last executing test programs: 8m51.312817858s ago: executing program 4 (id=655): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x24, r1, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xfffffffffffffffe}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000) r2 = socket(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000013c0)={{0x14, 0x453, 0x1f, 0x0, 0x0, {0x5}}, [], {0x14, 0x3e8}}, 0x28}, 0x1, 0x0, 0x0, 0x64841}, 0x40000) recvfrom$netrom(r2, &(0x7f0000000100)=""/96, 0x60, 0x2040, &(0x7f0000000200)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x3}, [@default, @null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x48) 8m50.737230693s ago: executing program 4 (id=659): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, 0x0) socket(0x10, 0x80002, 0x0) syz_io_uring_setup(0x2d44, &(0x7f0000000640)={0x0, 0xcd7d, 0x2, 0x3, 0x17f}, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r3, 0x0) syz_usb_connect(0x1, 0x59f, 0x0, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x80480c0}, 0x10) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x24000000}, 0x20000091) syz_usb_connect$uac2(0x5, 0x8f, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r5) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0x1d, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x5, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) 8m49.360755745s ago: executing program 4 (id=664): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x240, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000040)={0x6, 0x7, 0x9, 0x0, 0x1, "100056f200"}) r2 = getpgid(0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_pidfd_open(r2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r5, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r4, @ANYRESHEX=r5], 0x15) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000000)=0x8001) openat$ttyS3(0xffffff9c, &(0x7f0000000140), 0x20040, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1) 8m46.856915789s ago: executing program 4 (id=670): mkdir(&(0x7f0000000200)='./file1\x00', 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) newfstatat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x2000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r2, 0x40049366, &(0x7f0000000500)=0x1) setuid(0xee01) 8m45.288756328s ago: executing program 4 (id=674): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) pread64(r0, 0x0, 0x0, 0x8002) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x2, 0x2) syz_open_dev$usbfs(0x0, 0x77, 0x101301) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r4, 0x0, 0x0) recvmmsg(r4, 0x0, 0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000000)=0x1) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xf, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b703000000000000850000008c000000bf090000000000005509090000000000000000b7020000000000008500000085000000b700000000000000950000000000000006f7021f7e7f447ada2b29dda7289bbe264dbee23894c356aa6d62f3aa162db5e7f14abca2bb8beb7b7f88f7c6464023dc9da52c0a6dc4bda83eca11e1768dd63555091d4ef2b9008f8f7e2a870ed53f2b5ad644db030abcfd166e486e891809d3aca59e5975e9375109f2bc97194b7bd6ccfd247bd5582db72242023f9e7e6bba259aef902367a9e7d69e9da2e9124d576e117ae44a7635c227598be7f562ce78f2e23e032d"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffd}, 0x94) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000200)=@mmap={0x1, 0x1, 0x4, 0x1, 0x6, {0x77359400}, {0x1, 0x8, 0x5, 0x9, 0x64, 0x5, ' \x00'}, 0xfffffff7, 0x1, {}, 0x2}) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f000000010000000058000b480400945f64009400050038925a01000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000001300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@func_proto={0x0, 0x0, 0x0, 0x2, 0x3}, @fwd={0x2}, @struct={0x0, 0x0, 0x0, 0x9, 0x0, 0x2}]}, {0x0, [0x0, 0x51]}}, &(0x7f00000005c0)=""/240, 0x40, 0xf0, 0x1}, 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r9, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r8, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r9, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000340)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x10001, '\x00', 0x0, r7, 0x2, 0x3}, 0x50) 8m43.157378916s ago: executing program 4 (id=681): setresuid(0x0, 0xee01, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="b8000000150001002bbd7000fddbdf25fe880000000000000000000000000501fc000000000000000000000000000001000000004e2300000a00100000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="080000000000000001000000000000000000000000000000000000000000000008000000000000000000000000000000ff8af1ace4c4e206637effffff00000000ffffffffffffffff000000000000000000000000000000000200000000000000000000000000000004000000b36b6e0000010303000000005aa758960aa2d1c2bad360df5227766c29a585f728"], 0xb8}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x28) mmap(&(0x7f0000328000/0x4000)=nil, 0x4000, 0x1000003, 0x12, 0xffffffffffffffff, 0xaffef000) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009690342058200510f6b50102030109021b00020000000009043d0000518e3f0009"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8a002, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000001c0)={0x8000, 0x2, 0x4}) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x91) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$netrom_NETROM_IDLE(0xffffffffffffffff, 0x103, 0x7, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r4) r5 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000080)={0x0, &(0x7f0000000340), 0x0, 0x0, 0xfffffffffffffd4b, 0x5, 0x0, 0xffffff2d}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000680)={r6, 0x1ff, 0x0, 0x1, 0x3, [0x0, 0x0, 0x0, 0x0], [0x800020], [0x0, 0x1001000, 0x1], [0x0, 0x0, 0xfffffffffefffffc, 0x9]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r4, 0xc06864b8, &(0x7f00000001c0)={r6, 0xae, 0x3ff, 0x34325241, 0x3, [r7, 0x0, r8, r9], [0x2b8, 0x0, 0x4], [0x4, 0x2, 0x0, 0xffffffff], [0x0, 0x0, 0x0, 0x9]}) r10 = socket(0x2000000000000021, 0x2, 0x2) setsockopt$inet_tcp_TCP_CONGESTION(r10, 0x110, 0xd, 0x0, 0x0) 8m42.83052534s ago: executing program 32 (id=681): setresuid(0x0, 0xee01, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="b8000000150001002bbd7000fddbdf25fe880000000000000000000000000501fc000000000000000000000000000001000000004e2300000a00100000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="080000000000000001000000000000000000000000000000000000000000000008000000000000000000000000000000ff8af1ace4c4e206637effffff00000000ffffffffffffffff000000000000000000000000000000000200000000000000000000000000000004000000b36b6e0000010303000000005aa758960aa2d1c2bad360df5227766c29a585f728"], 0xb8}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x28) mmap(&(0x7f0000328000/0x4000)=nil, 0x4000, 0x1000003, 0x12, 0xffffffffffffffff, 0xaffef000) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009690342058200510f6b50102030109021b00020000000009043d0000518e3f0009"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8a002, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000001c0)={0x8000, 0x2, 0x4}) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x91) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$netrom_NETROM_IDLE(0xffffffffffffffff, 0x103, 0x7, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r4) r5 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000080)={0x0, &(0x7f0000000340), 0x0, 0x0, 0xfffffffffffffd4b, 0x5, 0x0, 0xffffff2d}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000680)={r6, 0x1ff, 0x0, 0x1, 0x3, [0x0, 0x0, 0x0, 0x0], [0x800020], [0x0, 0x1001000, 0x1], [0x0, 0x0, 0xfffffffffefffffc, 0x9]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r4, 0xc06864b8, &(0x7f00000001c0)={r6, 0xae, 0x3ff, 0x34325241, 0x3, [r7, 0x0, r8, r9], [0x2b8, 0x0, 0x4], [0x4, 0x2, 0x0, 0xffffffff], [0x0, 0x0, 0x0, 0x9]}) r10 = socket(0x2000000000000021, 0x2, 0x2) setsockopt$inet_tcp_TCP_CONGESTION(r10, 0x110, 0xd, 0x0, 0x0) 6m48.241344712s ago: executing program 3 (id=1023): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000096d5c4004233e0269d7010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="800001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) openat$binfmt_format(0xffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_setup(0x3454, &(0x7f00000003c0)={0x0, 0x0, 0x40, 0x0, 0xa7}) clock_gettime(0xfffffffffffffffb, 0x0) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa) mmap(&(0x7f0000a82000/0x3000)=nil, 0x3000, 0x300000a, 0x810, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r4 = io_uring_setup(0xbbc, 0x0) io_uring_enter(r4, 0x100000, 0x2, 0xf, &(0x7f0000000000), 0x18) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x800) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000180)=""/67) syz_usb_connect$uac1(0x1, 0x0, 0x0, &(0x7f0000000880)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x2, 0x3, 0x40, 0x40, 0x8}, 0x37, &(0x7f0000000140)={0x5, 0xf, 0x37, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0xda, "9be30049b874bfa13fa1039b4f0a321f"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xb, 0x0, 0x6, 0x800}, @ss_container_id={0x14, 0x10, 0x4, 0xa, "a41709cf027d58104e6929058b401f89"}]}, 0x8, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x80f}}, {0xc5, &(0x7f0000000900)=@string={0xc5, 0x3, "90a102e2723d553fc84ea4b8f78a090c9d357e826e70d028b9e49e3f6a182cad591177550d972928b40aceceba5d5b85decd8c260a890ce1155a785253d4ee4facfe1f6f2cff007da5ce01eeaeef9dcfac3a2a701e94a15d9deec159c84f390e4f7d70d47128be98c7a151c40742f8f6f6b4e8349f4e35551d5a36d8cb14f4e29f4791aa391a6e35c03c7e54797687eab1f34898096bb4b209da4831a8f4cfae208f883c07c9b1d85b605d942fb33ff5ef9207513f9f45431ca2a636124fac8115fe8a"}}, {0x9, &(0x7f0000000340)=@string={0x9, 0x3, "01eb987bfa48ac"}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0xc65}}, {0x8e, &(0x7f0000000600)=@string={0x8e, 0x3, "804022d2156f3bbd1ed27f55def7f3c81ca82e38094f2f4563f4d05ff307638ad8e7b2ae6ea53589a96c96de551aa8869501febe3326370e560f26941df7efe90dde5ed09ade9b6b4fecdd4852893e10ccd429f9d2ccdb3c33f28d410b7509dc32d092332c2350d38e26a578d6b27f6289d2323388a463e42737f88d4f024776f4954871b67e67fb12844c9a"}}, {0xac, &(0x7f00000006c0)=@string={0xac, 0x3, "a326f09bdf223c3ee2367cbe947a4f45ae7f41a030085ba711a4ce190330633286305fb0e8a79278ee129e6d20ace81384f608823f947cb70d7db7dead993c712b14595fbc3e11c68556252180d8d1e5ba6eff8c16e25bdb14048c85bb1bafd8150d59082187106a3e006ba0bb4ed53e36ee3b4e7efcba34886c91f328a6cbfd4916b16fb43e18a3fd2b27fa36dac018cb56c6a3f46a4c4b1d890ff1534f618198ecd26074794cf0dd5e"}}, {0x31, &(0x7f0000000780)=@string={0x31, 0x3, "73b19e69161ea1a9176cd7c97554883070338ac8bc2d32da341ea8319c0282e3f00f87e15a10b42b7588549b6383d6"}}, {0xae, &(0x7f00000007c0)=@string={0xae, 0x3, "cf10239a8b03e646b877b61bb193055285832aeb996cb16e676da1a34d7b02ff1ef73b2f3837c28ecc0ffbaca0e3fa6bdcfa2b22888d21b3296dd9bdea72f006de6de1ccfd1faff53f04a8476c0288adb7c03611bb7e7952bdf625ea885e4e9730581efcc66e9ebbfeb3b3ffcfa7c3e35d28c86cb7178923895c93c4a60c5ea5b1140cbdc559b016c7e1b05a6e83d82e3935b7d949b107a52e21fe7be19290295cee1603eff5e658d26feb33"}}]}) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000140)={0x0, 0x4, 0x4, &(0x7f0000000080)={0x1d, "537a1468df08000000758bd16868e0bf22c7b844c1b1f10186854fff98d2870c38"}}) 6m44.761527542s ago: executing program 3 (id=1034): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000340)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c440c87", @ANYRES16=r1, @ANYRESHEX, @ANYRES32=r1, @ANYBLOB], 0x1c}}, 0x8080) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) prlimit64(0x0, 0x2, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r5 = getpid() sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, &(0x7f00000015c0)={&(0x7f0000000240), 0xc, &(0x7f0000001580)={&(0x7f0000001600)={0x5c, 0x0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0xff}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x10}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x5}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x9}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000080}, 0x40000) sched_setaffinity(r5, 0x8, &(0x7f00000002c0)=0x80000000005) r6 = syz_io_uring_setup(0x837, &(0x7f0000001480)={0x0, 0x2b94, 0x80, 0x7, 0x3cf}, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) r10 = dup(r9) write$UHID_INPUT(r10, &(0x7f0000000440)={0xf, {"a2e3ad21e08eeb661b5d310987f70e06d038e7ff7fc6e5539b0d750e8b089b3f363b68090890e0878f0e1ac6e7049b3b48959b649a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07410936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63da1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c554336909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e6409000000000000002fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec1109110900d0a8c4f6777478bc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e1505f6bf39ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97912507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000010000008000bea37ce0d0d4aa202f928f28381aab144a5dc29a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f6435f7590000008271a1f5f8528f227eabc1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9a53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b649f07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076a882e8020f06c47f8156832369c33076da865d258734dd73583df292892448839ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02da93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059ec01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d0300000000000000b378dd4dd891e937c2ea5410e0513005000000000000003911fab964c27155005e797b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02c67141a360c3ace48aee67918e5d678746383074c6bc1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7fdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e44e07b3c7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333b25bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475fb7807fb33b72685ec37a2d3f7664fe2f0459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b6cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5dd40b0000000000005f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128060000008261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b6c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb00600000000000000dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69cce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) syz_io_uring_submit(r7, r8, &(0x7f0000000100)=@IORING_OP_SEND={0x1a, 0x8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x44}) io_uring_enter(r6, 0x23a4, 0xe5bc, 0x8, 0x0, 0x0) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r12, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r11, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r13 = socket$inet6_sctp(0xa, 0x1, 0x84) r14 = dup(r13) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r14, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2c}}], 0x10) setrlimit(0x3, &(0x7f0000000080)={0xda, 0x100000000}) sendmsg$inet6(r13, &(0x7f0000000800)={&(0x7f0000000000)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c, &(0x7f0000000280)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) ioctl$FS_IOC_GETFSUUID(r13, 0x80111500, &(0x7f0000000180)) sendmsg$inet_sctp(r4, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) 6m42.875834095s ago: executing program 3 (id=1042): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) add_key$user(0x0, &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) prlimit64(0x0, 0x5, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) r1 = getpid() r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x530, 0x320, 0x18c, 0x203, 0x320, 0x19030000, 0x460, 0x2e0, 0x2e0, 0x460, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x320, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x0, 0x0, 0x8, 0x2000000}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0xe}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x3}, {0x2, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x8}, {}, {0x16}, {0x0, 0xff}, {}, {0x7}, {0x0, 0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0x101}, {}, {0x0, 0x0, 0x5}, {}, {0x0, 0x0, 0x0, 0x9}, {0xfffc, 0x0, 0x0, 0x10}, {}, {0xfffe}, {}, {}, {}, {0xfffe, 0xfb}, {}, {0x7a04}, {}, {}, {0x20, 0x6}, {}, {}, {}, {0x0, 0x1, 0x0, 0x800}, {}, {0xb8c, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x3}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {0x0, 0xfd}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0xb}, {0x4, 0x2}]}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x2, 'syz0\x00', {0x8001}}}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xb}}, @inet=@rpfilter={{0x28}, {0xd}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x590) fsopen(&(0x7f0000000000)='exfat\x00', 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, 0x0, 0x40094) syz_open_dev$dri(&(0x7f0000000180), 0x1ff, 0x141941) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, 0xffffffffffffffff, &(0x7f0000000280)={0xffffffffffffffff, r3, 0x7}) socket(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r6, {0x1, 0x2}, {0x1}, {0x11, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x80) mremap(&(0x7f0000216000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000875000/0x1000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 6m39.559706909s ago: executing program 3 (id=1047): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000180)={0x1, 0x0, [{0x201}]}) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, 0x0) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000100)={0x4}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000280)={[0x60000000004, 0x7, 0x80400000000009, 0xfffffffffffffa20, 0x2000000, 0x0, 0x2004cb, 0xfffffffff0000000, 0xa1d, 0x9, 0x5, 0x0, 0x400, 0x2, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000040)=@arm64={0xc, 0xb, 0x1, '\x00', 0x8}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000000)={0x5, 0x40, 0x40, 0x0}) openat$kvm(0xffffff9c, 0x0, 0x20000, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) 6m36.893460558s ago: executing program 3 (id=1052): r0 = socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256-generic\x00'}, 0x58) r4 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$sock(r4, &(0x7f0000002480)=[{{0x0, 0xf0ff, &(0x7f0000001780)=[{&(0x7f0000000340)="8224aca5f41b9e0ec5e7a706c919e7c0e343f0cd0a779c17e7f992396b09252009d2d12e9475a57ec39f71417044cf4151af34ac1dfd5d87cdd80bc4c24478821f64d4d971bbc1fc7bdd181a839344917165bb9cd0fa568aac55d8e38ee30fd3a9bc63e2656b6941c812e6ea0692ec276deb2b7b817906cf8c5429a42164e8bb521e216e554d509a0fd0d86729b5f4b9a01fb336bef1be8a68a628452b83a7404087d4bcb64f6ecad05459d12595d5b8b2657f2f29656a15e5a18e3168946dcb5faa59f7b404bad393ba06734d170b0513aeb0d051", 0xd5}, {&(0x7f00000004c0)="62c99e05d98775ed1beb5d67431ead896f7060f03e5b8671b283168d0df1573bef271f3a22b9cac06e27c7e87b34a19188d3e10e670bc070f0d3eb88d2f891d242747e0deec4a10609b12d4058b0fbff28bb01e6e49b533b03b11288ff4da1ab3226a2e3ba5fc47969142f1a1a0ca9ba4cece2ac9a5fcd89343de7e57dfcbb6216499555bd04f2fcb91c3c6c72868a3797ec63f8138ab74b5034878812df8b0445704cb33f81bffed93c3e645a206db134f626a59f4fac53fbf23489cf2f45d05d735e64033376671da045df97bcb989bda1d17ba14afbfd19e32a8222ebf934c17fed237b86aef2e830", 0xea}, {&(0x7f00000005c0)="f2b314c96d500b66f7fd46493862d9eb11d188464208592330ac482436286448", 0x20000}], 0x3}}], 0x1, 0x0) 6m34.196885195s ago: executing program 3 (id=1060): memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) move_pages(0x0, 0x20000000000000fe, &(0x7f0000000080)=[&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) setgroups(0x400000000000026f, &(0x7f0000000080)=[0x0, 0xee00]) 6m18.901919688s ago: executing program 33 (id=1060): memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) move_pages(0x0, 0x20000000000000fe, &(0x7f0000000080)=[&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) setgroups(0x400000000000026f, &(0x7f0000000080)=[0x0, 0xee00]) 2m39.635056535s ago: executing program 5 (id=1733): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x900, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) 2m39.52484949s ago: executing program 5 (id=1734): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fsopen(&(0x7f0000000340)='ramfs\x00', 0x1) ptrace(0x10, 0x0) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r4 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000280)={'syz', 0x3}, &(0x7f0000000100)="f8", 0x1, 0xfffffffffffffffe) setrlimit(0x7, &(0x7f0000000400)) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r3, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r3, 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0xffe7}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r2, 0x0) kexec_load(0x8, 0x1, &(0x7f0000000500)=[{0x0, 0x0, 0x0, 0x10000}], 0x3e0000) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, 0x0, 0x0) 2m38.196581956s ago: executing program 5 (id=1741): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000002080), 0x80000, 0x0) fallocate(r1, 0x28, 0xd, 0xf7a4) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000020c0)={{{@in6=@private0, @in=@private}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000021c0)=0xe8) (async) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000020c0)={{{@in6=@private0, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000021c0)=0xe8) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000002200)='./file0\x00', 0x88040, 0x80) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_int(r4, 0x29, 0x13, &(0x7f0000002240)=0x391, 0x4) openat$sndseq(0xffffffffffffff9c, &(0x7f0000002280), 0x111200) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000002280), 0x111200) syz_open_dev$MSR(&(0x7f00000022c0), 0x5, 0x0) (async) syz_open_dev$MSR(&(0x7f00000022c0), 0x5, 0x0) ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, &(0x7f0000002300)={{r5}, 0x2, 0x7, 0x61a}) (async) ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, &(0x7f0000002300)={{r5}, 0x2, 0x7, 0x61a}) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000002380), 0xffffffffffffffff) (async) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000002380), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r6, &(0x7f0000002440)={&(0x7f0000002340)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000002400)={&(0x7f00000023c0)={0x20, r7, 0x4, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x20}, 0x1, 0x0, 0x0, 0x41804}, 0x20000000) (async) sendmsg$NBD_CMD_RECONFIGURE(r6, &(0x7f0000002440)={&(0x7f0000002340)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000002400)={&(0x7f00000023c0)={0x20, r7, 0x4, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x20}, 0x1, 0x0, 0x0, 0x41804}, 0x20000000) write$6lowpan_control(r1, &(0x7f0000002480)='disconnect aa:aa:aa:aa:aa:11 2', 0x1e) (async) write$6lowpan_control(r1, &(0x7f0000002480)='disconnect aa:aa:aa:aa:aa:11 2', 0x1e) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f00000024c0)={0x0, 0x0, '\x00', @bt={0xd, 0xfffff881, 0x80000001, 0x51, 0xdae, 0xffffffffbdcd2c29, 0x19, 0xb}}) syz_genetlink_get_family_id$ieee802154(&(0x7f0000002580), r6) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r5, 0x4048587b, &(0x7f0000002980)={{r4, &(0x7f00000025c0)='/dev/cpu/#/msr\x00', 0x82802, &(0x7f0000002600)={@_ha_fsid={[0xa, 0x8]}, {0x3, 0x45, 0xf, 0x8}}, 0x1, &(0x7f0000002640)={@_ha_fsid}, &(0x7f0000002680)=0xb31}, 0x3, &(0x7f0000002900)=[{0x1, 0x8, &(0x7f00000026c0)='/dev/fuse\x00', &(0x7f0000002700)="91ac8b605047a359d9e7795a1b", 0xd, 0x2}, {0x1, 0x47, &(0x7f0000002740)='{&+@\x00', &(0x7f0000002780)="e57eb65918de7bbab64b3cf5ac0ab62116d9c76401bd5ddaea4650a0e99b91d415066caad020917dbeea0384d04885a1a7591bbebc5d9bdfd84f5e3d5e7cf9386f1fb5", 0x43, 0x32}, {0x0, 0x4, &(0x7f0000002800)='/dev/snd/seq\x00', &(0x7f0000002840)="3ee1a12941b4d1e99130bb66cf82fc8d6e9bb72fe75f16cd40f335852c647c529255392f112aa6d45428ea231a6c794e0a2abc375f110e4b3ec1388423cd30d45f668c9364d9815dd5da22ff38c3872dc338452c986d66534f7eaa7454a45c2218ee7cb66f7b932a26159bbe900ba713fbb0488653260e1ea31c67f9f66dc4387b8dff715d1f1d7d185ea1be8a3447c235c9013ff97910e3786b69aed2bc21dba42382bdf0aafa3ad5e6f42334c2cefad176388e024e11", 0xb7, 0x3a}]}) r9 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x20010, r1, 