last executing test programs: 4.892536184s ago: executing program 3 (id=4): pipe(0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) shutdown(r0, 0x1) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000003c0)=@gcm_256={{0x304}, "5467ab0000007ffb", "df7b57d67e69283c56bd41adb4d53f4ad34ad31139acfb5bd7ec4175c068f087", '\x00', "0200"}, 0x38) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0xfffffffffffffffe) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000180)={'syzkaller1\x00', 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x46d, 0xc219, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x9, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xb3, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) r3 = getpgrp(0x0) syz_pidfd_open(r3, 0x0) r4 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xc45, 0x5112, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x0, "", [{{0x9, 0x4, 0x0, 0x1, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x404, 0x9, 0x1, {0x22, 0x27}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0xb, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000080)={0x2c, &(0x7f00000000c0)={0x0, 0x22, 0x28, {0x28, 0xd, "83efb930f0187ff0478fa22a61a54607b71ea9e43d359c479c37f545cb92e449c42123ec25cd"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, 0xffffffffffffffff, 0x0) 3.927999315s ago: executing program 2 (id=12): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r1, 0x28, 0x8, &(0x7f0000001680)=""/54, &(0x7f0000000040)=0x36) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2140, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b95}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x4, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0xa, 0x81, 0x8a, 0x79, 0x2, 0x8, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x7fffffff, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x4, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x0, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0xc7c, 0x4, 0x0, 0xfffffff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x1, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000000, 0x6, 0x438, 0x2, 0x9, 0x92, 0x7ffdffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x9, 0x8, 0x3fc, 0x4000006, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x3e55, 0x4005, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x6, 0x8922, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa774, 0x6, 0x5, 0x1afa, 0xbfc, 0xb, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x3, 0x4, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x5, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x5, 0x3, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xffff7ff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xb, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x385584689564a4db}, 0x44054) openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/pm_wakeup_irq', 0x6000, 0x1c) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x2, 0x0, 0x4}}, 0x2e) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x28, 0x0, 0x11, 0x70bd28, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}}, 0x28}, 0x1, 0x0, 0x0, 0xe4}, 0x2c90224929df06d3) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r8 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000039c0), 0x0, 0x0) readv(r8, &(0x7f0000004b00)=[{&(0x7f0000003a00)=""/101, 0x65}, {&(0x7f0000003a80)=""/115, 0x73}], 0x2) r9 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) shutdown(r0, 0x0) shutdown(r0, 0x0) r10 = syz_usb_connect(0x2, 0x5e, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006b36a2207b06a1279bb00102030109024c0001000010000904e7000229feac000b2402010302057ff49bfd052406000105240002000d240f0105000000090007000806241a7f000109050602ff030000000905820208"], 0x0) syz_usb_control_io$sierra_net(r10, &(0x7f0000000240)={0x14, &(0x7f0000000080)=ANY=[@ANYBLOB="40096b0000006b0d0fa4e549a6b9e983ab4e1bcc2d4a5ff748dd1a678be9ea4606eeda1dfb25d424eb3c7cc16e480c93dbaba581c87d1307a5cadb46402ecfffb323abc69aa935744acbfcd1c445103131d8098dbdd20e365f0b44ed19a2a3b7e77032e5e0bb663770f0e95d7dddd789de"], 0x0}, 0x0) 3.153918289s ago: executing program 3 (id=19): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) modify_ldt$write2(0x11, &(0x7f0000000680)={0x8, 0x100000, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1}, 0x10) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000040)=@ccm_128={{0x303}, "966bbc1bef4fcc76", "a0fd54e84490296c931f641a0b8ebf95", "e9f59e39", "485c05644d6ee8b8"}, 0xfffffffffffffcfd) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000080)="44fb64cec586f8ac7c18d3763a8af31493c79c87115a49609fe6e695efc7fdc105d4ea57d12791274d330e41fd5f299a20eefdaa1978929b7ab8dd1d50d0b3cebb9ec2ee4aee3b46faabfe42cb86f0d30b77302d9a159d0f484f6ecb38644b455a619f05808dc278d2e572611464bb3711bbb2143c0d5e34b36f7d9cb942a7231f9de8ea1a7c720ff974899f622c219be35923f09dd4fa9790aba9a1ce3186861b99cca367cb0b668953e381425b33c57323b32a4b1463425042e251c9b78b3d61", 0xc1}], 0x1) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000000c0)=0xff) syz_usb_connect$uac2(0x2, 0xab, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x99, 0x3, 0x1, 0x3, 0x60, 0xf8, {0x8, 0xb, 0x1, 0x2, 0x1, 0xc, 0x20, 0x9}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x9, 0xa, 0x29, 0x9}, [@input_terminal={0x10, 0x24, 0x2, 0x6, 0x100, 0x1, 0xb, 0x3d, 0x2, 0x0, 0x54, 0x8}, @input_terminal={0x10, 0x24, 0x2, 0x3, 0x201, 0x6, 0x3, 0xa9, 0xfffffff9, 0xf, 0x9, 0x8}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@as_header={0x10, 0x24, 0x1, 0x3, 0x8, 0x0, 0x5, 0x4, 0x8, 0x7f}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x5, 0x6, 0x74, {0x8, 0x25, 0x1, 0x4, 0xc, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x8, 0x8, 0x10, {0x8, 0x25, 0x1, 0x1, 0x3, 0x7f, 0x4}}}}}}}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) unshare(0x20060400) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') preadv2(r3, 0x0, 0x0, 0x5, 0x101, 0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000007d00)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000006a0015012000"], 0x1c}], 0x1}, 0x4000080) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) pipe(&(0x7f0000000080)={0xffffffffffffffff}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) read(r5, &(0x7f0000000200)=""/9, 0x9) syz_open_procfs(0x0, &(0x7f00000002c0)='gid_map\x00') write$binfmt_misc(r5, &(0x7f00000003c0)="9fe14ec3b102d0c29a4b2cea0f6c7139773c891ff60519f61d07007f529006b8a7905975600000000001ab1ea136f1a0e2a7c3ae9cee7dbe51a4197c883b6b79b3d6e8aa114b6f4a24e10879d524a6ccd1e7813943a4d1426861a0af2b58bcc56714890164a7f5817be81fe3f8615de528f93d15ea32da058cb32a06df485d092a9d7bd1e2de9d10603b6668f0f9c78262c48b5fe501bd3c348af764c21aa078292bb4da4b4535aeb9a764acf17caf108924446c4aafc393dbb4169bbc7bbd831a060e53eb321cedde3af9201f5b343337b2f183f4780700eb89a72a00a2b68d808f1f19f5144dcf76a6b433d044b1d13cf0cf0714803b616aa121e2dd9a0dac3e3d91f0eb763088a00512f29a70a0cda6fe84975f335b4f0c09de8d117379ae293b766d4ba6fac9509eceefcb4ac338", 0xffffff2f) r6 = dup(r0) r7 = socket(0x1e, 0x5, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r7) ioctl$TCSETA(r6, 0x5406, &(0x7f0000000240)={0xe7a, 0x0, 0x10, 0x40, 0x6, "3f8f9b406b195ae6"}) 2.236064589s ago: executing program 2 (id=28): pipe(0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) shutdown(r0, 0x1) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000003c0)=@gcm_256={{0x304}, "5467ab0000007ffb", "df7b57d67e69283c56bd41adb4d53f4ad34ad31139acfb5bd7ec4175c068f087", '\x00', "0200"}, 0x38) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0xfffffffffffffffe) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000180)={'syzkaller1\x00', 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x46d, 0xc219, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x9, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xb3, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) r3 = getpgrp(0x0) syz_pidfd_open(r3, 