last executing test programs: 59.041340304s ago: executing program 1 (id=286): r0 = syz_open_dev$video4linux(&(0x7f0000002ac0), 0xeb74, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000002b00)={0x0, 0x0, {0xa, 0x0, 0x1011, 0x3, 0xc, 0x0, 0x0, 0x5}}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="b8000000000100e000000200100000000000000000000000000000000000000000000000400000000000104e2400000a00200062000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0700000000000000100000000000000002000000010000000000000000000000ff0f00000000000073b4ffffffffffffffffffffffffffff0000000000000000000000001000000003000000000000200200000000000000fffffffffffffffffeffffff000000000000000300000000"], 0xb8}}, 0x4004) sendmsg$nl_xfrm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}, 0x0, 0x6e6bc0}}, 0xb8}}, 0x2c000010) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000080)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000540), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304, 0x37}, "475566172f45f011", "bd1406000f000000000092f94413582b", "0100", "00000000ffffffff"}, 0x28) ioctl$SIOCX25CALLACCPTAPPRV(r2, 0x89e8) r4 = syz_open_dev$MSR(&(0x7f0000002d40), 0x3, 0x0) preadv(r4, &(0x7f0000000000), 0x0, 0x5, 0xc) r5 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r5, 0x8982, &(0x7f0000000000)={0x8, 'bond_slave_0\x00', {'macvlan0\x00'}}) 58.956530357s ago: executing program 1 (id=290): r0 = syz_io_uring_setup(0xefd, &(0x7f0000000400)={0x0, 0x80b2, 0x110101, 0x3, 0x55}, &(0x7f0000000100), &(0x7f0000000240), &(0x7f0000000080)) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) io_uring_enter(r0, 0x1, 0xfffffffd, 0x9, 0x0, 0x0) 58.952274515s ago: executing program 1 (id=291): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_load_code={0x12e, 0x19, {0x0, "f4"}}], 0x31}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f00000005c0)="0f1cbe0000ba6100b05eee440f20c066350900000044070722c0b838000f00d8ba400066b80000000066eff4d09800000f4da2ee005df2ab", 0x38}], 0x1, 0x15, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x101fd, 0x5, 0x100000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf7}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x8, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x5}) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 2) 58.700257615s ago: executing program 1 (id=300): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) (async) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x1000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @flat=@weak_binder={0x77622a85, 0x1, 0x2}}, 0x0}}], 0x0, 0x0, 0x0}) (async) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f00000034c0)={0x2020}, 0xcac) (async) sched_setscheduler(0x0, 0x1, 0x0) (async) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='hugetlbfs\x00', 0x16, 0x0) (async) chdir(&(0x7f0000000000)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000001fc0), r5) sendmsg$NFC_CMD_START_POLL(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x24, r6, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x80}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008081}, 0x20000004) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x2a) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)={0x64, 0x19, 0x1, 0x0, 0x25dfdbfb, {0x1d, 0xd601, 0x9}, [@nested={0x50, 0x12, 0x0, 0x1, [@nested={0x49, 0xe1, 0x0, 0x1, [@generic="9e1b73d1fa90f57f0c5dfbe64c0cbb59b43d4d13905a9670479f21c67da9eb32a7ac03bf90d9c3f733a58daf7f832f6db521e0f6ba90beb3973c2e335ecb2b37b1f82b2e06"]}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x800, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) 58.62914723s ago: executing program 1 (id=303): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='sysfs\x00', &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:03.0/resource4\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x0) r1 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$peekuser(0x3, r1, 0x350) ioctl$sock_x25_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={@remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x3}, 0x0, 'bond_slave_1\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000000)='./my_tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_tracefs\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_tracefs/trace\x00', 0x1, 0x0) ioctl$XFS_IOC_GET_RESBLKS(r3, 0x80105873, &(0x7f0000000040)) write(r3, &(0x7f0000000400)='wip\x00', 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000003540)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff) (async) mount(&(0x7f0000000000)=@filename='sysfs\x00', &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:03.0/resource4\x00', 0x2, 0x0) (async) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x0) (async) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ptrace(0x10, r1) (async) ptrace$peekuser(0x3, r1, 0x350) (async) ioctl$sock_x25_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={@remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x3}, 0x0, 'bond_slave_1\x00'}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) mkdir(&(0x7f0000000000)='./my_tracefs\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000100)='./my_tracefs\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_tracefs/trace\x00', 0x1, 0x0) (async) ioctl$XFS_IOC_GET_RESBLKS(r3, 0x80105873, &(0x7f0000000040)) (async) write(r3, &(0x7f0000000400)='wip\x00', 0x4) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000003540)={'wlan0\x00'}) (async) 58.236058159s ago: executing program 0 (id=310): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r1, 0x11, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r4 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r3, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000440)={r4, r2, 0x4, r1}, 0x10) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) mount$fuseblk(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', &(0x7f0000000080), 0x488, &(0x7f0000000140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xc000}}) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) umount2(&(0x7f0000000040)='./file0\x00', 0x5) recvmmsg(r5, &(0x7f0000000040), 0x0, 0x40000040, &(0x7f00000000c0)) 58.109931263s ago: executing program 0 (id=313): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x28, r1, 0x7, 0x0, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @ETHTOOL_A_LINKMODES_LANES={0x8, 0x9, 0x3}]}, 0x28}}, 0x4000004) 58.109123818s ago: executing program 0 (id=314): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) r2 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/oss_mixer\x00', 0x80, 0x0) dup3(r2, r1, 0x0) sendto$inet6(r0, &(0x7f0000000080)='\x00', 0x1, 0x8081, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x4}, 0x1c) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) recvmmsg(r0, &(0x7f0000001b80)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x10140, 0x0) r3 = syz_io_uring_complete(0x0, 0x0) bpf$LINK_DETACH(0x22, &(0x7f0000000100)=r3, 0x4) prlimit64(0x0, 0x2, &(0x7f0000000000)={0x0, 0x800}, 0x0) setrlimit(0x8, &(0x7f0000000040)={0x73344c31, 0x9}) shmctl$SHM_STAT_ANY(0xffffffffffffffff, 0xf, 0x0) shmget$private(0x0, 0x4000, 0x54000000, &(0x7f0000ffc000/0x4000)=nil) shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x4000) shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x1000) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x1, 0x2) r4 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x3) mlock2(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x0) 58.038642638s ago: executing program 0 (id=316): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005c48, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_tcp(0x2, 0x1, 0x0) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000001500)=@raw={'raw\x00', 0x8, 0x3, 0xb30, 0x0, 0x43, 0xa0, 0x0, 0x98, 0xa98, 0x178, 0x178, 0xa98, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1a0, 0x1e8, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x3, {0x100010001}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x1346, 0x7fff, 0x0, '\x00', {0x7ff}}}}, {{@uncond, 0x0, 0x888, 0x8b0, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@unspec=@u32={{0x7e0}, {[{[{0x9}, {0x3}, {0x1, 0x1}, {0x0, 0x3}, {0x4, 0x2}, {0xb1d}, {0x3}, {0x8}, {0x2, 0x3}, {0x3}, {0x103}], [{0xe8f3, 0x5}, {0x1d, 0x6}, {0x4, 0x8}, {0x0, 0x4}, {0x4, 0xc3e}, {0x1, 0x100}, {0x6, 0x7}, {0x3, 0x3}, {0xf2, 0x3}, {0x3ff, 0x7}, {0x10, 0x3}], 0x6, 0x6}, {[{0x80, 0x3}, {0x2}, {0x6, 0x1}, {0x355cbac3, 0x2}, {0x0, 0x2}, {0x0, 0x2}, {0x7}, {0xe7, 0x2}, {0x3, 0x3}, {0x5598e8fe, 0x2}, {0x6, 0x1}], [{0x9, 0x9097}, {0x7, 0x9}, {0x7, 0xa}, {0x6, 0x8}, {0x20080, 0x5}, {0x13, 0xc0000000}, {0x40, 0x8}, {0x9, 0x6}, {0x4, 0x2}, {0x6, 0x7fffffff}, {0x7fffffff, 0x400}], 0x7}, {[{0x84, 0x2}, {}, {0x0, 0x2}, {0xffffffff, 0x1}, {}, {0x7, 0x1}, {0x5, 0x2}, {0x8, 0x3}, {0x2, 0x3}, {0x8, 0x1}, {0x7, 0x1}], [{0x9, 0x5}, {0x80, 0x32}, {0x0, 0xfffffff7}, {0xff, 0x1}, {0x7, 0x6}, {0xdb9, 0xff4}, {0x6, 0x3ff}, {0x3, 0x6}, {0x5, 0x10}, {0x9, 0x6}, {0x10000, 0x2}], 0x4, 0xa}, {[{0x3, 0x2}, {0xa, 0x1}, {0x6, 0x1}, {0x10, 0x3}, {0x2, 0x2}, {0x2, 0x2}, {0x3, 0x1}, {0x2, 0x3}, {0x3, 0x1}, {0x2, 0x2}, {0x477d, 0x1}], [{0x4, 0xffffffff}, {0x200, 0x6}, {0x4be1, 0x4044}, {0x1}, {0x5, 0xc}, {0x3, 0x4}, {0x2, 0x4}, {0x800, 0x8000}, {0x8, 0x800}, {0x7, 0x2}, {0xe, 0x8000}], 0x4, 0xb}, {[{0x7, 0x3}, {0xd, 0x3}, {0x5}, {0x61}, {0x9}, {}, {0x2}, {0x1}, {0x0, 0x2}, {0x9, 0x3}, {0x5, 0x3}], [{0x58d, 0x3ff}, {0x0, 0x7f}, {0x6}, {0xfc9b, 0x80000001}, {0x101, 0x7}, {0x7, 0x1}, {0x7, 0x8001}, {0x2, 0x1}, {0x2, 0x2}, {0x9, 0x3}, {0x7, 0x10000}], 0x1}, {[{0x2}, {0x9}, {0x8, 0x1}, {0x2, 0x3}, {0x71, 0x3}, {0x0, 0x2}, {0xe, 0x2}, {0x6, 0x2}, {0x5}, {0x3000000, 0x3}, {0x6, 0x1}], [{0x9, 0x3}, {0x5, 0x7fffffff}, {0xffff, 0x4}, {0x0, 0x7}, {0x8, 0xb502}, {0x1ff, 0x86}, {0x6, 0xffffffff}, {0x3, 0x4}, {0x5, 0x6}, {0xf, 0xf93}, {0x5, 0x4}], 0x3, 0x3}, {[{0x7, 0x1}, {0x3, 0x1}, {0x45d7}, {0xfff, 0x3}, {0xc4f, 0x3}, {0x0, 0x2}, {0x400, 0x1}, {0x2, 0x1}, {0x4, 0x2}, {0xfffffffd}, {0x2}], [{0x3, 0x6}, {0xed, 0xd}, {0x80, 0xb81d}, {0x2ca, 0x80000000}, {0x8, 0xff}, {0x7, 0xc8}, {0x8, 0x6}, {0x4, 0x1}, {0x2, 0x6}, {0xfc, 0x6}, {0xd, 0x138c}], 0x6}, {[{0x4, 0x1}, {0x800}, {0x9, 0x2}, {0xf0000000, 0x2}, {0x6, 0x3}, {0x3, 0x2}, {0x8, 0x2}, {}, {0x9}, {0x400, 0x2}, {0x8, 0x3}], [{0x7, 0xfffffffd}, {0x2}, {0x2, 0x2}, {0x8f, 0x6}, {0x7, 0x5}, {0x8, 0x7}, {0xb, 0x82c6}, {0xb1b}, {0xbd5c, 0xffff}, {0x1, 0x9b8d}, {0xec, 0x5}], 0x2, 0x6}, {[{0x8}, {0x0, 0x1}, {0xac000000}, {0x6, 0x2}, {0x2d8, 0x3}, {0x7e3ea4bc}, {0x8, 0x1}, {0x4f, 0x3}, {0x4, 0x2}, {0xfffffff7}, {0x3, 0x2}], [{0x5, 0x42}, {0x76a74689, 0x4}, {0x1}, {0x8000, 0x7}, {0x400, 0xdd}, {0xfff, 0x8}, {0x76b, 0xfffffffe}, {0xa6d00, 0xfffffff7}, {0x10001, 0xfc8d}, {0x0, 0x10001}, {0x4, 0x3}], 0x1, 0x9}, {[{0x8, 0x1}, {0x3, 0x3}, {0x18, 0x3}, {0x3ff, 0x3}, {0x7fffffff}, {0x8, 0x2}, {0x1}, {0x8, 0x3}, {0xf1b6}, {0x80, 0x3}, {0x4, 0x2}], [{0x2, 0x4}, {0x3, 0xf}, {0x9, 0x6}, {0x7f, 0x8}, {0xffffffff, 0x273e1899}, {0x4, 0x1}, {0x6, 0x3}, {0x1, 0xb7}, {0x8, 0x3}, {0x3, 0x1}, {0x7ff, 0x63}], 0xb, 0x3}, {[{0x1, 0x2}, {0x6, 0x3}, {0xffff, 0x1}, {0x1}, {0x4, 0x3}, {0x4, 0x3}, {0xaa7}, {0x100, 0x3}, {0x2}, {0xfffffff7, 0xb90af65875a5dc08}, {0x4, 0x3}], [{0x3}, {0x8001, 0x7}, {0x10000, 0x7524}, {0x73d, 0x4}, {0x0, 0x280000}, {0x3, 0x3af}, {0x5, 0x2}, {0x101, 0xbf}, {0x10000, 0x6}, {0x3, 0x800}], 0x8, 0x5}], 0x3}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x8}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0xb90) (async) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000001500)=@raw={'raw\x00', 0x8, 0x3, 0xb30, 0x0, 0x43, 0xa0, 0x0, 0x98, 0xa98, 0x178, 0x178, 0xa98, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1a0, 0x1e8, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x3, {0x100010001}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x1346, 