0x0) syz_io_uring_complete(r9) (async) syz_io_uring_complete(r9) syz_genetlink_get_family_id$nl802154(&(0x7f0000002a40), r6) (async) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000002a40), r6) sendmsg$NL802154_CMD_SET_CCA_MODE(r6, &(0x7f0000002b00)={&(0x7f0000002a00)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000002ac0)={&(0x7f0000002a80)={0x1c, r10, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_CCA_OPT={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40d4}, 0x4004008) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000002b80)=@raw={'raw\x00', 0x9, 0x3, 0x300, 0x0, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x3, &(0x7f0000002b40), {[{{@ipv6={@rand_addr=' \x01\x00', @mcast1, [0xffffff00, 0xffffffff, 0xffffffff, 0xffffffff], [0x0, 0xff, 0xff, 0xff], 'bond0\x00', 'veth0_to_batadv\x00', {}, {}, 0x89, 0x6, 0x1, 0x48}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x7}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xf8, 0x138, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xe}}, @inet=@rpfilter={{0x28}, {0xe}}]}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "19b0133b36be44cd10009361aff303b759c382374511176fd13212414cc8"}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x360) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000002fc0)={'gretap0\x00', &(0x7f0000002f00)={'syztnl2\x00', r2, 0x10, 0x80, 0x280000, 0x3492, {{0x1e, 0x4, 0x2, 0x1d, 0x78, 0x64, 0x0, 0xef, 0x2f, 0x0, @loopback, @private=0xa010101, {[@ssrr={0x89, 0xb, 0x1c, [@multicast1, @broadcast]}, @cipso={0x86, 0x3d, 0xffffffffffffffff, [{0x1, 0xd, "b8cd6ab86a66c087d88b1c"}, {0x6, 0x6, "627dd406"}, {0x5, 0x3, '3'}, {0x4, 0x11, "819a1cfebe9015e77899ab2d8a6454"}, {0x7, 0xe, "787b31125040965eeb67ae54"}, {0x0, 0x2}]}, @lsrr={0x83, 0x1b, 0x7d, [@empty, @local, @dev={0xac, 0x14, 0x14, 0x36}, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}, @private=0xa010101]}, @noop]}}}}}) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r11, &(0x7f00000030c0)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000003080)={&(0x7f0000003040)={0x14, r10, 0x300, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x40) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000003100)={"46e1c35712ed2af1366bccb11a969fc0", 0x0, 0x0, {0x100, 0x81}, {0x1ef56735, 0x2}, 0x6, [0x4e71, 0xf, 0x5, 0x4, 0x8, 0x0, 0x416b, 0x7fff, 0x1ced0607, 0x8, 0x1, 0x0, 0xfa0, 0x8, 0x5, 0x1]}) ioctl$BTRFS_IOC_GET_DEV_STATS(r3, 0xc4089434, &(0x7f0000003280)={0x0, 0x5, 0x0, [0x80000001, 0x34, 0x7, 0x0, 0x15024186], [0xa, 0xffffffffffffffcc, 0x1, 0x6, 0x0, 0x7, 0x4, 0x23e, 0x6a6d, 0x5, 0xef63, 0x3, 0xaee9, 0x8, 0xfff, 0x2, 0xe4, 0x70000, 0x5, 0x8, 0xd0ed, 0x3, 0x3ff, 0x1, 0x80000000, 0xffffffffffffffff, 0x447f, 0x100000000, 0x8, 0x4, 0x0, 0x0, 0x101, 0x4, 0x1, 0x5, 0xfb8, 0x3a, 0x8000000000000001, 0xffffffff, 0xc76a, 0x7, 0xffffffffffffffff, 0x7, 0xa20, 0x0, 0x7, 0x10, 0xa, 0x9, 0x6d, 0x0, 0x7, 0x6, 0x9d, 0x9, 0x5, 0x7, 0xdf, 0xe46c, 0x8, 0x0, 0x0, 0x0, 0x1, 0x80, 0x6, 0xc8f7, 0x8, 0x0, 0x400, 0xa788, 0x80000000, 0x1, 0x4, 0x4, 0x4, 0xfffffffffffffff7, 0x6, 0x8, 0xffffffff00000001, 0x0, 0x1, 0x3, 0x7, 0x2, 0x1000, 0xffffffffe8a2b8e9, 0x7, 0xff, 0x1, 0x7, 0x0, 0x6, 0x0, 0x7, 0x2, 0x5, 0x71d0f3f7, 0x2, 0x6, 0x5, 0x4, 0x20000, 0x0, 0x800, 0x10, 0x1, 0x3, 0x2, 0x8000, 0xc7, 0x6, 0xf35e, 0x0, 0x7, 0x2, 0x3, 0xfffffffffffffffc, 0x1, 0x18]}) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(r3, 0xc4089434, &(0x7f0000003280)={0x0, 0x5, 0x0, [0x80000001, 0x34, 0x7, 0x0, 0x15024186], [0xa, 0xffffffffffffffcc, 0x1, 0x6, 0x0, 0x7, 0x4, 0x23e, 0x6a6d, 0x5, 0xef63, 0x3, 0xaee9, 0x8, 0xfff, 0x2, 0xe4, 0x70000, 0x5, 0x8, 0xd0ed, 0x3, 0x3ff, 0x1, 0x80000000, 0xffffffffffffffff, 0x447f, 0x100000000, 0x8, 0x4, 0x0, 0x0, 0x101, 0x4, 0x1, 0x5, 0xfb8, 0x3a, 0x8000000000000001, 0xffffffff, 0xc76a, 0x7, 0xffffffffffffffff, 0x7, 0xa20, 0x0, 0x7, 0x10, 0xa, 0x9, 0x6d, 0x0, 0x7, 0x6, 0x9d, 0x9, 0x5, 0x7, 0xdf, 0xe46c, 0x8, 0x0, 0x0, 0x0, 0x1, 0x80, 0x6, 0xc8f7, 0x8, 0x0, 0x400, 0xa788, 0x80000000, 0x1, 0x4, 0x4, 0x4, 0xfffffffffffffff7, 0x6, 0x8, 0xffffffff00000001, 0x0, 0x1, 0x3, 0x7, 0x2, 0x1000, 0xffffffffe8a2b8e9, 0x7, 0xff, 0x1, 0x7, 0x0, 0x6, 0x0, 0x7, 0x2, 0x5, 0x71d0f3f7, 0x2, 0x6, 0x5, 0x4, 0x20000, 0x0, 0x800, 0x10, 0x1, 0x3, 0x2, 0x8000, 0xc7, 0x6, 0xf35e, 0x0, 0x7, 0x2, 0x3, 0xfffffffffffffffc, 0x1, 0x18]}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r5, 0x50009417, &(0x7f00000036c0)={{r4}, r12, 0xcc752f26c81a4704, @inherit={0x70, &(0x7f0000003200)={0x1, 0x5, 0x10000, 0x9, {0x4, 0x4, 0x800, 0x9, 0x5}, [0x9, 0xfffffffffffffff9, 0x800, 0x12000000000, 0x2]}}, @devid=r13}) getsockopt$MRT(r8, 0x0, 0xd0, &(0x7f00000046c0), &(0x7f0000004700)=0x4) 2m37.801753913s ago: executing program 5 (id=1742): openat$nullb(0xffffffffffffff9c, 0x0, 0x4000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, 0x0, 0x26) r3 = socket(0x25, 0x800, 0x5) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x72, 0x11cfa, 0x0, 0x8000008, 0x1000003, 0x4, 0x1, 0x0, 0x7cce8c743ee810df, 0x1}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f}, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r5, 0x40505330, &(0x7f0000000bc0)={0x800100, 0x0, 0x0, 0x724f, 0x0, 0x55a}) r6 = syz_open_dev$I2C(&(0x7f00000000c0), 0x2000000000, 0xa00) ioctl$I2C_PEC(r6, 0x708, 0x200) ioctl$I2C_SMBUS(r6, 0x720, &(0x7f0000000040)={0x0, 0x79, 0x1, 0x0}) r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000003fc0), 0x121100, 0x0) ioctl$SOUND_MIXER_READ_DEVMASK(r7, 0xc0044dff, &(0x7f0000004000)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x893}, 0x20040084) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r3, 0x0, 0x20000010) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2714, 0x0, &(0x7f0000000000)) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILE_ALLOC_RANGE(0xffffffffffffffff, 0x19, &(0x7f0000000140)={0x800}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC], 0x0, 0xffffffff, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff"], 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd0054c19d4cbd804, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2m36.833931435s ago: executing program 5 (id=1745): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000d00)={0x0, 0x700, &(0x7f0000000340)={&(0x7f0000000440)=ANY=[@ANYBLOB="58010000", @ANYRES16=r1, @ANYBLOB="01002cbd7000fcdbdf2501000000060006004e2300000800050001000000200108801c011380f400098070000080060001000a00000014000200fc0200000000000000000000000000010500030002000000060001000a00000014000200000000000000000000000000000000010500030001000000060001000a0000001400020000000000000000000000ffff0a010102050003000200000028000080060001000a00000014000200fe8000000000000000000000000000bb050003000200000034000080060001000200000008000200ac1414bb05000300020000000600010002000000080002000a01010005000300020000001c000080060001000223000008000200ac1414aa0500030003000000040000800400008024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b392214000200776731000000"], 0x158}, 0x1, 0x0, 0x0, 0x44001}, 0x4c020) 2m36.380540049s ago: executing program 5 (id=1747): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000040)=ANY=[@ANYBLOB="8023b4ddde6b70d8189c195ed95ec5f07ffd55a0dbd7670861d522f4ddce469942648b7c", @ANYRES16=r0], 0x8) getsockopt$inet6_opts(r0, 0x29, 0x37, 0x0, &(0x7f0000000280)) ioperm(0x0, 0x7, 0x5) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r1, 0xa9525000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040), 0x0) close(0x3) close_range(r0, 0xffffffffffffffff, 0x2) sync() sync() 2m20.854988285s ago: executing program 34 (id=1747): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000040)=ANY=[@ANYBLOB="8023b4ddde6b70d8189c195ed95ec5f07ffd55a0dbd7670861d522f4ddce469942648b7c", @ANYRES16=r0], 0x8) getsockopt$inet6_opts(r0, 0x29, 0x37, 0x0, &(0x7f0000000280)) ioperm(0x0, 0x7, 0x5) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r1, 0xa9525000) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040), 0x0) close(0x3) close_range(r0, 0xffffffffffffffff, 0x2) sync() sync() 12.705301343s ago: executing program 2 (id=2320): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x400, 0x20000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4}, {0x0, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_NAT={0x8}, @TCA_CAKE_WASH={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x20008844) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) r2 = fanotify_init(0x8, 0x101000) add_key(&(0x7f0000000040)='ceph\x00', 0x0, &(0x7f0000000000)="01fe000200373a4541062000a59ea940d2cb0b3692f5020000a00000050000000000eb000000a5e5be21c44e", 0x2c, 0xffffffffffffffff) r3 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r3, 0x2) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) rmdir(&(0x7f0000000000)='./file0\x00') write$binfmt_aout(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="00000000008000"/18], 0x20) sendmmsg$inet6(r1, &(0x7f0000001ac0)=[{{&(0x7f0000000080)={0xa, 0x4e21, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, 0x10}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000ac0)='%', 0x1}], 0x1, &(0x7f0000001f00)=ANY=[], 0x128}}], 0x2, 0xc040) syz_kvm_setup_cpu$x86(r3, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f00000002c0)="0ffbffdfed64260fc7b5e500f01923ba4300b065eeb877038ee0baf80c66b87a77f68166efbafc0ced0f88bcd366660f388297d000baf80c66b8c06b6a8366efbafc0c66b87bdb000066ef", 0x4b}], 0x1, 0x36, &(0x7f0000000340)=[@cr4={0x1, 0x114080}, @cr4={0x1, 0x110}], 0x2) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x1) ioctl$DRM_IOCTL_WAIT_VBLANK(r4, 0xc018643a, &(0x7f00000001c0)={0x3e, 0x5, 0xb4}) syz_emit_ethernet(0x2a, 0x0, 0x0) sendmmsg(r1, &(0x7f0000009340)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000002680)='u', 0x1}], 0x1}}], 0x1, 0x20000880) r5 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r6 = socket$nl_route(0x10, 0x3, 0x0) flistxattr(r6, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3fd, 0x4000009, 0x200, 0xe2df, 0x9, 0x1, 0x4, 0x40000, 0x7, 0xf58, 0x6]}) r7 = socket$packet(0x11, 0x3, 0x300) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x9007}, 0x4) dup2(r7, r8) 11.104631171s ago: executing program 6 (id=2324): openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x101000, 0x0) pselect6(0x40, &(0x7f0000000000)={0x80000001, 0x1, 0x0, 0x400000101, 0x804, 0x40400004, 0x5fcfcf86, 0x8000}, 0x0, &(0x7f0000000040)={0x1f, 0x0, 0xfffffffffffffffe, 0x2000000000000000, 0x3, 0xfffffffffffffffd, 0x6a6, 0x7}, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(r0, 0x4010942a, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[], 0x18, 0x4004844}, 0x4800) openat$kvm(0xffffffffffffff9c, 0x0, 0x44000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mknodat$loop(0xffffffffffffff9c, 0x0, 0x1000, 0x1) symlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='./file1\x00') symlink(&(0x7f0000000280)='./file1/file0\x00', &(0x7f00000002c0)='./file0\x00') r2 = socket$inet6_sctp(0xa, 0x1, 0x84) dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000040), 0x0) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e22, 0xb, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2ed1}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000380)="8c", 0x1}, {&(0x7f00000004c0)="c1d84ca628868ff60f441f70291cf73befdf023dff1d5d3323370f22c9e92a64fdc8c690427f2b9230295610ff06e2f66636f54fe626be20ce219ca0be2745149492dbc39d0ddd9309ed6be4eeec74539e05549becb53fc8711c2d6bcab6b22d31756c8ebbb08ffccb8bd87cae2d40020b04a54bd4c61802b5bf7446c32e13ca368ec867efde2a2fbce359fbc40e7184fae042148b0709887235f5f8c1b35d7351767de08b39ed399891332d6483370e504c04fc2b2c4dbe1b04d2d1adfe36d08be627a728eb7206f85469", 0xcb}], 0x2}, 0x20048043) r3 = dup(r2) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x4e21, 0xa, @ipv4={'\x00', '\xff\xff', @remote}, 0x1000}}, 0x8003, 0x6, 0xe652, 0x5, 0x1b0, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000100)={0x0, @in6={{0xa, 0xce20, 0x4, @empty, 0x2e}}, 0x7, 0x1, 0xf06, 0x2, 0xbc, 0x81, 0x9}, 0x9c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) execve(&(0x7f0000019140)='./file0\x00', 0x0, 0x0) getpriority(0x2, 0x0) io_setup(0x80000000, 0x0) syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) 10.981509213s ago: executing program 2 (id=2327): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r1 = gettid() socket$igmp(0x2, 0x3, 0x2) socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$caif_seqpacket(0x25, 0x5, 0x0) recvmsg(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) openat$vcsa(0xffffffffffffff9c, 0x0, 0x80900, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0]) mount$tmpfs(0x0, 0x0, &(0x7f00000000c0), 0x800400, &(0x7f0000000300)=ANY=[@ANYBLOB='usrquota,usrquota_block_hardlimit']) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, &(0x7f0000000e40)=[{{&(0x7f0000000200)={0xa, 0x4e23, 0x11, @loopback, 0x7}, 0x1c, &(0x7f0000001b40)=[{&(0x7f0000001200)='\x00', 0x1}], 0x1}}], 0x1, 0x40) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e23, 0x2, @loopback}}}, 0x84) futex_waitv(&(0x7f0000002200)=[{0x87d, &(0x7f0000000200)=0x81, 0x2}, {0x11e, &(0x7f00000002c0)=0x5, 0x82}, {0x21, &(0x7f0000000340)=0x2, 0x2}, {0x5, &(0x7f0000000380)=0x8, 0x2}, {0x7, &(0x7f0000000440)=0x10000}, {0xf, &(0x7f0000000480)=0x3, 0x82}, {0x1, &(0x7f00000004c0)=0x3, 0x2}, {0x3, &(0x7f0000000500)=0x100, 0x82}, {0x80, &(0x7f0000000540)=0x8, 0x2}, {0xbbe0, &(0x7f0000000580)=0x1, 0x82}, {0x1ca5, &(0x7f00000005c0)=0x78, 0x82}, {0xa, &(0x7f0000000640)=0x6, 0x2}, {0x29, &(0x7f0000000680)=0x2, 0x2}, {0xffffffffffffffff, &(0x7f00000006c0)=0x3, 0x82}, {0x6, &(0x7f0000000700)=0xffffffffffffffff, 0x82}, {0x2, &(0x7f0000000740)=0x8a, 0x82}, {0x0, &(0x7f0000000780)=0x5, 0x2}, {0x8, &(0x7f0000000800)=0x8007, 0x2}, {0xffff, &(0x7f0000000840)=0x9, 0x2}, {0x71d, &(0x7f0000000880), 0x2}, {0xfffffffffffffff7, &(0x7f00000008c0)=0xd}, {0x2, &(0x7f0000000900)=0x3, 0x2}, {0x3, &(0x7f0000000940)=0x4, 0x2}, {0xfffffffffffffff8, 0x0, 0x82}, {0xf20c, &(0x7f00000009c0), 0x2}, {0x7, &(0x7f0000000a00)=0xfffffffffffffffb, 0x82}, {0xaf6, &(0x7f0000000a40)=0x2, 0x82}, {0x6, &(0x7f0000000a80)=0x9, 0x2}, {0x100000000, &(0x7f0000000ac0)=0xbcbd, 0x2}, {0x10001, &(0x7f0000000b00)=0x2, 0x82}, {0x4, &(0x7f0000000b40)=0x4, 0x2}, {0x8001, 0x0, 0x2}, {0x7ff, &(0x7f0000000bc0), 0x82}, {0x1ff, &(0x7f0000000c00)=0x8b1, 0x2}, {0x6, &(0x7f0000000c40)=0x5, 0x82}, {0x2ce, 0x0, 0x2}, {0x7fff, &(0x7f0000000cc0)=0x2, 0x2}, {0xfffffffffffffff9, &(0x7f0000000d00)=0x8000000000000000}, {0x400, 0x0, 0x2}, {0x7f, &(0x7f0000000d80)=0x2d84, 0x2}, {0x1, &(0x7f0000000dc0)=0xffffffffffff0000, 0x82}, {0x9, &(0x7f0000000e00)=0xdb6, 0x2}, {0x5, &(0x7f0000000e40)=0x8000000000000001, 0x2}, {0xd3, &(0x7f0000000e80)=0xffffffff, 0x2}, {0xf4c, &(0x7f0000000ec0)=0x401, 0x82}, {0xc, &(0x7f0000000f00)=0x6, 0x2}, {0xbc6c, &(0x7f0000000f40)=0x7c, 0x2}, {0x8, &(0x7f0000000f80)=0x2, 0x82}, {0xfffffffffffffff7, 0x0, 0x82}, {0x5, &(0x7f0000002000)=0x10004, 0x2}, {0x9, &(0x7f00000020c0)=0x100, 0x2}, {0x7, &(0x7f0000002140)=0x1000, 0x82}, {0x1, &(0x7f0000002180)=0x4438d299, 0x82}], 0x35, 0x0, &(0x7f0000002740), 0x1) ioperm(0x0, 0x2, 0x7e) gettid() fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000)={0x1}) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f00000006c0)={0x0, 0x0, 0xac1d}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f00000000c0)={0x0, 0x0, 0x8}) syz_io_uring_setup(0x236, &(0x7f0000000240)={0x0, 0x8101, 0x0, 0xfffffffe, 0x338}, &(0x7f0000000040), &(0x7f0000000600)) 10.343499485s ago: executing program 6 (id=2329): r0 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) sendmmsg$inet(r0, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}, 0x68}], 0x68000, 0x0) 10.266937732s ago: executing program 2 (id=2330): socket$kcm(0x2, 0x3, 0x2) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x4000)=nil, 0x0, 0x12) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, 0x0, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) mmap$snddsp(&(0x7f00006b3000/0x1000)=nil, 0x1000, 0xc, 0x20010, 0xffffffffffffffff, 0x6000) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) r4 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r4, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) r5 = io_uring_setup(0xf08, &(0x7f000000c480)={0x0, 0xc46e, 0x400, 0x20001, 0x3}) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f0000000940)=[{0x0}], 0x1) r6 = io_uring_setup(0x6fa2, &(0x7f0000000600)={0x0, 0x8474, 0x0, 0x4, 0x3d}) io_uring_register$IORING_REGISTER_FILES(r6, 0x1e, &(0x7f0000000000)=[r5], 0x1) write$FUSE_NOTIFY_STORE(r4, 0x0, 0x28) close(r4) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setns(r1, 0x8020000) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="5c00000013006bcd9e3fe3dc6e48aa310b6b8703110000001f03000000080000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84d0f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4014) socket$kcm(0x10, 0x2, 0x4) 10.140678595s ago: executing program 6 (id=2333): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x0, 0x0) userfaultfd(0x801) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x256ba000) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f00000004c0)=[@in_dx={0x69, 0x20, {0xff4f, 0x1}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @control_area=0xa6, 0x100000001, 0x6, 0x6}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @control_area=0xa4, 0x100000000, 0x5, 0x40}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @ro32=0x4408, 0x7, 0x5, 0x10001}}, @nested_load_syzos={0x136, 0x20, {0x0, 0x7}}, @nested_amd_invlpga={0x17d, 0x20, {0x2000, 0xcfa1}}, @nested_amd_clgi={0x17f, 0x10}, @wr_crn={0x67, 0x20, {0x0, 0x1a59}}, @nested_amd_set_intercept={0x181, 0x30, {0x1, 0x1, 0xb8f, 0x1}}, @nested_amd_stgi={0x17e, 0x10}, @wr_crn={0x67, 0x20, {0x8, 0x3}}, @nested_amd_vmload={0x182, 0x18, 0x3}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @ro32=0x440a, 0x400, 0xb, 0x9}}, @enable_nested={0x12c, 0x18}], 0x200}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x9, 0x6, 0x400, 0x80, 0x89, 0x0, 0x3, 0x8d], 0x100000, 0x100}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRESHEX=r5, @ANYRES32=r0, @ANYRESHEX, @ANYRESOCT, @ANYRESDEC=r0, @ANYRES64=r1, @ANYRESOCT, @ANYRES32=r5], 0x48) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r6, 0x8941, &(0x7f0000000100)=@add_del={0x2, 0x0}) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) 9.189806734s ago: executing program 1 (id=2338): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), 0xffffffffffffffff) syz_emit_vhci(0x0, 0x0) r0 = syz_io_uring_setup(0x10f, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000640)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r6 = syz_open_dev$sndmidi(0x0, 0x2, 0x141002) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES64=r6, @ANYRES8=r0], 0x48) syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000083850000000400000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000018110000", @ANYRES32], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 8.071787711s ago: executing program 2 (id=2342): socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setresuid(0x0, 0xee00, 0x0) r2 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r2, &(0x7f00000001c0)={0x0, 0x2, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="f0000000120003"], 0xf0}}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x800) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) syz_clone3(&(0x7f000000dd80)={0xa00400, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e23, @multicast1}, 0x10) r5 = fcntl$dupfd(r4, 0x406, r4) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfd, 0x8, 0xe4}]}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x400000, 0x26}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x40440c1}, 0x80) sendmmsg$inet(r5, &(0x7f00000000c0), 0x0, 0x4008010) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r5) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r5) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/warn_count', 0x48000, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x4c, 0x10, 0x401, 0xf0bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b, 0x5081}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e21}, @IFLA_GRE_IKEY={0x8, 0x4, 0x8}, @IFLA_GRE_FWMARK={0x8, 0x14, 0xa}]}}}]}, 0x4c}}, 0x20000080) read$watch_queue(r6, &(0x7f00000002c0)=""/37, 0x25) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = fsmount(r3, 0x0, 0x0) fchdir(r8) open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) 7.317070137s ago: executing program 1 (id=2345): openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r0 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x6) ftruncate(r0, 0x2000000) socket$qrtr(0x2a, 0x2, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x25, 0x4}, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000740)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept$alg(r1, 0x0, 0x0) pselect6(0x40, &(0x7f0000000080)={0x0, 0x5, 0x0, 0x7, 0x8, 0x0, 0x0, 0x2b}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x200000004, 0x7}, 0x0, 0x0) recvmmsg(r2, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}], 0x1, 0xcb, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) getrlimit(0x5, &(0x7f0000000180)) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_rdma(0x10, 0x3, 0x14) r4 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback, 0x4}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg$can_bcm(r4, &(0x7f00000016c0)={0x0, 0x0, 0x0}, 0x10002) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x1e, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaffaaaaaaaaaa0e000c000000a005030000519c4a8b734b3983752d263c7aed1de82db76270427f8113e895a34dcb12c566d09a205cf565802b5038797a7bd4b592b67fe8b358dd7edfc533936e36628540cd0c020c81db9066f696bbf89bf73825"], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 6.891313573s ago: executing program 2 (id=2351): ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05640, 0x0) request_key(&(0x7f0000000300)='big_key\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000002a80)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb14x\x0f\xdf\x83\xdd31\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x14\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb]@F\xe3?