0x0) r4 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xc45, 0x5112, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x0, "", [{{0x9, 0x4, 0x0, 0x1, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x404, 0x9, 0x1, {0x22, 0x27}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0xb, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, 0xffffffffffffffff, 0x0) 2.235501638s ago: executing program 0 (id=29): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa2588a81900810020000806000700060600000a00004a9f1b56aa8aaaaaaaaaed58cf2b6d3002fc8003345aa79918fcea08b06992a9599e12508df2787c2a9f15b773e9798aefe0558c13cc5c05609c31ba2696"], 0x2a) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f00000087c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000100)={0x50, 0x0, r4, {0x7, 0x29, 0x0, 0xffffffff8d412014, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5}}, 0x50) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x4b) socket$packet(0x11, 0x3, 0x300) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) sendmsg$inet6(r6, &(0x7f0000000480)={&(0x7f0000000040)={0xa, 0x4e20, 0xfffffffc, @remote, 0x2}, 0x1c, 0x0}, 0x20008814) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) syz_fuse_handle_req(r3, &(0x7f00000042c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x40000000000, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getdents64(r5, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) dup(r1) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) (async) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa2588a81900810020000806000700060600000a00004a9f1b56aa8aaaaaaaaaed58cf2b6d3002fc8003345aa79918fcea08b06992a9599e12508df2787c2a9f15b773e9798aefe0558c13cc5c05609c31ba2696"], 0x2a) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) read$FUSE(r3, &(0x7f00000087c0)={0x2020}, 0x2020) (async) write$FUSE_INIT(r3, &(0x7f0000000100)={0x50, 0x0, r4, {0x7, 0x29, 0x0, 0xffffffff8d412014, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5}}, 0x50) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x4b) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) (async) sendmsg$inet6(r6, &(0x7f0000000480)={&(0x7f0000000040)={0xa, 0x4e20, 0xfffffffc, @remote, 0x2}, 0x1c, 0x0}, 0x20008814) (async) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) (async) syz_fuse_handle_req(r3, &(0x7f00000042c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x40000000000, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) getdents64(r5, 0x0, 0x0) (async) 2.093739743s ago: executing program 0 (id=30): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x678, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0x3, 0xf, 0x8, 0x80, 0x9, 0x3, 0x7f, 0x20000006, 0x20000000, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0x3, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0xa, 0x3c1b, 0x1, 0x24, 0x800000d, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xc, 0x0, 0x8071, 0x7, 0x6, 0xffffffff, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0xfffffff9, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012d, 0x8004, 0x5, 0xfffffff3, 0x129432e2, 0xc8, 0xf9, 0xe, 0x2ff, 0x1, 0x9, 0xfffffffc, 0x4, 0x10001, 0x0, 0x3, 0x2f, 0xe, 0x6, 0x78, 0xea4, 0x0, 0x3, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0x1000d, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x4, 0xf, 0xffff8001, 0x47, 0x31f3, 0x1, 0xfe000000, 0xfffe, 0x202, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x3, 0x42, 0x3], [0x5, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x2, 0x5, 0x8, 0x4, 0x5, 0x5, 0x4, 0x1ef, 0x2, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0xc, 0x2, 0x2, 0x3, 0x20000008, 0x4004, 0xffffff11, 0x6, 0x38, 0x800003, 0x200, 0x83, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x3, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x4002, 0x3, 0x7ff, 0x12b, 0x4, 0x40000001, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x0, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x400006, 0x6, 0x0, 0xb9, 0x9, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x9, 0x7fff, 0xffff, 0xa620, 0x1, 0x78b, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x1, 0xc8, 0x1, 0xfffff000, 0x5, 0x3, 0x0, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x1, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf44, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff343e, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="3400000013000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14000c8008"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) 1.941481518s ago: executing program 0 (id=31): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x1fd2, 0x6007, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x9, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x5, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socket(0x28, 0x2, 0x0) r1 = syz_usb_connect(0x3, 0x1a2, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000b6a57e4086805b0bc5e10102030109029001020000000009040000020e0100000a2401002200020102092100000001220000090500000000000000a7008d566539461c701919d99a91c3af134dfaf61ea66b8f08810855d90c55c91f11c4a6d847caf7b449c6c760e60f6b890d99ed23074bf2538ca7bba727dfe7c00b90d0bc7f2da56768ed5ce8df38c07183564831596fd52da49a92adafa6277df5a120c898fc51ca04089f110dfbe1b258e9b9a83bf95fb0a4a24ca6acae78e1c291f671fcdca77c7128d319f7a4b51bbc2ed4bab8aac95498fb6033f760602c1a8b1eac2150072501000000000905000000000000000725010000000007250100000000090400000eb03748000a2401000000020102052405", @ANYRESDEC=r0, @ANYRESDEC=0x0, @ANYRESHEX, @ANYBLOB="b3f4284e15ee530c2e6fa9918737ee33bce025f7affc5fb44e1802fa85b644c6fb576e08e0154c19b954c154ec0835bb47dc2c30eb7de028316ba5bc1e8417aa0df16a770b80998e8afda1b094b24e62e29c07435d400ef41811837651cc01930bbb3ee3b685cdf5af75455e7c964e79ad983cff96bbecbfdc3853539f90584e19cc312bd6b1b376aefaa71458c12f95d5a1be595b2b066bcc531772bd20605926190f4c40227b8006"], 0x0) syz_usb_control_io$rtl8150(r1, &(0x7f0000000b80)={0x14, 0x0, &(0x7f0000000b40)={0x0, 0x3, 0x4, @lang_id={0x4}}}, 0x0) syz_usb_control_io$uac2(r1, &(0x7f0000000140)={0x14, &(0x7f0000000040)={0x40, 0x10, 0x14, {0x14, 0x31, "4aa175aef68c6737b66559ea5cd3f50f5734"}}, &(0x7f0000000100)={0x0, 0x3, 0x21, @string={0x21, 0x3, "15d694f3ee988dc2509480c44bbc805ca0c2d22c808c57cc2bd3136f8729c6"}}}, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x20, 0x15, 0xc9, "25904bd6018293f29c886a1a8b7cf756d3ac9a9ea12c87bef077d06c6837b601ab5ebc98321ba92668c2a8e68aea1e7edf83dfb1e1ee24aa1b517805db223a4ec10ef77c2738ed3624e4f9dd030bf91e6b978855b6c0de4a2b59bc76844f51ed1673c5eac9cb32d4e418a7abbc12e451391f1108876be2edb1bc510522213bd9632a338d37aa8cc42939c438fc34f8dd3ada008c54cc7afac553cce02e3e1ebd3afbac886993f9e214a054ca295aa92d547d1269bdb3199b38bf06fc3cb55f8ecd14df7d08bccfbff9"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x8}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0xa7}, &(0x7f0000000300)={0x20, 0x81, 0x1, 'F'}, &(0x7f0000000340)={0x20, 0x82, 0x1, "de"}, &(0x7f0000000380)={0x20, 0x83, 0x3, "008303"}, &(0x7f00000003c0)={0x20, 0x84, 0x2, "7115"}, &(0x7f0000000400)={0x20, 0x85, 0x3, "3969df"}}) syz_usb_connect$cdc_ecm(0x2, 0x7c, &(0x7f00000004c0)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6a, 0x1, 0x1, 0x91, 0x90, 0x6, "", [{{0x9, 0x4, 0x0, 0x5, 0x3, 0x2, 0x6, 0x0, 0x1, {{0x8, 0x24, 0x6, 0x0, 0x0, "5ba370"}, {0x5, 0x24, 0x0, 0x80}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x5, 0x7ff, 0x9}, [@mdlm={0x15}, @network_terminal={0x7, 0x24, 0xa, 0x3e, 0x22, 0x80, 0x8b}, @network_terminal={0x7, 0x24, 0xa, 0x5, 0xf, 0x9, 0x80}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x40, 0x4, 0x1, 0x4}}], {{0x9, 0x5, 0x82, 0x2, 0x8, 0x8c, 0x81, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x0, 0x8, 0x7a, 0x67}}}}}]}}]}}, &(0x7f0000000a00)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x200, 0xe8, 0x5, 0x24, 0x30, 0x2}, 0x24, &(0x7f0000000580)={0x5, 0xf, 