0x0, 0x0, 0x9, 0x2}]}}, 0x0, 0x4e}, 0x28) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) r9 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000000c0)=0x1) ioctl$TIOCSTI(r9, 0x5412, &(0x7f0000000040)=0x7d) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) r10 = add_key$user(&(0x7f0000000000), &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000480)="d25a9850a9a91163f76c5357f3bbadf2656e10d77f85d1028e60ab4e45b931e71645d3d636e82cfdeaadb674e1693d4a7de63820fefc4f787e272b122ebbff6884b3de82f8a3df9a2d0b67e46c349917110300b94240185146e52ac154013016", 0x60, 0xfffffffffffffffe) r11 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r10, r11, r10}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) io_uring_enter(r1, 0x7a98, 0x0, 0x0, 0x0, 0x0) 8.515620073s ago: executing program 5 (id=1279): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x54}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xb2, &(0x7f0000000140)=""/178, 0x2c8a4ed31704d5db, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bind$inet6(r5, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./file0/file0\x00', 0x0) write$FUSE_INIT(r0, &(0x7f0000000400)={0x50, 0x0, r6, {0x7, 0x1f, 0x1, 0x50, 0x0, 0x0, 0x5}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000008280)="cab1f92d585917232bcfa47f91900c936355a83b5a41f6f43bd8b0d1a1e13674b6a8596a8376e6851e0b96decd071d92ce4887ddad2b82183858d82c7d11948024607d92ec0f1c23a4e755f29fa557d1353a3ced680f530e822eed64b4d1aaf20d1320f3583cadb9dfde95993487f96bc290dc10cfccc5ec8ea864590fc1678b79b0a36c9668b27ae142d22c305496881af0d0546076ec21e31bdab2465010e779e7140036d2b12f59b971792cfed8d07f0b8ae13ee944268f573ec11c1b14d53880a64fd2fdbe981f4d9af8863191efc03a39d5a3f19badf65dd49443297b38bf0c009eafad5879cb78e63b00e961de7d7180941f0d1e87a2635294bcb4619e9d84be1816784325d23fcb9c66388b586c8e719f3edfa2aa37cc3f6511add854c10fe546d1c11f11eeaff24cecc0d47ec8fd336ec08470f06227e4a9410074a3d715eb6a697b04bdfeda0b6753d880d012ef8fada7f4ed649ca214609e31cace9a33937813012e4c1b787d8f71ce9b495a69e5c8810ff9954b7b96743dcdd7e52ebbf526f339d3c8ad2550326d3a396de5ac90787b352feabe013c4044ca813344c97f836851d6daf2de3a8b07a61d1052bd302a641706af7629a042dc2f0374671b287f1325763e1818beba9f7cab9e25d6f8749f7dea4c5ef684723d33938aca32e19b1c6a6237d899fb397e9023764b3f4d6399885533a802e4d3ca76f2e0234ed6d7257f8cebddc900af88cc21ee2816513045e92f71fc8523894d684678f17b5fdb4adeda98fc019c0ba05efeffeff3bbda1d6d84a98002a74237cb8d13cb30d8a9a7e47e4da8273a47df4e6ea53036b5b154b9597e6eb00fcad29ed04a820b1ce807bf1818344122a6f0aac52d24426feeba0af56925cb4a1e70a84251f2b4d4693e689518a0e159647b5b60a62db699a25275520c208652ce4401bb5dcd633e7c889758d3d213f4dbe69c9bb76e80b6e892bb5f5809e042ee5cb1982a2373b1886711d1e68d0bc3d4c9d69ac605432bf84cd81104e77c71cd7c0708244fc9428edd52f8cc8f3023b4c6d3bbad7a9b874111098c4652b34c428a8f789c5e5f3f84354ab7afec1a7b11d2a34771ebad2f15c169a61b431c8a1cca9ca1596fce65242d03814ebf977da9bbde5707b22b5002cce68bd0f6d196df341c96bd0cf0916b8775e75021663ea82c99a90b844cc5f8b6c56b21b1fbbbf6fb40ed0c29ee4ecc2998df2cbe3a4d75025ef73dd9f3aa5bc7aa694fe573a73453c9ff873d0a8840afd91be319181836de45260b4e252394edae58f840858a9b64f0ff37bb1820031e563250e62ceea5a7c4d2cd4d5d10e57176fcf576e774920db06b36ea02f9cae9c1087bd1866fb4bcf7fbf393093b339860a61c61248000a2a1bbc982fa691e311fa1bf2a38afdf08b574eed0df42bdc30c3db7cdcb71687f48070077f91fef93e8e47e248d3e53e8a79fcb5a8f8aa39b3bfa2dd88d5c5840d517ae8c132d423a37a8be3301d62a99753bc72f674205a11850e045430abbdc4e68223a93c76d6d2f1d646af10a15705793e2fc5a532af3dda88f52063a091f1f79cd5a5b23ea7742b149eab1aa43c21c2f15227a1f94b5580adbb1e1c49ade49d6e8b838cff43aa2426651817f479252c8ef7af9e4a5ad33839be6c15b50016c59f13c26cfca796cfc01207acc69e9d3952f6e71c975bc77d5a001f6f6c044770f54d86a4518a4898e3136988d643dd2de907859f0b4d4de2a2d461ba5e05cff49eda86772799b2e7947fdbb89fc5b0347e87f1b9dbb94842cc1457d07f3e0c41342510f5ccb551cdf0fcac1a758041bff75812de1b2abf341ed5f667c9b0581d2c33e0b17f1b46c2287399c62252edb9c1cf2b80b7a1b4c3c903aa4cf5332a2998b9072f61f589ae5df1168f8d18e98fce2bec1d5d876f9757017b73495a4e8f4f2423cde8875aa8c95a9ce180cac6690657b8a70e5541d5ef46575cd74e063759fe4889f4d9737a6c9732f8b7f7836508814093b9bdac5733938e761b3642910d4df0b646c1b9583a502246988e9ab78de3d011e8590e48eadfcdb70c8aad6dfbe1dbd3ef20d9ba393db4e6cf91e3bb4e84883c60dc20ed974a5decde12d3c5a1c9a00999f8eefc244465f518425820b9713cbfc6027f427b9cd8756edec5b3a0301a01ebb12c6d412ee3422aeb8b291619f62f4ce41511156f73e54b5097051ea777af7cb73b36e1274ce1a3892007466cc793eb0515b8984acb99c04c7eaa51e175bd73d99bc0c67c8ea84d808a7906a6ad330ba2c9651b2ab82d0781a969873dcddb068c15b7899fd560a1c3d44b34e81cce079c46fd86522052659e2c3151c79a8ccab1dfcdb91f53ca067ea1b2aa507278e4166e817eb0d7dea67cde1598a1bdb76a8caf82add2b43fdd10bf80b0d2f32365849c425d6ac3d2d88a76378d23961eb96c8422e785ea61f33e4daec02393d51f44b177755749fe84b43f5246d20177800af05752af524265f34f62bd5167fa647d2118aa905a1af53f07e7447bee29675cc23f547339af140c0818aa974ca16da33e767d508e4f56726c7076acce57a9957d08348ef84a39188e800ca44682fccaa9ee1b42e1aaf7738dced1dce3ef2dadfcba2863f36b5f8080ed22539b5176bc2c57e52e4cfde659c1ce9e179c79f85d60ca51c7453dad593190b19a1be8f5c5b0249d70079f10f9d0f07f25a98bd95e6e6f71101842b55347ee008d58522e8f7598c1636c58fd20984a6bb17fd47e7db4bc72854054e7900cac4174cf0b4eda2406842955fd8a2ba00ea4d490dbbab02d659cea4c449d9ee37c8f35daa4740b3273693ee2c1b00965a79d18ad98ae92bf2e1ea84ff1e6181937d38765cb353c6223ead1257d88a8844cb0be17aecc2dd56b78dcd6e2999fe695db248dd68275a5ad0f223a4629b17a040a766b2bd2376d77a422375de14a3daaf4fee92f23ca831452826bc66d0cee2049acbde07bdbb6ce228147f9ed4f9437301e8ca9e1ace0684700e9623a1534212d4c557712a3196d86c86077e97172d7e89436e95e1d7e7629d5bc908e346e504839498890210ca15bea51bb2840f1275d36b99490ff0706aa3ca9e89f33fd99df863acc3bca504c15501ba9d987999ee118f47b7737d2dfe73ab257d680f983da1f5fd5975491ad966989f7b15e76e4e6b1a2987801adb3b7cd4cb1d2c9d0454429c2955643c8fb82ccf8e93051cc10081f8181af0d143deee686f67ec42db1e9914ed047e4bf0006af01028e3839451fa3e17d33586022c63cafaf6d0fc773c96143473316988d32f9943d7477604a27ae4b8a7093bee2cefe10cc02109c748d0676692a2411e5c3b4c4c1b9ac7f9b71a1a7126dacf4615e8c9c3d38f536e8b32e37f406b3dc44db80a00d6e423deec869edb32a411986be1517b6ea45e1f984a6fbd08edb25a305122fe5a90cc46af48ebc36433a1f27f43d85492ea60fd2f43125e7328da93f7aad97f97910112fed7ae7b1785822356a525df1f3ab4637b68d92ecd8d7f234973c686fb11821bb1de5f8459b57892f1dae08aae1924ee60a904d7be6e6611ec3d00002152ab7e0c29c7bf124dbec9a6eff25e619d89c27d187e3ffff63c996c33f4b7e967b607f36a8ac8dba6beb43395c9c9b2e3e36de29b07f9c2d60cdfd1d02813d4e508c56b99405b752758a01cc25bb5436ea1efd52c536fa1d2fb1cd9b1ee006d42b58600be2c1aba59c480cb6e9224d7a4df920598950634033087d3e356f35cd2f8b021d30f4ba79bc60eb6715c6c9bed84648552395cffa97c8cdb8f562f8f127f0e6f86dc61fab11ff782560d88cf2872d0e07a27f38120a0831a93c377298c2ed4fe180eb078422e5f030540fd21ebd414e6c42f1fa5491b5b8fdcada476376732edbfd66e10a475e2c0a43ccf6a41f7879f4577e987695d8d5097f6920fbe2b9ac2cb424de7afded1b5b7db89f3612c487770d58a7bb7517f1fa7a98ff6db3778d40c5f36b27d233a0c18587220f900f4a8e867e33e24c1981acb3445de995132d8fcc58f79ddb1475ba69c464071e95c0707c396c0b1b710cceb51efba5f30a271cd456d5f7216d90b412156ecb01dd41f15ac31980649c5eabc7fbb085a38318d43b0683cba055deb9dde4dc4584935473508837c1023993d50b434b311f126df6a0be0653b97a97bbc9b165098dac8dfd6ed6f033ccf7b32cfa3292296222aebfaec4dcd5066b66be45696067dfab907e2984f1bb6067c170e0617e245c9c09a85a061c4b7e2873ce0571b48d557007d5c7ddf5cc2ffa533e2a3975f3687a6d08a09dc1d285cfed129ec887d70bb5aded429b676c242d57c8f36721bf5732b1f25eced0ffedba7254486c9caab3fb3e0ad3b2dc332a06dadd39e5483a314b1d3086cc198b6b6b272fb56e35e0388b1dcddd484fde0ef9d855ca7bd98ebf0f686cec7d5e37f7b5dffbe4ab28c4422adbaef0c45649b0b830dfff90bbea3b7103ea9dd87d856ba7c5bb485319eecc71acc943c733f489ad72e13b1b232cd1eb4ce87917daad4b0405c9905f7a35501c75332d9acb36057715a6abd0958061fda860c00000000bc9aeac4f47acd022927c381012150fed83a99c2d7b268ff2e1c8d162d3feae2c5bdee747aa10566a94f13d4e1a00a4043bd179310e72ec8e4c68659be77907bba82fc416a72c0d2076821f77e8afdbeac769195a01515ab45ba73ec85a2f8a52146dbbc8d585def095aef4e4491362b596a84d2e9fd0131de2c72b71c4bd239146011eaa209957b2bb3f74bf2f42a17440749688d66a18a9d4a7d1e2bbb34dbb2a45460e69a1ec43467665c59438d35fe9b04a94e408ec4bcf7ba1a25bfc287d6189b65711904be9860f8a68d1bab99eed54890f963caef1fa0179224b650f090f67dca59f1241c2a25bc921d522f61e57d2bad88c057d3f7729499a0391fca3a62b27cc0a9b976da3eef333d88ad128ea757697ffdd50633b66b73ea3ddb565bc3d8780f9c0bb2347551969aaa500e7c030da2a92eb3f78d88b91eb547dba2e9be7ab2aa617f0890c39c73c8c2b35ff7ec529f6b8d08e3fcf2630e454bdb6474185ae72ba69310654c9c0b3ba158fe223954e1d46f9d27b0a4e090b0084918b2964bdcee31d258325b89ef96790ed1df4842b482023f1d22fb3e01280f1c8616153035f10bd65de57c1fa7d5a17e77b12e348bd3019092ef548c5249694168dd24df8a7318eccd779da4f547e9f162f484eb3ab9f5bd196f6b68656725d2624b61d09f73586753a1fb7eeb1721973f8e15522487f1dd1412b0f4846801d1abbfe53b755f15047981b162a1de04d52b4d4762ac877e4d718619e8cdba16df688fe95bdc9a1ee99c21004ba7e72985752d89d6892a4169296703fde314457f014ed89c129a4c83b5bee0bb93cb69a83313442837bc03679ee317cf8d1b908b70fae1b1461a398f310ac073642f954ab39e0eda329a94a5c12cf262ca4a25831dbc10aecf83d9d54776c379c230bb488cd6c9295bc31cfab61eb9b5486726f5c854db8aad2642d4468643f3bc8b25cdc9fda7aad04b06b61b185868a44acd46a0bd8debc1e431f19aeddfa3d0e480949bd361f6c988744acafae954c140192306c3066e8e434f70e8cd67b65a59923d166a95ca5e0515e2059e1f1aa9a74bfd49e4e37638bfa6b6117b790c4ec7f536d046c38f8ab6eedac1713bcb8860a18cac43e9add3c68c3ce5d17fbf76e966afcd3ed7795540650e093d39926f5e3719156baa54307b4f5e934f24951b3644a7657e798525d3f1207b28527a5bcdeb33e296c6c0e9e1757941ddd24a0d15c9a21918514a3143ef3fc2e775345ea10aeba6767686e9cfa646da377e88fd759a33ff20c9b258fd37d063d02fe22f090c5e324b507cd3bc42248a7abb2c7d0b1b85ecb5a67bf53a2f25d139ea523808678942e1588fd677df161b67b563a446a2cc69d9126fbf308258a13fcd6f53d92d9947311e3de4fa5acd7c2684d9eb3b4feb024e05bbf090836d92e30b68df6a7619542c9acbbb69dc73c781bdc7ef4b25c2af77186f493a5038a56508cc56b7085e13f4264e02a2a3bb515e15301371520481302f2367c883a5ac503ae4269cbbc8fb2f0f77ecaea7b8af04bc24aa90f677a72bbecfdb225864714344a8fd1c07ef664abaefe53bd76ba12c8bf45860a316812af87348682ee7005ac6a00523f4313102742ee5502d8c61c3321d1b872780192f4d00b12b38d0aedd34619c42f49b81d7bddc4ca481ed8f448bc3ad98b13f7176748838d623e007a24948480e978b80ce67ec952eca613091ad4f81cd521b2851bb8b2a6b1da0420eca80aecac9c0887988e1f29906c9ce65b990a00f22ba6f115a7a0001f511ec35dbcd401130173fded8b2e23365caf3d6d7c8f404383f16fcd76b17c220f88c1fe96211bd92c5803c63d9537a2ceb258508d9b1d74ca43174eaefd677ed6db63bb3d7712c9558c7879fbe67b7396c721407953db9dad13291f96d7d0290ad56cf1f65ccf58d3f5b8ba1f78f81d86ae0ea50926ff352d73629da44a6d31598dcdcf81355faed4f5a6ad8cc39d4a414b97f193c896bd3c270097cc96e4a5e36ca9a56a27c52a03decc4837d7b008acc1fd2724f97e0e9591afb5de3af3ec5fc16e1bee79098cc94d638375d69ae5065bedaed575e11b1b0a4d1189830856e8d48a6c50bf18cb9f8919fd8a55ad0b2f7d8c096c7f549fec8e1522be0de2a69699afe47e899ac6d5405c08e2e374326808ba76259d85b971dcce55aceed11583603dd280fd15c8e7b206e8bade3f6d83c6041838ea8b489fb9f92ab220ad5d3cd2af3f45cb2df7094d550b2cfea314469943a159e12c01897a7cc42904eeb24cc507e7ce7ffb4d22efdcd5cb5d75975582e14960fb0f2b83cb774faea32dfba7ed0e8b6a749785166cb5c77dde7498f67f7f20d0b85a7fe6e7f8a8e3f95bd795165f36440d84434cef17f81697816030e3a86bf003272ca4868ab935fa0d465fb10637a706c9fd04fa4d4eb421e87aa6628a1d6174833af4dbfceab7fc5989550c0847bf27a5243e3b318fffde95d11cf507bc4e092180dd228df9f89d193a160d50c223309eae580a09f2e78855f17f8ad25c1f5814becdfca7948c7045b242e22d5efab676fe717eb34d2f0fcb77289c8b12caadd2377b7ccdcfab61900971b4a2ac132587174117428739ebb109fa133e483956bd499dfa530cbb3d1df42309f6f0755b043d85776807f25c3b4b518a2274671eb38f3e82ad4397377f85201771877a7cc43b838791a4d4d655ecadf03d8c1687e961c83dbb64c4d54d4b745a3abca7e381a00c6f51f48f6f7ce29ec656d89a1fab216675febedfe6b08c35add5aeb8cf6c0b226d309a222e1783e45e560f6ea64bf7706787f199116341f874321b52b1135830ab8979ae5546aad4ecfdac0045d4d15b4ed2fe26e484793db6aa61d40333355fa96ac5d1b8a5b5fc033475cba14f344007bfd82deb64b5c2eda6c0d528e4de0c21802d6b27554c0e2090f2c4ebd19208ce904cc02756b44bb2f8ebc1d37961c0957a4815487cbf76fdbe1f2b77b563a5663a00952c92579399f7acc1d41d9289ea0345f02f6f760ced802c8e0b14760a43dd04e6c371ceab9f5cb3617cd7ab31457b6821c6a4f34b243fba61f5c553e58ca253d5723382cf5d3f8357347ee2af2d48d86367f993e4b80b849dd3f50b2a89338af97e11b9a796ae2548856cce01334bca0c558e160f16e74699c7eaefd699acdf4d5019bf70f2d9c083f62b5254262f05c01dba59b1779502d3ad310a3039447d730a2cebb1242331a9849921c07336e985a844c55ce6129a650b3fd7cbda52a0cfdf0ef566f24adb8c959e442e9d5663fa16561b185cfb18355863d9b9f91c3829c4b0ba580668402a7a100fcd4a4e901b660863a9537f46e4f36446945e8f62e53e8282ccd7cfe14fca161d7daf592188eb2e11e275f616f4e692db8f318e8fb635d1a2582a3c8ad3050995f4cd810c04b23aaa6b26a2276133b443280f0526c9b1c016a7fdc052eff91d167b2813ec4f868c2da5fd9568da148e0ced0229f415716c1caddba880efa2017a82829125e734b96333da0b15340c149b50be86e3017bdaae3d80ae51c35df37e67684e81b5933cc7bfbe7ef0486d57e3901f9ae3eb1d592eb3fc244ce6555d3d69922dd3dcefecbba207fcbd5144a5ff97bf2216c046348a633284db59c10662350c7484ced762f353cd01a971c88d0eabb68eef856d585e8f5a684dc948b094754362ba8d606f85a755a27895ff5b6b4ea0387574afdf362a43b5535a2838b3f00f24612b9ae47e95f15d8b828efe56152d77871cfda0e0ff9936db3fe9c49f0d0f5ef9b71b81efd2e92d0166a4970254950a51235b66866d5402740adaa584e892572a6f46714704660cfbcaa56cc27cb538a908d1ee2fc7adaa674ce7a717f6e0481a2374f768fa3df8368bf4281bce6f9777f958f36502908d7c921ba745d0cc16b8a9a67f15c26d4b005788b1e90b19cc13f3e925fc14ef31d624c7500710d8f80e5bd4b14dd6bf70c210db6077c69d2d1751fe999442502d3542be12b732e3793e6c5e5c33a15a792ea344b0ed0be1ebb1d4e896e3e62d8d85afad2ae134dabc4f0d3fc719c6245d3bfafa42f0cdc9c0d5c4ba5c20b9da975bfd2f211bee8589ce1dc9652c2c3cee2a5e8a00049e42afe4403a905b60e0dcda1120d32ce36b91719d6308c93dfaa16c23a3b37e88194778be77d5e9e64b39477b76b4644ca32525b73bcf1fd9dc9af7776f2149e368053c58e1c93e1ec4575cb5e0b2da61d5e6b19436f3c095cdb4af4ddfc3364975700e5ff5275f9336b8cb3b959a1cd94f6b9c3a33f35e9ba4b7fea0466edf54e5e2e06a79bd170392c02b09749f3d111ef60baa8016dbf9ba581beab2c43d094add0d7fb7e16f198f3050641255f30a57c3045c1b51dd6e5d65613167596365b9c67aaa36fc89c44fbc4c8c96c328554a63a15511b04692651dd5e30780caf0dfce976c665e7b05fa6143914837bc82fb9d9dc5a1660e28a697e8a0a32eb8db109c5a045243d86ea11847fb64ec450112d77ecba32de418629a4ea2ae3f7ed3625b26def5c19813a6386ab4e43838c1fad3d4e92dfd7d3f98b3cf46d6e20304851899c59661e9639f3ff52fa023114907d930d74d605f3f7c5fd9ebb446d807e96cf3bf3517e369dc98f489026ec035a86f3719e1e50a48c0381f7fd2a7eea1d3a09ef7a0ba50b2ae28c2c955db4761ac005226ebc0c18d108e8ac066371be249b80eed88afee799411a50381cacb2d5164f0827720eb9d11b5cc548c2e145291dfbc5d4f70646dfbca077ce8ad3a3f8c627021295cbef70f5013c53e8fce32116e678a7b1dc535d43b429d330e9193f8de1a6c1da4353a86bc722ef1cffe59a012ff9c5f45b85e55ebdaa6b36a519c544ef8a86095e522d7dfbb9cac41e826fcc4bc676297141195f839ebcd8f64599fb15856960f97bc70d2336507d5060282d0988f354eb757c6f4b0ee77e2c0889e5336633ac28e2651c98e7f2fa4c163f8fc196b6798c1400c46710abed12a33a95afa56c7fe55de0b48cc984c80f6d98d212daeefdbcb457217b3962436e481d70967cab6b0943d5da59021ea9fbebf66e86943e029ef95d46d347b834098e1c8fb4c35d15945bc2e336f74c6c80430ad5fc4f5b9c6b41245ecf151eea90763ce3e09e050ae1c0925fa7a5ddbb7f210226cdcf9ee406041b73a5988646b90ed382d08e7a147078f9de025f5617017ec70f65dd25d7ccdb47ad7209474f4ca461ca46f0afe3cb405c3b72d320016d01b62def93fa4fa5a34df145c526fc497329a9e29ce17a929893f7beb417c88804418271dbeb51115821db4737b9cc467f190209649f543675defbf95640d20cdd124e85788b703213f4e99b4f36b74b5d44b67b7bc995ba133da4ae92f3a3db49c9ec039e0285001fc16760da0d07552e1ad621a4bac6d0b6409316e8a78273b79aa70df0e3ca024336d42c530550be8c68897bfa6a44f595bf5be48f8b25b48825ebcba815db4b3124522bc71e3970dbcafd479a6dab40f745a655cc3f9dd5aeb046d25baaaa160ba21f8b3c0292329ae107483c8caafcd70d041facfbf705dda95370a91879fc0ab9132e3b7b02cad69417178c4f34909df7a373bacb289476c25c901be7b52aabfdfcb3415ef3a565c7de2f0128c63e16984e2e98ad23e06b890f22894ebeceefdb472192e501e2c791232933b52ea4b9c4e9fe3654b8b1e08048fbcf58fada1cd49ca6658ce6ecd12102d90c81eac26090efa36514553abb298f7cf1a43bd6d473c1436b6be9e87445de726cfffb00c72de49db0585d677d5b245e15f9a53b4c258ba2fd67d38afd9ccd0d409c0bad675fcfbc1f4e5166fd1b29203274f758f55a266b8f7c9ec8ef1dd4913727fa392ce6b11baf902ea708adddd836982a609718c1dfb810aee6f21e47c27dc6b4eeebe5fc21aae6fe7d2908679c873e2aa45a1ee14cd7e10586216d5e17cdbfacd4bfedf00b7ba7fc46d4ac90667329ba76b4fcc6b991a55c9ed159a2fb9525c975bc0aa4a291fdde14a78b95adcde52fcb5a893ee7b4df6631b3ed5a9d9d9ebe36c7cedea777a9e67faad7f7004f0a820aeb6636f24685a15d12abc639aab2233b36584670c667f9e7a3fe1195d35b268d1052d5b4c9625dc963640c2c5e6c37d36acc31755b34f3ee2af7b7ba5dbe105322a3741c567c9edd817f6488fe69301b19481fe2e2cf74b19d4b224598b0ce1fa151fa1ef3d69aaeaab397a5eac72e0b969a09b85e3258e891db207393bc281afa93468b29b7e55cc2decf8292fc68e1a02b2faa873a846680992b37a548c8f724c0125027faa58be5b2836206cc34c063b50270d7fc968dab0d38072ca90bdef91119b72ab417d811d2f32bd41e6ab2bc5b5293f92f7a0a4f172bfea5403cd418db95e1a4232f78f6afd3d13978e206d85fa9ebe2abe444db065d03b6169bc9f0dbfc19237a74bd13c1ef844f839b20018fdaf1be6f1a171f6f3ce2205fdcce38330b88ceba0c5eae812e12be99993d265f806e61ec42c9527287967a1c3b27afb1edc35a5d17bb7f4d20ea708c62c9170ba2ab710f2d7f5dca7b33e0f9434cf0b6ee846fc8bc45d39f252ec682732fb090f46032491155d83a30894a259e037e57de7523481bcc2d704d8d728fbdf048df30f7e4861f62b8e63de47b3838b5062ccd2c125bc581024ea76bd4b1f53057f37d329f7861a2a70fd3b6d6fe252a1b892192ed75c585ab809f702e27e237c4aa2dc947585c2086eeaa29c3ff7e02cb7d3a0aa3a8156d2897daa9c45a2e28ba14fd40c8a3a058805e4b5b10641c3c25b9ab80cce83206b13a1e2bc362eb5ab7e0e677c01fc0486aa32862ad0afa4f1cc8496b961a0eec71c26ad107ead599d8ddd59d85adceb3ea442efcf8ed64f4c66547344dc81ef5b6ac102434395203f58d59656d41dcc192774d70f4f2964e304efde831126d402a240325e603347aa43626b5eb69b0", 0x2000, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x90, 0x0, 0x7fffe, {0x5, 0xfffffffffffffff9, 0x7fff, 0x4, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0xffffffff, 0x1, 0xc000, 0x0, r7, 0xee01, 0x0, 0x8}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) 7.8878237s ago: executing program 4 (id=1280): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) socket$inet_udp(0x2, 0x2, 0x0) ioctl$INCFS_IOC_FILL_BLOCKS(r2, 0x80106720, &(0x7f0000000280)={0x0, &(0x7f0000000cc0)}) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086"], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000020a010200000000000000000a0000060900010073797a310000000008000240000000018c000000020a010100000000000000000000000369000600e62807258a6d38caf4cb1d7a776a7a05e57912414e63207c5e61d47bb4016b21bd5593b033b0968722f2f0f4818a1a13fbb43e79d0ae674d071c0164df9d3701cc15211300766b6ebe326ada9e49cca5c2a07460e46e35eabfb48a4cd2cd83790d7e705b010000000900010073797a31000000001c000000090a030000000000000000000a00000208000c4004"], 0xf8}, 0x1, 0x0, 0x0, 0x2000c814}, 0x4000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000004000ffff0900010073797a30000000000900020073797a3100000000140003800800014000000000"], 0x138}, 0x1, 0x0, 0x0, 0x20040855}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd0002800800"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000dc0), 0x100, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) socket(0xa, 0x5, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) 7.66604054s ago: executing program 3 (id=1281): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000300)="0000001d", 0x4, 0x0, &(0x7f0000000080)={0x11, 0x8100, r2, 0x1, 0x3}, 0x14) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000100)={0x1ff, 0x3, 0x1}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r3, {0x3}}, './file0\x00'}) 7.523073389s ago: executing program 5 (id=1282): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x74}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002800)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)="93", 0x1}], 0x1}}], 0x1, 0x4c000) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x24, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), r4) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[], 0x30}}, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f00000002c0)={0x1f, 0x0, @any, 0x9}, 0xe) sendmmsg(r5, &(0x7f0000004280)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)='z', 0x1}], 0x1}}], 0x1, 0x4004004) r6 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r6, &(0x7f0000000100)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000000080)) sendmmsg(r6, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 7.471278501s ago: executing program 3 (id=1283): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000003e00070100000000fcdbdf25047c000004000000140001800674405c57"], 0x2c}}, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000bc0)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x40, 0x3a, 0x0, @remote, @local, {[], @pkt_toobig={0x3, 0x2, 0x0, 0x0, {0x0, 0x6, "020810", 0xfffe, 0x11, 0x0, @private1, @empty, [@dstopts={0x0, 0x0, '\x00', [@pad1]}]}}}}}}}, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x8000, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000cc0)={0x6, 