last executing test programs: 29m31.053724778s ago: executing program 0 (id=119): r0 = fsopen(&(0x7f0000000240)='ocfs2_dlmfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, 0x0, 0x0, 0xffffffffffffffff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x401, 0x87) openat$vimc2(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x489, 0x0, 0x100000005}]}) r6 = socket(0x10, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="58000000100037040400"/20, @ANYRES32=r7, @ANYBLOB="8304050000000000380012800b000100697036746e6c000028000280080008001300000014000300fe"], 0x58}, 0x1, 0x0, 0x0, 0x9005}, 0x4000000) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r8, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r9 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r9, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r9, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x800000000000, 0x4, 0x3}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r9, &(0x7f0000000480), 0x2e9, 0x0) r10 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r10, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="020602000200000002"], 0x10}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001000010029bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="159804000300000008000d000100000008001b00"], 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) socket(0x46, 0xa, 0x2feb) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f000043b000/0x1000)=nil, 0xfffffffffffffdb5, &(0x7f0000000080)='\x00\xc9\xf5\x00\x00\x00\x00\x00\x00\x00+\x1ct\xc6\fr\xbaU\xc1\xb2\xd2\xde\xbfk\xc0\x18\x94\xc5&\xec\x03\xa0w\"E\xc9\xf2,K4\x10\xc8\x8cuj\xd3\xf0\xb3\xa9f\xf7\xb7\x17\xdf\xca\xac\x8b\x81K\t\x14^\xc3\xb7<\xa1\x15\v4\xd0\xbe\xa8\x01\x00<:-Y\n<\x1d\xb2\xe0kU\xc0\xc1\x14') io_submit(0x0, 0xfffffffffffffead, 0x0) r11 = eventfd2(0x19, 0x80801) io_submit(0x0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x55, r5, &(0x7f0000000140)="77205d1f4e74bb7505f150bd081a941803f3df16da0eef75ff03c653f93f38cea9e73f026e9e352d43167f129160d195a598682e6fff58f7a7b37c94309f2ab2c5957eddbfceceda7e430038d4bee0a1baed5a7055e19297ed03357f3c3ad92278fffc2509dc7a5529e44ae75005eaa615dcd73968e33fc75ef5c358e5bc53efe7e4269163a71d89d156d73cd9e63b566949a23ad411bcfff601e6a7272fdbbf807de455b7d177267da93965479425c74d44e6a8079dcbcb524a8ddb5047c234b742fb4914b29f73db88d3615823c93f192a272d00956991e38e041b7e0833102255bb5c025fafc5", 0xe8, 0x0, 0x0, 0x3, r11}]) write(r1, &(0x7f0000000280)='0', 0x1) 29m28.8978758s ago: executing program 0 (id=123): r0 = fsopen(&(0x7f0000000240)='ocfs2_dlmfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, 0x0, 0x0, 0xffffffffffffffff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x401, 0x87) openat$vimc2(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x489, 0x0, 0x100000005}]}) r6 = socket(0x10, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x9005}, 0x4000000) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r7, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r8 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r8, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x800000000000, 0x4, 0x3}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r8, &(0x7f0000000480), 0x2e9, 0x0) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="020602000200000002"], 0x10}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001000010029bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="159804000300000008000d000100000008001b00"], 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) socket(0x46, 0xa, 0x2feb) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f000043b000/0x1000)=nil, 0xfffffffffffffdb5, &(0x7f0000000080)='\x00\xc9\xf5\x00\x00\x00\x00\x00\x00\x00+\x1ct\xc6\fr\xbaU\xc1\xb2\xd2\xde\xbfk\xc0\x18\x94\xc5&\xec\x03\xa0w\"E\xc9\xf2,K4\x10\xc8\x8cuj\xd3\xf0\xb3\xa9f\xf7\xb7\x17\xdf\xca\xac\x8b\x81K\t\x14^\xc3\xb7<\xa1\x15\v4\xd0\xbe\xa8\x01\x00<:-Y\n<\x1d\xb2\xe0kU\xc0\xc1\x14') io_submit(0x0, 0xfffffffffffffead, 0x0) r10 = eventfd2(0x19, 0x80801) io_submit(0x0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x55, r5, &(0x7f0000000140)="77205d1f4e74bb7505f150bd081a941803f3df16da0eef75ff03c653f93f38cea9e73f026e9e352d43167f129160d195a598682e6fff58f7a7b37c94309f2ab2c5957eddbfceceda7e430038d4bee0a1baed5a7055e19297ed03357f3c3ad92278fffc2509dc7a5529e44ae75005eaa615dcd73968e33fc75ef5c358e5bc53efe7e4269163a71d89d156d73cd9e63b566949a23ad411bcfff601e6a7272fdbbf807de455b7d177267da93965479425c74d44e6a8079dcbcb524a8ddb5047c234b742fb4914b29f73db88d3615823c93f192a272d00956991e38e041b7e0833102255bb5c025fafc5", 0xe8, 0x0, 0x0, 0x3, r10}]) write(r1, &(0x7f0000000280)='0', 0x1) 29m27.787261909s ago: executing program 0 (id=126): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x2, 0x0) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r1) tkill(r1, 0x12) ptrace(0x4208, r1) tkill(r1, 0x12) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x800000000000002) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01040000000000000000070000000900010073797a300000000040000000030a01040000000000000000070000000900010073797a30000000000900030073797a300000000014000480080001400000000408000240ffffff3854000000060a01040000000000000000070000000900010073797a30000000000900020073797a30000000002800048024000180090001006d65746100000000140002800800014000000001080002400000002114000000110001"], 0xdc}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee00}}, './file0\x00'}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/uevent_helper', 0x0, 0x0) read$FUSE(r6, &(0x7f00000014c0)={0x2020}, 0x2020) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) 29m26.745935233s ago: executing program 0 (id=128): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)={0x5c, 0x2, 0x6, 0x801, 0x0, 0xffef, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x1}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}}, 0x4004804) fsetxattr$security_evm(r0, &(0x7f0000000080), &(0x7f00000001c0)=@md5={0x1, "0a08e3078bd8565a3444fae0130a9596"}, 0x11, 0x3) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x2, 0x40, 0x7fff0000}]}) syz_emit_ethernet(0x2a, &(0x7f0000002600)=ANY=[@ANYBLOB="aaaa696b00c10d275f1e00000800450c001c000000020011907800000000000000004e234e2400089078"], 0x0) syz_emit_ethernet(0x32, &(0x7f0000000080)={@broadcast, @random="67eaa8fce250", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x2, 0x36, 0x24, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x4, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) futimesat(0xffffffffffffffff, 0x0, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) ptrace(0x10, r1) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x89901) ptrace$peeksig(0x4209, r1, &(0x7f0000000000)={0xfffffffffffffffe, 0x1, 0x1}, &(0x7f0000000040)=[{}]) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) close(r4) rmdir(&(0x7f0000000640)='./file0\x00') r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) move_mount(r6, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x267) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r6, 0xc040564a, &(0x7f0000000040)={0x1ed, 0x0, 0x1015, 0xffffff01, 0x5, 0x8, 0x1}) 29m25.383064363s ago: executing program 0 (id=131): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x2, 0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r2) tkill(r2, 0x12) ptrace(0x4208, r2) tkill(r2, 0x12) sched_setaffinity(r2, 0x8, &(0x7f00000000c0)=0x800000000000002) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) connect$unix(r4, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01040000000000000000070000000900010073797a300000000040000000030a01040000000000000000070000000900010073797a30000000000900030073797a300000000014000480080001400000000408000240ffffff3854000000060a01040000000000000000070000000900010073797a30000000000900020073797a30000000002800048024000180090001006d65746100000000140002800800014000000001080002400000002114000000110001"], 0xdc}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1, {0xee00}}, './file0\x00'}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/uevent_helper', 0x0, 0x0) read$FUSE(r6, &(0x7f00000014c0)={0x2020}, 0x2020) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r7 = gettid() r8 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r8, 0x84, 0x11, 0x0, &(0x7f0000001040)) process_vm_writev(r7, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1f80}], 0x310, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000440)={'dt2814\x00', [0x300, 0xc0000000, 0x1, 0x400, 0xe, 0x800005, 0x3, 0x6, 0x8, 0x56, 0xffffffff, 0x1, 0x1, 0xfffffffc, 0x10000b, 0x0, 0x6c18, 0x4007a, 0x3, 0x20000003, 0x89, 0x12, 0x7f, 0xfffff801, 0x5, 0xe66, 0x1, 0x2000008, 0xa6b3, 0x0, 0x5]}) 29m24.604061541s ago: executing program 0 (id=135): r0 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) r2 = fsopen(&(0x7f0000000080)='hfsplus\x00', 0x1) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000080)=0x40000) write$dsp(r1, 0x0, 0xfffffe59) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r4, 0x5760, 0x1f) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="180000001800070102000000000000fa127c000004000180"], 0x18}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r5) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8b32, &(0x7f0000000080)={'virt_wifi0\x00', @multicast}) r6 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f010000000000000000000905810340000000000905820260000000000905030208"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r6, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r4, 0x100000000000f7) sync_file_range(r5, 0x1d, 0x7, 0x0) read$watch_queue(r3, &(0x7f0000000000)=""/18, 0x12) openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) syz_usb_connect$uac2(0x5, 0x11d, &(0x7f0000000300)={{0x12, 0x1, 0x1, 0x0, 0x0, 0x0, 0x8, 0x86a, 0x1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x10b, 0x3, 0x1, 0x40, 0x60, 0x29, {0x8, 0xb, 0x0, 0x0, 0x1, 0x8, 0x20, 0x4}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x8001, 0x1, 0x30, 0x5}, [@feature_unit={0xf, 0x24, 0x6, 0x2, 0x1, [0xff, 0x6, 0x3, 0x7, 0x0]}, @feature_unit={0x7, 0x24, 0x6, 0x1, 0x6, [0x1]}, @source_unit={0x8, 0x24, 0xa, 0x3, 0x3, 0xc, 0x8, 0x2}, @effect_unit={0x9, 0x24, 0x7, 0x3, 0x1, 0x6, [0x2]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0xe, 0x1, 0x6, 0x40, "1d"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x5, 0xff31, 0x94, 0x1}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0xa}, @as_header={0x10, 0x24, 0x1, 0x7, 0x2, 0x0, 0x3, 0x8, 0xd, 0xff}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x8, 0x8, 0x2, "701f0c125d"}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x4, 0x1, 0x7, 0x80, "327d2171fb9eb02266"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x7, 0xe2, 0x8, {0x8, 0x25, 0x1, 0x80, 0xf, 0xe0, 0xfc80}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0x4}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x6}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x8, 0x9f, 0x40, "59fbc181"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x8, 0x9a, 0x5, "dc6fdcef5e8bde3c6a"}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x9, 0x2, 0x0, 0xb}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x4, 0x2, 0x1, {0x8, 0x25, 0x1, 0x80, 0x0, 0x4, 0x3}}}}}}}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x200, 0x9, 0x0, 0x9a, 0x8, 0x4d}, 0x0, 0x0, 0x5, [{0x39, &(0x7f00000005c0)=@string={0x39, 0x3, "1d303e48c2ae2e92a79b9ebe6c2b22f57581331a2297d5541ad68f8116c06ca5821e331e269d550a08bdf192bd61e6f04a008f07d1e8a9"}}, {0xcb, &(0x7f00000004c0)=@string={0xcb, 0x3, "be5faa3d536d0971c2cc8ee786bfd4451c88088fd9d8f164f0fc0c51d71971bdb81571d3749b43ee1918196e1e11b19c0732994d9fa1afec20fef226de8dd091077e454ce7957a21643323262092e02f3c775d38dfe79cfb4790a77cdb65417a942f77c0ebc067d9ad64ca27c49de37d72740039d2c48fa175a4774ce2e8c73b444bbf788066533de53ed66d6118b884a9843c2171ec8ff6ddc3a37a597d0fe86a82b1fe7f9cc3bb821ef29b795c5a38a05515382c8ef17a38e969492f19296f589266dd5052dca82f"}}, {0xbb, &(0x7f00000001c0)=@string={0xbb, 0x3, "d8bb1ddb23075f55199114eabc21f98f951a5f976c34ba60f1ab5bea8aec3f2081d97b5438ffceccf0e938606f72d99263a45f71a6b6283ad9c1d19cd6c7af1ed86667bbdb88bd20911ab4f24fd8236de9869201779ce6ca276024232fb33238bc092ab1f7076ce9bf21dadca8afb3ed2d53e0e1eed759aaaba72e13055068812f4ba596a5e169071ef8e7703d8fbc5cac18e2fae2fb5c16b9dbe9997ab7db9d4f921fcda25e3d950efb133355f5397877868b842ddf4e20eb"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1404}}, {0x34, &(0x7f0000000640)=@string={0x34, 0x3, "50ab8eaed1c4f774bd9eb1087b91025bc4172a274ed33847a2cc14c9d727e62e28e1049552720b13b04a2fcbf2421f9d233f"}}]}) r7 = socket$inet6_icmp(0xa, 0x2, 0x3a) getsockopt$inet6_int(r7, 0x29, 0x4b, 0x0, &(0x7f0000000e00)) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') writev(r8, &(0x7f00000012c0)=[{&(0x7f0000000100)="dd", 0x1}], 0x1) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r9, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10) 29m23.301374242s ago: executing program 32 (id=135): r0 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) r2 = fsopen(&(0x7f0000000080)='hfsplus\x00', 0x1) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000080)=0x40000) write$dsp(r1, 0x0, 0xfffffe59) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r4, 0x5760, 0x1f) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="180000001800070102000000000000fa127c000004000180"], 0x18}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r5) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8b32, &(0x7f0000000080)={'virt_wifi0\x00', @multicast}) r6 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f010000000000000000000905810340000000000905820260000000000905030208"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r6, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r4, 0x100000000000f7) sync_file_range(r5, 0x1d, 0x7, 0x0) read$watch_queue(r3, &(0x7f0000000000)=""/18, 0x12) openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) syz_usb_connect$uac2(0x5, 0x11d, &(0x7f0000000300)={{0x12, 0x1, 0x1, 0x0, 0x0, 0x0, 0x8, 0x86a, 0x1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x10b, 0x3, 0x1, 0x40, 0x60, 0x29, {0x8, 0xb, 0x0, 0x0, 0x1, 0x8, 0x20, 0x4}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x8001, 0x1, 0x30, 0x5}, [@feature_unit={0xf, 0x24, 0x6, 0x2, 0x1, [0xff, 0x6, 0x3, 0x7, 0x0]}, @feature_unit={0x7, 0x24, 0x6, 0x1, 0x6, [0x1]}, @source_unit={0x8, 0x24, 0xa, 0x3, 0x3, 0xc, 0x8, 0x2}, @effect_unit={0x9, 0x24, 0x7, 0x3, 0x1, 0x6, [0x2]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0xe, 0x1, 0x6, 0x40, "1d"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x5, 0xff31, 0x94, 0x1}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0xa}, @as_header={0x10, 0x24, 0x1, 0x7, 0x2, 0x0, 0x3, 0x8, 0xd, 0xff}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x8, 0x8, 0x2, "701f0c125d"}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x4, 0x1, 0x7, 0x80, "327d2171fb9eb02266"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x7, 0xe2, 0x8, {0x8, 0x25, 0x1, 0x80, 0xf, 0xe0, 0xfc80}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0x4}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x6}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x8, 0x9f, 0x40, "59fbc181"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x8, 0x9a, 0x5, "dc6fdcef5e8bde3c6a"}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x9, 0x2, 0x0, 0xb}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x4, 0x2, 0x1, {0x8, 0x25, 0x1, 0x80, 0x0, 0x4, 0x3}}}}}}}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x200, 0x9, 0x0, 0x9a, 0x8, 0x4d}, 0x0, 0x0, 0x5, [{0x39, &(0x7f00000005c0)=@string={0x39, 0x3, "1d303e48c2ae2e92a79b9ebe6c2b22f57581331a2297d5541ad68f8116c06ca5821e331e269d550a08bdf192bd61e6f04a008f07d1e8a9"}}, {0xcb, &(0x7f00000004c0)=@string={0xcb, 0x3, "be5faa3d536d0971c2cc8ee786bfd4451c88088fd9d8f164f0fc0c51d71971bdb81571d3749b43ee1918196e1e11b19c0732994d9fa1afec20fef226de8dd091077e454ce7957a21643323262092e02f3c775d38dfe79cfb4790a77cdb65417a942f77c0ebc067d9ad64ca27c49de37d72740039d2c48fa175a4774ce2e8c73b444bbf788066533de53ed66d6118b884a9843c2171ec8ff6ddc3a37a597d0fe86a82b1fe7f9cc3bb821ef29b795c5a38a05515382c8ef17a38e969492f19296f589266dd5052dca82f"}}, {0xbb, &(0x7f00000001c0)=@string={0xbb, 0x3, "d8bb1ddb23075f55199114eabc21f98f951a5f976c34ba60f1ab5bea8aec3f2081d97b5438ffceccf0e938606f72d99263a45f71a6b6283ad9c1d19cd6c7af1ed86667bbdb88bd20911ab4f24fd8236de9869201779ce6ca276024232fb33238bc092ab1f7076ce9bf21dadca8afb3ed2d53e0e1eed759aaaba72e13055068812f4ba596a5e169071ef8e7703d8fbc5cac18e2fae2fb5c16b9dbe9997ab7db9d4f921fcda25e3d950efb133355f5397877868b842ddf4e20eb"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1404}}, {0x34, &(0x7f0000000640)=@string={0x34, 0x3, "50ab8eaed1c4f774bd9eb1087b91025bc4172a274ed33847a2cc14c9d727e62e28e1049552720b13b04a2fcbf2421f9d233f"}}]}) r7 = socket$inet6_icmp(0xa, 0x2, 0x3a) getsockopt$inet6_int(r7, 0x29, 0x4b, 0x0, &(0x7f0000000e00)) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') writev(r8, &(0x7f00000012c0)=[{&(0x7f0000000100)="dd", 0x1}], 0x1) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r9, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10) 21m23.624648971s ago: executing program 1 (id=949): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000002e40)={0x0, 0x0, &(0x7f0000002e00)={&(0x7f0000002d00)={0x20, 0x0, 0x8, 0x801, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4000100) writev(0xffffffffffffffff, 0x0, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r1, 0x0, 0x20004040) r2 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r2, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000040)={r2}) migrate_pages(0x0, 0x200, &(0x7f0000000000)=0xffffffff7fffffff, &(0x7f00000000c0)=0x3) 21m19.700739449s ago: executing program 1 (id=956): r0 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) r2 = fsopen(&(0x7f0000000080)='hfsplus\x00', 0x1) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000080)=0x40000) write$dsp(r1, 0x0, 0xfffffe59) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r4, 0x5760, 0x1f) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="180000001800070102000000000000fa127c000004000180"], 0x18}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r5) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8b32, &(0x7f0000000080)={'virt_wifi0\x00', @multicast}) r6 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f010000000000000000000905810340000000000905820260000000000905030208"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r6, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r4, 0x100000000000f7) sync_file_range(r5, 0x1d, 0x7, 0x0) read$watch_queue(r3, &(0x7f0000000000)=""/18, 0x12) keyctl$revoke(0x3, r0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) syz_usb_connect$uac2(0x5, 0x11d, &(0x7f0000000300)={{0x12, 0x1, 0x1, 0x0, 0x0, 0x0, 0x8, 0x86a, 0x1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x10b, 0x3, 0x1, 0x40, 0x60, 0x29, {0x8, 0xb, 0x0, 0x0, 0x1, 0x8, 0x20, 0x4}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x8001, 0x1, 0x30, 0x5}, [@feature_unit={0xf, 0x24, 0x6, 0x2, 0x1, [0xff, 0x6, 0x3, 0x7, 0x0]}, @feature_unit={0x7, 0x24, 0x6, 0x1, 0x6, [0x1]}, @source_unit={0x8, 0x24, 0xa, 0x3, 0x3, 0xc, 0x8, 0x2}, @effect_unit={0x9, 0x24, 0x7, 0x3, 0x1, 0x6, [0x2]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0xe, 0x1, 0x6, 0x40, "1d"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x5, 0xff31, 0x94, 0x1}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0xa}, @as_header={0x10, 0x24, 0x1, 0x7, 0x2, 0x0, 0x3, 0x8, 0xd, 0xff}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x8, 0x8, 0x2, "701f0c125d"}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x4, 0x1, 0x7, 0x80, "327d2171fb9eb02266"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x7, 0xe2, 0x8, {0x8, 0x25, 0x1, 0x80, 0xf, 0xe0, 0xfc80}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0x4}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x6}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x8, 0x9f, 0x40, "59fbc181"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x8, 0x9a, 0x5, "dc6fdcef5e8bde3c6a"}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x9, 0x2, 0x0, 0xb}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x4, 0x2, 0x1, {0x8, 0x25, 0x1, 0x80, 0x0, 0x4, 0x3}}}}}}}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x200, 0x9, 0x0, 0x9a, 0x8, 0x4d}, 0x0, 0x0, 0x5, [{0x39, &(0x7f00000005c0)=@string={0x39, 0x3, "1d303e48c2ae2e92a79b9ebe6c2b22f57581331a2297d5541ad68f8116c06ca5821e331e269d550a08bdf192bd61e6f04a008f07d1e8a9"}}, {0xbf, &(0x7f00000004c0)=@string={0xbf, 0x3, "be5faa3d536d0971c2cc8ee786bfd4451c88088fd9d8f164f0fc0c51d71971bdb81571d3749b43ee1918196e1e11b19c0732994d9fa1afec20fef226de8dd091077e454ce7957a21643323262092e02f3c775d38dfe79cfb4790a77cdb65417a942f77c0ebc067d9ad64ca27c49de37d72740039d2c48fa175a4774ce2e8c73b444bbf788066533de53ed66d6118b884a9843c2171ec8ff6ddc3a37a597d0fe86a82b1fe7f9cc3bb821ef29b795c5a38a05515382c8ef17a38e969492f"}}, {0xbb, &(0x7f00000001c0)=@string={0xbb, 0x3, "d8bb1ddb23075f55199114eabc21f98f951a5f976c34ba60f1ab5bea8aec3f2081d97b5438ffceccf0e938606f72d99263a45f71a6b6283ad9c1d19cd6c7af1ed86667bbdb88bd20911ab4f24fd8236de9869201779ce6ca276024232fb33238bc092ab1f7076ce9bf21dadca8afb3ed2d53e0e1eed759aaaba72e13055068812f4ba596a5e169071ef8e7703d8fbc5cac18e2fae2fb5c16b9dbe9997ab7db9d4f921fcda25e3d950efb133355f5397877868b842ddf4e20eb"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1404}}, {0x34, &(0x7f0000000640)=@string={0x34, 0x3, "50ab8eaed1c4f774bd9eb1087b91025bc4172a274ed33847a2cc14c9d727e62e28e1049552720b13b04a2fcbf2421f9d233f"}}]}) r7 = socket$inet6_icmp(0xa, 0x2, 0x3a) getsockopt$inet6_int(r7, 0x29, 0x4b, 0x0, &(0x7f0000000e00)) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') writev(r8, &(0x7f00000012c0)=[{&(0x7f0000000100)="dd", 0x1}], 0x1) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r9, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10) 21m15.370607183s ago: executing program 1 (id=964): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0xfffffffffffffff2, 0x10, 0x421, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x2240}, [@IFLA_NUM_TX_QUEUES={0x0, 0x1f, 0xffffffff}]}, 0x40}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="640000000206030000000000000000000000000005000100070000000900020073797a3100000000140007800500150000"], 0x64}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mknod(&(0x7f00000000c0)='./bus\x00', 0x8000, 0xd02) listen(0xffffffffffffffff, 0x5) syz_emit_ethernet(0x4a, &(0x7f00000005c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000081001000080049b4003800000000a3069078ac1414bbac1414aa070f09e00000027f00000100000000004e", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB], 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r6, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) mlockall(0x3) syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000040)=ANY=[@ANYBLOB="1214000300000020da0b144040000102030109026e000301021080080b0001012130090904000000010130000a2401060a0007000000090401000001023000090401010101023000090501092000fc7f8b0a25250104000000050009040200000102300009040201010102300009058209200006064f0a252500000000040800"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) 21m9.140365935s ago: executing program 1 (id=970): socket$inet_udp(0x2, 0x2, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/51, 0x0, 0xe000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f0000000740)=""/182, 0x0, 0x9000}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0xe0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4c0142, 0x161) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) setrlimit(0xd, &(0x7f0000000040)={0x3, 0x7}) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r2, r2, 0x0, 0x200000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x58, 0x24, 0xe0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x1, 0x6, 0xa00, 0x3, 0xffffffff, 0x20102}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0x7fffffff, 0x155}}]}}}]}, 0x58}}, 0x4000080) bind$packet(r3, &(0x7f0000000040)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r3, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000400000000000000faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0x124, 0x880, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/1/root/var\x00', 