0x24, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x6, "55450552388c26cbfc675eb449fda587"}, @wireless={0xb, 0x10, 0x1, 0x2, 0x0, 0xca, 0xff, 0x9, 0x28}]}, 0x3, [{0xbb, &(0x7f0000000840)=@string={0xbb, 0x3, "2e00e015a6757db137f754858509d3e63d8a090f90f3967d03e70cc300725836fa68e1f52d323d8f67d99666483b2e12b29e15f5ebffe00639b8fc092707664081dfb8306474bd6aa59b11dc1cacf9f53d4738d0958b4aab90ea447bd8a55e224f4e782cc1bbc55fbbea38e12cbaa9f5cc770e117541152574caf0c27b76d46ebd9d0b1d4ee743d559b9f4e0c00414249c3876d8b8b0c1092c6bf8d4cc454663c649d776e378dab71c2b8c6e63ac292bcb405deb67209e51e0"}}, {0x4, &(0x7f0000000900)=@lang_id={0x4}}, {0x86, &(0x7f0000000940)=@string={0x86, 0x3, "4f110dae3c6cc906ecfae234295190bb2142b27a9d8f2914a1f61a54dcc03ff7695e1e5006ef0d981772b9512d4ed2e0ad9898b4babd9359ec68ba91b06a1bc84482df75fda2633b8b95be64df600cae068e499747a5dc406881e32c844d28b84e515b3cb628409d5ba70f1ab9349811a519bc03bea9c99fe8b1e2249b72489c667a7662"}}]}) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, &(0x7f00000000c0)={0x0, 0x0, 0x35, {0x35, 0x8, "83efb930f0187ff0478fa22a61a54607b71ea9e43d359c479c37f545cb92e449c42123ec25cde38bf7914077366b487a480400"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 1.647950747s ago: executing program 1 (id=32): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) (async, rerun: 32) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) (rerun: 32) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) (async, rerun: 32) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x24c01, 0x0) (async, rerun: 32) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r3, 0x1, &(0x7f0000000780)=[&(0x7f0000000440)={0xfffffffe, 0x20011004, 0x4, 0x1, 0x0, r2, 0x0, 0x0, 0x407f0b00}]) (async) dup3(r2, 0xffffffffffffffff, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201100100000020f2042311000000000001092424000100006006090400040203000200092104004001222b0009058103"], 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f00000012c0)=0x100000001, 0x4) (async) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e24}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x3, 0x0, @loopback={0x0, 0xac141400}}, 0x1c) (async, rerun: 32) r6 = socket$inet_tcp(0x2, 0x1, 0x0) (rerun: 32) setsockopt$inet_mreqn(r6, 0x0, 0x0, &(0x7f0000000000)={@multicast2, @dev={0xac, 0x14, 0x14, 0x36}}, 0xc) (async) getsockopt$inet_buf(r6, 0x0, 0x29, &(0x7f0000000000)=""/137, &(0x7f0000695ffc)=0xbf) (async) r7 = fcntl$dupfd(r4, 0x0, r4) sendmsg$IPVS_CMD_GET_CONFIG(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000000)='pids.events\x00', 0x0, 0x0) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f0000000300)={r7, 0x4, {0x0, 0x0, 0x0, 0x6, 0x6e9, 0x0, 0x6, 0x9, 0x14, "76fad820542dfc8ae6978fb5b6b2442fa9f81687252048d42f97fe3bbf78276f2309caa7692546474d0e66154bbc72aa278159e6d0ee017c6c97bfab58ae8b0a", "fd391d4a0a1cbe299ccdebe23cbbc25700a3dceff721c793533011ac963540e707e90ac0595cd802f8b35f2a580ab4be810bd905e9a933e1a8a974e8cf050497", "4ee15a237454961642dea5b90eec320b2428e679c7f1e9a85fccde1700", [0x592, 0x2]}}) (async) r9 = socket$nl_audit(0x10, 0x3, 0x9) (async, rerun: 64) r10 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) (rerun: 64) write$binfmt_format(r10, &(0x7f0000000080)='-1\x00', 0x3) (async) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f00000000c0)={'batadv_slave_1\x00', &(0x7f0000000380)=@ethtool_rxnfc={0x31, 0xe, 0x1, {0x5, @ah_ip6_spec={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, 0x1, 0x1}, {0x0, @multicast, 0x4, 0x0, [0x1]}, @tcp_ip6_spec={@remote, @dev={0xfe, 0x80, '\x00', 0x31}, 0x4e23, 0x4e22}, {0x0, @local, 0xa7f, 0x0, [0x1, 0x4]}, 0x9a, 0x4}}}) 1.624650028s ago: executing program 1 (id=33): r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x8, 0x0, 0x0) r2 = syz_ublk_setup_io_uring(0x8, &(0x7f0000000140)={0x0, 0xb9e7, 0xff2c6d9f89b69b34, 0x0, 0x3a0}, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)) syz_io_uring_setup(0x680c, &(0x7f0000000280)={0x0, 0x718d, 0x20, 0x1, 0x27b}, &(0x7f0000000300)=0x0, &(0x7f0000000340), &(0x7f0000000380)) (async) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4, 0x50, 0xffffffffffffffff, 0x0) (async) syz_io_uring_setup(0x14ff, &(0x7f00000003c0)={0x0, 0x2a7d, 0x1, 0x2, 0x80000e5}, &(0x7f0000000440), &(0x7f0000000480), &(0x7f0000000640)=0x0) (async, rerun: 32) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (rerun: 32) r7 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x12) fcntl$setlease(r7, 0x400, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r8 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fcntl$setlease(r8, 0x400, 0x0) (async, rerun: 64) ioctl$KVM_CREATE_VM(r6, 0xae03, 0x2f) (async, rerun: 64) r9 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) (async, rerun: 32) r10 = getpgrp(0xffffffffffffffff) (rerun: 32) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000580)={0x2e, 0x14, 0x0, r9, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000540)=@new_dev={0x7, 0x9e8, 0x0, 0x0, 0x1000, 0xffffffff, r10, 0x0, 0x8d}}}, &(0x7f0000000600)) (async) r11 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_WATCH_KEY(0x6, r11, 0xffffffffffffffff, 0x8f) (async) getsockopt$inet_tcp_int(r0, 0x6, 0x9, 0x0, &(0x7f0000000040)) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r13 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (rerun: 64) ioctl$SNDRV_TIMER_IOCTL_SELECT(r13, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) (async) ioctl$SNDRV_TIMER_IOCTL_START(r13, 0x54a0) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r12, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40041) 1.610061589s ago: executing program 1 (id=34): r0 = syz_ublk_setup_io_uring(0x13fe, &(0x7f0000000040)={0x0, 0x0, 0x1000, 0x4}, &(0x7f0000000000)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f0000000280)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f031c00", 0x4, 0x800, 0x0, 0x0) (async) syz_ublk_setup_queues(r0, r4, &(0x7f0000000200)={0x0, 0x1460, 0x8, 0x0, 0xb2}, &(0x7f0000000840)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf0b2, 0x4000, 0x1, 0x3ab, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x20000, 0x9, 0x2000008, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x10, 0x2, 0x902c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x100, 0x2, 0x21b, 0x0, r0}}], 0x4, 0x0, 0x0) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000b80)={{0x12, 0x1, 0x201, 0x74, 0xeb, 0x78, 0x40, 0x1bcf, 0xb40, 0x4abf, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x67, 0x4, 0x10, 0xf, "", [{{0x9, 0x4, 0x82, 0x5, 0x0, 0xe, 0x1, 0x0, 0x96}}]}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) 834.894273ms ago: executing program 2 (id=35): r0 = socket(0x10, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000200)=@name={0x1e, 0x2, 0x3, {{0x42, 0x4}, 0x4}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}, 0x1}}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r2, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x20000003}}, 0x10) bind$tipc(r1, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000800)={'pimreg\x00', &(0x7f0000000000)=@ethtool_coalesce={0xf, 0x2, 0x3, 0xfffffe00, 0xa8c, 0x10001, 0x9, 0x9, 0x80000000, 0x6, 0x9, 0x6, 0x752, 0x9, 0x6, 0x4, 0xd8c7, 0x2, 0x6, 0x6, 0x4, 0x3, 0xffffa149}}) socket(0x10, 0x2, 0x0) (async) socket$tipc(0x1e, 0x2, 0x0) (async) bind$tipc(r1, &(0x7f0000000200)=@name={0x1e, 0x2, 0x3, {{0x42, 0x4}, 0x4}}, 0x10) (async) socket$tipc(0x1e, 0x5, 0x0) (async) bind$tipc(r2, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}, 0x1}}, 0x10) (async) socket$tipc(0x1e, 0x2, 0x0) (async) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) (async) bind$tipc(r2, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x20000003}}, 0x10) (async) bind$tipc(r1, 0x0, 0x0) (async) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000800)={'pimreg\x00', &(0x7f0000000000)=@ethtool_coalesce={0xf, 0x2, 0x3, 0xfffffe00, 0xa8c, 0x10001, 0x9, 0x9, 0x80000000, 0x6, 0x9, 0x6, 0x752, 