0x7fff, 0x0, '\x00', {0x7ff}}}}, {{@uncond, 0x0, 0x888, 0x8b0, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@unspec=@u32={{0x7e0}, {[{[{0x9}, {0x3}, {0x1, 0x1}, {0x0, 0x3}, {0x4, 0x2}, {0xb1d}, {0x3}, {0x8}, {0x2, 0x3}, {0x3}, {0x103}], [{0xe8f3, 0x5}, {0x1d, 0x6}, {0x4, 0x8}, {0x0, 0x4}, {0x4, 0xc3e}, {0x1, 0x100}, {0x6, 0x7}, {0x3, 0x3}, {0xf2, 0x3}, {0x3ff, 0x7}, {0x10, 0x3}], 0x6, 0x6}, {[{0x80, 0x3}, {0x2}, {0x6, 0x1}, {0x355cbac3, 0x2}, {0x0, 0x2}, {0x0, 0x2}, {0x7}, {0xe7, 0x2}, {0x3, 0x3}, {0x5598e8fe, 0x2}, {0x6, 0x1}], [{0x9, 0x9097}, {0x7, 0x9}, {0x7, 0xa}, {0x6, 0x8}, {0x20080, 0x5}, {0x13, 0xc0000000}, {0x40, 0x8}, {0x9, 0x6}, {0x4, 0x2}, {0x6, 0x7fffffff}, {0x7fffffff, 0x400}], 0x7}, {[{0x84, 0x2}, {}, {0x0, 0x2}, {0xffffffff, 0x1}, {}, {0x7, 0x1}, {0x5, 0x2}, {0x8, 0x3}, {0x2, 0x3}, {0x8, 0x1}, {0x7, 0x1}], [{0x9, 0x5}, {0x80, 0x32}, {0x0, 0xfffffff7}, {0xff, 0x1}, {0x7, 0x6}, {0xdb9, 0xff4}, {0x6, 0x3ff}, {0x3, 0x6}, {0x5, 0x10}, {0x9, 0x6}, {0x10000, 0x2}], 0x4, 0xa}, {[{0x3, 0x2}, {0xa, 0x1}, {0x6, 0x1}, {0x10, 0x3}, {0x2, 0x2}, {0x2, 0x2}, {0x3, 0x1}, {0x2, 0x3}, {0x3, 0x1}, {0x2, 0x2}, {0x477d, 0x1}], [{0x4, 0xffffffff}, {0x200, 0x6}, {0x4be1, 0x4044}, {0x1}, {0x5, 0xc}, {0x3, 0x4}, {0x2, 0x4}, {0x800, 0x8000}, {0x8, 0x800}, {0x7, 0x2}, {0xe, 0x8000}], 0x4, 0xb}, {[{0x7, 0x3}, {0xd, 0x3}, {0x5}, {0x61}, {0x9}, {}, {0x2}, {0x1}, {0x0, 0x2}, {0x9, 0x3}, {0x5, 0x3}], [{0x58d, 0x3ff}, {0x0, 0x7f}, {0x6}, {0xfc9b, 0x80000001}, {0x101, 0x7}, {0x7, 0x1}, {0x7, 0x8001}, {0x2, 0x1}, {0x2, 0x2}, {0x9, 0x3}, {0x7, 0x10000}], 0x1}, {[{0x2}, {0x9}, {0x8, 0x1}, {0x2, 0x3}, {0x71, 0x3}, {0x0, 0x2}, {0xe, 0x2}, {0x6, 0x2}, {0x5}, {0x3000000, 0x3}, {0x6, 0x1}], [{0x9, 0x3}, {0x5, 0x7fffffff}, {0xffff, 0x4}, {0x0, 0x7}, {0x8, 0xb502}, {0x1ff, 0x86}, {0x6, 0xffffffff}, {0x3, 0x4}, {0x5, 0x6}, {0xf, 0xf93}, {0x5, 0x4}], 0x3, 0x3}, {[{0x7, 0x1}, {0x3, 0x1}, {0x45d7}, {0xfff, 0x3}, {0xc4f, 0x3}, {0x0, 0x2}, {0x400, 0x1}, {0x2, 0x1}, {0x4, 0x2}, {0xfffffffd}, {0x2}], [{0x3, 0x6}, {0xed, 0xd}, {0x80, 0xb81d}, {0x2ca, 0x80000000}, {0x8, 0xff}, {0x7, 0xc8}, {0x8, 0x6}, {0x4, 0x1}, {0x2, 0x6}, {0xfc, 0x6}, {0xd, 0x138c}], 0x6}, {[{0x4, 0x1}, {0x800}, {0x9, 0x2}, {0xf0000000, 0x2}, {0x6, 0x3}, {0x3, 0x2}, {0x8, 0x2}, {}, {0x9}, {0x400, 0x2}, {0x8, 0x3}], [{0x7, 0xfffffffd}, {0x2}, {0x2, 0x2}, {0x8f, 0x6}, {0x7, 0x5}, {0x8, 0x7}, {0xb, 0x82c6}, {0xb1b}, {0xbd5c, 0xffff}, {0x1, 0x9b8d}, {0xec, 0x5}], 0x2, 0x6}, {[{0x8}, {0x0, 0x1}, {0xac000000}, {0x6, 0x2}, {0x2d8, 0x3}, {0x7e3ea4bc}, {0x8, 0x1}, {0x4f, 0x3}, {0x4, 0x2}, {0xfffffff7}, {0x3, 0x2}], [{0x5, 0x42}, {0x76a74689, 0x4}, {0x1}, {0x8000, 0x7}, {0x400, 0xdd}, {0xfff, 0x8}, {0x76b, 0xfffffffe}, {0xa6d00, 0xfffffff7}, {0x10001, 0xfc8d}, {0x0, 0x10001}, {0x4, 0x3}], 0x1, 0x9}, {[{0x8, 0x1}, {0x3, 0x3}, {0x18, 0x3}, {0x3ff, 0x3}, {0x7fffffff}, {0x8, 0x2}, {0x1}, {0x8, 0x3}, {0xf1b6}, {0x80, 0x3}, {0x4, 0x2}], [{0x2, 0x4}, {0x3, 0xf}, {0x9, 0x6}, {0x7f, 0x8}, {0xffffffff, 0x273e1899}, {0x4, 0x1}, {0x6, 0x3}, {0x1, 0xb7}, {0x8, 0x3}, {0x3, 0x1}, {0x7ff, 0x63}], 0xb, 0x3}, {[{0x1, 0x2}, {0x6, 0x3}, {0xffff, 0x1}, {0x1}, {0x4, 0x3}, {0x4, 0x3}, {0xaa7}, {0x100, 0x3}, {0x2}, {0xfffffff7, 0xb90af65875a5dc08}, {0x4, 0x3}], [{0x3}, {0x8001, 0x7}, {0x10000, 0x7524}, {0x73d, 0x4}, {0x0, 0x280000}, {0x3, 0x3af}, {0x5, 0x2}, {0x101, 0xbf}, {0x10000, 0x6}, {0x3, 0x800}], 0x8, 0x5}], 0x3}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x8}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0xb90) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x3}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x2b}, 0x1, 0x0, 0x0, 0x80}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000020000000000000001000079100000000000007a00e0ff0000000095"], &(0x7f0000000100)='GPL\x00', 0x2}, 0x94) r3 = socket$alg(0x26, 0x5, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) (async) ioctl$int_in(r4, 0x40000000af01, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40102, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000080)={0x1, 0x1, 0x0, &(0x7f0000001600)=""/107, 0x0, 0x3332f000}) (async) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000080)={0x1, 0x1, 0x0, &(0x7f0000001600)=""/107, 0x0, 0x3332f000}) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000000)) r6 = dup(r5) ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f0000000040)={0x1, r6}) bind$alg(r3, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r7 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@assoc={0x18, 0x117, 0x4, 0x10}, @op={0x18}], 0x30, 0x40040}], 0x1, 0x8040) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r7) r8 = syz_usb_connect$sierra_net(0x1, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0xf, 0x2, 0x7ff, 0x9, 0x3, 0x66}, {0x9, 0x5, 0xa, 0x2, 0x40, 0x4, 0x5, 0x4}, {0x9, 0x5, 0x7, 0x3, 0x40, 0x8, 0x0, 0x7f}}}}}}]}}, 0x0) syz_usb_disconnect(r8) (async) syz_usb_disconnect(r8) 57.821232911s ago: executing program 1 (id=321): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000080)={0x2, r0, 'id1\x00'}) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r0, 0x118, 0x1, 0x0, 0xfffffe17) r2 = socket$netlink(0x10, 0x3, 0x7) r3 = socket$inet(0x2, 0x2, 0x7) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'dummy0\x00'}) sendmsg$netlink(r2, &(0x7f0000000040)={&(0x7f0000000200)=@kern={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000640)=[{&(0x7f0000000680)=ANY=[@ANYBLOB="c4030000370000042cbd7000fddbdf252d7422688d3fe5cd41013d80ea61f9ec50bb16ae12f27bf8f65450ae88f35f7723bdd00e871e7aee2a221a8f5629676d3ed34de281800f5c25bcfedb99088d1ef8e7bf967d13097c8b0d0b52ad2b826cf60d9de469a50ec6b5e48bf7f4e7199126b693f85513d4a7a7f0f93431be3729573a45c5d23bce8f29ab98812d451cf5015f047f594a2fa71c2e5ee9dff1df4d9d70c85cd1d8c8c385f161f9519330cb0e182b406befd5ede24525604c3388d19d67ace8437b29dbc181b14601fdea655513e01b6b643340581b9be2e16819575a3bfb4282f65bc848e1a59a872452ea3a67a5d9ba3c8bda5a91813ae002bc90a01f346088afffb7515bc91235c3f14ba2135ff69af610ddaede67624f9baf3704a8f9c38824d4ed0d16cfe2d5a13de82523b4d816d9aabc7e0daebcb1ff6d56ddcfd233f0ffb787a09c50598b777f491bcacfa26314f945f5000000e5af55d1fac39e7f5c225796fc2b94283c870adcfa704bde60f9362973830bd05589acbc17c7aad42a05810f6d2b5ba190fb34ab3fb00876276bd571488b3f5b2347a8b2e9960e8ff7480523d9d5cdb2f571cdbb920351338bb50b70000316a976104ba5c2bba7d6cecef9c6e41d99e912b3f1089078563e61d6e6acfcd180d52d5ea87f7e77639d2e143fd816b6dab1d2f1e11640d5a16d566ceb4b7d859c884bf3ee721b5ffe6ea4915d3208ec4b84e25f8403e6f437948fc015b89f1f565d6885457a10b1229f25589c09339924428cb155a777c7336e2b7fb57dbab6f1adcc1d5117b10791cd4d01c9a9fab34df72b9a1ea23435237067c01ae136a4e6d43459ab90891bae827ca39f30adc9f412ad5f39a40e19478350824de6abd74e7a85d5f1c59b8de9ed96a09640dbdfdca827ab42eac463812fe87dabffa984127c440765b12f75a319e1a574878fcfe26a965e17dc8148e7dc2a7f9c240126b9a9a2cc241f4d69aba00bff3b57dfafe5eebf97ba24efc08f30bcf3d846b07b2acb05d47ad6de6757547c7cb1afa17288b2799576d3773a26359d227b0376bef18c097a96c460fda524cef0c5e504a554f76c25dbaedea875e8da91bd001ef5333678d3e979bb68ccbd8106c0b5618ed520840ea8b06fbfa9d909b2a40767f41d97868659ddf20c9813082d03853a9ad38158b44a1d5a8691ed839d840c2dd8b845cbce4fbc6d38fa16e4cb3e4f68b271edd535830d921b2f166626238acfd0fa02529caf9b811a9a97a947a00497b8aeafdb17aafa7165ffd28873f42b48c44ee21ea81c5eb2fc8e7f467ca8ba58ae47725575cdf5003b393c70b300784733346af824ddb49be309ce276c7a2d514964a5134044457de6aa5e2c459636a038257a8709974ec4216d922ef66b08ec8aaff7b7965d88e57c1a10c94873bfc13dbad19fca6094205368f11e06fbd2c0dfd76c3b3fa7116625e886102cff45f4fd228d047c698a75f9743cf07b3ca465600b72861fb5e1ddb83012911a20ad9856242b833520cb1149606d90d71f6e81d472e98df5fe"], 0x3c4}], 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000100)={0x0, 0x4, 0x2, [0x4, 0x9]}, &(0x7f0000000140)=0xc) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000000180)={r4, 0x1, 0x5, [0x800, 0x8, 0xc1, 0x5, 0x5]}, &(0x7f00000001c0)=0x12) 54.99837696s ago: executing program 0 (id=336): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r2 = socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r1, &(0x7f00000003c0), &(0x7f0000000080)=@udp=r2, 0x1}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r3, r5, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x66, &(0x7f0000000880)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @broadcast, @void, {@mpls_uc={0x8847, {[], @ipv4=@gre={{0x5, 0x4, 0x1, 0x5, 0x58, 0x65, 0x0, 0x8, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x3, {{0x7, 0x1, 0x9, 0x0, 0x1, 0x2, 0x2, 0xb}, 0x1, {0x2}}}, {0x8, 0x22eb, 0x4, {{0x6, 0x2, 0x6, 0x3, 0x1, 0x1, 0x4, 0x2e}, 0x2, {0x5, 0x5, 0x3, 0x7, 0x1, 0x1, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0) 54.681719426s ago: executing program 0 (id=337): socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) (async) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) (async) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r2, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) (async) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r3, &(0x7f0000000a80)={'syz1\x00', {0x5, 0x1, 0x0, 0x1000}, 0x0, [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1000000, 0x4001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0xffffffff, 0x80000001, 0xd127, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x816, 0x8, 0x0, 0xfffffffc, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x5, 0x0, 0x2000, 0x521, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0xfffffffd, 0x1001f, 0x3, 0x4, 0x0, 0x4, 0x0, 0x42ac, 0x10, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xe43, 0x0, 0xfffffffd, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x2, 0x4], [0xfffffffe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x400000, 0x0, 0x4, 0x0, 0x7c45, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x8, 0x0, 0x0, 0x1, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x81, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x526d, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0xfffffffe, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x1, 0xfffffffd, 0x0, 0x0, 0x0, 0xff, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffff7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x956, 0x0, 0x1]}, 0x45c) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r4, &(0x7f0000000440)=ANY=[@ANYBLOB="0000880a020100000800faff0700d06d6558d57daaaaaaaaaa148100000008"], 0x54) (async) ioctl$UI_SET_RELBIT(r3, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x2) (async) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x1) ioctl$UI_DEV_CREATE(r3, 0x5501) dup3(r5, 0xffffffffffffffff, 0x0) (async) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r7, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8481f0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 54.627812834s ago: executing program 32 (id=337): socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) (async) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) (async) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r2, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) (async) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r3, &(0x7f0000000a80)={'syz1\x00', {0x5, 0x1, 0x0, 0x1000}, 0x0, [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1000000, 0x4001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0xffffffff, 0x80000001, 0xd127, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x816, 0x8, 0x0, 0xfffffffc, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x5, 0x0, 0x2000, 0x521, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0xfffffffd, 0x1001f, 0x3, 0x4, 0x0, 0x4, 0x0, 0x42ac, 0x10, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xe43, 0x0, 0xfffffffd, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x2, 0x4], [0xfffffffe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x400000, 0x0, 0x4, 0x0, 