0x1ff) 21m5.46532375s ago: executing program 1 (id=975): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r0, &(0x7f0000000700)={0x27, 0x1, 0x0, 0x5, 0x0, 0x0, 'urn:nfc:sn:snep\x00', 0xf}, 0x60) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000340)={0x0, &(0x7f0000000040)}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xff, 0xfdfffffffffffffc}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000000700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000015c0)=ANY=[@ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r6}, &(0x7f00000006c0), &(0x7f0000000700)=r5}, 0x20) sendmsg$inet(r4, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 21m4.498975237s ago: executing program 1 (id=978): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0xfffffffffffffff2, 0x10, 0x421, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x2240}, [@IFLA_NUM_TX_QUEUES={0x0, 0x1f, 0xffffffff}]}, 0x40}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="640000000206030000000000000000000000000005000100070000000900020073797a3100000000140007800500150000"], 0x64}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="6000000009060300f100100000000000050000400900020073797a3100000000050001000700000038000780060004404e21000005000700ff0000000c0001c008000140e00040000c00028008000140e00000020c00148008000140"], 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mknod(&(0x7f00000000c0)='./bus\x00', 0x8000, 0xd02) listen(0xffffffffffffffff, 0x5) syz_emit_ethernet(0x4a, &(0x7f00000005c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000081001000080049b4003800000000a3069078ac1414bbac1414aa070f09e00000027f00000100000000004e", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB], 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r7, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) mlockall(0x3) syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000040)=ANY=[@ANYBLOB="1214000300000020da0b144040000102030109026e000301021080080b0001012130090904000000010130000a2401060a0007000000090401000001023000090401010101023000090501092000fc7f8b0a25250104000000050009040200000102300009040201010102300009058209200006064f0a252500000000040800"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) 20m46.531612003s ago: executing program 33 (id=978): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0xfffffffffffffff2, 0x10, 0x421, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x2240}, [@IFLA_NUM_TX_QUEUES={0x0, 0x1f, 0xffffffff}]}, 0x40}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="640000000206030000000000000000000000000005000100070000000900020073797a3100000000140007800500150000"], 0x64}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="6000000009060300f100100000000000050000400900020073797a3100000000050001000700000038000780060004404e21000005000700ff0000000c0001c008000140e00040000c00028008000140e00000020c00148008000140"], 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mknod(&(0x7f00000000c0)='./bus\x00', 0x8000, 0xd02) listen(0xffffffffffffffff, 0x5) syz_emit_ethernet(0x4a, &(0x7f00000005c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000081001000080049b4003800000000a3069078ac1414bbac1414aa070f09e00000027f00000100000000004e", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB], 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r7, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) mlockall(0x3) syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000040)=ANY=[@ANYBLOB="1214000300000020da0b144040000102030109026e000301021080080b0001012130090904000000010130000a2401060a0007000000090401000001023000090401010101023000090501092000fc7f8b0a25250104000000050009040200000102300009040201010102300009058209200006064f0a252500000000040800"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) 4m22.855671176s ago: executing program 6 (id=3025): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setxattr$incfs_metadata(0x0, &(0x7f0000000040), 0x0, 0x0, 0x2) 4m22.62101984s ago: executing program 6 (id=3026): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) ioctl$FE_GET_PROPERTY(r0, 0x80106f53, &(0x7f0000000400)={0x4, &(0x7f00000006c0)=[{0x3c, '\x00', @data=0x3a6, 0x8}, {0x25, '\x00', @buffer={"1a1ce1ba1b497db100000400", 0x20}, 0x33}, {0x2b, '\x00', @data=0x7c7, 0x9b10}, {0x3e, '\x00', @st={0x4, [{0x2, @uvalue=0x3}, {0x1, @svalue=0x7}, {0x1, @uvalue=0xb}, {0x2, @svalue=0x8}]}, 0x2}]}) 4m22.522779597s ago: executing program 6 (id=3027): mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d4e, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000280), 0x1000000, &(0x7f0000000600)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xc000}}) syz_fuse_handle_req(r0, &(0x7f0000009b40)="de98ee653502c564abeb97fc678bde22efebcf99c2d89952950acc703a3c6268a54c8b1bd1ee165c82980cd315b55a070dc41deeb2d4c1842d936a0bcde5fd7ed6031fdd9cb58ebfe8261528f097f309813b5722c24a1af8e6bc6ddaef7e85d2659690154bc5e6ee73c3fe7176509ad7b30e1098fc9873db91d3c1816825e710374de8d40693578b598922d9c523cfff93a630f121251d17ad40bce021d7fd57945fe2a186618a40b5f3995a9f0ceaa3e22b57e4f68e53fffeb5474fb83afaf5cde6b0aaf5cf0313ede442ddf1df6c280921e43d80dddfd005969272e1719b37fd8f749fcde83f8201826b4cf5b1c1da394568aa7d8833dd11309f46422b0152ede5ab29b17bc1ae80147346155b20a98d6fc2650bec3fe73327c45cad1b38f7c983cd070556a8f8ed5d58e1052f6436fad905099d18fb3e62c2c36a1c2209a94c820e30e5234e77be3beb4cd183015d281e7bf39cdcf0f1e541211c75d64a49b55ba4c2c444bef36d98df66bea814bab91ed65386d6a491a6295c24dbaf752a5e7a856e0dfe46a6f9e718ca3919c6f8978b0fd65c9e389114e5afd8e9e2a575b854463b63f46d08795f0f1d0d48d6d610fd74e9238de32ee3fa2ffef550336341803c083ac1d749be6c5440bbe4bd3bc3015bcde2b4e2160ba266d281a9641f74d9348fb6fa8550d1e8a8362999452e40b75c412cfa77ab8e1aaf1a9e83c855ec9b7ada38690f0d2e59f67a1f3babbcda8011595ea720816c24726b833beaca0a9d11e7b99373601d27d18c9e29940503d3a12149fdc4fe0065c3d023d6e7712eb853df19f2b4b886e08d61629288ff16c2597d7fae5bfc8b41f92fc325ffe0f61683b1f661409bdd7c3d88a854f8393484f4669b5d9654fd3a0819a32110b9064539a7419c332629b3fc71da35b783ef7c693842ce83733a63f2e6af37989cfcb768ab8cea5d21b82a0e9f6fdcec26b0107708867dec54c4e739fe9b931b3c6da013bfae097c57f1e16ba54f9028e672511938a0ad9d681d7feebc65a2f5f588abd66261393f3ba02d7b2cf650a9f7c6a4ca55b4d41132908dc9c90e26f0da8e2259e3a2b63b2d9e27754e278827ab80438070698c690ec375a9aeb4193079a28a2a062961ba0e65af01644af063f3ebefda92c4986379f7b099b2fd3960929578736f09887fc5816cb1b982e5b121b79662d1674dd0c6e82627cf8c63e576e5c1eb0af9415ddc10ff880e8ae3ce8c4fb87b8f9d364974c2a1d8eba4e04bc2bc018bfabc435683b2551c0e4908570b930c4fd7c03ddb95e9ec1d1994e3df0305fdac4e5b914641ae25b0c469b194c0bb78ab04887cdc4262da468475b926a18254d23b4c44705aeca34ef8a7b04dd55a43f39996529a23804e054655c5ba8661f7c02737e7539650364928d62b9b8d80988232009acb54214f06640e9bc6614c0ce02e4a22dc8b91a0aad711e4fd01d7020b7c7185e41e27ce266b9f5aec682cbd4bba3240d6277b17b564937254f37afe580cba0b78c6b0cc81830eaf10d7cc1f7e918d49e935629fe6c24b4368a04af1b99f6981340ee031874f3d4b3a9ebc31719b3b775bfe1fdfa0460a3820bff6f61b49b11ac2ca00836a0c4a74aed92a619f34231196669b942e761538e64f965d23d4f7814256e876263fe5307985c4e6eb69c974f66276764e80ab1de3f5c55e7b2cfdb78dd183a85473e968918ad73f29a266c818b9bf9f62eed86df25b2577bb6d98e3996e94f5bdf119b869541a94eb3536c979c3d77cc0df7c0c48a902ca2f03f5ba5a8ef9431cf95f6fc89744e8440e1d5ebb837e30ef7541fbc27672c31566ac3676a173cb9e466a2d206ba1ebc2b985eddcd6ff937375fbc8415eba46f5ec68cfa9f3a669d41b078867dd9f5160ba45fa4719f32cf877d4b7a6d77c977533659f7c7ac22c68f5e93c1df6c2a3d45b55a4afd3355680aed864f6bbe13da2da28a4851f73c88e555f3bb1c34a21fc45ab6c28287902e8b5fcae6899c804f364cd878a8d1734462bb075cb7bc709cc2c5d7747c4c29a2fa9259752301c26b852b7993adf889d45dbe39094c9b7b168756e5b939ed10bb6df57b8f5e14352cfc7d8b03cda5b978b06cf2430af5db17177b1ef664bc4b00307f970c4fc606a6bab72125f62b0f59655c35b104da7af188a953cfc09b3aa0785abf330830fefedcc8bf9a11d5dc4b5642f679d45cb44fe61ab1d906345c1c345f6b8027bae9585580c20115d2504d9c83ab54ea2557b6d2dd3bc65fa29f091aa46a215e77621836154104e6969fa9107139a19f2e45cc6bf55422a0e1a6d037ad9e63df5f9cd2045e13ac2d6a15bc12008c4cd23782df7d41bfecc0037292d22c7b42f2cc1a22db7502332d9f4fa85f7640c8635b9469681adb6bcec2dfdf6926f1815156d80a835ae918527f549ea6df45f350f618dc1f3ca139759be28e35013034f8bbfd3fa1a8f302594213c18015305911f42e287f2d86f17d76f8a0ea03fb574c60c808669f9f4454fc2eaf0e93873f688e34bd3341f6874d5d8fe754172a751d6ab23dc1642220e7fb1071df0ee3c7e07c338915494a3b360bdc0b38ed221c2c2bc86b29744448b255802b3ddfe600c1d0f9acabb2185e4e9dae5e456d5825f516c857f63e72e4a5f3d45eaf11a0e3a5ad0ba30a0bf0f94cc99586fd202d6118bb6f9c272f6cbe39dd9b8b36ea7fa51dfe0bb87a633be11c16a14d1bce8492387696e195fa3c5f172690b4434aa2e91ce7d225d73b1983d2605ec725aae0ae402cd2f79fc202a307f1896f3dfcf8c0fd8b841dcfeda5d65bb7d76f7c2d2eb1b164c0368e9984f320a224d7d438bc5c699acbc18a587b7589e960af114afbc9f59243646557962fc2e0cb5b5bf160a313bcfd9ade3e140b808e9f19415808aa312ae9c9e8bcd5a47fc721eda59d10670088714984a71d5c0df8b68e675a8e31ec15a92ff6a04d17e0ef849c782b302d11f742efe6486ab904fd65c0aac4ec25c6d877b453dce80e894de703aa8b1e5d00701850f149fe437fd0944cb95e54a924a49bd86bb9a602cf2904fbd9e399f1cdcd0b45b6d8f872e285f9dfeaa26aa760074651393c6451b36c643dd0b7236ec7803d69cec1b09bf1b63fbb68ad7c01507f00083b184ff01a62096f386f4c8fdc85e93eecf3f4b384aec1c10ccc60d8109a6d887bd389c3406163f9600879f0e944443d783e8644f69344f6f44f7bbf1883cda7369c9b9904d991c01552135f158a0bbb7f40c354f292c034824d82c209ebc770f5b756768ae51d45f8875b59904a07090689e65b40625566eed5d209130db812f287b966ae21ba46a3a7a3a0360a4e284d8d91ba9ed9806ea063827c8dda0fa98f758cbfa523ac645421f444a40b95bb065a64256c19354b1ad5002bb7b2add9b5236ad64e9052734b9d263515683db121b5e4dc1eab244dd8fc0fc62d962834ba0b21aad872b127afc0a33c7869a3f213519aa2ef51bab9ab28ed18859fd8239841a6668fc614dedd099121ae6c220a143c119cb9bff9068f65d0554b4c12105e59a22e91203a08ab8c718ec62c42d7ebb7b495e9e1be8fb7e4aab2777025da37b48d9d7b97578841a73898a6eab994e250106e096390c77b0600537be881ab7d81e3cb468bf1fe318b1e804d8df9875e9b8da22e6244997317391cce608085a28b8d070d654a29afab324ba3eecf427b6dfd43501ec0db919f71a932897eb37fe3bd64ab5a34ec60011696298b74ddd7a3710d3e444cedcc5cdc357f9dd58e67dc0ed3fc8df6dad82b3c00b4290c3280c28f78df052ec9cdd9df025abe8834616eddd5bb93379c69092911cd60761e7d14b426a83e335bfc8bf67a14e01df7cefb6023f0c6556534b975ed889de0d96d968526372402ce3d21a2c5c64a449dc3ba4ee0b5ceabc2fa29679e225681c8e946dc94b48af024bb1633e1860c7d8c14500967f24e2f8f46db537232a4e9f4abf8408f53bb52b035bdb89917a6f2f4bd22403ad002c2d936b785ecd965177e9f6235787a185d0eca92532f1aab16756ae86ece13925ba4a1fd08125102ae08c428d073aa426c4e792b5a4acf618605df1707021ce1eed62da4ee87334e34edf43338a0076b8ec739e2c31071e10c6a853e19fbf25b8a356527a67c8f7696dc184e374f4641f4e5b0aa345f1e6c4bfeba3a392d9a994bc271717a051c98d6c5b1f3296caf4c01d80ffb75b6fbdd0a0583f9d4695a44a2878df0c09a85aaab14522320cc3d2611603a34e52da03677a60cc87cc3c689975e5b5366c82e040b6643b8865d8bea0c84cef9ff85245a8b4bc41af1a50775b29fe55e42ac4b29fe80ddaf02e8c9bd07cab823f3d9021ac88236525ec045688a2fc9c6df66f549b10720cebf09ead919524f071cd128fb7575c84190c698b420f89b3c11195b5d83022d1f7e48afc21203995caf8f9286dcd5bd51b65c1af1caadf5a1b3f12579066855ff851075adb959dc3e086a7fb4e9a27fe80e8f3c0959b042486310ae7b785b0612e0385e36f50d4cae3474dd000c3957955534b4907b9480e2e5d83dedbeb76cb78d893c5b64dd51e31abc8e8b4c56b96f67c4b6e43861d91681af3270aae1a8f50712bd97326ee46a2640285b2902f051071d5a3400e99b76459956ac6908688c314bd8e54365383a65b186a6386cc5218e41e0b386759de81bccf5aa68f8608831a9d33ad1af2bdbd8579c5921cd8c3dd2f3bf1f123c742e118c76e2f43618bb7885e44826b7417c9ca5a139d774c16fbf74c8969c038ba6a54f27bab46ecc94d6455188d8dc1edf1da715c8d9976226877096df4158eeecced2248c7b88de0dd11a076db1f06bae4adba8286dc39aa62a55233886e011622ae1cf97238914a55078a78908145295777dbbc4e0d34364e0f3daa9eba6fa54c085777b18c0523818ff8710dee4bfeb3db549c3f38dde73b99a7b1b219282407a4e0ab3794089e21f6f2045ab6254ac3703903edb302fb2f0f97e47cca7969ad6b5b6cf27314137a04d5f4f29c193cfc5540592ab1342a1a9cbd514a7b4d6b23f724a5d7bfa6ffe8e3d9de29b8661139f179a0fafecf234f19bee75c25faffc765e02377d83e0ad0a0029c08f5c71595bc1b2fe88f0fe958f3f1f8ba6821ab834cab9bc902b2d47bd4b5ed52b5b0d7b3bc999b2f68879be39ddcb0428ce3a617b68c11459b746651f413d9e9a098cd2b5c0fcfd0ea1db2cde1672818d7bc73b053015692f9e9259a0153e3c9ac5e73e3343dd350cfbcaa57be93cc881a35063aec2db4ed71df2b1bd90b5ecbd84f399d4530c5450d622188423e151cec49673dc633e503c497d53843f4824750dc09abae9f2f465e92888715b6879f5edbab7bcd58f0899e1430ffb5f3063450945cb0fb3b5c3088ed6966c54dddae3aab489a80341b45a17cac02ae62749f209a7e16ecdfd86b43569c7b34511c65474acf2b2c18834e158e20957bf2320e4a6b9d63caea93b3a7dd4f7ba54443aba1ac2b6f2b27e1bf6f17d3fd1582462e0debc7069bb70e219654cbb99adfed54ab94329382163f2ab6710bb581d189cb3449a02c917c1f2d1d5f51958ce605fdb0e37ae5f3cb3f123276d43b2c26ea948dee863e0b679ecddf0fe41ce78bbca30167c9c7d6b0e9193c98090facd7205a490727e1ac49bb4d639348a32546007459c61c27bf8df87dd2ed3f3228b8193422a72d15f848bac13c6ffa7b8a767cf04866feb7c7a81267d7a8e890128d4709e4873223578aa7febdd562403c6092c0a3f6e0650772ede935ab6ef95e375bcbfa395e23ef1d73532388b845a95f158dc845a123f798176c73e177926d39abd38a910d40653006375110be2f2c5f6efc87b31908be36dd07c8ba5853519a37dfc4dea981af855293f49a3270bb67cdc17b780fbf2a418fcec8953dae927909a6bbbdce230d23113efad9c02474682dafc63311050cb4f3f86c282ff29728eefac5c678360122b4ce221bcec82d24e053b63972d2e9a631a180b48bb8d2d4de7254d91a856071df51a1d87ca7eb5d19ac3def1fdd6ebd8f57c2c9e43cb6ff2fa00d27f279368f5ee29a84ba219a51d1f0f1965781164edbb3aa6209fbce6d40284fbb4a33f59bf9e1248100a623de16613eebc11f510b7718dde9f13b4c9b2b6a10dd932696cdb7fa4b5733b0377453471462762457d42038ebf8c0fb392ca7656ad1f050c326de75fffc698c48f5d809ae360ddb9856b9a54b811073233294bf91e46414441b6665f432201da12e49718b0d7929b6cbcbf310a09ce0d22f07ee5cfa8ffb9f03acd224641171ffafdf50f18be8fa3c907226cc1a6f3b16a776781a6396dbf09f689ad6bba4d537dad490a6f036a45ee3e224e6f519e44b7352ee3e7d3f0d89f8c7c8f54b6d2698c0298a07866c9d9ca09c96c2ac8efd7974294df6dd1bb0598debadb6135e7123bbfddf84870de54476a291586fc0e64784e65fdf78d462e8b51cbac38e7ff1878b11418f188220e3deb5367a2d90ad7d44395f6965cc6d680c59daac268c16814d1085302d0453b48e4a8ae78b8a5b6951a875ef42776f6d11955da7e5734a72b61cefcc6889b8f8d58db51ee78d7b1a8ffebd90e15a64654054767aaec24dd3b5f338b572496c8731049c10622b7f54fdfa43aaea316946291fee7bc9e64640e8bccf33fd1e8693b67020b49cf77faaaa8269e2fecc4e2b43c8c3378a4a9b9b85a4fe2c346c5512cda631542e0ff5706eba996f4f72e629b076d6be1966d44b1835ce664e3c6a4f18c68f5e32f900a0a167e547d5aa79c0aede966f83d00366a623ef8107e328654c8558d5e606f69a12b6c2a6fcbe0e08f945c4ad2738ed0b28d79c98514abe0819569c6e4f4751c665fd651aaa9ee392c330560ef6d57c0a97f0764f88433b2bf7641ba391634316b0ee1dac23a63be21270e50ea1ac24ac3b429a0b46c38dbd48c540bfb1e141b8b3df6caa179c7e54f2b7b1371e8eb05a30f13da95200ab70dc58325f6bea0ee9fe1f04154998df393f2b4ff4431363f3a7450fa5210e883d67620ae63cc41f72e74e26a0244de1ac722b6f1c1d293f7483b331a0efda65a4e4e9144547fe6dce2f4535e29048b07079329b63754bb124b9e046a6e97929b1f4a387765bf93804530791c9f649db6efbebebf46fa4f9af7ff2587130d0e70a32d4aab1dfbee6aadd1f3e5317e3d4c8cde75b1479bc3dd16ea35db3dca11cf1eb1d2bbac60b83605e171619d85fd4b6d0e24be8db76df12efef05eb87473b832e59f3039df44ef034e5e7546b399cc817a41b2f020286ff139072a5b909ebb185a3c955cf88f4a9929b2112e0a9ab43da0288ce3ea268ccc9f46f852d387f5d0a2831dfc8cb0bf593905ba376c069b8c9b70558ec826c5bf9835031199c4c6d84c913da7e9e7db49c1d34511d917b9ad3c40af0598737d58fd61b8f2adc46b73a284957a99943cf73414412fa5440a5f85b63c20794d122c267fba72bfcd0e2741642fd8ff5a0ae1ffd8b30d852c053d0e31f505ca13a21c0223a8ee77cdd92de1b9f87ebee4ea332e9d4573d7efb2ad3f50c35fb7a596c4edb4b72bf6df5a16ffe3c8a236f2cab8c0712ac26c2cbcc68c1dc45209b579c952c7d645642aeed7d60407ee2dc168179d536da950108e962c5c976d3a05bf5142466ee38939ee94e707a0135f99c99b5d6376f63c711e4f64950f08dbc931c812f34735d9eb1c5997770d8159068cdca2e0f192311ca438d613728b544d6a3e50ae0e4e6b1eb611ce55a96bb2f991d49173073d8547f5ede69d8b587a34bb8f637297a15ab4fc45f1384bbd19b3feab5fb81322ba831386eeb6067e55af374c1b1eb9613a6c41dfe2bbbcfad157dd042c67c44400b350f0dc40a8611f2e947f32ea3ac3f609027b5dbc95b157c13216fe7c35edcc82950bd4e38bcb02b63d2576489c331a222e013e73b5333694889b184bedbbb6fdd6fd40a62b1d5d494e68cd2aefc264f74bf70ef38373e599faaa326f574ae32b1aad86854af22db8c9673d14666aa7c0c3bbe0d76a835ba4b391552777ed20c5c6cd0aa84f3be73ca0a3c128914107fb8fc02220317fb111cf13398480cd3325582a7e55f4c4ef5a258bcd01a97615e95f89c8064d41d04340b88cd5f4b1d827a030637145d98422facadbbbce97dc3060402a7bfa73d7b4dde53184a0923c0ee29c6e8e2c35e396808df2481af6aab053b619fcb2833f14f87051c5461567c5f8dd40383a7521971775493f896e18c78bad8219f88258ea686652780c03ebafb63ecbfcb23e24d52a2f88a77ed3b2280637807a5e155f4fad7149b76841772471a3b77aa42e8058c0af1ac2be9d88b5152851708f1a77582b3e31702864ee6a244a38f3f95d9797a60cddeb5ddf08cc48fc677f03f9e717ebe7f472883e5a6a7df31ca4272228f26991460c537ebc8aecb6a0c34a763eb1f57124fbfafd6db4c21bedf6723b252aeb21eb1fd9f4f811fd3e2e764422964761b2ef3aaaf986a48f7be66f6387578f9492feebc97dfbc6bc97380394a5635dbe582e52a1fb18ea8fc4e53974c63d198cf0d878ba8a8d58688a037c0f753c7073337ef3da4c134ef939c98c8806d09943591e6013a1342de7c722f993fd7eb36ba8e8407d1ea60eb5724b0d6262c70469dbd8ea1956b8d7f5a77707a9cbe2137079e7abda3966c5bee4fd86e8a3c4969bc88ff328a2adc8f4546f647575866d5ced16df06bf40d9a5f178f9d19e490bd76e187c441e7de0e571f6cea5512ec9bea48903d91a519dc82defe34a06b0244d623090b5a250786bbc66c1e76db6b18d81ed33c81a7c93782d5cdbe0a7cf7d1ab29c04be6ff4a9bbc10f716a67d52fd52d91425abd2002cf83c3797861db5fbeaec745a552ca4a50604340f2cf2c1b10e9ba76c8ea43b283c73f774f8be213f17f70cf93b9f6a8bab1f516a935e80c3cc6756945edafd572e6e00840eedf61fc40351869f03562d8c13006de585a1141c02f1311fbc8e45e4b3878c32810698e4764a6e8495f165eefee35714a1794f9ab50897c5565ab745425933d9d6272a172c1f2a274f9ca7bc8e1b01a27b8bd06fd9dc61880789696348c99e9a70c9dd2a62ca04d1f86dc87380b618c2a78b16229d614702fce242fa17ea90cda2648f9375bf7e78b4267d558983e08a9566d95871998d23cc6d22c23370ae067b677609844abc140df81cbd9addbf657fffaab5c22c479acca18f3e4b508cf01ff7b2ca308ff116389790f26f2c7635f89c747a5bc66f61de575653069349a89fd7e3dd785266b7bccf16eb8b4a8a86751de60d33e17d64f6e4e0f9d13a16d243ad7364114db7ad011f094c4debf20a39e35e7eeb440bbe8811db2857b965edd1e2675ceb1bc9a1691f123dedb341962fbbe539485d2241b0409adce2587d035187a0dd5a62076ac4eb5c3e2f4455569b6eac0fc16155da1774cbe505dc92e2087585a7846bae699bef32e3c5ec2356dd4433ed29d4b03ff7b38f7b3cb96b92874eefda6c2e0e326214e40f14cc2ef80e1cd3fe226257a423b8ff5bb368b87ac7066c5136487775b5b122a858334c37f6a3f53d758c3c866e2e79daf9aeab36a59eddbae2fa5b6d20973014196ef0a4cde1373c7297833e6f1e46828f4a42eebd829dd4f17999abe285218ed5dc6007b21bceb588a213b29dbb1ab1a79b41a12df26fe35f0cf6a310c9e50cf10d71ad5960626e4efec211032ec4ae52512001362ba4108d86eb774d2d4d0364cbb1dae68f03a774e328c2dc09899ee80c05ac2a8e3ba905b0b3b7a08a3df20b505901123e7dc0a15db48d09c84189ca4345c23c2010c12cc35287fad30211cab9631e148a7c1e8bfab61ced30e098d1c3cf7b6a7fbd8288dfdc48044d0d47c17f129f6b5d751af1984d395ab1b08ccca3e7309a89a8a36dfc3fb82d2a4269bffc32571438d04a7b98137b46ae1fea1bd9ea64f99e2f0c5f12ed84886b10bbd511993b0447036c4e57b9dae6d5bdad6aa3f2d12e62471194e43111613b8b6944c2baf1f539ea14dd76c356bfef7e3d4b6fb91f6d321a796a4bce5a4c6a5caaf0f3eccd914dea21ae909be7ba486075ff6139e7e351fdd7e98013ba51ff0248852398c734f245ffd7fde8cacfa4805496ad7350b1c96d7bf9da9be492f2f414e973937ac9109b6e8b8315aa9b81840f2c21239caf85a28f0e590bb6ad12148e75bd4d7ea69a9ffb053781db98d5fb5aca30a734017be7683a559c203c006ecd4b135afe3650b906e0aa208c889f2af09f3f8263260c3bd07cf8021124b6f0e0d021f9839e47996905c3d7562df810484552de3bcc9ae054b62a01af6a7991e4d63f30c7a92d8b58e01052e53818e64d7540a3208af321709a5d891ceecae5d27a999b00ed01616a73ec8854ca61973ed1fd3d82f8628b215c55eb7908e297d77098a7b0c362709005a7d13c89c54556589b2a926c6e08cc1c0afebc7eeb5d7ae4ef0507c91b8e706e6dbf83d898819192c812554ad1c6377871a8ca50f1325630f7b5266b807ef61d0c8d399fada49cb02a14c16d39f4fa7b81272573808e761c9dce7cfd12f4f18dd06b0ee471c166e095bf84aa4aaa2d82f1afcf09e5d960257c0a8dc404225b4b62187829c59e57da50bf848d72fabfb69362c117c6913541f84095a2a4ccdd2d30860cd96640bb2315e435a4af08c62c584ad129300adb02a871f3c548b96c4f6c47efdf4a1163a8a5ba9b4766b01437bc5957324660a8cd87df0f7e000d1309e896e3ce9f57b17562c9368a95a4cf66b3a5b57f0cca563b045452bbc8ad07b96fd0322728ccb3b05bfda14ef36ecfa2f32c5aa899811a67f2d62ed970db5723d6e4e4913c98c81ed6c03469112c23549f7e20be6401c6544db9078f34e6a4ad3cc868bace2e7ec6ea17225986f9e941ec67d9a3fc57958f9df8a60f585aa38b1769e26ed3f68dd85685b2cefae9dd72a18abc0de6b94689785df377ef4a812a6abc7f738a396f0e99ccbc5731801c36e746ab6b1dda88ca6ecb899528e18543cb3dfd439cd5be566594f01a4533da3638e6331fedf5b67870938ad044aa0dfdae33e3a6258ad40baadd726eacb1f3c1eb8d83ef4e185d7603a4f1eb006d90bf5849e2f65d37ffe750eb061bbad08a0c0cfabb9abf7f27d36ee5687d23feaa923e09d2ae905410a9193f21ed9b1d6331bb1f3babb90da2f2e023a6ceda4b4fe0f5d864738ee7f65a0b136021fbe076b4adf2d3af760e1361bad7ae35cb7ca010ddf4488255a2d3c492d0b26a1a5643f998b5d04a52a59f176d9bda85c916ff901329f09fe953b030b92f6415172476ad89d3e8cdcb4eda7dde5d4fcd5d6a584a312563558e784b0f9bcea7c53d26c3f2d3350c70a5e06a67c4c0373dd6279e29c320e6580fba8ab2df3039c289235c066af1b07dd112f25b25e292020f36c1aba246cba4e054d64b38f53ed57a712dffad7d3dc97f86af511638a2779107fc55da63b6498ea5f3ae36883163e5bf2324211a61a9889278f828e58daae797fdba9218d322da7aa23db7a48a00", 0x2000, &(0x7f0000007a80)={&(0x7f0000006400)={0x50, 0xffffffffffffffda, 0x1ff, {0x7, 0x29, 0x1, 0x24ff871999e0dde7, 0xdcf, 0x4005, 0xb, 0x800, 0x0, 0x0, 0x100, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) llistxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=""/249, 0xf9) 4m22.352361914s ago: executing program 6 (id=3028): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 4m22.20135064s ago: executing program 6 (id=3029): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) 4m22.006436459s ago: executing program 6 (id=3031): mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x88201) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x3, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) 4m6.898095019s ago: executing program 34 (id=3031): mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x88201) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x3, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) 2m56.920426798s ago: executing program 2 (id=3637): r0 = socket$nl_generic(0x10, 0x3, 0x10) write(r0, &(0x7f00000001c0)="54000000270001000000000000000000060100002000018008000200096370001400010002000801000000000000e00000000000200001800800020074637000140001000200080200dc00"/85, 0x55) 2m55.30574776s ago: executing program 2 (id=3649): socket$unix(0x1, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x100) write(r1, &(0x7f0000000000)='3', 0x4e) socket$kcm(0x10, 0x2, 0x0) write(r0, &(0x7f0000000500)='md0', 0x3) 2m54.940855313s ago: executing program 2 (id=3656): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="01000000040000000200000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000b98cad95850000000100000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) sendmsg$unix(r2, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 2m54.86726854s ago: executing program 2 (id=3659): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000240)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r2 = socket(0xa, 0x1, 0x0) ioctl(r2, 0x8916, &(0x7f0000000240)) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000300010000004500000025000000190011000600ad000200000000000006040000000000000000", 0x39}], 0x1) 2m54.749513815s ago: executing program 2 (id=3661): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x121040, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz2\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz2/cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000100), 0x12) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/syz2/memory.limit_in_bytes\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='4', 0x1) 2m54.492769004s ago: executing program 2 (id=3668): syz_open_dev$video4linux(0x0, 0x1346, 0x0) r0 = syz_open_dev$usbfs(0x0, 0x204, 0x2) mmap(&(0x7f00001fb000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r0, 0xb2755000) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, 0x0, 0x80) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x32cc0000) socket$nl_netfilter(0x10, 0x3, 0xc) setgroups(0x0, 0x0) setregid(0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x8800}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) sendmsg$IPSET_CMD_TEST(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)={0x54, 0xb, 0x6, 