0x9, 0x6, 0x4, 0xd8c7, 0x2, 0x6, 0x6, 0x4, 0x3, 0xffffa149}}) (async) 756.940466ms ago: executing program 2 (id=36): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000000080)=0x1, 0x4) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000180)={0xffffffffffffffff}) sendmmsg$inet6(r1, &(0x7f00000000c0)=[{{&(0x7f0000000140)={0xa, 0x4e23, 0x9, @mcast2, 0x7}, 0x1c, &(0x7f0000000200)=[{&(0x7f0000000100)="006a19825a0e3d112c02b20d5f150a5f88c26615c82479d310d717bbaba9721f558e58bc0017cff8ea3c824a4f3284b49d3a6cf1d26494", 0x37}], 0x1}}], 0x1, 0x240c80c0) 756.808806ms ago: executing program 2 (id=37): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x64}, 0x1, 0x0, 0x0, 0x4000005}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000001010102000000000000000002001000240002800c000280050001003a00000014000180080001000000000008000000000000000c0019800800020099"], 0x44}}, 0x0) 694.971348ms ago: executing program 2 (id=38): prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r0 = syz_usb_connect$hid(0x0, 0x6c, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000040b827ed0100000000000109022400010000000009040000010300000009210000200122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0xc, "8b7f8976"}]}}, 0x0}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000002c0)="f333", 0x2}], 0x1, 0x0, 0x0, 0x11000000}, 0x4000001) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r2, 0x400455cb, 0x1f) ptrace(0x10, r1) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000540)) ptrace$cont(0x20, r1, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r3, 0x0, 0x40, &(0x7f0000000080)="8c5d7b87b32ecae06ac8cfe890364ab911d8c33439477a7591f6914e91c6821ee7163f8ae1896184d48797997716158aad89f66dd67480ce8ff178ef748cfcdcf54127d5ff95cbcaebf10a3b7cddafa2c0fa6aa2eaef0d457680203c02d0c623", 0x7590) r4 = socket$packet(0x11, 0x2, 0x300) sendmmsg$sock(r4, &(0x7f0000002c00)=[{{&(0x7f0000000500)=@hci={0x1f, 0xffffffffffffffff, 0x4}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@txtime={{0x18, 0x1, 0x25, 0xe6b}}], 0x28}}], 0x1, 0x20008845) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(r5, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000000c0)=""/147, 0x93}, {&(0x7f0000000bc0)=""/175, 0xaf}, {&(0x7f0000000840)=""/206, 0xce}, {&(0x7f0000000e00)=""/4072, 0xfe8}, {&(0x7f0000000940)=""/132, 0x84}, {&(0x7f0000000300)=""/133, 0x85}], 0x6}}], 0x1, 0x40010080, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000", @ANYRES16=r6, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) socket$inet6(0xa, 0x4, 0x80) 376.458188ms ago: executing program 1 (id=39): keyctl$set_reqkey_keyring(0xe, 0x0) r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000780), 0x2) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f00000007c0)={0xffffffffffffffff, 0x0, 0x1000000}) 320.083249ms ago: executing program 1 (id=40): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000780)='net/fib_triestat\x00') r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000c40)={0x8000203d}) writev(r0, 0x0, 0x0) r3 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x400) writev(r3, &(0x7f00000001c0)=[{&(0x7f00000000c0)="3979a0edcb6c689230647619e254a257b4f920830600000000000000bb060000000070cd56a80000ffe1000000002500000019001100", 0x36}], 0x1) 319.627549ms ago: executing program 1 (id=41): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r0, 0x4008af23, &(0x7f0000000000)={0x0, 0x100}) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x1fd2, 0x6007, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x9, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x5, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) r3 = dup2(r2, r2) sendmmsg$unix(r3, &(0x7f0000012200)=[{{&(0x7f000000c8c0)=@file={0x1, './file1\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4000}}], 0x1, 0x4004) r4 = fsopen(&(0x7f0000000080)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='a\x01:{\x86', 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r3, 0x7, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000000c0)='source', &(0x7f00000001c0)='source', 0x0) syz_usb_control_io(r1, &(0x7f0000000080)={0x2c, &(0x7f00000000c0)={0x0, 0x0, 0x35, {0x35, 0x8, "83efb930f0187ff0478fa22a61a54607b71ea9e43d359c479c37f545cb92e449c42123ec25cde38bf7914077366b487a480400"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 271.489321ms ago: executing program 0 (id=42): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000980)={0x802}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x14, 0x52, 0x201, 0x0, 0x0, {0x20}}, 0x14}}, 0x44001) syz_genetlink_get_family_id$tipc(&(0x7f0000000180), r0) 256.891422ms ago: executing program 0 (id=43): r0 = syz_open_dev$usbmon(&(0x7f0000000380), 0x0, 0x60040) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x13, r0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_int(r1, 0x0, 0x33, &(0x7f0000000180)=0xfffffff6, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0x7, &(0x7f0000000240)=0x6, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'ip6tnl0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="0b032200eb1025120212475400f6a13bb1000000080089064803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r3}, 0x14) listen(r1, 0x5) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000140)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe000000802dca8a9848a3c728f1c46b7b311338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade0000", 0x55}], 0x1}, 0x0) r5 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) close(r5) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40800, 0x0) ioctl$sock_TIOCINQ(r4, 0x541b, &(0x7f0000000080)) syz_extract_tcp_res$synack(&(0x7f0000000040)={0x41424344, 0x41424344}, 0x1, 0x0) write$tun(r6, &(0x7f00000003c0)=ANY=[@ANYBLOB="460101e90065000005069078ac141440ffffffff860cfffffffc0202070459a444449251e0000002000000017f00000100000002ac1414aa000000087f000001000000057f00000180000001ac1414aa0000007fac1e010100000003640101000000b7c9071741ffffffffac14144364010100ac1414aaffffffff8667000000030709e79d54a8a5d25e0512ffecaa9a98f4f7b80908edfc4e7251880011ed3b1aa4f6096b2266c444aef250bf0004e8ec0605305fcd020b56e8334313408119fe050ddec92c285c8c27dc8d1c40010b60762f2a03c63f37c605067f771d540103be071bb6ac14141eac1489f249fab8803ca2000064010100e000000294040000440c39010a0101000000000501820ab5bdde3b54236fcb8640ffffffff070b6cd1a0c41f4ddb842b0710993c0b00a17b53ba99a7784d7f96020d08b30cc0771b841df454f9060306010fa52b36d9fd0d4537716915692f4e234e20", @ANYRES32=r7, @ANYRES32=0x41424344, @ANYBLOB="40020000907800081e1220dbe00000016000538fbdce4b07b47e07095782a86249ddb9fe0bf989e97d3db3f4ce83050e0000000700000000000086b50507a7928d0e44006e41cd3d8f0fb82d43dea98763af9fbb3cfabd760b44bd1e8c30e9f1047a35d7a142812b185c6c87f290b6f77b40a1960a4ccfbb27d10995de3764f581dbfc859a"], 0x1e9) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0x5a5b5) 196.063143ms ago: executing program 0 (id=44): pipe(0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) shutdown(r0, 0x1) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000003c0)=@gcm_256={{0x304}, "5467ab0000007ffb", "df7b57d67e69283c56bd41adb4d53f4ad34ad31139acfb5bd7ec4175c068f087", '\x00', "0200"}, 0x38) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0xfffffffffffffffe) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000180)={'syzkaller1\x00', 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x46d, 0xc219, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x9, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xb3, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) r3 = getpgrp(0x0) syz_pidfd_open(r3, 0x0) r4 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xc45, 0x5112, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x0, "", [{{0x9, 0x4, 0x0, 0x1, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x404, 0x9, 0x1, {0x22, 0x27}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0xb, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, 