0x7c45, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x8, 0x0, 0x0, 0x1, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x81, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x526d, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0xfffffffe, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x1, 0xfffffffd, 0x0, 0x0, 0x0, 0xff, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffff7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x956, 0x0, 0x1]}, 0x45c) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r4, &(0x7f0000000440)=ANY=[@ANYBLOB="0000880a020100000800faff0700d06d6558d57daaaaaaaaaa148100000008"], 0x54) (async) ioctl$UI_SET_RELBIT(r3, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x2) (async) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x1) ioctl$UI_DEV_CREATE(r3, 0x5501) dup3(r5, 0xffffffffffffffff, 0x0) (async) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r7, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8481f0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 42.732310353s ago: executing program 33 (id=321): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000080)={0x2, r0, 'id1\x00'}) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r0, 0x118, 0x1, 0x0, 0xfffffe17) r2 = socket$netlink(0x10, 0x3, 0x7) r3 = socket$inet(0x2, 0x2, 0x7) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'dummy0\x00'}) sendmsg$netlink(r2, &(0x7f0000000040)={&(0x7f0000000200)=@kern={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000640)=[{&(0x7f0000000680)=ANY=[@ANYBLOB="c4030000370000042cbd7000fddbdf252d7422688d3fe5cd41013d80ea61f9ec50bb16ae12f27bf8f65450ae88f35f7723bdd00e871e7aee2a221a8f5629676d3ed34de281800f5c25bcfedb99088d1ef8e7bf967d13097c8b0d0b52ad2b826cf60d9de469a50ec6b5e48bf7f4e7199126b693f85513d4a7a7f0f93431be3729573a45c5d23bce8f29ab98812d451cf5015f047f594a2fa71c2e5ee9dff1df4d9d70c85cd1d8c8c385f161f9519330cb0e182b406befd5ede24525604c3388d19d67ace8437b29dbc181b14601fdea655513e01b6b643340581b9be2e16819575a3bfb4282f65bc848e1a59a872452ea3a67a5d9ba3c8bda5a91813ae002bc90a01f346088afffb7515bc91235c3f14ba2135ff69af610ddaede67624f9baf3704a8f9c38824d4ed0d16cfe2d5a13de82523b4d816d9aabc7e0daebcb1ff6d56ddcfd233f0ffb787a09c50598b777f491bcacfa26314f945f5000000e5af55d1fac39e7f5c225796fc2b94283c870adcfa704bde60f9362973830bd05589acbc17c7aad42a05810f6d2b5ba190fb34ab3fb00876276bd571488b3f5b2347a8b2e9960e8ff7480523d9d5cdb2f571cdbb920351338bb50b70000316a976104ba5c2bba7d6cecef9c6e41d99e912b3f1089078563e61d6e6acfcd180d52d5ea87f7e77639d2e143fd816b6dab1d2f1e11640d5a16d566ceb4b7d859c884bf3ee721b5ffe6ea4915d3208ec4b84e25f8403e6f437948fc015b89f1f565d6885457a10b1229f25589c09339924428cb155a777c7336e2b7fb57dbab6f1adcc1d5117b10791cd4d01c9a9fab34df72b9a1ea23435237067c01ae136a4e6d43459ab90891bae827ca39f30adc9f412ad5f39a40e19478350824de6abd74e7a85d5f1c59b8de9ed96a09640dbdfdca827ab42eac463812fe87dabffa984127c440765b12f75a319e1a574878fcfe26a965e17dc8148e7dc2a7f9c240126b9a9a2cc241f4d69aba00bff3b57dfafe5eebf97ba24efc08f30bcf3d846b07b2acb05d47ad6de6757547c7cb1afa17288b2799576d3773a26359d227b0376bef18c097a96c460fda524cef0c5e504a554f76c25dbaedea875e8da91bd001ef5333678d3e979bb68ccbd8106c0b5618ed520840ea8b06fbfa9d909b2a40767f41d97868659ddf20c9813082d03853a9ad38158b44a1d5a8691ed839d840c2dd8b845cbce4fbc6d38fa16e4cb3e4f68b271edd535830d921b2f166626238acfd0fa02529caf9b811a9a97a947a00497b8aeafdb17aafa7165ffd28873f42b48c44ee21ea81c5eb2fc8e7f467ca8ba58ae47725575cdf5003b393c70b300784733346af824ddb49be309ce276c7a2d514964a5134044457de6aa5e2c459636a038257a8709974ec4216d922ef66b08ec8aaff7b7965d88e57c1a10c94873bfc13dbad19fca6094205368f11e06fbd2c0dfd76c3b3fa7116625e886102cff45f4fd228d047c698a75f9743cf07b3ca465600b72861fb5e1ddb83012911a20ad9856242b833520cb1149606d90d71f6e81d472e98df5fe"], 0x3c4}], 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000100)={0x0, 0x4, 0x2, [0x4, 0x9]}, &(0x7f0000000140)=0xc) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000000180)={r4, 0x1, 0x5, [0x800, 0x8, 0xc1, 0x5, 0x5]}, &(0x7f00000001c0)=0x12) 28.83547779s ago: executing program 5 (id=687): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_flowlabel\x00') writev(r0, &(0x7f0000000640)=[{&(0x7f0000000080)='1', 0x1}, {&(0x7f00000000c0)="b19affc737ffda8c2c66f8aea03d3500def8a1efe35c4b50bd3913e26424f1bde912acdac5415cdd5c2147d5761353af603fff599fe17ef0ce67e596", 0x3c}], 0x2) 28.765219392s ago: executing program 5 (id=688): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000010000100000000000000e3000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x20000084) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000001c0), r0) r3 = openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_S_AUDOUT(r3, 0x40345632, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000100)=0x2, 0x4) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x8, @loopback, 0x7}, 0x1c) syz_open_dev$evdev(&(0x7f0000000040), 0x3214, 0x240080) syz_emit_ethernet(0x5a, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r5, 0x84, 0x74, &(0x7f0000000380)=""/199, &(0x7f0000000480)=0xc7) setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r5, 0x84, 0x21, &(0x7f0000000000), &(0x7f0000000140)=0x4) sendto$inet6(r4, &(0x7f0000000340)="a6", 0x1, 0x24004055, &(0x7f00000001c0)={0xa, 0x2, 0x200ffff, @loopback, 0x9}, 0x1c) 28.704180354s ago: executing program 5 (id=691): r0 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/crypto\x00', 0x0, 0x0) r2 = syz_io_uring_setup(0x6214, &(0x7f0000000540)={0x0, 0x469ea, 0xc00, 0x1, 0x12}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_FUTEX_WAKE={0x34, 0x40, 0x0, 0x8a, 0xece1, 0x0, 0x0, 0x0, 0x1, {0x0, 0x0, 0x0, 0x207e}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) read$FUSE(r1, &(0x7f0000000200)={0x2020}, 0x2020) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', &(0x7f0000000180)='devtmpfs\x00', 0x2200892, 0x0) lseek(r0, 0x7ffffffe, 0x1) 27.860166031s ago: executing program 5 (id=695): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1aa) modify_ldt$write(0x1, &(0x7f0000000040)={0x600}, 0x10) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000380), 0x0, 0x0) ioctl$FE_GET_PROPERTY(r0, 0x80106f53, &(0x7f0000000140)={0x10, &(0x7f0000000000)=[{0x39, '\x00', @st={0x4, [{0x0, @svalue=0x65c}, {0x1, @uvalue=0x3}, {0x2, @svalue=0x7fffffff}, {0x2, @uvalue=0x6}]}, 0x400}]}) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000200)=""/201, 0xc9) mkdir(&(0x7f00000001c0)='./file1\x00', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) lsetxattr$trusted_overlay_redirect(&(0x7f0000000180)='./file1/file0\x00', &(0x7f0000000200), &(0x7f0000000280)='./bus\x00', 0x6, 0x1) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000002c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}]}) socketpair(0x1e, 0x2, 0x2, &(0x7f0000000000)) chdir(&(0x7f00000001c0)='./bus\x00') mount$binder(0x0, &(0x7f0000000300)='./file0\x00', 0x0, 0x8000, 0x0) 27.784833046s ago: executing program 5 (id=697): socket$netlink(0x10, 0x3, 0x14) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'virt_wifi0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0xfe, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="480000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002800128008000100687372001c000280050007000100000008000200", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r2], 0x48}}, 0x0) (async, rerun: 32) sendmsg$netlink(r0, &(0x7f0000003f40)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001840)={0x10, 0x1000, 0x4}, 0x10}], 0x1, 0x0, 0x0, 0x440a0}, 0x10) (rerun: 32) 27.655706455s ago: executing program 3 (id=704): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x3, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000100)={0xf030000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x9909c9, 0x10001, '\x00', @p_u16=0x0}}) r3 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000280)={0x0, 0x0, 0x5, "fca3fffaf7"}, 0x0, 0x0}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r4, 0xc0105b08, &(0x7f0000000040)) syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) socket(0x10, 0x803, 0x2) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, 0x0, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x8) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') preadv(r5, &(0x7f00000001c0)=[{&(0x7f0000001140)=""/4096, 0x1000}], 0x1, 0x0, 0x0) r6 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_G_FMT(r6, 0xc0d05604, &(0x7f0000000040)={0x8, @pix_mp={0x10001, 0x2, 0x32315258, 0x1, 0x3, [{0x8, 0x6}, {0x7fff, 0x8}, {0x2, 0x4}, {0x2, 0xffff}, {0x9, 0x3}, {0x1000, 0x3ff}, {0x4, 0x3}, {0x6, 0x9}], 0x81, 0x3, 0x6, 0x0, 0x7}}) syz_create_resource$binfmt(0x0) r7 = socket(0x1a57fad2c049bb64, 0x3, 0x0) setsockopt$sock_int(r7, 0x1, 0xc, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e045f2d20"], 0x7) 27.376729967s ago: executing program 5 (id=708): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000100)={0x9, 0x8002, 0x145}, &(0x7f00000002c0)=0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="600000004400010029bd70000400000002"], 0x60}, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) ioctl$CDROMVOLCTRL(0xffffffffffffffff, 0x5392, &(0x7f0000000000)={0xb, 0x3, 0x8, 0x8}) r3 = syz_open_dev$sg(&(0x7f0000005980), 0x9, 0x200) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r5, 0xc008ae67, &(0x7f0000000140)={0xe, 0x4}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) get_mempolicy(0x0, &(0x7f0000000440), 0x4000, &(0x7f0000fff000/0x1000)=nil, 0x2) ioctl$KVM_SET_XCRS(r6, 0x4188aea7, &(0x7f0000000180)={0x6, 0x0, [{0x2, 0x0, 0x2f57}, {0xea5, 0x0, 0x2}, {0xfffffff8, 0x0, 0x1}, {0x4, 0x0, 0x6e28}, {0x401, 0x0, 0x6}, {0x0, 0x0, 0x9}, {0x100, 0x0, 0x9}, {0x0, 0x0, 0x5}, {0x40, 0x0, 0x5}, {0x10001, 0x0, 0xc3}, {0x2, 0x0, 0x7}, {0x7, 0x0, 0x8}, {0xe, 0x0, 0x8}, {0x6, 0x0, 0x4}, {0xffffffff, 0x0, 0x10001}, {0x70, 0x0, 0x3}]}) ioctl$SG_IO(r3, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffe, 0x6, 0xf8, @buffer={0x0, 0xe9, &(0x7f0000000000)=""/233}, &(0x7f0000000440)="153606ee522b", 0x0, 0x3, 0x0, 0x3, 0x0}) 26.474202472s ago: executing program 34 (id=708): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000100)={0x9, 0x8002, 0x145}, &(0x7f00000002c0)=0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="600000004400010029bd70000400000002"], 0x60}, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) ioctl$CDROMVOLCTRL(0xffffffffffffffff, 0x5392, &(0x7f0000000000)={0xb, 0x3, 0x8, 0x8}) r3 = syz_open_dev$sg(&(0x7f0000005980), 0x9, 0x200) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r5, 0xc008ae67, &(0x7f0000000140)={0xe, 0x4}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) get_mempolicy(0x0, &(0x7f0000000440), 0x4000, &(0x7f0000fff000/0x1000)=nil, 0x2) ioctl$KVM_SET_XCRS(r6, 0x4188aea7, &(0x7f0000000180)={0x6, 0x0, [{0x2, 0x0, 0x2f57}, {0xea5, 0x0, 0x2}, {0xfffffff8, 0x0, 0x1}, {0x4, 0x0, 0x6e28}, {0x401, 0x0, 0x6}, {0x0, 0x0, 0x9}, {0x100, 0x0, 0x9}, {0x0, 0x0, 0x5}, {0x40, 0x0, 0x5}, {0x10001, 0x0, 0xc3}, {0x2, 0x0, 0x7}, {0x7, 0x0, 0x8}, {0xe, 0x0, 0x8}, {0x6, 0x0, 0x4}, {0xffffffff, 0x0, 0x10001}, {0x70, 0x0, 0x3}]}) ioctl$SG_IO(r3, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffe, 0x6, 0xf8, @buffer={0x0, 0xe9, &(0x7f0000000000)=""/233}, &(0x7f0000000440)="153606ee522b", 0x0, 0x3, 0x0, 0x3, 0x0}) 25.796540061s ago: executing program 3 (id=720): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'bridge0\x00', 0x0}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="bc0000002b0001000000000000000000aa0000800c000000000000000000000014000100fe8000000000000000000000000000aa50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc089029d1608a487f26fbe816b89f7cb81bff81a9c9482565856555ee923c65973deb0a99b962bc0fe94"], 0xbc}], 0x1}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0, 0xffffffffffffff8a}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000080)={0x50, 0x0, r5, {0x7, 0x29, 