0x301, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x5e}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x4800) 2m39.350421185s ago: executing program 35 (id=3668): syz_open_dev$video4linux(0x0, 0x1346, 0x0) r0 = syz_open_dev$usbfs(0x0, 0x204, 0x2) mmap(&(0x7f00001fb000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r0, 0xb2755000) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, 0x0, 0x80) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x32cc0000) socket$nl_netfilter(0x10, 0x3, 0xc) setgroups(0x0, 0x0) setregid(0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x8800}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) sendmsg$IPSET_CMD_TEST(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)={0x54, 0xb, 0x6, 0x301, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x5e}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x4800) 7.66862667s ago: executing program 3 (id=5180): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) pipe2$watch_queue(0x0, 0x80) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x2, 0x5) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x3}}, 0x48) r3 = socket$netlink(0x10, 0x3, 0x10) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000001d80)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x400c004}, 0x20001004) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000200)={'team0\x00', &(0x7f00000005c0)=@ethtool_link_settings={0x4c, 0x4, 0x1, 0x6, 0x7, 0x0, 0x0, 0x0, 0xc, 0x4, [0x2, 0x9, 0x0, 0xfd, 0x5, 0x0, 0x0, 0x2]}}) 6.58536259s ago: executing program 3 (id=5182): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004051045f500001010203020902350001020080300904000005ff00000007058102000200070501020002000705820200020007050202000200070583030a"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/ttyUSB0\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='7', 0x1) 5.445639274s ago: executing program 5 (id=5196): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d1}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x0) 5.348521376s ago: executing program 5 (id=5198): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000280)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) connect$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x48, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}}, 0x14) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x80010, r4, 0xa94000) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0x80000001, 0xffffffff}, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_score_adj\x00') write$tcp_mem(r6, &(0x7f0000000100)={0xf, 0x20, 0x1cd, 0x20, 0x2}, 0x48) ioctl$TCSETS(r5, 0x40045431, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001a80)=@newtfilter={0x44, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xffff, 0xfff3}, {0x0, 0xfff3}, {0xb, 0x10}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ENC_IP_TTL_MASK={0x5, 0x53, 0x4c}, @TCA_FLOWER_KEY_ENC_IP_TTL={0x5, 0x52, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r9 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r9, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r10 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r10, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r12, 0x1, 0x70bd2a, 0x0, {{}, {}, {0x14, 0x19, {0x0, 0x1}}}}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x4080) 4.497909259s ago: executing program 3 (id=5201): r0 = syz_ublk_setup_io_uring(0xd, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, 0x0) syz_ublk_add_dev(r0, r1, r2, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x7, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, 0x0) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x72d, 0x100, 0x8, 0x390}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x90, &(0x7f0000000440)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) r9 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) syz_ublk_setup_queues(r9, r8, &(0x7f0000000340)={0x0, 0x0, 0x10, 0x5, 0x2e3}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x880000, 0x20, 0x1000000, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdd52, 0x40000, 0x2, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x8c, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8af2, 0x2, 0x8, 0x9d7c}}], 0x1, &(0x7f00000014c0)={0x2e, 0x1f, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r7, '\x00', {0x3, 0x5, 0x0, 0x0}}, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000390000/0x1000)=nil) 3.811554598s ago: executing program 4 (id=5205): r0 = syz_open_procfs$namespace(0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4d073c420f4cba7b, 0x113, r0, 0x2000) r1 = openat$fault_inject(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYRES64, @ANYBLOB="a5a2c3418223c5dce05bb57e97d969b21048ce2d45e340b694faeceb59517182a36a74122230cd4d174b76e021d8b2e7cfa32fcb835dee8f239e120186cb5020396f8841c8b182a1b9633b5bcf2d701286cced963058e2b6a20fc403a0c5c51b885e4b148045859b37d0c81cd19c544f69328d77c1d9fce63d4726d8f0", @ANYRES16, @ANYRESHEX, @ANYRESOCT, @ANYRESOCT, @ANYRESDEC, @ANYRES16=r1, @ANYBLOB="ae1aaa22d260307ef70e7befd4605968734c2b208b5ad04ca903341de10e948cd3353e768582acba43370f4169c59e611ef2a0ec88a2599b3681a3a23fd6d4707e1f3516a607ae446d31eb4a14d8b86288798a6aa2dcbe3cfe9c2976815f17ba8c5a52eae251155d71075526e017f8d8328fc2394099dbb8a117a0df8b71a259b5"], 0x0, 0x4e}, 0x28) request_key(0x0, &(0x7f0000000380)={'syz', 0x3}, 0x0, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74"], 0x0, 0x8e}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, 0x0, &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$PTP_EXTTS_REQUEST2(r5, 0x40103d0b, &(0x7f0000000d80)={0x7fff, 0x8}) 2.623399957s ago: executing program 3 (id=5207): r0 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r0, 0x0, 0x922bac8556bdad8e) 2.355901972s ago: executing program 8 (id=5210): connect$tipc(0xffffffffffffffff, &(0x7f0000003100)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x2}}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f40)=[{{0x0, 0x15, &(0x7f00000016c0)=[{&(0x7f00000002c0)="91199893b794f675ec88239fef317c764ee3a8ecbdc2a8c32d46f77944d1de9f924d05d3566b8eb8f5750393c669559d05543efa2927ef0d2b10e3d4f8541f34e1c7c8ca2d1e811f67f3dc50fdd469af72a49e684e28a364f5da124dff2b55a5536aa670b82da70bf0f19cd420371848ddc41d65649fde307c1971599f2fec84845e32bb2b6ebda099de12e8b64842024389524a1c5a97608000d1030d99e2a6e23a0bc8", 0xa4}, {&(0x7f0000000380)="11a68683394e1541cc444dff7adf30f079408cb066a6f8f4d33c4f11850de78c586d1a2ccff92e8e83fb82e447d9b88de42182e9e8c97415f41ef8a504215a2b2fdb1404c9659fdb988d0f527c3675cf2b", 0x51}, {&(0x7f0000000400)="875ad17d55c11f1ea6ec6cd17661afc73209e32142961e4660591bf3ca40d05a507ac0b0e71f7ed4c63f52a003cc8102f20dc6e33b5dc6de64ac815cf87867507cc072f0cb762aa5deb8731a699d3c7c69f85266ba51eb244f20129de491adaeb0c2d2eb13c1f215ddff92b05148f0ad513018b14798e45e55ecb916d4dd89f2df7e33c470998f325bf453f929d86196", 0x90}, {&(0x7f00000004c0)="1273dd9951adeaefffe3c4957c86dbff8693adf2202b620b3aec000cf330bb7249", 0x21}, {&(0x7f0000000500)="4167c4fd9ea8b423c01e798bbd631e888a04e31e6865a2d55b31833b82989759c0f3241bb5ebe979636a5f22244112d95d11a07cb172724ec37ef9faaf227d64f5190c9d82dfe194b2cf6d77e917e513170fa1e8e4c82dd9898b4ad23e677261595ec62844104d7ca15aa7eec90685ad92f2cd5b745910e47d703315a0d1d3a6d143575da2604e54bb1ddb295e590a1392770befa52aaf1651d375682bcf94e5da4ea37e1cde1d2a80890d896cfe4d08801bc50d9bc08480de2b2710b694ff7fb5bda12cd8a8cb8dc18bf0c265b71aef50ec0ee22e1968a4f3487d8487026bc2b721692064dcfdd1b6b6aec3e8da3d0ab7d3cc51e2db33c169e6354ea425fbfc1bc39057e64d3aff3749d60edcf0a50fe0e973b5ee3a7cd45ad967564fdbc9832869346037dabe420448b5089ab553c2c87e94befac8d3a0c2a56ca2ab778c2f34f571217c837580e8a524db35baea8024482bb32306182faaf39bb1c4e992c4440889e274952ed3d17d5e87224fec8048e6b7344270e046ab2fdda270ad4e5f651fd6eede5d42d9599265520d45d6f500fd733372a62ab4f496b56839b0d6418961a3b6016c26409daba4f2beeceeb38cc6ba75f57e8ee45d8a6c2ecc031c9469d937b9d7db91ded158ebd7f7d512d445f4104130a429ce7fce52d3fec37df953fc6e6adaa781b820b4bb6d4ffd2c10a16f9583890118793bae09157d3ac5625ad8e66a367488e2722bb82161661711d91a5540a92e3de7506861875575d40465cda28989cbc46fb3d80c2bc7e96afbde1cbd2e89103c55bde669c77b774ea570b26e93a1be5e50269ea5f3355869ac5a9701ac0e7d8f69b0a3186e118c6e2ce8e946c95bd729d94d237e5915e2711cc82826f147176a8a0555b9e11fb9a8ad736d016d202cea43b10a5102e48387ab70069b876051ac0557528c14748aa9cc0e0d9bf512533bdc83610d9f801ec4ed512a4a877e2f45b0cbe87ee25a314d481153eefe8643fb2f3e0478353552b0ae863635ab12e7bf0e4f046e8ba9cb7ce3189d52b2a27ff9e4eb5bf8b12d09d610705eec149589bdd38c951de63de4e3065e45eeb261a72c980349387514cb42467e1fe5812abaf4670e993c6fb561e5cccf7a472ee874bbfe73412bc63f706424f174afd1a3f16fb8b8305d932d33ab211d473d210b87e2f20b6ba951a2b98206793c04516fd57fc7365cec4a1831548470ebefe7f9487cc7b287b2f45eb69b4e165b9f3404d8ac84b2b57ace34de669a85fd885ecb055a6fd2ba5d5396737c702c082bfb35f3ccace91eacfc7a71b2bca1e228170ad6d194aa7c2dc2cf5f0bce153ac1befb2b82e6cf1f12d28812e309f5da0dbe1cad03172d296fa13247b1952ec988316f668aa65e1ca7e9e383b115ce5c25130955c118a0b4567bd180c07ce18bd0c459cc33ed7ba1c43262034a60711315ed81bbc95b7e3088dbd22b976fcd18bae330f08c89236f770478305fac20b5d9bd5cbc98c5c0f9713345c7362bc0e0bc78d212433bcdc6142989bc6ab82160df897825aa906d739dac905a434c90b2cbc72223011ea11480278b681cdcdf5fa63ac5f8b8f1f3ef7d4eb02f422e9fc52b98163630cd2f130f076a33bb011bb8e42800c9475f5cbee042b79fda44b6432b126f085a17553b82d9cae519ec239a9cccb99444f24b8f11e255e31e0d53a28e36949a3f8238c2ea3f4e3d8cf3b85b031c962504d00a4e7928b5fa2fab311bcc54d68738086ce70a8e5bdaf425033036a85e59aa3bb1b01f8b6c6a2e221c69e48565b55a196b2dc9cb067b4ccf8a7c81e31795a8b74e8940455126f19c8bbb9b941cc66c9443fd13e20c2074a9c3bc1740262c1fcb8e9ca5ac5729dfe6e25561eba41ccae8ca2e851affc1ab4ec912925ef7ccf72e97c577413260ccda170d75741336f837258a59da907460a2917f652c6e4ebc0467da8a95f2ceae9afcc4e0d1f4b95fc68b2f5e32af96fb12a8e7f3140dd235a30e5ad94e78cf58ad75ca8a871a70820090ba510e7563c0f78cf364369a51fa6683ff8d24924ceb922927eb0ba1395b7a4f37d92913a9688ef8428a887f1161f10aeab749f5ea8ca24e579008f542a9b785841dae071b94b5a8ba79985930f60ac2c93aa002d84b212e2e2b6c9c2a0694595dad99fd1f27d0044481ef5b364a059599ef982a114a61094b3b7d0f9a7b78d7615cc8573430e676987ab7421fde9abeb29e4529beb6a2724bed86a7b1d27ee73585892f083fad4307696a4166356b9c20a9579bbf3e8cda9ad7ec2b2bb973d05cf8d9457dc03eee2cfbf630dd917768ae652c0627e32ebb4c62951dfbd8e074dfdf02c5517ace50d5813c8d8d7f1fc0fc63a4fae5c2bcf26560c627500e03692384630be287790d545403adc500ef732d66e269b8b051aa57bb865a9b709c7a0426188daf29caf1d062b104592b4f6acc86895956d8085424dba0bfafdf900419f2227db1eca75b338091d23da2067566c6d54de1604bf8d4cce8a0b4484c4645a305861bc46ebccafbe500e01d51236b40027d1b2c7a72937b15899bb982c880d83ed6b70502bd0d68d2a2146a85c6518a11c386df610243ec513e7a284a81c841f9201ee3b9d3a8f44cdf52ec842e07c1f2f35e2a5b17278dce1f9b7fa09866ecb0d2e78fc8095b7dee81d3e308fd10a1490036194bfa89c118bd9c72d4747b90724d7bd0a7ead28c89c23cc6667c1a8b362ca5385d24b2c1265957764a4e46176365a5348bcf85c457921e7fa6c9e165b6c4d8bd9e8782c96839a5fd2679cd08f656ca5b41d00f8429d517a0d776049918e73b4a258fd2a1576b6420b67fc9ff3520556881ef4838e973f552edebde686af1d55e6172e5bb9b01543d32c0c7753b380dd9ed3f5c0b663a9b1bcb4bd36a365172aeee96a8d69c1e5c5b6c88fc9453ace6aa24bdfc1cfa27ea8cc36c80cace296259545a4e155d154ccbf00ae4ff912c583c871b7cdb46813584ea14bb6943d16b3f12e8fe149076e5e646e1dca0bf121a2e2fa09816e9056aa1143988ff17c21c49981445d98d88fd4bba6a59d9f97d301d90e3754103389b36308713c1ba31031e42f2d759343a95bbae9c01a3bb3e6b537b658d1c028c8ec3126bf79db223a3320e25a671ef834c924f02c1bbab338517accb8378f945cb1d65d4dff90f1e3af8168e33a5a124aef715b656075f6a62099afa110f2fe5eb83e0b3e36df91be2125be6500e5f3a81f8bc116f42734c784f6bb6c7e968610243b06026a9def4e85f8344fae36602aa3795cf71ecf7e57a3da0bef859daf649abc6390e86edaa84eefe48999ddba9067b90dd5ea2477f150ab588dadfe79ab7524157d1b94c738ca3345ce8657bfac981cb30b7c0f05f96dafcdce3e41471943609b121de1eda3e95a1c31bada084beec699512c7d5cec71e06a57c177ca1f383120bf46a9c805c9220d3d0c6807d60e6b7f9c80de1d815bdf1ebe62338862719eab55ef4971a69c76aa2f25c3c9d0c2e5c7857a86f9ab26c3c6aa395f2c366548f60a40abbe14dd011358d9b3695b8a091e16552478aeee1e2e91abd67deeb15732f428c3304a2bf2e4cbb3768875b35d126ca46d29e506ee1e0aba7a17eba27c19d7626064c0a17d7ee7f2f220e5e28bd7d691dffa84f2a2f92c924b87da382ae9a688ad4322fa0cc72604fc43e17002b8f3844a7431205de46818310d0fcf4676f45c9941dde767c9a4376e13cd7e91308cc0df25a4c79e390674fa0161695cc9e9bee12620d8571a4b3800370cd01bf0546758a048563539edf15d58b108159ea5fe0f038281c7855bbd92cc86de38df60b8597f4bce4ae9cae1647b5024bfb73630cdf4d1827a5f0ff779a1e6c6efbc6561d06b249986703b9dc61a63e2068e4786e6a8be34a808143301ef00f21bee8399d88ecffddb4867790d4d1cbe827a5a220834ba831d3ba424ff8fc9a99b175d2feca9f581e24bb69bdc4f64a6ea0c9c37d6976d15e9388519a2bed100a2a8358215a8b63b6e25a677875ee2bc3fd9c77783b39a166b863376b496775b83804a2c7f5363cca9ade819034afc2f7b40ffc316089556dec2e55e1bd92c9b905d6b1b9160d6c492d4384acd7e380874939b1ab02dbbacfbedd74cd524b4eab643e8b92d38d9fae446afd8d774d1c933bce8c341f0ff283acec3bbbbfdb06a15eb88ca6600542dda45334a374e31bae", 0xba7}], 0x5}}], 0x300, 0x0) 2.268455929s ago: executing program 8 (id=5211): ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, 0x0) 2.258246342s ago: executing program 4 (id=5212): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xfffffffe}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}]}]}], {0x14}}, 0xc8}, 0x1, 0x0, 0x0, 0x2000c045}, 0x24000004) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) 2.249709669s ago: executing program 8 (id=5213): openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = memfd_create(&(0x7f0000000180)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaaSc\xf3]WhI\xf4\x89\x85!mPl\x90\xa5\x93\x19\f\x9a\xae\xd5a\x9bU5\x1a\x86\x9d)5y\xef\x90\xea5\x81\xfeO;\xd4zh?\xbdW\xe0\x84\xe6\x9d\xcb\xcd\xb6\xad3\x7fWY\x02\xa2\x8baG\x00\x0e\x8e/\xc1\xaf\xd0\xbcH9\x04\x00\x00\x00z\x16\xdf\xf3hLpLaA\x89n]>,^M\x82\x8e\xe40\x97_\x809y)Z\xeb\x9d\xbawv\xe9\xc0\x16\xdc\xf5\xcb\xdb\x96\xd6\xba@\xa7\x1bl\xca\xe0\x1e3\x81\xc6S\x86\xf7\xf0\xba\x1b\x14N\xa2\x04\xdb\xb5X\xe4y\xef\xe8\xdb\xd5r\x11\xfb\xe4v\xef\x06\xbb\x00\x96CR\xe0~5\x16=:A2\x9c\b\xd9\xa0CB\r\xe9\xb8$\xfe\x8d\xb1Gg\xa9\xac<\xbf\x10]\b9\xd9\x89\xaf\xa6\xd1\x10\x1fq\xba\x06_NW\xdb67Xv(\xa8\xce\x1b\xe6\xbd\x947\x8f)8\xe5\xb3\xac;\x7f+\xf67\xea\x1ei\x92w-)\xa1B/M\x0e7:9\xdb~V\xb7\xd5\x13^v\x14\xe6O\xea\x00\x87\x8dkG\xdf%\xebe\x83\xb97\x01| \xb3\xd8W\xe8o\x17\x97\xd9\x14o\x92\xb9\x9a\x8c\xd7\xcf\xa2\x11\xc3\xa5\xb3\xd2\xdeQ\xa7\x05\x7f\x99Lq(\xcd\\\xa2y\x14or\x1efn\xf2\x97\x96c\xda7\t,', 0x4) ftruncate(r0, 0x1000000) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r2}) ioctl(r1, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000080000000000000010") 2.228631949s ago: executing program 3 (id=5214): r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f211066865578ac0109029c000100000400090400bf"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) syz_usb_disconnect(r0) write$char_usb(r1, &(0x7f0000000140)="54c8d6caadb2", 0x6) 2.133074319s ago: executing program 7 (id=5215): socket$unix(0x1, 0x5, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000400)='yeah', 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdff", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r0, &(0x7f0000000240)="c9", 0x1, 0x4044880, 0x0, 0x0) 2.053876401s ago: executing program 5 (id=5216): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[{0x18, 0x110, 0xa, 'P'}], 0x18}, 0xfc40) 2.053110631s ago: executing program 7 (id=5217): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000008c0)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000040)=0x40, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000c40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000380)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf2fcd367a783443fa96baaa893d0666dd21482a2485ef23bfb8a14c917b4ffb8f694566151da0ae7b401ece8598e6cd7b97a58991c0725cee218df6ea0c73adfc6de77514dc15c7c834daa97759b1e88ef28881bbac8495721a6745117b43feb4932a959acc49cf1b5175a73d2c94bfbd01e7f72c0b2874ffec8bc1c342e5708e8b04696139f245560d3cdf772a0d50e7427f81afb0c6ada2794406f91f5f4cc4217324f2c839fdc5bcc59eef0d484e8ceb2bb9a4364b", 0xd7}], 0x1}}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000680)="b32e3e6e", 0x4}, {&(0x7f0000000280)="660ed4757ad7", 0x6}, {&(0x7f0000000900)="a71294e71ccfa74413067413c3d82b3117224f1170bde5ec5878d84c15e2c76371ad6671d8b553bbb75617d605087eae569d55b652c3c323a53d78ca4ceac331ca37dfb81b021fdab96f832b11f7b850cdce2e23112292f0164c8ea451856b2ccb15461bc5e93755856c4acf233bc8b76ba465855d0083483cd8c78a5f70e914147ff375269134144e9afe9cdd595c9ae1c1c0deea0251b5a36ebb250e81a296", 0xa0}], 0x3}}, {{0x0, 0x0, 0x0}}], 0x3, 0x4000001) r1 = dup(r0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1) 1.98996839s ago: executing program 4 (id=5218): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x80001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x80, 0x87}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @loopback}}}, &(0x7f0000000040)=0x84) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000200)={0x0, 0x0, 0x14}) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000040)) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000000040)) 1.90031s ago: executing program 7 (id=5219): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d1}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, 0x0}, 0x0) 1.900118768s ago: executing program 5 (id=5220): r0 = socket$inet_udp(0x2, 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.857341455s ago: executing program 8 (id=5221): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300"], 0x4c}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001f40)={0x4c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xfdff}, [@IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}, @IPSET_ATTR_IFACE={0x14, 0x17, 'batadv_slave_0\x00'}, @IPSET_ATTR_BYTES={0xc, 0x18, 0x1, 0x0, 0x3}]}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x40c0080) 1.753785615s ago: executing program 5 (id=5222): r0 = syz_open_procfs$namespace(0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4d073c420f4cba7b, 0x113, r0, 0x2000) r1 = openat$fault_inject(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYRES64, @ANYBLOB="a5a2c3418223c5dce05bb57e97d969b21048ce2d45e340b694faeceb59517182a36a74122230cd4d174b76e021d8b2e7cfa32fcb835dee8f239e120186cb5020396f8841c8b182a1b9633b5bcf2d701286cced963058e2b6a20fc403a0c5c51b885e4b148045859b37d0c81cd19c544f69328d77c1d9fce63d4726d8f0", @ANYRES16, @ANYRESHEX, @ANYRESOCT, @ANYRESOCT, @ANYRESDEC, @ANYRES16=r1, @ANYBLOB="ae1aaa22d260307ef70e7befd4605968734c2b208b5ad04ca903341de10e948cd3353e768582acba43370f4169c59e611ef2a0ec88a2599b3681a3a23fd6d4707e1f3516a607ae446d31eb4a14d8b86288798a6aa2dcbe3cfe9c2976815f17ba8c5a52eae251155d71075526e017f8d8328fc2394099dbb8a117a0df8b71a259b5"], 0x0, 0x4e}, 0x28) request_key(0x0, &(0x7f0000000380)={'syz', 0x3}, 0x0, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74"], 0x0, 0x8e}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, 0x0, &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$PTP_EXTTS_REQUEST2(r5, 0x40103d0b, &(0x7f0000000d80)={0x7fff, 0x8}) 1.66260932s ago: executing program 8 (id=5223): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/cluster/ocfs2/heartbeat/hb0/dev\x00', 0x2, 0x0) write(r0, 0x0, 0x0) 1.512887085s ago: executing program 4 (id=5224): r0 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r0, 0x0, 0x922bac8556bdad8e) 1.492393769s ago: executing program 8 (id=5225): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES16], 0x14) 1.435562669s ago: executing program 4 (id=5226): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000100)={0x3, &(0x7f0000000800)=[{0x5, '\x00', @buffer={"6383d1fa1b5e124b4317d553975a2561ead98593e9060ad61456e06afea3cd65", 0x20}, 0x98}, {0x8, '\x00', @buffer={"f335f2a95f2639f06213d5007fbb7424bde5c361de6d9c57c7b5b0bc0dc4a01f", 0x20}, 0x7a7ce1c8}]}) 1.411899052s ago: executing program 7 (id=5227): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000040)=0x5, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'ip6gretap0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000940)="330312001200140000007ef52f555f", 0xf, 0x3674842c2921b847, &(0x7f00000000c0)={0x11, 0x0, r2, 0x1, 0x62, 0x6, @broadcast}, 0x14) 590.266329ms ago: executing program 3 (id=5228): socket$unix(0x1, 0x5, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000400)='yeah', 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff080000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r0, &(0x7f0000000240)="c9", 0x1, 0x4044880, 0x0, 0x0) 536.892432ms ago: executing program 4 (id=5229): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004051045f500001010203020902350001020080300904000005ff00000007058102000200070501020002000705820200020007050202000200070583030a"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/ttyUSB0\x00', 0x2, 0x0) 373.73258ms ago: executing program 7 (id=5230): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000000)={0x80, 0x40000105, 0x0, 0x0}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e9"], 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000280)="0f30baf80c66b8625fa68766ef0f00d12066b9bf0a00006683818b000000d800d8000000000f3036f30f5163000fc71a2e0f68affbff66b9800000c00f326635010000000f30baf80c66b8d8d3748466efbafc0cedc1117664678152fe266d", 0x5f}], 0x1, 0x0, 0x0, 0x5b) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x40f00, 0x24}, 0x94) ioctl$KVM_RUN(r4, 0xae80, 0x0) 243.158472ms ago: executing program 5 (id=5231): syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ffbe"], 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f0000000000)={0x0, 0x1, 0x2b, 0x5, "2af15ef6983d2e9e4cea7f3567bf701fa00d6a39ad4b3eb72544d4c1ba33b030"}) 0s ago: executing program 7 (id=5232): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x400, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}, 0xf29d}], 0x1a000, 0x40010102, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv4_delroute={0x24, 0x19, 0x901, 0x0, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_GATEWAY={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3e}}]}, 0x24}}, 0x0) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e23, 0xffffffff, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2}, 0x1c) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) write(r1, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000000)={0x209d, 0x9, 0x2008, 0x7ffffff9}, 0x10) write(0xffffffffffffffff, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000040, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) close(0x3) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0xa7, &(0x7f0000000440)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x95, 0x2, 0x1, 0x4, 0x20, 0x8, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x9, 0x24, 0x6, 0x0, 0x1, "714985bc"}, {0x5, 0x24, 0x0, 0x163}, {0xd, 0x24, 0xf, 0x1, 0x1ca8, 0x81, 0x0, 0x6}, {0x6, 0x24, 0x1a, 0x3, 0x2}, [@country_functional={0x8, 0x24, 0x7, 0x9, 0x1000, [0xf]}, @mdlm_detail={0x28, 0x24, 0x13, 0x4, "fb37cfd810016e06eee729ba357342855f671da5d51830e032323195e93c993c1fb1be1e"}, @obex={0x5, 0x24, 0x15, 0x7}]}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x9, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x7, 0x82, 0xeb}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x7, 0xbe, 0xa}}}}}}}]}}, &(0x7f00000008c0)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x200, 0x17, 0x8, 0x1, 0x40, 0x7}, 0x5, &(0x7f00000003c0)={0x5, 0xf, 0x5}}) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x42804}, 0x20000004) close(0x3) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x4000000}, 0xc) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f0000000140)) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) close_range(r3, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): L syzkaller #0 PREEMPT(full) [ 1818.497536][T24735] Tainted: [L]=SOFTLOCKUP [ 1818.497543][T24735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1818.497556][T24735] Call Trace: [ 1818.497563][T24735] [ 1818.497571][T24735] dump_stack_lvl+0x100/0x190 [ 1818.497604][T24735] should_fail_ex.cold+0x5/0xa [ 1818.497634][T24735] should_failslab+0xc2/0x120 [ 1818.497662][T24735] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1818.497686][T24735] ? __proc_create+0xc1/0x8f0 [ 1818.497707][T24735] ? __proc_create+0x247/0x8f0 [ 1818.497732][T24735] __proc_create+0x247/0x8f0 [ 1818.497753][T24735] ? __pfx___proc_create+0x10/0x10 [ 1818.497778][T24735] ? _raw_write_unlock+0x28/0x50 [ 1818.497805][T24735] proc_create_reg+0x75/0x170 [ 1818.497830][T24735] proc_create_seq_private+0x8e/0x180 [ 1818.497854][T24735] ? __pfx_proc_create_seq_private+0x10/0x10 [ 1818.497883][T24735] xt_proto_init+0x45d/0x780 [ 1818.497913][T24735] ? __pfx_xt_proto_init+0x10/0x10 [ 1818.497948][T24735] ? __pfx_arp_tables_net_init+0x10/0x10 [ 1818.497976][T24735] ops_init+0x1e2/0x5f0 [ 1818.498008][T24735] setup_net+0x118/0x3a0 [ 1818.498038][T24735] ? __pfx_setup_net+0x10/0x10 [ 1818.498074][T24735] copy_net_ns+0x345/0x7a0 [ 1818.498098][T24735] create_new_namespaces+0x3ea/0xac0 [ 1818.498131][T24735] unshare_nsproxy_namespaces+0xf2/0x220 [ 1818.498159][T24735] ksys_unshare+0x4a2/0xa70 [ 1818.498186][T24735] ? __pfx_ksys_unshare+0x10/0x10 [ 1818.498223][T24735] __x64_sys_unshare+0x31/0x40 [ 1818.498246][T24735] do_syscall_64+0x123/0x790 [ 1818.498271][T24735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1818.498294][T24735] RIP: 0033:0x7fec22f9e159 [ 1818.498312][T24735] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1818.498332][T24735] RSP: 002b:00007fec23f05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 1818.498352][T24735] RAX: ffffffffffffffda RBX: 00007fec23225fa0 RCX: 00007fec22f9e159 [ 1818.498367][T24735] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000 [ 1818.498381][T24735] RBP: 00007fec2303506b R08: 0000000000000000 R09: 0000000000000000 [ 1818.498394][T24735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1818.498407][T24735] R13: 00007fec23226038 R14: 00007fec23225fa0 R15: 00007fff4bcffc48 [ 1818.498436][T24735] [ 1818.733754][T24735] FAULT_INJECTION: forcing a failure. [ 1818.733754][T24735] name failslab, interval 1, probability 0, space 0, times 0 [ 1818.733784][T24735] CPU: 0 UID: 0 PID: 24735 Comm: syz.4.4455 Tainted: G L syzkaller #0 PREEMPT(full) [ 1818.733814][T24735] Tainted: [L]=SOFTLOCKUP [ 1818.733822][T24735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1818.733836][T24735] Call Trace: [ 1818.733844][T24735] [ 1818.733852][T24735] dump_stack_lvl+0x100/0x190 [ 1818.733885][T24735] should_fail_ex.cold+0x5/0xa [ 1818.733913][T24735] should_failslab+0xc2/0x120 [ 1818.733941][T24735] __kmalloc_cache_noprof+0x91/0x6d0 [ 1818.733970][T24735] ? sget_fc+0xb19/0x1f70 [ 1818.734000][T24735] sget_fc+0xb19/0x1f70 [ 1818.734030][T24735] ? __pfx_set_anon_super_fc+0x10/0x10 [ 1818.734055][T24735] ? __pfx_sget_fc+0x10/0x10 [ 1818.734076][T24735] ? refcount_dec_not_one+0x136/0x1c0 [ 1818.734103][T24735] ? __pfx_refcount_dec_not_one+0x10/0x10 [ 1818.734126][T24735] ? __kasan_kmalloc+0xaa/0xb0 [ 1818.734153][T24735] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 1818.734172][T24735] ? __kasan_kmalloc+0xaa/0xb0 [ 1818.734201][T24735] ? __pfx_mqueue_fill_super+0x10/0x10 [ 1818.734233][T24735] get_tree_nodev+0x28/0x190 [ 1818.734257][T24735] mqueue_get_tree+0xf1/0x130 [ 1818.734288][T24735] vfs_get_tree+0x92/0x320 [ 1818.734309][T24735] fc_mount_longterm+0x1a/0x270 [ 1818.734335][T24735] mq_init_ns+0x482/0x820 [ 1818.734361][T24735] copy_ipcs+0x3dd/0x7e0 [ 1818.734386][T24735] create_new_namespaces+0x20a/0xac0 [ 1818.734412][T24735] ? security_capable+0x80/0x260 [ 1818.734437][T24735] unshare_nsproxy_namespaces+0xf2/0x220 [ 1818.734465][T24735] ksys_unshare+0x4a2/0xa70 [ 1818.734490][T24735] ? __pfx_ksys_unshare+0x10/0x10 [ 1818.734526][T24735] __x64_sys_unshare+0x31/0x40 [ 1818.734550][T24735] do_syscall_64+0x123/0x790 [ 1818.734578][T24735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1818.734600][T24735] RIP: 0033:0x7fec22f9e159 [ 1818.734619][T24735] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1818.734640][T24735] RSP: 002b:00007fec23f05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 1818.734660][T24735] RAX: ffffffffffffffda RBX: 00007fec23225fa0 RCX: 00007fec22f9e159 [ 1818.734675][T24735] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000 [ 1818.734688][T24735] RBP: 00007fec2303506b R08: 0000000000000000 R09: 0000000000000000 [ 1818.734702][T24735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1818.734716][T24735] R13: 00007fec23226038 R14: 00007fec23225fa0 R15: 00007fff4bcffc48 [ 1818.734747][T24735] [ 1818.741065][T24743] pim6reg: entered allmulticast mode [ 1818.742728][T11919] Bluetooth: hci0: command 0x0c1a tx timeout [ 1818.992407][ T981] net_ratelimit: 65 callbacks suppressed [ 1819.270923][T24739] pim6reg: left allmulticast mode [ 1819.317684][ T5789] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 1819.505698][ T5789] usb 9-1: New USB device found, idVendor=1df7, idProduct=2500, bcdDevice= 1.00 [ 1819.514327][ T5789] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1819.514348][ T5789] usb 9-1: config 0 has no interfaces? [ 1819.514396][ T5789] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1819.529671][ T5789] usb 9-1: config 0 descriptor?? [ 1819.781050][ T5789] usb 9-1: USB disconnect, device number 8 [ 1820.653315][T24777] VIDIOC_TRY_EXT_CTRLS: error -22: which=0xa30000, count=1, error_idx=0, request_fd=-1 [ 1820.653351][T24777] , name=Balance, id/size=0x980906/6 [ 1820.656251][T24775] fuse: Unknown parameter 'grou00000000000000000000' [ 1820.787610][T24784] fuse: Bad value for 'fd' [ 1820.821486][T11919] Bluetooth: hci0: command 0x0c1a tx timeout [ 1821.122154][ T985] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 1821.271991][ T985] usb 6-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1821.272024][ T985] usb 6-1: no configurations [ 1821.272038][ T985] usb 6-1: can't read configurations, error -22 [ 1821.411213][ T5789] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 1821.421271][ T985] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 1821.561404][ T5789] usb 8-1: Using ep0 maxpacket: 16 [ 1821.562176][ T5789] usb 8-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 1821.564189][ T5789] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1821.564219][ T5789] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1821.571479][ T5789] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1821.571499][ T5789] usb 8-1: Product: syz [ 1821.571514][ T5789] usb 8-1: Manufacturer: syz [ 1821.571529][ T5789] usb 8-1: SerialNumber: syz [ 1821.576940][ T985] usb 6-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1821.576976][ T985] usb 6-1: no configurations [ 1821.576989][ T985] usb 6-1: can't read configurations, error -22 [ 1821.586899][ T985] usb usb6-port1: attempt power cycle [ 1821.591545][ T5789] usb 8-1: config 0 descriptor?? [ 1821.850278][ C0] imon 8-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 1821.884596][ T5789] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/input/input23 [ 1821.977944][ T5789] imon:send_packet: packet tx failed (-71) [ 1821.994680][ T985] usb 6-1: new full-speed USB device number 10 using dummy_hcd [ 1822.003311][ T5789] imon 8-1:0.0: panel buttons/knobs setup failed [ 1822.016551][ T985] usb 6-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1822.016587][ T985] usb 6-1: no configurations [ 1822.016601][ T985] usb 6-1: can't read configurations, error -22 [ 1822.118460][T24833] binder_alloc: 24830: binder_alloc_buf, no vma [ 1822.141471][ T985] usb 6-1: new full-speed USB device number 11 using dummy_hcd [ 1822.147494][T24835] fuse: Unknown parameter 'grou00000000000000000000' [ 1822.169946][ T5789] rc_core: IR keymap rc-imon-pad not found [ 1822.169965][ T5789] Registered IR keymap rc-empty [ 1822.170651][ T5789] imon 8-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 1822.170667][ T5789] imon 8-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1822.171045][ T5789] imon:send_packet: packet tx failed (-71) [ 1822.174168][ T985] usb 6-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1822.174202][ T985] usb 6-1: no configurations [ 1822.174214][ T985] usb 6-1: can't read configurations, error -22 [ 1822.174609][ T985] usb usb6-port1: unable to enumerate USB device [ 1822.195942][ T5789] imon 8-1:0.0: remote input dev register failed [ 1822.196189][ T5789] imon 8-1:0.0: imon_init_intf0: rc device setup failed [ 1822.282034][ T5789] imon 8-1:0.0: unable to initialize intf0, err 0 [ 1822.282049][ T5789] imon:imon_probe: failed to initialize context! [ 1822.282061][ T5789] imon 8-1:0.0: unable to register, err -19 [ 1822.288697][ T5789] usb 8-1: USB disconnect, device number 6 [ 1822.641558][ T5789] usb 8-1: new full-speed USB device number 7 using dummy_hcd [ 1822.779180][T24840] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4495'. [ 1822.792010][ T5789] usb 8-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 1822.793273][ T5789] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1822.793302][ T5789] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 1822.793331][ T5789] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1822.796238][ T5789] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1822.796260][ T5789] usb 8-1: Product: syz [ 1822.796275][ T5789] usb 8-1: Manufacturer: syz [ 1822.796291][ T5789] usb 8-1: SerialNumber: syz [ 1822.822914][ T5789] usb 8-1: config 0 descriptor?? [ 1822.835154][T24795] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1822.978519][T24844] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4497'. [ 1823.118338][ C0] imon 8-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 1823.120480][ T5789] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/input/input25 [ 1823.482443][ T5789] rc_core: IR keymap rc-imon-pad not found [ 1823.482458][ T5789] Registered IR keymap rc-empty [ 1823.482563][ T5789] imon 8-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 1823.482579][ T5789] imon 8-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1823.490289][T24861] binder: 24860:24861 ioctl c0306201 200000000080 returned -14 [ 1823.542297][T24861] binder_alloc: 24860: binder_alloc_buf, no vma [ 1823.545772][ T5789] rc rc0: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0 [ 1823.590159][ T5789] input: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/rc/rc0/input26 [ 1823.619338][ T5789] imon 8-1:0.0: iMON device (15c2:0045, intf0) on usb<8:7> initialized [ 1823.765640][ T985] usb 8-1: USB disconnect, device number 7 [ 1823.819905][T24873] bridge0: port 3(syz_tun) entered blocking state [ 1823.820048][T24873] bridge0: port 3(syz_tun) entered disabled state [ 1823.820242][T24873] syz_tun: entered allmulticast mode [ 1823.844484][T24874] binder_alloc: 24870: binder_alloc_buf, no vma [ 1823.870180][T24873] syz_tun: entered promiscuous mode [ 1823.907854][ T30] audit: type=1400 audit(1790904694.383:13587): avc: denied { write } for pid=24876 comm="syz.3.4510" name="nullb" dev="configfs" ino=3569 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1823.941785][ T30] audit: type=1400 audit(1790904694.413:13588): avc: denied { write } for pid=24876 comm="syz.3.4510" name="power" dev="configfs" ino=91901 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 1823.941835][ T30] audit: type=1400 audit(1790904694.413:13589): avc: denied { open } for pid=24876 comm="syz.3.4510" path="/336/config/nullb/nullb1/power" dev="configfs" ino=91901 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 1824.011562][ T30] audit: type=1400 audit(1790904694.483:13590): avc: denied { write } for pid=24876 comm="syz.3.4510" name="subsystems" dev="configfs" ino=3578 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1824.641164][ T5789] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 1824.769519][T24901] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4520'. [ 1824.811891][ T5789] usb 9-1: New USB device found, idVendor=1df7, idProduct=2500, bcdDevice= 1.00 [ 1824.812983][ T5789] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1824.813005][ T5789] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1824.813058][ T5789] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1825.028957][ T5789] usb 9-1: USB disconnect, device number 9 [ 1825.135184][T24877] null_blk: disk nullb1 created [ 1825.231352][ T985] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 1825.386890][ T985] usb 5-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1825.386925][ T985] usb 5-1: no configurations [ 1825.386939][ T985] usb 5-1: can't read configurations, error -22 [ 1825.511572][ T985] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 1825.667624][ T985] usb 5-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1825.667662][ T985] usb 5-1: no configurations [ 1825.667676][ T985] usb 5-1: can't read configurations, error -22 [ 1825.668170][ T985] usb usb5-port1: attempt power cycle [ 1825.732117][ T5608] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 1826.171182][ T5608] usb 8-1: Using ep0 maxpacket: 16 [ 1826.181902][ T5608] usb 8-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 1826.193717][ T5608] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1826.193747][ T5608] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1826.196043][ T5608] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1826.196063][ T5608] usb 8-1: Product: syz [ 1826.196078][ T5608] usb 8-1: Manufacturer: syz [ 1826.196093][ T5608] usb 8-1: SerialNumber: syz [ 1826.198981][ T5608] usb 8-1: config 0 descriptor?? [ 1826.201755][ T985] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 1826.224800][ T985] usb 5-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1826.224855][ T985] usb 5-1: no configurations [ 1826.224867][ T985] usb 5-1: can't read configurations, error -22 [ 1826.353829][ T985] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 1826.376575][ T985] usb 5-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1826.376600][ T985] usb 5-1: no configurations [ 1826.376622][ T985] usb 5-1: can't read configurations, error -22 [ 1826.376992][ T985] usb usb5-port1: unable to enumerate USB device [ 1826.413699][ C1] imon 8-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 1826.456923][T24934] binder_alloc: 24932: binder_alloc_buf, no vma [ 1826.474247][ T5608] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/input/input27 [ 1826.531535][ T5608] imon:send_packet: packet tx failed (-71) [ 1826.553494][ T5608] imon 8-1:0.0: panel buttons/knobs setup failed [ 1826.735557][ T5608] rc_core: IR keymap rc-imon-pad not found [ 1826.735586][ T5608] Registered IR keymap rc-empty [ 1826.735763][ T5608] imon 8-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 1826.735789][ T5608] imon 8-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1826.736527][ T5608] imon:send_packet: packet tx failed (-71) [ 1826.751901][ T5608] imon 8-1:0.0: remote input dev register failed [ 1826.752275][ T5608] imon 8-1:0.0: imon_init_intf0: rc device setup failed [ 1826.896923][ T5608] imon 8-1:0.0: unable to initialize intf0, err 0 [ 1826.896938][ T5608] imon:imon_probe: failed to initialize context! [ 1826.896950][ T5608] imon 8-1:0.0: unable to register, err -19 [ 1826.918826][ T5608] usb 8-1: USB disconnect, device number 8 [ 1826.985592][T24947] binder: 24946:24947 ioctl c0306201 0 returned -14 [ 1827.251675][ T5608] usb 8-1: new full-speed USB device number 9 using dummy_hcd [ 1827.405133][ T5608] usb 8-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 1827.407961][ T5608] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1827.407990][ T5608] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 1827.408016][ T5608] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1827.421408][ T5608] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1827.421429][ T5608] usb 8-1: Product: syz [ 1827.421444][ T5608] usb 8-1: Manufacturer: syz [ 1827.421459][ T5608] usb 8-1: SerialNumber: syz [ 1827.431612][ T5608] usb 8-1: config 0 descriptor?? [ 1827.483068][T24921] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1827.754235][ C1] imon 8-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 1827.843596][ T30] audit: type=1400 audit(1790904698.313:13591): avc: denied { write } for pid=24964 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1827.894850][ T5608] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/input/input29 [ 1827.978493][ T30] audit: type=1400 audit(1790904698.453:13592): avc: denied { write } for pid=24980 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1828.136954][T24984] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.4543'. [ 1828.151570][ T5608] rc_core: IR keymap rc-imon-pad not found [ 1828.151584][ T5608] Registered IR keymap rc-empty [ 1828.151692][ T5608] imon 8-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 1828.151708][ T5608] imon 8-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1828.157851][ T5608] imon:send_packet: packet tx failed (-71) [ 1828.173695][ T5608] imon 8-1:0.0: remote input dev register failed [ 1828.173933][ T5608] imon 8-1:0.0: imon_init_intf0: rc device setup failed [ 1828.276884][ T5608] imon 8-1:0.0: unable to initialize intf0, err 0 [ 1828.276898][ T5608] imon:imon_probe: failed to initialize context! [ 1828.276908][ T5608] imon 8-1:0.0: unable to register, err -19 [ 1828.309276][ T5608] usb 8-1: USB disconnect, device number 9 [ 1828.522175][ T5794] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 1828.577710][T24997] binder: 24995:24997 ioctl c0306201 0 returned -14 [ 1828.684595][ T5794] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 1828.685913][ T5794] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1828.685942][ T5794] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1828.685966][ T5794] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 1828.691037][ T5794] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1828.691056][ T5794] usb 5-1: Product: syz [ 1828.691367][ T5794] usb 5-1: Manufacturer: syz [ 1828.691384][ T5794] usb 5-1: SerialNumber: syz [ 1828.695844][ T5794] usb 5-1: config 0 descriptor?? [ 1828.995335][ T5794] adutux 5-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 1829.141954][ T981] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1829.143598][ T40] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1829.143637][ T40] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1829.143670][ T40] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1829.377456][T25023] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.4556'. [ 1829.442524][ T30] audit: type=1400 audit(1790904699.913:13593): avc: denied { write } for pid=24991 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1829.452479][ T5608] usb 9-1: new full-speed USB device number 10 using dummy_hcd [ 1829.487655][T20007] usb 5-1: USB disconnect, device number 9 [ 1829.610014][T25027] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4557'. [ 1829.611342][ T5794] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 1829.632015][ T5608] usb 9-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1829.633098][ T5608] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1829.633118][ T5608] usb 9-1: config 0 has no interfaces? [ 1829.635859][ T5608] usb 9-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1829.635879][ T5608] usb 9-1: Product: syz [ 1829.635892][ T5608] usb 9-1: Manufacturer: syz [ 1829.635903][ T5608] usb 9-1: SerialNumber: syz [ 1829.638667][ T5608] usb 9-1: config 0 descriptor?? [ 1829.763146][ T5794] usb 8-1: device descriptor read/64, error -71 [ 1829.833138][ T30] audit: type=1400 audit(1790904700.313:13594): avc: denied { write } for pid=25028 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1829.899461][T20007] usb 9-1: USB disconnect, device number 10 [ 1830.001287][ T5794] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 1830.131194][ T5794] usb 8-1: device descriptor read/64, error -71 [ 1830.251595][ T5794] usb usb8-port1: attempt power cycle [ 1830.591339][T25043] ovs-dp0: entered promiscuous mode [ 1830.592719][ T5794] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 1830.614890][ T5794] usb 8-1: device descriptor read/8, error -71 [ 1830.771064][ T30] audit: type=1400 audit(1790904701.243:13595): avc: denied { write } for pid=25035 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1830.871532][ T5794] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 1830.893926][ T5794] usb 8-1: device descriptor read/8, error -71 [ 1831.002149][ T5794] usb usb8-port1: unable to enumerate USB device [ 1831.126039][T25071] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.4567'. [ 1831.138253][ T30] audit: type=1400 audit(1790904701.593:13596): avc: denied { write } for pid=25061 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1831.167376][T25072] binder: 25070:25072 ioctl c0306201 0 returned -14 [ 1831.425009][ T30] audit: type=1400 audit(1790904701.903:13597): avc: denied { write } for pid=25078 comm="syz.8.4572" name="ptp0" dev="devtmpfs" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1831.761188][T20007] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 1831.913337][T20007] usb 5-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1831.914423][T20007] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1831.914468][T20007] usb 5-1: config 0 has no interfaces? [ 1831.916732][T20007] usb 5-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1831.916754][T20007] usb 5-1: Product: syz [ 1831.916770][T20007] usb 5-1: Manufacturer: syz [ 1831.916786][T20007] usb 5-1: SerialNumber: syz [ 1831.919684][T20007] usb 5-1: config 0 descriptor?? [ 1832.150337][ T30] audit: type=1400 audit(1790904702.623:13598): avc: denied { write } for pid=25077 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1832.154845][T25109] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4580'. [ 1832.158966][ T5794] usb 5-1: USB disconnect, device number 10 [ 1832.353979][T25113] binder: 25112:25113 ioctl c0306201 0 returned -14 [ 1832.495183][ T30] audit: type=1400 audit(1790904702.973:13599): avc: denied { write } for pid=25116 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1832.888924][T25137] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4592'. [ 1833.011439][ T30] audit: type=1400 audit(1790904703.493:13600): avc: denied { read } for pid=25133 comm="syz.5.4591" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1833.211209][ T5794] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1833.363728][ T5794] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 1833.365020][ T5794] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1833.366318][ T5794] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1833.368754][ T5794] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1833.368773][ T5794] usb 4-1: Product: syz [ 1833.368786][ T5794] usb 4-1: Manufacturer: syz [ 1833.368799][ T5794] usb 4-1: SerialNumber: syz [ 1833.430791][ T5794] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 1833.448686][ T5794] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 1833.466376][ T5794] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 1834.152229][T20007] usb 8-1: new full-speed USB device number 14 using dummy_hcd [ 1834.326610][T20007] usb 8-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1834.335386][T20007] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1834.335410][T20007] usb 8-1: config 0 has no interfaces? [ 1834.340434][T20007] usb 8-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1834.340455][T20007] usb 8-1: Product: syz [ 1834.340469][T20007] usb 8-1: Manufacturer: syz [ 1834.340483][T20007] usb 8-1: SerialNumber: syz [ 1834.348985][T20007] usb 8-1: config 0 descriptor?? [ 1834.748809][T25139] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set config on port 0, -110 [ 1834.774896][T25139] FAULT_INJECTION: forcing a failure. [ 1834.774896][T25139] name failslab, interval 1, probability 0, space 0, times 0 [ 1834.774928][T25139] CPU: 0 UID: 0 PID: 25139 Comm: syz.3.4594 Tainted: G L syzkaller #0 PREEMPT(full) [ 1834.774959][T25139] Tainted: [L]=SOFTLOCKUP [ 1834.774970][T25139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1834.774985][T25139] Call Trace: [ 1834.774993][T25139] [ 1834.775002][T25139] dump_stack_lvl+0x100/0x190 [ 1834.775039][T25139] should_fail_ex.cold+0x5/0xa [ 1834.775069][T25139] should_failslab+0xc2/0x120 [ 1834.775098][T25139] __kmalloc_cache_noprof+0x91/0x6d0 [ 1834.775121][T25139] ? kasan_save_stack+0x3f/0x50 [ 1834.775147][T25139] ? dummy_urb_enqueue+0xa3/0x880 [ 