0xffffffffffffffff, 0x0) 140.163905ms ago: executing program 3 (id=45): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = syz_open_dev$rtc(&(0x7f0000000000), 0x0, 0x0) ioctl$RTC_ALM_READ(r3, 0x80247008, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r4 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x14b040, 0x0) ioctl$ASHMEM_SET_SIZE(r4, 0x40087703, 0xfffffff4) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r4, 0x0) ioctl$ASHMEM_SET_NAME(r4, 0x40087708, &(0x7f0000000540)='\x00\x00\x03\x01\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x02\x00g\x00\x00\x00\x80\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-\xac\x99\xb8\xd2\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc4\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0HdO\xb9\xa2\x1d\x13\x8fCha\xb3\x95wl},\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80Z\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9\x13f=\xbd\x03\xe8\xbex:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13\xba\x00|g]7\xdc\xe9=\"\xe4\xb3\x0f\xc6\x8f\x85fGGV&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xd0d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146\'Z\x83H\xabF\x18<\x86h\x01=\x03\\\xc4\t\x8e/\x12\a\xdf\xe7zU\xcc\x02\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&@\x00\x00\x00rT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\xd7c\t(\xf2\x93\x8d\\\x91\xef\xab(Jck\xdf\xa3 \x16\x9bH=\x01\x7f\x02\x1dF3\x7f\xd15\xa8\xd2\x94\xa7\xe9\xbd\xdc\x16\xe1Z\x9c\xe3\xeb9\x8f\xfdC\x0e\xd3]\xb5\xfdB\\\xd2\xfe\xf6H\x8ai}kDM\xbd\xfcJ{T{@i/\xb7x\xef\x1f\xf0t\xf5\xaf\xb21F\x01\xe0\x86\xde\x88\xb8\x8f \xfc\xcd\xba\xea\x16\xc1J\xb7\xe3\x04m\x0e\xaf\xd6X\xba\x8a\xdb\xeda\x83.H\xe3\x86\x03\t\xcb\xdc\x80\xee\x0ec\x12\x8a\x92\x11\xb6\xcc#\x10\xec\xfd\xbb\xd3\\\xc8\x88\x04,\'\x14\xbf\x84\x16\xb3\x8f,6\xc6D\xae\xa1\xf9\xe7@\xac\xaa\x104\x8b\x8eQ8\x11\xa7|\x87\xe2\xccrj%\xc4r&\r\a\xa7\xda\xf5\'V\x89\xe6\xa4\x05\xde\xf5\xaa@\xec\xe2\xf6\xb5x\xa1w\n\xda\xf2\xd67\xc6%\x0f[sF\xb6\xaeS>\xe9^\xd4\xf03\xe9.\xc4\xd5\xe0\r\xa1Q\xa8\xf2\xa2`zs\'k\xd4pV\xab&%\xf8\x8a\x80\x9d\"\xf3\xcc\xd2i\xc8\xd8\xc6\xbeD\xda\x86?\xf9\x13\xe5L`R\xe8Vq\xa3\nD\x9f\xe4M\xe6\xab\xdd!=%\x06z$\x99\';O\xfc\xf0u\x83\v\x83\a8\xfe<\x9e\xa8\xfe\xca`D\x91\x81!QT$\x05T\x85\xd6\xe9!\xb9wfL\x12\xa8\xb0\xb0\x86\xc2\xa1\xf7\x05i\xf5\xf0\r\xe7h\xdaD\xcb\xd4\x87\x84\xe5\xc7r;.\xf0\xed\x17\x83Nn\xb7\x0f!u}J)\xa1\xa1\x16\xc5`Z,\xa3\xcf\xfdy\aH\x06\x14l\x92x\xdbB=\xcc\xcdf\xe5\x04=HQ\xeaE-v\x02\x0eY\x8e\xbf\xec\x16\xc4G\xea\x8bS\x8e\xd5f\xdcj\xe1\x86\xf9s\x90\xe5\xf9\x89\xc0\xf3\xcd;r4j]\x9b\xdf\xf5\xe9\x82\xe1\xdb\x11\xb3\b\xa2Y\xdb\\\xc1H\xc3\xcf\xb1W\xe9(\xee\x18\xca\xda\xf5p,\x16\xbc\x17\xfe\xd8\n\xe1\xa1&=+)\xf9Vd\x11\xf6hX\xbe\x85O=\xe2\x9f~I\xc4\"\xa9\xd9\x19\xa2\\\xb8>f\xe2Jh+u\x90\x13\x94\x12\xc8X\xd7\xb4\xf1JS0FN\xa0\xda\xb6ez`\x9a\xea\xcf^\xa5\x17{\v\xe8n\xe9 \xc0/D\t\x7f\xd8\xad\xf2e\xff\x8b\x16p\x0f\xe4\x1a/\xe1\x96\xd2\xae\x94\x0e5\xb0b+\xac\x14\xaa\xb0\xb7\xa5.\x15\x8a\xca\xb5~=D-\x90\xc1\xbf\x05\xb9\xd5\x86\xeb\xd2#\xda\xc132\'\xfc!%\x94\x1f\xbfL)\xc2c\xa8\xef\x152\x8d\xef\xde\xbe\xab\xf5g\x80\x02G>\xf5\x04a-\xff\x06X+\xc1\xd3\xb1\xcdn\x15p\xdf\xd8.\x89\x95{\xb6+:`\x9c\xcf2\x01\x1d1\xf7\xe6\x7f\x1f\xf5\xb0\xb9\t2\x14\x81\x99\xb8@7y\xb4\xce\xf1]\a\x03y\xc5F\xfa\xae\xd1Ov7\xa7\xc1\xb2.~B\xe8@G\xd1\xd9R~\x1b\xf7\xa8\x86\xa7\xc1\b\x9ej\x01\xf4\xb7\xd2\x0e\xc2\x15S\x19\xd7\xd4\xe6\xaf!\xf8_\x8aEOp@>4\xd7\xcf\x11\xe0;\x99}QmE\xdd\xa69)Q\x9e\xb9\'\x97\x9b\xe7\xa4?Ed\x9c\x7fE\xba5\x90\xc07\x96S\x9d\xe1\x84\xfa\x1a\xd6\x9a\x15\xd1o \xc0\xd28\x01\xa7\x99\x85q\xbd\x80\x00\x00\x00\x00\x00\x00\x00H\x0f\xbbT\xd5\xb3\xf4\xcd<\x8a\x01\x19\xd0|B\f0\xf8i\xd3\x1bJke\t\x8b7Q\x1dQ&\x96H\x05\xec\x80\xf0\xab\x8f\x94{\x9d+\xefs\x1c\xfck\xf7q\x10\xf6\x16\xbc\xe7\x93\x0f\x7f\xcd\xa7b\xbe\x88\xcc\xb6^\x93\xa9P\xf3\xa3\xe4Az=\xe0+Q\x9e\xb5\x01\xb3\xc1\xa8P0+\xc9\xa1\xdbU~J$\xa4\x03\x11\x1aa~\x9du\x8f\x8d\xbcI\x85k\xa0\xae\xf6\xa0\x94r\xfb\xe3\xaa\xd4\xf0\x99\x06\xe1i\x1f\xfa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\\\xb2/R\xedI2e5\x88(\xc0+^\xe7G\x17\x03^\xd7g\xb9n\x8c2\xb3\x12\x91\x86b\t\xd0R\x01\xda$Y\x85\x02&\x95FC\xc8\xd9\x00\x00\x00\xb6u\xbb\n{\x90\xfd>\xd0-\xfa\xa9\xfd{\x95E\r\x81j\x12\xb7\xd0k\xc2\xdc\xcdK\xc1\xe6\xf7\xb8@\xe0D') ioctl$ASHMEM_SET_NAME(r4, 0x40087708, &(0x7f0000001d80)='\x00\x000\x10\x00\x00\x00\x1f\x00x\x85\x1c \xf3\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\x00\x00\x00\x000Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xc9\x91\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\t\x00\x00\x00\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\x89]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8CoB\xdc\xc26\x06\x10\x92\xc7\xa55\x9f\x04\x00*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03\xae\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\xedo\x92\xae\r\x05\xfa\x99\x15\x87\x14\x13$\t\x01\x00\x00\x00\x00\x00\x00\x00\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\f\x03\xbb\x14\xa7\xda\x19M\xa3!\x95\xa0\x9a\x05\x06\x00\x00\x00\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00f\x8a\x9b\xe2\xa7k9\xd9`=}\t\x82\nw!y\x91\xbeM\xdck=\xcc\xef\x16vt\x1d\x1c\xa3\xee\x13\x16\xdbb0\b`/c\x9f\x8c\xee\xb1\x1a\xcf\x8ba\x11Oh\xc7\xb8\x8e#\xeeAh\xd9\x15\xc6\xe7>\x95\xe2\xdaQ\x0e\xc0E\xdd\xc3^7Y\xd2\xf0\xf7DZ\x12\xce\xba\vI$[v\x00\x830p\xd4\xbf\xa3\xf28\xab\xd4e\xc9z\xff\xfc\xeb\x04\xff\x98\xda\x01.gT\xcb7!W\x98\xc4\xa5\xb4\xc3\xd8\x94\xe6\xd7\x9e\xed\x1f\xafBF\xd6\xbfu5=.\x92\xc8-\xcc~6Y\xa7K\xd5=v\xdctJ\xba\x17\x18\xc8x\x95\xd8\xb2\xd6\x10)\xcfs\xaf\xf5E\x18\xa2*\x82\tU\xd3\xf7Y\x1d\x175\x04X2\xa3K\xab\x14\xec\xc9\x9c?\xa9\xc4\xc7\xe3{\xbfA\x16\xfcY\nR\x93\xb3\xcd\x0fg\xf6L3\xe87\x8aX\x82Y\x95\v\xbf%\xef\x83\x02\xc1\xd5c}\x18(\x13\x9e\xe7\xb2$\xee\xc4\x94\x00\xf6S9\xb7\xbcu\xb9\xad\xc6$=D\xb9\x82\x15yM\xa8\xf1N\xaeB\xf8.q\x90\x8a\xb57_\x98\x7f\xf2b\xbd\x97\xfc\xefN\xc6\xad\x99IJW\'\xd6m\xf0[WO\xf3\xd0\x9e\xda\xbd8\xd5FVA>\xa8p\vp*\xd1\xd9\v\xa3\xb2\x1b)E/\xbb\x90\xcct_K\x8d\xa3\xd2\xad,y\xa7\x8b\xa3\xb8\x86\xa9Q~\x1f\xbf\xa3(,\x91') write$tun(0xffffffffffffffff, &(0x7f0000000100)={@val={0x8, 0x800}, @val={0x5, 0x0, 0x0, 0x0, 0x14}, @ipv4=@tcp={{0x5, 0x4, 0x2, 0xc, 0x28, 0x67, 0x0, 0xb, 0x6, 0x0, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x19}}, {{0x4e1d, 0x4e24, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x8, 0x5, 0x0, 0xefff}}}}, 0x36) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd070010000000140bb80060ec97000fc82c00fe8000000000000000000000000000aaff02000000000000000000000000000111"], 0xffe) 57.101528ms ago: executing program 3 (id=46): socket$packet(0x11, 0x3, 0x300) (async) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000240)=0x6, 0x4) (async) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000240)=0x6, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="0b032200eb1025120212475400f6a13bb1000000080086dd4803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xf) 0s ago: executing program 3 (id=47): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000001c0)=ANY=[@ANYRES16=0x0], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000657"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100100000008961b12000000002000010902240001000080100904000009030001000921040000012228000905810300020007fe"], 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@rand_addr=0x64010100, @in=@local, 0x0, 0x5, 0x4e21, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x7f, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x40}, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', r3, &(0x7f00000001c0)='./file0\x00', 0x114) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="400000001800150000000000ffffffff0a0000000202000000000000240009801c00000000000000140015"], 0x40}], 0x1}, 