0x3, &(0x7f0000000b40)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) syz_usb_control_io(r1, &(0x7f0000000300)={0x2c, &(0x7f0000000100)={0x40, 0x8, 0x6a, {0x6a, 0xe, "bb074a5ebe68f2f92010caf5d75254f61a9f53b8d093ad5bdfa48ce3dd4e94ecaa130066acbd534f0f9feda850068dd7a4341f26cb8d24b3db8d0cb8c762fd4f8a6c21b86739012e0363731ed00ff71989c3d166c056051f9eccadde212f3f86a0860f48c5aab407"}}, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x827}}, &(0x7f00000001c0)={0x0, 0xf, 0x5c, {0x5, 0xf, 0x5c, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0xdc, "7769e97020dfa55e177b1d9b1f80635c"}, @ptm_cap={0x3}, @generic={0x22, 0x10, 0xa, "96722ef52107dbd135e3f1118efc80754317cf492555310c1e54bc7994d751"}, @ss_container_id={0x14, 0x10, 0x4, 0x90, "c37ad793cbc9904540e365eb1fbd92ca"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xc, 0x0, 0x8, 0x8000}]}}, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x0, 0x9, 0x3, "5967ea59", "ee696543"}}, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x60, 0x4, 0x0, 0x3, 0xd0f, 0x7ff}}}, &(0x7f0000000a40)={0x84, &(0x7f00000003c0)={0x40, 0x4, 0x6c, "86817b9a03723382421001d78a372ecc945f72a29f1288679d71a213f0d4b2ba00c9868cd674eecaa81981ea65cb95722a7d2fcd2c57da9f7a64229893fb27af1538c07d8727df352be33c16e6d93dc1e7aadcf9a68d4fa20e539c20dbce5c024a68a367ab035e9ed46be735"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0xba}, &(0x7f00000006c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000700)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f0000000740)={0x20, 0x0, 0x4, {0x20, 0x20}}, &(0x7f0000000780)={0x40, 0x7, 0x2, 0xb492}, &(0x7f00000007c0)={0x40, 0x9, 0x1, 0xf}, &(0x7f0000000800)={0x40, 0xb, 0x2, "e44c"}, &(0x7f0000000840)={0x40, 0xf, 0x2}, &(0x7f0000000880)={0x40, 0x13, 0x6, @remote}, &(0x7f00000008c0)={0x40, 0x17, 0x6, @broadcast}, &(0x7f0000000900)={0x40, 0x19, 0x2, "97a9"}, &(0x7f0000000940)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000980)={0x40, 0x1c, 0x1, 0x7}, &(0x7f00000009c0)={0x40, 0x1e, 0x1, 0x5}, &(0x7f0000000a00)={0x40, 0x21, 0x1, 0x9}}) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xd50, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2608054c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0xec, 0x21, 0x1, 0x0, 0x4, {{@in6=@mcast1, @in=@rand_addr=0x64010101, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x2}, [@migrate={0x9c, 0x11, [{@in=@multicast1, @in=@local, @in6=@private2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x33, 0x4, 0x0, 0x34ff, 0x2, 0x2}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x35}, @in=@local, @in=@remote, 0x3c, 0x0, 0x0, 0x0, 0xa, 0x8}]}]}, 0xec}}, 0x0) r8 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x437, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x80000001}]}}}]}, 0x38}}, 0x0) read$msr(r8, &(0x7f00000000c0)=""/16, 0x10) openat$fuse(0xffffffffffffff9c, &(0x7f0000000c40), 0x2, 0x0) 6.726284924s ago: executing program 0 (id=1284): mkdir(&(0x7f0000000200)='./file0\x00', 0x56) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) mremap(&(0x7f0000ff1000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000ffb000/0x4000)=nil) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETENCODER(0xffffffffffffffff, 0xc01464a6, &(0x7f0000000280)) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[], 0x50) r3 = syz_open_dev$vbi(&(0x7f0000000440), 0x2, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0205648, &(0x7f00000000c0)={0x9f0000, 0x1, 0x3, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x9b0952, 0xffffc003, '\x00', @p_u16=&(0x7f0000000400)=0x3260}}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={0x0}}, 0x4000000) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x20000040, 0x8, 0x0, 0x1, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00'], 0x1}) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x1, 0x41, "0062aa7d82000800030000000000f7ffff00"}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000000)=@base={0xa, 0x16, 0xeb5, 0x7f, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='ocfs2_dlmfs\x00', 0x4, 0x0) 6.571936951s ago: executing program 1 (id=1285): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = syz_open_dev$sndpcmp(0x0, 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r1, 0xc2604110, &(0x7f0000000000)={0x1, [[0x7fff, 0x40, 0x0, 0xd, 0xfffffffd, 0x0, 0x1, 0xfffffffc], [0x2, 0x0, 0x0, 0x0, 0x1, 0x5, 0x4, 0x800], [0x200000, 0x5, 0x0, 0x7, 0xfffffffe, 0xa, 0xfffffffe]], '\x00', [{0x7}, {0x3}, {0xffffffff, 0xa40}, {0x0, 0x1}, {0xb07, 0x6}, {0xfffffffc, 0x4}, {0x20004, 0x8}, {0x9, 0xe595}, {0x4, 0x200000}, {0x164, 0xffff}, {0x8, 0x1}], '\x00', 0x80000001, 0x0, 0x0, 0x2, 0x0, 0x35}) r2 = openat$fb0(0xffffffffffffff9c, 0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000005580)=""/102392, 0x18ff8) setresuid(0xee00, 0x0, 0xee00) r4 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f00000001c0)) sendmsg$nl_generic(r4, 0x0, 0xc000) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xbb7, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, 0x0, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) creat(0x0, 0x125) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10401, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 5.973231567s ago: executing program 4 (id=1286): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB="b4000000190001002abd7000ffdbdf251d01090050001180490067004df4fc8de71626db37a39716bc6a1d9cbb21e0a06208c366fbcb7bdf381a45efcace9782aab31f4423aa8b1fa6f26bc762d6030000004ff3c640b8656c018bebe844d61d0b0000004d0012"], 0xb4}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x16) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) pwrite64(r1, 0x0, 0x0, 0x26c) 5.903856858s ago: executing program 1 (id=1287): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0xfffff, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="28000000100001000200"/20, @ANYRES32=0x0, @ANYBLOB="04000448079208001b0000b90736000000000000000000"], 0x28}}, 0x0) syz_emit_ethernet(0x6c, &(0x7f0000000000)=ANY=[@ANYBLOB="0580c20000000180c200000008004500005e00000000002f9078000000000000009824806558000000001000080010000002000086dd0006080088be0000000010b200000100000000000000080022eb00000000200000000200000000000000000000000800655800000000"], 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) recvmmsg(r4, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) setsockopt$sock_int(r4, 0x1, 0x28, &(0x7f0000000040)=0xd, 0x4) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0216000002"], 0x10}}, 0x0) 5.279971619s ago: executing program 0 (id=1288): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x7, 0xca352c92cb699c71, 0xffffffffffffffff, 0xd0a55000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) sched_setaffinity(0x0, 0x0, 0x0) setrlimit(0xa, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102384, 0x18ff0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) syz_open_dev$vcsa(0x0, 0x1, 0x113583) r1 = socket$nl_generic(0x10, 0x3, 0x10) mount$binderfs(0x0, 0x0, 0x0, 0x4847, &(0x7f0000000100)=ANY=[@ANYBLOB='max=', @ANYRESOCT=r1]) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x301, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}]}], {0x14}}, 0x70}}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') read$FUSE(r2, &(0x7f0000002780)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000003000000850000008600000018010000", @ANYRES32, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) r3 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r3, &(0x7f0000048040)=""/102392, 0x18ff8) 4.752237889s ago: executing program 1 (id=1289): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000580)=ANY=[@ANYBLOB], 0x5c}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, &(0x7f00000014c0)=""/145, &(0x7f0000000000)=0x91) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x40100001, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r5 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c00)={0x14, 0x453, 0x4, 0x70bd39, 0x255fdbfd, "bf"}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000002c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r2, 0xc06864a2, &(0x7f0000000300)={&(0x7f0000001180)=[r10], 0x1, r8, r9, 0x3, 0x0, 0x3, 0x802, {0xac7c, 0x1, 0x7, 0x69, 0xf4b, 0x2, 0x2, 0x45, 0x412f, 0xe154, 0x1000, 0x7, 0xb2bf, 0x3, "fe1d00003413000000000000000caa000000090000000000000004b427180010"}}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) r11 = socket$inet_sctp(0x2, 0x5, 0x84) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x408000, 0x21) sendmsg$inet_sctp(r11, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="20000000000000db0db69b00"/28, @ANYRES32=0x0], 0x20, 0x4048800}, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[], 0x0) 4.485980875s ago: executing program 0 (id=1290): syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) pwrite64(r0, 0x0, 0xf5, 0x26c) 4.373948569s ago: executing program 5 (id=1291): r0 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r1 = open(0x0, 0x40, 0x100) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff}) ioctl$SIOCGETLINKNAME(r2, 0x89e0, &(0x7f0000000800)={0x4, 0x1}) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_io_uring_setup(0x8000010b, &(0x7f0000000140)={0x0, 0x334c, 0x20000, 0x4, 0x800, 0x0, r1}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000540)=0xfffffffc, 0x0, 0x4) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r8, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185500, 0x12345}) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb000c000000020000000000000000000004000000000000"], 0x0, 0x26}, 0x20) io_uring_enter(r5, 0x7277, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x6, 0xc, &(0x7f00000008c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) landlock_create_ruleset(&(0x7f0000000040)={0xd351}, 0x10, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000100)) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000080)={0x10, 0x0, &(0x7f00000001c0)=[@request_death], 0x0, 0x0, 0x0}) r11 = dup3(r10, r9, 0x0) accept4$rose(r11, &(0x7f0000000000)=@short={0xb, @dev, @netrom, 0x1, @null}, &(0x7f0000000140)=0x1c, 0x800) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) 4.17933186s ago: executing program 3 (id=1292): openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = userfaultfd(0x80801) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r4, &(0x7f0000000040)={0x40000008}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x7c8}) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x19, 0x64, 0xd4, 0x8, 0x1a86, 0xe092, 0x533f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0x0, 0x10, 0x3, [{{0x9, 0x4, 0x1f, 0x2, 0x0, 0xe9, 0x17, 0xf3}}]}}]}}, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x107842, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r5, 0xc0189379, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r6 = socket(0x22, 0x2, 0x1) recvfrom$rxrpc(r6, 0x0, 0x0, 0x2043, 0x0, 0x0) mremap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000, 0x3, &(0x7f00001c3000/0x2000)=nil) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c00090502020002020000098a82020002000000"], 0x0) open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) close(0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f0000000300)={'comedi_parport\x00', [0x800, 0x1f, 0x10000, 0x4, 0x3, 0xcc7, 0x4, 0x10, 0xe, 0x6, 0x2, 0x2, 0x7, 0x1, 0x6, 0x10000105, 0x0, 0x1244d, 0x3, 0x3fff7fff, 0x89, 0x10, 0x1, 0x20001e58, 0x80000b, 0xe6c, 0x8, 0x8, 0x6, 0xffffffff, 0xeffffff8]}) 3.888195453s ago: executing program 4 (id=1293): r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) syz_io_uring_setup(0x109, &(0x7f00000000c0)={0x0, 0xc4bb, 0x8, 0xfffffffc, 0x2e8}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0x10000, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x2, r1, 0x0, 0x0, 0x0, 0x80800}) r4 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) syz_io_uring_setup(0xb, &(0x7f0000000240)={0x0, 0x6109, 0x800, 0x0, 0x1a2}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000400)=0xfffffff8, 0x0, 0x4) r7 = syz_io_uring_setup(0x3005, &(0x7f0000000180)={0x0, 0x200089b7, 0x0, 0x1, 0x385}, &(0x7f0000000240), &(0x7f00000002c0)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x12, 0x84ef6d5657f05c1f, {0x0, r8}}) syz_io_uring_submit(r0, r3, &(0x7f0000001140)=@IORING_OP_LINK_TIMEOUT={0xf, 0x4, 0x0, 0x0, 0x0, &(0x7f0000001100)={0x0, 0x989680}, 0x1, 0x8, 0x0, {0x0, r8}}) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000001180)='mountinfo\x00') read$char_usb(r10, &(0x7f0000000040)=""/4109, 0x100d) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r10, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r11 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r12 = dup3(r11, r9, 0x0) r13 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001080)='./binderfs/binder0\x00', 0x800, 0x0) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder1\x00') mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r13, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r13, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r12, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f00000001c0)={0xc, 0x0, &(0x7f00000010c0)=[@register_looper, @increfs], 0x0, 0x0, 0x0}) personality(0x8) uname(&(0x7f0000000000)=""/123) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2ff8}], 0x0, 0x0, 0x0}) 3.237620803s ago: executing program 4 (id=1294): io_uring_setup(0x55a8, &(0x7f0000000000)={0x0, 0x1951, 0xf52027a535eed838, 0x1, 0x39e}) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0xf7fe, 0x6}, 0x4) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r1, &(0x7f00000065c0)={0x0, 0x0, &(0x7f0000006580)={&(0x7f0000006080)=ANY=[@ANYBLOB="2800f0280068fdfa004ac2411e47070000"], 0x28}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000800)=@mangle={'mangle\x00', 0x44, 0x6, 0x408, 0x0, 0x0, 0x0, 0x130, 0x0, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'geneve1\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x130}}, {{@ip={@private, @local, 0x0, 0x0, 'vcan0\x00', 'macvlan1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0x4}}}, {{@ip={@multicast2, @private, 0x0, 0x0, 'bridge_slave_0\x00', 'bridge0\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}, {{@ip={@rand_addr, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) r6 = socket(0xa, 0x2, 0x0) getsockname$packet(r6, 0x0, &(0x7f0000000380)) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xf) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@mpls_delroute={0x1c, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}}, 0x1c}}, 0x8020) syz_io_uring_setup(0x64e8, &(0x7f0000000240)={0x0, 0x8c13, 0x2000, 0x2001, 0x143}, 0x0, 0x0) 2.855208391s ago: executing program 5 (id=1295): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x189400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x10b}]}) (fail_nth: 1) 2.781472424s ago: executing program 4 (id=1296): r0 = socket(0x10, 0x3, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="7472716c6f63a9c8"], 0xc) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000021c0)={'\x00', 0xff, 0x9, 0x8, 0x3c7818b, 0x3, 0xffffffffffffffff}) r2 = epoll_create(0x827e) kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, r0, &(0x7f0000002240)={r2, r0, 0x4}) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r3, 0xc02064b6, &(0x7f00000001c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r3, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r5}) ioctl$DRM_IOCTL_MODE_ATOMIC(r3, 0xc03864bc, &(0x7f0000000580)={0x600, 0x1, &(0x7f0000000180)=[r5], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r6], &(0x7f0000000340), 0x0, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x40, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0x3}, {0xffff, 0xffff}, {0x4}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x2}}]}, 0x40}, 0x1, 0x0, 0x0, 0x1d4}, 0x8840) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000084}, 0x24000000) read$FUSE(0xffffffffffffffff, &(0x7f0000000100)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sched_setaffinity(r9, 0x8, &(0x7f0000000000)=0x2) syz_emit_ethernet(0x3e, &(0x7f0000002140)=ANY=[@ANYBLOB="ffffffffff004500003000000000008890787f000001ac1414aa0c00907800f80200450000000002000000000000e0000001ac1e01010000000000000000355f828c7b278491ea0ca1de4fe5da8a4aefc3cb9d1e2e7ce3a7d2ac992b813d1d28425798d5aa070caf0c"], 0x0) 2.47996192s ago: executing program 0 (id=1297): r0 = syz_io_uring_setup(0x2e06, &(0x7f00000002c0)={0x0, 0x2667, 0x40, 0x3, 0x6d}, &(0x7f0000000340), &(0x7f0000000080)) io_uring_register$IORING_REGISTER_RESTRICTIONS(r0, 0xb, 0x0, 0x0) 2.445971685s ago: executing program 4 (id=1298): socket$nl_generic(0x10, 0x3, 0x10) socket$caif_stream(0x25, 0x1, 0x2) socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000540)={0x0}}, 0x240400c2) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x3}, {0x0, [0x5f]}}, &(0x7f0000000f40)=""/4089, 0x1b, 0xff9, 0x1}, 0x28) capset(0x0, &(0x7f0000000100)={0x4, 0x0, 0x3, 0x200005, 0x0, 0x1}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000400)=ANY=[@ANYBLOB="ea29ff1a3fb6e09bcb400000001000390400"/29, @ANYRES32=0x0, @ANYBLOB="01980000000000002000128008000100677265001400028008000700ac1414000500130000000000"], 0x40}}, 0x0) r4 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x8082) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r6) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_open_procfs(r5, &(0x7f0000000040)='pagemap\x00') syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793f10d105012000020000000109021200"], 0x0) close_range(r4, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 2.38289513s ago: executing program 0 (id=1299): semctl$SETALL(0x0, 0x0, 0x12, 0x0) 2.382553739s ago: executing program 5 (id=1300): syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000024917720042322023f77010203010902120001000010000904"], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000044000900000092000000000305000000080002"], 0x1c}, 0x1, 0x0, 0x0, 0xc1}, 0x4000040) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000001c0)={&(0x7f0000000200)=[{0xe4, 0x2239, 0x0, 0x0}, {0x101, 0x201, 0x0, 0x0}], 0x2}) 2.220587015s ago: executing program 0 (id=1301): syz_usb_connect(0x3, 0x24, &(0x7f0000000dc0)={{0x12, 0x1, 0x0, 0xdb, 0x16, 0x89, 0x20, 0x2040, 0xd900, 0xa92c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x4c, 0x0, 0x0, 0xb2, 0x50, 0xcf}}]}}]}}, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000800)=[{0x1900, 0xc001, 0x0, 0x0}], 0x1}) 1.597937046s ago: executing program 1 (id=1302): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @broadcast}}, 0x0, 0x21de, 0x3fc, 0x0, 0x2}, 0x9c) r1 = syz_open_dev$sndpcmp(0x0, 0xb, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x3c, 0x3e9, 0x400, 0x70bd2b, 0x25dfdbfb, {0xb, 0x1, 0x1, 0x0, 0x800, 0x10001, 0x1, 0x4, 0x0, 0x6, 0x5}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x48008}, 0x50) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x8, &(0x7f00000000c0)=0x20007, 0x4) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000010, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, 0x0, 0x2a, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), 0x0, 0x0, 0xfffffffffffffffe) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20004882) r4 = socket(0x10, 0x803, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) symlink(0x0, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002480)=@newtfilter={0x8b4, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x880, 0x2, [@TCA_U32_POLICE={0x858, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x80000, 0x3, 0xf, 0xfdb, 0x1, 0x80, 0x7, 0x7, 0x40000000, 0xaa04, 0x80000001, 0x99, 0x8000, 0x1000, 0x3, 0x0, 0x7fffffff, 0x80, 0x1, 0x7, 0x0, 0x9, 0x4, 0x5, 0x80000001, 0x2, 0xe0, 0x9, 0x1, 0x9, 0x1, 0xffff8001, 0x9, 0x10001, 0x7, 0x10000, 0x30, 0x807, 0x1000, 0xfff, 0x7, 0x2, 0x5, 0x48a, 0x9, 0x1000, 0x7, 0x7198, 0x8, 0x80000001, 0x1, 0x101, 0x3, 0x7, 0x2, 0x8, 0x10000, 0x2, 0x1, 0x2, 0x6, 0x9, 0x13, 0x2, 0xffff, 0x80, 0xbf77, 0x8, 0xc52, 0x6, 0x9, 0x7, 0x9, 0x5, 0x8, 0x3, 0x8, 0x5, 0x8, 0x1, 0x3, 0x7fffffff, 0x8, 0x2845, 0x2, 0xe9, 0x2a, 0x3, 0x891, 0x8, 0x1, 0x12, 0x6, 0xfff, 0xffffc9b5, 0x80000000, 0x2, 0x6, 0x6, 0xaa, 0x0, 0x8, 0x0, 0x0, 0x5, 0x1, 0x2, 0x40, 0x4, 0x7, 0xa, 0x8000, 0x4, 0xffffff2d, 0x0, 0xffff7fff, 0x2, 0x3, 0x6, 0x2f1e, 0x8, 0xfcb, 0x8, 0x1, 0x9, 0x6fe68a84, 0x200, 0x1, 0xfffffff9, 0xb, 0x1, 0xab, 0x9, 0x7, 0x0, 0xe, 0x10001, 0x8, 0xa, 0x6, 0x0, 0xa1, 0x7, 0xffff519d, 0x9, 0x4, 0x2, 0x3, 0x1, 0xffffffff, 0x9, 0x4ae, 0x8, 0x1e9, 0x9, 0x101, 0x200, 0x4, 0x4, 0x1, 0x5, 0x5, 0x7, 0x5, 0x0, 0x7, 0x80, 0x2, 0x2, 0x1, 0x5, 0x101, 0x7, 0x4, 0x9, 0x7e32, 0x8800, 0x4, 0xf85f, 0x10000, 0x800, 0xffffffff, 0x7, 0x4af, 0x7e21, 0x1, 0x5027, 0x8, 0x10000, 0x4, 0x3, 0x7, 0x680, 0xc1, 0x2, 0x7, 0x8, 0x401, 0x74dc, 0x400000, 0x401, 0x92c, 0xffff32d2, 0x4, 0xafcf, 0x7f, 0x5, 0xffff0000, 0x0, 0x8, 0x200, 0x4a, 0x4000, 0x0, 0x9, 0x10000, 0x4d4fbb35, 0xb2, 0x4, 0x5, 0x0, 0x100, 0x8001, 0x6, 0xfffffff8, 0x9, 0x2, 0x81, 0x2, 0xc, 0xa, 0x94, 0x3b0, 0x401, 0x118966c9, 0xe56, 0x8, 0x4, 0x1800000, 0x6a, 0x9d6, 0x200, 