0x9, 0xffffffff90adedc4, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x10}}, 0x50) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18) syz_fuse_handle_req(r4, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_STATFS(r4, &(0x7f0000000480)={0x60, 0xffffffffffffffda, r5, {{0x4, 0xfff, 0xfffffffffffffff6, 0x3, 0x2, 0x80000000, 0x7, 0xc5}}}, 0x60) syz_fuse_handle_req(r4, &(0x7f00000083c0)="c91443d5daaf04b192358b692f84d66c60492a57cffd585b0068ccde45d94ded1e86d3670791c21f8e0b2153d10d45d37b72ee2fa06ad61b0a9354045a8dae1bd1cfb49f3c11fe54c17eee632d95574681e6c472eb8a1beaf3a4b88561847a0a0f05fa4a26639d7e74a0c1c2790d6a59d4073b1c55539b7c21b8550efbd5f835c56642f4be57d170e36a6bf3a995f418554f0cab342769089d0777b28daad5c0c4ba56a0bd6c0515d9bf488fdcf49a9a7bbfcf5ad78733f8119f2568daefbd0985a9916c0d048e38765cc7bb1c82e0f3c81d98e7179ec782331bc3cfb2caf58a99668420795e6a00ef41dcf5283bbb61ebaedbb7a675be4fb2d11c31f9b76936d1112c68978c73f42e145b094490d748c1456a14c23fe25e2fdaeaaa7dc0d35dcc9bbfe86361f99f4d04090d1e66aa9714ee9f4608ad66c60f500bf06a1b5b90fbe2f6c42c4b5f337393b0bb201473712c48f898c514fff84c46b50d3aaf44578f41d312bb5a73526db7818617dcb938ebdb17f92423ca2cf7ea2c611483e0baff012fd97e28558317049e4fe2d27f72796d7260b33900cd61f984c087d3c54f6aa11e389a49069ef99ca86c279598b42dd3485f09fc7e119f707438498316cf2f2bc8a293eeb1a35635989327d4f6c9ba6b2d5b9b8ee89a1e13d538b954479663223bb704af6a63ee497734410ea43bfdb0ad3708cb7155df2432c44e8468a7b77b807d345c9b94fedadfdeba12f4b6d11d16fd6dd5fff6cf896d0f40785ffca538dae61d8a5ffee814e96628cd945553e788b8d915762ca3b40124149b3c186ddd5f7af5b75f4725444f2f7e54b999c93e8c5fd4d4fbd7a3b3d7e85df3053c866f1dd247cac6912ed8b0e491101ca5a0b999a21014b573ba3996c76065c9d8bebf431f8be6435837193efd6e5a565b2ced30d04355435f166b09f9dc91ee50412d0daf72b28ec14c505cb155de1a46362f140ac2b633fa42b12109f0a29fa8ba271d6fc2a77af3b16032ee46b3ddead76a481ef52f6bd25cab4494681f0abc2ffc60ebb36cffcc058a067fcdae6c9de670cd6fde6eb8086a65fc05df17cf69f654516ba30ee04a1427b40fb8e81fe46787d557046854ad342442bacd781c7a6063892402fb0d765397448991206b28193e20f285e50d9219ace39b311e572ebcd80702164315656e7fa92960d0fd28c6489406f0b3061218417548e7e78b8aaaf5a623eb47c92aebfebd1c78343bc781f184e0122a28f56b18832da5646ee8405fa2fc040ab30377c447b42d0bfdddc65e064ccdf1ad52a94309a819caeb523e22b25d1ba288b7f2c726290d50021b9839c5d3c471aadb08025d97619935a9880942cf653508a0b2c43838e5aada8b84d22042928dd372dedec14672266ddceb0744c7464ab282d7fbfb2767e891832aa25d1425b33a60c6894a8d5292fdd73e05a868b8e50cb1a412d1249a77ccfc3d3eb35a67221f80bb8960fd93ceb74e102f2a6946b50caae3ccb86a8ec441d6e58dbf24b3eb962c8a28cffeded9b7cf4a54f524a1ef49fbdc91e125aad65a54df6a0f10cd8799f48aa144f7aec977b4a347c5c9628c4805ecf71f305adc9e5ca7c1f313f9ea3e99b3590efd94d831e1ff5cd7a26b72281109547facfa3abac2cfc9177b117a3757b778e95b5069236abb25d8fb032c38d296f87388fdd364b491cb828732177a2c6bcaaf831d138c898bb60c0d9d8a02d8b4b8e7efa87d3ed66221ac52e31ba9c2da488b999eaf82994bc8f1ac29d5e60b8b1cdc30a1c9829aca1cd7881c8aaac9ede0f5d8b85538d2b13751cfc6b37587b0223b9f6b6dd9340753106b1eecdf4f63c51cc2c63a1f86235bad7602e115d1e0ed78a6b170b88eb9584d2098b187695627612189998171d245797391b2b79bb690a79dac4b769e3f18c4d49359f7b460d997c03c793f51a830d5b21faed2ae1c3eb0fce0cdadde3c789ec931b6397c2a2fb2eda87756fec031e5f50f07619130f8e39f1e00004a1f204e5d87780542bdedf0b1ca5168779ad7cb2ebf27e0a5d760a2492b4d92eab24f2bc9af0a3e51140c415a6f885d0faa38ee6dcffc41652b28e628b859db0e7a0f961e37c5806df137e68c5316667f36051eb05c971e208721fdb8a49b8c49f85114be9dd7288f4e95c5f6fb8c1bc1bc7d79f32ba5419d90130a0328ba70d10c770a1540718f7d890dba9c39a116623d492275a1268c91149bfe026ca1c6a458449d4004d653f4b0a234eacd1f4da495fd1f936b4b335f64514fc8091b1dab132f599e26cb127e25011efa30a922b5a3e8807db9a00a9cc732fd323708767c905c8a3cd53e2e8d377d3b43cb971cbd0e66e2e47f3d601d49e29941b2ea4d3c8b7f5698e1a633ebba00f6c178d6d04b9f1544f04cd173e2d49f129a8725a647e1a9e798b5581c6a461b585012a302353178188e55f8102a49343c9c370ee505d09e4be8580d95f5bf39267b00e93adb6b52b2029160d78ac271e4e0c70ed835484e80302b93efd599707d4d22c806476fd04d18ebd6a9bf88c11dc2c96041ac8c3e04ac0aa5d2ac6740972717b543fb871884a7a0434a433571fd621977777984ea9c06914be966da9f349cb1ef3a116c49f0c716eae1df118cd3d5b350b917c06d853c1e1514213f5a29071e42eecee264ff20529c53c3a060a18a680ade2a08b4549e6998f06e61e4f4c36d578e9ad83dd38d1eeb100e7ab023edb38426d5165b867b9507a6b644aa0322da335b208105f2e74a9841ea7c629ea20cef740f6364e9d84a4485d3bb6b5f4e14c7764f78b65c0647870638a8f618381ec0823faed0424a448f753a59fb22e5138e0ca537b6935befb99fc6eea2d9457c01345afbbaaf3a7a96a39478b222af322f86730d137c3f570b38c7363bb9a89bb4b3b8979b9afd232927becbc91c8d4a276febe47bacd4a84c0bfdd54e685080f2c3be0b1e37bc6d21b13b7b1bfd507880f6ad7fa39bf99eaf6b7088d758d9383e38326381088e9e3e792f75d682cf61cf1176953960b0e160b2a535495d52c28f14fa45ed7a3f91e219dcd05afdda2b7e6c1b742b29f6c5f62a040a5fe6606433fce7de757ed76372dfc0b1af9af10c0128bcd335eff1c6c9660b0893730c3ef8de6e50dba419b35d1766eb9a5dce4c2fa518f8e3e2a27855e04d06b89e97578a4406ac03f3314575143db5e43ae3d03a7e90a590b4c188a5acbe1cf23cd4cf60ca98248d4e740122a55ac6e463511b4c4cd47040aafc0bed7878348a4caad4d977671cf4ac319773767ee28f8ccc4c9deae531b029eff5345470f20865549b2f2c4089306304e13e42ca37fbca6839bbcd2f10bd20c81d44ab73ad5ffcc55f51b53efb00d3c68d8d8505e005247ba23e86a803b199f36447fd01f192994b2fa27c9db59ae66b56b30c1ae5cd717407068a9b13ca941b82db254f4ecdbd1751a3f8f1061031bb41af5c04a33ffc98509f456830cf3c94c14451f04d84844e41c618e82958710d07daeba666329b914f2cc7c1d34ffbf6b50620b7c78c25c5d82a5aadcc4d824b3b68c34231fa7c0befe5241c447f90111c55848feed9d1ee67f61095ec2c0b4ac82f5cf169201516082a804c9d1775990d430d21bc65877041905caf385918f44191c134e493d960724b28f01e79fbf3b99eac1e75fbc8ab8dcfdd98b573fa6d7e6a6ead6b15ed78e2a8d564f61d8c52be8104306c104146696e16c9e9bff79a5fc1d92326cf0f2ff5e5c5c252773f2bd2c554bc409aaec03055f71d439daebc1d8b06c9ca0e1fe4729e8e6119616e8fb861b1e2694d1df267cbc496ba4a87013c3317a16b4c1e369748507794a20ad06aad20e4dbfc1834d789d2a8e9395ddad33a74c6c7cf54e61e533cae228909536eba8020f0c3845d2063270cae4d8e8dd8cfe3f112c46751444546ced9f6434741656dcda2185be13eebcc0392c256f384fc16353e89cbdeef8fb2e3cadc1ed2142f3b6485dc2d540fe799d027413128f624aaf8bc1933d3a0e6a954931bfc914921dec7ec822a31ebb652d4f312ab4068cedc6203b0de98e60c5f82296a3482132b288ba0a8eabdd8ac40faf145928e7563dbcb14d0625c92b542860993bb0388d8390dae727ae4086d4de1b7fea9d79f4844374bcd67fa5e1a3a28cd6d8da3f171fcf9d13062bb149fde18917c6650cdfa2be8de33b556ad34fad454db13a446e8a7c40167117e884d874c786768975df0b201ea0077ba735d31d65a832dc122d13c6559601b83899af1f14808f55f077ad465ed61378c63abff3ad742691168fe1e31bfd0dbb9f43d364ddf0bb185f69e69110c9eb1ab808354fdd2cf571838d5ec63bac3d70ca40878dc3c3cea26adffd5a197206d7c80d6a86c202338e72f17dc7185e1df0cfefa9475a2156738f90c6410c1698d1a160fd396548323c796ec5dca3cd59e468ff6a14caf34b4fdb16f1c92acb6bff2e859f9de1266dea0d1828598319b40a3edef657be02188fc94490c1da088d3ec2f315d6b5bb2f262764b67ba321379f4c93bb3ef9bc7db0c0e5f1e680ebfa84463e904d5351ecf25d1d22a98f81f7a1fc4c4fee3934b7672661f0bcd94109706644d0fdac4b7933b5db2acf39b98c0a8106a7a757408404a4c299a077379458e2118fb0a53b798adc1b85d3eb20b539e572741b9855e44a545809f897dde06730145b5caefe9db1c321783450d25d38834532c3e372fa92a53ac9cb4330eaaf65fe1b69a66459058e02d20c6641b7d8edfa8e356baaeb011b61208ef36ed33235144c86d6ce65da89d66da06291d4acc05e3136559ab77a7c4ad229c5307b48ed642d96c28cd06c82dedd4a16ed90bceda81292120438fd5c47b7b41b2646fe0899643f896ddb2d11e7311f8a0cbb9bfa38106507e06f35b3052ad6b6a11ac5f0129bedc59d04aee3737ebbf10f97c80f1a4e3f51ac8ac4488ad9e3f685a7c0dd4074b07774f4efe4b9f2cba400ef49f73b12fc7d96d8f3283a1eaf8c003931fc24a9248e201ac31bb49226c37d535592e00308d86ba0765a7eda13b72686101d352fb959598038b8dec44a0f18e5c8ec089912d325880390ce5186d4585df46e5662987c164f0ccfb8f12f6144f91349051d3ffa35ba597d2b5920e279ca8e139dfe2ba9923c0190fd444c8bf12a627618791a8781d6b54470777e6a5dac8cb505ae1e534b0c3af7db010dd602b1459964e1e15a812f3b4c8038e6bc1dc568ba482ee4944582abeeda1ed012391706ddb1e0ce60efd15acde8283d3612de5d0cf76185ad3a1ce89488e1cea4009573b55a2766d100ecefc5d53c99876cfec65daea82f55cf9687ec70e45cfdba9fe69fc3a822c29ff4be34857bdcd4313fb23d1d01d8a79cbd0057eeb5c1c0b39f75d5a753a2e10bd0ebb91dab1312bdf1a984332d566ab56dfd838d285995bec8726c5d1358fe10b0b6aaa99b9d9b08894c1dbd06356e5c693ddebb9d8b306062defb160db9d8f02ae3df59697866f5adeb34c8c5b27b63b09675030f344197b3bff097b996819dec9059aaf5ec1a6c585a86d16528091543a9e6bca4d850b7963fd1e7d981814dedb165c1a6444ec0a21743a4de8845b386ad4e1e9c9f2873f6a353487d9a8f8f56ae1d0f69124ee56b5c2b2a48c78cc6ba6b313b889adf0acfaebb4e2dc71054a4992366a2b6ff1f5972d7d2f0e9e3b17d7fbe931f43871819dc6e6040ba239ebce2cfa424ff7344b8a880040321909dcd16956594f5d99fdd39ea5d7209b906d2601572c56c72db899f986185194fe5aab45f27d9ac12aa8600b3c2728ef2e589a6886d711edf4d7f95b2e10d9adde3009560ad754f9e7a52808720a973dc475f8177fd5b199b69925f03a44a8bd9f3c3369861802ce5ca4b40cb47d19e2e1bda1b054f16b66ac7b7c0e5205112e011d6957f1df50505003544631ff4385d8128d46838338930aebc0496348045a7c05abd7a56e1079947d3eb1c50e4d8be001d03d8973f8f08f2f21a415174173ccb90f7ab615be5036947e164a434c059637bfeebb8b9f2e87b9774a4595c71122c9fac74347488b9a054e2e7b9c45b7b12fcca0fe789db614c70d4149d44e50fb64aabccee7447288a5b865a60c2640171f89afecda2cb18b7ecea214bd32f43d5ff66e90741697d085f3ee9bfd8662a3cc570999bb151090160d3bf5bf1d85e896d66276cba7ed97f341f595b13c02ac2a1352aec7a5980de2c8f9d890951108947b7602dcf2bdd2aef680667572b87aadf7c54338492eae763df73e89e3c438c196da83d98bc65233a242e08894f2390d8714f0abb801d9e5c42f169555284b6cf079005b373e9938db71a93ee5945c2a43a06e3df580d372318b3d203503c6e968206d7db8116cca2f2a1fae7f5b5195bea92914d66516bc3ceb2d9dc4de59d0d52ab80910aba7ebb696c7deaddcf0fedf56e2a88c3496bb79897c6420a0ef1b03ad89c76b24f67ffd41c9227d464565457bb25f0b32c83e676b0a3284f2acbed39c6875871c5e866a8284f12e383f87f12dd9bbe3078c68b3711eaa9bc17a7ac8413a8ef486922eddf43f01625671b7c3d0a4c6c2dc38217b4135c8cb46df7d936aabfd253e95e0816dd1f92b257e2f96d2a259a320756ba77d99b709711326f2ea42def974d60f817a1f6779121dd32a1cb194c7809e4c8fd052ba357323436491ec45a49fa601ed373aadd2199e4483704fb2f4edd7bf2815b552fb84d09094cab9700b5125887ee508570217c16799bc11d9e3658de8d9812f30dc8078bbecaf887a6527686b026eea70229df1e61759adf19c1b96673419decb382ae29bd685c5f32120b2d56d3e97c9ef00a2c0598c2181b8fa53172312590a9549ff55dffb9070b042c74654b2ae56371b2a6bac8e2808a40fd5d6d0af184c035101394e347521467e0ddb962e0d63614cf1461ac7b9d744084e9f6f26c88d515dbb1b7392b8e9384b81f186224d5c09e266682d8044d8afb1bd6483962b03ed6884759d2647b8f174a6695a437a1f1aac3e6a2f8ca658ee8a8ae44a77393cec61a9f335a1e859825e73df4125828fbde19d3695125992ddb2826ffbc6c7cfbfdbae19ba864c4170c79cce408e8b280a7632c855d802029ebac8627fbd6fec1c3bd858411c969ca035992f2ab909c423158dffd0dd5a407b3e0c2d9b180440996e09e15f17b4e42f365371d9dd58c4609455253c44c2ba73f592e360ab5fcccdb6e90ae0c60ada9325c4824242c0d866e7dfbefe091067d5c7ff0432814f733591eb0096659738b34cfa8c6c988ec628f34fe08f31dc0156dc39866412932d045168f4f3a48f24fb3b884be1384845d496c3009626f1c41b0189e95c9055d24eb5a0390596f6ccf50d3727e607875a3b2cf076a277e12ac07ddc59da78ee16e1952706ac6a1a9ade80b867d889789c935d196cc4da67aa35ba80ef2077ee4dd69c5f31a0410f7fd0739303ddcdbff2f53e0a44ec5de0f062e533444bd946959a1d9c25b297b6fc7675ca4add9e24e8ff390e0375f3b15e1d3e8129007d743e384659f191bd23ffe02140fa64d5c6d75937b28d51afcaa9d207f57c878f2f54493025e9eff5b5ce0c997d11c9690262e38e1e83c7f1a0ed3f200d9d0472739d59dea3cc6e8783758e3e3201731cf27211267702594356345449b42fa64b64c6f00a8f26665524fe2208b1a7c5fbdc822ea611c1811526471e4f52ab5e3a43de8fd4eba2fb2796a206e348de9b0be78ded78204dc82d9e9adccbe408d7ff538aab3d663eab189927a9cd597388e8dc5063d2db42cd65415fa32d20288da017c9f94e788dfe7cc3a0f6b6ab06116ed3f72f3c048cb1e51abf308ed7169908d1ad5b7ab3a86a3316d164084f8d88c6f96142d888ccb158efa586015914c116db114aa82c44a55d4c33bd901dc34e820d3120d57def03ea4f01b263913cc02ca586b208506d149ef03a706fd5360a12b83acb7bf97ac1f1f85389d4fbfdcf38551e9dbce760a05e8e4023d85038570d3697b3e7de73aac9c7feb39b6ccd1a775c8ce01b08d7190e28866aa7bb8d0cff0fc45b452fcb6a290f98f4b5ec125224c8a93918