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18K\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00', 0xffffffffffffffff) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/keys\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000003540)={0x2020}, 0x2020) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xa000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000000c0)="0f01c5b912000000b800000000ba010000000f3066ba610066b8006866ef0f0666ba2000b800800000efc7442400ea000000c7442402e1003b68ff2c2466430fd7fd451441c48255049592f8b04b460f78e4", 0x52}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r5, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r5, 0x114, 0x1, &(0x7f0000000100)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0xb7, 0x0, 0x2004cb, 0x0, 0xffffffffffffffff, 0x1005, 0x7ffd, 0x1000202004, 0x1, 0x80000000, 0x0, 0x4], 0x60000}) r7 = syz_io_uring_setup(0x19f2, &(0x7f0000000300)={0x0, 0x7b2, 0x8001, 0x0, 0x330}, &(0x7f0000000140), &(0x7f0000000100)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='pids.events\x00', 0x275a, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r8, @ANYRES32=r8, @ANYRES8=r2, @ANYRESDEC=r7, @ANYRES64=r9], 0x118) 6.738432878s ago: executing program 6 (id=2352): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x50) close(0x3) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000000)) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r2, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000200)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r4}, &(0x7f0000000180)=0x20000, &(0x7f00000001c0)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r4}, &(0x7f0000000500)=0x2000000, &(0x7f0000000540)=r3}, 0x20) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x15, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000080850000008200000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f00000021c0)={r6, 0x0, 0x0}, 0x10) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000240)="5c00000014006b03c84e21008bf32c19021800f80200000044000200ac14140e05251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b7800000000000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 5.705448137s ago: executing program 7 (id=2353): openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) r0 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x6) ftruncate(r0, 0x2000000) socket$qrtr(0x2a, 0x2, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x25, 0x4}, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000740)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept$alg(r1, 0x0, 0x0) pselect6(0x40, &(0x7f0000000080)={0x0, 0x5, 0x0, 0x7, 0x8, 0x0, 0x0, 0x2b}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x200000004, 0x7}, 0x0, 0x0) recvmmsg(r2, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}], 0x1, 0xcb, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) getrlimit(0x5, &(0x7f0000000180)) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_rdma(0x10, 0x3, 0x14) r4 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback, 0x4}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg$can_bcm(r4, &(0x7f00000016c0)={0x0, 0x0, 0x0}, 0x10002) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x1e, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaffaaaaaaaaaa0e000c000000a005030000519c4a8b734b3983752d263c7aed1de82db76270427f8113e895a34dcb12c566d09a205cf565802b5038797a7bd4b592b67fe8b358dd7edfc533936e36628540cd0c020c81db9066f696bbf89bf73825"], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 5.286485777s ago: executing program 1 (id=2355): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r1 = gettid() socket$igmp(0x2, 0x3, 0x2) socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$caif_seqpacket(0x25, 0x5, 0x0) recvmsg(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) openat$vcsa(0xffffffffffffff9c, 0x0, 0x80900, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0]) mount$tmpfs(0x0, 0x0, &(0x7f00000000c0), 0x800400, &(0x7f0000000300)=ANY=[@ANYBLOB='usrquota,usrquota_block_hardlimit']) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, &(0x7f0000000e40)=[{{&(0x7f0000000200)={0xa, 0x4e23, 0x11, @loopback, 0x7}, 0x1c, &(0x7f0000001b40)=[{&(0x7f0000001200)='\x00', 0x1}], 0x1}}], 0x1, 0x40) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e23, 0x2, @loopback}}}, 0x84) futex_waitv(&(0x7f0000002200)=[{0x87d, &(0x7f0000000200)=0x81, 0x2}, {0x11e, &(0x7f00000002c0)=0x5, 0x82}, {0x21, &(0x7f0000000340)=0x2, 0x2}, {0x5, &(0x7f0000000380)=0x8, 0x2}, {0x7, &(0x7f0000000440)=0x10000}, {0xf, &(0x7f0000000480)=0x3, 0x82}, {0x1, &(0x7f00000004c0)=0x3, 0x2}, {0x3, &(0x7f0000000500)=0x100, 0x82}, {0x80, &(0x7f0000000540)=0x8, 0x2}, {0xbbe0, &(0x7f0000000580)=0x1, 0x82}, {0x1ca5, &(0x7f00000005c0)=0x78, 0x82}, {0xa, &(0x7f0000000640)=0x6, 0x2}, {0x29, &(0x7f0000000680)=0x2, 0x2}, {0xffffffffffffffff, &(0x7f00000006c0)=0x3, 0x82}, {0x6, &(0x7f0000000700)=0xffffffffffffffff, 0x82}, {0x2, &(0x7f0000000740)=0x8a, 0x82}, {0x0, &(0x7f0000000780)=0x5, 0x2}, {0x8, &(0x7f0000000800)=0x8007, 0x2}, {0xffff, &(0x7f0000000840)=0x9, 0x2}, {0x71d, &(0x7f0000000880), 0x2}, {0xfffffffffffffff7, &(0x7f00000008c0)=0xd}, {0x2, &(0x7f0000000900)=0x3, 0x2}, {0x3, &(0x7f0000000940)=0x4, 0x2}, {0xfffffffffffffff8, 0x0, 0x82}, {0xf20c, &(0x7f00000009c0), 0x2}, {0x7, &(0x7f0000000a00)=0xfffffffffffffffb, 0x82}, {0xaf6, &(0x7f0000000a40)=0x2, 0x82}, {0x6, &(0x7f0000000a80)=0x9, 0x2}, {0x100000000, &(0x7f0000000ac0)=0xbcbd, 0x2}, {0x10001, &(0x7f0000000b00)=0x2, 0x82}, {0x4, &(0x7f0000000b40)=0x4, 0x2}, {0x8001, 0x0, 0x2}, {0x7ff, &(0x7f0000000bc0), 0x82}, {0x1ff, &(0x7f0000000c00)=0x8b1, 0x2}, {0x6, &(0x7f0000000c40)=0x5, 0x82}, {0x2ce, 0x0, 0x2}, {0x7fff, &(0x7f0000000cc0)=0x2, 0x2}, {0xfffffffffffffff9, &(0x7f0000000d00)=0x8000000000000000}, {0x400, 0x0, 0x2}, {0x7f, &(0x7f0000000d80)=0x2d84, 0x2}, {0x1, &(0x7f0000000dc0)=0xffffffffffff0000, 0x82}, {0x9, &(0x7f0000000e00)=0xdb6, 0x2}, {0x5, &(0x7f0000000e40)=0x8000000000000001, 0x2}, {0xd3, &(0x7f0000000e80)=0xffffffff, 0x2}, {0xf4c, &(0x7f0000000ec0)=0x401, 0x82}, {0xc, &(0x7f0000000f00)=0x6, 0x2}, {0xbc6c, &(0x7f0000000f40)=0x7c, 0x2}, {0x8, &(0x7f0000000f80)=0x2, 0x82}, {0xfffffffffffffff7, 0x0, 0x82}, {0x5, &(0x7f0000002000)=0x10004, 0x2}, {0x9, &(0x7f00000020c0)=0x100, 0x2}, {0x7, &(0x7f0000002140)=0x1000, 0x82}, {0x1, &(0x7f0000002180)=0x4438d299, 0x82}], 0x35, 0x0, &(0x7f0000002740), 0x1) ioperm(0x0, 0x2, 0x7e) gettid() fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000)={0x1}) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f00000006c0)={0x0, 0x0, 0xac1d}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f00000000c0)={0x0, 0x0, 0x8}) syz_io_uring_setup(0x236, &(0x7f0000000240)={0x0, 0x8101, 0x0, 0xfffffffe, 0x338}, &(0x7f0000000040), &(0x7f0000000600)) 5.084464713s ago: executing program 6 (id=2356): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), 0xffffffffffffffff) syz_emit_vhci(0x0, 0x0) r0 = syz_io_uring_setup(0x10f, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000640)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = syz_open_dev$sndmidi(0x0, 0x2, 0x141002) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES64=r4, @ANYRES8=r0], 0x48) syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000083850000000400000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000018110000", @ANYRES32], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.127420117s ago: executing program 7 (id=2358): r0 = socket(0x10, 0x3, 0x0) connect$llc(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x40081, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) socket$alg(0x26, 0x5, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) userfaultfd(0x801) socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/pm_test', 0x42, 0x18) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa010102}, {0x2, 0x4e23, @private=0xa010102}, {0x2, 0x4e24, @private=0xa010102}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8, 0x10}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r2], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x7ffffffe) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 3.935601367s ago: executing program 6 (id=2359): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'veth1_to_bond\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={r2, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000000000)={0x6, 0xffffffff, 0x1, 0xffffffffffffffff, 0x4}) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) r8 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r8, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) sendmsg$nl_generic(r3, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="b4000000340000012cbd7000fcdbdf2518000000ebe8d19baf05fba7dd36290f73af1af68ed515ac35038c4d168fa40035d7a28476ca978959cc0e7688682724c17877e312c0c116f157a66fd60e73f52068794b1bc9d269243a13732f2882317a50114824f8671507ebcd0743ca01b1b714721af1832d89df00cc891339f8c682c996fb5df93478a7e872c7d08d48d1aa4dae673e7d12b107ba6666eeae5cf64fa232649b0a71c0b1450f67835aa98a864cc400", @ANYRES16=r7, @ANYRESHEX=r6, @ANYRESDEC=r7, @ANYRES64=r8, @ANYRES8=r8], 0xb4}}, 0x24008840) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) sendmsg$NL80211_CMD_VENDOR(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYRES8=r6, @ANYRES16=r0, @ANYBLOB="01020000000000000000e220000008000300", @ANYRES32=r4], 0x30}}, 0x0) 3.639286044s ago: executing program 1 (id=2360): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$vimc0(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x40d, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x5, 0x2}]}}}]}, 0x3c}}, 0x0) ioctl$XFS_IOC_GETBMAPX(0xffffffffffffffff, 0xc0205838, &(0x7f0000000140)={0x5, 0x1, 0x3, 0x1, 0x6a, 0x8, 0x6}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) 3.586815076s ago: executing program 7 (id=2361): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x28002) r2 = dup(r1) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, 0x0) r3 = open(&(0x7f0000000380)='./bus\x00', 0x40, 0x0) creat(&(0x7f0000000440)='./bus\x00', 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)=@newqdisc={0x38, 0x24, 0x400, 0x20000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4}, {0x0, 0xfff3}, {0x0, 0xa}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x31}}]}, 0x38}}, 0x4) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESDEC=0x0], 0x50}}, 0x20008844) r5 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x800001, 0x3fd, 0x4000009, 0x200, 0xe2df, 0x9, 0x1, 0x4, 0x40000, 0x7, 0xf58, 0x6]}) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000140)) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8028640c, &(0x7f0000000540)={0x8000000, 0x0, 0x0, 0x20001, 0x80000000}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000900)={'bridge0\x00', @remote}) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000024000008240000000000000000010000840000a28b1b61b8486214000000000000020000000000f7000000000000000006020000000000"], 0x0, 0x3e}, 0x20) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ_RESET(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="28000000150a010800000000000000000000000208000340000000030900020073797a3200000000f12a2d5d0696259f20d521cd5d8fa681245b157fde2f38afa78ac99263ed18a60e2e8ee2e57773e6960c3d3710589d145f3ed1eb090105b6f728fa4ee86957cf9d97b97dbafec0b7dccfc4cef77562ea8ab8af1a959bbd59dab00f59baa763b247b9dd1da8f0f156e98a9f06e51d85129c933a40399551d0a800f7939d5626"], 0x28}, 0x1, 0x0, 0x0, 0x40090}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYRESHEX=r7], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x404080, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89a1, &(0x7f0000000900)={'bridge0\x00', @broadcast}) 3.585511863s ago: executing program 0 (id=2362): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x0, 0x0) userfaultfd(0x801) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x256ba000) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f00000004c0)=[@in_dx={0x69, 0x20, {0xff4f, 0x1}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @control_area=0xa6, 0x100000001, 0x6, 0x6}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @control_area=0xa4, 0x100000000, 0x5, 0x40}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @ro32=0x4408, 0x7, 0x5, 0x10001}}, @nested_load_syzos={0x136, 0x20, {0x0, 0x7}}, @nested_amd_invlpga={0x17d, 0x20, {0x2000, 0xcfa1}}, @nested_amd_clgi={0x17f, 0x10}, @wr_crn={0x67, 0x20, {0x0, 0x1a59}}, @nested_amd_set_intercept={0x181, 0x30, {0x1, 0x1, 0xb8f, 0x1}}, @nested_amd_stgi={0x17e, 0x10}, @wr_crn={0x67, 0x20, {0x8, 0x3}}, @nested_amd_vmload={0x182, 0x18, 0x3}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @ro32=0x440a, 0x400, 0xb, 0x9}}, @enable_nested={0x12c, 0x18}], 0x200}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRESHEX=r5, @ANYRES32=r0, @ANYRESHEX, @ANYRESOCT, @ANYRESDEC=r0, @ANYRES64=r1, @ANYRESOCT, @ANYRES32=r5], 0x48) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r6, 0x8941, &(0x7f0000000100)=@add_del={0x2, 0x0}) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) 3.305704642s ago: executing program 2 (id=2363): socket$inet_udplite(0x2, 0x2, 0x88) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r4 = syz_io_uring_setup(0x10d, &(0x7f00000000c0)={0x0, 0x8d2dc, 0x0, 0xffffffff, 0xa0}, &(0x7f00000003c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_usb_connect(0x5, 0x36, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1301"], 0x16) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="0408"], 0x7) r7 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r7, &(0x7f0000000a40)={&(0x7f0000000200)={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000300)=""/152, 0x98}, {&(0x7f00000003c0)=""/131, 0x83}], 0x2, &(0x7f0000000800)=[@mask_cswp={0x58, 0x114, 0x9, {{0x3, 0x7f}, &(0x7f0000000280)=0xe, &(0x7f0000000480)=0x10001, 0x0, 0x4, 0x0, 0x0, 0x2, 0xffffffffffff7fff}}, @cswp={0x58, 0x114, 0x7, {{0x37d30c90, 0x9}, &(0x7f0000000600)=0xf, &(0x7f0000000640)=0x4c, 0x7ff, 0x100000000, 0x4, 0x9, 0x15, 0x200}}, @mask_cswp={0x58, 0x114, 0x9, {{0x10000, 0x5}, &(0x7f0000000680)=0x1, &(0x7f00000006c0)=0x101, 0x8d, 0x7, 0x1, 0x71e9, 0x40, 0x8000000000000001}}, @cswp={0x58, 0x114, 0x7, {{0x1, 0x10000}, &(0x7f0000000700)=0x40, &(0x7f0000000740)=0x6, 0x1, 0x52, 0x5, 0x4, 0x14, 0x6}}, @cswp={0x58, 0x114, 0x7, {{0xfcb8, 0x6}, &(0x7f0000000780)=0x7fffffffffffffff, &(0x7f00000007c0)=0x9ec00000, 0x1ff, 0x9, 0x511, 0x7, 0x42, 0x10000}}], 0x1b8, 0x4011}, 0x5010) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_CLOSE={0x13, 0x18, 0x0, r7, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r8}}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x161040, 0x0) r9 = eventfd2(0x4, 0x800) io_setup(0x6, &(0x7f0000000140)=0x0) io_submit(r10, 0x1, &(0x7f0000000180)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0xffed, r9, 0x0, 0x0, 0x0, 0x0, 0x3, r9}]) write(r9, &(0x7f00000001c0)="e1eb8e6a800f0be2", 0x8) r11 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x4400, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r11, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1, {0xb2df}}, './file1\x00'}) io_uring_enter(r4, 0x47f5, 0x20, 0x0, 0x0, 0x0) 2.724445575s ago: executing program 7 (id=2364): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r1 = gettid() socket$igmp(0x2, 0x3, 0x2) socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$caif_seqpacket(0x25, 0x5, 0x0) recvmsg(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) openat$vcsa(0xffffffffffffff9c, 0x0, 0x80900, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0]) mount$tmpfs(0x0, 0x0, &(0x7f00000000c0), 0x800400, &(0x7f0000000300)=ANY=[@ANYBLOB='usrquota,usrquota_block_hardlimit']) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, &(0x7f0000000e40)=[{{&(0x7f0000000200)={0xa, 0x4e23, 0x11, @loopback, 0x7}, 0x1c, &(0x7f0000001b40)=[{&(0x7f0000001200)='\x00', 0x1}], 0x1}}], 0x1, 0x40) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e23, 0x2, @loopback}}}, 0x84) futex_waitv(&(0x7f0000002200), 0x0, 0x0, &(0x7f0000002740), 0x1) ioperm(0x0, 0x2, 0x7e) gettid() fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000)={0x1}) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f00000006c0)={0x0, 0x0, 0xac1d}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f00000000c0)={0x0, 0x0, 0x8}) syz_io_uring_setup(0x236, &(0x7f0000000240)={0x0, 0x8101, 0x0, 0xfffffffe, 0x338}, &(0x7f0000000040), &(0x7f0000000600)) 1.863542561s ago: executing program 0 (id=2365): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x16, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x67}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x30, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_MASK={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x104}}, 0x0) 1.802168129s ago: executing program 1 (id=2366): prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_getparam(0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180), 0x6cc0, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000100)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0}) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) r2 = socket$kcm(0x2d, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000040)={r3}) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000a00)={r3}) 1.685572868s ago: executing program 7 (id=2367): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x148, 0x65, 0x300, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0xd}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0xd8}]}}, @TCA_RATE={0x6, 0x5, {0xb, 0x42}}, @filter_kind_options=@f_basic={{0xa}, {0xfc, 0x2, [@TCA_BASIC_EMATCHES={0x64, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xfff}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xff7f}}, @TCA_EMATCH_TREE_LIST={0x50, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x18, 0x2, 0x0, 0x0, {{0x9e1c, 0x9, 0x7}, [@TCA_EM_IPT_MATCH_NAME={0xb}]}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x2, 0x1, 0xef6}, {0xb25, 0x9, 0xfff8, 0x1, 0x9, 0x2, 0xa74b546439a9262b}}}, @TCF_EM_IPSET={0x10, 0x2, 0x0, 0x0, {{0x6, 0x8, 0xfff9}, {0x2, 0x5}}}, @TCF_EM_IPT={0xc, 0x3, 0x0, 0x0, {{0x4, 0x9, 0x6}}}]}]}, @TCA_BASIC_ACT={0x94, 0x3, [@m_sample={0x5c, 0x17, 0x0, 0x0, {{0xb}, {0x4}, {0x2f, 0x6, "64a8416e1a2ad4f08a507ade2030959fbaf47dae3d8c5509c5f67bbd00abca8965993d237d8db6ee7a95ac"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_connmark={0x34, 0x5, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x6, 0x2}}}}]}]}}]}, 0x148}, 0x1, 0x0, 0x0, 0x40008c5}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000380), 0x33, 0x6143, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, 0x0, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x7, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x58}, 0x1, 0x0, 0x0, 0x44050}, 0x40) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000200), 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{}, &(0x7f0000000100), &(0x7f0000000140)=r2}, 0x20) r3 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) dup3(r3, 0xffffffffffffffff, 0x0) ioctl$MON_IOCG_STATS(r3, 0xc0109207, 0x0) socket$xdp(0x2c, 0x3, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.632535861s ago: executing program 0 (id=2368): pipe2$watch_queue(0x0, 0x80) r0 = mq_open(&(0x7f0000000080)='!selin\xdb\xa1\x02\xbf\xd9l\xd7\xcd\xc0uxse\xee\x0e\xcd\xce6\xbf\xfa;\xb9-a\xb8\xef\x8de\x14\xbc\x9ej\xa1q\xa2\xa5\t\x98\x8a\x8f>\xba', 0x6e93ebbbcc088cf2, 0x0, &(0x7f0000000300)={0x0, 0x1, 0xec}) mq_timedsend(r0, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r0, 0x0, 0x0, 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'macvtap0\x00', 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0xfffffffd, 0x0, 0x0) connect$bt_rfcomm(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, 0x1, 0x4, 0x5, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x3}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x400}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x6}, @NFULA_CFG_CMD={0x5, 0x1, 0x4}]}, 0x34}}, 0x10) syz_emit_ethernet(0x3e, 0x0, 0x0) unshare(0x30050d00) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002000)=""/102400, 0x19000) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}, 0x2, 0x2}}, 0x2e) getsockopt(r4, 0x111, 0x5, 0x0, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x39}}, 0x10) r6 = socket$netlink(0x10, 0x3, 0x9) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="400000001400011504000000000000000a0000000400000014000900ff01000000000000000000000000000114000280"], 0x40}, 0x1, 0x0, 0x0, 0x20000804}, 0x8018) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r1, 0x42}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000200)="27030200000314000e000f3c002400000000ff8400", 0x15}], 0x1}, 0x4005) 1.278622931s ago: executing program 0 (id=2369): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), 0xffffffffffffffff) syz_emit_vhci(0x0, 0x0) r0 = syz_io_uring_setup(0x10f, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000640)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = syz_open_dev$sndmidi(0x0, 0x2, 0x141002) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES64=r4, @ANYRES8=r0], 0x48) syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000083850000000400000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000018110000", @ANYRES32], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.249881319s ago: executing program 1 (id=2370): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0xd4}, [@initr0]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6b00}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) connect$llc(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0xe7e, 0x0) read$msr(r2, &(0x7f0000009b80)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xd0}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x5, 0x0, 0x7, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xf1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x9, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x11, 0x4, 0x4, 0x5, 0x0, 0xffffffffffffffff, 0x9d}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x14, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000300)={0xf, 0x37, 0xb, 0x6, 0x3, 0xc, 0x1, 0xcf, 0x1}) 1.221117697s ago: executing program 7 (id=2371): getsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000000), &(0x7f0000000040)=0x4) get_robust_list(0x0, 0x0, 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x7000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = socket$inet(0x2, 0xa, 0x262) ioctl$sock_inet_SIOCSARP(r3, 0x8955, 0x0) r4 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r4, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x44, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1fffff}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000440)=ANY=[@ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="0500"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r7}, &(0x7f00000006c0), &(0x7f0000000700)=r6}, 0x20) sendmsg$inet(r5, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 1.067625732s ago: executing program 0 (id=2372): r0 = socket(0x10, 0x3, 0x0) connect$llc(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x40081, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) socket$alg(0x26, 0x5, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) userfaultfd(0x801) socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/pm_test', 0x42, 0x18) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa010102}, {0x2, 0x4e23, @private=0xa010102}, {0x2, 0x4e24, @private=0xa010102}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8, 0x10}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r2], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, 0x0, 0x0) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 0s ago: executing program 0 (id=2373): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0xd4}, [@initr0]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6b00}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) connect$llc(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0xe7e, 0x0) read$msr(r2, &(0x7f0000009b80)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xd0}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x5, 0x0, 0x7, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xf1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x9, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x11, 0x4, 0x4, 0x5, 0x0, 0xffffffffffffffff, 0x9d}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x14, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000300)={0xf, 0x37, 0xb, 0x6, 0x3, 0xc, 0x1, 0xcf, 0x1}) kernel console output (not intermixed with test programs): 654.280597][T13159] Bluetooth: hci0: unsupported parameter 27926 [ 654.309924][T13159] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 654.850684][ T30] audit: type=1400 audit(1773671355.145:1480): avc: denied { create } for pid=13167 comm="syz.2.1750" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 655.394055][ T30] audit: type=1400 audit(1773671355.145:1481): avc: denied { ioctl } for pid=13167 comm="syz.2.1750" path="socket:[37442]" dev="sockfs" ino=37442 ioctlcmd=0x4944 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 655.667745][ T30] audit: type=1400 audit(1773671355.325:1482): avc: denied { mounton } for pid=13165 comm="syz.0.1751" path="/354/file0" dev="tmpfs" ino=1900 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 656.538904][ T30] audit: type=1400 audit(1773671356.845:1483): avc: denied { map } for pid=13184 comm="syz.6.1756" path="socket:[37483]" dev="sockfs" ino=37483 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 656.896052][T13196] fuse: Unknown parameter '0x0000000000000004' [ 657.110436][ T792] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 657.187464][T13204] Bluetooth: hci0: unsupported parameter 27926 [ 657.235110][T13204] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 657.313229][ T792] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 657.648461][ T792] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.666380][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1764'. [ 