0x2, 0x40, 0x7, 0x8000, 0x7e, 0x6, 0x5, 0x7, 0x4, 0x3, 0xff, 0xe, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x1, 0x5, 0x53e5, 0x7f, 0x4, 0x3000000, 0x0, 0xf0000000, 0x3, 0xfff, 0xe, 0x7, 0xf8, 0x1ff, 0x3, 0x800001, 0xfffffffb, 0x8001, 0xff, 0x0, 0xfff, 0x80, 0x1, 0x5, 0xffff, 0x6, 0x1, 0x7, 0x9, 0x10000, 0x0, 0x5, 0xe184, 0x4, 0x1, 0xadd, 0x1, 0x16, 0x4, 0xa35c, 0xc, 0x80, 0xff, 0x6, 0x2, 0xd, 0x4, 0x3, 0x5, 0x4, 0x401, 0x4, 0x4, 0x1, 0x3, 0x8, 0xfffffffc, 0x3, 0xc1, 0x2, 0xffff, 0x80, 0xfffffff1, 0x7ff, 0x9, 0xfffffffe, 0x2, 0x6, 0x80, 0x200, 0x1000, 0xb11a, 0x0, 0x5, 0x8, 0xf49d, 0x5, 0x3361, 0x435, 0x7fffffff, 0x2, 0x6, 0xc4, 0x9, 0x0, 0xee2, 0x4, 0x401, 0xfffffffa, 0x8000, 0x2, 0x0, 0x5, 0x5dd3c81c, 0xffffffff, 0x7, 0x3, 0x81, 0x9, 0x5, 0xfffffffc, 0x2, 0x1, 0x8, 0x6, 0x0, 0x6, 0xc, 0x8, 0x6, 0x100, 0x1, 0xb5a, 0x7, 0x4, 0x18, 0x8, 0x31, 0x1ff, 0x4, 0x9, 0x400, 0x2, 0x6, 0x7, 0x9, 0x91e7, 0x5, 0x7, 0x81eb, 0x400, 0xffff, 0x9, 0x9, 0x6, 0x7, 0x2, 0xea, 0x3, 0x9, 0x4, 0x3, 0x7, 0x0, 0x8, 0x1, 0xbf0, 0x7, 0x7, 0x66, 0x7, 0x6, 0x3, 0x9, 0x0, 0x9c4, 0x7fff, 0x7, 0x800, 0x5, 0x9, 0x10001, 0x4, 0x2a64aeea, 0x0, 0x5, 0x2, 0x1, 0xc, 0x1ff, 0x400, 0x3, 0x3ff, 0xb, 0x39, 0x0, 0x8, 0xffffffff, 0x0, 0x8, 0x6, 0x9, 0x2, 0xffffffff, 0x401, 0x9, 0x800, 0x9, 0xeb, 0x8, 0x6ed, 0x5, 0x2004, 0x4c3e, 0x6f, 0x381, 0x4282, 0x4, 0x7, 0x1, 0x4, 0xfffffff7, 0x5, 0x7, 0x0, 0x46, 0x9, 0x3, 0x3, 0x6, 0x9, 0x4, 0x1, 0x4, 0xfffeffff, 0xe, 0x3ff, 0x80000000, 0x7, 0x80, 0x7, 0x10042b, 0x7, 0x7, 0xfff, 0x5, 0x8, 0xffffffff, 0xffff671f, 0x7, 0x4, 0x80, 0x6, 0x4, 0xd, 0x1, 0xff, 0x2, 0x5be228d5, 0x2, 0x0, 0x8, 0xaff0, 0x8001, 0x3, 0x1, 0x7, 0x0, 0x51e, 0x2, 0x6, 0x4, 0xfffffffc, 0xd97, 0xa8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x4, 0x6, 0x0, {0x7, 0x2, 0x3, 0x10, 0x4, 0x8}, {0x6, 0x2, 0x9, 0xe23, 0x100, 0x5}, 0x7, 0x99, 0xef2}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xadd1}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x9}]}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x8b4}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r1, 0xc2604110, &(0x7f0000000000)={0x1, [[0x7fff, 0x41, 0x0, 0xd, 0xfffffffd, 0x0, 0x1, 0xfffffffc], [0x2, 0x0, 0x0, 0x0, 0x1, 0x5, 0x4, 0x800], [0x200000, 0x5, 0x0, 0x7, 0xfffffffe, 0xa, 0xfffffffe]], '\x00', [{0x1}, {0x3}, {0xffffffff, 0xa40}, {0x0, 0x6}, {0xb07, 0x6}, {0xfffffffc, 0x4}, {0x20004, 0x8}, {0x9, 0xe595}, {0x4, 0x200000}, {0x164, 0xffff}, {0x8, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}], '\x00', 0x80000001, 0x0, 0x0, 0x2, 0x0, 0x35}) bpf$PROG_LOAD(0x5, 0x0, 0x0) 247.148724ms ago: executing program 3 (id=1303): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) sendmmsg$inet6(r0, &(0x7f0000000a80)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4d7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}}], 0x1, 0x4c040) (fail_nth: 4) 242.842494ms ago: executing program 1 (id=1304): r0 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f00009ff000/0x600000)=nil, 0x600000, 0x0, 0x11, r0, 0x3156b000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x108081, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x13) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4040000) r2 = socket$inet(0x2, 0x3, 0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newtaction={0x70, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_ctinfo={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3f}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x1}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @loopback}, 0xc) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000180)=ANY=[@ANYBLOB="e0000002ac1414aa0100000002"], 0x18) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) r5 = getpgid(0x0) r6 = syz_pidfd_open(r5, 0x0) syz_clone(0x40040091, 0x0, 0x0, 0x0, 0x0, 0x0) pidfd_send_signal(r6, 0x11, 0x0, 0x4) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="6d8ca182e66ad46b5bb5a14c5b30ad999fa78f6802395a9c37c1d0f86b928f6643376684d170b8ca5a34db0009754da5619a5e344feaef3fcc930c7145b9eb369f8057c3e6c1a2089a3049cb8c01b67e175c058d27462cda76e8da33445a6eb6081e77323507ff30d8957725e2f4e7be2bc4cf66826a62249b8fb73033"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r9, r7}, 0xc) close_range(r4, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000003, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(0xffffffffffffffff, 0xc0305710, &(0x7f0000000040)={0x0, 0x7ff, 0x41, 0x0, 0x1}) r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/kexec_crash_loaded', 0x0, 0x0) read$FUSE(r10, &(0x7f00000007c0)={0x2020}, 0x2020) close(0x3) syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') r11 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) prctl$PR_GET_KEEPCAPS(0x7) io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x18, &(0x7f0000000380)={0x6, r11, 0x3b, {0xd4, 0x1}, 0x9}, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000071123600000000f995005000000000003710a9f1645702d4110e1e1277f18a1a87fd5afd05de0a1f43f5a1d99672a628ec85c395f2c41f7ae485d71bad005bebc7a456d09f4c7256da3aa66c4c3b6fa3f97a9c00100000000000003b9e5f67feb5b65fad673a6cdbd99ad629395de3f85951e8441e3ea97eccd003e645b02d40cea2823068eabc933b637004a188fe4ec20258d878e6e2089c1916f9094f85aa15cbbfc5691bae3dbe731ddf2013797b8c6ac4b93af4618bd07a8ad9e89489f0ef0104a530cdc49d53bf54797779e5d43253b4bd00ba5efd4281d76b6cd06f4820eeb8e6a07f1cd553966e9ad0300bc4fa22d73ea59c755abe3d24b3345534af8fbe0c6e17b5d97c484d97772fded46e35c883462bb63eaa4b0c0b9f0044b381e9e8ef21df46cd84067a7b388c6e85814d2f04c0265fa6ff83533f6766a6dbe1d1e152b93068733a36ced578c8c8"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) 0s ago: executing program 3 (id=1305): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0x1, 0x0, 0x0) (async) r1 = socket$alg(0x26, 0x5, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, 0x0, 0x0, 0x8040) (async) symlinkat(&(0x7f0000000080)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00') (async) mkdir(&(0x7f0000000300)='./file0\x00', 0xfffffffffffffffe) (async) recvmsg(r0, &(0x7f0000000340)={&(0x7f00000003c0)=@hci, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000100)}, {&(0x7f0000000180)=""/2, 0x2}, {&(0x7f0000000200)=""/26, 0x1a}], 0x3}, 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x7) (async) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) (async, rerun: 64) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x200088, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@xino_on}]}) (async, rerun: 64) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, 0x0) (async, rerun: 64) chdir(&(0x7f0000000440)='./bus\x00') (rerun: 64) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) (async, rerun: 32) socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async, rerun: 64) r5 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x100003}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40080d1}, 0x14) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x200040f0}, 0x4890) (async, rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) kernel console output (not intermixed with test programs): or pid=5160 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 398.541381][ T5883] usb 5-1: cp210x converter now attached to ttyUSB0 [ 398.549576][ T9818] netlink: 8 bytes leftover after parsing attributes in process `syz.1.960'. [ 398.567986][ T30] audit: type=1400 audit(2000000091.358:792): avc: denied { append open } for pid=5160 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 398.613237][ T9818] netlink: 8 bytes leftover after parsing attributes in process `syz.1.960'. [ 398.634490][ T9818] netlink: 8 bytes leftover after parsing attributes in process `syz.1.960'. [ 398.640113][ T30] audit: type=1400 audit(2000000091.358:793): avc: denied { getattr } for pid=5160 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 398.674196][ T9818] netlink: 8 bytes leftover after parsing attributes in process `syz.1.960'. [ 398.675083][ T30] audit: type=1400 audit(2000000091.573:794): avc: denied { setattr } for pid=9817 comm="syz.1.960" name="tun" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tun_tap_device_t tclass=chr_file permissive=1 [ 398.714827][ T9818] netlink: 8 bytes leftover after parsing attributes in process `syz.1.960'. [ 398.719651][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 398.737573][ T24] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 398.752151][ T5930] usb 5-1: USB disconnect, device number 49 [ 398.759826][ T24] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 398.768917][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807ab74c00: rx timeout, send abort [ 398.777405][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807ab74800: abort rx timeout. Force session deactivation [ 398.789203][ T5930] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 398.797487][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.806705][ T5930] cp210x 5-1:0.0: device disconnected [ 398.823532][ T24] usb 1-1: config 0 descriptor?? [ 398.984887][ T5883] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 399.102500][ T10] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 399.167385][ T5883] usb 6-1: Using ep0 maxpacket: 32 [ 399.173786][ T5883] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 399.182332][ T5883] usb 6-1: config 0 has no interface number 0 [ 399.190136][ T5883] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 399.199244][ T5883] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.207221][ T5883] usb 6-1: Product: syz [ 399.212099][ T5883] usb 6-1: Manufacturer: syz [ 399.216806][ T5883] usb 6-1: SerialNumber: syz [ 399.222878][ T5883] usb 6-1: config 0 descriptor?? [ 399.232417][ T5883] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 399.263529][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 399.270035][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 399.280971][ T10] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 399.290188][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.300770][ T10] usb 4-1: config 0 descriptor?? [ 399.303514][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807ab74c00: abort rx timeout. Force session deactivation [ 399.453302][ T9822] netlink: 8 bytes leftover after parsing attributes in process `syz.5.961'. [ 399.492358][ T9842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 399.504042][ T9842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 399.506900][ T9822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 399.560089][ T10] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 399.581697][ T9822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 399.624101][ T5883] usb 6-1: qt2_attach - failed to power on unit: -71 [ 399.673239][ T5883] quatech2 6-1:0.51: probe with driver quatech2 failed with error -71 [ 399.722488][ T5883] usb 6-1: USB disconnect, device number 10 [ 399.734059][ T9] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 399.879956][ T30] audit: type=1326 audit(2000000092.873:795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9830 comm="syz.1.965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf4519c629 code=0x7fc00000 [ 400.933284][ T30] audit: type=1326 audit(2000000092.873:796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9830 comm="syz.1.965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7faf4519c629 code=0x7fc00000 [ 401.639250][ T30] audit: type=1326 audit(2000000092.873:797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9830 comm="syz.1.965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf4519c629 code=0x7fc00000 [ 401.662978][ T30] audit: type=1326 audit(2000000092.873:798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9830 comm="syz.1.965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf4519c629 code=0x7fc00000 [ 401.688945][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 401.699761][ T9] usb 5-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice=4e.53 [ 401.716659][ T30] audit: type=1326 audit(2000000092.873:799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9830 comm="syz.1.965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf4519c629 code=0x7fc00000 [ 401.751345][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.788231][ T9] usb 5-1: config 0 descriptor?? [ 401.828006][ T30] audit: type=1326 audit(2000000092.873:800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9830 comm="syz.1.965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf4519c629 code=0x7fc00000 [ 401.890644][ T30] audit: type=1326 audit(2000000092.873:801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9830 comm="syz.1.965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf4519c629 code=0x7fc00000 [ 401.947504][ T30] audit: type=1326 audit(2000000092.873:802): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9830 comm="syz.1.965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf4519c629 code=0x7fc00000 [ 402.014863][ T30] audit: type=1326 audit(2000000092.873:803): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9830 comm="syz.1.965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf4519c629 code=0x7fc00000 [ 402.092365][ T9] usb 5-1: USB disconnect, device number 50 [ 402.104143][ T30] audit: type=1326 audit(2000000092.873:804): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9830 comm="syz.1.965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf4519c629 code=0x7fc00000 [ 402.240683][ T5808] udevd[5808]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 403.089833][ T24] usb 4-1: USB disconnect, device number 42 [ 405.096013][ T5875] usb 1-1: USB disconnect, device number 42 [ 405.356477][ T10] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 405.538216][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 405.563440][ T10] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 405.606042][ T10] usb 2-1: config 0 has no interface number 0 [ 405.632808][ T10] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 405.679314][ T10] usb 2-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 405.716785][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.754926][ T10] usb 2-1: Product: syz [ 405.775089][ T10] usb 2-1: Manufacturer: syz [ 405.795923][ T10] usb 2-1: SerialNumber: syz [ 405.819708][ T10] usb 2-1: config 0 descriptor?? [ 406.130525][ T10] em28xx 2-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 406.151134][ T10] em28xx 2-1:0.132: Video interface 132 found: [ 406.456962][ T9887] vivid-007: ================= START STATUS ================= [ 406.493886][ T9887] vivid-007: Enable Output Cropping: true [ 406.500160][ T9887] vivid-007: Enable Output Composing: true [ 406.508097][ T9887] vivid-007: Enable Output Scaler: true [ 406.514031][ T9887] vivid-007: Tx RGB Quantization Range: Automatic [ 406.521353][ T9887] vivid-007: Transmit Mode: HDMI [ 406.529364][ T9887] vivid-007: Hotplug Present: 0x00000000 [ 406.589296][ T9887] vivid-007: RxSense Present: 0x00000000 [ 406.597432][ T30] kauditd_printk_skb: 59 callbacks suppressed [ 406.597447][ T30] audit: type=1400 audit(2000000099.150:864): avc: denied { setattr } for pid=9885 comm="syz.4.977" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 406.623494][ T10] em28xx 2-1:0.132: unknown em28xx chip ID (0) [ 406.639478][ T9887] vivid-007: EDID Present: 0x00000000 [ 406.657265][ T9887] vivid-007: ================== END STATUS ================== [ 407.008815][ T9892] netlink: 8 bytes leftover after parsing attributes in process `syz.5.978'. [ 407.788273][ T10] em28xx 2-1:0.132: failed to trigger write to i2c address 0xa0 (error=-5) [ 407.815350][ T10] em28xx 2-1:0.132: failed to read eeprom (err=-5) [ 407.862784][ T10] em28xx 2-1:0.132: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 407.971540][ T10] em28xx 2-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 408.012144][ T10] em28xx 2-1:0.132: analog set to bulk mode. [ 408.022955][ T9] em28xx 2-1:0.132: Registering V4L2 extension [ 408.077214][ T10] usb 2-1: USB disconnect, device number 42 [ 408.099759][ T10] em28xx 2-1:0.132: Disconnecting em28xx [ 408.379216][ T9903] openvswitch: netlink: Flow actions attr not present in new flow. [ 408.705116][ T9] em28xx 2-1:0.132: Config register raw data: 0xffffffed [ 409.142650][ T9] em28xx 2-1:0.132: AC97 chip type couldn't be determined [ 409.149803][ T9] em28xx 2-1:0.132: No AC97 audio processor [ 409.165673][ T9] usb 2-1: Decoder not found [ 409.172229][ T9] em28xx 2-1:0.132: failed to create media graph [ 409.181026][ T9] em28xx 2-1:0.132: V4L2 device video103 deregistered [ 409.209537][ T9] em28xx 2-1:0.132: Remote control support is not available for this card. [ 409.246781][ T10] em28xx 2-1:0.132: Closing input extension [ 409.268707][ T10] em28xx 2-1:0.132: Freeing device [ 412.151967][ T9930] netlink: 'syz.0.989': attribute type 3 has an invalid length. [ 412.179853][ T9935] FAULT_INJECTION: forcing a failure. [ 412.179853][ T9935] name failslab, interval 1, probability 0, space 0, times 0 [ 412.206386][ T9935] CPU: 1 UID: 0 PID: 9935 Comm: syz.5.991 Tainted: G L syzkaller #0 PREEMPT(full) [ 412.206417][ T9935] Tainted: [L]=SOFTLOCKUP [ 412.206429][ T9935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 412.206440][ T9935] Call Trace: [ 412.206445][ T9935] [ 412.206452][ T9935] dump_stack_lvl+0x100/0x190 [ 412.206485][ T9935] should_fail_ex.cold+0x5/0xa [ 412.206509][ T9935] should_failslab+0xc2/0x120 [ 412.206536][ T9935] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 412.206559][ T9935] ? skb_clone+0x190/0x400 [ 412.206580][ T9935] skb_clone+0x190/0x400 [ 412.206598][ T9935] netlink_deliver_tap+0xaed/0xcc0 [ 412.206622][ T9935] netlink_unicast+0x650/0x870 [ 412.206646][ T9935] ? __pfx_netlink_unicast+0x10/0x10 [ 412.206674][ T9935] netlink_sendmsg+0x8b0/0xda0 [ 412.206697][ T9935] ? __pfx_netlink_sendmsg+0x10/0x10 [ 412.206715][ T9935] ? __might_fault+0x60/0x140 [ 412.206745][ T9935] ____sys_sendmsg+0xa54/0xc30 [ 412.206769][ T9935] ? __pfx_____sys_sendmsg+0x10/0x10 [ 412.206801][ T9935] ___sys_sendmsg+0x190/0x1e0 [ 412.206826][ T9935] ? __pfx____sys_sendmsg+0x10/0x10 [ 412.206878][ T9935] __sys_sendmsg+0x170/0x220 [ 412.206896][ T9935] ? __pfx___sys_sendmsg+0x10/0x10 [ 412.206930][ T9935] do_syscall_64+0x106/0xf80 [ 412.206948][ T9935] ? clear_bhb_loop+0x40/0x90 [ 412.206970][ T9935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.206988][ T9935] RIP: 0033:0x7fef37b9c629 [ 412.207004][ T9935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 412.207021][ T9935] RSP: 002b:00007fef389fc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 412.207038][ T9935] RAX: ffffffffffffffda RBX: 00007fef37e15fa0 RCX: 00007fef37b9c629 [ 412.207050][ T9935] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 412.207059][ T9935] RBP: 00007fef389fc090 R08: 0000000000000000 R09: 0000000000000000 [ 412.207069][ T9935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 412.207079][ T9935] R13: 00007fef37e16038 R14: 00007fef37e15fa0 R15: 00007ffdac4afba8 [ 412.207103][ T9935] [ 412.812447][ T30] audit: type=1400 audit(2000000104.968:865): avc: denied { watch watch_reads } for pid=9944 comm="syz.0.995" path="pipe:[27569]" dev="pipefs" ino=27569 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 413.198940][ T9947] netlink: 'syz.0.995': attribute type 12 has an invalid length. [ 413.212247][ T9947] netlink: 'syz.0.995': attribute type 29 has an invalid length. [ 413.220595][ T9947] netlink: 148 bytes leftover after parsing attributes in process `syz.0.995'. [ 413.231102][ T30] audit: type=1400 audit(2000000105.352:866): avc: denied { ioctl } for pid=9939 comm="syz.5.994" path="socket:[28157]" dev="sockfs" ino=28157 ioctlcmd=0x5875 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 413.231166][ T9947] netlink: 'syz.0.995': attribute type 1 has an invalid length. [ 413.455612][ T5842] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 413.714907][ T5842] usb 4-1: Using ep0 maxpacket: 32 [ 414.179382][ T5842] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 414.187513][ T5842] usb 4-1: config 0 has no interface number 0 [ 414.208756][ T5842] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 414.218275][ T5842] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.227167][ T5842] usb 4-1: Product: syz [ 414.240161][ T5842] usb 4-1: Manufacturer: syz [ 414.250332][ T5842] usb 4-1: SerialNumber: syz [ 414.267194][ T5842] usb 4-1: config 0 descriptor?? [ 414.280803][ T5842] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 414.495464][ T5842] usb 4-1: qt2_attach - failed to power on unit: -71 [ 414.573574][ T5842] quatech2 4-1:0.51: probe with driver quatech2 failed with error -71 [ 414.608186][ T5842] usb 4-1: USB disconnect, device number 43 [ 414.609545][ T5875] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 415.182075][ T9] usb 5-1: new full-speed USB device number 51 using dummy_hcd [ 415.215790][ T5875] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 415.232170][ T5875] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 415.262460][ T5875] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 