b1f2888befba6de3d294ee1f13a9c56e92eaac0b8e6c6905e77a60ea7e1d1ed979b6b2606652e7d75750a065c57c7efb1ef5708719ef04e354bd861b15e0a1cbc7cfe65c8a3d9a2b790260d6e6eb60bd4e0fb3f040dfa27fa00797664122add0750a23a8b20fcd68b6be1e21620dda4bf0561f4c5ed74f41612a0676dcdbf669df3436cbf2ce253e69319e3ab36e6e6314f11e0d0882ee3d7f3d3b3dcfe3cd7f061e301369207545676e09801f9bc4bc4c3dcaf48e5320a4b3211051a7525868a0ac1278ed6fc9531ed89cf4205458acc05d5351bcab7ea50250b6cb4c6fdd0cd96f30cdc9a820f495d0a3e14eb6c493a85a87e3b7fb8e5f23431c3c5359f5802f1fc11ff71c3172c6b57b5587ab38579b79e328792edb7a81d60762bc6c88693a00712f811cab9b075a97535c904396dbd2fa0994ba9c9b06fe9c042cb6860d22844b94863bf7b68a1ab8639e4487b38d48e40da4a98dedd7d73ca4b575bf4c604a364a9247c2ea5e3b127ff42f9bce1d3d37c2428edab1708ebd71ac0e4a408a9c6eb97407a4a8b5e912e2c63fadd1abad9a772a96fc4666f7d2b604adbde6f1136de2adfe38994491ab0f34ff1fd20cb8034ad39aae4c5c0076da2e7a157764b770e1c5f35b6f323ce809b2e92be1345204021d74712368e0ef77056afd85f065bba085793c9b6950d3c3fc6c445afbdd5a80cf7b0bb13055fd486700be1500bdf8771e286a63962e56d4771ed5eefbf111ba7380f02d6f96eed174246820b73bd772689c072bb3d8e43ef96f5466dce5c9392e34b7176821d2f4df3dab4c6ef5e0238ffe61582812fdacc987fbb6d98cad5a2d7af0e4c8dd3f800cd75c38a515d4d4c7118c5f81c6f7504e7ae452370c56c4b7fb4daa65bf26919c12081485d09e9d142965320211f483ed2a0a6836fa2488a878eaf9653b0528c3680b75a1920a25b5c5c17548c7ceb9a1656a0cf6a404aec14f7ed8a1dcf8ed32e1cf94dc2f60b65aa102650b7a22d9e708c606ce8403ceb81434bd9938b2c4e5a8530a156a1df7d143b2da54071ba3e673ce11760f72c32273b7bcd9a48da2a6caeb4b782cf1c3a044c1731f3ad61ce32bbd0b52cbb187cb3ecc1e85a67ffe27cf86769a0d69fe293dd30f060b8a0f26ccd0287d0b8d941ee7410a7c6aa430add67c2dd60db292e24f294ce80b0321aaa4d054a6f5d9981e1d5e859b454f5005be082bd59baca5775eedb7994333c62c452ef7b2893e4d03a28c0e368928b4bdd6e31f52a83cd7e162975405fd128321e0a8e3e77fd93257b0c46b309e16203974382ced818faac3a02e74141e9ea36c4a1b98bd859fafce43b2984d856c832f61b1ca562cee96f5843adc14b35bec1ccdafedd214f1a344345373f3c9eccee8324950a23c3e77d55dbde9a7ac1b7804927affb8b0e1488dcd8919d227bd1f50a35abf25e3f120c25b0dfb4d85b4c2a2c69cf7047c76c45e4e901e7396140496f9a322c2c2ac777a27adff5a6daf32e852b1bac89f1086739a603cf0f6838f792351c08e38ab130e5a83aa5a4f2da19df131770a308d810eed0059a2e5546a2169b9d0119f6df7c18981f4b4f119c76fdaac031ce7551f25678b5c4d8815a7ea9565e63389fca6ea0bcd40e71ac72124113dc0041ce26a0c9979ff76d7f1f2c0cd2c16d8c7a36930b909ed7e2d4adfa8352b12b99bdcbc25b485f652539fab7ac983c1ae925967c15ba2345e45d6bafe13b3e9d7acf1a592422ea09c3a45f7fe24e235bd70b106cdaa665584e74cdaf9f39b804bc6c4e7f0bf572225acd4dfe010081b91c2d5970d4f43d2e1a0e05f84baaf50642991b3704034aed74572e6a4715b79276432d06660b39c989570fc0d5d0071a7c690658caee447370d3295db3b5dc625e697e1ca2675b5430b9969024835c7d001fbce86c5165c4fe8f2d46b883daaa3fbf42dc5cf61209379013896df740b9cc32638358ea8079a33f04197f650471086e67e5cf9779268d7973c73bbbde2f1c11e1a8e2b154aaa8b4b74f8a03f14ceb7afc4ba35e6620b7af89c969021d20cb260c1868f3fa432ce7e509db06001ae6540531b126c1e3a851acbf0a9c1354bece05c094d69d9bd87f99391e23306911383d2082997339daebd67d8a707c9b496a309b7921696f39a07864f31208802db7188881e346b41c34f4129fca9c6a13172a4dabfe791584d240fc03685057d53c08737aa1d486233318eb4545f2e8d18087705b9d3a7658564592f56aea3aee53d66c249988bf353853728553a1577062e24af533f47dc012ae90c5c085babc121be2993c063e203ab949a088041271ac0527c56edd4b7a87e98323a0137cd493aa05fe38d02754a66d89348b119e6200d5919bc366788eb67115fc57c4c1a9dd42c7411d6709ad82de8662a1849445b39beb2ba8f894860e41a054f61337179a9214b0884f3964c95ed2a4ab37de8038566bba76fbaa7502c0460558ff4bf4793ca68d78e50f384a81da4cfa23723747e906b82290e0b8ea07e3404bee0915800d4c3c07f94c43e7aafbc7a44d923de97963d0d1586bee06fc90aadbe5758fb9933ff7df346d62e082223741f5cb26ef953ca654ab983a72b30b296891c9e3f1ed5216b0e588eb25f5d4ccad6f96973cc2d26196bbd37c83266473071ccd84d9e3c74f22621e8bd60afa4bcad6c853c7591fe5d4298a954ea5006f682a7a65aeb26b230f3866a28a58bf532aca8fd5eaec64f442ac510a7df4114f00fd6ff7e02d77f8e72797222556959958c4c4d166c5af18a6e25588cac9871a3d5bb453889ff8d13db22024a997bf97a5afdf698b1deaff3101e27868d2de47b92c403ce82e15f3239d8923e8ca0c01e3781b5dd6121f57d2238dc3ff8a1bde3e371efd33838c552e43588042b360f55d7ca92f11987630364b263428e18601d7bf23f6432b3a9aa2c500cd9ac5f73cbe309443858a2806956b0cdcfc19904567bb1703641017c6199e768410e03d8ba603eb34249d567370202f39639ae8f6d52d9d5dbfc544c5b85ac8187095c63f1f613fe4af179fc5c837e6e0ccc21e62ac22ac045c4ac3b1ca6a4cbdbe29ea465240fc0aed1f0e086d7580bcf81d4e2a4d55a8e3bc57110e7cf1e1895df07974f0686dd2ea2b12bbfd64e7a9d0c62c662f0370e6ed495eeb2ee5029042147a1f2e5fcd6068b06567be893cb80e2cbb5fbb12847313811c13cf685698d5e2175959579e510279b9e959ac2c3f94fec653c6b521f8909d633ccedbc1109285ecbd52d27cd2891eaf354db2c966d1e3086718848433c12658fe7f6fbfef930b963139a63f6c4caee5a1964d3a038dd0db403c0a251d702c07a0fba4a3576ec6668a78e9e26efc6ad83a670a47608bf4207979bf196b3160c95e7ccc6406d46f529d34676b76d72396262e1448df051130a21484e0e977df1f7f0a259ac762eef9506877498b9998e1286d6294cf60b95352e81c3", 0x2000, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="f0010000000000000300000000000000040000000000000003000000000000000080020000000000030000000000000009000000010001000600000000000000090000000000000004000000000000000b000000000000000600000000000000000000000000000006000000010000000600000000800000de000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="01800000000000800000000001000000000000000100000000000000010000009401543200000000000000000400000000000000000000000000000004000000000000000000000000000000ff0f0000f4000000040000000000000007000000000000000700000000000000f9ffffffffffffff0000000000000000000000800000000008000000060800000500000000a0000078bcc133", @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="fd01000000000000000000000600000000000000e6000000000000000200000007000000666400000000000004000000000000000300000000000000ff07000000000000ffffffffffffff7fff0f0000ff07000003000000000000000900000000000000030000448e1119236996430000000000050000000000000002000000000000000200000006000000070000000080000000000000", @ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="0100000003000000000000000000000000000000070000000000000001000000000300"/44], 0x0, 0x0, 0x0}) getdents64(r8, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000010001fff0000056842bb002552d215f6", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140011"], 0x48}}, 0x0) r9 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r9, &(0x7f0000000140), 0x4924b68, 0x0) r10 = syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$x86(r10, &(0x7f0000000080)={0x0, 0x0}) ioctl$KVM_GET_MSRS_cpu(r11, 0xc008ae88, &(0x7f00000000c0)={0x1, 0x0, [{0x40000082, 0x0, 0x10}]}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="4c0000001000ffff26bd7000eedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="350c040000000000240012800b0001006d61637365630000140002800500070001000000050008000000000008000500", @ANYRES32=r1], 0x4c}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) 24.886522262s ago: executing program 3 (id=729): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = syz_open_dev$mtd(&(0x7f0000000080), 0xa, 0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140008001000010000000000000000000000000a58000000062b0b040000000000000000020000002c000480170001800a0001006d617463680000001800028008000240000000000400070008000100407066000900010073797a30000000000900020073797a3200000000140000001100010000000000000001000000000a"], 0x80}}, 0x4048010) ioctl$MEMREAD(r1, 0xc0404d1a, &(0x7f00000013c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0x9, 0x2bd, 0xc}}) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_load_code={0x12e, 0x19, {0x0, "f4"}}], 0x31}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) unshare(0x8040480) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) ioctl$EXT4_IOC_MIGRATE(r5, 0xff08) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f00000005c0)="0f1cbe0000ba6100b05eee440f20c066350900000044070722c0b838000f00d8ba400066b80000000066eff4d09800000f4da2ee005df2ab", 0x38}], 0x1, 0x15, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000140)={0x101fd, 0x5, 0x100000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf7}}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x8, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f00000000c0)={0x5}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 24.669828947s ago: executing program 3 (id=734): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000007b40), r0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r2, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000004200)={0x50, 0x0, r3}, 0x50) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) syz_fuse_handle_req(r2, &(0x7f00000042c0), 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getdents64(r4, &(0x7f00000063c0)=""/1024, 0x400) syz_fuse_handle_req(r2, &(0x7f00000067c0), 0x2000, &(0x7f00000087c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000008880)={0x30, 0x0, 0x0, [{0x0, 0x0, 0x4, 0x0, '#,,-'}]}, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f00000086c0)={0x0, 0x0, &(0x7f0000008680)={&(0x7f0000008600)={0x28, r1, 0x1, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20}, 0x48000) r5 = syz_clone(0x88200, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000380)={0x22340200, 0x0, 0x0, 0x0, {0x20}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[r5], 0x1}, 0x58) 24.515650523s ago: executing program 3 (id=737): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x6, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000141000001c00128009000100626f6e64000000000c00028005001f"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r1 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000f40)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e681cdb9e581a38ebb0ddd5f307e56", r5, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r6, 0xc0383e04, &(0x7f0000000680)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$MEMREADOOB64(r1, 0x1269, &(0x7f00000000c0)={0x2, 0x0, 0x0, &(0x7f0000000280)}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(r7, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x48, r8, 0x8, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7f, 0x6b}}}}, [@NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x1e3}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x1}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x1a7}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x703}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x804) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000000) 24.249814248s ago: executing program 3 (id=740): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000500)='/sys/kernel/rcu_normal', 0x202, 0x20) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @none, 0x4}, 0xe) r2 = syz_open_dev$radio(&(0x7f00000005c0), 0x2, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000140)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f903, 0x0, '\x00', @p_u8=0x0}}) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000040)={0x0, 0x5, 0x7, 0x8}, 0xc) sendfile(r0, r0, 0x0, 0x4) 24.204716358s ago: executing program 35 (id=740): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000500)='/sys/kernel/rcu_normal', 0x202, 0x20) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @none, 0x4}, 0xe) r2 = syz_open_dev$radio(&(0x7f00000005c0), 0x2, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000140)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f903, 0x0, '\x00', @p_u8=0x0}}) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000040)={0x0, 0x5, 0x7, 0x8}, 0xc) sendfile(r0, r0, 0x0, 0x4) 1.797947671s ago: executing program 7 (id=1018): setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000c00)={{{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e24, 0x9, 0x4e23, 0x9, 0x2, 0x80, 0x80, 0x89}, {0x1, 0x98, 0x5, 0x9, 0x1, 0x8, 0x4, 0x5}, {0xffffffffffffff22, 0xe0, 0x823}, 0x68a4, 0x6e6bb9, 0x2, 0x1, 0x3, 