0x0) keyctl$restrict_keyring(0x1d, r2, &(0x7f00000001c0)='keyring\x00', &(0x7f00000023c0)='\x00') sendmsg$nl_xfrm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="ec0000002100010000000000fefffffffc010000000000000000000000000000fc020000000000000000000000000001fffc0000000200000a00e08000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="02000000000000009c001100fe80000000000000000000000000001164010102000000000000000000000000fe8000000000000000000000000000bb3c00000000000000000000000101fc00000000000000000000000000000000000000000027cdea3176a200000000000000000001fffffeff0000000000000000000000006c0200000000000002000a00"/150], 0xec}}, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 12.399333][ T36] kauditd_printk_skb: 48 callbacks suppressed [ 12.399349][ T36] audit: type=1400 audit(1780200187.619:59): avc: denied { transition } for pid=230 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.403607][ T36] audit: type=1400 audit(1780200187.619:60): avc: denied { noatsecure } for pid=230 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.406452][ T36] audit: type=1400 audit(1780200187.619:61): avc: denied { write } for pid=230 comm="sh" path="pipe:[2713]" dev="pipefs" ino=2713 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 12.409741][ T36] audit: type=1400 audit(1780200187.619:62): avc: denied { rlimitinh } for pid=230 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.412504][ T36] audit: type=1400 audit(1780200187.619:63): avc: denied { siginh } for pid=230 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.96' (ED25519) to the list of known hosts. [ 19.339566][ T36] audit: type=1400 audit(1780200194.559:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.340887][ T286] cgroup: Unknown subsys name 'net' [ 19.343354][ T36] audit: type=1400 audit(1780200194.559:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.347648][ T36] audit: type=1400 audit(1780200194.569:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.347801][ T286] cgroup: Unknown subsys name 'devices' [ 19.425192][ T286] cgroup: Unknown subsys name 'hugetlb' [ 19.430810][ T286] cgroup: Unknown subsys name 'rlimit' [ 19.524203][ T36] audit: type=1400 audit(1780200194.749:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.547400][ T36] audit: type=1400 audit(1780200194.749:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.561445][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.572365][ T36] audit: type=1400 audit(1780200194.749:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 19.603989][ T36] audit: type=1400 audit(1780200194.809:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.629900][ T36] audit: type=1400 audit(1780200194.809:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.631706][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.655611][ T36] audit: type=1400 audit(1780200194.849:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.689886][ T36] audit: type=1400 audit(1780200194.849:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.496848][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.504163][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.511241][ T296] bridge_slave_0: entered allmulticast mode [ 20.517540][ T296] bridge_slave_0: entered promiscuous mode [ 20.525299][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.532336][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.539548][ T296] bridge_slave_1: entered allmulticast mode [ 20.545817][ T296] bridge_slave_1: entered promiscuous mode [ 20.579185][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.586250][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.593355][ T294] bridge_slave_0: entered allmulticast mode [ 20.599537][ T294] bridge_slave_0: entered promiscuous mode [ 20.606054][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.613285][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.620357][ T294] bridge_slave_1: entered allmulticast mode [ 20.626682][ T294] bridge_slave_1: entered promiscuous mode [ 20.647663][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.654770][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.661839][ T295] bridge_slave_0: entered allmulticast mode [ 20.668264][ T295] bridge_slave_0: entered promiscuous mode [ 20.677037][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.684102][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.691222][ T295] bridge_slave_1: entered allmulticast mode [ 20.697392][ T295] bridge_slave_1: entered promiscuous mode [ 20.742874][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.749965][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.757053][ T293] bridge_slave_0: entered allmulticast mode [ 20.763197][ T293] bridge_slave_0: entered promiscuous mode [ 20.769867][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.776925][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.784011][ T293] bridge_slave_1: entered allmulticast mode [ 20.790251][ T293] bridge_slave_1: entered promiscuous mode [ 20.892664][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.899742][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.907054][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.914084][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.928277][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.935355][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.942603][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.949623][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.972518][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.979591][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.986915][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.994040][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.011059][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.018136][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.025383][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.032413][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.064700][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.072011][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.079406][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.087388][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.094975][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.102116][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.109515][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.116837][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.145173][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.152391][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.160020][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.167061][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.175436][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.182505][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.190730][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.197782][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.214292][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.221347][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.229232][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.236331][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.254276][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.261334][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.268985][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.276116][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.304442][ T296] veth0_vlan: entered promiscuous mode [ 21.312120][ T295] veth0_vlan: entered promiscuous mode [ 21.333169][ T295] veth1_macvtap: entered promiscuous mode [ 21.342976][ T296] veth1_macvtap: entered promiscuous mode [ 21.359409][ T294] veth0_vlan: entered promiscuous mode [ 21.375075][ T293] veth0_vlan: entered promiscuous mode [ 21.385287][ T294] veth1_macvtap: entered promiscuous mode [ 21.419297][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 21.434098][ T293] veth1_macvtap: entered promiscuous mode [ 21.536991][ T325] af_packet: tpacket_rcv: packet too big, clamped from 42 to 4294967286. macoff=82 [ 21.609945][ T334] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 21.773779][ T31] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 21.793648][ T311] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 21.924588][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 48, changing to 9 [ 21.935785][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24624, setting to 1024 [ 21.947040][ T31] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 21.953292][ T311] usb 4-1: Using ep0 maxpacket: 32 [ 21.960095][ T31] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 21.967421][ T311] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 21.974521][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 21.986106][ T311] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 21.995014][ T31] usb 2-1: config 0 descriptor?? [ 22.008241][ T311] usb 4-1: New USB device found, idVendor=046d, idProduct=c219, bcdDevice= 0.00 [ 22.020303][ T311] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 22.029785][ T311] usb 4-1: config 0 descriptor?? [ 22.033325][ T65] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 22.183301][ T65] usb 1-1: Using ep0 maxpacket: 16 [ 22.190032][ T65] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 22.198408][ T65] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 22.208555][ T65] usb 1-1: config 0 has no interface number 0 [ 22.216192][ T65] usb 1-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28 [ 22.225288][ T65] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 22.234076][ T65] usb 1-1: Product: syz [ 22.238255][ T65] usb 1-1: Manufacturer: syz [ 22.242842][ T65] usb 1-1: SerialNumber: syz [ 22.248242][ T65] usb 1-1: config 0 descriptor?? [ 22.254263][ T65] usb 1-1: Found UVC 0.00 device syz (046d:08d3) [ 22.260693][ T65] usb 1-1: No valid video chain found. [ 22.437396][ T319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 22.456007][ T319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 22.471094][ T10] usb 1-1: USB disconnect, device number 2 [ 22.488359][ T311] logitech 0003:046D:C219.0001: ignoring exceeding usage max [ 22.497138][ T311] logitech 0003:046D:C219.0001: unknown main item tag 0x2 [ 22.506239][ T311] logitech 0003:046D:C219.0001: hidraw0: USB HID v0.b3 Device [HID 046d:c219] on usb-dummy_hcd.3-1/input0 [ 22.517312][ T31] usbhid 2-1:0.0: can't add hid device: -71 [ 22.518264][ T311] logitech 0003:046D:C219.0001: no inputs found [ 22.524681][ T31] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 22.542218][ T31] usb 2-1: USB disconnect, device number 2 [ 22.694332][ T10] usb 4-1: USB disconnect, device number 2 [ 22.713391][ T9] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 22.864802][ T9] usb 3-1: config 0 has an invalid interface number: 231 but max is 0 [ 22.873091][ T9] usb 3-1: config 0 has no interface number 0 [ 22.879368][ T9] usb 3-1: config 0 interface 231 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 22.890460][ T9] usb 3-1: config 0 interface 231 altsetting 0 endpoint 0x82 has invalid maxpacket 37384, setting to 64 [ 22.903890][ T9] usb 3-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 22.913026][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 22.921069][ T9] usb 3-1: Product: syz [ 22.925312][ T9] usb 3-1: Manufacturer: syz [ 22.929905][ T9] usb 3-1: SerialNumber: syz [ 22.935326][ T9] usb 3-1: config 0 descriptor?? [ 22.940589][ T346] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 22.947993][ T346] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 22.958079][ T9] plusb 3-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.2-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, 06:b7:3f:36:74:51 [ 23.176615][ T449] Zero length message leads to an empty skb [ 23.253346][ T455] netlink: 184 bytes leftover after parsing attributes in process `syz.1.21'. [ 23.274936][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 23.358356][ T31] usb 3-1: USB disconnect, device number 2 [ 23.368045][ T31] plusb 3-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.2-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 23.433349][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 23.444145][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 23.463576][ T10] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 23.471168][ T9] usb 1-1: config 0 has no interfaces? [ 23.483894][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 23.506894][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.523661][ T9] usb 1-1: config 0 descriptor?? [ 23.635103][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 23.651760][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 23.673049][ T10] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 23.682872][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.697739][ T10] usb 4-1: Product: syz [ 23.701950][ T10] usb 4-1: Manufacturer: syz [ 23.711415][ T10] usb 4-1: SerialNumber: syz [ 23.735821][ T365] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 23.762945][ T365] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 23.865601][ T365] SELinux: failed to load policy [ 23.898768][ T31] usb 1-1: USB disconnect, device number 3 [ 23.922165][ T451] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19'. [ 24.343317][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 24.344672][ T537] netlink: 'syz.0.30': attribute type 4 has an invalid length. [ 24.377242][ T537] netlink: 'syz.0.30': attribute type 32 has an invalid length. [ 24.523307][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 24.529757][ T9] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 24.541284][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 24.555274][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c219, bcdDevice= 0.00 [ 24.564813][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.574994][ T9] usb 3-1: config 0 descriptor?? [ 24.693360][ T31] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 24.844446][ T31] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 24.855379][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 24.866281][ T31] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 24.879281][ T31] usb 1-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 24.893308][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.907156][ T31] usb 1-1: config 0 descriptor?? [ 24.912500][ T539] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 24.985304][ T528] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 24.994033][ T528] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.003655][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 25.011205][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 25.021464][ T9] usb 3-1: USB disconnect, device number 3 [ 25.033352][ T540] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 25.072287][ T36] kauditd_printk_skb: 96 callbacks suppressed [ 25.072303][ T36] audit: type=1400 audit(1780200200.289:170): avc: denied { read } for pid=555 comm="poweroff" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 25.195559][ T540] usb 2-1: unable to get BOS descriptor or descriptor too short [ 25.205372][ T540] usb 2-1: config 103 has an invalid interface number: 130 but max is 0 [ 25.219468][ T540] usb 2-1: config 103 has no interface number 0 [ 25.227111][ T540] usb 2-1: config 103 interface 130 has no altsetting 0 [ 25.237990][ T540] usb 2-1: New USB device found, idVendor=1bcf, idProduct=0b40, bcdDevice=4a.bf [ 25.249746][ T540] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.261036][ T540] usb 2-1: Product: syz [ 25.265961][ T540] usb 2-1: Manufacturer: syz [ 25.271989][ T540] usb 2-1: SerialNumber: syz [ 25.327609][ T539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.338862][ T539] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.351206][ T539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.362949][ T539] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.375240][ T31] hid-multitouch 0003:1FD2:6007.0002: ignoring exceeding usage max [ 25.387134][ T31] hid-multitouch 0003:1FD2:6007.0002: unknown main item tag 0x2 [ 25.399353][ T31] hid-multitouch 0003:1FD2:6007.0002: hidraw0: USB HID v0.05 Device [HID 1fd2:6007] on usb-dummy_hcd.0-1/input0 [ 25.486496][ T540] usb 2-1: Found UVC 0.00 device syz (1bcf:0b40) [ 25.503410][ T540] usb 2-1: Forcing UVC version to 1.0a Stopping sshd: [ 25.512716][ T540] usb 2-1: No valid video chain found. stopped /usr/sbin/sshd (pid 203) OK [ 25.540598][ T540] usb 2-1: USB disconnect, device number 3 Stopping crond: stopped /usr/sbi[ 25.578093][ T31] usb 1-1: USB disconnect, device number 4 n/crond (pid 194) OK [ 25.624215][ T36] audit: type=1400 audit(1780200200.849:171): avc: denied { create } for pid=572 comm="syz.2.