415.281571][ T5875] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 415.305027][ T5875] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 415.318860][ T5875] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 415.329671][ T5875] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 415.338270][ T5875] usb 2-1: Product: syz [ 415.360076][ T5875] usb 2-1: Manufacturer: syz [ 415.375552][ T9] usb 5-1: not running at top speed; connect to a high speed hub [ 415.379079][ T5875] cdc_wdm 2-1:1.0: skipping garbage [ 415.400704][ T5875] cdc_wdm 2-1:1.0: skipping garbage [ 415.412678][ T9] usb 5-1: config 1 interface 0 altsetting 10 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 415.429189][ T5875] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 415.442889][ T5875] cdc_wdm 2-1:1.0: Unknown control protocol [ 415.456607][ T9] usb 5-1: config 1 interface 0 altsetting 10 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 415.619806][ T9] usb 5-1: config 1 interface 0 has no altsetting 0 [ 415.761134][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 415.761391][ T5875] usb 2-1: USB disconnect, device number 43 [ 415.767762][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 415.767784][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 415.974669][ T9] usb 5-1: string descriptor 0 read error: -22 [ 415.995722][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 416.006346][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.310665][ T9972] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 416.320089][ T9] usb 5-1: bad CDC descriptors [ 416.877226][ T30] audit: type=1400 audit(2000000108.775:867): avc: denied { append } for pid=9991 comm="syz.3.1006" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 417.059731][ T30] audit: type=1400 audit(2000000108.794:868): avc: denied { getopt } for pid=9976 comm="syz.5.1002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 417.175723][T10000] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=10000 comm=syz.0.1007 [ 418.259675][ T9] usb 5-1: USB disconnect, device number 51 [ 419.248934][ T30] audit: type=1400 audit(2000000110.992:869): avc: denied { bind } for pid=10014 comm="syz.3.1013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 419.582694][T10032] program syz.0.1015 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 419.671223][ T9] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 420.916594][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 421.216681][ T9] usb 4-1: config 0 has an invalid interface number: 147 but max is 0 [ 421.339035][T10049] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=10049 comm=syz.5.1019 [ 422.263671][ T9] usb 4-1: config 0 has no interface number 0 [ 422.289579][ T9] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice=cb.7c [ 422.301154][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.309391][ T9] usb 4-1: Product: syz [ 422.336276][ T9] usb 4-1: Manufacturer: syz [ 422.341002][ T9] usb 4-1: SerialNumber: syz [ 422.355731][ T9] usb 4-1: config 0 descriptor?? [ 422.363667][ T9] ti_usb_3410_5052 4-1:0.147: TI USB 5052 2 port adapter converter detected [ 422.373706][ T9] ti_usb_3410_5052 4-1:0.147: missing endpoints [ 422.842991][ T9] usb 4-1: USB disconnect, device number 44 [ 423.256416][ T5842] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 423.414909][T10068] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=10068 comm=syz.3.1024 [ 423.584193][ T5930] usb 1-1: new full-speed USB device number 43 using dummy_hcd [ 424.249736][ T9] page_pool_release_retry() stalled pool shutdown: id 39, 1 inflight 61 sec [ 424.910759][ T5930] usb 1-1: not running at top speed; connect to a high speed hub [ 424.966683][ T5930] usb 1-1: config 1 interface 0 altsetting 10 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 425.027323][ T5930] usb 1-1: config 1 interface 0 altsetting 10 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 425.083206][ T5930] usb 1-1: config 1 interface 0 has no altsetting 0 [ 425.117958][ T5930] usb 1-1: string descriptor 0 read error: -22 [ 425.134212][ T5930] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 425.203346][ T5930] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.267388][T10066] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 425.285278][ T5930] usb 1-1: bad CDC descriptors [ 425.483583][T10078] openvswitch: netlink: Unexpected mask (mask=200840, allowed=10048) [ 425.732073][ T5842] usb 5-1: device descriptor read/all, error -71 [ 425.786890][ T9] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 425.887089][T10083] program syz.4.1027 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 425.967962][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 426.754229][ T5932] usb 1-1: USB disconnect, device number 43 [ 426.909152][ T9] usb 6-1: device descriptor read/all, error -71 [ 427.217405][T10097] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=10097 comm=syz.1.1031 [ 427.332294][T10101] usb usb8: usbfs: process 10101 (syz.3.1032) did not claim interface 2 before use [ 428.124470][ T5842] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 428.298612][ T5842] usb 5-1: Using ep0 maxpacket: 32 [ 428.398323][ T5842] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 428.407135][ T30] audit: type=1400 audit(2000000119.551:870): avc: denied { execute } for pid=10095 comm="syz.3.1032" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 428.625646][ T5842] usb 5-1: config 0 has no interface number 0 [ 428.639663][ T5842] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 428.648832][ T5842] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.658201][ T5842] usb 5-1: Product: syz [ 428.662983][ T5842] usb 5-1: Manufacturer: syz [ 428.663117][T10096] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(11) [ 428.667582][ T5842] usb 5-1: SerialNumber: syz [ 428.674147][T10096] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 428.690595][ T5842] usb 5-1: config 0 descriptor?? [ 428.710246][T10096] vhci_hcd vhci_hcd.0: Device attached [ 428.710642][ T5842] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 428.745857][T10106] vhci_hcd: connection closed [ 428.746727][ T1153] vhci_hcd vhci_hcd.3: stop threads [ 428.762165][ T1153] vhci_hcd vhci_hcd.3: release socket [ 428.768096][ T1153] vhci_hcd vhci_hcd.3: disconnect device [ 428.946228][ T5842] usb 5-1: qt2_attach - failed to power on unit: -71 [ 429.093565][T10112] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=10112 comm=syz.1.1035 [ 430.055792][ T5842] quatech2 5-1:0.51: probe with driver quatech2 failed with error -71 [ 430.342984][ T5842] usb 5-1: USB disconnect, device number 54 [ 430.356508][ T30] audit: type=1326 audit(2000000121.384:871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10090 comm="syz.0.1030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f905cf9c629 code=0x7ffc0000 [ 430.553747][ T30] audit: type=1326 audit(2000000121.384:872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10090 comm="syz.0.1030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f905cf9c629 code=0x7ffc0000 [ 430.593880][ T30] audit: type=1326 audit(2000000121.384:873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10090 comm="syz.0.1030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=35 compat=0 ip=0x7f905cf9c629 code=0x7ffc0000 [ 430.619025][ T30] audit: type=1326 audit(2000000121.384:874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10090 comm="syz.0.1030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f905cf9c629 code=0x7ffc0000 [ 430.651950][ T30] audit: type=1326 audit(2000000121.384:875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10090 comm="syz.0.1030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f905cf9c629 code=0x7ffc0000 [ 430.702966][ T30] audit: type=1326 audit(2000000121.384:876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10090 comm="syz.0.1030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f905cf9c629 code=0x7ffc0000 [ 430.743339][ T30] audit: type=1326 audit(2000000121.384:877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10090 comm="syz.0.1030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f905cf9c629 code=0x7ffc0000 [ 430.842287][ T30] audit: type=1326 audit(2000000121.384:878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10090 comm="syz.0.1030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f905cf9c629 code=0x7ffc0000 [ 430.875039][ T30] audit: type=1326 audit(2000000121.384:879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10090 comm="syz.0.1030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f905cf9c629 code=0x7ffc0000 [ 430.904890][T10119] openvswitch: netlink: Unexpected mask (mask=200840, allowed=10048) [ 430.961475][ T5842] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 431.041422][T10131] program syz.3.1040 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 431.372122][ T5842] usb 5-1: Using ep0 maxpacket: 8 [ 431.887206][ T5842] usb 5-1: device descriptor read/all, error -71 [ 432.151184][T10139] fuse: Unknown parameter 'fd0x0000000000000004' [ 432.298468][T10143] openvswitch: netlink: Unexpected mask (mask=200840, allowed=10048) [ 432.382356][ T5932] usb 4-1: new full-speed USB device number 45 using dummy_hcd [ 432.543752][ T5930] usb 1-1: new full-speed USB device number 44 using dummy_hcd [ 432.567339][ T5932] usb 4-1: not running at top speed; connect to a high speed hub [ 432.597651][ T5932] usb 4-1: config 1 interface 0 altsetting 10 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 432.622096][ T5932] usb 4-1: config 1 interface 0 altsetting 10 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 432.643053][ T5932] usb 4-1: config 1 interface 0 has no altsetting 0 [ 432.665941][ T5932] usb 4-1: string descriptor 0 read error: -22 [ 432.680637][ T5932] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 432.691344][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.716848][ T5930] usb 1-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 432.729324][T10134] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 432.738001][ T5932] usb 4-1: bad CDC descriptors [ 432.748529][ T5930] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.759069][ T5930] usb 1-1: Product: syz [ 432.763296][ T5930] usb 1-1: Manufacturer: syz [ 432.768896][ T5930] usb 1-1: SerialNumber: syz [ 432.790815][ T5930] usb 1-1: config 0 descriptor?? [ 432.802184][T10149] pim6reg: entered allmulticast mode [ 433.641140][T10168] program syz.4.1051 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 433.894321][ T5930] airspy 1-1:0.0: usb_control_msg() failed -110 request 09 [ 434.654606][ T5930] airspy 1-1:0.0: Could not detect board [ 434.830872][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 435.126775][ T5930] airspy 1-1:0.0: probe with driver airspy failed with error -110 [ 435.170451][ T5883] usb 4-1: USB disconnect, device number 45 [ 435.466914][T10175] fuse: Unknown parameter 'fd0x0000000000000004' [ 436.040722][T10184] netlink: 'syz.3.1056': attribute type 1 has an invalid length. [ 436.059583][ T5932] usb 1-1: USB disconnect, device number 44 [ 436.139809][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 436.139829][ T30] audit: type=1400 audit(2000000126.791:887): avc: denied { create } for pid=10181 comm="syz.3.1056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 436.511658][ T30] audit: type=1400 audit(2000000126.791:888): avc: denied { write } for pid=10181 comm="syz.3.1056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 436.631532][T10188] bond3: (slave gretap1): Enslaving as a backup interface with an up link [ 436.831223][T10195] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1056'. [ 436.896878][T10184] macvlan3: entered promiscuous mode [ 436.912261][T10184] macvlan3: entered allmulticast mode [ 437.014523][T10184] bond3: entered promiscuous mode [ 437.026606][ T30] audit: type=1400 audit(2000000127.623:889): avc: denied { watch } for pid=10193 comm="syz.5.1061" path="/80" dev="tmpfs" ino=439 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 437.057985][ T5820] Bluetooth: hci1: command 0x0406 tx timeout [ 437.066114][T10184] gretap1: entered promiscuous mode [ 437.092714][T10184] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 437.288989][T10209] program syz.5.1063 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 438.164627][T10184] bond3: left promiscuous mode [ 438.173643][T10184] gretap1: left promiscuous mode [ 438.208933][T10183] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1057'. [ 441.234330][ T24] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 441.295996][T10240] netlink: 212348 bytes leftover after parsing attributes in process `syz.5.1067'. [ 441.352684][T10240] netlink: ct family unspecified [ 441.505480][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 441.511817][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.528517][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 441.556512][ T24] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 441.566933][T10246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1072'. [ 441.586082][ T24] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 441.598579][ T5930] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 441.616077][T10246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1072'. [ 441.626820][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.639717][T10246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1072'. [ 441.657652][ T24] usb 5-1: config 0 descriptor?? [ 441.663671][T10246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1072'. [ 441.683003][T10246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1072'. [ 441.802199][ T5930] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 441.822146][ T5930] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 441.832326][ T5930] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 441.887059][ T5930] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 441.956418][ T5930] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 441.988725][ T5930] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 442.018230][ T5930] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 442.046565][ T5930] usb 2-1: Product: syz [ 442.061199][ T5930] usb 2-1: Manufacturer: syz [ 442.128193][ T5930] cdc_wdm 2-1:1.0: skipping garbage [ 442.153763][ T5930] cdc_wdm 2-1:1.0: skipping garbage [ 442.219124][T10254] program syz.5.1074 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 443.039091][ T5930] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 443.160408][ T5930] cdc_wdm 2-1:1.0: Unknown control protocol [ 443.199756][ T5930] usb 2-1: USB disconnect, device number 44 [ 443.404375][ T5875] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 443.575589][ T5875] usb 6-1: Using ep0 maxpacket: 8 [ 443.608119][ T5875] usb 6-1: config index 0 descriptor too short (expected 74, got 45) [ 443.619029][ T5875] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 443.631819][ T5875] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 443.644697][ T5875] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 443.668026][ T5875] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 443.693291][ T5875] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 444.386787][ T5875] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 444.396502][ T5875] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.638013][ T5875] usb 6-1: GET_CAPABILITIES returned 0 [ 444.649646][T10265] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 444.656734][ T5875] usbtmc 6-1:16.0: can't read capabilities [ 444.788332][ T5883] usb 5-1: USB disconnect, device number 57 [ 445.116320][ T10] usb 6-1: USB disconnect, device number 13 [ 447.283616][T10289] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 449.297063][T10311] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1090'. [ 449.974524][T10322] netlink: 212348 bytes leftover after parsing attributes in process `syz.5.1085'. [ 449.991786][T10322] netlink: ct family unspecified [ 450.590428][ T10] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 450.840130][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 451.075318][ T10] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 451.142658][ T10] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 451.156164][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.173893][ T10] usb 2-1: config 0 descriptor?? [ 452.020766][T10345] FAULT_INJECTION: forcing a failure. [ 452.020766][T10345] name failslab, interval 1, probability 0, space 0, times 0 [ 452.033563][T10345] CPU: 0 UID: 0 PID: 10345 Comm: syz.5.1099 Tainted: G L syzkaller #0 PREEMPT(full) [ 452.033592][T10345] Tainted: [L]=SOFTLOCKUP [ 452.033597][T10345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 452.033607][T10345] Call Trace: [ 452.033613][T10345] [ 452.033619][T10345] dump_stack_lvl+0x100/0x190 [ 452.033644][T10345] should_fail_ex.cold+0x5/0xa [ 452.033659][T10345] should_failslab+0xc2/0x120 [ 452.033677][T10345] __kmalloc_node_noprof+0xe6/0x850 [ 452.033692][T10345] ? qdisc_alloc+0xbb/0xb30 [ 452.033709][T10345] ? qdisc_lookup_ops+0xf3/0x130 [ 452.033724][T10345] qdisc_alloc+0xbb/0xb30 [ 452.033741][T10345] ? _raw_read_unlock+0x28/0x50 [ 452.033762][T10345] qdisc_create+0x70/0x1090 [ 452.033776][T10345] ? nla_strcmp+0xff/0x130 [ 452.033796][T10345] tc_modify_qdisc+0xdcf/0x2120 [ 452.033814][T10345] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 452.033836][T10345] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 452.033852][T10345] ? rtnl_get_link+0x1a0/0x320 [ 452.033868][T10345] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 452.033883][T10345] rtnetlink_rcv_msg+0x3c9/0xe90 [ 452.033896][T10345] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 452.033909][T10345] ? __pfx___schedule+0x10/0x10 [ 452.033930][T10345] netlink_rcv_skb+0x159/0x420 [ 452.033943][T10345] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 452.033955][T10345] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 452.033973][T10345] ? rcu_is_watching+0x12/0xc0 [ 452.033990][T10345] netlink_unicast+0x5aa/0x870 [ 452.034004][T10345] ? __pfx_netlink_unicast+0x10/0x10 [ 452.034022][T10345] netlink_sendmsg+0x8b0/0xda0 [ 452.034037][T10345] ? __pfx_netlink_sendmsg+0x10/0x10 [ 452.034048][T10345] ? __might_fault+0x60/0x140 [ 452.034067][T10345] ____sys_sendmsg+0xa54/0xc30 [ 452.034083][T10345] ? __pfx_____sys_sendmsg+0x10/0x10 [ 452.034103][T10345] ___sys_sendmsg+0x190/0x1e0 [ 452.034118][T10345] ? __pfx____sys_sendmsg+0x10/0x10 [ 452.034140][T10345] ? __rcu_read_unlock+0x26a/0x5e0 [ 452.034166][T10345] __sys_sendmmsg+0x205/0x430 [ 452.034180][T10345] ? __pfx___sys_sendmmsg+0x10/0x10 [ 452.034195][T10345] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 452.034213][T10345] ? fput+0x79/0x100 [ 452.034225][T10345] ? ksys_write+0x1ac/0x250 [ 452.034241][T10345] ? __pfx_ksys_write+0x10/0x10 [ 452.034259][T10345] __x64_sys_sendmmsg+0x9c/0x100 [ 452.034274][T10345] ? lockdep_hardirqs_on+0x78/0x100 [ 452.034286][T10345] do_syscall_64+0x106/0xf80 [ 452.034297][T10345] ? clear_bhb_loop+0x40/0x90 [ 452.034310][T10345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.034321][T10345] RIP: 0033:0x7fef37b9c629 [ 452.034333][T10345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 452.034343][T10345] RSP: 002b:00007fef389db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 452.034354][T10345] RAX: ffffffffffffffda RBX: 00007fef37e16090 RCX: 00007fef37b9c629 [ 452.034361][T10345] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000007 [ 452.034367][T10345] RBP: 00007fef389db090 R08: 0000000000000000 R09: 0000000000000000 [ 452.034373][T10345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.034379][T10345] R13: 00007fef37e16128 R14: 00007fef37e16090 R15: 00007ffdac4afba8 [ 452.034394][T10345] [ 455.100091][ T24] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 455.579642][T10372] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=10372 comm=syz.4.1104 [ 458.014058][ T24] usb 2-1: USB disconnect, device number 45 [ 458.698634][T10396] vivid-000: kernel_thread() failed [ 458.698781][ T10] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 458.981630][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 459.156059][ T10] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 459.173851][ T10] usb 5-1: config 0 has no interface number 0 [ 459.192540][ T10] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 459.227653][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.235660][ T10] usb 5-1: Product: syz [ 459.252316][ T10] usb 5-1: Manufacturer: syz [ 459.262387][ T10] usb 5-1: SerialNumber: syz [ 459.526425][ T10] usb 5-1: config 0 descriptor?? [ 459.542904][ T10] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 459.590088][ T5883] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 459.635301][T10414] FAULT_INJECTION: forcing a failure. [ 459.635301][T10414] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 