0x1}, {{@in=@multicast2, 0x4d3, 0x3c}, 0x2, @in=@loopback, 0x3501, 0x1, 0x2, 0x1, 0xffff7fff, 0x3}}, 0xe8) r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)=0xe) ioctl$FIONREAD(r0, 0x541b, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@ipv6_newrule={0x44, 0x20, 0x1, 0x70bd28, 0x25dfdbfc, {0xa, 0x14, 0x10, 0x0, 0x8, 0x0, 0x0, 0x3, 0xf}, [@FRA_SRC={0x14, 0x2, @empty}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000050}, 0x20048810) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newtfilter={0x44, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xfff3, 0xfff3}, {0x0, 0xfff3}, {0x1, 0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8847}, @TCA_FLOWER_KEY_MPLS_BOS={0x5, 0x44, 0x6}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c00000000000000000f883816814100000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b0000000000e000000200000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="ac00000000000000000000001400000000000018000000000200000000000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f0000017f00000a0000000800"/28, @ANYRES32, @ANYBLOB="7f000001ac141400000000011c0e0000000000000000000007006fc946f1f569c01801"], 0x230}, 0x1) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803002d000b12d25a80648c2594f90124fc60100c020000040000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 1.719595635s ago: executing program 7 (id=1019): r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r0, &(0x7f0000000040), 0x2, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) ioctl$SNDCTL_TMR_START(r1, 0x5402) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000100)={0x0, 0x1ff, 0x0, 0xffffffffffffffff, 0xf645}, &(0x7f0000000140)=0x18) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000180)={r3, 0xfffffff9, 0x30}, 0xc) ioctl$SNDRV_PCM_IOCTL_DELAY(r1, 0x80084121, &(0x7f00000001c0)) pread64$ublk_ch(r1, &(0x7f0000000200)=@buf_4k, 0x1000, 0x0) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000001200), &(0x7f0000001240)=0x4) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f0000001280)=0x80, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000012c0)={r3, 0xffff, 0x563}, 0x8) mlock(&(0x7f0000fff000/0x1000)=nil, 0x1000) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) setsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000001300)={0x0, 0x8, 0x400, 0xff}, 0x10) ioctl$SNDCTL_SEQ_THRESHOLD(r1, 0x4004510d, &(0x7f0000001340)=0x7) ioctl$XFS_IOC_GETBMAPX(r4, 0xc0205838, &(0x7f0000001380)={0xffff, 0x5, 0x3, 0x40, 0x100, 0x3f, 0xe}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001400), r1) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000001440)={'team0\x00', 0x0}) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000001480)=0x0, &(0x7f00000014c0)=0x4) sendmsg$ETHTOOL_MSG_FEATURES_SET(r5, &(0x7f0000001580)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x2208480}, 0xc, &(0x7f0000001540)={&(0x7f0000001500)={0x38, r6, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_FEATURES_HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x38}}, 0x40000) fcntl$getown(r0, 0x9) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r5, &(0x7f00000015c0)={0x20000002}) setsockopt$IP_VS_SO_SET_DELDEST(r2, 0x0, 0x488, &(0x7f0000001600)={{0x89, @multicast2, 0x4e24, 0x3, 'wlc\x00', 0x1, 0x4000, 0x80}, {@loopback, 0x4e20, 0x2, 0x5, 0x2, 0x6}}, 0x44) ioctl$SNDCTL_TMR_TEMPO(r1, 0xc0045405, &(0x7f0000001680)=0x112) madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x15) connect$inet(r2, &(0x7f00000016c0)={0x2, 0x4e21, @private=0xa010102}, 0x10) fsetxattr$system_posix_acl(r1, &(0x7f0000001700)='system.posix_acl_default\x00', &(0x7f0000003a00)={{}, {0x1, 0x1}, [{0x2, 0x4}, {0x2, 0x4}, {0x2, 0x4}], {}, [{0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x7}, {0x8, 0x1}, {0x8, 0x5, 0xffffffffffffffff}, {0x8, 0x3}, {0x8, 0x2}, {0x8, 0x4, 0xee01}], {0x10, 0x4}, {0x20, 0x6}}, 0x74, 0x3) 1.637289301s ago: executing program 2 (id=1020): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000080), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2214088, 0x0) chdir(&(0x7f0000000100)='./file0\x00') r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000001c0)={'vlan1\x00', &(0x7f0000000400)=@ethtool_sfeatures={0x3b, 0x2, [{0xc, 0x63}, {0x0, 0x73}]}}) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x8010, r0, 0x1f9b000) recvmsg(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000200)=""/254, 0xfe}, {&(0x7f0000000300)=""/67, 0x43}], 0x2, &(0x7f00000003c0)=""/57, 0x39}, 0x40012001) mount$fuseblk(0x0, 0x0, 0x0, 0x100800, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000000200000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r1, 0x2000000, 0xfe7f, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) read$FUSE(r2, &(0x7f0000001300)={0x2020}, 0x169b) 1.538904873s ago: executing program 2 (id=1023): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000040)={0xf0, 0x258, 0xa0, 0x640, 0x0, 0x0, 0x10, 0x2, {0x1, 0x7fff, 0x1}, {0x3, 0x8f}, {0x1000, 0x3}, {0xf9a, 0x4}, 0x2, 0x2, 0x800, 0x1, 0x0, 0x6, 0x9, 0x4, 0x10, 0x1, 0x9, 0x1, 0x0, 0x100, 0x1, 0x8}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="580000000102010800000000000000000a000000440002802c00018014000300fe8000000000000000000000000000bb14000400fc01000000000000000800000000000010000280050001"], 0x58}}, 0x0) 1.269825745s ago: executing program 2 (id=1024): r0 = syz_open_dev$admmidi(&(0x7f0000000080), 0x8, 0x4000) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r0, 0x40045730, &(0x7f0000000140)=0x3) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, 0x0, &(0x7f00000000c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) setsockopt$sock_int(r5, 0x1, 0x22, &(0x7f0000000240)=0x8, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@getqdisc={0x24, 0x25, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xb}, {0xa, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) write(r2, &(0x7f0000000000)="2defed0000000100ae82d2cf9005aa4855e500", 0x13) 1.18957145s ago: executing program 2 (id=1027): syz_clone(0x49000100, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x11, 0x4, 0x4, 0x9, 0x0, 0x1}, 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000580081044e81f782db44b904021d080009000300e8fe55a1180015000600142603600e120900210000000401a8001600a40001", 0x37}], 0x1}, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000380)={&(0x7f0000000040)="b64b6779e728a585fc6d831c9c111ee3bf867c7fa20663508d961b5b0bc1d4eded804b84c8ee0b5e7b55af44aa8bf4a16c4d4aaf896a13f650a3b4f737945a9a179a6ceb93adadb8dd841258d0f04b02868cd415ab9bc48b055a8b3f92b143cb16138c216513a045af2101e7e3c507bedee404330f1171812cdaeed17a0e89dd4863a4e6808ca6b7046c38f33b9a0417e1c8fae7a9e1b4c8161b02", 0x0, 0x0, 0x0}, 0x38) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x100) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) r1 = socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES16, @ANYRES32=0x1, @ANYBLOB='\x00'/17], 0x50) r2 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="3640000049009125745c7388641f9c0e0a"], 0xfe33) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB='6@\x00\x00H'], 0xfe33) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000840)=@mangle={'mangle\x00', 0x8, 0x6, 0x768, 0x578, 0xf8, 0xf8, 0x578, 0x460, 0x698, 0x698, 0x698, 0x698, 0x698, 0x6, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x7a00000000000000}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x80}, @loopback, [], [0x0, 0x0, 0xff000000], 'veth1_to_batadv\x00', 'veth1_macvtap\x00', {0xff}}, 0x0, 0x138, 0x160, 0x0, {0x5002}, [@common=@unspec=@physdev={{0x68}, {'veth0_to_team\x00', {}, 'netpci0\x00', {}, 0x14, 0x14}}, @inet=@rpfilter={{0x28}, {0x7}}]}, @common=@unspec=@NFQUEUE1={0x28}}, {{@uncond, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, @local, @local, @local, @dev, @rand_addr=' \x01\x00', @private1, @mcast2, @dev={0xfe, 0x80, '\x00', 0x3}, @private2, @empty, @mcast2, @loopback]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x1, 'netbios-ns\x00'}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x0, 0x6}}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@eui64={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7c8) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101001, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x40000021, 0x0, 0x3}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x2, 0x4, 0x1, 0x0, r0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r6}, &(0x7f0000000840), &(0x7f0000000880)=r0}, 0x20) syz_clone(0x54800500, 0x0, 0x0, 0x0, 0x0, 0x0) 1.103869898s ago: executing program 4 (id=1028): r0 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000000)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x1b59, 0x64, 0x0, @wg=@response={0x2, 0x0, 0xe0, "00ab08653904030401c50900000009c5000000efffffffff00", "9384bbeb3018ad591b661fe808b21b77", {"694c875dfb1be5d2a0057a62022a1564", "a329d3a13bd5b6cc6a9471314a1d8c69"}}}}}}}, 0x0) write(r0, &(0x7f0000000100)="240000001a007f0214f9f407000904f702000000000000000002000008000f40fe00000e", 0x24) 1.049704101s ago: executing program 4 (id=1029): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)={0x6c, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x31, 0xe, {{{}, {0x7ffc}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0xa03, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x71, 0x7, {0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x54, 0x68}}, @void}}, @NL80211_ATTR_FTM_RESPONDER={0x4}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0xfffffffd}]}, 0x6c}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x60, r1, 0x1, 0x70bd27, 0x25dfdc06, {}, [{{0x8, 0x1, r2}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r2}}, {0x8}}}]}}]}, 0x60}, 0x1, 0x400000000000000}, 0x0) 979.645132ms ago: executing program 4 (id=1030): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) syz_open_dev$mtd(&(0x7f0000000080), 0xa, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140008001000010000000000000000000000000a58000000062b0b040000000000000000020000002c000480170001800a0001006d617463680000001800028008000240000000000400070008000100407066000900010073797a30000000000900020073797a3200000000140000001100010000000000000001000000000a"], 0x80}}, 0x4048010) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_load_code={0x12e, 0x19, {0x0, "f4"}}], 0x31}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f00000005c0)="0f1cbe0000ba6100b05eee440f20c066350900000044070722c0b838000f00d8ba400066b80000000066eff4d09800000f4da2ee005df2ab", 0x38}], 0x1, 0x15, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x101fd, 0x5, 0x100000, 0x2000, &(0x7f0000003000/0x2000)=nil}) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000180), &(0x7f00000004c0)='./file0\x00', 0x8, 0x1) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf7}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x8, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x5}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 918.310672ms ago: executing program 2 (id=1031): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) (async) mkdir(&(0x7f0000000000)='./cgroup/../file0/../file0\x00', 0x0) (async) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_clone3(&(0x7f0000000040)={0x2a0a00300, 0x0, 0x0, 0x0, {0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, {r0}}, 0x58) 839.400112ms ago: executing program 7 (id=1032): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newsa={0x168, 0x10, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {@in6=@local, 0x1234, 0x32}, @in=@dev={0xac, 0x14, 0x14, 0x3e}, {0x0, 0x0, 0x0, 0xfffffffffffffffe}, {}, {}, 0x0, 0x0, 0xa, 0x2}, [@algo_auth={0x5c, 0x1, {{'hmac(sha1)\x00'}, 0xa0, "000102030405060708090a0b0c0d0e0f10111213"}}, @encap={0x1c, 0x4, {0x1, 0x4e20, 0x4e22, @in=@dev={0xac, 0x14, 0x14, 0x40}}}]}, 