657.680413][ T792] usb 3-1: Product: syz [ 657.686794][ T792] usb 3-1: Manufacturer: syz [ 657.711868][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1764'. [ 657.733293][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1764'. [ 657.734186][ T792] usb 3-1: SerialNumber: syz [ 658.883390][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1764'. [ 658.920395][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1764'. [ 658.922854][ T792] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 658.980525][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1764'. [ 659.050446][ T10] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 659.120403][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1764'. [ 659.129752][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1764'. [ 659.164407][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1764'. [ 659.190520][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1764'. [ 659.280974][ T30] audit: type=1400 audit(1773671359.595:1484): avc: denied { append } for pid=13218 comm="syz.6.1768" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 660.080387][ T10] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 660.087515][ T10] ath9k_htc: Failed to initialize the device [ 660.153399][ T10] usb 3-1: ath9k_htc: USB layer deinitialized [ 660.256914][ T5824] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 660.423897][ T5824] usb 1-1: Using ep0 maxpacket: 32 [ 660.457118][ T5824] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 660.556523][T13235] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 660.575802][T13235] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 660.598824][ T5824] usb 1-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=bf.99 [ 660.617778][ T5824] usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 660.617785][ T30] audit: type=1400 audit(1773671360.855:1485): avc: denied { accept } for pid=13232 comm="syz.6.1771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 660.617825][ T30] audit: type=1400 audit(1773671360.885:1486): avc: denied { listen } for pid=13232 comm="syz.6.1771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 660.636151][ T5824] usb 1-1: Product: syz [ 660.698343][ T30] audit: type=1400 audit(1773671360.885:1487): avc: denied { append } for pid=13232 comm="syz.6.1771" name="001" dev="devtmpfs" ino=745 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 661.099286][ T5824] usb 1-1: SerialNumber: syz [ 661.105715][ T792] usb 3-1: USB disconnect, device number 53 [ 661.203586][ T5824] usb 1-1: config 0 descriptor?? [ 662.787564][ T30] audit: type=1400 audit(1773671362.059:1488): avc: denied { ioctl } for pid=13250 comm="syz.1.1775" path="socket:[37736]" dev="sockfs" ino=37736 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 663.226155][ T792] usb 1-1: USB disconnect, device number 50 [ 663.298941][ T30] audit: type=1400 audit(1773671362.609:1489): avc: denied { ioctl } for pid=13262 comm="syz.0.1778" path="socket:[38029]" dev="sockfs" ino=38029 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 663.341514][ T947] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 663.522045][ T947] usb 3-1: config 0 has an invalid interface number: 11 but max is 0 [ 663.531389][ T947] usb 3-1: config 0 has no interface number 0 [ 663.537457][ T947] usb 3-1: config 0 interface 11 altsetting 245 endpoint 0x7 has an invalid bInterval 129, changing to 11 [ 663.562182][T13271] ref_ctr increment failed for inode: 0x796 offset: 0x5 ref_ctr_offset: 0x1000 of mm: 0xffff888057df8c40 [ 663.577806][ T947] usb 3-1: config 0 interface 11 altsetting 245 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 663.598474][ T947] usb 3-1: config 0 interface 11 has no altsetting 0 [ 663.609998][ T947] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 663.624285][ T947] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 663.641550][ T947] usb 3-1: config 0 descriptor?? [ 663.659429][ T947] keyspan 3-1:0.11: Keyspan 2 port adapter converter detected [ 663.699268][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 81 [ 663.720901][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 82 [ 663.735808][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 1 [ 663.750113][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 2 [ 663.771153][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 85 [ 663.789462][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 5 [ 663.816521][ T947] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 663.833225][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 83 [ 663.835279][T13276] __nla_validate_parse: 41 callbacks suppressed [ 663.835291][T13276] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1780'. [ 663.856777][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 84 [ 663.891858][T13260] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 663.907246][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 3 [ 663.923831][T13260] team0: Port device batadv1 added [ 663.929593][T13278] FAULT_INJECTION: forcing a failure. [ 663.929593][T13278] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 663.951132][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 4 [ 663.953946][T13278] CPU: 0 UID: 0 PID: 13278 Comm: syz.1.1781 Tainted: G L syzkaller #0 PREEMPT(full) [ 663.953970][T13278] Tainted: [L]=SOFTLOCKUP [ 663.953976][T13278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 663.953984][T13278] Call Trace: [ 663.953989][T13278] [ 663.953995][T13278] dump_stack_lvl+0x100/0x190 [ 663.954023][T13278] should_fail_ex.cold+0x5/0xa [ 663.954044][T13278] _copy_from_user+0x2e/0xd0 [ 663.954060][T13278] copy_msghdr_from_user+0x9f/0x4f0 [ 663.954091][T13278] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 663.954125][T13278] ___sys_sendmsg+0x106/0x1e0 [ 663.954149][T13278] ? __pfx____sys_sendmsg+0x10/0x10 [ 663.954198][T13278] __sys_sendmsg+0x170/0x220 [ 663.954217][T13278] ? __pfx___sys_sendmsg+0x10/0x10 [ 663.954249][T13278] do_syscall_64+0x106/0xf80 [ 663.954267][T13278] ? clear_bhb_loop+0x40/0x90 [ 663.954286][T13278] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 663.954301][T13278] RIP: 0033:0x7f5a1499c799 [ 663.954314][T13278] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 663.954328][T13278] RSP: 002b:00007f5a1582d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 663.954343][T13278] RAX: ffffffffffffffda RBX: 00007f5a14c15fa0 RCX: 00007f5a1499c799 [ 663.954353][T13278] RDX: 0000000000040084 RSI: 00002000000002c0 RDI: 0000000000000003 [ 663.954363][T13278] RBP: 00007f5a1582d090 R08: 0000000000000000 R09: 0000000000000000 [ 663.954372][T13278] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 663.954381][T13278] R13: 00007f5a14c16038 R14: 00007f5a14c15fa0 R15: 00007ffdd390dc58 [ 663.954401][T13278] [ 664.037203][T13281] trusted_key: encrypted_key: insufficient parameters specified [ 664.040235][T13260] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13260 comm=syz.2.1777 [ 664.161138][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 86 [ 664.169250][ T947] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 6 [ 664.226065][ T947] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 664.304160][ T947] usb 3-1: USB disconnect, device number 54 [ 664.314767][ T947] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 664.338687][ T947] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 664.352948][ T947] keyspan 3-1:0.11: device disconnected [ 665.628218][T13299] netlink: 48 bytes leftover after parsing attributes in process `syz.6.1787'. [ 665.942485][T13307] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1790'. [ 665.951584][ T30] audit: type=1400 audit(1773671365.249:1490): avc: denied { shutdown } for pid=13301 comm="syz.6.1790" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 666.024401][T13308] trusted_key: encrypted_key: key user:syz not found [ 666.783805][ T30] audit: type=1400 audit(1773671366.099:1491): avc: denied { create } for pid=13312 comm="syz.2.1791" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 666.849235][T13302] "syz.6.1790" (13302) uses obsolete ecb(arc4) skcipher [ 666.861225][T13307] bond0: Unable to set down delay as MII monitoring is disabled [ 666.990548][ T30] audit: type=1400 audit(1773671366.129:1492): avc: denied { ioctl } for pid=13301 comm="syz.6.1790" path="socket:[37796]" dev="sockfs" ino=37796 ioctlcmd=0x5838 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 667.976891][ T792] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 668.106624][T13307] bond0 (unregistering): Released all slaves [ 668.390548][ T792] usb 3-1: Using ep0 maxpacket: 32 [ 668.456994][ T792] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 668.480355][ T792] usb 3-1: config 0 has no interfaces? [ 668.495383][ T792] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 668.525290][ T792] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.540370][ T792] usb 3-1: Product: syz [ 669.641081][ T792] usb 3-1: Manufacturer: syz [ 669.643406][T13326] overlayfs: failed to clone lowerpath [ 669.670393][ T792] usb 3-1: SerialNumber: syz [ 669.685992][ T792] usb 3-1: config 0 descriptor?? [ 669.834802][ T792] usb 3-1: USB disconnect, device number 55 [ 670.294105][ T5820] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 670.306395][ T5820] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 670.320735][ T5820] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 670.331088][ T5820] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 670.390669][ T5820] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 670.430461][ T30] audit: type=1400 audit(1773671369.739:1493): avc: denied { mounton } for pid=13340 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 671.028453][ T30] audit: type=1400 audit(1773671370.339:1494): avc: denied { map } for pid=13352 comm="syz.6.1804" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 671.374402][T13340] chnl_net:caif_netlink_parms(): no params data found [ 671.497099][T13340] bridge0: port 1(bridge_slave_0) entered blocking state [ 671.510386][T13340] bridge0: port 1(bridge_slave_0) entered disabled state [ 671.517634][T13340] bridge_slave_0: entered allmulticast mode [ 671.531100][T13340] bridge_slave_0: entered promiscuous mode [ 671.550209][T13340] bridge0: port 2(bridge_slave_1) entered blocking state [ 671.559452][T13340] bridge0: port 2(bridge_slave_1) entered disabled state [ 671.567307][T13340] bridge_slave_1: entered allmulticast mode [ 671.569332][ T30] audit: type=1400 audit(1773671370.879:1495): avc: denied { create } for pid=13362 comm="syz.2.1805" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 671.575647][T13340] bridge_slave_1: entered promiscuous mode [ 671.661149][ T792] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 671.767954][T13340] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 671.792964][T13340] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 671.845499][ T30] audit: type=1400 audit(1773671370.919:1496): avc: denied { ioctl } for pid=13362 comm="syz.2.1805" path="socket:[38930]" dev="sockfs" ino=38930 ioctlcmd=0x89eb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 671.876930][T13340] team0: Port device team_slave_0 added [ 671.885963][T13340] team0: Port device team_slave_1 added [ 671.938738][ T792] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 671.948076][ T792] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.956180][ T792] usb 2-1: Product: syz [ 671.960780][ T792] usb 2-1: Manufacturer: syz [ 671.965372][ T792] usb 2-1: SerialNumber: syz [ 672.012354][ T792] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 672.042231][T13340] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 672.049172][T13340] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 672.121590][ T9] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 672.138611][T13340] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 672.552498][ T5820] Bluetooth: hci4: command tx timeout [ 672.559271][ T5145] block nbd0: Possible stuck request ffff888027500000: control (read@0,1024B). Runtime 300 seconds [ 672.570325][ T5145] block nbd0: Possible stuck request ffff888027500200: control (read@1024,1024B). Runtime 300 seconds [ 672.582941][ T5145] block nbd0: Possible stuck request ffff888027500400: control (read@2048,1024B). Runtime 300 seconds [ 672.594261][ T5145] block nbd0: Possible stuck request ffff888027500600: control (read@3072,1024B). Runtime 300 seconds [ 672.606791][T13340] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 672.630447][T13340] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 672.699006][T13340] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 672.937602][T13358] random: crng reseeded on system resumption [ 673.000154][T13340] hsr_slave_0: entered promiscuous mode [ 673.027031][ T947] usb 2-1: USB disconnect, device number 51 [ 673.034280][T13340] hsr_slave_1: entered promiscuous mode [ 673.052168][T13340] debugfs: 'hsr0' already exists in 'hsr' [ 673.057913][T13340] Cannot create hsr debugfs directory [ 673.424874][T13340] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 673.463411][T13340] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 673.475678][T13340] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 673.485953][T13340] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 673.605681][ T9] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 673.629463][ T9] ath9k_htc: Failed to initialize the device [ 673.656354][ T30] audit: type=1400 audit(1773671372.969:1497): avc: denied { connect } for pid=13382 comm="syz.0.1810" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 673.748609][ T947] usb 2-1: ath9k_htc: USB layer deinitialized [ 674.180202][T13340] 8021q: adding VLAN 0 to HW filter on device bond0 [ 674.242654][T13340] 8021q: adding VLAN 0 to HW filter on device team0 [ 674.285929][ T9277] bridge0: port 1(bridge_slave_0) entered blocking state [ 674.293031][ T9277] bridge0: port 1(bridge_slave_0) entered forwarding state [ 674.314799][T13403] netlink: 'syz.6.1814': attribute type 9 has an invalid length. [ 674.333359][T13403] netlink: 'syz.6.1814': attribute type 11 has an invalid length. [ 674.354102][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 674.361224][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 674.369385][T13403] netlink: 'syz.6.1814': attribute type 12 has an invalid length. [ 674.382316][T13403] netlink: 210020 bytes leftover after parsing attributes in process `syz.6.1814'. [ 674.405922][T13340] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 674.430820][T13340] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 674.644548][ T5820] Bluetooth: hci4: command tx timeout [ 674.654518][T13421] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1818'. [ 674.697024][ T30] audit: type=1400 audit(1773671373.989:1498): avc: denied { write } for pid=13415 comm="syz.6.1819" dev="sockfs" ino=38580 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 674.820388][ T792] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 675.499160][T13340] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 675.633476][ T792] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 675.649747][T13428] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=13428 comm=syz.1.1822 [ 675.690192][ T792] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.795761][ T792] usb 3-1: Product: syz [ 675.822081][ T792] usb 3-1: Manufacturer: syz [ 675.950313][ T792] usb 3-1: SerialNumber: syz [ 675.976562][ T792] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 676.026654][ T10] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 676.583377][T13419] random: crng reseeded on system resumption [ 676.628756][T13340] veth0_vlan: entered promiscuous mode [ 676.639653][T13340] veth1_vlan: entered promiscuous mode [ 676.715650][ T9] usb 3-1: USB disconnect, device number 56 [ 676.721033][ T5820] Bluetooth: hci4: command tx timeout [ 676.776336][T13340] veth0_macvtap: entered promiscuous mode [ 676.807279][T13340] veth1_macvtap: entered promiscuous mode [ 676.824850][T13340] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 676.836006][T13340] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 676.858498][ T66] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.878084][ T66] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.912855][ T66] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.962584][ T66] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 677.240394][T13431] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 677.269756][ T3490] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 677.288130][ T3490] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 677.305055][ T10] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 677.318309][ T10] ath9k_htc: Failed to initialize the device [ 677.335608][ T9] usb 3-1: ath9k_htc: USB layer deinitialized [ 677.352463][ T93] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 677.381232][ T93] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 677.423791][T13456] netlink: 'syz.2.1829': attribute type 9 has an invalid length. [ 677.446421][T13431] usb 2-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 677.460283][T13431] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.460365][T13456] netlink: 'syz.2.1829': attribute type 11 has an invalid length. [ 677.479333][T13431] usb 2-1: Product: syz [ 677.488920][T13431] usb 2-1: Manufacturer: syz [ 677.491125][T13456] netlink: 'syz.2.1829': attribute type 12 has an invalid length. [ 677.496016][T13431] usb 2-1: SerialNumber: syz [ 677.508473][T13431] usb 2-1: config 0 descriptor?? [ 677.517495][T13431] hub 2-1:0.0: bad descriptor, ignoring hub [ 677.523962][T13456] netlink: 210020 bytes leftover after parsing attributes in process `syz.2.1829'. [ 677.535350][ T30] audit: type=1400 audit(1773671376.849:1499): avc: denied { mounton } for pid=13340 comm="syz-executor" path="/root/syzkaller.8MqUE4/syz-tmp" dev="sda1" ino=2051 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 677.596091][T13431] hub 2-1:0.0: probe with driver hub failed with error -5 [ 677.606094][ T30] audit: type=1400 audit(1773671376.909:1500): avc: denied { mount } for pid=13340 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 677.635803][ T30] audit: type=1400 audit(1773671376.909:1501): avc: denied { mounton } for pid=13340 comm="syz-executor" path="/root/syzkaller.8MqUE4/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 677.663332][ T30] audit: type=1400 audit(1773671376.929:1502): avc: denied { mounton } for pid=13340 comm="syz-executor" path="/root/syzkaller.8MqUE4/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=39436 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 677.692745][T13450] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1826'. [ 677.725421][T13431] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 677.755161][T13431] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 677.774972][ T30] audit: type=1400 audit(1773671376.949:1503): avc: denied { mounton } for pid=13340 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2786 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 677.811435][T13431] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 678.002614][T13431] usb 2-1: media controller created [ 678.156956][T13468] netlink: 'syz.7.1799': attribute type 1 has an invalid length. [ 678.386492][ T5820] Bluetooth: hci0: Malformed HCI Event [ 678.636431][ T30] audit: type=1400 audit(1773671376.949:1504): avc: denied { mount } for pid=13340 comm="syz-executor" name="/" dev="gadgetfs" ino=7143 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 678.650561][T13431] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 678.740314][ T30] audit: type=1400 audit(1773671376.949:1505): avc: denied { mount } for pid=13340 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 678.780690][ T30] audit: type=1400 audit(1773671376.949:1506): avc: denied { mounton } for pid=13340 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 678.810789][ T5820] Bluetooth: hci4: command tx timeout [ 678.909815][ T30] audit: type=1400 audit(1773671377.059:1507): avc: denied { mount } for pid=13460 comm="syz.2.1831" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 678.932612][T13431] DVB: Unable to find symbol dib7000p_attach() [ 678.938759][T13431] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 678.951989][ T30] audit: type=1400 audit(1773671377.329:1508): avc: denied { watch } for pid=13460 comm="syz.2.1831" path="/365/file0" dev="tmpfs" ino=1951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 679.028626][T13481] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1832'. [ 679.088373][T13449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 679.097112][T13449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 679.127589][T13449] dib0700: tx buffer length is larger than 4. Not supported. [ 679.630466][T13431] rc_core: IR keymap rc-dib0700-rc5 not found [ 679.664691][T13431] Registered IR keymap rc-empty [ 679.715333][T13431] dvb-usb: could not initialize remote control. [ 679.801867][T13431] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 679.848434][T13431] usb 2-1: USB disconnect, device number 52 [ 679.916163][T13431] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 679.968403][T13487] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1835'. [ 680.012102][T13487] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1835'. [ 680.310641][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 680.317242][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 680.365743][T13499] netlink: 'syz.0.1841': attribute type 9 has an invalid length. [ 680.380462][ T9] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 680.381431][T13499] netlink: 'syz.0.1841': attribute type 11 has an invalid length. [ 680.396821][T13499] netlink: 'syz.0.1841': attribute type 12 has an invalid length. [ 680.405703][T13499] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.1841'. [ 680.595296][ T9] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 680.606273][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 680.617008][ T9] usb 3-1: Product: syz [ 680.621605][ T9] usb 3-1: Manufacturer: syz [ 680.626553][ T9] usb 3-1: SerialNumber: syz [ 680.668784][ T9] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 680.731451][ T792] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 681.391734][T13520] random: crng reseeded on system resumption [ 681.599086][T13431] usb 3-1: USB disconnect, device number 57 [ 681.761162][ T792] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 681.787194][ T792] ath9k_htc: Failed to initialize the device [ 681.841139][T13527] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1848'. [ 681.896741][T13431] usb 3-1: ath9k_htc: USB layer deinitialized [ 683.018542][T13542] netlink: 'syz.0.1854': attribute type 9 has an invalid length. [ 683.029465][T13542] netlink: 'syz.0.1854': attribute type 11 has an invalid length. [ 683.037670][T13542] netlink: 'syz.0.1854': attribute type 12 has an invalid length. [ 683.045761][T13542] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.1854'. [ 683.338562][T13546] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 684.014069][ T2822] block nbd6: Possible stuck request ffff888027758000: control (read@0,1024B). Runtime 150 seconds [ 684.025072][ T2822] block nbd6: Possible stuck request ffff888027758200: control (read@1024,1024B). Runtime 150 seconds [ 684.036127][ T2822] block nbd6: Possible stuck request ffff888027758400: control (read@2048,1024B). Runtime 150 seconds [ 684.048047][T13555] /dev/nullb0: Can't open blockdev [ 684.053270][ T2822] block nbd6: Possible stuck request ffff888027758600: control (read@3072,1024B). Runtime 150 seconds [ 684.075077][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 684.075090][ T30] audit: type=1400 audit(1773671383.389:1516): avc: denied { execute } for pid=13553 comm="syz.6.1859" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 684.243411][ T30] audit: type=1400 audit(1773671383.509:1517): avc: denied { name_bind } for pid=13553 comm="syz.6.1859" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 684.313158][T13562] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 684.390108][T13561] netlink: 'syz.2.1856': attribute type 10 has an invalid length. [ 684.398650][T13561] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1856'. [ 684.408624][T13561] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 685.806908][T13582] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=13582 comm=syz.0.1865 [ 685.922119][T13584] netlink: 'syz.1.1864': attribute type 10 has an invalid length. [ 685.930780][T13584] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1864'. [ 686.074861][ T30] audit: type=1400 audit(1773671385.339:1518): avc: denied { bind } for pid=13586 comm="syz.0.1866" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 686.281606][T13592] netlink: 'syz.6.1868': attribute type 9 has an invalid length. [ 686.299030][T13592] netlink: 'syz.6.1868': attribute type 11 has an invalid length. [ 686.318618][T13592] netlink: 'syz.6.1868': attribute type 12 has an invalid length. [ 686.343844][T13592] netlink: 210020 bytes leftover after parsing attributes in process `syz.6.1868'. [ 688.315370][ T30] audit: type=1400 audit(1773671387.629:1519): avc: denied { execute } for pid=13608 comm="syz.1.1875" path="/dev/snd/controlC0" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 688.341636][T13617] xt_addrtype: ipv6 does not support BROADCAST matching [ 688.546472][T13620] ipt_REJECT: ECHOREPLY no longer supported. [ 689.341629][T13632] netlink: 'syz.2.1881': attribute type 9 has an invalid length. [ 689.349565][T13632] netlink: 'syz.2.1881': attribute type 11 has an invalid length. [ 689.357707][T13632] netlink: 'syz.2.1881': attribute type 12 has an invalid length. [ 689.429388][T13632] netlink: 210020 bytes leftover after parsing attributes in process `syz.2.1881'. [ 689.626008][T13636] netlink: 'syz.6.1884': attribute type 10 has an invalid length. [ 689.639774][T13636] netlink: 228 bytes leftover after parsing attributes in process `syz.6.1884'. [ 689.840703][ T30] audit: type=1400 audit(1773671389.149:1520): avc: denied { wake_alarm } for pid=13635 comm="syz.6.1884" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 690.933612][T13654] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1887'. [ 691.055032][ T30] audit: type=1400 audit(1773671390.369:1521): avc: denied { ioctl } for pid=13655 comm="syz.2.1888" path="socket:[40656]" dev="sockfs" ino=40656 ioctlcmd=0x8903 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 692.000671][ T30] audit: type=1400 audit(1773671391.309:1522): avc: denied { search } for pid=13660 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 692.096374][T13662] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1889'. [ 692.105739][ T30] audit: type=1400 audit(1773671391.309:1523): avc: denied { search } for pid=13660 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=1837 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 692.280943][ T30] audit: type=1400 audit(1773671391.309:1524): avc: denied { search } for pid=13660 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 692.466478][ T30] audit: type=1400 audit(1773671391.309:1525): avc: denied { search } for pid=13660 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 692.675065][ T30] audit: type=1400 audit(1773671391.319:1526): avc: denied { read open } for pid=13665 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 692.900349][ T30] audit: type=1400 audit(1773671391.319:1527): avc: denied { getattr } for pid=13665 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 692.970304][ T30] audit: type=1400 audit(1773671391.319:1528): avc: denied { getattr } for pid=13665 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=1884 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 693.000382][ T30] audit: type=1400 audit(1773671392.199:1529): avc: denied { read } for pid=13667 comm="sed" name="eth0.dhcp" dev="tmpfs" ino=1884 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 693.916054][T13697] random: crng reseeded on system resumption [ 694.709239][T13711] netlink: 'syz.6.1901': attribute type 10 has an invalid length. [ 694.735053][T13711] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1901'. [ 697.424057][T13754] netlink: 'syz.2.1907': attribute type 13 has an invalid length. [ 697.432036][T13754] netlink: 'syz.2.1907': attribute type 17 has an invalid length. [ 698.453410][T13754] gretap0: refused to change device tx_queue_len [ 698.460615][T13754] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 698.945030][T13777] netlink: 'syz.6.1911': attribute type 10 has an invalid length. [ 698.953013][T13777] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1911'. [ 699.022411][ T947] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 699.681119][ T947] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 699.700324][ T947] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 699.730168][ T947] usb 3-1: Product: syz [ 699.735474][ T947] usb 3-1: Manufacturer: syz [ 699.749552][ T947] usb 3-1: SerialNumber: syz [ 699.772076][ T947] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 699.787175][T13431] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 699.983805][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 699.983821][ T30] audit: type=1400 audit(1773671407.298:1540): avc: denied { connect } for pid=13788 comm="syz.7.1915" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 699.984474][T13789] netlink: 64 bytes leftover after parsing attributes in process `syz.7.1915'. [ 700.090930][ T9] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 700.250369][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 700.287344][ T9] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 700.313252][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 700.439692][ T9] usb 2-1: Product: syz [ 700.456290][T13765] random: crng reseeded on system resumption [ 700.478343][ T9] usb 2-1: Manufacturer: syz [ 700.490362][ T9] usb 2-1: SerialNumber: syz [ 700.522681][ T9] usb 2-1: config 0 descriptor?? [ 700.568839][T13451] usb 3-1: USB disconnect, device number 58 [ 700.798532][ T9] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 700.817473][T13810] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=13810 comm=syz.7.1919 [ 700.885421][T13431] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 700.910497][T13431] ath9k_htc: Failed to initialize the device [ 700.931706][T13451] usb 3-1: ath9k_htc: USB layer deinitialized [ 702.729069][T13843] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1928'. [ 702.763586][T13843] bond1: Unable to set down delay as MII monitoring is disabled [ 702.795440][T13849] "syz.7.1928" (13849) uses obsolete ecb(arc4) skcipher [ 702.813303][T13843] bond1 (unregistering): Released all slaves [ 703.204132][ T5145] block nbd0: Possible stuck request ffff888027500000: control (read@0,1024B). Runtime 330 seconds [ 703.215261][ T5145] block nbd0: Possible stuck request ffff888027500200: control (read@1024,1024B). Runtime 330 seconds [ 703.226367][ T5145] block nbd0: Possible stuck request ffff888027500400: control (read@2048,1024B). Runtime 330 seconds [ 703.237390][ T5145] block nbd0: Possible stuck request ffff888027500600: control (read@3072,1024B). Runtime 330 seconds [ 703.273871][ T5820] Bluetooth: hci5: unexpected cc 0x0c7a length: 5 > 1 [ 703.283544][ T5820] Bluetooth: hci5: unexpected event for opcode 0x0c7a [ 703.342488][ T5820] Bluetooth: hci5: ACL packet for unknown connection handle 201 [ 703.352625][ T30] audit: type=1400 audit(1773671410.668:1541): avc: denied { create } for pid=13862 comm="syz.6.1931" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 703.557929][T13872] FAULT_INJECTION: forcing a failure. [ 703.557929][T13872] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 703.571442][T13872] CPU: 0 UID: 0 PID: 13872 Comm: syz.6.1934 Tainted: G L syzkaller #0 PREEMPT(full) [ 703.571470][T13872] Tainted: [L]=SOFTLOCKUP [ 703.571477][T13872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 703.571486][T13872] Call Trace: [ 703.571492][T13872] [ 703.571499][T13872] dump_stack_lvl+0x100/0x190 [ 703.571534][T13872] should_fail_ex.cold+0x5/0xa [ 703.571557][T13872] _copy_from_user+0x2e/0xd0 [ 703.571575][T13872] bpf_test_init.isra.0+0xaf/0x100 [ 703.571601][T13872] bpf_prog_test_run_xdp+0x57e/0x1670 [ 703.571632][T13872] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 703.571662][T13872] ? fput+0x79/0x100 [ 703.571683][T13872] ? __bpf_prog_get+0x97/0x2a0 [ 703.571707][T13872] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 703.571731][T13872] __sys_bpf+0x1725/0x4b90 [ 703.571753][T13872] ? __pfx___sys_bpf+0x10/0x10 [ 703.571769][T13872] ? proc_fail_nth_write+0x9f/0x220 [ 703.571794][T13872] ? find_held_lock+0x2b/0x80 [ 703.571821][T13872] ? find_held_lock+0x2b/0x80 [ 703.571841][T13872] ? ksys_write+0x190/0x250 [ 703.571872][T13872] ? __mutex_unlock_slowpath+0x15c/0x790 [ 703.571895][T13872] ? __fget_files+0x215/0x3d0 [ 703.571925][T13872] ? fput+0x79/0x100 [ 703.571944][T13872] ? ksys_write+0x1ac/0x250 [ 703.571969][T13872] ? __pfx_ksys_write+0x10/0x10 [ 703.572000][T13872] __x64_sys_bpf+0x7b/0xc0 [ 703.572018][T13872] ? lockdep_hardirqs_on+0x78/0x100 [ 703.572045][T13872] do_syscall_64+0x106/0xf80 [ 703.572066][T13872] ? clear_bhb_loop+0x40/0x90 [ 703.572088][T13872] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.572106][T13872] RIP: 0033:0x7fe6f7f9c799 [ 703.572121][T13872] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 703.572137][T13872] RSP: 002b:00007fe6f8ecc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 703.572154][T13872] RAX: ffffffffffffffda RBX: 00007fe6f8215fa0 RCX: 00007fe6f7f9c799 [ 703.572165][T13872] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 703.572175][T13872] RBP: 00007fe6f8ecc090 R08: 0000000000000000 R09: 0000000000000000 [ 703.572185][T13872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 703.572194][T13872] R13: 00007fe6f8216038 R14: 00007fe6f8215fa0 R15: 00007ffe53a44228 [ 703.572217][T13872] [ 703.906992][ T30] audit: type=1400 audit(1773671411.218:1542): avc: denied { read } for pid=13875 comm="syz.2.1936" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 703.932627][ T9] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 703.947570][ T9] usb 2-1: USB disconnect, device number 53 [ 704.041655][T13881] netlink: 'syz.7.1938': attribute type 10 has an invalid length. [ 704.049502][T13881] netlink: 40 bytes leftover after parsing attributes in process `syz.7.1938'. [ 704.066342][ T30] audit: type=1400 audit(1773671411.268:1543): avc: denied { open } for pid=13875 comm="syz.2.1936" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 704.094003][T13879] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1936'. [ 704.286002][T13887] IPVS: set_ctl: invalid protocol: 1 172.30.1.7:20000 [ 704.423961][T13892] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1937'. [ 704.589431][T13881] bridge0: port 3(dummy0) entered blocking state [ 704.589474][T13881] bridge0: port 3(dummy0) entered disabled state [ 704.589589][T13881] dummy0: entered allmulticast mode [ 704.639957][T13881] dummy0: entered promiscuous mode [ 704.640289][T13881] bridge0: port 3(dummy0) entered blocking state [ 704.640409][T13881] bridge0: port 3(dummy0) entered forwarding state [ 704.640696][ T30] audit: type=1400 audit(1773671411.408:1544): avc: denied { create } for pid=13875 comm="syz.2.1936" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 704.640732][ T30] audit: type=1400 audit(1773671411.408:1545): avc: denied { ioctl } for pid=13875 comm="syz.2.1936" path="socket:[40949]" dev="sockfs" ino=40949 ioctlcmd=0xaee2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 704.785346][T13898] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1941'. [ 704.806994][T13898] bond3: Unable to set down delay as MII monitoring is disabled [ 704.835179][T13898] bond3 (unregistering): Released all slaves [ 704.841546][T13901] "syz.0.1941" (13901) uses obsolete ecb(arc4) skcipher [ 704.860341][T13451] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 705.057798][T13451] usb 2-1: Using ep0 maxpacket: 16 [ 705.059442][T13451] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 705.059467][T13451] usb 2-1: config 0 has no interface number 0 [ 705.059500][T13451] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 705.059525][T13451] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 705.062098][T13451] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 705.062125][T13451] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 705.062146][T13451] usb 2-1: Product: syz [ 705.062160][T13451] usb 2-1: SerialNumber: syz [ 705.064482][T13451] usb 2-1: config 0 descriptor?? [ 705.067493][T13451] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 705.069083][T13451] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input80 [ 705.270524][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 705.270697][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 705.270816][T13451] usb 2-1: USB disconnect, device number 54 [ 705.270860][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 705.270870][ C0] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 705.300029][T13451] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 705.699883][T13921] IPVS: sync thread started: state = BACKUP, mcast_ifn = hsr0, syncid = 4, id = 0 [ 705.780173][ T30] audit: type=1400 audit(1773671412.998:1546): avc: denied { write } for pid=13913 comm="syz.7.1947" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 708.062863][T13944] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=13944 comm=syz.1.1954 [ 708.440337][T13431] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 708.730930][T13431] usb 3-1: Using ep0 maxpacket: 16 [ 708.845246][T13431] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 708.867332][T13431] usb 3-1: config 0 has no interface number 0 [ 708.888046][T13431] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 708.929153][T13431] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 708.959499][T13431] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 708.989062][ T30] audit: type=1400 audit(1773671416.298:1547): avc: denied { write } for pid=13978 comm="syz.6.1965" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 709.043243][T13431] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 709.079104][T13431] usb 3-1: Product: syz [ 709.096176][T13431] usb 3-1: SerialNumber: syz [ 709.122160][T13431] usb 3-1: config 0 descriptor?? [ 709.139797][T13431] cm109 3-1:0.8: invalid payload size 0, expected 4 [ 709.179131][T13431] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input81 [ 709.353603][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 709.360749][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 709.360940][T13451] usb 3-1: USB disconnect, device number 59 [ 709.367691][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 709.427036][T13451] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 710.075743][T14000] hpfs: Bad magic ... probably not HPFS [ 710.358597][ T30] audit: type=1400 audit(1773671417.668:1548): avc: denied { getopt } for pid=14007 comm="syz.2.1973" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 710.650428][T14014] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1975'. [ 711.147447][T14015] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1974'. [ 711.174792][T14015] bridge0: port 3(dummy0) entered disabled state [ 711.181261][T14015] bridge0: port 2(bridge_slave_1) entered disabled state [ 711.188371][T14015] bridge0: port 1(bridge_slave_0) entered disabled state [ 711.197841][T14015] bridge0: entered allmulticast mode [ 712.517597][T14034] netlink: 'syz.0.1981': attribute type 9 has an invalid length. [ 712.525425][T14034] netlink: 'syz.0.1981': attribute type 11 has an invalid length. [ 712.561688][T14034] netlink: 'syz.0.1981': attribute type 12 has an invalid length. [ 712.604093][T14034] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.1981'. [ 712.809578][ T30] audit: type=1400 audit(1773671420.118:1549): avc: denied { write } for pid=14046 comm="syz.0.1986" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 712.835653][T14047] overlayfs: failed to resolve '/8 *iFON~y+': -2 [ 712.871824][ T30] audit: type=1400 audit(1773671420.148:1550): avc: denied { mount } for pid=14046 comm="syz.0.1986" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 712.901059][ T24] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 713.290352][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 713.296737][ T24] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 713.304929][ T24] usb 2-1: config 0 has no interface number 0 [ 713.316934][ T24] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 713.364481][ T24] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 713.410430][ T24] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 713.419713][ T24] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 713.455412][ T24] usb 2-1: Product: syz [ 713.474309][ T24] usb 2-1: SerialNumber: syz [ 713.510035][ T24] usb 2-1: config 0 descriptor?? [ 713.527529][ T24] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 713.553028][ T24] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input82 [ 713.750747][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 713.751100][T13451] usb 2-1: USB disconnect, device number 55 [ 713.757708][ C1] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 713.895874][T13451] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 714.440992][ T2822] block nbd6: Possible stuck request ffff888027758000: control (read@0,1024B). Runtime 180 seconds [ 714.451791][ T2822] block nbd6: Possible stuck request ffff888027758200: control (read@1024,1024B). Runtime 180 seconds [ 714.464398][ T2822] block nbd6: Possible stuck request ffff888027758400: control (read@2048,1024B). Runtime 180 seconds [ 714.475495][ T2822] block nbd6: Possible stuck request ffff888027758600: control (read@3072,1024B). Runtime 180 seconds [ 714.514287][T14069] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1993'. [ 714.543584][T14069] bond1: Unable to set down delay as MII monitoring is disabled [ 714.553661][T14069] bond1 (unregistering): Released all slaves [ 714.879468][T14074] netlink: 'syz.0.1994': attribute type 9 has an invalid length. [ 714.887443][T14074] netlink: 'syz.0.1994': attribute type 11 has an invalid length. [ 714.896494][T14074] netlink: 'syz.0.1994': attribute type 12 has an invalid length. [ 714.934931][T14074] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.1994'. [ 714.960695][T14079] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1996'. [ 716.160487][T13451] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 716.249874][T14080] bond1: Unable to set down delay as MII monitoring is disabled [ 716.321189][T13451] usb 2-1: Using ep0 maxpacket: 32 [ 716.330887][T13451] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 716.342909][T14080] bond1 (unregistering): Released all slaves [ 716.383274][T13451] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 716.512951][T14105] hpfs: Bad magic ... probably not HPFS [ 716.596370][T13451] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 716.614405][T13451] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 716.761667][T13451] usb 2-1: config 0 interface 0 has no altsetting 0 [ 717.094616][T13451] usb 2-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 717.120401][T13451] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.168880][T13451] usb 2-1: config 0 descriptor?? [ 717.607756][T13451] hid-thrustmaster 0003:044F:B65D.000C: item fetching failed at offset 3/5 [ 717.639495][T13451] hid-thrustmaster 0003:044F:B65D.000C: parse failed with error -22 [ 717.772553][T13451] hid-thrustmaster 0003:044F:B65D.000C: probe with driver hid-thrustmaster failed with error -22 [ 718.246262][ T12] Bluetooth: hci6: received HCILL_GO_TO_SLEEP_ACK in state 1 [ 718.270604][ T12] Bluetooth: hci6: Frame reassembly failed (-84) [ 718.835770][ T24] usb 2-1: USB disconnect, device number 56 [ 720.044009][T14136] netlink: 'syz.0.2014': attribute type 9 has an invalid length. [ 720.051777][T14136] netlink: 'syz.0.2014': attribute type 11 has an invalid length. [ 720.059550][T14136] netlink: 'syz.0.2014': attribute type 12 has an invalid length. [ 720.067824][T14136] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.2014'. [ 720.077138][T14136] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2014'. [ 720.240417][ T5820] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 720.324075][T14141] hpfs: Bad magic ... probably not HPFS [ 720.776587][T14153] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 720.996377][T14158] overlayfs: failed to clone upperpath [ 721.074227][T14160] futex_wake_op: syz.6.2020 tries to shift op by -1; fix this program [ 721.287460][T14163] overlayfs: failed to resolve './file0': -40 [ 721.557943][T14167] netlink: 100 bytes leftover after parsing attributes in process `syz.7.2013'. [ 722.469076][T14191] hpfs: Bad magic ... probably not HPFS [ 723.160433][ T24] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 723.300550][ T24] usb 2-1: device descriptor read/64, error -71 [ 723.617941][ T24] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 723.830330][ T24] usb 2-1: device descriptor read/64, error -71 [ 723.848059][T14205] overlayfs: conflicting lowerdir path [ 723.940583][ T24] usb usb2-port1: attempt power cycle [ 724.760635][ T24] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 724.790899][ T24] usb 2-1: device descriptor read/8, error -71 [ 724.861532][ T30] audit: type=1400 audit(1773671432.178:1551): avc: denied { accept } for pid=14233 comm="syz.2.2043" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 724.884514][ T30] audit: type=1400 audit(1773671432.198:1552): avc: denied { write } for pid=14233 comm="syz.2.2043" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 724.970977][T14235] dvmrp9: entered allmulticast mode [ 724.981894][ T30] audit: type=1400 audit(1773671432.288:1553): avc: denied { read } for pid=14233 comm="syz.2.2043" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 725.100323][ T24] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 725.120947][ T24] usb 2-1: device descriptor read/8, error -71 [ 725.590309][ T30] audit: type=1400 audit(1773671432.868:1554): avc: denied { ioctl } for pid=14230 comm="syz.7.2042" path="socket:[43077]" dev="sockfs" ino=43077 ioctlcmd=0x7436 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 725.596453][ T24] usb usb2-port1: unable to enumerate USB device [ 729.508076][T14292] overlayfs: failed to clone upperpath [ 730.377595][T14311] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=14311 comm=syz.1.2067 [ 732.301412][T14326] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=14326 comm=syz.0.2073 [ 732.376351][T14332] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=14332 comm=syz.0.2076 [ 732.530313][T13431] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 733.624982][ T5145] block nbd0: Possible stuck request ffff888027500000: control (read@0,1024B). Runtime 360 seconds [ 733.644560][ T5145] block nbd0: Possible stuck request ffff888027500200: control (read@1024,1024B). Runtime 360 seconds [ 733.656170][ T5145] block nbd0: Possible stuck request ffff888027500400: control (read@2048,1024B). Runtime 360 seconds [ 733.667382][ T5145] block nbd0: Possible stuck request ffff888027500600: control (read@3072,1024B). Runtime 360 seconds [ 733.729980][T13431] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 733.746589][T13431] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 733.766787][T13431] usb 2-1: Product: syz [ 733.771021][T13431] usb 2-1: Manufacturer: syz [ 733.775610][T13431] usb 2-1: SerialNumber: syz [ 733.795460][T13431] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 733.826575][ T24] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 734.380228][T14329] random: crng reseeded on system resumption [ 734.463870][ T9] usb 2-1: USB disconnect, device