459.650234][T10414] CPU: 1 UID: 0 PID: 10414 Comm: syz.1.1117 Tainted: G L syzkaller #0 PREEMPT(full) [ 459.650264][T10414] Tainted: [L]=SOFTLOCKUP [ 459.650270][T10414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 459.650280][T10414] Call Trace: [ 459.650286][T10414] [ 459.650292][T10414] dump_stack_lvl+0x100/0x190 [ 459.650327][T10414] should_fail_ex.cold+0x5/0xa [ 459.650348][T10414] _copy_to_user+0x32/0xd0 [ 459.650373][T10414] simple_read_from_buffer+0xcb/0x170 [ 459.650403][T10414] proc_fail_nth_read+0x1af/0x230 [ 459.650427][T10414] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 459.650449][T10414] ? rw_verify_area+0xce/0x6d0 [ 459.650471][T10414] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 459.650492][T10414] vfs_read+0x1e4/0xb30 [ 459.650519][T10414] ? __pfx_vfs_read+0x10/0x10 [ 459.650542][T10414] ? __fget_files+0x215/0x3d0 [ 459.650562][T10414] ? __fget_files+0x21f/0x3d0 [ 459.650584][T10414] ksys_read+0x12a/0x250 [ 459.650608][T10414] ? __pfx_ksys_read+0x10/0x10 [ 459.650637][T10414] do_syscall_64+0x106/0xf80 [ 459.650654][T10414] ? clear_bhb_loop+0x40/0x90 [ 459.650675][T10414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.650693][T10414] RIP: 0033:0x7faf4515cece [ 459.650708][T10414] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 459.650723][T10414] RSP: 002b:00007faf45fd4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 459.650740][T10414] RAX: ffffffffffffffda RBX: 00007faf45fd56c0 RCX: 00007faf4515cece [ 459.650750][T10414] RDX: 000000000000000f RSI: 00007faf45fd50a0 RDI: 0000000000000004 [ 459.650760][T10414] RBP: 00007faf45fd5090 R08: 0000000000000000 R09: 0000000000000000 [ 459.650768][T10414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 459.650778][T10414] R13: 00007faf45416038 R14: 00007faf45415fa0 R15: 00007ffcf13298b8 [ 459.650802][T10414] [ 459.887886][T10392] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1110'. [ 459.922206][ T5883] usb 6-1: Using ep0 maxpacket: 32 [ 459.946373][ T5883] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 459.957430][ T5883] usb 6-1: config 0 has no interface number 0 [ 459.973673][ T5883] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 459.985269][ T5883] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.993753][ T5883] usb 6-1: Product: syz [ 460.003296][T10392] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 460.051208][T10392] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 460.060691][ T5883] usb 6-1: Manufacturer: syz [ 460.066978][ T5883] usb 6-1: SerialNumber: syz [ 460.079218][ T10] usb 5-1: qt2_attach - failed to power on unit: -71 [ 460.665372][ T9] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 460.724940][ T5883] usb 6-1: config 0 descriptor?? [ 460.730296][ T10] quatech2 5-1:0.51: probe with driver quatech2 failed with error -71 [ 460.740539][ T5883] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 460.752743][ T10] usb 5-1: USB disconnect, device number 58 [ 460.871538][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 460.884098][ T9] usb 1-1: config 0 has an invalid interface number: 212 but max is 0 [ 461.370586][ T5883] usb 6-1: qt2_attach - failed to power on unit: -71 [ 461.388901][ T9] usb 1-1: config 0 has no interface number 0 [ 461.395086][ T9] usb 1-1: config 0 interface 212 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 461.406175][ T5883] quatech2 6-1:0.51: probe with driver quatech2 failed with error -71 [ 461.466401][ T5883] usb 6-1: USB disconnect, device number 15 [ 461.558023][ T9] usb 1-1: New USB device found, idVendor=257a, idProduct=360c, bcdDevice=f3.40 [ 461.678044][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.706291][ T9] usb 1-1: Product: syz [ 461.710466][ T9] usb 1-1: Manufacturer: syz [ 461.742461][ T9] usb 1-1: SerialNumber: syz [ 461.779875][ T9] usb 1-1: config 0 descriptor?? [ 461.797397][ T9] option 1-1:0.212: GSM modem (1-port) converter detected [ 462.048495][T10416] netlink: 'syz.0.1118': attribute type 21 has an invalid length. [ 462.052322][T10437] netlink: 'syz.0.1118': attribute type 21 has an invalid length. [ 462.079677][T10416] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1118'. [ 462.118246][T10416] netlink: 'syz.0.1118': attribute type 4 has an invalid length. [ 462.141386][T10437] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1118'. [ 462.143208][T10416] netlink: 'syz.0.1118': attribute type 3 has an invalid length. [ 462.162977][T10416] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1118'. [ 462.206218][T10437] netlink: 'syz.0.1118': attribute type 4 has an invalid length. [ 462.235773][T10437] netlink: 'syz.0.1118': attribute type 3 has an invalid length. [ 462.256235][T10437] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1118'. [ 462.409898][ T9] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 462.571846][ T5875] usb 1-1: USB disconnect, device number 45 [ 462.579227][ T5875] option 1-1:0.212: device disconnected [ 462.659505][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 462.786280][ T9] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 462.861149][ T30] audit: type=1400 audit(2000000920.210:890): avc: denied { write } for pid=10450 comm="syz.0.1126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 462.887956][ T9] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 462.919920][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.984816][ T9] usb 5-1: config 0 descriptor?? [ 463.999057][ T30] audit: type=1400 audit(2000000921.417:891): avc: denied { watch_reads } for pid=10466 comm="syz.0.1132" path="/228/file0" dev="tmpfs" ino=1240 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 464.220716][T10474] dvmrp9: entered allmulticast mode [ 464.293470][ T9] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 464.446232][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 464.488085][ T9] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 464.518769][ T9] usb 4-1: config 0 has no interface number 0 [ 464.551111][ T9] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 464.579259][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.612067][ T9] usb 4-1: Product: syz [ 464.630854][ T9] usb 4-1: Manufacturer: syz [ 464.651003][ T9] usb 4-1: SerialNumber: syz [ 464.680703][ T9] usb 4-1: config 0 descriptor?? [ 464.707593][ T9] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 464.920807][T10469] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1131'. [ 465.033609][T10469] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.081621][T10469] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.140457][ T5875] usb 5-1: USB disconnect, device number 59 [ 465.255742][ T9] usb 4-1: qt2_attach - failed to power on unit: -71 [ 465.292446][ T9] quatech2 4-1:0.51: probe with driver quatech2 failed with error -71 [ 465.343087][ T9] usb 4-1: USB disconnect, device number 46 [ 465.437746][T10486] 9p: Bad value for 'wfdno' [ 465.731976][T10490] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=10490 comm=syz.1.1136 [ 466.882125][ T9] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 467.131308][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 467.159572][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 102, changing to 7 [ 467.224090][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 24624, setting to 1024 [ 468.862077][T10506] FAULT_INJECTION: forcing a failure. [ 468.862077][T10506] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 468.885015][T10506] CPU: 1 UID: 0 PID: 10506 Comm: syz.1.1142 Tainted: G L syzkaller #0 PREEMPT(full) [ 468.885046][T10506] Tainted: [L]=SOFTLOCKUP [ 468.885052][T10506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 468.885062][T10506] Call Trace: [ 468.885068][T10506] [ 468.885076][T10506] dump_stack_lvl+0x100/0x190 [ 468.885117][T10506] should_fail_ex.cold+0x5/0xa [ 468.885139][T10506] _copy_from_user+0x2e/0xd0 [ 468.885164][T10506] ip_tunnel_parm_from_user+0xa5/0x370 [ 468.885186][T10506] ? __pfx_ip_tunnel_parm_from_user+0x10/0x10 [ 468.885211][T10506] ? avc_has_extended_perms+0x484/0x1080 [ 468.885242][T10506] ip_tunnel_siocdevprivate+0xa1/0x1b0 [ 468.885263][T10506] ? __pfx_ip_tunnel_siocdevprivate+0x10/0x10 [ 468.885289][T10506] ? netdev_name_node_lookup+0x107/0x150 [ 468.885319][T10506] dev_ifsioc+0xc60/0x1f20 [ 468.885348][T10506] ? __pfx_dev_ifsioc+0x10/0x10 [ 468.885370][T10506] ? __pfx___mutex_lock+0x10/0x10 [ 468.885398][T10506] ? dev_load+0x8e/0x240 [ 468.885419][T10506] ? dev_load+0x8e/0x240 [ 468.885449][T10506] dev_ioctl+0x70e/0x10e0 [ 468.885477][T10506] sock_ioctl+0x494/0x6b0 [ 468.885500][T10506] ? __pfx_sock_ioctl+0x10/0x10 [ 468.885520][T10506] ? hook_file_ioctl_common+0x146/0x410 [ 468.885548][T10506] ? selinux_file_ioctl+0x139/0x290 [ 468.885567][T10506] ? selinux_file_ioctl+0xb4/0x290 [ 468.885587][T10506] ? __pfx_sock_ioctl+0x10/0x10 [ 468.885610][T10506] __x64_sys_ioctl+0x18e/0x210 [ 468.885636][T10506] do_syscall_64+0x106/0xf80 [ 468.885652][T10506] ? clear_bhb_loop+0x40/0x90 [ 468.885674][T10506] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.885690][T10506] RIP: 0033:0x7faf4519c629 [ 468.885706][T10506] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 468.885722][T10506] RSP: 002b:00007faf45fd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 468.885738][T10506] RAX: ffffffffffffffda RBX: 00007faf45415fa0 RCX: 00007faf4519c629 [ 468.885749][T10506] RDX: 0000200000000200 RSI: 00000000000089f1 RDI: 0000000000000003 [ 468.885759][T10506] RBP: 00007faf45fd5090 R08: 0000000000000000 R09: 0000000000000000 [ 468.885769][T10506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 468.885778][T10506] R13: 00007faf45416038 R14: 00007faf45415fa0 R15: 00007ffcf13298b8 [ 468.885802][T10506] [ 469.511087][T10511] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 470.111571][ T9] usb 5-1: string descriptor 0 read error: -71 [ 470.131539][ T9] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=7b.55 [ 470.360961][ T5875] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 470.413847][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.439308][ T9] usb 5-1: config 0 descriptor?? [ 470.470268][ T9] usb 5-1: can't set config #0, error -71 [ 470.481828][ T9] usb 5-1: USB disconnect, device number 60 [ 470.570199][ T30] audit: type=1400 audit(2000000928.305:892): avc: denied { setopt } for pid=10512 comm="syz.3.1145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 470.580023][ T5875] usb 6-1: Using ep0 maxpacket: 32 [ 470.610176][ T5875] usb 6-1: config 0 has an invalid interface number: 132 but max is 0 [ 470.668570][ T5875] usb 6-1: config 0 has no interface number 0 [ 470.674707][ T5875] usb 6-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 470.724927][ T5875] usb 6-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 470.741944][ T5875] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.750048][ T5875] usb 6-1: Product: syz [ 470.754425][ T5875] usb 6-1: Manufacturer: syz [ 470.759013][ T5875] usb 6-1: SerialNumber: syz [ 470.766128][ T5875] usb 6-1: config 0 descriptor?? [ 470.777817][ T5875] em28xx 6-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 470.787900][ T5875] em28xx 6-1:0.132: Video interface 132 found: [ 470.976725][ T30] audit: type=1400 audit(2000000928.724:893): avc: denied { lock } for pid=10537 comm="syz.1.1151" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 471.591873][ T5875] em28xx 6-1:0.132: unknown em28xx chip ID (0) [ 471.846836][ T5957] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 472.210157][ T5957] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 472.231564][ T5957] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.266177][ T5957] usb 2-1: config 0 descriptor?? [ 472.947281][ T5957] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 472.989157][ T5957] [drm:udl_init] *ERROR* Selecting channel failed [ 473.010662][ T5875] em28xx 6-1:0.132: failed to trigger write to i2c address 0xa0 (error=-5) [ 473.115697][ T30] audit: type=1400 audit(2000000930.982:894): avc: denied { watch_sb } for pid=10565 comm="syz.3.1158" path="/244/file1" dev="tmpfs" ino=1297 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 473.125137][ T5957] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 473.142454][ T5875] em28xx 6-1:0.132: failed to read eeprom (err=-5) [ 473.184833][ T5875] em28xx 6-1:0.132: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 473.262187][ T5957] [drm] Initialized udl on minor 2 [ 473.279550][ T5957] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 473.305693][ T5957] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 473.314849][ T9] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 473.323029][ T5875] em28xx 6-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 473.341905][ T9] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 473.352642][ T5957] usb 2-1: USB disconnect, device number 46 [ 473.383971][ T5875] em28xx 6-1:0.132: analog set to bulk mode. [ 473.661729][ T5932] em28xx 6-1:0.132: Registering V4L2 extension [ 473.733966][ T5875] usb 6-1: USB disconnect, device number 16 [ 473.751197][ T5875] em28xx 6-1:0.132: Disconnecting em28xx [ 474.092952][ T30] audit: type=1400 audit(2000000932.000:895): avc: denied { write } for pid=10576 comm="syz.5.1161" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 474.669504][T10592] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1163'. [ 474.678542][T10592] netlink: 'syz.1.1163': attribute type 3 has an invalid length. [ 474.699490][T10592] input: syz0 as /devices/virtual/input/input31 [ 475.061665][ T5932] em28xx 6-1:0.132: Config register raw data: 0xffffffed [ 475.124638][ T5932] em28xx 6-1:0.132: AC97 chip type couldn't be determined [ 475.125795][ T30] audit: type=1400 audit(2000000932.840:896): avc: denied { append } for pid=10591 comm="syz.3.1164" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 475.158185][ T5932] em28xx 6-1:0.132: No AC97 audio processor [ 475.792795][ T5932] usb 6-1: Decoder not found [ 475.797436][ T5932] em28xx 6-1:0.132: failed to create media graph [ 475.825568][ T5932] em28xx 6-1:0.132: V4L2 device video103 deregistered [ 475.855320][ T5932] em28xx 6-1:0.132: Remote control support is not available for this card. [ 475.875724][ T5875] em28xx 6-1:0.132: Closing input extension [ 475.889580][T10606] input: syz1 as /devices/virtual/input/input32 [ 475.897430][ T5875] em28xx 6-1:0.132: Freeing device [ 476.028123][ T9] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 476.050034][T10611] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1167'. [ 476.141588][T10615] netlink: 'syz.3.1169': attribute type 4 has an invalid length. [ 476.174442][T10615] netlink: 17 bytes leftover after parsing attributes in process `syz.3.1169'. [ 476.195776][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 476.225866][ T30] audit: type=1400 audit(2000000934.237:897): avc: denied { connect } for pid=10609 comm="syz.3.1169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 476.290532][ T9] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 476.334693][ T9] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 476.377171][ T30] audit: type=1400 audit(2000000934.331:898): avc: denied { write } for pid=10609 comm="syz.3.1169" path="socket:[30886]" dev="sockfs" ino=30886 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 476.379817][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.537903][ T9] usb 2-1: config 0 descriptor?? [ 476.904372][T10621] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.1168'. [ 476.971052][T10621] netlink: ct family unspecified [ 478.195668][T10634] FAULT_INJECTION: forcing a failure. [ 478.195668][T10634] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 478.229770][T10634] CPU: 0 UID: 0 PID: 10634 Comm: syz.5.1172 Tainted: G L syzkaller #0 PREEMPT(full) [ 478.229801][T10634] Tainted: [L]=SOFTLOCKUP [ 478.229807][T10634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 478.229816][T10634] Call Trace: [ 478.229822][T10634] [ 478.229829][T10634] dump_stack_lvl+0x100/0x190 [ 478.229863][T10634] should_fail_ex.cold+0x5/0xa [ 478.229885][T10634] _copy_to_user+0x32/0xd0 [ 478.229909][T10634] video_usercopy+0xece/0x1740 [ 478.229929][T10634] ? __pfx___video_do_ioctl+0x10/0x10 [ 478.229946][T10634] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 478.229967][T10634] ? __pfx_video_usercopy+0x10/0x10 [ 478.230000][T10634] v4l2_ioctl+0x1bd/0x250 [ 478.230018][T10634] ? __pfx_v4l2_ioctl+0x10/0x10 [ 478.230038][T10634] __x64_sys_ioctl+0x18e/0x210 [ 478.230064][T10634] do_syscall_64+0x106/0xf80 [ 478.230081][T10634] ? clear_bhb_loop+0x40/0x90 [ 478.230103][T10634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.230120][T10634] RIP: 0033:0x7fef37b9c629 [ 478.230135][T10634] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 478.230151][T10634] RSP: 002b:00007fef389fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 478.230174][T10634] RAX: ffffffffffffffda RBX: 00007fef37e15fa0 RCX: 00007fef37b9c629 [ 478.230185][T10634] RDX: 0000200000000040 RSI: 00000000c02c564a RDI: 0000000000000003 [ 478.230196][T10634] RBP: 00007fef389fc090 R08: 0000000000000000 R09: 0000000000000000 [ 478.230205][T10634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 478.230215][T10634] R13: 00007fef37e16038 R14: 00007fef37e15fa0 R15: 00007ffdac4afba8 [ 478.230238][T10634] [ 478.417719][ T9] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 478.971144][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 478.983888][ T9] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 478.992696][ T9] usb 4-1: config 0 has no interface number 0 [ 479.013253][ T9] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 479.056730][ T9] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 479.069754][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 479.077857][ T5883] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 479.093079][ T9] usb 4-1: Product: syz [ 479.098603][ T9] usb 4-1: Manufacturer: syz [ 479.103274][ T9] usb 4-1: SerialNumber: syz [ 479.112338][ T9] usb 4-1: config 0 descriptor?? [ 479.120271][ T5875] usb 2-1: USB disconnect, device number 47 [ 479.124059][ T9] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 479.138157][ T9] em28xx 4-1:0.132: Video interface 132 found: [ 479.144546][ T5957] usb 1-1: new low-speed USB device number 46 using dummy_hcd [ 479.237908][ T5883] usb 6-1: Using ep0 maxpacket: 32 [ 479.244345][ T5883] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 255 [ 479.256242][ T5883] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 479.265456][ T5883] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 479.273830][ T5883] usb 6-1: Product: syz [ 479.289610][ T5883] usb 6-1: Manufacturer: syz [ 479.299277][ T5883] usb 6-1: SerialNumber: syz [ 479.307575][ T5883] usb 6-1: config 0 descriptor?? [ 479.313468][T10640] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 479.334396][ T5957] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 479.343625][ T5957] usb 1-1: config 0 has no interface number 0 [ 479.369198][T10649] usb usb9: usbfs: process 10649 (syz.1.1178) did not claim interface 0 before use [ 479.373995][ T5957] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 479.398857][ T5957] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 479.426609][ T5957] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 479.436491][ T10] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 479.445027][ T5957] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.458132][ T5957] usb 1-1: config 0 descriptor?? [ 479.491629][ T5957] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior1 [ 479.522535][ T9] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 479.546628][ T5957] usb 6-1: USB disconnect, device number 17 [ 479.602493][ T10] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 479.621494][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.701446][ T10] usb 5-1: config 0 descriptor?? [ 480.083900][ T10] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 480.094641][ T10] [drm:udl_init] *ERROR* Selecting channel failed [ 480.166334][ T10] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 480.182658][ T10] [drm] Initialized udl on minor 2 [ 480.196965][ T10] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 480.268863][ T10] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 480.297780][ T5875] usb 1-1: USB disconnect, device number 46 [ 480.316325][ T5957] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 480.327984][ T10] usb 5-1: USB disconnect, device number 61 [ 480.345732][ T5957] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 480.803972][ T9] em28xx 4-1:0.132: failed to trigger write to i2c address 0xa0 (error=-5) [ 480.816225][ T9] em28xx 4-1:0.132: failed to read eeprom (err=-5) [ 480.830392][ T9] em28xx 4-1:0.132: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 480.998009][ T9] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 481.005938][ T9] em28xx 4-1:0.132: analog