0x168}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='proc/sys/net/ipv4/conf/default/forwarding\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='proc/sys/net/ipv4/conf/default/forwarding\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='1', 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendto(r3, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x32}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r4, &(0x7f0000000600)="1234567890", 0x5, 0x40800, &(0x7f0000000040)={0xa, 0x1234, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c) 838.933123ms ago: executing program 7 (id=1033): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb1e9a000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000185000/0x4000)=nil, 0x4000, 0xa) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r0, &(0x7f00000003c0)=ANY=[@ANYRES8, @ANYBLOB="7672762dca"], 0x10) openat$nmem0(0xffffffffffffff9c, &(0x7f0000000040), 0x2c8000, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@broadcast, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x89, 0x0, @dev, @local}}}}}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x600a00, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r0, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000000)) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) 488.121638ms ago: executing program 2 (id=1037): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0884113, &(0x7f0000000380)={0x1, 0x7, 0x6a, 0x10001, 0x0, 0xffffdffffffffffd, 0x7, 0x0, 0xffff7ffffffffff8, 0x10000009, 0xff7ffffb, 0x1}) socket$kcm(0x2, 0xa, 0x2) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r3, &(0x7f0000000100)=[{&(0x7f0000000140)=""/197, 0xc5}], 0x1, 0x36, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r2, 0xc0984124, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) 424.684349ms ago: executing program 36 (id=1037): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0884113, &(0x7f0000000380)={0x1, 0x7, 0x6a, 0x10001, 0x0, 0xffffdffffffffffd, 0x7, 0x0, 0xffff7ffffffffff8, 0x10000009, 0xff7ffffb, 0x1}) socket$kcm(0x2, 0xa, 0x2) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r3, &(0x7f0000000100)=[{&(0x7f0000000140)=""/197, 0xc5}], 0x1, 0x36, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r2, 0xc0984124, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) 417.761806ms ago: executing program 4 (id=1038): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a300000000098000000060a010400000000000000000100000008000b400000000070000480340001800b000100657874686472000024000280080001400000000c080006400000000008000440000000220500020007000000380001800c0001006269747769736500280002800800034000000004080001400000001408000240000000120400058008000640000000010900010073797a3000"], 0x10c}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x25, 0x803, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000f80)="d8000000180081064e81f782db4cb910021d0800fd007c05e8fe50a10a000700014002020c600e41b0000900ac000a0501000000040012000a00ff150048035c3b61c1d67f6f94007134cf6efb80073f6a5aa8457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667daffffffffff1f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5b7276505de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000001252c330f973f4953d2a6823a45", 0xd8}], 0x1}, 0x4000044) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newtaction={0x64, 0x30, 0xffffffffffffffff, 0x0, 0x0, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x5, 0x0, 0x0, 0x80000008, 0x40000000}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x0, 0x0, 0x4000001}, 0x40000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bind$packet(r2, &(0x7f0000000000)={0x11, 0x1c, r6, 0x1, 0x3, 0x6, @broadcast}, 0x14) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$BLKGETDISKSEQ(r7, 0x80081280, &(0x7f0000000180)) getsockopt$inet6_mreq(r2, 0x29, 0x14, &(0x7f0000000140)={@rand_addr, 0x0}, &(0x7f0000000180)=0x14) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@deltfilter={0x4b8, 0x2d, 0x100, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x5c21f5d85561bb9b, 0xe}, {0xc, 0x10}, {0xf, 0xfff3}}, [@TCA_RATE={0x6, 0x5, {0xd, 0x4}}, @TCA_RATE={0x6, 0x5, {0xb, 0x1}}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_fw={{0x7}, {0x45c, 0x2, [@TCA_FW_POLICE={0x458, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x7, 0x2, 0xffffffff, 0x5, 0x1ff, 0x400080, 0x7, 0x3d42, 0x5, 0x38000, 0x0, 0xdb58, 0x5f2f, 0x2, 0x3ff, 0x6, 0x0, 0x271, 0x6, 0x80, 0x8, 0x2, 0x2d9, 0x40, 0x2, 0x8, 0x530e, 0x9a, 0xfffffffa, 0x8, 0x9, 0x1, 0x7, 0xc, 0xa, 0x10, 0x8, 0x2, 0x3, 0x9, 0x5, 0x35dc, 0x4, 0x22, 0x2, 0x4, 0xabc, 0xb3fd, 0x0, 0x4, 0x60, 0x7, 0xfd8, 0x0, 0x1c45, 0x4000, 0x1ff, 0x6, 0x1, 0x4, 0x2, 0x38, 0x0, 0x3, 0x7, 0x1, 0xf, 0x3, 0xaf, 0xc4, 0x8, 0x17, 0x45, 0x3, 0x5, 0x7ff, 0x1, 0x4, 0x5, 0x2, 0x8000, 0x3, 0x5, 0x7fc, 0x9, 0x2, 0x4, 0x4, 0x5, 0x1fc00000, 0x1, 0x0, 0x80, 0x78, 0x200, 0x6bc9, 0x8, 0x0, 0x6, 0x400, 0x8, 0xffff, 0x5, 0x80, 0x401, 0xd281, 0x1000, 0x5, 0x101, 0x3, 0x4, 0x9, 0x26b, 0x1, 0x2cd, 0x1, 0x7, 0x4, 0xc, 0xb, 0xfffffbff, 0x0, 0x6, 0x9, 0xa, 0x5, 0x4, 0x2, 0x2, 0xe8, 0x3, 0x6, 0xd108, 0x9, 0x5, 0x6, 0x8221, 0x2, 0xc, 0x1, 0x0, 0xfffffffe, 0x5, 0xfffffffe, 0x4, 0x6, 0x80000001, 0x800, 0x4, 0x0, 0x8, 0x0, 0x914, 0x1ff, 0xe9f8, 0x4, 0x8, 0x0, 0xbd, 0xfc, 0x3, 0x2, 0x5, 0x40, 0x4000, 0xffff, 0x2234a1cb, 0x1ff, 0x8, 0xffffffff, 0xa, 0x2fadef9d, 0x4, 0x9d0e, 0x9, 0x3, 0xdf, 0x95d9, 0x7, 0xfffffc01, 0x8000, 0x71, 0xe, 0xfffffffe, 0x371, 0x2c, 0x9, 0x9, 0x0, 0x3, 0xbb58, 0x4, 0xb92, 0x6, 0x3, 0x1, 0x80, 0x0, 0x11, 0x7, 0x3, 0xb24, 0x43a, 0x6580b588, 0xfff, 0x5, 0x8000, 0x1, 0xe, 0x7, 0x101, 0x5, 0x8c2, 0x0, 0x4, 0xfa4e, 0x4315, 0xffff, 0xce, 0x3, 0x6a17e01f, 0x404, 0x400, 0x97, 0x4, 0x5, 0x4, 0xfffffffc, 0x0, 0x8, 0x1, 0xce46, 0x4, 0x10, 0x9, 0x0, 0x6, 0x4, 0x77d88f19, 0xedf7, 0xfffffffa, 0xc, 0x106b, 0x9, 0x9, 0x3, 0x81, 0x1000, 0x9, 0x1, 0x9451, 0x5cd, 0xfffffff8, 0x8, 0x200, 0x6]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x2, 0x5, 0x7, 0x6, {0x1, 0x1, 0x83a7, 0x4, 0x8, 0x400}, {0x7, 0x0, 0x8, 0x3, 0x8, 0x8}, 0x3, 0x2, 0x9b5}}, @TCA_POLICE_RATE64={0xc, 0x8, 0xff}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x8}]}]}}, @TCA_RATE={0x6, 0x5, {0x87, 0x7}}, @TCA_CHAIN={0x8, 0xb, 0x8}, @TCA_CHAIN={0x8, 0xb, 0x2}]}, 0x4b8}, 0x1, 0x0, 0x0, 0x480c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@newtfilter={0x24, 0x2c, 0xd3f, 0x70bd23, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0xd, 0xfff2}, {0xfff1, 0xe}, {0x19, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0xc1}, 0x20040004) 417.304296ms ago: executing program 6 (id=1039): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0xaf, 0x80, 0x800, 0x4, 0x401}) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0xc055) 417.14816ms ago: executing program 7 (id=1040): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x11, 0x4, 0x4, 0x9, 0x0, 0x1}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x2, 0x4, 0x1, 0x0, r0}, 0x48) socket$inet6(0xa, 0x80003, 0xff) close(0x3) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x1c, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x274a5550, 0x0, 0x0, 0x0, 0x7ff}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@btf_id={0x18, 0x5, 0x3, 0x0, 0x2}, @jmp={0x5, 0x0, 0x7, 0x4, 0x2, 0xfffffffffffffffe, 0x10}, @map_val={0x18, 0x7, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x4}, @printk={@lli, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4cc8}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000001c0)='GPL\x00', 0x19b4c639, 0xc0, &(0x7f0000000200)=""/192, 0x41000, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000002c0)={0x5, 0x3}, 0x8, 0x10, &(0x7f0000000300)={0x4, 0x5, 0x10001, 0xe9b}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000340)=[r1, r0, r1, r0, 0xffffffffffffffff], &(0x7f0000000380)=[{0x3, 0x4, 0xd, 0x8}], 0x10, 0x5}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r0}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) 348.585747ms ago: executing program 6 (id=1041): socket$inet6(0xa, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xfffffffffffffe84}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x56ab, &(0x7f0000000040)={0x0, 0x36d, 0xc000, 0xc, 0xa0002f5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x7ffffffc, 0x9f69a7a086f70aee, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x3d, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x24, &(0x7f0000000000)=0xa, 0x4) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vxcan0\x00'}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x100007e) bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10) sendmsg$inet(r1, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x5}], 0x1}, 0x40) 346.513041ms ago: executing program 7 (id=1042): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, 0x1, 0x2, 0x101, 0x0, 0x0, {0x5, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4811}, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x140) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB="380000005400e50029bd7000fdffffff07000000", @ANYRES32=r5, @ANYBLOB="20000100", @ANYRES32=r7, @ANYBLOB="010101000000000000000000000000000000000186dd000040f652b5e9c30cb182ca7648a1904b599ad4e8a72ba7d1e13ed4fbec70f196072542f1d15c6ec423663d54b3e2b7fc2e6725116249c9307a490bb1d65d7f7eebf88feec177668b8efa452a94e59f3d"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000000)=0xf4e) writev(r2, &(0x7f0000019880)=[{&(0x7f0000000400)="fb", 0xffffff5c}, {&(0x7f00000197c0)="1902eb02d5e5f29e59e1a7caec33eb76d2430da474d87e367f6598d026438b65eda8341073b6752abdcee080c8e1e876b25227c37d7dd79886ce33f13e857c8eda1cecf6ac36c03dbf54e3cb5136da5a33fee76fb3113f8b6700e9e5fc006b8eed665fed48738d59395ad07438c3610ae3976aac75caf2facafa21c25be3c2", 0x7f}], 0x2) r8 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) write(r8, &(0x7f0000000200), 0x0) writev(r8, &(0x7f0000000100)=[{&(0x7f0000000200)='H\x00', 0x2}], 0x1) rename(0x0, &(0x7f0000000c40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r9 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x2, 0x0, [{0xf88e470f, 0xed, 0xce}, {0xb18, 0x0, 0xfc}]}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r11, 0x4090ae82, &(0x7f00000001c0)={[0x205, 0x6, 0x0, 0x0, 0x10003, 0x40, 0x400200cc4, 0xffd, 0x4, 0x0, 0x7, 0x0, 0x2, 0x0, 0x6a, 0x8d], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r11, 0xae80, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f00000001c0), 0x804010, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c626c050000000000000030303030300630303030303031343030247a"]) 251.561651ms ago: executing program 6 (id=1043): mknod$loop(&(0x7f0000001b80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) r0 = creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x93) sendmsg$AUDIT_MAKE_EQUIV(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000040)={0x210, 0x3f7, 0x400, 0x70bd2a, 0x25dfdbfc, {0xfb, 0xfa, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, ["", "", "", "", "", ""]}, 0x210}, 0x1, 0x0, 0x0, 0x8004}, 0x8040) renameat2(0xffffffffffffff9c, &(0x7f0000000380)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2) 250.363972ms ago: executing program 6 (id=1044): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x83a3, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x10, 0xfffffffe}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42400, 0x0) close(r2) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x42000, 0x0) r4 = socket(0x2d, 0x2, 0x0) close(0x3) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r5, 0x10040) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x42, &(0x7f0000000580)={@local, @multicast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3d, 0x34, 0x69, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0xc2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x2, 0x8}]}}}}}}}, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000480)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x78, 