number 61 [ 734.880519][ T24] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 735.140459][ T24] ath9k_htc: Failed to initialize the device [ 735.246901][ T9] usb 2-1: ath9k_htc: USB layer deinitialized [ 737.167008][T14392] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 737.174222][T14392] IPv6: NLM_F_CREATE should be set when creating new route [ 737.181450][T14392] IPv6: NLM_F_CREATE should be set when creating new route [ 737.237241][T14370] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=14370 comm=syz.7.2085 [ 737.944406][T14392] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2093'. [ 738.350572][T13431] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 739.542919][T13431] usb 3-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 739.554856][T13431] usb 3-1: config 36 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 739.565925][T13431] usb 3-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 739.579912][T13431] usb 3-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=26.29 [ 739.800294][T13431] usb 3-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 739.838946][T13431] usb 3-1: Manufacturer: syz [ 739.843754][T13431] usb 3-1: SerialNumber: syz [ 739.853626][T14400] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 740.991847][T14400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 741.398071][T14400] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 741.584334][T13431] yealink 3-1:36.0: invalid payload size 1024, expected 16 [ 741.594927][ T30] audit: type=1400 audit(1773671448.768:1555): avc: denied { map } for pid=14431 comm="syz.0.2104" path="socket:[43563]" dev="sockfs" ino=43563 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 741.622142][T13431] input: Yealink usb-p1k as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:36.0/input/input83 [ 741.659228][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.666189][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.673988][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.681752][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.688682][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.695634][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.702571][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.709493][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.716445][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.723198][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.729092][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.736272][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.743033][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.748931][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.755859][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.762613][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.768505][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.780054][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.786825][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.793047][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.799983][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.806765][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.812674][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.819595][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.826349][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.832370][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.840369][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.847109][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.853024][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.859907][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.866638][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.872496][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.879557][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.880814][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 741.886294][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.886552][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.893151][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 741.900291][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.917913][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.925924][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.933033][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.939782][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.945755][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.952731][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.959465][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.965309][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.972238][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.978986][ C1] yealink 3-1:36.0: unexpected response 0 [ 741.985088][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 741.991981][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 741.998733][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.004575][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.011468][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.018227][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.024085][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.030972][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.037706][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.043742][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.050631][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.057363][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.063202][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.070090][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.076821][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.083019][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.089906][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.096637][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.102511][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.109407][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.116146][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.121992][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.128892][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.135624][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.141473][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.148561][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.155325][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.161180][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.168075][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.174816][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.180715][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.188132][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.194890][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.200761][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.207699][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.214457][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.220372][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.227314][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.234070][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.240002][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.247039][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.253777][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.260910][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.267832][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.274587][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.280464][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.288179][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.294934][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.300789][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.307688][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.314438][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.320459][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.327369][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.334111][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.339955][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.346858][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.353602][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.359798][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.366793][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.373527][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.379378][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.386273][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.393008][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.400676][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.407648][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.414380][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.420239][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.427144][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.433874][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.439726][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.446626][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.453363][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.460371][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.467258][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.473995][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.479853][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.486914][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.493647][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.500581][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.507533][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.514263][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.520114][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.527005][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.533736][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.539583][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.546507][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.553257][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.560410][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.567299][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.574039][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.579884][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.586775][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.593505][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.600576][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.607537][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.614282][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.620139][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.627041][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.633773][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.639625][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.646523][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.653251][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.660420][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.667307][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.674045][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.679896][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.686798][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.693529][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.700558][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.707519][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.714250][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.720101][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.727009][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.733740][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.739597][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.746495][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.753226][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.759070][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.770428][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.777168][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.783098][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.789986][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.796735][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.810728][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.817765][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.824505][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.830391][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.837284][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.844015][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.849873][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.856776][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.863521][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.870506][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.877399][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.884129][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.890018][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.896923][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.903657][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.910602][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.917587][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.924316][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.930165][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.937075][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.943806][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.949670][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.956563][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.963292][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.970511][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.977422][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 742.984152][ C1] yealink 3-1:36.0: unexpected response 0 [ 742.990009][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 742.996904][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.003648][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.010568][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.017548][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.024280][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.030130][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.037018][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.043749][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.049764][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.056666][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.063400][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.070420][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.077311][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.084040][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.089882][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.096776][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.103505][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.110572][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.117529][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.124260][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.130128][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.137033][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.143781][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.149695][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.156631][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.163399][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.169274][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.176264][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.183002][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.188861][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.195763][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.202512][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.208595][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.215499][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.222248][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.228143][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.235039][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.241772][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.247636][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.254554][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.261287][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.267140][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.274224][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.280976][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.286892][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.293776][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.300517][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.306353][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.313495][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.320238][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.326098][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.332979][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.339719][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.345558][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.352447][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.359178][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.365018][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.371913][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.378662][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.384701][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.391624][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.398387][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.404302][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.411447][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.418206][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.424400][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.431323][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.438057][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.443992][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.450973][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.457732][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.463604][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.470536][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.477278][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.483512][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.490435][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.497196][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.503064][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.510016][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.516804][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.530837][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.538136][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.544893][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.552770][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.559730][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.566479][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.572357][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.579422][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.586179][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.592064][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.598982][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.605747][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.611646][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.619168][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.625931][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.631837][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.638811][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.645569][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.651460][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.658427][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.665190][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.671091][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.678023][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.684784][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.690778][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.697747][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.704508][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.710397][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.717348][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.724115][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.730942][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.738270][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.745025][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.751923][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.758884][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.765652][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.771626][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.778571][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.785328][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.791381][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.798335][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.805082][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.811016][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.817980][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.825805][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.833115][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.840309][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.847083][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.853763][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.861145][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.867881][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.880367][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.887928][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.894681][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.901978][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.908889][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.915629][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.921545][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.928962][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.935702][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.941569][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.948488][ C1] yealink 3-1:36.0: urb_irq_callback - urb status -71 [ 743.955235][ C1] yealink 3-1:36.0: unexpected response 0 [ 743.961001][T13431] usb 3-1: USB disconnect, device number 60 [ 743.966907][ C1] yealink 3-1:36.0: urb_ctl_callback - urb status -71 [ 743.966918][ C1] yealink 3-1:36.0: urb_ctl_callback - usb_submit_urb failed -19 [ 744.137656][T14446] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2109'. [ 745.000826][ T2822] block nbd6: Possible stuck request ffff888027758000: control (read@0,1024B). Runtime 210 seconds [ 745.011900][ T2822] block nbd6: Possible stuck request ffff888027758200: control (read@1024,1024B). Runtime 210 seconds [ 745.023520][ T2822] block nbd6: Possible stuck request ffff888027758400: control (read@2048,1024B). Runtime 210 seconds [ 745.034657][ T2822] block nbd6: Possible stuck request ffff888027758600: control (read@3072,1024B). Runtime 210 seconds [ 745.230411][T14457] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=14457 comm=syz.2.2112 [ 746.451253][ T30] audit: type=1400 audit(1773671453.768:1556): avc: denied { map } for pid=14469 comm="syz.2.2119" path="/dev/zero" dev="devtmpfs" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 