set to bulk mode. [ 481.435282][ T5957] em28xx 4-1:0.132: Registering V4L2 extension [ 481.469206][ T9] usb 4-1: USB disconnect, device number 47 [ 481.487499][ T9] em28xx 4-1:0.132: Disconnecting em28xx [ 482.004830][T10682] openvswitch: netlink: Flow key attr not present in new flow. [ 482.034464][ T5957] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 482.073302][ T5957] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 482.097523][ T5957] em28xx 4-1:0.132: No AC97 audio processor [ 482.124480][ T5957] usb 4-1: Decoder not found [ 482.129082][ T5957] em28xx 4-1:0.132: failed to create media graph [ 482.165212][ T5957] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 482.200360][T10692] FAULT_INJECTION: forcing a failure. [ 482.200360][T10692] name failslab, interval 1, probability 0, space 0, times 0 [ 482.200525][ T5957] em28xx 4-1:0.132: Remote control support is not available for this card. [ 482.248292][ T9] em28xx 4-1:0.132: Closing input extension [ 482.267257][ T9] em28xx 4-1:0.132: Freeing device [ 482.273510][T10692] CPU: 1 UID: 0 PID: 10692 Comm: syz.3.1187 Tainted: G L syzkaller #0 PREEMPT(full) [ 482.273534][T10692] Tainted: [L]=SOFTLOCKUP [ 482.273540][T10692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 482.273549][T10692] Call Trace: [ 482.273555][T10692] [ 482.273562][T10692] dump_stack_lvl+0x100/0x190 [ 482.273593][T10692] should_fail_ex.cold+0x5/0xa [ 482.273616][T10692] should_failslab+0xc2/0x120 [ 482.273643][T10692] __kmalloc_node_track_caller_noprof+0xe3/0x850 [ 482.273668][T10692] ? sidtab_sid2str_get+0x17a/0x670 [ 482.273694][T10692] kmemdup_noprof+0x29/0x60 [ 482.273719][T10692] sidtab_sid2str_get+0x17a/0x670 [ 482.273743][T10692] security_sid_to_context_core+0x35a/0x6d0 [ 482.273761][T10692] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 482.273787][T10692] avc_audit_post_callback+0x109/0x910 [ 482.273811][T10692] ? __pfx_audit_log_lsm_data+0x10/0x10 [ 482.273830][T10692] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 482.273851][T10692] ? skb_put+0x138/0x180 [ 482.273873][T10692] ? audit_log_n_string+0x256/0x550 [ 482.273900][T10692] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 482.273919][T10692] common_lsm_audit+0x23f/0x2b0 [ 482.273940][T10692] ? __pfx_common_lsm_audit+0x10/0x10 [ 482.273958][T10692] ? lockdep_hardirqs_on+0x78/0x100 [ 482.273978][T10692] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 482.274007][T10692] slow_avc_audit+0x186/0x210 [ 482.274031][T10692] ? __pfx_slow_avc_audit+0x10/0x10 [ 482.274055][T10692] ? avc_denied+0x14a/0x190 [ 482.274077][T10692] ? avc_has_perm_noaudit+0x2fc/0x3b0 [ 482.274103][T10692] avc_has_perm+0x1a6/0x1e0 [ 482.274126][T10692] ? __pfx_avc_has_perm+0x10/0x10 [ 482.274157][T10692] sock_has_perm+0x251/0x2f0 [ 482.274182][T10692] ? __pfx_sock_has_perm+0x10/0x10 [ 482.274217][T10692] ? find_held_lock+0x2b/0x80 [ 482.274241][T10692] security_socket_getsockopt+0x9b/0x230 [ 482.274269][T10692] do_sock_getsockopt+0x11f/0x3d0 [ 482.274291][T10692] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 482.274330][T10692] __sys_getsockopt+0x148/0x260 [ 482.274362][T10692] ? __x64_sys_getsockopt+0xbd/0x160 [ 482.274386][T10692] __x64_sys_getsockopt+0xbd/0x160 [ 482.274407][T10692] ? do_syscall_64+0x95/0xf80 [ 482.274423][T10692] ? lockdep_hardirqs_on+0x78/0x100 [ 482.274439][T10692] do_syscall_64+0x106/0xf80 [ 482.274455][T10692] ? clear_bhb_loop+0x40/0x90 [ 482.274477][T10692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 482.274493][T10692] RIP: 0033:0x7f0a4b79c629 [ 482.274509][T10692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 482.274525][T10692] RSP: 002b:00007f0a4c5e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 482.274542][T10692] RAX: ffffffffffffffda RBX: 00007f0a4ba15fa0 RCX: 00007f0a4b79c629 [ 482.274553][T10692] RDX: 0000000000000066 RSI: 0000000000000011 RDI: 0000000000000003 [ 482.274563][T10692] RBP: 00007f0a4c5e6090 R08: 0000000000000000 R09: 0000000000000000 [ 482.274572][T10692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 482.274581][T10692] R13: 00007f0a4ba16038 R14: 00007f0a4ba15fa0 R15: 00007ffcd7190a68 [ 482.274605][T10692] [ 482.632038][ T30] audit: type=1400 audit(2000000940.526:899): avc: denied { getopt } for pid=10690 comm="syz.3.1187" ssid=148 tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 482.743009][T10694] program syz.0.1188 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 482.879283][T10699] vivid-000: disconnect [ 482.885880][T10700] FAULT_INJECTION: forcing a failure. [ 482.885880][T10700] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 482.940636][ T30] audit: type=1400 audit(2000000941.292:900): avc: denied { map } for pid=10697 comm="syz.0.1189" path="/dev/swradio0" dev="devtmpfs" ino=956 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 482.969263][T10697] vivid-000: reconnect [ 482.987996][T10700] CPU: 0 UID: 0 PID: 10700 Comm: syz.3.1191 Tainted: G L syzkaller #0 PREEMPT(full) [ 482.988018][T10700] Tainted: [L]=SOFTLOCKUP [ 482.988021][T10700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 482.988028][T10700] Call Trace: [ 482.988032][T10700] [ 482.988036][T10700] dump_stack_lvl+0x100/0x190 [ 482.988059][T10700] should_fail_ex.cold+0x5/0xa [ 482.988073][T10700] _copy_from_user+0x2e/0xd0 [ 482.988089][T10700] ucma_init_qp_attr+0x10f/0x3c0 [ 482.988102][T10700] ? __pfx_ucma_init_qp_attr+0x10/0x10 [ 482.988121][T10700] ? __lock_acquire+0x4a5/0x2630 [ 482.988155][T10700] ? __pfx_ucma_init_qp_attr+0x10/0x10 [ 482.988167][T10700] ucma_write+0x1fb/0x330 [ 482.988183][T10700] ? __pfx_ucma_write+0x10/0x10 [ 482.988200][T10700] ? bpf_lsm_file_permission+0x9/0x10 [ 482.988215][T10700] ? security_file_permission+0x76/0x210 [ 482.988229][T10700] ? rw_verify_area+0xce/0x6d0 [ 482.988245][T10700] vfs_write+0x2aa/0x1070 [ 482.988262][T10700] ? __pfx_ucma_write+0x10/0x10 [ 482.988279][T10700] ? __pfx_vfs_write+0x10/0x10 [ 482.988294][T10700] ? find_held_lock+0x2b/0x80 [ 482.988307][T10700] ? __fget_files+0x215/0x3d0 [ 482.988317][T10700] ? __fget_files+0x215/0x3d0 [ 482.988329][T10700] ? __fget_files+0x21f/0x3d0 [ 482.988343][T10700] ksys_write+0x1f8/0x250 [ 482.988359][T10700] ? __pfx_ksys_write+0x10/0x10 [ 482.988378][T10700] do_syscall_64+0x106/0xf80 [ 482.988391][T10700] ? clear_bhb_loop+0x40/0x90 [ 482.988405][T10700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 482.988416][T10700] RIP: 0033:0x7f0a4b79c629 [ 482.988427][T10700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 482.988437][T10700] RSP: 002b:00007f0a4c5e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 482.988448][T10700] RAX: ffffffffffffffda RBX: 00007f0a4ba15fa0 RCX: 00007f0a4b79c629 [ 482.988455][T10700] RDX: 0000000000000018 RSI: 00002000000000c0 RDI: 0000000000000003 [ 482.988461][T10700] RBP: 00007f0a4c5e6090 R08: 0000000000000000 R09: 0000000000000000 [ 482.988467][T10700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 482.988474][T10700] R13: 00007f0a4ba16038 R14: 00007f0a4ba15fa0 R15: 00007ffcd7190a68 [ 482.988487][T10700] [ 483.264798][T10703] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.1183'. [ 483.336975][T10703] netlink: ct family unspecified [ 483.533692][ T5932] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 483.849640][ T5932] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 483.869591][ T5932] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 483.906280][ T5932] usb 1-1: config 0 descriptor?? [ 484.103580][ T30] audit: type=1107 audit(2000000942.510:901): pid=10718 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='¿' [ 484.231156][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 484.238808][ T5932] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 484.249413][ T5932] [drm:udl_init] *ERROR* Selecting channel failed [ 484.292916][ T5932] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 2 [ 484.305752][ T5932] [drm] Initialized udl on minor 2 [ 484.328417][ T5932] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 484.352455][ T5932] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 484.378185][ T24] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 484.388067][ T5932] usb 1-1: USB disconnect, device number 47 [ 484.405626][ T24] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 484.504546][ T9] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 484.598854][T10732] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1198'. [ 484.612330][T10732] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1198'. [ 485.061273][ T9] usb 5-1: device descriptor read/64, error -71 [ 485.084212][T10732] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1198'. [ 485.098993][T10734] erofs (device nbd5): cannot find valid erofs superblock [ 485.117714][T10732] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1198'. [ 485.142580][T10732] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1198'. [ 485.223335][T10736] program syz.0.1200 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 485.333166][ T9] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 485.495321][ T9] usb 5-1: device descriptor read/64, error -71 [ 485.953189][ T9] usb usb5-port1: attempt power cycle [ 486.299367][ T9] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 486.303574][T10753] FAULT_INJECTION: forcing a failure. [ 486.303574][T10753] name failslab, interval 1, probability 0, space 0, times 0 [ 486.323530][T10753] CPU: 1 UID: 0 PID: 10753 Comm: syz.0.1204 Tainted: G L syzkaller #0 PREEMPT(full) [ 486.323559][T10753] Tainted: [L]=SOFTLOCKUP [ 486.323565][T10753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 486.323575][T10753] Call Trace: [ 486.323581][T10753] [ 486.323587][T10753] dump_stack_lvl+0x100/0x190 [ 486.323616][T10753] should_fail_ex.cold+0x5/0xa [ 486.323638][T10753] should_failslab+0xc2/0x120 [ 486.323665][T10753] __kvmalloc_node_noprof+0xfa/0xa00 [ 486.323689][T10753] ? video_usercopy+0x8a7/0x1740 [ 486.323718][T10753] video_usercopy+0x8a7/0x1740 [ 486.323736][T10753] ? __pfx___video_do_ioctl+0x10/0x10 [ 486.323754][T10753] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 486.323776][T10753] ? __pfx_video_usercopy+0x10/0x10 [ 486.323808][T10753] v4l2_ioctl+0x1bd/0x250 [ 486.323826][T10753] ? __pfx_v4l2_ioctl+0x10/0x10 [ 486.323845][T10753] __x64_sys_ioctl+0x18e/0x210 [ 486.323872][T10753] do_syscall_64+0x106/0xf80 [ 486.323889][T10753] ? clear_bhb_loop+0x40/0x90 [ 486.323911][T10753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 486.323928][T10753] RIP: 0033:0x7f905cf9c629 [ 486.323943][T10753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 486.323960][T10753] RSP: 002b:00007f905dee8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 486.323979][T10753] RAX: ffffffffffffffda RBX: 00007f905d215fa0 RCX: 00007f905cf9c629 [ 486.323990][T10753] RDX: 0000200000000500 RSI: 00000000c058565d RDI: 0000000000000003 [ 486.324001][T10753] RBP: 00007f905dee8090 R08: 0000000000000000 R09: 0000000000000000 [ 486.324010][T10753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 486.324020][T10753] R13: 00007f905d216038 R14: 00007f905d215fa0 R15: 00007ffe88d06018 [ 486.324043][T10753] [ 486.595307][ T9] usb 5-1: device descriptor read/8, error -71 [ 487.010121][ T9] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 487.038494][ T9] usb 5-1: device descriptor read/8, error -71 [ 487.162397][ T9] usb usb5-port1: unable to enumerate USB device [ 487.238337][ T5883] usb 2-1: new full-speed USB device number 48 using dummy_hcd [ 487.410533][T10768] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=10768 comm=syz.0.1208 [ 489.069188][ T5883] usb 2-1: not running at top speed; connect to a high speed hub [ 489.166882][ T5883] usb 2-1: config 1 interface 0 altsetting 10 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 489.343134][ T5883] usb 2-1: config 1 interface 0 altsetting 10 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 489.369500][ T30] audit: type=1107 audit(2000000948.022:902): pid=10776 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='¿' [ 489.479491][T10775] vivid-000: disconnect [ 489.543358][ T5883] usb 2-1: config 1 interface 0 has no altsetting 0 [ 489.562911][ T5883] usb 2-1: string descriptor 0 read error: -22 [ 489.569395][ T5883] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 489.697624][ T5883] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.718317][ T5883] usb 2-1: can't set config #1, error -71 [ 489.733607][ T5883] usb 2-1: USB disconnect, device number 48 [ 489.741408][T10770] vivid-000: reconnect [ 489.849615][ T30] audit: type=1800 audit(2000000948.495:903): pid=10783 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.1213" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 489.870995][ T9] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 490.062058][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 490.128179][ T9] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 490.138694][ T30] audit: type=1326 audit(2000000948.547:904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10780 comm="syz.4.1213" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd0c739c629 code=0x0 [ 490.162522][ T9] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 490.174941][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.191383][ T9] usb 4-1: config 0 descriptor?? [ 490.211804][ T30] audit: type=1400 audit(2000000948.925:905): avc: denied { load_policy } for pid=10785 comm="syz.1.1214" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 490.319961][T10786] SELinux: failed to load policy [ 490.457491][ T5957] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 490.619764][ T5957] usb 1-1: device descriptor read/64, error -71 [ 490.867029][ T5883] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 490.895874][ T5957] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 491.034592][ T5957] usb 1-1: device descriptor read/64, error -71 [ 491.041009][ T5883] usb 5-1: Using ep0 maxpacket: 32 [ 491.091306][T10800] openvswitch: netlink: Unexpected mask (mask=200840, allowed=10048) [ 491.238682][ T5957] usb usb1-port1: attempt power cycle [ 491.275523][ T5883] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 491.294817][ T5883] usb 5-1: config 0 has no interface number 0 [ 491.304044][ T5883] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 491.313886][ T5883] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.345847][ T5883] usb 5-1: Product: syz [ 491.350001][ T5883] usb 5-1: Manufacturer: syz [ 491.394216][ T5883] usb 5-1: SerialNumber: syz [ 491.408445][ T5883] usb 5-1: config 0 descriptor?? [ 491.463024][T10807] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1218'. [ 491.479299][ T5883] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 491.510999][T10807] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1218'. [ 491.530286][T10807] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1218'. [ 491.539831][T10807] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1218'. [ 491.586382][T10807] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1218'. [ 491.596630][T10810] erofs (device nbd5): cannot find valid erofs superblock [ 491.620452][ T5957] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 491.649070][ T5957] usb 1-1: device descriptor read/8, error -71 [ 491.729247][T10795] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1217'. [ 491.775639][T10795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.852274][T10795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.886218][ T5957] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 492.257476][ T5883] usb 5-1: qt2_attach - failed to power on unit: -71 [ 492.273082][ T5883] quatech2 5-1:0.51: probe with driver quatech2 failed with error -71 [ 492.446148][ T5883] usb 5-1: USB disconnect, device number 66 [ 492.550537][ T5957] usb 1-1: device descriptor read/8, error -71 [ 492.631929][ T24] usb 4-1: USB disconnect, device number 48 [ 492.668546][ T5957] usb usb1-port1: unable to enumerate USB device [ 492.886688][ T30] audit: type=1107 audit(2000000951.560:906): pid=10822 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='¿' [ 493.248049][ T5957] usb 1-1: new full-speed USB device number 52 using dummy_hcd [ 493.372019][ T10] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 493.469076][ T5957] usb 1-1: not running at top speed; connect to a high speed hub [ 493.479139][ T5957] usb 1-1: config 1 interface 0 altsetting 10 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 493.483312][ T5932] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 493.490599][ T5957] usb 1-1: config 1 interface 0 altsetting 10 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 493.510706][ T5957] usb 1-1: config 1 interface 0 has no altsetting 0 [ 493.519759][ T5957] usb 1-1: string descriptor 0 read error: -22 [ 493.526266][ T5957] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 493.535682][ T5957] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.546786][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 493.559075][ T10] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 493.568516][T10825] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 493.578283][ T5957] usb 1-1: bad CDC descriptors [ 493.587075][ T10] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 493.596182][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.606028][ T10] usb 5-1: config 0 descriptor?? [ 493.648141][ T5932] usb 2-1: Using ep0 maxpacket: 32 [ 493.655987][ T5932] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 493.664538][ T24] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 493.672198][ T5932] usb 2-1: config 0 has no interface number 0 [ 493.678685][ T5932] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 493.690801][ T5932] usb 2-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 493.699922][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.707960][ T5932] usb 2-1: Product: syz [ 493.712120][ T5932] usb 2-1: Manufacturer: syz [ 493.716747][ T5932] usb 2-1: SerialNumber: syz [ 493.723040][ T5932] usb 2-1: config 0 descriptor?? [ 493.730695][ T5932] em28xx 2-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 493.740513][ T5932] em28xx 2-1:0.132: Video interface 132 found: [ 493.785367][ T5930] usb 1-1: USB disconnect, device number 52 [ 493.848482][ T24] usb 4-1: device descriptor read/64, error -71 [ 494.076569][ T24] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 494.116210][ T5932] em28xx 2-1:0.132: unknown em28xx chip ID (0) [ 494.191281][ T5930] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 494.200975][ T24] usb 4-1: device descriptor read/64, error -71 [ 494.306081][ T24] usb usb4-port1: attempt power cycle [ 494.334333][ T5930] usb 6-1: device descriptor read/64, error -71 [ 494.518839][T10844] openvswitch: netlink: Unexpected mask (mask=200840, allowed=10048) [ 494.752954][ T24] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 494.772339][ T24] usb 4-1: device descriptor read/8, error -71 [ 494.819843][ T5930] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 495.048533][ T24] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 495.056292][ T5930] usb 6-1: device descriptor read/64, error -71 [ 495.075342][ T5932] em28xx 2-1:0.132: failed to trigger write to i2c address 0xa0 (error=-5) [ 495.084689][ T24] usb 4-1: device descriptor read/8, error -71 [ 495.092399][ T5932] em28xx 2-1:0.132: failed to read eeprom (err=-5) [ 495.099726][ T5932] em28xx 2-1:0.132: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 495.163043][ T5932] em28xx 2-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 495.172528][ T5930] usb usb6-port1: attempt power cycle [ 495.182011][ T5932] em28xx 2-1:0.132: analog set to bulk mode. [ 495.188618][ T2059] em28xx 2-1:0.132: Registering V4L2 extension [ 495.195646][ T24] usb usb4-port1: unable to enumerate USB device [ 495.212202][ T5932] usb 2-1: USB disconnect, device number 49 [ 495.231500][ T5932] em28xx 2-1:0.132: Disconnecting em28xx [ 495.282757][ T2059] em28xx 2-1:0.132: Config register raw data: 0xffffffed [ 495.290266][ T2059] em28xx 2-1:0.132: AC97 chip type couldn't be determined [ 495.297646][ T2059] em28xx 2-1:0.132: No AC97 audio processor [ 495.305978][ T2059] usb 2-1: Decoder not found [ 495.310853][ T2059] em28xx 2-1:0.132: failed to create media graph [ 495.317834][ T2059] em28xx 2-1:0.132: V4L2 device video103 deregistered [ 495.326686][ T2059] em28xx 2-1:0.132: Remote control support is not available for this card. [ 495.335882][ T5932] em28xx 2-1:0.132: Closing input extension [ 495.347254][ T5932] em28xx 2-1:0.132: Freeing device [ 495.506730][ T5930] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 495.521575][T10854] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 495.528083][T10854] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 495.543553][ T5930] usb 6-1: device descriptor read/8, error -71 [ 495.543581][T10854] vhci_hcd vhci_hcd.0: Device attached [ 495.573241][T10855] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1231'. [ 