1834.775177][T25139] dummy_urb_enqueue+0xa3/0x880 [ 1834.775201][T25139] ? chrdev_open+0x234/0x6a0 [ 1834.775226][T25139] ? usb_hcd_map_urb_for_dma+0x28a/0x1190 [ 1834.775250][T25139] ? vfs_open+0x82/0x3f0 [ 1834.775273][T25139] ? path_openat+0x19fa/0x2440 [ 1834.775299][T25139] ? do_file_open+0x20e/0x430 [ 1834.775329][T25139] usb_hcd_submit_urb+0x268/0x2150 [ 1834.775364][T25139] usb_submit_urb+0x827/0x19b0 [ 1834.775396][T25139] ? __init_swait_queue_head+0xca/0x150 [ 1834.775427][T25139] usb_start_wait_urb+0x10e/0x580 [ 1834.775458][T25139] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1834.775514][T25139] ? __asan_memset+0x23/0x50 [ 1834.775544][T25139] usb_control_msg+0x328/0x4b0 [ 1834.775574][T25139] ? __pfx_usb_control_msg+0x10/0x10 [ 1834.775601][T25139] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 1834.775621][T25139] ? __pfx__dev_err+0x10/0x10 [ 1834.775650][T25139] ? ti_write_byte.isra.0+0x5e/0x3d0 [ 1834.775676][T25139] ti_write_byte.isra.0+0x29b/0x3d0 [ 1834.775704][T25139] ti_set_mcr+0x76/0x110 [ 1834.775726][T25139] ti_set_termios+0x6f3/0xbc0 [ 1834.775756][T25139] ti_open+0x277/0xce0 [ 1834.775783][T25139] serial_port_activate+0x181/0x290 [ 1834.775805][T25139] ? __pfx_serial_port_activate+0x10/0x10 [ 1834.775828][T25139] tty_port_open+0x156/0x1f0 [ 1834.775859][T25139] ? __pfx_serial_open+0x10/0x10 [ 1834.775879][T25139] tty_open+0x2cc/0xe20 [ 1834.775912][T25139] ? __pfx_tty_open+0x10/0x10 [ 1834.775938][T25139] ? chrdev_open+0x589/0x6a0 [ 1834.775963][T25139] ? chrdev_open+0x589/0x6a0 [ 1834.775992][T25139] ? __pfx_tty_open+0x10/0x10 [ 1834.776019][T25139] chrdev_open+0x234/0x6a0 [ 1834.776047][T25139] ? __pfx_chrdev_open+0x10/0x10 [ 1834.776075][T25139] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 1834.776103][T25139] do_dentry_open+0x6ab/0x14d0 [ 1834.776127][T25139] ? __pfx_chrdev_open+0x10/0x10 [ 1834.776161][T25139] vfs_open+0x82/0x3f0 [ 1834.776194][T25139] path_openat+0x19fa/0x2440 [ 1834.776222][T25139] ? __pfx_path_openat+0x10/0x10 [ 1834.776256][T25139] do_file_open+0x20e/0x430 [ 1834.776284][T25139] ? __pfx_do_file_open+0x10/0x10 [ 1834.776334][T25139] ? _raw_spin_unlock+0x28/0x50 [ 1834.776364][T25139] ? alloc_fd+0x471/0x7a0 [ 1834.776403][T25139] do_sys_openat2+0x10f/0x1e0 [ 1834.776434][T25139] ? __pfx_do_sys_openat2+0x10/0x10 [ 1834.776472][T25139] ? __pfx_get_timespec64+0x10/0x10 [ 1834.776507][T25139] __x64_sys_openat+0x12d/0x210 [ 1834.776540][T25139] ? __pfx___x64_sys_openat+0x10/0x10 [ 1834.776585][T25139] do_syscall_64+0x123/0x790 [ 1834.776611][T25139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1834.776633][T25139] RIP: 0033:0x7fd96879e159 [ 1834.776652][T25139] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1834.776672][T25139] RSP: 002b:00007fd9669f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1834.776692][T25139] RAX: ffffffffffffffda RBX: 00007fd968a25fa0 RCX: 00007fd96879e159 [ 1834.776708][T25139] RDX: 0000000000000002 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 1834.776723][T25139] RBP: 00007fd96883506b R08: 0000000000000000 R09: 0000000000000000 [ 1834.776736][T25139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1834.776749][T25139] R13: 00007fd968a26038 R14: 00007fd968a25fa0 R15: 00007ffcd3f4e038 [ 1834.776781][T25139] [ 1834.845602][T25139] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -12 [ 1834.845696][T25139] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set modem control on port 0, -12 [ 1834.848235][T25139] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot send open command, -32 [ 1834.857542][T25156] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set config on port 0, -32 [ 1834.858006][T25156] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -32 [ 1834.858059][T25156] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set modem control on port 0, -32 [ 1834.858449][T25156] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot send open command, -32 [ 1834.861841][ T5794] usb 4-1: USB disconnect, device number 102 [ 1834.870785][ T5789] usb 8-1: USB disconnect, device number 14 [ 1835.224734][T25170] fuse: Unknown parameter 'group_i00000000000000000000' [ 1835.285397][ T5794] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 1835.306978][ T5794] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 1835.308077][ T5794] ti_usb_3410_5052 4-1:2.0: device disconnected [ 1835.813416][ T30] audit: type=1400 audit(1790904706.293:13601): avc: denied { write } for pid=25190 comm="syz.7.4615" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1836.150793][ T30] audit: type=1400 audit(1790904706.623:13602): avc: denied { setopt } for pid=25200 comm="syz.4.4620" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1836.413410][T20007] usb 9-1: new full-speed USB device number 11 using dummy_hcd [ 1836.571992][T20007] usb 9-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1836.573333][T20007] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1836.573354][T20007] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1836.575597][T20007] usb 9-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1836.575616][T20007] usb 9-1: Product: syz [ 1836.575631][T20007] usb 9-1: Manufacturer: syz [ 1836.575645][T20007] usb 9-1: SerialNumber: syz [ 1836.578440][T20007] usb 9-1: config 0 descriptor?? [ 1836.761192][ T5608] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 1836.864799][ T5789] usb 9-1: USB disconnect, device number 11 [ 1836.911629][ T5608] usb 8-1: Using ep0 maxpacket: 8 [ 1836.919294][ T5608] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1836.919331][ T5608] usb 8-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 1836.920397][ T5608] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1836.920432][ T5608] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 1836.963107][ T5608] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1836.963128][ T5608] usb 8-1: Product: syz [ 1836.963143][ T5608] usb 8-1: Manufacturer: syz [ 1836.963159][ T5608] usb 8-1: SerialNumber: syz [ 1836.965936][ T5608] usb 8-1: config 0 descriptor?? [ 1837.108445][T25234] Bluetooth: hci0: load_link_keys: expected 3 bytes, got 28 bytes [ 1837.195978][ T5789] usb 8-1: USB disconnect, device number 15 [ 1837.568967][T25247] tipc: Started in network mode [ 1837.568990][T25247] tipc: Node identity 4, cluster identity 4711 [ 1837.569004][T25247] tipc: Node number set to 4 [ 1837.575768][T25247] tipc: Enabling of bearer rejected, failed to enable media [ 1837.844184][T25261] IPVS: sh: TCP 127.0.0.1:21 - no destination available [ 1838.345988][ T30] audit: type=1400 audit(1790904708.823:13603): avc: denied { read } for pid=25283 comm="syz.5.4647" name="ipv4_address" dev="configfs" ino=92877 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 1838.404232][ T30] audit: type=1400 audit(1790904708.883:13604): avc: denied { write } for pid=25283 comm="syz.5.4647" name="heartbeat" dev="configfs" ino=44359 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1838.455085][T25289] Bluetooth: hci0: load_link_keys: expected 3 bytes, got 28 bytes [ 1838.595682][ T5789] usb 8-1: new full-speed USB device number 16 using dummy_hcd [ 1838.751271][ T5789] usb 8-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1838.752759][ T5789] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1838.752779][ T5789] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1838.754979][ T5789] usb 8-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1838.755006][ T5789] usb 8-1: Product: syz [ 1838.755021][ T5789] usb 8-1: Manufacturer: syz [ 1838.755046][ T5789] usb 8-1: SerialNumber: syz [ 1838.767345][ T5789] usb 8-1: config 0 descriptor?? [ 1838.969767][T25312] binder: 25311:25312 ioctl c0306201 200000000080 returned -14 [ 1838.982784][ T5789] usb 8-1: USB disconnect, device number 16 [ 1839.471854][ T30] audit: type=1400 audit(1790904709.953:13605): avc: denied { write } for pid=25321 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1839.671067][ T30] audit: type=1400 audit(1790904710.143:13606): avc: denied { write } for pid=25341 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1839.806106][T25354] binder: 25352:25354 ioctl c0306201 200000000080 returned -14 [ 1840.244711][T25384] index=4294967294, name=, capability=0x0, rangelow=0, rangehigh=0, txsubchans=0x0 [ 1840.367387][ T30] audit: type=1400 audit(1790904710.843:13607): avc: denied { write } for pid=25360 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1840.514172][ T30] audit: type=1400 audit(1790904710.993:13608): avc: denied { write } for pid=25398 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1840.789007][T25413] binder: 25412:25413 ioctl c0306201 200000000080 returned -14 [ 1840.892344][T25418] net_ratelimit: 1 callbacks suppressed [ 1840.904303][ T30] audit: type=1400 audit(1790904711.383:13609): avc: denied { write } for pid=25403 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1840.951575][T25422] netlink: 20 bytes leftover after parsing attributes in process `syz.8.4683'. [ 1840.996349][ T30] audit: type=1400 audit(1790904711.473:13610): avc: denied { write } for pid=25423 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1841.402504][ T30] audit: type=1400 audit(1790904711.873:13611): avc: denied { write } for pid=25426 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1842.061048][ T30] audit: type=1400 audit(1790904712.533:13612): avc: denied { write } for pid=25457 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1842.088550][T25463] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_vlan, syncid = 0, id = 0 [ 1842.266243][T11919] Bluetooth: hci0: unexpected event for opcode 0x1003 [ 1842.941374][T11161] netdevsim netdevsim8 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1842.941414][T11161] netdevsim netdevsim8 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1842.952331][T11161] netdevsim netdevsim8 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1842.952371][T11161] netdevsim netdevsim8 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1843.316202][T25456] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1843.451846][T25456] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1843.838933][T25504] dvmrp0: entered allmulticast mode [ 1844.091899][ T8209] IPVS: starting estimator thread 0... [ 1844.181448][T11919] Bluetooth: hci4: command 0x0406 tx timeout [ 1844.183118][T25516] IPVS: using max 35 ests per chain, 84000 per kthread [ 1844.533308][ T5789] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 1844.596377][ T30] audit: type=1400 audit(1790904715.073:13613): avc: denied { write } for pid=25533 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1844.666618][ T30] audit: type=1400 audit(1790904715.143:13614): avc: denied { write } for pid=25544 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1844.696901][ T5789] usb 5-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1844.697971][ T5789] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1844.697992][ T5789] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1844.700208][ T5789] usb 5-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1844.700229][ T5789] usb 5-1: Product: syz [ 1844.700244][ T5789] usb 5-1: Manufacturer: syz [ 1844.700260][ T5789] usb 5-1: SerialNumber: syz [ 1844.713685][ T5789] usb 5-1: config 0 descriptor?? [ 1844.939564][ T5789] usb 5-1: USB disconnect, device number 11 [ 1845.015802][T25556] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4721'. [ 1845.023118][ T30] audit: type=1400 audit(1790904715.493:13615): avc: denied { write } for pid=25555 comm="syz.5.4721" name="ports" dev="configfs" ino=3579 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1845.461496][T11919] Bluetooth: hci0: command 0x0c1a tx timeout [ 1845.468191][T25456] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1845.944172][ T5789] net_ratelimit: 8 callbacks suppressed [ 1846.096660][ T30] audit: type=1400 audit(1790904716.573:13616): avc: denied { write } for pid=25563 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1846.110820][T25587] binder: 25585:25587 ioctl c0306201 0 returned -14 [ 1846.274580][ T30] audit: type=1400 audit(1790904716.753:13617): avc: denied { write } for pid=25591 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1847.328602][ T30] audit: type=1400 audit(1790904717.803:13618): avc: denied { write } for pid=25598 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1847.386548][T25631] binder: 25628:25631 ioctl c0306201 0 returned -14 [ 1847.485540][ T30] audit: type=1400 audit(1790904717.963:13619): avc: denied { write } for pid=25634 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1847.541239][T11919] Bluetooth: hci0: command 0x0c1a tx timeout [ 1847.543420][ T30] audit: type=1400 audit(1790904718.023:13620): avc: denied { setopt } for pid=25635 comm="syz.3.4746" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1847.571216][ T5789] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 1847.721167][ T5789] usb 8-1: Using ep0 maxpacket: 16 [ 1847.721930][ T5789] usb 8-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 1847.724424][ T5789] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1847.724455][ T5789] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1847.726676][ T5789] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1847.726702][ T5789] usb 8-1: Product: syz [ 1847.726717][ T5789] usb 8-1: Manufacturer: syz [ 1847.726732][ T5789] usb 8-1: SerialNumber: syz [ 1847.732126][ T5789] usb 8-1: config 0 descriptor?? [ 1847.979101][ C0] imon 8-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 1847.988930][ T30] audit: type=1400 audit(1790904718.463:13621): avc: denied { write } for pid=25641 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1847.999733][ T5789] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/input/input31 [ 1848.052200][ T5789] imon:send_packet: packet tx failed (-71) [ 1848.071161][ T5789] imon 8-1:0.0: panel buttons/knobs setup failed [ 1848.219369][ T30] audit: type=1400 audit(1790904718.693:13622): avc: denied { write } for pid=25669 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1848.221413][ T5789] rc_core: IR keymap rc-imon-pad not found [ 1848.221427][ T5789] Registered IR keymap rc-empty [ 1848.221533][ T5789] imon 8-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 1848.221549][ T5789] imon 8-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1848.223263][ T5789] imon:send_packet: packet tx failed (-71) [ 1848.244275][ T5789] imon 8-1:0.0: remote input dev register failed [ 1848.244506][ T5789] imon 8-1:0.0: imon_init_intf0: rc device setup failed [ 1848.283462][T25674] binder: 25673:25674 ioctl c0306201 0 returned -14 [ 1848.396281][ T5789] imon 8-1:0.0: unable to initialize intf0, err 0 [ 1848.396296][ T5789] imon:imon_probe: failed to initialize context! [ 1848.396308][ T5789] imon 8-1:0.0: unable to register, err -19 [ 1848.431929][ T5789] usb 8-1: USB disconnect, device number 17 [ 1848.632288][T25690] FAULT_INJECTION: forcing a failure. [ 1848.632288][T25690] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1848.632318][T25690] CPU: 0 UID: 0 PID: 25690 Comm: syz.4.4761 Tainted: G L syzkaller #0 PREEMPT(full) [ 1848.632347][T25690] Tainted: [L]=SOFTLOCKUP [ 1848.632355][T25690] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1848.632367][T25690] Call Trace: [ 1848.632375][T25690] [ 1848.632384][T25690] dump_stack_lvl+0x100/0x190 [ 1848.632422][T25690] should_fail_ex.cold+0x5/0xa [ 1848.632450][T25690] get_futex_key+0x1d0/0x14f0 [ 1848.632481][T25690] ? __pfx_get_futex_key+0x10/0x10 [ 1848.632507][T25690] ? get_pid_task+0x2a/0x250 [ 1848.632534][T25690] ? find_held_lock+0x2b/0x80 [ 1848.632562][T25690] ? get_pid_task+0xfc/0x250 [ 1848.632588][T25690] ? get_pid_task+0xfc/0x250 [ 1848.632618][T25690] futex_wake+0xf4/0x5e0 [ 1848.632641][T25690] ? find_held_lock+0x2b/0x80 [ 1848.632670][T25690] ? __pfx_futex_wake+0x10/0x10 [ 1848.632694][T25690] ? rcu_read_lock_any_held+0x6a/0x90 [ 1848.632724][T25690] ? find_held_lock+0x2b/0x80 [ 1848.632749][T25690] ? ksys_write+0x190/0x250 [ 1848.632773][T25690] ? ksys_write+0x190/0x250 [ 1848.632799][T25690] do_futex+0x2b2/0x440 [ 1848.632826][T25690] ? __pfx_do_futex+0x10/0x10 [ 1848.632855][T25690] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1848.632885][T25690] __x64_sys_futex+0x34f/0x4d0 [ 1848.632919][T25690] ? fput+0x7c/0x100 [ 1848.632948][T25690] ? __pfx___x64_sys_futex+0x10/0x10 [ 1848.632978][T25690] ? ksys_write+0x1ac/0x250 [ 1848.633000][T25690] ? __pfx_ksys_write+0x10/0x10 [ 1848.633032][T25690] do_syscall_64+0x123/0x790 [ 1848.633059][T25690] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1848.633081][T25690] RIP: 0033:0x7fec22f9e159 [ 1848.633111][T25690] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1848.633133][T25690] RSP: 002b:00007fec23f050e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1848.633156][T25690] RAX: ffffffffffffffda RBX: 00007fec23225fa8 RCX: 00007fec22f9e159 [ 1848.633172][T25690] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fec23225fac [ 1848.633186][T25690] RBP: 00007fec23225fa0 R08: 0000000000000001 R09: 0000000000000000 [ 1848.633200][T25690] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 1848.633213][T25690] R13: 00007fec23226038 R14: 00007fff4bcffb60 R15: 00007fff4bcffc48 [ 1848.633243][T25690] [ 1849.374781][T25714] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4768'. [ 1849.960565][T25733] FAULT_INJECTION: forcing a failure. [ 1849.960565][T25733] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1849.960598][T25733] CPU: 0 UID: 0 PID: 25733 Comm: syz.4.4773 Tainted: G L syzkaller #0 PREEMPT(full) [ 1849.960630][T25733] Tainted: [L]=SOFTLOCKUP [ 1849.960638][T25733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1849.960652][T25733] Call Trace: [ 1849.960660][T25733] [ 1849.960670][T25733] dump_stack_lvl+0x100/0x190 [ 1849.960701][T25733] should_fail_ex.cold+0x5/0xa [ 1849.960725][T25733] get_futex_key+0x1d0/0x14f0 [ 1849.960755][T25733] ? __pfx_get_futex_key+0x10/0x10 [ 1849.960778][T25733] ? get_pid_task+0x2a/0x250 [ 1849.960804][T25733] ? find_held_lock+0x2b/0x80 [ 1849.960831][T25733] ? get_pid_task+0xfc/0x250 [ 1849.960856][T25733] ? get_pid_task+0xfc/0x250 [ 1849.960887][T25733] futex_wake+0xf4/0x5e0 [ 1849.960908][T25733] ? find_held_lock+0x2b/0x80 [ 1849.960934][T25733] ? __pfx_futex_wake+0x10/0x10 [ 1849.960959][T25733] ? rcu_read_lock_any_held+0x6a/0x90 [ 1849.960990][T25733] ? find_held_lock+0x2b/0x80 [ 1849.961017][T25733] ? ksys_write+0x190/0x250 [ 1849.961039][T25733] ? ksys_write+0x190/0x250 [ 1849.961065][T25733] do_futex+0x2b2/0x440 [ 1849.961097][T25733] ? __pfx_do_futex+0x10/0x10 [ 1849.961126][T25733] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1849.961155][T25733] __x64_sys_futex+0x34f/0x4d0 [ 1849.961187][T25733] ? fput+0x7c/0x100 [ 1849.961214][T25733] ? __pfx___x64_sys_futex+0x10/0x10 [ 1849.961241][T25733] ? ksys_write+0x1ac/0x250 [ 1849.961277][T25733] ? __pfx_ksys_write+0x10/0x10 [ 1849.961311][T25733] do_syscall_64+0x123/0x790 [ 1849.961338][T25733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1849.961360][T25733] RIP: 0033:0x7fec22f9e159 [ 1849.961379][T25733] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1849.961400][T25733] RSP: 002b:00007fec23f050e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1849.961421][T25733] RAX: ffffffffffffffda RBX: 00007fec23225fa8 RCX: 00007fec22f9e159 [ 1849.961436][T25733] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fec23225fac [ 1849.961450][T25733] RBP: 00007fec23225fa0 R08: 0000000000000001 R09: 0000000000000000 [ 1849.961464][T25733] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 1849.961478][T25733] R13: 00007fec23226038 R14: 00007fff4bcffb60 R15: 00007fff4bcffc48 [ 1849.961508][T25733] [ 1850.128561][ T30] audit: type=1400 audit(1790904720.603:13623): avc: denied { write } for pid=25703 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1850.383960][ T30] audit: type=1400 audit(1790904720.863:13624): avc: denied { write } for pid=25742 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1850.942830][ T30] audit: type=1400 audit(1790904721.423:13625): avc: denied { write } for pid=25763 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1851.633529][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 1851.633582][ T30] audit: type=1400 audit(1790904722.113:13627): avc: denied { write } for pid=25790 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1851.919052][ T30] audit: type=1400 audit(1790904722.393:13628): avc: denied { write } for pid=25808 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1852.228590][T25822] fuse: Bad value for 'fd' [ 1852.247213][T25825] net_ratelimit: 20 callbacks suppressed [ 1852.501333][ T5789] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 1852.672118][ T5789] usb 8-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 1852.673723][ T5789] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1852.674718][ T5789] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1852.676582][ T5789] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1852.676594][ T5789] usb 8-1: Product: syz [ 1852.676603][ T5789] usb 8-1: Manufacturer: syz [ 1852.676612][ T5789] usb 8-1: SerialNumber: syz [ 1852.693323][ T5789] ti_usb_3410_5052 8-1:2.0: TI USB 5052 2 port adapter converter detected [ 1852.698425][ T5789] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 1852.707247][ T5789] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 1852.902986][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 1853.568411][ T30] audit: type=1400 audit(1790904724.043:13629): avc: denied { write } for pid=25845 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1853.686087][ T30] audit: type=1400 audit(1790904724.163:13630): avc: denied { write } for pid=25858 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1853.946685][T25826] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set config on port 0, -110 [ 1853.947097][T25826] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -32 [ 1853.947134][T25826] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set modem control on port 0, -32 [ 1853.947503][T25826] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot send open command, -32 [ 1853.950424][ T5040] usb 8-1: USB disconnect, device number 18 [ 1854.016999][ T5040] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 1854.050933][ T5040] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 1854.063191][ T5040] ti_usb_3410_5052 8-1:2.0: device disconnected [ 1854.243858][ T30] audit: type=1400 audit(1790904724.723:13631): avc: denied { write } for pid=25865 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1854.476285][ T30] audit: type=1400 audit(1790904724.943:13632): avc: denied { write } for pid=25889 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1855.044684][T25890] bridge0: port 3(syz_tun) entered blocking state [ 1855.044765][T25890] bridge0: port 3(syz_tun) entered forwarding state [ 1855.061402][T25890] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1855.070135][T25890] 8021q: adding VLAN 0 to HW filter on device team0 [ 1855.150531][T25890] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1855.369467][T25902] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1855.623762][T25890] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1855.682821][T25890] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1855.737234][T25890] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1855.737252][T25890] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1855.800855][T25890] veth1_vlan: left promiscuous mode [ 1855.814523][T25890] veth0_vlan: left promiscuous mode [ 1855.846792][T25890] veth0_vlan: entered promiscuous mode [ 1855.875230][T25890] veth1_vlan: entered promiscuous mode [ 1855.925842][T25890] veth1_macvtap: left promiscuous mode [ 1855.943266][T25890] veth0_macvtap: left promiscuous mode [ 1855.957618][T25890] veth0_macvtap: entered promiscuous mode [ 1855.975075][T25890] veth1_macvtap: entered promiscuous mode [ 1856.008828][ T30] audit: type=1400 audit(1790904726.483:13633): avc: denied { write } for pid=25897 