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 25.645705][ T36] audit: type=1400 audit(1780200200.849:172): avc: denied { write } for pid=572 comm="syz.2.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 Stopping dhcpcd... stopped /sbin/dhcpcd (pid 148) [ 25.707637][ T36] audit: type=1400 audit(1780200200.929:173): avc: denied { search } for pid=578 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping network: [ 25.812546][ T36] audit: type=1400 audit(1780200201.029:174): avc: denied { write } for pid=149 comm="dhcpcd" name="dhcpcd" dev="tmpfs" ino=421 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 25.837466][ T36] audit: type=1400 audit(1780200201.029:175): avc: denied { remove_name } for pid=149 comm="dhcpcd" name="sock" dev="tmpfs" ino=423 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 25.863947][ T36] audit: type=1400 audit(1780200201.029:176): avc: denied { unlink } for pid=149 comm="dhcpcd" name="sock" dev="tmpfs" ino=423 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=sock_file permissive=1 OK Stopping iptables: [ 25.913122][ T36] audit: type=1400 audit(1780200201.129:177): avc: denied { search } for pid=592 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 OK [ 25.935482][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 25.943340][ T36] audit: type=1400 audit(1780200201.129:178): avc: denied { write } for pid=592 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping system [ 25.966391][ T36] audit: type=1400 audit(1780200201.129:179): avc: denied { add_name } for pid=592 comm="iptables" name="xtables.lock" scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 message bus: done [ 26.134769][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.151573][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.162265][ T9] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 26.171742][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.182605][ T9] usb 3-1: config 0 descriptor?? [ 26.229837][ T10] usb 4-1: 1:1 : bogus bTerminalLink 3 Stopping klogd: [ 26.243078][ T10] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 26.265277][ T10] usb 4-1: USB disconnect, device number 3 OK [ 26.283665][ T352] usb 2-1: new full-speed USB device number 4 using dummy_hcd Stopping acpid: [ 26.423344][ T31] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 26.444349][ T352] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 26.456065][ T352] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 26.467197][ T352] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 26.480546][ T352] usb 2-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 26.489699][ T352] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.498389][ T352] usb 2-1: config 0 descriptor?? [ 26.503786][ T600] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 26.593356][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 26.594842][ T9] hid-led 0003:27B8:01ED.0003: collection stack underflow [ 26.600882][ T31] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 26.607044][ T9] hid-led 0003:27B8:01ED.0003: item 0 4 0 12 parsing failed [ 26.618068][ T31] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 26.625685][ T9] hid-led 0003:27B8:01ED.0003: probe with driver hid-led failed with error -22 [ 26.639435][ T31] usb 1-1: New USB device found, idVendor=046d, idProduct=c219, bcdDevice= 0.00 [ 26.648017][ T10] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 26.657159][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.673911][ T31] usb 1-1: config 0 descriptor?? [ 26.793648][ T10] usb 4-1: device descriptor read/64, error -71 [ 26.912740][ T600] raw_sendmsg: syz.1.41 forgot to set AF_INET. Fix it! [ 26.921330][ T352] hid-multitouch 0003:1FD2:6007.0004: ignoring exceeding usage max [ 26.930190][ T352] hid-multitouch 0003:1FD2:6007.0004: unknown main item tag 0x2 [ 26.938654][ T352] hid-multitouch 0003:1FD2:6007.0004: hidraw0: USB HID v0.05 Device [HID 1fd2:6007] on usb-dummy_hcd.1-1/input0 [ 27.033652][ T10] usb 4-1: device descriptor read/64, error -71 [ 27.080840][ T611] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.089468][ T611] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.098480][ T31] usbhid 1-1:0.0: can't add hid device: -71 [ 27.104574][ T31] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 27.114763][ T31] usb 1-1: USB disconnect, device number 5 [ 27.125524][ T352] usb 2-1: USB disconnect, device number 4 [ 27.274061][ T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd OK Stopping syslogd: stopped /sbin/syslogd (pid 92) OK [ 27.403344][ T10] usb 4-1: device descriptor read/64, error -71 umount: can't remount debugfs read-only Connection to 10.128.0.96 closed by remote host. umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! Sent SIGTERM to all processes [ 27.510093][ T352] usb 3-1: USB disconnect, device number 4 [ 27.657245][ T395] bridge_slave_1: left allmulticast mode [ 27.662928][ T395] bridge_slave_1: left promiscuous mode [ 27.669030][ T395] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.676935][ T395] bridge_slave_0: left allmulticast mode [ 27.682605][ T395] bridge_slave_0: left promiscuous mode [ 27.688382][ T395] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.796013][ T395] veth1_macvtap: left promiscuous mode [ 27.801612][ T395] veth0_vlan: left promiscuous mode [ 27.996718][ T395] bridge_slave_1: left allmulticast mode [ 28.002487][ T395] bridge_slave_1: left promiscuous mode [ 28.008131][ T395] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.015625][ T395] bridge_slave_0: left allmulticast mode [ 28.021327][ T395] bridge_slave_0: left promiscuous mode [ 28.027007][ T395] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.034781][ T395] bridge_slave_1: left allmulticast mode [ 28.040415][ T395] bridge_slave_1: left promiscuous mode [ 28.046051][ T395] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.053782][ T395] bridge_slave_0: left allmulticast mode [ 28.059591][ T395] bridge_slave_0: left promiscuous mode [ 28.065256][ T395] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.072944][ T395] bridge_slave_1: left allmulticast mode [ 28.078668][ T395] bridge_slave_1: left promiscuous mode [ 28.084374][ T395] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.092001][ T395] bridge_slave_0: left allmulticast mode [ 28.097737][ T395] bridge_slave_0: left promiscuous mode [ 28.103397][ T395] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.347448][ T395] veth1_macvtap: left promiscuous mode [ 28.352979][ T395] veth0_vlan: left promiscuous mode [ 28.358693][ T395] veth1_macvtap: left promiscuous mode [ 28.364315][ T395] veth0_vlan: left promiscuous mode [ 28.369805][ T395] veth1_macvtap: left promiscuous mode [ 28.375298][ T395] veth0_vlan: left promiscuous mode Sent SIGKILL to all processes Requesting system poweroff [ 29.751687][ T634] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 29.758467][ T634] ACPI: PM: Preparing to enter system sleep state S5 [ 29.765352][ T634] kvm: exiting hardware virtualization [ 29.770844][ T634] reboot: Power down serialport: VM disconnected.