495.609228][T10854] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1231'. [ 495.729459][T10856] vhci_hcd: connection closed [ 495.732232][ T49] vhci_hcd vhci_hcd.0: stop threads [ 495.766041][ T49] vhci_hcd vhci_hcd.0: release socket [ 495.773544][ T5932] usb 33-1: new high-speed USB device number 3 using vhci_hcd [ 495.782721][ T5930] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 495.790493][ T49] vhci_hcd vhci_hcd.0: disconnect device [ 495.813032][ T5930] usb 6-1: device descriptor read/8, error -71 [ 496.016270][T10863] FAULT_INJECTION: forcing a failure. [ 496.016270][T10863] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 496.033017][T10863] CPU: 1 UID: 0 PID: 10863 Comm: syz.1.1233 Tainted: G L syzkaller #0 PREEMPT(full) [ 496.033038][T10863] Tainted: [L]=SOFTLOCKUP [ 496.033042][T10863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 496.033049][T10863] Call Trace: [ 496.033054][T10863] [ 496.033060][T10863] dump_stack_lvl+0x100/0x190 [ 496.033082][T10863] should_fail_ex.cold+0x5/0xa [ 496.033097][T10863] _copy_to_user+0x32/0xd0 [ 496.033114][T10863] simple_read_from_buffer+0xcb/0x170 [ 496.033138][T10863] proc_fail_nth_read+0x1af/0x230 [ 496.033154][T10863] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 496.033169][T10863] ? rw_verify_area+0xce/0x6d0 [ 496.033183][T10863] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 496.033198][T10863] vfs_read+0x1e4/0xb30 [ 496.033215][T10863] ? __pfx_vfs_read+0x10/0x10 [ 496.033230][T10863] ? __fget_files+0x215/0x3d0 [ 496.033244][T10863] ? __fget_files+0x21f/0x3d0 [ 496.033258][T10863] ksys_read+0x12a/0x250 [ 496.033273][T10863] ? __pfx_ksys_read+0x10/0x10 [ 496.033293][T10863] do_syscall_64+0x106/0xf80 [ 496.033305][T10863] ? clear_bhb_loop+0x40/0x90 [ 496.033318][T10863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.033330][T10863] RIP: 0033:0x7faf4515cece [ 496.033341][T10863] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 496.033352][T10863] RSP: 002b:00007faf45fd4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 496.033363][T10863] RAX: ffffffffffffffda RBX: 00007faf45fd56c0 RCX: 00007faf4515cece [ 496.033370][T10863] RDX: 000000000000000f RSI: 00007faf45fd50a0 RDI: 0000000000000004 [ 496.033376][T10863] RBP: 00007faf45fd5090 R08: 0000000000000000 R09: 0000000000000000 [ 496.033382][T10863] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.033388][T10863] R13: 00007faf45416038 R14: 00007faf45415fa0 R15: 00007ffcf13298b8 [ 496.033402][T10863] [ 496.241476][ T5930] usb usb6-port1: unable to enumerate USB device [ 496.264181][ T5930] usb 5-1: USB disconnect, device number 67 [ 496.955421][T10882] FAULT_INJECTION: forcing a failure. [ 496.955421][T10882] name failslab, interval 1, probability 0, space 0, times 0 [ 496.986319][T10887] FAULT_INJECTION: forcing a failure. [ 496.986319][T10887] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 497.000107][T10882] CPU: 0 UID: 0 PID: 10882 Comm: syz.0.1239 Tainted: G L syzkaller #0 PREEMPT(full) [ 497.000135][T10882] Tainted: [L]=SOFTLOCKUP [ 497.000141][T10882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 497.000150][T10882] Call Trace: [ 497.000155][T10882] [ 497.000161][T10882] dump_stack_lvl+0x100/0x190 [ 497.000193][T10882] should_fail_ex.cold+0x5/0xa [ 497.000216][T10882] should_failslab+0xc2/0x120 [ 497.000242][T10882] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 497.000264][T10882] ? security_file_alloc+0x34/0x2c0 [ 497.000283][T10882] ? trace_kmem_cache_alloc+0xf3/0x120 [ 497.000313][T10882] security_file_alloc+0x34/0x2c0 [ 497.000333][T10882] init_file+0x95/0x480 [ 497.000350][T10882] alloc_empty_file+0x73/0x1c0 [ 497.000370][T10882] path_openat+0xe8/0x31a0 [ 497.000385][T10882] ? kasan_save_stack+0x3f/0x50 [ 497.000407][T10882] ? kasan_save_stack+0x30/0x50 [ 497.000428][T10882] ? kasan_save_track+0x14/0x30 [ 497.000449][T10882] ? __kasan_slab_alloc+0x89/0x90 [ 497.000473][T10882] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 497.000494][T10882] ? do_getname+0x35/0x390 [ 497.000513][T10882] ? do_sys_openat2+0xc5/0x1e0 [ 497.000532][T10882] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.000554][T10882] ? __pfx_path_openat+0x10/0x10 [ 497.000584][T10882] do_file_open+0x20e/0x430 [ 497.000602][T10882] ? __pfx_do_file_open+0x10/0x10 [ 497.000636][T10882] ? alloc_fd+0x476/0x790 [ 497.000656][T10882] ? do_getname+0x191/0x390 [ 497.000678][T10882] do_sys_openat2+0x10d/0x1e0 [ 497.000699][T10882] ? __pfx_do_sys_openat2+0x10/0x10 [ 497.000726][T10882] __x64_sys_openat+0x12d/0x210 [ 497.000747][T10882] ? __pfx___x64_sys_openat+0x10/0x10 [ 497.000770][T10882] ? do_user_addr_fault+0x8d6/0x12f0 [ 497.000793][T10882] do_syscall_64+0x106/0xf80 [ 497.000811][T10882] ? clear_bhb_loop+0x40/0x90 [ 497.000832][T10882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.000850][T10882] RIP: 0033:0x7f905cf5cece [ 497.000865][T10882] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 497.000881][T10882] RSP: 002b:00007f905dee7b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 497.000898][T10882] RAX: ffffffffffffffda RBX: 00007f905dee86c0 RCX: 00007f905cf5cece [ 497.000909][T10882] RDX: 0000000000008000 RSI: 00007f905dee7c00 RDI: ffffffffffffff9c [ 497.000919][T10882] RBP: 00007f905dee7c00 R08: 0000000000000000 R09: 0000000000000000 [ 497.000927][T10882] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 497.000937][T10882] R13: 00007f905d216038 R14: 00007f905d215fa0 R15: 00007ffe88d06018 [ 497.000960][T10882] [ 497.260463][ T30] audit: type=1400 audit(2000000956.064:907): avc: denied { append } for pid=10886 comm="syz.1.1241" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 497.283329][T10887] CPU: 1 UID: 0 PID: 10887 Comm: syz.5.1240 Tainted: G L syzkaller #0 PREEMPT(full) [ 497.283355][T10887] Tainted: [L]=SOFTLOCKUP [ 497.283359][T10887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 497.283369][T10887] Call Trace: [ 497.283374][T10887] [ 497.283380][T10887] dump_stack_lvl+0x100/0x190 [ 497.283413][T10887] should_fail_ex.cold+0x5/0xa [ 497.283434][T10887] _copy_from_iter+0x1f4/0x1690 [ 497.283459][T10887] ? __asan_memset+0x23/0x50 [ 497.283481][T10887] ? __pfx__copy_from_iter+0x10/0x10 [ 497.283502][T10887] ? __pfx___alloc_skb+0x10/0x10 [ 497.283535][T10887] netlink_sendmsg+0x808/0xda0 [ 497.283557][T10887] ? __pfx_netlink_sendmsg+0x10/0x10 [ 497.283573][T10887] ? __might_fault+0x60/0x140 [ 497.283600][T10887] ____sys_sendmsg+0xa54/0xc30 [ 497.283621][T10887] ? __pfx_____sys_sendmsg+0x10/0x10 [ 497.283650][T10887] ___sys_sendmsg+0x190/0x1e0 [ 497.283671][T10887] ? __pfx____sys_sendmsg+0x10/0x10 [ 497.283717][T10887] __sys_sendmsg+0x170/0x220 [ 497.283734][T10887] ? __pfx___sys_sendmsg+0x10/0x10 [ 497.283765][T10887] do_syscall_64+0x106/0xf80 [ 497.283782][T10887] ? clear_bhb_loop+0x40/0x90 [ 497.283804][T10887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.283822][T10887] RIP: 0033:0x7fef37b9c629 [ 497.283837][T10887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 497.283852][T10887] RSP: 002b:00007fef389fc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 497.283870][T10887] RAX: ffffffffffffffda RBX: 00007fef37e15fa0 RCX: 00007fef37b9c629 [ 497.283880][T10887] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 497.283890][T10887] RBP: 00007fef389fc090 R08: 0000000000000000 R09: 0000000000000000 [ 497.283901][T10887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 497.283910][T10887] R13: 00007fef37e16038 R14: 00007fef37e15fa0 R15: 00007ffdac4afba8 [ 497.283935][T10887] [ 497.628513][ T30] audit: type=1107 audit(2000000956.715:908): pid=10892 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='¿' [ 497.749041][T10898] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1242'. [ 497.760937][ T30] audit: type=1400 audit(2000000956.841:909): avc: denied { nlmsg_read } for pid=10890 comm="syz.4.1242" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 498.343805][ T10] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 498.373807][ T5957] usb 5-1: new full-speed USB device number 68 using dummy_hcd [ 498.496292][ T10] usb 1-1: device descriptor read/64, error -71 [ 498.555620][ T5957] usb 5-1: config index 0 descriptor too short (expected 28277, got 36) [ 498.573088][ T5957] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 498.598540][ T5957] usb 5-1: config 0 has no interfaces? [ 498.610510][ T5957] usb 5-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 498.639913][ T5957] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.669344][ T5957] usb 5-1: config 0 descriptor?? [ 498.763018][ T10] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 498.820294][ T5957] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 498.916452][ T10] usb 1-1: device descriptor read/64, error -71 [ 499.037928][ T10] usb usb1-port1: attempt power cycle [ 499.049856][ T5957] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.230753][ T5957] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 499.249711][ T5957] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 499.270434][ T5957] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 499.313740][ T5957] usb 2-1: config 0 descriptor?? [ 499.436547][T10929] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1253'. [ 499.460541][T10929] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1253'. [ 499.486515][T10929] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1253'. [ 499.502517][T10929] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1253'. [ 499.516192][ T10] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 499.525240][T10929] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1253'. [ 499.525677][T10930] erofs (device nbd3): cannot find valid erofs superblock [ 499.582545][ T10] usb 1-1: device descriptor read/8, error -71 [ 501.110888][ T10] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 501.500948][ T5932] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 501.706263][ T10] usb 1-1: device not accepting address 56, error -71 [ 501.764521][ T10] usb usb1-port1: unable to enumerate USB device [ 501.957408][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.964674][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.736147][ T5932] usb 5-1: USB disconnect, device number 68 [ 503.116085][T10955] FAULT_INJECTION: forcing a failure. [ 503.116085][T10955] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 503.131026][T10955] CPU: 1 UID: 0 PID: 10955 Comm: syz.4.1261 Tainted: G L syzkaller #0 PREEMPT(full) [ 503.131059][T10955] Tainted: [L]=SOFTLOCKUP [ 503.131065][T10955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 503.131075][T10955] Call Trace: [ 503.131080][T10955] [ 503.131087][T10955] dump_stack_lvl+0x100/0x190 [ 503.131118][T10955] should_fail_ex.cold+0x5/0xa [ 503.131141][T10955] _copy_from_user+0x2e/0xd0 [ 503.131166][T10955] bpf_test_init.isra.0+0xaf/0x100 [ 503.131196][T10955] bpf_prog_test_run_xdp+0x57e/0x1670 [ 503.131222][T10955] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 503.131248][T10955] ? fput+0x79/0x100 [ 503.131266][T10955] ? __bpf_prog_get+0x97/0x2a0 [ 503.131289][T10955] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 503.131306][T10955] __sys_bpf+0x1725/0x4b90 [ 503.131327][T10955] ? __pfx___sys_bpf+0x10/0x10 [ 503.131342][T10955] ? proc_fail_nth_write+0x9f/0x220 [ 503.131365][T10955] ? find_held_lock+0x2b/0x80 [ 503.131391][T10955] ? find_held_lock+0x2b/0x80 [ 503.131411][T10955] ? ksys_write+0x190/0x250 [ 503.131440][T10955] ? __mutex_unlock_slowpath+0x15c/0x790 [ 503.131460][T10955] ? __fget_files+0x215/0x3d0 [ 503.131489][T10955] ? fput+0x79/0x100 [ 503.131506][T10955] ? ksys_write+0x1ac/0x250 [ 503.131530][T10955] ? __pfx_ksys_write+0x10/0x10 [ 503.131557][T10955] __x64_sys_bpf+0x7b/0xc0 [ 503.131575][T10955] ? lockdep_hardirqs_on+0x78/0x100 [ 503.131591][T10955] do_syscall_64+0x106/0xf80 [ 503.131607][T10955] ? clear_bhb_loop+0x40/0x90 [ 503.131628][T10955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.131646][T10955] RIP: 0033:0x7fd0c739c629 [ 503.131660][T10955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 503.131676][T10955] RSP: 002b:00007fd0c820e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 503.131693][T10955] RAX: ffffffffffffffda RBX: 00007fd0c7615fa0 RCX: 00007fd0c739c629 [ 503.131703][T10955] RDX: 0000000000000050 RSI: 0000200000000b80 RDI: 000000000000000a [ 503.131713][T10955] RBP: 00007fd0c820e090 R08: 0000000000000000 R09: 0000000000000000 [ 503.131723][T10955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 503.131732][T10955] R13: 00007fd0c7616038 R14: 00007fd0c7615fa0 R15: 00007ffedced9eb8 [ 503.131756][T10955] [ 505.257712][ T30] audit: type=1107 audit(2000000964.726:910): pid=10976 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='¿' [ 505.883960][T10982] trusted_key: encrypted_key: insufficient parameters specified [ 506.144310][ T9] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 506.160150][ T2059] usb 2-1: USB disconnect, device number 50 [ 506.360669][ T9] usb 6-1: device descriptor read/64, error -71 [ 506.612675][ T30] audit: type=1400 audit(2000000966.144:911): avc: denied { setopt } for pid=10991 comm="syz.1.1272" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 506.706248][ T9] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 506.787074][T11003] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.1267'. [ 506.832683][T11003] netlink: ct family unspecified [ 506.850999][ T9] usb 6-1: device descriptor read/64, error -71 [ 506.896740][ T2059] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 507.134488][ T9] usb usb6-port1: attempt power cycle [ 507.279216][ T2059] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 507.297094][ T2059] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.319683][ T2059] usb 4-1: config 0 descriptor?? [ 507.477639][ T9] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 507.507438][ T9] usb 6-1: device descriptor read/8, error -71 [ 507.525308][ T2059] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 507.534198][ T2059] [drm:udl_init] *ERROR* Selecting channel failed [ 507.559869][ T2059] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 507.567877][ T2059] [drm] Initialized udl on minor 2 [ 507.582870][ T2059] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 507.591395][ T2059] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 507.599016][ T24] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 507.608830][ T2059] usb 4-1: USB disconnect, device number 53 [ 507.615012][ T24] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 507.687503][ T5932] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 507.851122][ T9] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 507.897136][ T5932] usb 2-1: Using ep0 maxpacket: 32 [ 507.918657][ T5932] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 507.933006][ T5932] usb 2-1: config 0 has no interface number 0 [ 507.941821][ T5932] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 507.955995][ T9] usb 6-1: device descriptor read/8, error -71 [ 507.958143][ T5932] usb 2-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 507.973749][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.986289][ T5932] usb 2-1: Product: syz [ 507.991938][ T5932] usb 2-1: Manufacturer: syz [ 508.021126][ T5932] usb 2-1: SerialNumber: syz [ 508.068978][ T9] usb usb6-port1: unable to enumerate USB device [ 508.076560][ T5932] usb 2-1: config 0 descriptor?? [ 508.093226][ T5932] em28xx 2-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 508.104240][ T5932] em28xx 2-1:0.132: Video interface 132 found: [ 508.211058][ T9] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 508.468161][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 508.482570][ T9] usb 1-1: config 0 has an invalid interface number: 190 but max is 0 [ 508.492915][ T9] usb 1-1: config 0 has no interface number 0 [ 508.506591][ T9] usb 1-1: New USB device found, idVendor=14aa, idProduct=022b, bcdDevice=b0.11 [ 508.516104][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.524178][ T9] usb 1-1: Product: syz [ 508.539866][ T9] usb 1-1: Manufacturer: syz [ 508.546523][ T9] usb 1-1: SerialNumber: syz [ 508.583318][ T9] usb 1-1: config 0 descriptor?? [ 508.622704][ T9] dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)' in warm state. [ 508.675579][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 508.682278][ T9] dvb-usb: will use the device's hardware PID filter (table count: 15). [ 508.694713][ T9] dvbdev: DVB: registering new adapter (WideView WT-220U PenType Receiver (based on ZL353)) [ 508.707185][ T9] usb 1-1: media controller created [ 508.723281][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 508.774626][ T9] usb 1-1: DVB: registering adapter 1 frontend 0 (WideView USB DVB-T)... [ 508.784534][ T9] dvbdev: dvb_create_media_entity: media entity 'WideView USB DVB-T' registered. [ 508.795976][ T5932] em28xx 2-1:0.132: unknown em28xx chip ID (0) [ 508.823199][T11016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.859690][T11016] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.906293][ T9] rc_core: IR keymap rc-dtt200u not found [ 508.912949][ T9] Registered IR keymap rc-empty [ 508.919249][ T9] rc rc0: WideView WT-220U PenType Receiver (based on ZL353) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 508.968287][ T9] input: WideView WT-220U PenType Receiver (based on ZL353) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input33 [ 509.005526][ T9] dvb-usb: schedule remote query interval to 300 msecs. [ 509.023137][ T9] dvb-usb: WideView WT-220U PenType Receiver (based on ZL353) successfully initialized and connected. [ 509.320055][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 509.328991][ T9] dvb-usb: error -22 while querying for an remote control event. [ 509.377892][ T2059] usb 1-1: USB disconnect, device number 57 [ 509.384017][T11049] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge_slave_0, syncid = 1, id = 0 [ 509.528421][ T5932] em28xx 2-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 509.554161][T11053] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.1280'. [ 509.563522][T11053] netlink: ct family unspecified [ 509.581900][ T2059] dvb-usb: WideView WT-220U PenType Receiver (base successfully deinitialized and disconnected. [ 509.594304][ T5932] em28xx 2-1:0.132: board has no eeprom [ 509.602022][ T9] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 509.602175][ T10] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 509.649295][ T5932] em28xx 2-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 509.649324][ T5932] em28xx 2-1:0.132: analog set to bulk mode. [ 509.650104][ T24] em28xx 2-1:0.132: Registering V4L2 extension [ 509.663776][ T5932] usb 2-1: USB disconnect, device number 51 [ 509.672237][ T5932] em28xx 2-1:0.132: Disconnecting em28xx [ 509.744796][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 509.755529][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 509.778626][ T10] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 509.788404][ T9] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 509.800270][ T9] usb 4-1: config 0 has no interface number 0 [ 509.806780][ T10] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 509.820284][ T9] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 509.830553][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 509.844295][ T9] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 509.859545][ T10] usb 6-1: config 0 descriptor?? [ 509.864614][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.879879][ T9] usb 4-1: Product: syz [ 509.884439][ T9] usb 4-1: Manufacturer: syz [ 509.896438][ T9] usb 4-1: SerialNumber: syz [ 509.913121][ T9] usb 4-1: config 0 descriptor?? [ 509.921870][ T24] em28xx 2-1:0.132: Config register raw data: 0xffffffed [ 509.930161][ T9] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 509.945141][ T9] em28xx 4-1:0.132: Video interface 132 found: [ 509.946252][ T24] em28xx 2-1:0.132: AC97 chip type couldn't be determined [ 509.982134][ T24] em28xx 2-1:0.132: No AC97 audio processor [ 510.001950][ T24] usb 2-1: Decoder not found [ 510.008792][ T24] em28xx 2-1:0.132: failed to create media graph [ 510.027533][ T24] em28xx 2-1:0.132: V4L2 device video103 deregistered [ 510.050026][ T24] em28xx 2-1:0.132: Remote control support is not available for this card. [ 510.072691][ T5932] em28xx 2-1:0.132: Closing input extension [ 510.100370][ T5932] em28xx 2-1:0.132: Freeing device [ 510.494100][ T9] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 511.048818][T11087] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1287'. [ 511.049254][ T10] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 511.288398][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 511.302207][ T10] usb 5-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 511.324015][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 511.348344][ T10] usb 5-1: Product: syz [ 511.361025][ T10] usb 5-1: Manufacturer: syz [ 