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1856.008969][T25890] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1856.049986][T25890] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1856.082452][T25890] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1856.102877][T25890] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1856.163809][ T1495] bridge0: port 1(bridge_slave_0) entered blocking state [ 1856.163916][ T1495] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1856.175523][ T1495] bridge0: port 2(bridge_slave_1) entered blocking state [ 1856.175629][ T1495] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1856.234439][ T30] audit: type=1400 audit(1790904726.713:13634): avc: denied { write } for pid=25927 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1856.341581][T11162] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1856.344247][T11162] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1856.344294][T11162] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1856.344325][T11162] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1856.831187][ T5794] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 1856.907499][ T30] audit: type=1400 audit(1790904727.333:13635): avc: denied { write } for pid=25937 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1857.061528][ T5794] usb 5-1: Using ep0 maxpacket: 32 [ 1857.068398][ T5794] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1857.097570][ T5794] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1857.097626][ T5794] usb 5-1: config 0 has no interfaces? [ 1857.141237][ T30] audit: type=1400 audit(1790904727.503:13636): avc: denied { write } for pid=25959 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1857.179129][ T5794] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1857.179342][ T5794] usb 5-1: Product: syz [ 1857.179956][ T5794] usb 5-1: Manufacturer: syz [ 1857.180173][ T5794] usb 5-1: SerialNumber: syz [ 1857.266215][ T5794] usb 5-1: config 0 descriptor?? [ 1857.381170][ C1] net_ratelimit: 73 callbacks suppressed [ 1857.684975][T25974] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 1857.688549][ T30] audit: type=1400 audit(1790904728.163:13637): avc: denied { bind } for pid=25973 comm="syz.7.4829" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1857.918543][T25987] FAULT_INJECTION: forcing a failure. [ 1857.918543][T25987] name failslab, interval 1, probability 0, space 0, times 0 [ 1857.918574][T25987] CPU: 1 UID: 0 PID: 25987 Comm: syz.4.4821 Tainted: G L syzkaller #0 PREEMPT(full) [ 1857.918606][T25987] Tainted: [L]=SOFTLOCKUP [ 1857.918615][T25987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1857.918629][T25987] Call Trace: [ 1857.918637][T25987] [ 1857.918646][T25987] dump_stack_lvl+0x100/0x190 [ 1857.918685][T25987] should_fail_ex.cold+0x5/0xa [ 1857.918718][T25987] should_failslab+0xc2/0x120 [ 1857.918747][T25987] __kmalloc_cache_noprof+0x91/0x6d0 [ 1857.918770][T25987] ? x509_cert_parse+0xfc/0x910 [ 1857.918803][T25987] x509_cert_parse+0xfc/0x910 [ 1857.918832][T25987] x509_key_preparse+0x65/0x9c0 [ 1857.918865][T25987] asymmetric_key_preparse+0xce/0x1d0 [ 1857.918886][T25987] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 1857.918908][T25987] __key_create_or_update+0x463/0xe30 [ 1857.918940][T25987] ? __pfx___key_create_or_update+0x10/0x10 [ 1857.918970][T25987] ? lookup_user_key+0x3f3/0x1300 [ 1857.919010][T25987] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 1857.919043][T25987] key_create_or_update+0x42/0x60 [ 1857.919075][T25987] __do_sys_add_key+0x2e8/0x460 [ 1857.919098][T25987] ? __pfx___do_sys_add_key+0x10/0x10 [ 1857.919130][T25987] do_syscall_64+0x123/0x790 [ 1857.919165][T25987] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1857.919188][T25987] RIP: 0033:0x7fec22f9e159 [ 1857.919207][T25987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1857.919226][T25987] RSP: 002b:00007fec23ee4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 1857.919247][T25987] RAX: ffffffffffffffda RBX: 00007fec23226090 RCX: 00007fec22f9e159 [ 1857.919262][T25987] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 1857.919276][T25987] RBP: 00007fec2303506b R08: ffffffffffffffff R09: 0000000000000000 [ 1857.919289][T25987] R10: 0000000000000254 R11: 0000000000000246 R12: 0000000000000000 [ 1857.919302][T25987] R13: 00007fec23226128 R14: 00007fec23226090 R15: 00007fff4bcffc48 [ 1857.919333][T25987] [ 1858.434333][ T30] audit: type=1400 audit(1790904728.913:13638): avc: denied { write } for pid=25967 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1858.649765][T26019] ovs-dp0: entered promiscuous mode [ 1858.670599][ T30] audit: type=1400 audit(1790904729.143:13639): avc: denied { write } for pid=26021 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1859.638529][ T30] audit: type=1400 audit(1790904730.113:13640): avc: denied { write } for pid=26030 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1859.646172][ T5040] usb 5-1: USB disconnect, device number 12 [ 1859.969484][ T30] audit: type=1400 audit(1790904730.443:13641): avc: denied { write } for pid=26059 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1860.486756][T26102] netlink: 'syz.3.4860': attribute type 1 has an invalid length. [ 1862.261218][T11919] Bluetooth: hci4: command 0x0406 tx timeout [ 1862.266244][T26074] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1862.266602][T26074] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1862.679117][ C1] net_ratelimit: 101 callbacks suppressed [ 1862.753105][ T5608] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 1862.902475][ T5608] usb 5-1: New USB device found, idVendor=0ab4, idProduct=0011, bcdDevice=ca.fb [ 1862.903858][ T5608] usb 5-1: config 2 has an invalid interface number: 79 but max is 0 [ 1862.903881][ T5608] usb 5-1: config 2 has no interface number 0 [ 1862.903909][ T5608] usb 5-1: config 2 interface 79 has no altsetting 0 [ 1862.908538][ T5608] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1862.908550][ T5608] usb 5-1: Product: syz [ 1862.908559][ T5608] usb 5-1: Manufacturer: syz [ 1862.908568][ T5608] usb 5-1: SerialNumber: syz [ 1863.162370][ T5608] usb 5-1: USB disconnect, device number 13 [ 1863.313269][T26072] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1863.616467][ T30] audit: type=1400 audit(1790904734.093:13642): avc: denied { create } for pid=26165 comm="syz.3.4882" name="#f" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1863.617185][ T30] audit: type=1400 audit(1790904734.093:13643): avc: denied { link } for pid=26165 comm="syz.3.4882" name="#f" dev="tmpfs" ino=2182 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1863.624360][ T30] audit: type=1400 audit(1790904734.093:13644): avc: denied { rename } for pid=26165 comm="syz.3.4882" name="#10" dev="tmpfs" ino=2182 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1864.351167][T19822] Bluetooth: hci0: command 0x0c1a tx timeout [ 1864.351214][T19822] Bluetooth: hci4: command 0x0406 tx timeout [ 1864.578088][ T30] audit: type=1400 audit(1790904735.053:13645): avc: denied { write } for pid=26195 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1864.774450][ T30] audit: type=1400 audit(1790904735.253:13646): avc: denied { write } for pid=26231 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1865.211684][T26256] FAULT_INJECTION: forcing a failure. [ 1865.211684][T26256] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1865.211721][T26256] CPU: 1 UID: 0 PID: 26256 Comm: syz.5.4913 Tainted: G L syzkaller #0 PREEMPT(full) [ 1865.211752][T26256] Tainted: [L]=SOFTLOCKUP [ 1865.211760][T26256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1865.211774][T26256] Call Trace: [ 1865.211782][T26256] [ 1865.211790][T26256] dump_stack_lvl+0x100/0x190 [ 1865.211825][T26256] should_fail_ex.cold+0x5/0xa [ 1865.211853][T26256] get_futex_key+0x1d0/0x14f0 [ 1865.211883][T26256] ? __pfx_get_futex_key+0x10/0x10 [ 1865.211908][T26256] ? get_pid_task+0x2a/0x250 [ 1865.211933][T26256] ? find_held_lock+0x2b/0x80 [ 1865.211960][T26256] ? get_pid_task+0xfc/0x250 [ 1865.211988][T26256] ? get_pid_task+0xfc/0x250 [ 1865.212018][T26256] futex_wake+0xf4/0x5e0 [ 1865.212039][T26256] ? find_held_lock+0x2b/0x80 [ 1865.212066][T26256] ? __pfx_futex_wake+0x10/0x10 [ 1865.212088][T26256] ? rcu_read_lock_any_held+0x6a/0x90 [ 1865.212120][T26256] ? find_held_lock+0x2b/0x80 [ 1865.212149][T26256] ? ksys_write+0x190/0x250 [ 1865.212172][T26256] ? ksys_write+0x190/0x250 [ 1865.212196][T26256] do_futex+0x2b2/0x440 [ 1865.212226][T26256] ? __pfx_do_futex+0x10/0x10 [ 1865.212256][T26256] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1865.212285][T26256] __x64_sys_futex+0x34f/0x4d0 [ 1865.212317][T26256] ? fput+0x7c/0x100 [ 1865.212348][T26256] ? __pfx___x64_sys_futex+0x10/0x10 [ 1865.212378][T26256] ? ksys_write+0x1ac/0x250 [ 1865.212403][T26256] ? __pfx_ksys_write+0x10/0x10 [ 1865.212437][T26256] do_syscall_64+0x123/0x790 [ 1865.212464][T26256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1865.212487][T26256] RIP: 0033:0x7fbfb039e159 [ 1865.212512][T26256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1865.212534][T26256] RSP: 002b:00007fbfb12740e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1865.212556][T26256] RAX: ffffffffffffffda RBX: 00007fbfb0625fa8 RCX: 00007fbfb039e159 [ 1865.212568][T26256] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbfb0625fac [ 1865.212580][T26256] RBP: 00007fbfb0625fa0 R08: 0000000000000001 R09: 0000000000000000 [ 1865.212590][T26256] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 1865.212602][T26256] R13: 00007fbfb0626038 R14: 00007ffd664d9ed0 R15: 00007ffd664d9fb8 [ 1865.212623][T26256] [ 1865.613531][ T30] audit: type=1400 audit(1790904736.093:13647): avc: denied { write } for pid=26247 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1865.859324][ T30] audit: type=1400 audit(1790904736.333:13648): avc: denied { write } for pid=26284 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1866.174754][ T30] audit: type=1400 audit(1790904736.653:13649): avc: denied { name_connect } for pid=26291 comm="syz.7.4923" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 1866.211562][ T30] audit: type=1400 audit(1790904736.693:13650): avc: denied { listen } for pid=26291 comm="syz.7.4923" lport=52761 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1866.237455][ T30] audit: type=1400 audit(1790904736.713:13651): avc: denied { accept } for pid=26291 comm="syz.7.4923" lport=52761 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1866.391223][ T5613] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 1866.421345][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 1866.521479][ T5613] usb 5-1: device descriptor read/64, error -71 [ 1866.701258][ T5040] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 1866.761469][ T5613] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 1866.863997][ T5040] usb 6-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1866.866110][ T5040] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1866.871488][ T5040] usb 6-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1866.871532][ T5040] usb 6-1: Product: syz [ 1866.871548][ T5040] usb 6-1: Manufacturer: syz [ 1866.871563][ T5040] usb 6-1: SerialNumber: syz [ 1866.902912][ T5613] usb 5-1: device descriptor read/64, error -71 [ 1866.906757][ T5040] usb 6-1: config 0 descriptor?? [ 1866.930775][ T5040] keyspan 6-1:0.0: Keyspan 4 port adapter converter detected [ 1866.930950][ T5040] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 81 [ 1866.933954][ T5040] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 88 [ 1866.943444][ T5040] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 1 [ 1866.965195][ T5040] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 1866.966239][ T5040] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 2 [ 1866.993512][ T5040] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 1866.999643][ T5040] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 4 [ 1867.013497][ T5613] usb usb5-port1: attempt power cycle [ 1867.027616][ T5040] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 1867.046432][ T5040] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 6 [ 1867.061812][ T5040] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 1867.100499][T26322] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4929'. [ 1867.167658][ T5040] usb 6-1: USB disconnect, device number 12 [ 1867.204770][ T5040] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 1867.228712][ T5040] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 1867.252560][ T5040] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 1867.259049][ T5040] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 1867.281927][ T5040] keyspan 6-1:0.0: device disconnected [ 1867.351614][ T5613] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 1867.370217][T26327] binder: 26326:26327 ioctl c0306201 200000000080 returned -14 [ 1867.379857][ T5613] usb 5-1: device descriptor read/8, error -71 [ 1867.390278][T26327] binder: 26326:26327 ioctl 4018620d 0 returned -22 [ 1867.612935][ T5613] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 1867.632068][ T5613] usb 5-1: device descriptor read/8, error -71 [ 1867.742300][ T5613] usb usb5-port1: unable to enumerate USB device [ 1867.783427][ T5794] usb 9-1: new full-speed USB device number 12 using dummy_hcd [ 1867.932230][ T5794] usb 9-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1867.933520][ T5794] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1867.937279][ T5794] usb 9-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1867.937298][ T5794] usb 9-1: Product: syz [ 1867.937312][ T5794] usb 9-1: Manufacturer: syz [ 1867.937326][ T5794] usb 9-1: SerialNumber: syz [ 1867.950849][ T5794] usb 9-1: config 0 descriptor?? [ 1867.999672][ T5794] keyspan 9-1:0.0: Keyspan 4 port adapter converter detected [ 1868.000069][ T5794] keyspan 9-1:0.0: found no endpoint descriptor for endpoint 81 [ 1868.000148][ T5794] keyspan 9-1:0.0: found no endpoint descriptor for endpoint 88 [ 1868.028122][ T5794] keyspan 9-1:0.0: found no endpoint descriptor for endpoint 1 [ 1868.030154][ T5794] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 1868.056281][ T5794] keyspan 9-1:0.0: found no endpoint descriptor for endpoint 2 [ 1868.059173][ T5794] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 1868.081846][ T5794] keyspan 9-1:0.0: found no endpoint descriptor for endpoint 4 [ 1868.085099][ T5794] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 1868.087906][ T5794] keyspan 9-1:0.0: found no endpoint descriptor for endpoint 6 [ 1868.128153][ T5794] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 1868.245362][ T5613] usb 9-1: USB disconnect, device number 12 [ 1868.270112][ T5613] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 1868.293025][ T5613] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 1868.357550][ T5613] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 1868.382768][ T5613] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 1868.403117][ T5613] keyspan 9-1:0.0: device disconnected [ 1868.421164][ C1] net_ratelimit: 60 callbacks suppressed [ 1869.042940][T26363] ip_tables: iptables: counters copy to user failed while replacing table [ 1869.158914][T26367] binder: 26366:26367 ioctl c0306201 200000000080 returned -14 [ 1869.176960][T26367] binder: 26366:26367 ioctl 4018620d 0 returned -22 [ 1869.341246][T26374] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1869.858965][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 1869.858980][ T30] audit: type=1400 audit(1790904740.333:13656): avc: denied { write } for pid=26386 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1869.900266][T26412] binder: 26411:26412 ioctl c0306201 200000000080 returned -14 [ 1869.915782][T26412] binder: 26411:26412 ioctl c0306201 0 returned -14 [ 1869.927943][T19940] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 1870.050390][ T30] audit: type=1400 audit(1790904740.523:13657): avc: denied { write } for pid=26418 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1870.074287][T19940] usb 9-1: device descriptor read/64, error -71 [ 1870.321536][T19940] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 1870.463262][T19940] usb 9-1: device descriptor read/64, error -71 [ 1870.573336][T19940] usb usb9-port1: attempt power cycle [ 1870.648918][T26453] binder: 26452:26453 ioctl c0306201 200000000080 returned -14 [ 1870.655235][T26453] binder: 26452:26453 ioctl c0306201 0 returned -14 [ 1870.706746][ T30] audit: type=1400 audit(1790904741.183:13658): avc: denied { write } for pid=26424 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1870.911232][T19940] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 1870.949434][T19940] usb 9-1: device descriptor read/8, error -71 [ 1871.021042][ T30] audit: type=1400 audit(1790904741.493:13659): avc: denied { write } for pid=26460 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1871.191482][T19940] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 1871.223380][T19940] usb 9-1: device descriptor read/8, error -71 [ 1871.333256][T19940] usb usb9-port1: unable to enumerate USB device [ 1871.516229][T26488] binder: 26487:26488 ioctl c0306201 200000000080 returned -14 [ 1871.518555][T26488] binder: 26487:26488 ioctl c0306201 0 returned -14 [ 1871.676388][ T30] audit: type=1400 audit(1790904742.153:13660): avc: denied { write } for pid=26478 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1871.799291][ T30] audit: type=1400 audit(1790904742.273:13661): avc: denied { write } for pid=26502 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1872.234060][ T30] audit: type=1400 audit(1790904742.713:13662): avc: denied { write } for pid=26512 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1872.238594][T26535] binder: 26529:26535 ioctl c0306201 200000000080 returned -14 [ 1872.363580][ T30] audit: type=1400 audit(1790904742.843:13663): avc: denied { write } for pid=26539 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1872.365195][T26540] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.4993'. [ 1872.422351][T26533] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4991'. [ 1872.422376][T26533] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1872.424783][T26533] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1872.648655][ T52] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 1872.903832][ T30] audit: type=1400 audit(1790904743.383:13664): avc: denied { write } for pid=26550 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1873.052638][ T30] audit: type=1400 audit(1790904743.533:13665): avc: denied { write } for pid=26574 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1873.201423][T19940] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1873.222112][T26583] binder: 26582:26583 ioctl c0306201 200000000080 returned -14 [ 1873.352817][T19940] usb 6-1: Using ep0 maxpacket: 32 [ 1873.353692][T19940] usb 6-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1873.354869][T19940] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1873.354892][T19940] usb 6-1: config 0 has no interfaces? [ 1873.357306][T19940] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1873.357328][T19940] usb 6-1: Product: syz [ 1873.357343][T19940] usb 6-1: Manufacturer: syz [ 1873.357359][T19940] usb 6-1: SerialNumber: syz [ 1873.363498][T19940] usb 6-1: config 0 descriptor?? [ 1873.621192][ C1] net_ratelimit: 39 callbacks suppressed [ 1873.676886][T26605] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1873.677271][T26605] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1873.949156][T26623] FAULT_INJECTION: forcing a failure. [ 1873.949156][T26623] name failslab, interval 1, probability 0, space 0, times 0 [ 1873.949186][T26623] CPU: 0 UID: 0 PID: 26623 Comm: syz.5.5001 Tainted: G L syzkaller #0 PREEMPT(full) [ 1873.949218][T26623] Tainted: [L]=SOFTLOCKUP [ 1873.949226][T26623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1873.949240][T26623] Call Trace: [ 1873.949248][T26623] [ 1873.949257][T26623] dump_stack_lvl+0x100/0x190 [ 1873.949293][T26623] should_fail_ex.cold+0x5/0xa [ 1873.949321][T26623] should_failslab+0xc2/0x120 [ 1873.949352][T26623] __kmalloc_cache_noprof+0x91/0x6d0 [ 1873.949388][T26623] ? pkcs8_key_preparse+0x128/0x480 [ 1873.949430][T26623] pkcs8_key_preparse+0x128/0x480 [ 1873.949459][T26623] ? __pfx_pkcs8_key_preparse+0x10/0x10 [ 1873.949498][T26623] asymmetric_key_preparse+0xce/0x1d0 [ 1873.949517][T26623] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 1873.949537][T26623] __key_create_or_update+0x463/0xe30 [ 1873.949570][T26623] ? __pfx___key_create_or_update+0x10/0x10 [ 1873.949600][T26623] ? lookup_user_key+0x3f3/0x1300 [ 1873.949648][T26623] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 1873.949714][T26623] key_create_or_update+0x42/0x60 [ 1873.949755][T26623] __do_sys_add_key+0x2e8/0x460 [ 1873.949777][T26623] ? __pfx___do_sys_add_key+0x10/0x10 [ 1873.949843][T26623] do_syscall_64+0x123/0x790 [ 1873.949872][T26623] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1873.949901][T26623] RIP: 0033:0x7fbfb039e159 [ 1873.949919][T26623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1873.949941][T26623] RSP: 002b:00007fbfb1253028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 1873.949964][T26623] RAX: ffffffffffffffda RBX: 00007fbfb0626090 RCX: 00007fbfb039e159 [ 1873.949980][T26623] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 1873.949994][T26623] RBP: 00007fbfb043506b R08: ffffffffffffffff R09: 0000000000000000 [ 1873.950008][T26623] R10: 0000000000000254 R11: 0000000000000246 R12: 0000000000000000 [ 1873.950022][T26623] R13: 00007fbfb0626128 R14: 00007fbfb0626090 R15: 00007ffd664d9fb8 [ 1873.950053][T26623] [ 1874.531302][T26648] binder: 26646:26648 ioctl c0306201 200000000080 returned -14 [ 1874.643165][T26653] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5017'. [ 1874.771210][ T5789] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1874.932447][ T5789] usb 4-1: Using ep0 maxpacket: 8 [ 1874.933166][ T5789] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 1874.934064][ T5789] usb 4-1: config 1 has an invalid descriptor of length 231, skipping remainder of the config [ 1874.934077][ T5789] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1874.934090][ T5789] usb 4-1: config 1 has no interface number 0 [ 1874.935805][ T5789] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1874.935816][ T5789] usb 4-1: Product: syz [ 1874.935825][ T5789] usb 4-1: Manufacturer: syz [ 1874.935834][ T5789] usb 4-1: SerialNumber: syz [ 1875.170347][ T5789] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 1875.195934][T26324] udevd[26324]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1875.701230][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 1875.701251][T19822] Bluetooth: hci4: command 0x0406 tx timeout [ 1875.702812][T26603] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1875.875459][T26667] FAULT_INJECTION: forcing a failure. [ 1875.875459][T26667] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1875.875490][T26667] CPU: 0 UID: 0 PID: 26667 Comm: syz.8.5022 Tainted: G L syzkaller #0 PREEMPT(full) [ 1875.875509][T26667] Tainted: [L]=SOFTLOCKUP [ 1875.875513][T26667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1875.875521][T26667] Call Trace: [ 1875.875526][T26667] [ 1875.875532][T26667] dump_stack_lvl+0x100/0x190 [ 1875.875556][T26667] should_fail_ex.cold+0x5/0xa [ 1875.875574][T26667] get_futex_key+0x1d0/0x14f0 [ 1875.875592][T26667] ? __pfx_get_futex_key+0x10/0x10 [ 1875.875607][T26667] ? get_pid_task+0x2a/0x250 [ 1875.875622][T26667] ? find_held_lock+0x2b/0x80 [ 1875.875639][T26667] ? get_pid_task+0xfc/0x250 [ 1875.875654][T26667] ? get_pid_task+0xfc/0x250 [ 1875.875672][T26667] futex_wake+0xf4/0x5e0 [ 1875.875685][T26667] ? find_held_lock+0x2b/0x80 [ 1875.875701][T26667] ? __pfx_futex_wake+0x10/0x10 [ 1875.875715][T26667] ? rcu_read_lock_any_held+0x6a/0x90 [ 1875.875733][T26667] ? find_held_lock+0x2b/0x80 [ 1875.875750][T26667] ? ksys_write+0x190/0x250 [ 1875.875763][T26667] ? ksys_write+0x190/0x250 [ 1875.875777][T26667] do_futex+0x2b2/0x440 [ 1875.875795][T26667] ? __pfx_do_futex+0x10/0x10 [ 1875.875812][T26667] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1875.875828][T26667] __x64_sys_futex+0x34f/0x4d0 [ 1875.875846][T26667] ? fput+0x7c/0x100 [ 