746.511929][T13431] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 746.524974][ T30] audit: type=1400 audit(1773671453.768:1557): avc: denied { execute } for pid=14469 comm="syz.2.2119" path="/dev/zero" dev="devtmpfs" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 747.220405][T13431] usb 2-1: Using ep0 maxpacket: 16 [ 747.235258][T13431] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 747.244792][T13431] usb 2-1: config 0 has no interface number 0 [ 747.252783][T13431] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 747.274661][T13431] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 747.330603][T13431] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 747.400476][T13431] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 747.409590][T13431] usb 2-1: Product: syz [ 747.416380][T13431] usb 2-1: SerialNumber: syz [ 747.550855][T13431] usb 2-1: config 0 descriptor?? [ 747.558986][T13431] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 747.584362][T13431] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input84 [ 747.656376][T14487] netlink: 'syz.0.2121': attribute type 1 has an invalid length. [ 747.664415][T14487] netlink: 'syz.0.2121': attribute type 2 has an invalid length. [ 747.879939][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 747.887244][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 747.894319][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 747.901396][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 747.908469][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 747.915537][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 747.922453][ C1] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 747.931429][T13431] usb 2-1: USB disconnect, device number 62 [ 747.956886][T13431] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 748.277945][T14506] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2127'. [ 748.343491][T14507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2128'. [ 748.382395][T14509] "syz.6.2127" (14509) uses obsolete ecb(arc4) skcipher [ 748.419235][T14510] "syz.0.2128" (14510) uses obsolete ecb(arc4) skcipher [ 748.455568][T14506] bond0: Unable to set down delay as MII monitoring is disabled [ 748.469747][T14506] bond0 (unregistering): Released all slaves [ 748.599602][T14507] bond3: Unable to set down delay as MII monitoring is disabled [ 748.620733][T14507] bond3 (unregistering): Released all slaves [ 750.661891][T14534] IPVS: stopping backup sync thread 13921 ... [ 752.162445][T14550] comedi comedi3: comedi_config --init_data is deprecated [ 752.680607][ T792] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 753.456981][ T792] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 753.487331][ T792] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 753.526989][ T792] usb 2-1: Product: syz [ 753.549222][ T792] usb 2-1: Manufacturer: syz [ 753.559110][ T792] usb 2-1: SerialNumber: syz [ 753.574053][ T792] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 753.590930][T13451] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 754.014692][T14573] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2146'. [ 754.136421][T14555] random: crng reseeded on system resumption [ 754.182373][T14576] bond1: Unable to set down delay as MII monitoring is disabled [ 754.289217][ T10] usb 2-1: USB disconnect, device number 63 [ 754.301053][T14573] "syz.7.2146" (14573) uses obsolete ecb(arc4) skcipher [ 754.339064][T14576] bond1 (unregistering): Released all slaves [ 754.818987][T13451] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 754.856309][T13451] ath9k_htc: Failed to initialize the device [ 754.910651][ T10] usb 2-1: ath9k_htc: USB layer deinitialized [ 755.038271][T14582] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 755.205786][T14587] bond0: entered promiscuous mode [ 755.210871][T14587] bond_slave_0: entered promiscuous mode [ 755.216566][T14587] bond_slave_1: entered promiscuous mode [ 755.223032][T14587] batadv0: entered promiscuous mode [ 755.228681][T14587] debugfs: 'hsr1' already exists in 'hsr' [ 755.234405][T14587] Cannot create hsr debugfs directory [ 755.239981][T14587] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 755.937692][T14600] FAULT_INJECTION: forcing a failure. [ 755.937692][T14600] name failslab, interval 1, probability 0, space 0, times 0 [ 756.036533][T14600] CPU: 0 UID: 0 PID: 14600 Comm: syz.6.2137 Tainted: G L syzkaller #0 PREEMPT(full) [ 756.036554][T14600] Tainted: [L]=SOFTLOCKUP [ 756.036558][T14600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 756.036565][T14600] Call Trace: [ 756.036569][T14600] [ 756.036574][T14600] dump_stack_lvl+0x100/0x190 [ 756.036597][T14600] should_fail_ex.cold+0x5/0xa [ 756.036612][T14600] should_failslab+0xc2/0x120 [ 756.036624][T14600] __kmalloc_cache_node_noprof+0x7d/0x770 [ 756.036641][T14600] ? __get_vm_area_node+0x101/0x330 [ 756.036653][T14600] ? __pfx_css_rstat_updated+0x10/0x10 [ 756.036673][T14600] __get_vm_area_node+0x101/0x330 [ 756.036687][T14600] __vmalloc_node_range_noprof+0x213/0x1530 [ 756.036700][T14600] ? kernel_clone+0xfc/0x9a0 [ 756.036715][T14600] ? find_held_lock+0x2b/0x80 [ 756.036729][T14600] ? local_lock_release+0x99/0x130 [ 756.036741][T14600] ? local_lock_release+0x99/0x130 [ 756.036755][T14600] ? kernel_clone+0xfc/0x9a0 [ 756.036774][T14600] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 756.036788][T14600] ? __memcg_slab_post_alloc_hook+0x51b/0x990 [ 756.036802][T14600] ? rcu_is_watching+0x12/0xc0 [ 756.036815][T14600] ? trace_kmem_cache_alloc+0xf3/0x120 [ 756.036828][T14600] ? kernel_clone+0xfc/0x9a0 [ 756.036842][T14600] __vmalloc_node_noprof+0xad/0xf0 [ 756.036855][T14600] ? kernel_clone+0xfc/0x9a0 [ 756.036871][T14600] copy_process+0x5ec/0x7a40 [ 756.036886][T14600] ? __pfx__kstrtoull+0x10/0x10 [ 756.036906][T14600] ? __pfx_copy_process+0x10/0x10 [ 756.036925][T14600] ? _copy_from_user+0x59/0xd0 [ 756.036937][T14600] kernel_clone+0xfc/0x9a0 [ 756.036955][T14600] ? get_pid_task+0xfc/0x250 [ 756.036973][T14600] ? __pfx_kernel_clone+0x10/0x10 [ 756.036991][T14600] ? find_held_lock+0x2b/0x80 [ 756.037009][T14600] __do_sys_clone3+0x214/0x290 [ 756.037024][T14600] ? __pfx___do_sys_clone3+0x10/0x10 [ 756.037047][T14600] ? __fget_files+0x21f/0x3d0 [ 756.037069][T14600] do_syscall_64+0x106/0xf80 [ 756.037083][T14600] ? clear_bhb_loop+0x40/0x90 [ 756.037097][T14600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.037109][T14600] RIP: 0033:0x7fe6f7f9c799 [ 756.037119][T14600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 756.037130][T14600] RSP: 002b:00007fe6f8ecbef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 756.037141][T14600] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fe6f7f9c799 [ 756.037148][T14600] RDX: 00007fe6f8ecbf10 RSI: 0000000000000058 RDI: 00007fe6f8ecbf10 [ 756.037155][T14600] RBP: 00007fe6f8ecc090 R08: 0000000000000000 R09: 0000000000000058 [ 756.037161][T14600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 756.037170][T14600] R13: 00007fe6f8216038 R14: 00007fe6f8215fa0 R15: 00007ffe53a44228 [ 756.037184][T14600] [ 756.038179][T14600] syz.6.2137: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 756.542925][T14600] CPU: 0 UID: 0 PID: 14600 Comm: syz.6.2137 Tainted: G L syzkaller #0 PREEMPT(full) [ 756.542953][T14600] Tainted: [L]=SOFTLOCKUP [ 756.542959][T14600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 756.542968][T14600] Call Trace: [ 756.542974][T14600] [ 756.542979][T14600] dump_stack_lvl+0x100/0x190 [ 756.543001][T14600] warn_alloc.cold+0x95/0x1c1 [ 756.543020][T14600] ? __pfx_warn_alloc+0x10/0x10 [ 756.543034][T14600] ? trace_kmalloc+0x101/0x130 [ 756.543046][T14600] ? __kmalloc_cache_node_noprof+0x2d9/0x770 [ 756.543065][T14600] ? __kasan_kmalloc+0x8a/0xb0 [ 756.543082][T14600] ? __get_vm_area_node+0x208/0x330 [ 756.543096][T14600] __vmalloc_node_range_noprof+0xbf4/0x1530 [ 756.543109][T14600] ? find_held_lock+0x2b/0x80 [ 756.543124][T14600] ? local_lock_release+0x99/0x130 [ 756.543138][T14600] ? local_lock_release+0x99/0x130 [ 756.543151][T14600] ? kernel_clone+0xfc/0x9a0 [ 756.543170][T14600] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 756.543185][T14600] ? __memcg_slab_post_alloc_hook+0x51b/0x990 [ 756.543199][T14600] ? rcu_is_watching+0x12/0xc0 [ 756.543212][T14600] ? trace_kmem_cache_alloc+0xf3/0x120 [ 756.543224][T14600] ? kernel_clone+0xfc/0x9a0 [ 756.543239][T14600] __vmalloc_node_noprof+0xad/0xf0 [ 756.543252][T14600] ? kernel_clone+0xfc/0x9a0 [ 756.543268][T14600] copy_process+0x5ec/0x7a40 [ 756.543283][T14600] ? __pfx__kstrtoull+0x10/0x10 [ 756.543303][T14600] ? __pfx_copy_process+0x10/0x10 [ 756.543321][T14600] ? _copy_from_user+0x59/0xd0 [ 756.543333][T14600] kernel_clone+0xfc/0x9a0 [ 756.543348][T14600] ? get_pid_task+0xfc/0x250 [ 756.543366][T14600] ? __pfx_kernel_clone+0x10/0x10 [ 756.543384][T14600] ? find_held_lock+0x2b/0x80 [ 756.543401][T14600] __do_sys_clone3+0x214/0x290 [ 756.543420][T14600] ? __pfx___do_sys_clone3+0x10/0x10 [ 756.543442][T14600] ? __fget_files+0x21f/0x3d0 [ 756.543463][T14600] do_syscall_64+0x106/0xf80 [ 756.543477][T14600] ? clear_bhb_loop+0x40/0x90 [ 756.543491][T14600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.543502][T14600] RIP: 0033:0x7fe6f7f9c799 [ 756.543512][T14600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 756.543523][T14600] RSP: 002b:00007fe6f8ecbef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 756.543534][T14600] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fe6f7f9c799 [ 756.543541][T14600] RDX: 00007fe6f8ecbf10 RSI: 0000000000000058 RDI: 00007fe6f8ecbf10 [ 756.543548][T14600] RBP: 00007fe6f8ecc090 R08: 0000000000000000 R09: 0000000000000058 [ 756.543554][T14600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 756.543561][T14600] R13: 00007fe6f8216038 R14: 00007fe6f8215fa0 R15: 00007ffe53a44228 [ 756.543575][T14600] [ 756.544636][T14600] Mem-Info: [ 757.092559][T14600] active_anon:48332 inactive_anon:0 isolated_anon:0 [ 757.092559][T14600] active_file:22149 inactive_file:40971 isolated_file:0 [ 757.092559][T14600] unevictable:1768 dirty:70 writeback:0 [ 757.092559][T14600] slab_reclaimable:12950 slab_unreclaimable:105344 [ 757.092559][T14600] mapped:55726 shmem:36592 pagetables:1756 [ 757.092559][T14600] sec_pagetables:0 bounce:0 [ 757.092559][T14600] kernel_misc_reclaimable:0 [ 757.092559][T14600] free:1220150 free_pcp:23622 free_cma:0 [ 757.218393][T14608] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2155'. [ 757.281078][ T947] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 757.489256][T14608] bond1: Unable to set down delay as MII monitoring is disabled [ 757.513223][T14600] Node 0 active_anon:190548kB inactive_anon:0kB active_file:88160kB inactive_file:163680kB unevictable:5588kB isolated(anon):0kB isolated(file):0kB mapped:224976kB dirty:372kB writeback:0kB shmem:141944kB shmem_thp:4096kB shmem_pmdmapped:4096kB anon_thp:0kB kernel_stack:13308kB pagetables:6800kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 757.565684][T14608] bond1 (unregistering): Released all slaves [ 757.795715][T14600] Node 1 active_anon:0kB inactive_anon:0kB active_file:436kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:436kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 757.805435][ T947] usb 3-1: Using ep0 maxpacket: 8 [ 757.981453][T14600] Node 0 DMA free:15344kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:16kB free_cma:0kB [ 758.209182][T14600] lowmem_reserve[]: 0 2477 2478 2478 2478 [ 758.247042][T14600] Node 0 DMA32 free:953484kB boost:0kB min:34056kB low:42568kB high:51080kB reserved_highatomic:0KB free_highatomic:0KB active_anon:182348kB inactive_anon:0kB active_file:88160kB inactive_file:163680kB unevictable:5588kB writepending:388kB zspages:0kB present:3129332kB managed:2537156kB mlocked:4096kB bounce:0kB free_pcp:80968kB local_pcp:51196kB free_cma:0kB [ 758.403414][T14600] lowmem_reserve[]: 0 0 1 1 1 [ 758.408125][T14600] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1048kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 758.566889][T14600] lowmem_reserve[]: 0 0 0 0 0 [ 758.601705][T14600] Node 1 Normal free:3930640kB boost:0kB min:55832kB low:69788kB high:83744kB reserved_highatomic:0KB free_highatomic:0KB active_anon:100kB inactive_anon:0kB active_file:436kB inactive_file:204kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:4952kB local_pcp:0kB free_cma:0kB [ 758.686606][ T947] usb 3-1: device descriptor read/all, error -71 [ 758.726062][T14600] lowmem_reserve[]: 0 0 0 0 0 [ 758.773305][T14600] Node 0 DMA: 0*4kB 0*8kB 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15344kB [ 758.889768][T14600] Node 0 DMA32: 1369*4kB (UME) 2486*8kB (UM) 1604*16kB (UM) 183*32kB (UME) 89*64kB (UM) 91*128kB (UM) 105*256kB (UM) 91*512kB (UM) 43*1024kB (UME) 9*2048kB (UME) 184*4096kB (UM) = 963828kB [ 758.985459][T14624] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2160'. [ 758.997806][T14624] "syz.1.2160" (14624) uses obsolete ecb(arc4) skcipher [ 759.011747][T14600] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 759.155821][T14600] Node 1 Normal: 6*4kB (UM) 5*8kB (UM) 13*16kB (UM) 18*32kB (UM) 13*64kB (UM) 9*128kB (UM) 5*256kB (UM) 5*512kB (UM) 6*1024kB (UM) 1*2048kB (U) 956*4096kB (M) = 3930640kB [ 759.190316][ T947] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 759.236750][T14600] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 759.297152][T14600] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 759.346727][T14600] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 759.393019][T14600] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 759.444940][T14600] 100753 total pagecache pages [ 759.688778][T14600] 0 pages in swap cache [ 759.717447][T14600] Free swap = 124996kB [ 759.743356][T14600] Total swap = 124996kB [ 759.775227][T14600] 2097051 pages RAM [ 759.795542][T14600] 0 pages HighMem/MovableOnly [ 759.822898][T14600] 430885 pages reserved [ 759.831401][T14600] 0 pages cma reserved [ 759.936222][ T947] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 760.041770][ T947] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 760.190276][ T947] usb 3-1: Product: syz [ 760.200414][ T947] usb 3-1: Manufacturer: syz [ 760.212679][ T947] usb 3-1: SerialNumber: syz [ 760.232139][ T947] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 760.255406][T13431] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 760.337143][ T30] audit: type=1400 audit(1773671475.656:1558): avc: denied { connect } for pid=14637 comm="syz.7.2165" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 760.533151][T14643] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2167'. [ 760.548141][ T30] audit: type=1400 audit(1773671475.866:1559): avc: denied { name_bind } for pid=14640 comm="syz.6.2167" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 760.653575][ T30] audit: type=1400 audit(1773671475.866:1560): avc: denied { node_bind } for pid=14640 comm="syz.6.2167" saddr=::ffff:0.0.0.0 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 760.842980][T14621] random: crng reseeded on system resumption [ 760.871779][T14649] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2168'. [ 761.041506][T13451] usb 3-1: USB disconnect, device number 62 [ 761.400413][T13431] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 761.421050][T13431] ath9k_htc: Failed to initialize the device [ 761.427239][T13451] usb 3-1: ath9k_htc: USB layer deinitialized [ 762.564304][T14668] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2174'. [ 762.611954][T14668] "syz.7.2174" (14668) uses obsolete ecb(arc4) skcipher [ 764.150795][ T5145] block nbd0: Possible stuck request ffff888027500000: control (read@0,1024B). Runtime 390 seconds [ 764.163095][ T5145] block nbd0: Possible stuck request ffff888027500200: control (read@1024,1024B). Runtime 390 seconds [ 764.174328][ T5145] block nbd0: Possible stuck request ffff888027500400: control (read@2048,1024B). Runtime 390 seconds [ 764.210161][ T5145] block nbd0: Possible stuck request ffff888027500600: control (read@3072,1024B). Runtime 390 seconds [ 766.475596][T14701] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 767.117564][T14701] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 768.178627][T14711] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2187'. [ 768.204625][T14711] "syz.7.2187" (14711) uses obsolete ecb(arc4) skcipher [ 768.506534][ T30] audit: type=1400 audit(1773671483.826:1561): avc: denied { create } for pid=14715 comm="syz.2.2182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 768.655255][ T30] audit: type=1400 audit(1773671483.976:1562): avc: denied { relabelto } for pid=14723 comm="syz.6.2191" name="194" dev="tmpfs" ino=1042 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 768.697843][ T30] audit: type=1400 audit(1773671483.976:1563): avc: denied { associate } for pid=14723 comm="syz.6.2191" name="194" dev="tmpfs" ino=1042 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:fsadm_exec_t:s0" [ 768.727641][T14724] netlink: 'syz.6.2191': attribute type 1 has an invalid length. [ 768.776177][T14724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 768.895195][T14728] vlan2: entered allmulticast mode [ 768.900746][T14728] veth0_to_bond: entered allmulticast mode [ 768.912624][T14728] bond0: (slave vlan2): Enslaving as an active interface with a down link [ 769.121187][T14740] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=14740 comm=syz.7.2196 [ 769.163656][T14735] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2195'. [ 769.253954][ T30] audit: type=1400 audit(1773671484.576:1564): avc: denied { remove_name } for pid=10453 comm="syz-executor" name="binderfs" dev="tmpfs" ino=1046 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 769.382467][T14743] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=14743 comm=syz.1.2197 [ 769.629347][ T30] audit: type=1400 audit(1773671484.606:1565): avc: denied { rmdir } for pid=10453 comm="syz-executor" name="194" dev="tmpfs" ino=1042 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 770.219705][ T30] audit: type=1400 audit(1773671485.186:1566): avc: denied { bind } for pid=14745 comm="syz.7.2198" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 770.680295][T13451] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 770.859394][T13451] usb 2-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 770.868608][T13451] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.970431][T13451] usb 2-1: Product: syz [ 770.979818][T13451] usb 2-1: Manufacturer: syz [ 770.985662][T13451] usb 2-1: SerialNumber: syz [ 770.998713][T13451] usb 2-1: config 0 descriptor?? [ 771.012941][T13451] hub 2-1:0.0: bad descriptor, ignoring hub [ 771.021672][T13451] hub 2-1:0.0: probe with driver hub failed with error -5 [ 771.227999][T13451] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 771.249292][T13451] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 771.260576][T13451] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 771.269761][T13451] usb 2-1: media controller created [ 771.299096][T13451] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 771.404316][T13451] DVB: Unable to find symbol dib7000p_attach() [ 771.410697][T13451] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 771.992843][T13451] rc_core: IR keymap rc-dib0700-rc5 not found [ 772.001993][T13451] Registered IR keymap rc-empty [ 772.022911][T13451] dvb-usb: could not initialize remote control. [ 772.029460][T13451] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 772.183621][T14778] overlayfs: failed to clone upperpath [ 772.190002][ T30] audit: type=1400 audit(1773671487.506:1567): avc: denied { setopt } for pid=14777 comm="syz.0.2206" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 772.862349][T14758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 772.871185][T14758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 773.426865][ T30] audit: type=1400 audit(1773671488.706:1568): avc: denied { bind } for pid=14789 comm="syz.7.2212" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 774.544889][T14758] dib0700: could not acquire lock [ 774.824656][ T30] audit: type=1400 audit(1773671489.866:1569): avc: denied { connect } for pid=14785 comm="syz.6.2211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 774.876679][T13451] usb 2-1: USB disconnect, device number 64 [ 775.006807][T13451] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 775.120047][ T5798] udevd[5798]: setting mode of /dev/bus/usb/002/064 to 020664 failed: No such file or directory [ 775.160400][ T5798] udevd[5798]: setting owner of /dev/bus/usb/002/064 to uid=0, gid=0 failed: No such file or directory [ 775.549465][ T2822] block nbd6: Possible stuck request ffff888027758000: control (read@0,1024B). Runtime 240 seconds [ 775.560319][ T2822] block nbd6: Possible stuck request ffff888027758200: control (read@1024,1024B). Runtime 240 seconds [ 775.582746][ T2822] block nbd6: Possible stuck request ffff888027758400: control (read@2048,1024B). Runtime 240 seconds [ 775.593987][ T2822] block nbd6: Possible stuck request ffff888027758600: control (read@3072,1024B). Runtime 240 seconds [ 776.122163][T14823] bad cache= option: no[dCȞXXޜ߽ew>jz"@ [ 776.122163][T14823] [ 776.142033][T14823] CIFS: VFS: bad cache= option: no[dCȞXXޜ߽ew>jz"@ [ 776.182687][T14826] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=14826 comm=syz.7.2221 [ 776.272221][ T30] audit: type=1400 audit(1773671491.596:1570): avc: denied { bind } for pid=14821 comm="syz.0.2209" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 776.521036][ T30] audit: type=1400 audit(1773671491.616:1571): avc: denied { setopt } for pid=14821 comm="syz.0.2209" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 776.672864][T14837] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 776.722718][T14829] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=14829 comm=syz.1.2222 [ 776.834155][T14838] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 776.983020][ T30] audit: type=1400 audit(1773671492.296:1572): avc: denied { create } for pid=14846 comm="syz.2.2227" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 777.133613][T14849] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2227'. [ 777.305028][ T30] audit: type=1400 audit(1773671492.296:1573): avc: denied { connect } for pid=14846 comm="syz.2.2227" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 777.350633][ T30] audit: type=1400 audit(1773671492.436:1574): avc: denied { write } for pid=14846 comm="syz.2.2227" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 777.466170][T14853] netlink: 'syz.2.2229': attribute type 1 has an invalid length. [ 778.245221][T14871] hpfs: Bad magic ... probably not HPFS [ 779.618268][ T30] audit: type=1326 audit(1773671494.936:1575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14890 comm="syz.2.2239" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7a59f9c799 code=0x0 [ 779.728298][T14894] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2240'. [ 780.024527][T14903] fuse: Bad value for 'user_id' [ 780.029401][T14903] fuse: Bad value for 'user_id' [ 780.041800][ T5824] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 780.303906][ T5824] usb 3-1: Using ep0 maxpacket: 16 [ 780.442167][ T5824] usb 3-1: config 0 has an invalid interface number: 246 but max is 0 [ 780.500910][ T5824] usb 3-1: config 0 has no interface number 0 [ 780.539992][ T5824] usb 3-1: config 0 interface 246 altsetting 255 endpoint 0xB has invalid maxpacket 1023, setting to 64 [ 780.568862][ T5824] usb 3-1: config 0 interface 246 altsetting 255 endpoint 0xD has invalid maxpacket 1024, setting to 64 [ 780.595330][ T5824] usb 3-1: config 0 interface 246 has no altsetting 0 [ 780.611460][ T5824] usb 3-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=35.27 [ 780.627929][ T5824] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.646203][ T5824] usb 3-1: Product: syz [ 780.658378][ T5824] usb 3-1: Manufacturer: syz [ 780.664493][ T5824] usb 3-1: SerialNumber: syz [ 780.773442][ T5824] usb 3-1: config 0 descriptor?? [ 780.788039][T14914] hpfs: Bad magic ... probably not HPFS [ 781.518547][ T30] audit: type=1400 audit(1773671496.826:1576): avc: denied { getopt } for pid=14921 comm="syz.1.2247" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 781.886701][T14936] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=14936 comm=syz.7.2252 [ 783.191976][ T5824] usb 3-1: USB disconnect, device number 63 [ 783.414756][T14961] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2262'. [ 783.445575][T14961] bond3: Unable to set down delay as MII monitoring is disabled [ 783.473495][T14961] bond3 (unregistering): Released all slaves [ 783.486914][T14963] "syz.0.2262" (14963) uses obsolete ecb(arc4) skcipher [ 783.600303][ T5824] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 783.774897][ T5824] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 783.794030][ T5824] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 783.809167][T14970] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2265'. [ 783.822185][ T5824] usb 3-1: Product: syz [ 783.829615][T14970] "syz.0.2265" (14970) uses obsolete ecb(arc4) skcipher [ 783.852503][ T5824] usb 3-1: Manufacturer: syz [ 783.862730][ T5824] usb 3-1: SerialNumber: syz [ 783.884253][ T5824] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 783.899628][ T24] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 785.132579][ T24] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 785.139702][ T24] ath9k_htc: Failed to initialize the device [ 785.330340][T14988] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=14988 comm=syz.6.2271 [ 785.351052][T14958] random: crng reseeded on system resumption [ 785.383386][ T24] usb 3-1: ath9k_htc: USB layer deinitialized [ 785.491962][T13451] usb 3-1: USB disconnect, device number 64 [ 785.583150][T14999] netlink: 68 bytes leftover after parsing attributes in process `syz.7.2276'. [ 785.642038][T14999] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=51730 sclass=netlink_xfrm_socket pid=14999 comm=syz.7.2276 [ 785.677961][ T30] audit: type=1400 audit(1773671500.996:1577): avc: denied { setopt } for pid=14994 comm="syz.7.2276" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 785.862583][ T9] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 786.080696][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 786.090565][ T9] usb 2-1: config 157 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 786.152466][ T9] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 786.161028][ T5824] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 786.169903][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 786.190894][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.544733][ T9] usb 2-1: Product: syz [ 786.549746][ T9] usb 2-1: Manufacturer: syz [ 786.555242][ T9] usb 2-1: SerialNumber: syz [ 787.143269][ T9] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 787.161986][ T9] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 787.180520][ T9] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 787.199444][ T9] usb 2-1: media controller created [ 787.228032][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 787.310338][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.660392][ T9] zl10353_read_register: readreg error (reg=127, ret==-32) [ 788.129214][ T30] audit: type=1400 audit(1773671503.086:1578): avc: denied { ioctl } for pid=15018 comm="syz.2.2282" path="socket:[44889]" dev="sockfs" ino=44889 ioctlcmd=0x89ed scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 788.286717][ T9] dvb_usb_gl861 2-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 788.321276][ T9] usb 2-1: USB disconnect, device number 65 [ 788.362903][T15026] netlink: 'syz.6.2283': attribute type 10 has an invalid length. [ 788.371025][T15026] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2283'. [ 788.452493][T15031] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2284'. [ 788.487431][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 788.616006][T15038] IPv6: addrconf: prefix option has invalid lifetime [ 788.947737][ T30] audit: type=1400 audit(1773671504.266:1579): avc: denied { getopt } for pid=15040 comm="syz.6.2288" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 789.633633][ T5824] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.652234][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.437687][T13431] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.525074][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.650529][ T947] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.842187][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.872321][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.881610][ T792] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 793.353814][T15102] netlink: 'syz.6.2299': attribute type 10 has an invalid length. [ 793.361946][T15102] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2299'. [ 793.440647][ T5824] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 793.680749][ T5824] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.222564][ T5824] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.231425][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 795.239974][ T5145] block nbd0: Possible stuck request ffff888027500000: control (read@0,1024B). Runtime 420 seconds [ 795.260344][ T5145] block nbd0: Possible stuck request ffff888027500200: control (read@1024,1024B). Runtime 420 seconds [ 795.271343][ T5145] block nbd0: Possible stuck request ffff888027500400: control (read@2048,1024B). Runtime 420 seconds [ 795.716426][ T5145] block nbd0: Possible stuck request ffff888027500600: control (read@3072,1024B). Runtime 420 seconds [ 795.920604][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.311449][ T5180] udevd[5180]: worker [9784] /devices/virtual/block/nbd6 timeout; kill it [ 796.360821][ T5180] udevd[5180]: seq 15976 '/devices/virtual/block/nbd6' killed [ 796.368474][ T5180] udevd[5180]: worker [7244] /devices/virtual/block/nbd0 timeout; kill it [ 796.512824][ T10] net_ratelimit: 1 callbacks suppressed [ 796.512841][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.587066][ T5180] udevd[5180]: seq 14208 '/devices/virtual/block/nbd0' killed [ 796.824377][T15131] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 796.851903][T15131] CIFS mount error: No usable UNC path provided in device string! [ 796.851903][T15131] [ 796.863317][T15131] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 797.216660][T13431] IPVS: starting estimator thread 0... [ 797.247286][T15145] cgroup: Unknown subsys name 'cpuset' [ 797.322787][T15146] IPVS: using max 75 ests per chain, 180000 per kthread [ 797.410449][T15154] hpfs: Bad magic ... probably not HPFS [ 797.540842][T13431] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 797.820445][T15160] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2320'. [ 797.829317][T15160] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2320'. [ 797.865473][T15160] netlink: 'syz.2.2320': attribute type 11 has an invalid length. [ 797.955458][T15160] netlink: 'syz.2.2320': attribute type 13 has an invalid length. [ 798.961733][T13431] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.761930][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 800.080499][T13431] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 800.465541][T15208] hpfs: Bad magic ... probably not HPFS [ 800.673540][T15216] netlink: 'syz.2.2330': attribute type 10 has an invalid length. [ 800.681411][T15216] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2330'. [ 800.690996][T15216] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 800.716574][T15217] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2334'. [ 800.728779][T15217] "syz.0.2334" (15217) uses obsolete ecb(arc4) skcipher [ 801.054978][T15223] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2336'. [ 801.121387][T13431] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.160722][ T5824] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.405893][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.455850][ T30] audit: type=1400 audit(1773671533.772:1580): avc: denied { write } for pid=15238 comm="syz.2.2342" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 802.455863][T15239] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2342'. [ 802.800642][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 803.015315][T15245] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 803.024004][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 803.045134][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 803.054076][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 803.201057][T13431] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 803.543488][T15263] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2349'. [ 803.553382][T15263] bridge0: entered allmulticast mode [ 803.709515][T15259] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=15259 comm=syz.7.2348 [ 804.771489][ T5824] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.883432][ T30] audit: type=1400 audit(1773671536.132:1581): avc: denied { view } for pid=15269 comm="syz.2.2351" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 806.071965][ T947] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.105392][ T30] audit: type=1400 audit(1773671537.002:1582): avc: denied { audit_read } for pid=15284 comm="syz.0.2354" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 806.311315][ T792] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.319560][T15281] block nbd6: Possible stuck request ffff888027758000: control (read@0,1024B). Runtime 270 seconds [ 806.330466][T15281] block nbd6: Possible stuck request ffff888027758200: control (read@1024,1024B). Runtime 270 seconds [ 806.343237][T15281] block nbd6: Possible stuck request ffff888027758400: control (read@2048,1024B). Runtime 270 seconds [ 806.358801][T15281] block nbd6: Possible stuck request ffff888027758600: control (read@3072,1024B). Runtime 270 seconds [ 806.859374][T15303] veth1_to_bond: entered allmulticast mode [ 806.961079][T15308] bond1: Unable to set down delay as MII monitoring is disabled [ 806.998941][T15310] "syz.1.2360" (15310) uses obsolete ecb(arc4) skcipher [ 807.098783][T15308] bond1 (unregistering): Released all slaves [ 807.120870][ T947] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 807.402409][T15313] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2361'. [ 807.417312][T15313] bridge0: port 3(dummy0) entered disabled state [ 807.423777][T15313] bridge0: port 2(bridge_slave_1) entered disabled state [ 807.431033][T15313] bridge0: port 1(bridge_slave_0) entered disabled state [ 807.438403][T15313] bridge0: entered allmulticast mode [ 808.510874][ T30] audit: type=1400 audit(1773671539.412:1583): avc: denied { read } for pid=15318 comm="syz.2.2363" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 808.554803][ T947] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.590719][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.599681][ T792] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.616484][ T792] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.643262][ T30] audit: type=1400 audit(1773671539.412:1584): avc: denied { open } for pid=15318 comm="syz.2.2363" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 808.687847][T15326] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.696327][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.712598][ T30] audit: type=1400 audit(1773671539.422:1585): avc: denied { append } for pid=15318 comm="syz.2.2363" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 808.736562][ T30] audit: type=1400 audit(1773671539.432:1586): avc: denied { override_creds } for pid=15318 comm="syz.2.2363" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 809.161626][T15334] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=15334 comm=syz.0.2368 [ 809.214884][T15299] veth1_to_bond: left allmulticast mode [ 809.392118][ T792] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 809.653747][ T947] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.725709][ T31] INFO: task syz.5.1747:13175 blocked for more than 143 seconds. [ 810.733921][ T51] Bluetooth: hci0: command 0x0401 tx timeout [ 810.767192][ T31] Tainted: G L syzkaller #0 [ 811.574210][ T5824] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.609764][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 811.625787][ T31] task:syz.5.1747 state:D stack:28112 pid:13175 tgid:13154 ppid:8646 task_flags:0x400040 flags:0x00080002 [ 811.640511][ T31] Call Trace: [ 811.643822][ T31] [ 811.646783][ T31] __schedule+0xfee/0x6120 [ 811.651278][ T31] ? __lock_acquire+0x4a5/0x2630 [ 811.672290][ T31] ? __pfx___schedule+0x10/0x10 [ 811.705757][ T31] ? find_held_lock+0x2b/0x80 [ 811.710511][ T31] ? schedule+0x2bf/0x390 [ 811.715250][ T31] schedule+0xdd/0x390 [ 811.719869][ T31] schedule_preempt_disabled+0x13/0x30 [ 811.725722][ T31] __mutex_lock+0xc9a/0x1b90 [ 811.731501][ T31] ? sync_bdevs+0x153/0x480 [ 811.736011][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 811.741281][ T31] ? __mutex_unlock_slowpath+0x15c/0x790 [ 811.746959][ T31] ? iput.part.0+0x1a0/0xf50 [ 811.752011][ T31] ? sync_bdevs+0x153/0x480 [ 811.756505][ T31] sync_bdevs+0x153/0x480 [ 811.760899][ T31] ksys_sync+0xb0/0xf0 [ 811.764978][ T31] ? __pfx_ksys_sync+0x10/0x10 [ 811.769766][ T31] ? do_syscall_64+0x95/0xf80 [ 811.775586][ T31] __do_sys_sync+0xe/0x20 [ 811.780183][ T31] do_syscall_64+0x106/0xf80 [ 811.784799][ T31] ? clear_bhb_loop+0x40/0x90 [ 811.789573][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 811.795557][ T31] RIP: 0033:0x7f8d2099c799 [ 811.799978][ T31] RSP: 002b:00007f8d21770028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 811.808503][ T31] RAX: ffffffffffffffda RBX: 00007f8d20c16090 RCX: 00007f8d2099c799 [ 811.817111][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 811.825125][ T31] RBP: 00007f8d20c16090 R08: 0000000000000000 R09: 0000000000000000 [ 811.833116][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 811.841088][ T31] R13: 00007f8d20c16128 R14: 00007f8d20c16090 R15: 00007ffe7a87cdd8 [ 811.849066][ T31] [ 811.860293][ T31] INFO: task syz.5.1747:13176 blocked for more than 144 seconds. [ 811.868053][ T31] Tainted: G L syzkaller #0 [ 811.878564][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 811.891975][ T31] task:syz.5.1747 state:D stack:28136 pid:13176 tgid:13154 ppid:8646 task_flags:0x400040 flags:0x00080002 [ 811.904027][ T31] Call Trace: [ 811.907295][ T31] [ 811.910201][ T31] __schedule+0xfee/0x6120 [ 811.914842][ T31] ? __lock_acquire+0x4a5/0x2630 [ 811.920505][ T31] ? __pfx___schedule+0x10/0x10 [ 811.925371][ T31] ? find_held_lock+0x2b/0x80 [ 811.930055][ T31] ? schedule+0x2bf/0x390 [ 811.934463][ T31] schedule+0xdd/0x390 [ 811.938543][ T31] schedule_preempt_disabled+0x13/0x30 [ 811.944019][ T31] __mutex_lock+0xc9a/0x1b90 [ 811.948606][ T31] ? sync_bdevs+0x153/0x480 [ 811.953265][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 811.958281][ T31] ? __mutex_unlock_slowpath+0x15c/0x790 [ 811.963939][ T31] ? iput.part.0+0x1a0/0xf50 [ 811.968528][ T31] ? sync_bdevs+0x153/0x480 [ 811.973074][ T31] sync_bdevs+0x153/0x480 [ 811.977395][ T31] ksys_sync+0xb0/0xf0 [ 811.981492][ T31] ? __pfx_ksys_sync+0x10/0x10 [ 811.986417][ T31] ? do_syscall_64+0x95/0xf80 [ 811.991236][ T31] __do_sys_sync+0xe/0x20 [ 811.995557][ T31] do_syscall_64+0x106/0xf80 [ 812.000123][ T31] ? clear_bhb_loop+0x40/0x90 [ 812.004838][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 812.010871][ T31] RIP: 0033:0x7f8d2099c799 [ 812.015291][ T31] RSP: 002b:00007f8d1ebf6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 812.024348][ T31] RAX: ffffffffffffffda RBX: 00007f8d20c16180 RCX: 00007f8d2099c799 [ 812.032449][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 812.040465][ T31] RBP: 00007f8d20c16180 R08: 0000000000000000 R09: 0000000000000000 [ 812.048438][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 812.056463][ T31] R13: 00007f8d20c16218 R14: 00007f8d20c16180 R15: 00007ffe7a87cdd8 [ 812.064467][ T31] [ 812.067530][ T31] [ 812.067530][ T31] Showing all locks held in the system: [ 812.076610][ T31] 1 lock held by khungtaskd/31: [ 812.081497][ T31] #0: ffffffff8e7e76a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 812.091653][ T31] 5 locks held by kworker/u8:3/49: [ 812.096758][ T31] 3 locks held by kworker/0:2/792: [ 812.101931][ T31] #0: ffff88813fe67148 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 [ 812.112482][ T31] #1: ffff8880b8424648 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2c11/0x6120 [ 812.121306][ T31] #2: ffffffff8e7e76a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x1ea0 [ 812.131775][ T31] 1 lock held by klogd/5169: [ 812.136373][ T31] #0: ffff8880b843b1a0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 [ 812.146338][ T31] 2 locks held by getty/5567: [ 812.151067][ T31] #0: ffff888038e400a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 812.160828][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 812.170977][ T31] 3 locks held by kworker/u9:6/5820: [ 812.176235][ T31] #0: ffff888079cb6948 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 [ 812.186493][ T31] #1: ffffc90003f17d08 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 [ 812.198696][ T31] #2: ffff8880332c8ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 [ 812.208586][ T31] 1 lock held by udevd/7244: [ 812.213169][ T31] #0: ffff888027499358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 812.222513][ T31] 1 lock held by udevd/9784: [ 812.227767][ T31] #0: ffff888027624358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 812.237235][ T31] 1 lock held by syz.5.1747/13175: [ 812.242357][ T31] #0: ffff888027624358 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x153/0x480 [ 812.251806][ T31] 1 lock held by syz.5.1747/13176: [ 812.256898][ T31] #0: ffff888027624358 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x153/0x480 [ 812.266328][ T31] [ 812.268634][ T31] ============================================= [ 812.268634][ T31] [ 812.277214][ T31] NMI backtrace for cpu 1 [ 812.277230][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 812.277247][ T31] Tainted: [L]=SOFTLOCKUP [ 812.277251][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 812.277258][ T31] Call Trace: [ 812.277262][ T31] [ 812.277266][ T31] dump_stack_lvl+0x100/0x190 [ 812.277287][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 812.277299][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 812.277318][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 812.277338][ T31] sys_info+0x141/0x190 [ 812.277354][ T31] watchdog+0xd25/0x1050 [ 812.277373][ T31] ? __pfx_watchdog+0x10/0x10 [ 812.277389][ T31] ? __kthread_parkme+0x18c/0x230 [ 812.277406][ T31] ? kthread+0x13a/0x450 [ 812.277415][ T31] ? __pfx_watchdog+0x10/0x10 [ 812.277435][ T31] kthread+0x370/0x450 [ 812.277445][ T31] ? __pfx_kthread+0x10/0x10 [ 812.277456][ T31] ret_from_fork+0x754/0xd80 [ 812.277468][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 812.277480][ T31] ? __switch_to+0x7b4/0x1120 [ 812.277493][ T31] ? __pfx_kthread+0x10/0x10 [ 812.277505][ T31] ret_from_fork_asm+0x1a/0x30 [ 812.277524][ T31] [ 812.277528][ T31] Sending NMI from CPU 1 to CPUs 0: [ 812.403322][ C0] NMI backtrace for cpu 0 [ 812.403337][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 812.403356][ C0] Tainted: [L]=SOFTLOCKUP [ 812.403362][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 812.403370][ C0] RIP: 0010:psi_group_change+0x2e7/0xa20 [ 812.403395][ C0] Code: 48 89 f9 48 c1 e9 03 0f b6 14 11 84 d2 74 06 0f 8e b5 04 00 00 41 80 7e 08 00 0f 84 54 02 00 00 48 ba 00 00 00 00 00 fc ff df <4c> 89 f9 8b 1c 24 48 c1 e9 03 0f b6 0c 11 4c 89 fa c1 eb 08 83 e2 [ 812.403408][ C0] RSP: 0018:ffffc90000007d58 EFLAGS: 00000002 [ 812.403420][ C0] RAX: 0000000000000003 RBX: 00000000fffffffb RCX: 1ffffffff1cda3f9 [ 812.403432][ C0] RDX: dffffc0000000000 RSI: ffffffff8de50b8b RDI: ffffffff8e6d1fc8 [ 812.403441][ C0] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000001 [ 812.403449][ C0] R10: dffffc0000000000 R11: 0000000000000000 R12: 0000000000000000 [ 812.403457][ C0] R13: 0000000000000002 R14: ffffffff8e6d1fc0 R15: ffff8880b8424680 [ 812.403467][ C0] FS: 0000000000000000(0000) GS:ffff888124342000(0000) knlGS:0000000000000000 [ 812.403480][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 812.403489][ C0] CR2: 0000001b2f81aff8 CR3: 0000000044007000 CR4: 00000000003526f0 [ 812.403498][ C0] Call Trace: [ 812.403503][ C0] [ 812.403511][ C0] psi_task_change+0x339/0x550 [ 812.403531][ C0] enqueue_task+0x1d6/0x4f0 [ 812.403551][ C0] ttwu_do_activate+0x176/0x7c0 [ 812.403571][ C0] sched_ttwu_pending+0x2b3/0x660 [ 812.403585][ C0] ? kvm_sched_clock_read+0x11/0x20 [ 812.403601][ C0] ? sched_clock+0x38/0x60 [ 812.403619][ C0] ? __pfx_sched_ttwu_pending+0x10/0x10 [ 812.403631][ C0] ? tick_irq_enter+0x175/0x240 [ 812.403651][ C0] ? __pfx_sched_ttwu_pending+0x10/0x10 [ 812.403663][ C0] ? rcu_is_watching+0x12/0xc0 [ 812.403680][ C0] __flush_smp_call_function_queue+0x4d3/0x960 [ 812.403700][ C0] __sysvec_call_function_single+0x81/0x470 [ 812.403720][ C0] sysvec_call_function_single+0x9e/0xc0 [ 812.403736][ C0] [ 812.403740][ C0] [ 812.403745][ C0] asm_sysvec_call_function_single+0x1a/0x20 [ 812.403760][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 812.403776][ C0] Code: 88 82 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d a3 71 1b 00 fb f4 fc 35 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 812.403788][ C0] RSP: 0018:ffffffff8e407e00 EFLAGS: 00000242 [ 812.403799][ C0] RAX: 00000000047d2ab5 RBX: ffffffff8e4975c0 RCX: ffffffff8b901c75 [ 812.403808][ C0] RDX: 0000000000000000 RSI: ffffffff8de76c97 RDI: ffffffff8c1b06a0 [ 812.403816][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed1017086795 [ 812.403825][ C0] R10: ffff8880b8433cab R11: 0000000000000000 R12: fffffbfff1c92eb8 [ 812.403833][ C0] R13: 0000000000000000 R14: ffffffff90d99110 R15: 0000000000000000 [ 812.403845][ C0] ? ct_kernel_exit+0x125/0x180 [ 812.403862][ C0] default_idle+0x9/0x10 [ 812.403880][ C0] default_idle_call+0x6c/0xb0 [ 812.403897][ C0] do_idle+0x43a/0x550 [ 812.403918][ C0] ? __pfx_do_idle+0x10/0x10 [ 812.403936][ C0] cpu_startup_entry+0x4f/0x60 [ 812.403951][ C0] rest_init+0x251/0x260 [ 812.403969][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 812.403985][ C0] start_kernel+0x47f/0x480 [ 812.403997][ C0] x86_64_start_reservations+0x24/0x30 [ 812.404010][ C0] x86_64_start_kernel+0x12b/0x130 [ 812.404023][ C0] common_startup_64+0x13e/0x148 [ 812.404043][ C0] [ 812.411089][ T792] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 812.419157][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 812.419173][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 812.419195][ T31] Tainted: [L]=SOFTLOCKUP [ 812.419201][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 812.419211][ T31] Call Trace: [ 812.419217][ T31] [ 812.419224][ T31] dump_stack_lvl+0x100/0x190 [ 812.419254][ T31] vpanic+0x552/0x970 [ 812.419270][ T31] ? __pfx_vpanic+0x10/0x10 [ 812.419288][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 812.419317][ T31] panic+0xd1/0xe0 [ 812.419332][ T31] ? __pfx_panic+0x10/0x10 [ 812.419350][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 812.419375][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 812.419420][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 812.419444][ T31] ? watchdog.cold+0x198/0x1ca [ 812.419461][ T31] ? watchdog+0xd35/0x1050 [ 812.419484][ T31] watchdog.cold+0x1a9/0x1ca [ 812.419512][ T31] ? __pfx_watchdog+0x10/0x10 [ 812.419534][ T31] ? __kthread_parkme+0x18c/0x230 [ 812.419559][ T31] ? kthread+0x13a/0x450 [ 812.419572][ T31] ? __pfx_watchdog+0x10/0x10 [ 812.419591][ T31] kthread+0x370/0x450 [ 812.419605][ T31] ? __pfx_kthread+0x10/0x10 [ 812.419622][ T31] ret_from_fork+0x754/0xd80 [ 812.419639][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 812.419657][ T31] ? __switch_to+0x7b4/0x1120 [ 812.419677][ T31] ? __pfx_kthread+0x10/0x10 [ 812.419693][ T31] ret_from_fork_asm+0x1a/0x30 [ 812.419722][ T31] [ 812.423574][ T31] Kernel Offset: disabled