511.372787][ T10] usb 5-1: SerialNumber: syz [ 511.394679][ T10] usb 5-1: config 0 descriptor?? [ 511.414722][ T10] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 511.436733][ T10] pctv452e: pctv452e_power_ctrl: 1 [ 511.436733][ T10] [ 511.452866][ T10] usb 5-1: selecting invalid altsetting 3 [ 511.470735][ T9] em28xx 4-1:0.132: failed to trigger write to i2c address 0xa0 (error=-5) [ 511.481329][ T10] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 511.481329][ T10] [ 511.492099][ T9] em28xx 4-1:0.132: failed to read eeprom (err=-5) [ 511.505092][ T10] dvb-usb: bulk message failed: -22 (5/0) [ 511.513484][ T9] em28xx 4-1:0.132: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 511.524098][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 511.536238][ T10] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 511.547789][ T10] usb 5-1: media controller created [ 511.555873][ T10] dvb-usb: bulk message failed: -22 (8/0) [ 511.564034][ T10] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 511.859941][ T9] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 511.948507][ T10] dvb-usb: MAC address reading failed. [ 511.954079][ T9] em28xx 4-1:0.132: analog set to bulk mode. [ 511.974219][ T5883] em28xx 4-1:0.132: Registering V4L2 extension [ 511.976898][T11084] em28xx 4-1:0.132: failed to trigger read from i2c address 0x0 (error=-5) [ 511.985946][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 512.000816][ T9] usb 4-1: USB disconnect, device number 54 [ 512.007728][ T9] em28xx 4-1:0.132: Disconnecting em28xx [ 512.079290][ T30] audit: type=1107 audit(2000000971.897:912): pid=11094 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='¿' [ 512.107471][ T10] DVB: Unable to find symbol stb0899_attach() [ 512.113717][ T10] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 512.335863][ T24] usb 6-1: USB disconnect, device number 26 [ 512.382885][ T10] rc_core: IR keymap rc-tt-1500 not found [ 512.391347][ T10] Registered IR keymap rc-empty [ 512.398317][ T10] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 512.411320][ T30] audit: type=1400 audit(2000000972.233:913): avc: denied { ioctl } for pid=11103 comm="syz.5.1291" path="socket:[32491]" dev="sockfs" ino=32491 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 512.413464][ T10] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input34 [ 512.451157][ T10] dvb-usb: schedule remote query interval to 100 msecs. [ 512.458349][ T10] pctv452e: pctv452e_power_ctrl: 0 [ 512.458349][ T10] [ 512.469743][ T5883] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 512.476786][ T5883] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 512.488114][ T10] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 512.510314][ T5883] em28xx 4-1:0.132: No AC97 audio processor [ 512.550239][ T10] usb 5-1: USB disconnect, device number 69 [ 512.575674][ T30] audit: type=1400 audit(2000000972.412:914): avc: denied { map } for pid=11103 comm="syz.5.1291" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 512.577834][ T5842] dvb-usb: bulk message failed: -22 (4/0) [ 512.599699][ T2059] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 512.610767][ T5883] usb 4-1: Decoder not found [ 512.618761][ T5930] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 512.627841][ T5883] em28xx 4-1:0.132: failed to create media graph [ 512.723213][ T30] audit: type=1400 audit(2000000972.412:915): avc: denied { execute } for pid=11103 comm="syz.5.1291" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 512.777421][ T5883] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 512.786997][ T5842] dvb-usb: error -22 while querying for an remote control event. [ 512.796546][ T5883] em28xx 4-1:0.132: Remote control support is not available for this card. [ 512.802345][ T2059] usb 2-1: device descriptor read/64, error -71 [ 512.805429][ T9] em28xx 4-1:0.132: Closing input extension [ 512.830712][ T5930] usb 1-1: Using ep0 maxpacket: 8 [ 512.856375][ T5930] usb 1-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 513.037619][ T5930] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.049690][ T2059] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 513.214858][ T5930] usb 1-1: Product: syz [ 513.219772][ T9] em28xx 4-1:0.132: Freeing device [ 513.256144][ T5930] usb 1-1: Manufacturer: syz [ 513.258918][ T10] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 513.273806][ T2059] usb 2-1: device descriptor read/64, error -71 [ 513.302537][ T5930] usb 1-1: SerialNumber: syz [ 513.324999][ T30] audit: type=1400 audit(2000000973.189:916): avc: denied { remove_name } for pid=11114 comm="syz.4.1293" name="binder1" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 513.350350][ T5930] usb 1-1: config 0 descriptor?? [ 513.376661][ T30] audit: type=1400 audit(2000000973.241:917): avc: denied { unlink } for pid=11114 comm="syz.4.1293" name="binder1" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 513.403121][ T5930] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 513.411065][ T5930] pctv452e: pctv452e_power_ctrl: 1 [ 513.411065][ T5930] [ 513.426115][ T2059] usb usb2-port1: attempt power cycle [ 513.443776][ T5930] usb 1-1: selecting invalid altsetting 3 [ 513.449517][ T5930] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 513.449517][ T5930] [ 513.461903][ T5930] dvb-usb: bulk message failed: -22 (5/0) [ 513.506428][ T5930] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 513.516827][ T5930] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 513.535727][ T5930] usb 1-1: media controller created [ 513.540981][ T5930] dvb-usb: bulk message failed: -22 (8/0) [ 513.553200][ T5930] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 513.571799][ T5930] dvb-usb: MAC address reading failed. [ 513.606879][ T5930] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 513.732174][ T5930] DVB: Unable to find symbol stb0899_attach() [ 513.743511][ T5930] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 513.754570][ T2059] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 513.783575][ T2059] usb 2-1: device descriptor read/8, error -71 [ 513.843665][ T9] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 513.906905][ T51] Bluetooth: hci5: command 0x0406 tx timeout [ 513.918796][ T5930] rc_core: IR keymap rc-tt-1500 not found [ 513.942941][T11124] FAULT_INJECTION: forcing a failure. [ 513.942941][T11124] name failslab, interval 1, probability 0, space 0, times 0 [ 513.945008][ T5930] Registered IR keymap rc-empty [ 513.966780][T11124] CPU: 0 UID: 0 PID: 11124 Comm: syz.5.1295 Tainted: G L syzkaller #0 PREEMPT(full) [ 513.966806][T11124] Tainted: [L]=SOFTLOCKUP [ 513.966812][T11124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 513.966821][T11124] Call Trace: [ 513.966827][T11124] [ 513.966835][T11124] dump_stack_lvl+0x100/0x190 [ 513.966866][T11124] should_fail_ex.cold+0x5/0xa [ 513.966890][T11124] ? tomoyo_realpath_from_path+0xb6/0x690 [ 513.966911][T11124] should_failslab+0xc2/0x120 [ 513.966938][T11124] __kmalloc_noprof+0xe0/0x850 [ 513.966976][T11124] tomoyo_realpath_from_path+0xb6/0x690 [ 513.967002][T11124] tomoyo_path_number_perm+0x23c/0x580 [ 513.967029][T11124] ? tomoyo_path_number_perm+0x22e/0x580 [ 513.967056][T11124] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 513.967105][T11124] ? find_held_lock+0x2b/0x80 [ 513.967126][T11124] ? __fget_files+0x215/0x3d0 [ 513.967142][T11124] ? hook_file_ioctl_common+0x146/0x410 [ 513.967169][T11124] ? __fget_files+0x21f/0x3d0 [ 513.967188][T11124] security_file_ioctl+0xd3/0x230 [ 513.967209][T11124] __x64_sys_ioctl+0xb7/0x210 [ 513.967234][T11124] do_syscall_64+0x106/0xf80 [ 513.967252][T11124] ? clear_bhb_loop+0x40/0x90 [ 513.967273][T11124] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.967291][T11124] RIP: 0033:0x7fef37b9c629 [ 513.967306][T11124] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 513.967329][T11124] RSP: 002b:00007fef389fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 513.967347][T11124] RAX: ffffffffffffffda RBX: 00007fef37e15fa0 RCX: 00007fef37b9c629 [ 513.967358][T11124] RDX: 0000200000000000 RSI: 000000004008ae89 RDI: 0000000000000005 [ 513.967369][T11124] RBP: 00007fef389fc090 R08: 0000000000000000 R09: 0000000000000000 [ 513.967380][T11124] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 513.967390][T11124] R13: 00007fef37e16038 R14: 00007fef37e15fa0 R15: 00007ffdac4afba8 [ 513.967416][T11124] [ 513.967440][T11124] ERROR: Out of memory at tomoyo_realpath_from_path. [ 513.970365][ T5930] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 514.078171][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 514.193948][ T9] usb 4-1: config 2 has an invalid interface number: 31 but max is 0 [ 514.198317][ T5930] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input35 [ 514.213565][ T9] usb 4-1: config 2 has no interface number 0 [ 514.213603][ T9] usb 4-1: config 2 interface 31 has no altsetting 0 [ 514.229932][ T9] usb 4-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 514.246284][ T5930] dvb-usb: schedule remote query interval to 100 msecs. [ 514.253394][ T2059] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 514.277724][ T5930] pctv452e: pctv452e_power_ctrl: 0 [ 514.277724][ T5930] [ 514.284984][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.293015][ T5930] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 514.302930][ T2059] usb 2-1: device descriptor read/8, error -71 [ 514.318328][ T5930] usb 1-1: USB disconnect, device number 58 [ 514.358403][ T9] usb 4-1: Product: syz [ 514.362598][ T9] usb 4-1: Manufacturer: syz [ 514.379960][ T9] usb 4-1: SerialNumber: syz [ 514.389767][ T9] ch9200 4-1:2.31: probe with driver ch9200 failed with error -22 [ 514.426818][ T2059] usb usb2-port1: unable to enumerate USB device [ 514.468653][ T5930] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 514.586380][ T30] audit: type=1400 audit(2000000974.522:918): avc: denied { write } for pid=11108 comm="syz.3.1292" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 514.610719][ T30] audit: type=1400 audit(2000000974.554:919): avc: denied { read } for pid=11108 comm="syz.3.1292" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 514.636986][T11112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 514.645827][T11112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.656254][T11112] genirq: Flags mismatch irq 31. 00200000 (comedi_parport) vs. 00200000 (virtio1-input.0) [ 514.830503][ T5930] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 514.932502][ T9] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 514.983980][ T2059] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 514.992771][ T5930] usb 1-1: Using ep0 maxpacket: 32 [ 515.000134][ T5930] usb 1-1: config 0 has an invalid interface number: 76 but max is 0 [ 515.022757][ T5930] usb 1-1: config 0 has no interface number 0 [ 515.044220][ T5930] usb 1-1: New USB device found, idVendor=2040, idProduct=d900, bcdDevice=a9.2c [ 515.065343][ T5930] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.097414][ T5930] usb 1-1: Product: syz [ 515.115049][ T5930] usb 1-1: Manufacturer: syz [ 515.132742][ T5930] usb 1-1: SerialNumber: syz [ 515.154408][ T2059] usb 5-1: Using ep0 maxpacket: 16 [ 515.163590][ T2059] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 515.186194][ T2059] usb 5-1: config 0 has no interfaces? [ 515.443826][ T5930] usb 1-1: config 0 descriptor?? [ 516.450903][ T10] usb 4-1: USB disconnect, device number 55 [ 516.469131][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 516.481164][ T5930] dvb-usb: found a 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' in warm state. [ 516.492498][ T9] usb 6-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 516.503402][ T2059] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 516.514105][ T5930] dw2102: su3000_power_ctrl: 1, initialized 0 [ 516.520368][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.520394][ T9] usb 6-1: Product: syz [ 516.520409][ T9] usb 6-1: Manufacturer: syz [ 516.520423][ T9] usb 6-1: SerialNumber: syz [ 516.533609][ T9] usb 6-1: config 0 descriptor?? [ 516.537355][ T2059] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 516.555732][T11147] FAULT_INJECTION: forcing a failure. [ 516.555732][T11147] name failslab, interval 1, probability 0, space 0, times 0 [ 516.572206][ T5930] dvb-usb: bulk message failed: -22 (2/0) [ 516.575410][ T9] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 516.594240][ T5930] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 516.602392][T11147] CPU: 0 UID: 0 PID: 11147 Comm: syz.3.1303 Tainted: G L syzkaller #0 PREEMPT(full) [ 516.602420][T11147] Tainted: [L]=SOFTLOCKUP [ 516.602426][T11147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 516.602435][T11147] Call Trace: [ 516.602440][T11147] [ 516.602447][T11147] dump_stack_lvl+0x100/0x190 [ 516.602477][T11147] should_fail_ex.cold+0x5/0xa [ 516.602498][T11147] should_failslab+0xc2/0x120 [ 516.602523][T11147] __kmalloc_cache_noprof+0x7a/0x6f0 [ 516.602542][T11147] ? sctp_add_bind_addr+0xae/0x3e0 [ 516.602563][T11147] ? __pfx_sctp_get_port_local+0x10/0x10 [ 516.602584][T11147] sctp_add_bind_addr+0xae/0x3e0 [ 516.602610][T11147] sctp_do_bind+0x36c/0x760 [ 516.602633][T11147] sctp_connect_new_asoc+0x5e7/0x770 [ 516.602654][T11147] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 516.602682][T11147] sctp_sendmsg+0x171a/0x22b0 [ 516.602706][T11147] ? __lock_acquire+0x4a5/0x2630 [ 516.602730][T11147] ? __pfx_sctp_sendmsg+0x10/0x10 [ 516.602753][T11147] ? __pfx_sock_has_perm+0x10/0x10 [ 516.602789][T11147] ? __pfx_sctp_sendmsg+0x10/0x10 [ 516.602810][T11147] inet_sendmsg+0x11c/0x140 [ 516.602832][T11147] ____sys_sendmsg+0x9ad/0xc30 [ 516.602853][T11147] ? __pfx_____sys_sendmsg+0x10/0x10 [ 516.602876][T11147] ? __pfx__kstrtoull+0x10/0x10 [ 516.602897][T11147] ___sys_sendmsg+0x190/0x1e0 [ 516.602918][T11147] ? __pfx____sys_sendmsg+0x10/0x10 [ 516.602948][T11147] ? find_held_lock+0x2b/0x80 [ 516.602981][T11147] __sys_sendmmsg+0x205/0x430 [ 516.602999][T11147] ? __pfx___sys_sendmmsg+0x10/0x10 [ 516.603025][T11147] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 516.603052][T11147] ? fput+0x79/0x100 [ 516.603068][T11147] ? ksys_write+0x1ac/0x250 [ 516.603089][T11147] ? __pfx_ksys_write+0x10/0x10 [ 516.603115][T11147] __x64_sys_sendmmsg+0x9c/0x100 [ 516.603130][T11147] ? lockdep_hardirqs_on+0x78/0x100 [ 516.603145][T11147] do_syscall_64+0x106/0xf80 [ 516.603161][T11147] ? clear_bhb_loop+0x40/0x90 [ 516.603180][T11147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.603196][T11147] RIP: 0033:0x7f0a4b79c629 [ 516.603210][T11147] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 516.603224][T11147] RSP: 002b:00007f0a4c5e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 516.603240][T11147] RAX: ffffffffffffffda RBX: 00007f0a4ba15fa0 RCX: 00007f0a4b79c629 [ 516.603250][T11147] RDX: 0000000000000001 RSI: 0000200000000a80 RDI: 0000000000000003 [ 516.603259][T11147] RBP: 00007f0a4c5e6090 R08: 0000000000000000 R09: 0000000000000000 [ 516.603274][T11147] R10: 000000000004c040 R11: 0000000000000246 R12: 0000000000000001 [ 516.603283][T11147] R13: 00007f0a4ba16038 R14: 00007f0a4ba15fa0 R15: 00007ffcd7190a68 [ 516.603305][T11147] [ 516.606299][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 516.616246][ T5930] dvbdev: DVB: registering new adapter (Hauppauge MAX S2 or WinTV NOVA HD USB2.0) [ 516.649965][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 516.650143][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 516.650159][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 516.670564][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 516.675698][ T2059] usb 5-1: config 0 descriptor?? [ 516.705754][T11138] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI [ 516.707942][ T5930] usb 1-1: media controller created [ 516.711874][T11138] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 516.711896][T11138] CPU: 0 UID: 0 PID: 11138 Comm: syz.0.1301 Tainted: G L syzkaller #0 PREEMPT(full) [ 516.711921][T11138] Tainted: [L]=SOFTLOCKUP [ 516.711928][T11138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 516.711939][T11138] RIP: 0010:su3000_i2c_transfer+0x607/0xd90 [ 516.986519][T11138] Code: 51 08 fa 48 8d 7b 08 48 89 f8 48 c1 e8 03 42 80 3c 20 00 0f 85 23 06 00 00 48 8b 5b 08 48 89 d8 48 89 da 48 c1 e8 03 83 e2 07 <42> 0f b6 04 20 38 d0 7f 08 84 c0 0f 85 f4 05 00 00 48 8b 44 24 10 [ 517.006197][T11138] RSP: 0018:ffffc90004adfc10 EFLAGS: 00010246 [ 517.012242][T11138] RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffffc9000cf51000 [ 517.020194][T11138] RDX: 0000000000000000 RSI: ffffffff88004af0 RDI: ffff8880603d2648 [ 517.028148][T11138] RBP: 0000000000001900 R08: 0000000000000003 R09: 0000000000001a00 [ 517.036097][T11138] R10: 0000000000001900 R11: 0000000000000001 R12: dffffc0000000000 [ 517.044045][T11138] R13: ffff8880222cab02 R14: 0000000000000000 R15: ffff8880222cab00 [ 517.052013][T11138] FS: 00007f905dee86c0(0000) GS:ffff888124347000(0000) knlGS:0000000000000000 [ 517.061031][T11138] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 517.067595][T11138] CR2: 000000110c2cc89a CR3: 000000005b903000 CR4: 00000000003526f0 [ 517.075547][T11138] Call Trace: [ 517.078822][T11138] [ 517.081736][T11138] __i2c_transfer+0x5d9/0x17f0 [ 517.086487][T11138] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 517.092280][T11138] ? __pfx___i2c_transfer+0x10/0x10 [ 517.097458][T11138] ? rt_mutex_slowtrylock+0x93/0x100 [ 517.102725][T11138] i2c_transfer+0x15f/0x380 [ 517.107470][T11138] i2cdev_ioctl_rdwr+0x3ec/0x700 [ 517.112389][T11138] i2cdev_ioctl+0x19d/0x830 [ 517.116872][T11138] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 517.121877][T11138] ? selinux_file_ioctl+0x139/0x290 [ 517.127055][T11138] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 517.132062][T11138] __x64_sys_ioctl+0x18e/0x210 [ 517.136811][T11138] do_syscall_64+0x106/0xf80 [ 517.141381][T11138] ? clear_bhb_loop+0x40/0x90 [ 517.146045][T11138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.151914][T11138] RIP: 0033:0x7f905cf9c629 [ 517.156312][T11138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 517.175898][T11138] RSP: 002b:00007f905dee8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 517.184289][T11138] RAX: ffffffffffffffda RBX: 00007f905d215fa0 RCX: 00007f905cf9c629 [ 517.192245][T11138] RDX: 0000200000000a40 RSI: 0000000000000707 RDI: 0000000000000004 [ 517.200195][T11138] RBP: 00007f905d032b39 R08: 0000000000000000 R09: 0000000000000000 [ 517.208402][T11138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 517.216347][T11138] R13: 00007f905d216038 R14: 00007f905d215fa0 R15: 00007ffe88d06018 [ 517.224301][T11138] [ 517.227300][T11138] Modules linked in: [ 517.232023][T11138] ---[ end trace 0000000000000000 ]--- [ 517.240044][ T9] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 517.252200][ T9] usb 6-1: media controller created [ 517.262788][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 517.302624][ T10] usb 5-1: USB disconnect, device number 70 [ 517.315001][ T9] usb 6-1: selecting invalid altsetting 3 [ 517.322030][ T9] ttusb2: set interface to alts=3 failed [ 517.333178][T11138] RIP: 0010:su3000_i2c_transfer+0x607/0xd90 [ 517.339767][T11138] Code: 51 08 fa 48 8d 7b 08 48 89 f8 48 c1 e8 03 42 80 3c 20 00 0f 85 23 06 00 00 48 8b 5b 08 48 89 d8 48 89 da 48 c1 e8 03 83 e2 07 <42> 0f b6 04 20 38 d0 7f 08 84 c0 0f 85 f4 05 00 00 48 8b 44 24 10 [ 517.360110][ T9] DVB: Unable to find symbol tda10086_attach() [ 517.375259][ T9] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 517.385871][T11138] RSP: 0018:ffffc90004adfc10 EFLAGS: 00010246 [ 517.392215][T11138] RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffffc9000cf51000 [ 517.400464][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 517.406358][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 517.418306][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 517.424503][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 517.434845][ T9] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 517.443988][T11138] RDX: 0000000000000000 RSI: ffffffff88004af0 RDI: ffff8880603d2648 [ 517.454323][ T9] usb 6-1: USB disconnect, device number 27 [ 517.460482][T11138] RBP: 0000000000001900 R08: 0000000000000003 R09: 0000000000001a00 [ 517.474833][T11138] R10: 0000000000001900 R11: 0000000000000001 R12: dffffc0000000000 [ 517.491491][ T9] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 517.503042][T11138] R13: ffff8880222cab02 R14: 0000000000000000 R15: ffff8880222cab00 [ 517.518571][T11138] FS: 00007f905dee86c0(0000) GS:ffff888124347000(0000) knlGS:0000000000000000 [ 517.528078][T11138] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 517.534685][T11138] CR2: 00007f0a4b84e9d3 CR3: 000000005b903000 CR4: 00000000003526f0 [ 517.543270][T11138] Kernel panic - not syncing: Fatal exception [ 517.549618][T11138] Kernel Offset: disabled [ 517.553926][T11138] Rebooting in 86400 seconds..