1875.875861][T26667] ? __pfx___x64_sys_futex+0x10/0x10 [ 1875.875877][T26667] ? ksys_write+0x1ac/0x250 [ 1875.875890][T26667] ? __pfx_ksys_write+0x10/0x10 [ 1875.875908][T26667] do_syscall_64+0x123/0x790 [ 1875.875922][T26667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1875.875934][T26667] RIP: 0033:0x7f38ce79e159 [ 1875.875947][T26667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1875.875958][T26667] RSP: 002b:00007f38cf6e90e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1875.875970][T26667] RAX: ffffffffffffffda RBX: 00007f38cea25fa8 RCX: 00007f38ce79e159 [ 1875.875978][T26667] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f38cea25fac [ 1875.875986][T26667] RBP: 00007f38cea25fa0 R08: 0000000000000001 R09: 0000000000000000 [ 1875.875993][T26667] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 1875.876001][T26667] R13: 00007f38cea26038 R14: 00007ffe9b944040 R15: 00007ffe9b944128 [ 1875.876017][T26667] [ 1875.984249][ T5789] usb 6-1: USB disconnect, device number 13 [ 1876.150859][T26674] binder: 26673:26674 ioctl c0306201 200000000080 returned -14 [ 1876.394058][T26686] bond2: entered promiscuous mode [ 1876.394083][T26686] bond2: entered allmulticast mode [ 1876.394513][T26686] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1876.979076][T26699] FAULT_INJECTION: forcing a failure. [ 1876.979076][T26699] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1876.979106][T26699] CPU: 0 UID: 0 PID: 26699 Comm: syz.5.5034 Tainted: G L syzkaller #0 PREEMPT(full) [ 1876.979123][T26699] Tainted: [L]=SOFTLOCKUP [ 1876.979128][T26699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1876.979136][T26699] Call Trace: [ 1876.979141][T26699] [ 1876.979146][T26699] dump_stack_lvl+0x100/0x190 [ 1876.979168][T26699] should_fail_ex.cold+0x5/0xa [ 1876.979186][T26699] get_futex_key+0x1d0/0x14f0 [ 1876.979205][T26699] ? __pfx_get_futex_key+0x10/0x10 [ 1876.979219][T26699] ? get_pid_task+0x2a/0x250 [ 1876.979236][T26699] ? find_held_lock+0x2b/0x80 [ 1876.979252][T26699] ? get_pid_task+0xfc/0x250 [ 1876.979267][T26699] ? get_pid_task+0xfc/0x250 [ 1876.979287][T26699] futex_wake+0xf4/0x5e0 [ 1876.979302][T26699] ? find_held_lock+0x2b/0x80 [ 1876.979319][T26699] ? __pfx_futex_wake+0x10/0x10 [ 1876.979333][T26699] ? rcu_read_lock_any_held+0x6a/0x90 [ 1876.979351][T26699] ? find_held_lock+0x2b/0x80 [ 1876.979372][T26699] ? ksys_write+0x190/0x250 [ 1876.979395][T26699] ? ksys_write+0x190/0x250 [ 1876.979422][T26699] do_futex+0x2b2/0x440 [ 1876.979452][T26699] ? __pfx_do_futex+0x10/0x10 [ 1876.979482][T26699] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1876.979512][T26699] __x64_sys_futex+0x34f/0x4d0 [ 1876.979533][T26699] ? fput+0x7c/0x100 [ 1876.979550][T26699] ? __pfx___x64_sys_futex+0x10/0x10 [ 1876.979568][T26699] ? ksys_write+0x1ac/0x250 [ 1876.979581][T26699] ? __pfx_ksys_write+0x10/0x10 [ 1876.979599][T26699] do_syscall_64+0x123/0x790 [ 1876.979613][T26699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1876.979625][T26699] RIP: 0033:0x7fbfb039e159 [ 1876.979636][T26699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1876.979648][T26699] RSP: 002b:00007fbfb12740e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1876.979660][T26699] RAX: ffffffffffffffda RBX: 00007fbfb0625fa8 RCX: 00007fbfb039e159 [ 1876.979668][T26699] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbfb0625fac [ 1876.979676][T26699] RBP: 00007fbfb0625fa0 R08: 0000000000000001 R09: 0000000000000000 [ 1876.979684][T26699] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 1876.979692][T26699] R13: 00007fbfb0626038 R14: 00007ffd664d9ed0 R15: 00007ffd664d9fb8 [ 1876.979709][T26699] [ 1877.344653][T26708] fuse: Unknown parameter 'user_i00000000000000000000' [ 1877.448774][T26713] netlink: 'syz.7.5040': attribute type 1 has an invalid length. [ 1877.471403][ T5040] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1877.496963][T26713] netlink: 12 bytes leftover after parsing attributes in process `syz.7.5040'. [ 1877.555897][ T5789] usb 4-1: USB disconnect, device number 103 [ 1877.633153][ T5040] usb 6-1: Using ep0 maxpacket: 32 [ 1877.634672][ T5040] usb 6-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1877.637088][ T5040] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1877.637110][ T5040] usb 6-1: config 0 has no interfaces? [ 1877.639523][ T5040] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1877.639544][ T5040] usb 6-1: Product: syz [ 1877.639559][ T5040] usb 6-1: Manufacturer: syz [ 1877.639574][ T5040] usb 6-1: SerialNumber: syz [ 1877.697109][ T5040] usb 6-1: config 0 descriptor?? [ 1877.781594][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 1878.332728][T26742] FAULT_INJECTION: forcing a failure. [ 1878.332728][T26742] name failslab, interval 1, probability 0, space 0, times 0 [ 1878.332752][T26742] CPU: 1 UID: 0 PID: 26742 Comm: syz.5.5035 Tainted: G L syzkaller #0 PREEMPT(full) [ 1878.332770][T26742] Tainted: [L]=SOFTLOCKUP [ 1878.332775][T26742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1878.332783][T26742] Call Trace: [ 1878.332788][T26742] [ 1878.332793][T26742] dump_stack_lvl+0x100/0x190 [ 1878.332816][T26742] should_fail_ex.cold+0x5/0xa [ 1878.332834][T26742] should_failslab+0xc2/0x120 [ 1878.332851][T26742] __kmalloc_cache_noprof+0x91/0x6d0 [ 1878.332864][T26742] ? pkcs8_key_preparse+0x128/0x480 [ 1878.332883][T26742] pkcs8_key_preparse+0x128/0x480 [ 1878.332898][T26742] ? __pfx_pkcs8_key_preparse+0x10/0x10 [ 1878.332920][T26742] asymmetric_key_preparse+0xce/0x1d0 [ 1878.332934][T26742] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 1878.332954][T26742] __key_create_or_update+0x463/0xe30 [ 1878.332986][T26742] ? __pfx___key_create_or_update+0x10/0x10 [ 1878.333016][T26742] ? lookup_user_key+0x3f3/0x1300 [ 1878.333054][T26742] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 1878.333089][T26742] key_create_or_update+0x42/0x60 [ 1878.333120][T26742] __do_sys_add_key+0x2e8/0x460 [ 1878.333143][T26742] ? __pfx___do_sys_add_key+0x10/0x10 [ 1878.333176][T26742] do_syscall_64+0x123/0x790 [ 1878.333204][T26742] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1878.333228][T26742] RIP: 0033:0x7fbfb039e159 [ 1878.333246][T26742] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1878.333265][T26742] RSP: 002b:00007fbfb1253028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 1878.333285][T26742] RAX: ffffffffffffffda RBX: 00007fbfb0626090 RCX: 00007fbfb039e159 [ 1878.333301][T26742] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 1878.333314][T26742] RBP: 00007fbfb043506b R08: ffffffffffffffff R09: 0000000000000000 [ 1878.333326][T26742] R10: 0000000000000254 R11: 0000000000000246 R12: 0000000000000000 [ 1878.333339][T26742] R13: 00007fbfb0626128 R14: 00007fbfb0626090 R15: 00007ffd664d9fb8 [ 1878.333365][T26742] [ 1878.571183][T20007] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 1878.729331][T20007] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1878.729357][T20007] usb 5-1: New USB device found, idVendor=0421, idProduct=02e3, bcdDevice=43.b7 [ 1878.730625][T20007] usb 5-1: config 0 has an invalid interface number: 59 but max is 2 [ 1878.730647][T20007] usb 5-1: config 0 has an invalid interface number: 59 but max is 2 [ 1878.730667][T20007] usb 5-1: config 0 has an invalid interface number: 56 but max is 2 [ 1878.730679][T20007] usb 5-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 1878.730691][T20007] usb 5-1: config 0 has no interface number 0 [ 1878.730699][T20007] usb 5-1: config 0 has no interface number 1 [ 1878.730730][T20007] usb 5-1: config 0 interface 59 has no altsetting 0 [ 1878.730745][T20007] usb 5-1: config 0 interface 59 has no altsetting 1 [ 1878.730761][T20007] usb 5-1: config 0 interface 56 has no altsetting 0 [ 1878.817624][T20007] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1878.817636][T20007] usb 5-1: Product: syz [ 1878.817645][T20007] usb 5-1: Manufacturer: syz [ 1878.817654][T20007] usb 5-1: SerialNumber: syz [ 1878.821172][ C1] net_ratelimit: 51 callbacks suppressed [ 1878.865173][T20007] usb 5-1: config 0 descriptor?? [ 1879.123496][T20007] rndis_host 5-1:0.59: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 1879.124230][T20007] cdc_acm 5-1:0.59: Zero length descriptor references [ 1879.124246][T20007] cdc_acm 5-1:0.59: probe with driver cdc_acm failed with error -22 [ 1879.193784][T20007] usb 5-1: USB disconnect, device number 18 [ 1879.273730][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 1879.273744][ T30] audit: type=1400 audit(1790904749.753:13672): avc: denied { setopt } for pid=26752 comm="syz.3.5051" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1879.902226][T26760] netlink: 'syz.8.5053': attribute type 1 has an invalid length. [ 1880.009747][T26760] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5053'. [ 1880.284545][T20007] usb 6-1: USB disconnect, device number 14 [ 1880.399496][T26765] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1880.672803][ T5794] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 1880.831603][ T5794] usb 9-1: Using ep0 maxpacket: 8 [ 1880.854799][ T5794] usb 9-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 1880.860115][ T5794] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1880.860156][ T5794] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1880.860189][ T5794] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1880.916715][ T5794] usb 9-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 1880.916734][ T5794] usb 9-1: Product: syz [ 1880.916748][ T5794] usb 9-1: Manufacturer: syz [ 1880.916762][ T5794] usb 9-1: SerialNumber: syz [ 1880.952153][ T5794] usb 9-1: config 0 descriptor?? [ 1881.021246][ T5794] rc_core: IR keymap rc-imon-rsc not found [ 1881.021265][ T5794] Registered IR keymap rc-empty [ 1881.022703][ T5794] rc rc0: iMON Station as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0 [ 1881.024866][ T5794] input: iMON Station as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0/input33 [ 1881.433870][T20007] usb 9-1: USB disconnect, device number 17 [ 1881.561308][ T5613] usb 4-1: new full-speed USB device number 104 using dummy_hcd [ 1881.599805][T26794] netlink: 'syz.7.5066': attribute type 1 has an invalid length. [ 1881.645244][ T30] audit: type=1400 audit(1790904752.123:13673): avc: denied { listen } for pid=26796 comm="syz.4.5067" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1881.676599][T26798] netlink: 12 bytes leftover after parsing attributes in process `syz.7.5066'. [ 1881.712335][ T5613] usb 4-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 1881.715699][ T5613] usb 4-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 1881.715719][ T5613] usb 4-1: Product: syz [ 1881.715734][ T5613] usb 4-1: Manufacturer: syz [ 1881.715746][ T5613] usb 4-1: SerialNumber: syz [ 1881.758016][ T5613] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 1881.951604][ T5613] vp7045: USB control message 'out' went wrong. [ 1881.951620][ T5613] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1881.951654][ T5613] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 1881.956026][ T5613] usb 4-1: USB disconnect, device number 104 [ 1882.041418][T20007] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 1882.191208][T20007] usb 5-1: Using ep0 maxpacket: 32 [ 1882.192058][T20007] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1882.193337][T20007] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1882.193360][T20007] usb 5-1: config 0 has no interfaces? [ 1882.195987][T20007] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1882.196008][T20007] usb 5-1: Product: syz [ 1882.196024][T20007] usb 5-1: Manufacturer: syz [ 1882.196064][T20007] usb 5-1: SerialNumber: syz [ 1882.201409][T20007] usb 5-1: config 0 descriptor?? [ 1882.636614][T26819] syz.3.5075: vmalloc error: size 8192, failed to allocate pages, mode:0x404dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO|__GFP_RETRY_MAYFAIL), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 1882.636766][T26819] CPU: 0 UID: 0 PID: 26819 Comm: syz.3.5075 Tainted: G L syzkaller #0 PREEMPT(full) [ 1882.636798][T26819] Tainted: [L]=SOFTLOCKUP [ 1882.636807][T26819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1882.636819][T26819] Call Trace: [ 1882.636827][T26819] [ 1882.636837][T26819] dump_stack_lvl+0x100/0x190 [ 1882.636872][T26819] warn_alloc.cold+0x9e/0xb2 [ 1882.636897][T26819] ? __pfx_warn_alloc+0x10/0x10 [ 1882.636919][T26819] ? policy_nodemask+0xed/0x4f0 [ 1882.636951][T26819] ? alloc_pages_mpol+0x260/0x550 [ 1882.636980][T26819] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 1882.637012][T26819] ? __get_vm_area_node+0x22b/0x350 [ 1882.637047][T26819] __vmalloc_node_range_noprof+0x111c/0x1420 [ 1882.637088][T26819] ? alloc_netdev_mqs+0xd7/0x15c0 [ 1882.637124][T26819] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1882.637154][T26819] ? kasan_quarantine_put+0x104/0x240 [ 1882.637179][T26819] ? lockdep_hardirqs_on+0x7d/0x110 [ 1882.637210][T26819] __kvmalloc_node_noprof+0x3da/0x9b0 [ 1882.637236][T26819] ? alloc_netdev_mqs+0xd7/0x15c0 [ 1882.637268][T26819] ? alloc_netdev_mqs+0xd7/0x15c0 [ 1882.637300][T26819] ? __pfx_batadv_meshif_init_early+0x10/0x10 [ 1882.637327][T26819] alloc_netdev_mqs+0xd7/0x15c0 [ 1882.637363][T26819] rtnl_create_link+0xc13/0xf80 [ 1882.637398][T26819] rtnl_newlink+0x15bc/0x2620 [ 1882.637440][T26819] ? __pfx_rtnl_newlink+0x10/0x10 [ 1882.637475][T26819] ? avc_has_perm_noaudit+0x56/0x470 [ 1882.637507][T26819] ? find_held_lock+0x2b/0x80 [ 1882.637536][T26819] ? avc_has_perm_noaudit+0x11e/0x470 [ 1882.637564][T26819] ? avc_has_perm_noaudit+0x11e/0x470 [ 1882.637625][T26819] ? lock_acquire+0x1d1/0x380 [ 1882.637649][T26819] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 1882.637680][T26819] ? find_held_lock+0x2b/0x80 [ 1882.637708][T26819] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 1882.637738][T26819] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 1882.637770][T26819] ? __pfx_rtnl_newlink+0x10/0x10 [ 1882.637801][T26819] rtnetlink_rcv_msg+0x95e/0xe90 [ 1882.637834][T26819] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1882.637870][T26819] ? __lock_acquire+0x5c0/0x1f40 [ 1882.637894][T26819] ? __netlink_lookup+0xa9/0x900 [ 1882.637924][T26819] netlink_rcv_skb+0x159/0x420 [ 1882.637950][T26819] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1882.637981][T26819] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1882.638017][T26819] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1882.638048][T26819] netlink_unicast+0x585/0x850 [ 1882.638079][T26819] ? __pfx_netlink_unicast+0x10/0x10 [ 1882.638114][T26819] netlink_sendmsg+0x8b0/0xda0 [ 1882.638146][T26819] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1882.638176][T26819] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1882.638207][T26819] ____sys_sendmsg+0xa4d/0xbe0 [ 1882.638227][T26819] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1882.638257][T26819] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1882.638292][T26819] ___sys_sendmsg+0x190/0x1e0 [ 1882.638318][T26819] ? __pfx____sys_sendmsg+0x10/0x10 [ 1882.638342][T26819] ? futex_wait+0x11e/0x370 [ 1882.638375][T26819] ? find_held_lock+0x2b/0x80 [ 1882.638425][T26819] __sys_sendmsg+0x160/0x210 [ 1882.638455][T26819] ? __pfx___sys_sendmsg+0x10/0x10 [ 1882.638507][T26819] do_syscall_64+0x123/0x790 [ 1882.638534][T26819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1882.638556][T26819] RIP: 0033:0x7fd96879e159 [ 1882.638576][T26819] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1882.638595][T26819] RSP: 002b:00007fd9669f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1882.638616][T26819] RAX: ffffffffffffffda RBX: 00007fd968a25fa0 RCX: 00007fd96879e159 [ 1882.638630][T26819] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000004 [ 1882.638644][T26819] RBP: 00007fd96883506b R08: 0000000000000000 R09: 0000000000000000 [ 1882.638657][T26819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1882.638670][T26819] R13: 00007fd968a26038 R14: 00007fd968a25fa0 R15: 00007ffcd3f4e038 [ 1882.638700][T26819] [ 1882.638787][T26819] Mem-Info: [ 1882.638798][T26819] active_anon:58952 inactive_anon:0 isolated_anon:0 [ 1882.638798][T26819] active_file:1 inactive_file:65661 isolated_file:0 [ 1882.638798][T26819] unevictable:0 dirty:307 writeback:0 [ 1882.638798][T26819] slab_reclaimable:13096 slab_unreclaimable:110503 [ 1882.638798][T26819] mapped:34191 shmem:49897 pagetables:3955 [ 1882.638798][T26819] sec_pagetables:0 bounce:0 [ 1882.638798][T26819] kernel_misc_reclaimable:0 [ 1882.638798][T26819] free:1207607 free_pcp:9603 free_cma:0 [ 1882.638850][T26819] Node 0 active_anon:235808kB inactive_anon:0kB active_file:4kB inactive_file:262440kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:136764kB dirty:1224kB writeback:0kB shmem:199588kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14492kB pagetables:15680kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1882.638904][T26819] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1882.638953][T26819] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1882.639008][T26819] lowmem_reserve[]: 0 2471 2471 2471 2471 [ 1882.639045][T26819] Node 0 DMA32 free:863264kB boost:0kB min:33992kB low:42488kB high:50984kB reserved_highatomic:0kB free_highatomic:0kB active_anon:235808kB inactive_anon:0kB active_file:4kB inactive_file:262440kB unevictable:0kB writepending:1224kB zspages:0kB present:3129332kB managed:2530380kB mlocked:0kB bounce:0kB free_pcp:38412kB local_pcp:17992kB free_cma:0kB [ 1882.639102][T26819] lowmem_reserve[]: 0 0 0 0 0 [ 1882.639135][T26819] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:64kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1882.639190][T26819] lowmem_reserve[]: 0 0 0 0 0 [ 1882.639225][T26819] Node 1 Normal free:3951804kB boost:0kB min:55908kB low:69884kB high:83860kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1882.639281][T26819] lowmem_reserve[]: 0 0 0 0 0 [ 1882.639316][T26819] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1882.639435][T26819] Node 0 DMA32: 427*4kB (UME) 264*8kB (UME) 423*16kB (UME) 1062*32kB (UME) 1053*64kB (UME) 727*128kB (UME) 491*256kB (UM) 294*512kB (UME) 171*1024kB (UME) 7*2048kB (M) 47*4096kB (UM) = 863196kB [ 1882.639598][T26819] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1882.639699][T26819] Node 1 Normal: 1*4kB (M) 3*8kB (UM) 8*16kB (UM) 5*32kB (UM) 2*64kB (UM) 6*128kB (UM) 2*256kB (M) 3*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 963*4096kB (UM) = 3951804kB [ 1882.639894][T26819] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1882.639911][T26819] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1882.639928][T26819] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1882.639944][T26819] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1882.639960][T26819] 115555 total pagecache pages [ 1882.639968][T26819] 0 pages in swap cache [ 1882.639975][T26819] Free swap = 124996kB [ 1882.639984][T26819] Total swap = 124996kB [ 1882.639992][T26819] 2097051 pages RAM [ 1882.640000][T26819] 0 pages HighMem/MovableOnly [ 1882.640007][T26819] 432824 pages reserved [ 1882.640014][T26819] 0 pages cma reserved [ 1882.818872][T26822] FAULT_INJECTION: forcing a failure. [ 1882.818872][T26822] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1882.818901][T26822] CPU: 0 UID: 0 PID: 26822 Comm: syz.4.5068 Tainted: G L syzkaller #0 PREEMPT(full) [ 1882.818929][T26822] Tainted: [L]=SOFTLOCKUP [ 1882.818938][T26822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1882.818952][T26822] Call Trace: [ 1882.818960][T26822] [ 1882.818969][T26822] dump_stack_lvl+0x100/0x190 [ 1882.819005][T26822] should_fail_ex.cold+0x5/0xa [ 1882.819033][T26822] ? __lock_acquire+0x5c0/0x1f40 [ 1882.819059][T26822] get_futex_key+0x1d0/0x14f0 [ 1882.819090][T26822] ? __pfx_get_futex_key+0x10/0x10 [ 1882.819127][T26822] futex_wake+0xf4/0x5e0 [ 1882.819152][T26822] ? __pfx_futex_wake+0x10/0x10 [ 1882.819186][T26822] do_futex+0x2b2/0x440 [ 1882.819216][T26822] ? __pfx_do_futex+0x10/0x10 [ 1882.819244][T26822] ? __do_sys_add_key+0x37d/0x460 [ 1882.819263][T26822] ? rcu_is_watching+0x13/0xc0 [ 1882.819291][T26822] ? __do_sys_add_key+0x37d/0x460 [ 1882.819309][T26822] ? kfree+0x1e5/0x6d0 [ 1882.819331][T26822] __x64_sys_futex+0x34f/0x4d0 [ 1882.819364][T26822] ? __pfx___x64_sys_futex+0x10/0x10 [ 1882.819400][T26822] do_syscall_64+0x123/0x790 [ 1882.819425][T26822] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1882.819446][T26822] RIP: 0033:0x7fec22f9e159 [ 1882.819463][T26822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1882.819481][T26822] RSP: 002b:00007fec23ee40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1882.819500][T26822] RAX: ffffffffffffffda RBX: 00007fec23226098 RCX: 00007fec22f9e159 [ 1882.819513][T26822] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fec2322609c [ 1882.819526][T26822] RBP: 00007fec23226090 R08: 0000000000000001 R09: 0000000000000000 [ 1882.819539][T26822] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 1882.819551][T26822] R13: 00007fec23226128 R14: 00007fff4bcffb60 R15: 00007fff4bcffc48 [ 1882.819577][T26822] [ 1883.710319][T26776] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1883.713462][T26809] netlink: 'syz.8.5072': attribute type 11 has an invalid length. [ 1884.021155][ C1] net_ratelimit: 12 callbacks suppressed [ 1884.427707][T26859] loop4: detected capacity change from 0 to 2640 [ 1884.429750][T26859] Buffer I/O error on dev loop4, logical block 0, async page read [ 1884.429795][T26859] Buffer I/O error on dev loop4, logical block 0, async page read [ 1884.429827][T26859] Buffer I/O error on dev loop4, logical block 0, async page read [ 1884.429856][T26859] Buffer I/O error on dev loop4, logical block 0, async page read [ 1884.429885][T26859] Buffer I/O error on dev loop4, logical block 0, async page read [ 1884.430956][T26859] Buffer I/O error on dev loop4, logical block 0, async page read [ 1884.431004][T26859] Buffer I/O error on dev loop4, logical block 0, async page read [ 1884.431034][T26859] Buffer I/O error on dev loop4, logical block 0, async page read [ 1884.431050][T26859] ldm_validate_partition_table(): Disk read failed. [ 1884.504831][ T30] audit: type=1400 audit(1790904754.983:13674): avc: denied { map } for pid=26850 comm="syz.5.5089" path="/dev/loop4" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1884.505105][ T30] audit: type=1400 audit(1790904754.983:13675): avc: denied { execute } for pid=26850 comm="syz.5.5089" path="/dev/loop4" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1884.536136][T26859] Buffer I/O error on dev loop4, logical block 0, async page read [ 1884.536204][T26859] Buffer I/O error on dev loop4, logical block 0, async page read [ 1884.536252][T26859] Dev loop4: unable to read RDB block 0 [ 1884.536450][T26859] loop4: unable to read partition table [ 1884.559486][T26859] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 1884.809499][T26872] random: crng reseeded on system resumption [ 1884.824779][ T5789] usb 5-1: USB disconnect, device number 19 [ 1884.992477][T26872] binder: 26871:26872 ioctl c0306201 0 returned -14 [ 1887.131208][ T5789] usb 9-1: new full-speed USB device number 18 using dummy_hcd [ 1887.283355][ T5789] usb 9-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 1887.285898][ T5789] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1887.285909][ T5789] usb 9-1: Product: syz [ 1887.285918][ T5789] usb 9-1: Manufacturer: syz [ 1887.285927][ T5789] usb 9-1: SerialNumber: syz [ 1887.371511][T26854] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1887.734808][ T5789] usblp 9-1:1.0: usblp0: USB Unidirectional printer dev 18 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 1887.926644][T26924] blktrace: Concurrent blktraces are not allowed on loop4 [ 1887.950654][ T30] audit: type=1400 audit(1790904758.303:13676): avc: denied { create } for pid=26921 comm="syz.5.5113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1887.950706][ T30] audit: type=1400 audit(1790904758.363:13677): avc: denied { setopt } for pid=26921 comm="syz.5.5113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1888.181334][ T30] audit: type=1400 audit(1790904758.643:13678): avc: denied { bind } for pid=26921 comm="syz.5.5113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1888.385506][ T30] audit: type=1400 audit(1790904758.863:13679): avc: denied { connect } for pid=26921 comm="syz.5.5113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1888.931037][T26938] netlink: 'syz.4.5116': attribute type 11 has an invalid length. [ 1889.051741][ T5789] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 1889.123143][T26940] netlink: 'syz.3.5118': attribute type 11 has an invalid length. [ 1889.201348][ T5789] usb 8-1: Using ep0 maxpacket: 8 [ 1889.202139][ T5789] usb 8-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 1889.203271][ T5789] usb 8-1: config 1 has an invalid descriptor of length 231, skipping remainder of the config [ 1889.203292][ T5789] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1889.203313][ T5789] usb 8-1: config 1 has no interface number 0 [ 1889.203368][ T5789] usb 8-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1889.206573][ T5789] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1889.206593][ T5789] usb 8-1: Product: syz [ 1889.206616][ T5789] usb 8-1: Manufacturer: syz [ 1889.206629][ T5789] usb 8-1: SerialNumber: syz [ 1889.381812][ C1] net_ratelimit: 30 callbacks suppressed [ 1889.398953][T26949] binder_alloc: 26947: binder_alloc_buf, no vma [ 1889.635014][ T5789] snd-usb-audio 8-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 1889.695131][T26324] udevd[26324]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1889.728741][ T5613] usb 9-1: USB disconnect, device number 18 [ 1889.780321][ T5613] usblp0: removed [ 1889.980140][ T30] audit: type=1400 audit(1790904760.453:13680): avc: denied { lock } for pid=26961 comm="syz.8.5123" path="socket:[98998]" dev="sockfs" ino=98998 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 1891.840387][ T5613] usb 8-1: USB disconnect, device number 19 [ 1891.926223][T26985] binder_alloc: 26984: binder_alloc_buf, no vma [ 1892.211344][T20007] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 1892.242343][T26995] fuse: Bad value for 'fd' [ 1892.337636][T26944] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1892.345128][T20007] usb 9-1: device descriptor read/64, error -71 [ 1892.537191][ T30] audit: type=1400 audit(1790904763.013:13681): avc: denied { ioctl } for pid=26999 comm="syz.5.5136" path="socket:[99079]" dev="sockfs" ino=99079 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1892.537299][T27000] syzkaller0: entered promiscuous mode [ 1892.537310][T27000] syzkaller0: entered allmulticast mode [ 1892.551519][ T1495] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1892.552253][ T1495] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1892.552287][ T1495] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1892.552324][ T1495] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1892.581312][T20007] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 1892.711979][T20007] usb 9-1: device descriptor read/64, error -71 [ 1892.821675][T20007] usb usb9-port1: attempt power cycle [ 1892.875672][T27004] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1892.875895][T27004] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1893.161301][T20007] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 1893.349275][T20007] usb 9-1: device descriptor read/8, error -71 [ 1893.693974][ T30] audit: type=1326 audit(1790904764.163:13682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27005 comm="syz.3.5139" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd96879e159 code=0x0 [ 1893.721616][T20007] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 1893.743601][T20007] usb 9-1: device descriptor read/8, error -71 [ 1893.851991][T20007] usb usb9-port1: unable to enumerate USB device [ 1894.581191][ C1] net_ratelimit: 38 callbacks suppressed [ 1894.901367][T19822] Bluetooth: hci0: command 0x0c1a tx timeout [ 1894.901418][T19822] Bluetooth: hci4: command 0x0406 tx timeout [ 1894.908597][T27003] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1894.996991][T27050] mac80211_hwsim hwsim30 wlan0: left promiscuous mode [ 1896.261505][T19940] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 1896.433308][T19940] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 1896.439241][T19940] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1896.468398][T19940] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1896.492575][T19940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1896.492596][T19940] usb 5-1: Product: syz [ 1896.492611][T19940] usb 5-1: Manufacturer: syz [ 1896.492626][T19940] usb 5-1: SerialNumber: syz [ 1896.555833][T19940] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 1896.571569][T19940] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 1896.610264][T19940] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 1896.881193][ T5040] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 1896.981525][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 1897.011315][ T5040] usb 9-1: device descriptor read/64, error -71 [ 1897.251230][ T5040] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 1897.381220][ T5040] usb 9-1: device descriptor read/64, error -71 [ 1897.487235][T27037] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1897.502995][ T5040] usb usb9-port1: attempt power cycle [ 1897.781683][T27067] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set config on port 0, -110 [ 1897.782102][T27067] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -32 [ 1897.782137][T27067] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set modem control on port 0, -32 [ 1897.782555][T27067] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot send open command, -32 [ 1897.848849][T19940] usb 5-1: USB disconnect, device number 20 [ 1897.875895][T19940] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 1897.880723][T19940] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 1897.881965][ T5040] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 1897.883229][T19940] ti_usb_3410_5052 5-1:2.0: device disconnected [ 1898.023465][ T5040] usb 9-1: device descriptor read/8, error -71 [ 1898.351392][ T5040] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 1898.372081][ T5040] usb 9-1: device descriptor read/8, error -71 [ 1898.481698][ T5040] usb usb9-port1: unable to enumerate USB device [ 1898.811462][ T5040] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 1898.964665][ T5040] usb 8-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1898.965541][ T5040] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1898.965575][ T5040] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1898.966510][ T5040] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1898.966522][ T5040] usb 8-1: SerialNumber: syz [ 1899.021276][T20007] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 1899.172125][T20007] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1899.173816][T20007] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1899.173844][T20007] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1899.173867][T20007] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1899.173944][T20007] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1899.177127][T20007] usb 5-1: config 0 descriptor?? [ 1899.243382][ T5040] usb 8-1: 0:2 : does not exist [ 1899.270785][ T5040] usb 8-1: USB disconnect, device number 20 [ 1899.330429][T26324] udevd[26324]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1899.605396][T20007] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0 [ 1899.605436][T20007] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0 [ 1899.605462][T20007] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0 [ 1899.605485][T20007] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0 [ 1899.605508][T20007] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0 [ 1899.605532][T20007] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0 [ 1899.605556][T20007] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0 [ 1899.605578][T20007] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0 [ 1899.605602][T20007] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0 [ 1899.605624][T20007] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0 [ 1899.830598][T20007] plantronics 0003:047F:FFFF.0014: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 1899.941275][ C1] net_ratelimit: 27 callbacks suppressed [ 1900.301210][ T5040] usb 9-1: new full-speed USB device number 27 using dummy_hcd [ 1900.881741][ T5040] usb 9-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1900.882743][ T5040] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1900.884792][ T5040] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1900.884812][ T5040] usb 9-1: Product: syz [ 1900.884823][ T5040] usb 9-1: Manufacturer: syz [ 1900.884831][ T5040] usb 9-1: SerialNumber: syz [ 1900.888205][ T5040] usb 9-1: config 0 descriptor?? [ 1900.984977][ T5040] asix 9-1:0.0: probe with driver asix failed with error -22 [ 1901.095231][ T5794] usb 9-1: USB disconnect, device number 27 [ 1901.261440][ T5040] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 1901.411877][ T5040] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 1901.412849][ T5040] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1901.413820][ T5040] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1901.415787][ T5040] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1901.415798][ T5040] usb 4-1: Product: syz [ 1901.415807][ T5040] usb 4-1: Manufacturer: syz [ 1901.415816][ T5040] usb 4-1: SerialNumber: syz [ 1901.433518][ T5040] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 1901.455746][ T5040] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 1901.482714][ T5040] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 1901.813407][T27109] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1902.013748][ T5794] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 1902.173663][ T5794] usb 9-1: Using ep0 maxpacket: 16 [ 1902.179679][ T5794] usb 9-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 1902.190197][ T5794] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1902.190247][ T5794] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1902.209810][ T5794] usb 9-1: config 0 descriptor?? [ 1902.229167][ T5613] usb 5-1: USB disconnect, device number 21 [ 1902.628729][ T30] audit: type=1400 audit(1790904773.103:13683): avc: denied { map } for pid=27172 comm="syz.5.5198" path="socket:[100416]" dev="sockfs" ino=100416 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 1902.662151][T27139] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set config on port 0, -110 [ 1902.662525][T27139] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -32 [ 1902.662560][T27139] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set modem control on port 0, -32 [ 1902.662918][T27139] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot send open command, -32 [ 1902.671970][T22798] usb 4-1: USB disconnect, device number 105 [ 1902.739020][T22798] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 1902.756431][T22798] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 1902.765331][T22798] ti_usb_3410_5052 4-1:2.0: device disconnected [ 1903.035458][ T5794] usbhid 9-1:0.0: can't add hid device: -71 [ 1903.035585][ T5794] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1903.054584][ T5794] usb 9-1: USB disconnect, device number 28 [ 1903.131061][T27189] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5200'. [ 1905.073738][T23136] net_ratelimit: 18 callbacks suppressed [ 1905.538954][T27179] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1905.667033][T27225] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5215'. [ 1905.778852][T27223] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1905.831574][ T5613] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1905.981538][ T5613] usb 4-1: Using ep0 maxpacket: 32 [ 1905.982288][ T5613] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1905.983437][ T5613] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 1905.983459][ T5613] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.983488][ T5613] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1905.987259][ T5613] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1905.987292][ T5613] usb 4-1: Product: syz [ 1905.987309][ T5613] usb 4-1: Manufacturer: syz [ 1905.987325][ T5613] usb 4-1: SerialNumber: syz [ 1906.060990][ T5613] usb 4-1: config 0 descriptor?? [ 1906.070390][ T5613] ldusb 4-1:0.0: Interrupt in endpoint not found [ 1906.322911][ T5794] usb 4-1: USB disconnect, device number 106 [ 1907.143755][T27261] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5228'. [ 1907.184055][T27257] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 1907.531615][T20007] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 1907.682045][T20007] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 1907.683565][T20007] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1907.684568][T20007] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1907.686702][T20007] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1907.686723][T20007] usb 5-1: Product: syz [ 1907.686736][T20007] usb 5-1: Manufacturer: syz [ 1907.686745][T20007] usb 5-1: SerialNumber: syz [ 1907.753670][T20007] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 1907.760614][T20007] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 1907.786370][T20007] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 1907.811177][T22798] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1907.843905][T27279] kcov: kcov_start: t = ffff888079c2cb00, size = 524288, area = ffffc9000ec72000 [ 1907.847626][T27279] ================================================================== [ 1907.847645][T27279] BUG: KASAN: slab-use-after-free in dvb_device_open+0x33f/0x3b0 [ 1907.847673][T27279] Read of size 8 at addr ffff88802d539e18 by task syz.7.5232/27279 [ 1907.847691][T27279] [ 1907.847705][T27279] CPU: 1 UID: 0 PID: 27279 Comm: syz.7.5232 Tainted: G L syzkaller #0 PREEMPT(full) [ 1907.847731][T27279] Tainted: [L]=SOFTLOCKUP [ 1907.847739][T27279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1907.847754][T27279] Call Trace: [ 1907.847760][T27279] [ 1907.847767][T27279] dump_stack_lvl+0x100/0x190 [ 1907.847800][T27279] print_report+0x13d/0x4b0 [ 1907.847830][T27279] ? __virt_addr_valid+0x239/0x430 [ 1907.847853][T27279] ? dvb_device_open+0x33f/0x3b0 [ 1907.847875][T27279] kasan_report+0xdf/0x1c0 [ 1907.847904][T27279] ? dvb_device_open+0x33f/0x3b0 [ 1907.847924][T27279] ? __pfx_dvb_device_open+0x10/0x10 [ 1907.847953][T27279] dvb_device_open+0x33f/0x3b0 [ 1907.847976][T27279] ? __pfx_dvb_device_open+0x10/0x10 [ 1907.847997][T27279] chrdev_open+0x234/0x6a0 [ 1907.848024][T27279] ? __pfx_chrdev_open+0x10/0x10 [ 1907.848050][T27279] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 1907.848075][T27279] do_dentry_open+0x6ab/0x14d0 [ 1907.848097][T27279] ? __pfx_chrdev_open+0x10/0x10 [ 1907.848126][T27279] vfs_open+0x82/0x3f0 [ 1907.848150][T27279] path_openat+0x19fa/0x2440 [ 1907.848176][T27279] ? __pfx_path_openat+0x10/0x10 [ 1907.848201][T27279] do_file_open+0x20e/0x430 [ 1907.848227][T27279] ? __pfx_do_file_open+0x10/0x10 [ 1907.848260][T27279] ? _raw_spin_unlock+0x28/0x50 [ 1907.848289][T27279] ? alloc_fd+0x471/0x7a0 [ 1907.848319][T27279] do_sys_openat2+0x10f/0x1e0 [ 1907.848347][T27279] ? __pfx_do_sys_openat2+0x10/0x10 [ 1907.848374][T27279] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 1907.848404][T27279] __x64_sys_openat+0x12d/0x210 [ 1907.848432][T27279] ? __pfx___x64_sys_openat+0x10/0x10 [ 1907.848464][T27279] do_syscall_64+0x123/0x790 [ 1907.848487][T27279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1907.848509][T27279] RIP: 0033:0x7f2948b5e98e [ 1907.848526][T27279] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1907.848549][T27279] RSP: 002b:00007f2949a0fb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1907.848570][T27279] RAX: ffffffffffffffda RBX: 00007f2949a106c0 RCX: 00007f2948b5e98e [ 1907.848585][T27279] RDX: 0000000000000002 RSI: 00007f2949a0fc00 RDI: ffffffffffffff9c [ 1907.848598][T27279] RBP: 00007f2949a0fc00 R08: 0000000000000000 R09: 0000000000000000 [ 1907.848611][T27279] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 1907.848625][T27279] R13: 00007f2948e26128 R14: 00007f2948e26090 R15: 00007ffd9ccd5718 [ 1907.848646][T27279] [ 1907.848653][T27279] [ 1907.848657][T27279] Allocated by task 1: [ 1907.848666][T27279] kasan_save_stack+0x30/0x50 [ 1907.848691][T27279] kasan_save_track+0x14/0x30 [ 1907.848713][T27279] __kasan_kmalloc+0xaa/0xb0 [ 1907.848734][T27279] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 1907.848751][T27279] dvb_register_device+0x1d6/0x1e20 [ 1907.848769][T27279] dvb_register_frontend+0x552/0x820 [ 1907.848788][T27279] vidtv_bridge_probe+0x44b/0xa30 [ 1907.848809][T27279] platform_probe+0x106/0x1d0 [ 1907.848826][T27279] really_probe+0x241/0xa60 [ 1907.848848][T27279] __driver_probe_device+0x210/0x460 [ 1907.848870][T27279] driver_probe_device+0x4a/0x140 [ 1907.848890][T27279] __driver_attach+0x21f/0x5b0 [ 1907.848913][T27279] bus_for_each_dev+0x13e/0x1d0 [ 1907.848931][T27279] bus_add_driver+0x305/0x5b0 [ 1907.848960][T27279] driver_register+0x1e2/0x360 [ 1907.848986][T27279] vidtv_bridge_init+0x52/0x80 [ 1907.849017][T27279] do_one_initcall+0x11c/0x6f0 [ 1907.849039][T27279] kernel_init_freeable+0x6ea/0x7b0 [ 1907.849059][T27279] kernel_init+0x21/0x1e0 [ 1907.849079][T27279] ret_from_fork+0x730/0xd60 [ 1907.849099][T27279] ret_from_fork_asm+0x1a/0x30 [ 1907.849116][T27279] [ 1907.849121][T27279] Freed by task 27257: [ 1907.849131][T27279] kasan_save_stack+0x30/0x50 [ 1907.849155][T27279] kasan_save_track+0x14/0x30 [ 1907.849178][T27279] kasan_save_free_info+0x3b/0x70 [ 1907.849196][T27279] __kasan_slab_free+0x5f/0x80 [ 1907.849218][T27279] kfree+0x22b/0x6d0 [ 1907.849234][T27279] dvb_device_put.part.0+0x57/0x90 [ 1907.849252][T27279] dvb_device_open+0x2ba/0x3b0 [ 1907.849270][T27279] chrdev_open+0x234/0x6a0 [ 1907.849293][T27279] do_dentry_open+0x6ab/0x14d0 [ 1907.849312][T27279] vfs_open+0x82/0x3f0 [ 1907.849333][T27279] path_openat+0x19fa/0x2440 [ 1907.849355][T27279] do_file_open+0x20e/0x430 [ 1907.849375][T27279] do_sys_openat2+0x10f/0x1e0 [ 1907.849397][T27279] __x64_sys_openat+0x12d/0x210 [ 1907.849421][T27279] do_syscall_64+0x123/0x790 [ 1907.849438][T27279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1907.849459][T27279] [ 1907.849464][T27279] The buggy address belongs to the object at ffff88802d539e00 [ 1907.849464][T27279] which belongs to the cache kmalloc-256 of size 256 [ 1907.849480][T27279] The buggy address is located 24 bytes inside of [ 1907.849480][T27279] freed 256-byte region [ffff88802d539e00, ffff88802d539f00) [ 1907.849501][T27279] [ 1907.849519][T27279] The buggy address belongs to the physical page: [ 1907.849532][T27279] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d538 [ 1907.849548][T27279] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1907.849565][T27279] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1907.849582][T27279] page_type: f5(slab) [ 1907.849600][T27279] raw: 00fff00000000040 ffff88801c031b40 dead000000000100 dead000000000122 [ 1907.849621][T27279] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1907.849639][T27279] head: 00fff00000000040 ffff88801c031b40 dead000000000100 dead000000000122 [ 1907.849656][T27279] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1907.849672][T27279] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 1907.849687][T27279] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 1907.849696][T27279] page dumped because: kasan: bad access detected [ 1907.849711][T27279] page_owner tracks the page as allocated [ 1907.849718][T27279] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 10774275375 [ 1907.849747][T27279] post_alloc_hook+0xfd/0x120 [ 1907.849764][T27279] get_page_from_freelist+0x110d/0x35d0 [ 1907.849792][T27279] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 1907.849812][T27279] new_slab+0xa9/0x6e0 [ 1907.849829][T27279] refill_objects+0xe3/0x410 [ 1907.849845][T27279] __pcs_replace_empty_main+0x35e/0x650 [ 1907.849863][T27279] __kmalloc_cache_noprof+0x4f4/0x6d0 [ 1907.849881][T27279] bus_add_driver+0x92/0x5b0 [ 1907.849901][T27279] driver_register+0x1e2/0x360 [ 1907.849923][T27279] usb_register_driver+0x21c/0x3e0 [ 1907.849949][T27279] do_one_initcall+0x11c/0x6f0 [ 1907.849970][T27279] kernel_init_freeable+0x6ea/0x7b0 [ 1907.849992][T27279] kernel_init+0x21/0x1e0 [ 1907.850016][T27279] ret_from_fork+0x730/0xd60 [ 1907.850034][T27279] ret_from_fork_asm+0x1a/0x30 [ 1907.850052][T27279] page_owner free stack trace missing [ 1907.850059][T27279] [ 1907.850064][T27279] Memory state around the buggy address: [ 1907.850074][T27279] ffff88802d539d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1907.850087][T27279] ffff88802d539d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1907.850099][T27279] >ffff88802d539e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1907.850105][T27279] ^ [ 1907.850111][T27279] ffff88802d539e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1907.850119][T27279] ffff88802d539f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1907.850125][T27279] ================================================================== [ 1907.850243][T27279] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1908.614743][T27279] CPU: 1 UID: 0 PID: 27279 Comm: syz.7.5232 Tainted: G L syzkaller #0 PREEMPT(full) [ 1908.625666][T27279] Tainted: [L]=SOFTLOCKUP [ 1908.629967][T27279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1908.640020][T27279] Call Trace: [ 1908.643376][T27279] [ 1908.646642][T27279] dump_stack_lvl+0x100/0x190 [ 1908.651760][T27279] vpanic+0x553/0x970 [ 1908.655839][T27279] ? __pfx_vpanic+0x10/0x10 [ 1908.660322][T27279] ? mark_held_locks+0x40/0x70 [ 1908.665086][T27279] ? dvb_device_open+0x33f/0x3b0 [ 1908.670006][T27279] panic+0xd1/0xe0 [ 1908.673725][T27279] ? __pfx_panic+0x10/0x10 [ 1908.678212][T27279] ? dvb_device_open+0x33f/0x3b0 [ 1908.683132][T27279] ? preempt_schedule_common+0x3c/0xb0 [ 1908.688576][T27279] check_panic_on_warn.cold+0x19/0x34 [ 1908.693930][T27279] end_report.part.0+0x3a/0x90 [ 1908.698683][T27279] kasan_report.cold+0xe/0x18 [ 1908.703349][T27279] ? dvb_device_open+0x33f/0x3b0 [ 1908.708275][T27279] ? __pfx_dvb_device_open+0x10/0x10 [ 1908.713543][T27279] dvb_device_open+0x33f/0x3b0 [ 1908.718288][T27279] ? __pfx_dvb_device_open+0x10/0x10 [ 1908.723552][T27279] chrdev_open+0x234/0x6a0 [ 1908.727958][T27279] ? __pfx_chrdev_open+0x10/0x10 [ 1908.732888][T27279] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 1908.739200][T27279] do_dentry_open+0x6ab/0x14d0 [ 1908.743949][T27279] ? __pfx_chrdev_open+0x10/0x10 [ 1908.748874][T27279] vfs_open+0x82/0x3f0 [ 1908.752938][T27279] path_openat+0x19fa/0x2440 [ 1908.757518][T27279] ? __pfx_path_openat+0x10/0x10 [ 1908.762445][T27279] do_file_open+0x20e/0x430 [ 1908.766937][T27279] ? __pfx_do_file_open+0x10/0x10 [ 1908.771956][T27279] ? _raw_spin_unlock+0x28/0x50 [ 1908.776796][T27279] ? alloc_fd+0x471/0x7a0 [ 1908.781114][T27279] do_sys_openat2+0x10f/0x1e0 [ 1908.785794][T27279] ? __pfx_do_sys_openat2+0x10/0x10 [ 1908.791023][T27279] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 1908.797441][T27279] __x64_sys_openat+0x12d/0x210 [ 1908.802290][T27279] ? __pfx___x64_sys_openat+0x10/0x10 [ 1908.807670][T27279] do_syscall_64+0x123/0x790 [ 1908.812247][T27279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1908.818124][T27279] RIP: 0033:0x7f2948b5e98e [ 1908.822782][T27279] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1908.842372][T27279] RSP: 002b:00007f2949a0fb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1908.850766][T27279] RAX: ffffffffffffffda RBX: 00007f2949a106c0 RCX: 00007f2948b5e98e [ 1908.858717][T27279] RDX: 0000000000000002 RSI: 00007f2949a0fc00 RDI: ffffffffffffff9c [ 1908.866670][T27279] RBP: 00007f2949a0fc00 R08: 0000000000000000 R09: 0000000000000000 [ 1908.874621][T27279] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 1908.882574][T27279] R13: 00007f2948e26128 R14: 00007f2948e26090 R15: 00007ffd9ccd5718 [ 1908.890534][T27279] [ 1908.893770][T27279] Kernel Offset: disabled [ 1908.898087][T27279] Rebooting in 86400 seconds..