0xfffe, 0x0, 0x95, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x19, 0x40, 0xb, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x6, 0x7}, @md5sig={0x13, 0x12, "a16dc34416fcb1917fdf02dd82bbfc0e"}, @mptcp=@syn={0x1e, 0xc, 0x0, 0x1, 0x7, 0x5, 0x2}, @timestamp={0x8, 0xa, 0xffff, 0x3}, @mptcp=@mp_fclose={0x1e, 0xc, 0x4, 0x0, 0x6}, @mptcp=@synack={0x1e, 0x10, 0x7, 0x2, 0x80, 0x101, 0x4}]}}}}}}}, 0x0) r6 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(r6, &(0x7f0000000080)={&(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000300)="df", 0x1}], 0x1}, 0x10) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000200), &(0x7f0000000340)=0x8) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNGETVNETLE(r2, 0x4010744d, &(0x7f0000000180)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x1c, r1, 0x701, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) syz_genetlink_get_family_id$gtp(&(0x7f0000000240), r0) 240.146671ms ago: executing program 4 (id=1046): r0 = openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x0) r1 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) ioctl$MEMWRITEOOB(r1, 0xc0104d03, &(0x7f0000000080)={0x0, 0x0, 0x0}) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION(r2, 0x79f, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaaaa28dd00283afffe8000000000000000000000000000bbff0200000000000000000000000000018900907800000000fe8800000000000000000000000000010002122b472e41e24b11f34b608816e5420a364fcf9d983bb55fc7200189d6ae6b8c4b27178676a3f59130519e973ac5a5d5710f6e05deabd091047c6107000000f5325673230856b4da31f9284cab5bbc295b31021e70b901e5ab443a927bbe6d696f90ddbe4f5115d0d093b87fb3c557f61e4b3dc855e0689eb6b0daa6bac403a799f3a090c9729dd34084e8956008c4b1d3d9ca9763cdb2da4c2fb0bed205e912eb231caf03d623a2595be856c793e4ba234fcccd136a2e1cc935d0cf4cba315e8333560d6878bcb62e43851ad4c5b76b807f96875b5041"], 0x0) syz_emit_ethernet(0x365, &(0x7f0000000080)=ANY=[@ANYBLOB="0180c20000020180c200000086dd6000cd04032f3afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000501000000000000000000030da78c00007dd3f1624ddfc479c35205dc8080a20378c08e7b40e19e0f4db0d174bc0003004003493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af050200010000050000000000260004000018fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978051d06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00010000000000000b17dcea468000000000054740a5d4901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2bce9ac946a3f0e2bc4000091394c02bcfbbb7d71138537d68e2d2c6393a9f3cc271a9ff09a48b5b303f4f00e07b8a3e10000a3e1100000006f00ffc0ffff00000000600000ff0bc0fe000000000000000000000000d9a027440000000000000000000000000c5e14ccb44d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d260600aa89c8f267d76ece1c9f6ae2e1eb3d8bf9c6ab2642c4808298e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c"], 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) recvmmsg(r3, &(0x7f0000002e40)=[{{0x0, 0x0, 0x0}, 0x7d}], 0x1, 0x1822b, 0x0) setsockopt$inet6_int(r3, 0x29, 0x4d, &(0x7f0000000000)=0x8, 0x4) r4 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendto$inet6(r4, &(0x7f0000000040), 0x3000, 0x0, 0x0, 0x0) file_setattr(r0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x2108, 0xfffffff8, 0x10000, 0x7f, 0x8}, 0x18, 0x400) 67.38328ms ago: executing program 4 (id=1047): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140008001000010000000000000000000000000a58000000062b0b040000000000000000020000002c000480170001800a0001006d617463680000001800028008000240000000000400070008000100407066000900010073797a30000000000900020073797a3200000000140000001100010000000000000001000000000a"], 0x80}}, 0x4048010) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_load_code={0x12e, 0x19, {0x0, "f4"}}], 0x31}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f00000005c0)="0f1cbe0000ba6100b05eee440f20c066350900000044070722c0b838000f00d8ba400066b80000000066eff4d09800000f4da2ee005df2ab", 0x38}], 0x1, 0x15, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x101fd, 0x5, 0x100000, 0x2000, &(0x7f0000003000/0x2000)=nil}) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000180), &(0x7f00000004c0)='./file0\x00', 0x8, 0x1) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf7}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x8, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x5}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 66.946567ms ago: executing program 6 (id=1048): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/self/make-it-fail\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='1\n\x00', 0x2) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="180b0000020000000800000000000000950000000000000056b5336aae489e778db4d952bcb724f6c07f60eaccf94375edd4b2f9fe9e7d360f1501456154ff1720a55bccce2985f60bfeedb6d06cf5660ffdd9"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000100)='6\n\x00', 0x2) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000000200)={r2, 0x0, 0xe, 0x0, &(0x7f0000000300)="00112233445566778899aabbccdd", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x50) write(r3, &(0x7f0000000100)='5\n\x00', 0x2) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000000200)={r2, 0x0, 0xe, 0x0, &(0x7f0000000300)="00112233445566778899aabbccdd", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x50) write(r3, &(0x7f0000000100)='4\n\x00', 0x2) write(r3, &(0x7f0000000100)='7\n\x00', 0x2) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000000200)={r2, 0x0, 0xe, 0x0, &(0x7f0000000300)="00112233445566778899aabbccdd", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x50) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=@gettfilter={0x54, 0x2e, 0x4, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0x2}, {0x0, 0x1}, {0xffe0, 0x10}}, [{0x8, 0xb, 0x7}, {0x8, 0xb, 0x5}, {0x8, 0xb, 0x2}, {0x8, 0xb, 0x6ddfdf84}, {0x8, 0xb, 0x7}, {0x8, 0xb, 0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x840}, 0x4000000) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYRES32=r7, @ANYBLOB="1000018004000480080001"], 0x28}}, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) bind$netlink(r5, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r4, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000010000d042abd7000077bf70000000000", @ANYRES32=r8, @ANYRESHEX=r8], 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x20000000) socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) 0s ago: executing program 6 (id=1049): mkdir(&(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000300)='exofs\x00', 0x0, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x4, &(0x7f0000001a40)=@framed={{0x18, 0x0, 0x0, 0x0, 0xc4f, 0x0, 0x0, 0x0, 0xffffbffc}, [@ldst={0x1, 0x0, 0x4, 0x6, 0x1, 0x28}]}, &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x18, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r1, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r3 = getuid() syz_open_dev$usbmon(&(0x7f0000000180), 0x200, 0x101000) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000240)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xee01}}, './config\x00'}) r6 = socket$netlink(0x10, 0x3, 0xa) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) mount$bpf(0x0, &(0x7f0000000100)='./cgroup\x00', &(0x7f0000000000), 0x808, &(0x7f0000000880)=ANY=[@ANYBLOB='5id}', @ANYRESHEX=r7, @ANYBLOB=',\x00']) mount$fuse(0x0, &(0x7f0000000140)='./config\x00', &(0x7f00000001c0), 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=r3, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB="2c614f6c6f775f6f746865722c416c6c6f775f6f746865722c00000000000000056865722c666f776e653526b929f4ab1aa0b0d656723e", @ANYRESDEC=r7, @ANYBLOB="2c61707072616973652c646f6e745f6d6561737572652c7375626a5f747970653deb247d5b2c00"]) r8 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1, 0x0) write(r8, &(0x7f0000000000)="f07693290c53b46ceaece1c0deb64ce3b35b33e4d8894998e029f0840bcda5a37dfd016b013c0a2eef647a65e7", 0x2d) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r12 = syz_init_net_socket$x25(0x9, 0x5, 0x0) accept4$x25(r12, 0x0, 0x0, 0x80000) syz_kvm_setup_cpu$x86(r10, r8, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x43, &(0x7f0000000300)=[@vmwrite={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000280)={0x0, 0x8}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000440)={r13, 0x3ff, 0x2d7, 0x14cf}, 0x10) r14 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0) close(r14) ioctl$KVM_RUN(r11, 0xae80, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) kernel console output (not intermixed with test programs): [ T64] Bluetooth: hci3: command tx timeout [ 92.424869][ T7450] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.448'. [ 92.431497][ T7450] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.448'. [ 92.444202][ T7450] warning: `syz.3.448' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 92.454355][ T42] audit: type=1400 audit(1785891315.964:641): avc: denied { write } for pid=7448 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 92.471505][ T42] audit: type=1400 audit(1785891315.984:642): avc: denied { mounton } for pid=7455 comm="syz.4.449" path="/26/sys" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 92.549142][ T42] audit: type=1400 audit(1785891316.064:643): avc: denied { write } for pid=7461 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 92.567106][ T5882] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 92.646972][ T42] audit: type=1400 audit(1785891316.164:644): avc: denied { read } for pid=7470 comm="syz.4.452" name="ppp" dev="devtmpfs" ino=731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 92.654440][ T42] audit: type=1400 audit(1785891316.164:645): avc: denied { open } for pid=7470 comm="syz.4.452" path="/dev/ppp" dev="devtmpfs" ino=731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 92.664080][ T42] audit: type=1400 audit(1785891316.164:646): avc: denied { mount } for pid=7470 comm="syz.4.452" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 92.725609][ T5882] usb 7-1: Using ep0 maxpacket: 32 [ 92.728849][ T5882] usb 7-1: config index 0 descriptor too short (expected 15270, got 18) [ 92.733407][ T5882] usb 7-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 92.737040][ T5882] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.739745][ T5882] usb 7-1: Product: syz [ 92.741164][ T5882] usb 7-1: Manufacturer: syz [ 92.742952][ T5882] usb 7-1: SerialNumber: syz [ 92.755157][ T5882] usb 7-1: config 0 descriptor?? [ 92.759365][ T5882] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 92.762185][ T5882] dvb-usb: bulk message failed: -22 (4/0) [ 92.764282][ T5882] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 92.768310][ T5882] dvb-usb: bulk message failed: -22 (5/0) [ 92.771578][ T5882] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 92.786708][ T5882] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 92.790149][ T5882] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 92.792797][ T5882] usb 7-1: media controller created [ 92.796859][ T42] audit: type=1400 audit(1785891316.315:647): avc: denied { unmount } for pid=7035 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 92.803752][ T5882] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 92.819818][ T5882] usb 7-1: selecting invalid altsetting 3 [ 92.821705][ T5882] ttusb2: set interface to alts=3 failed [ 92.847472][ T5882] DVB: Unable to find symbol tda10086_attach() [ 92.849396][ T5882] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 92.852558][ T5882] dvb-usb: bulk message failed: -22 (4/0) [ 92.854439][ T5882] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 92.858165][ T5882] dvb-usb: bulk message failed: -22 (5/0) [ 92.860070][ T5882] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 92.863246][ T5882] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 92.892042][ T7486] netlink: 4 bytes leftover after parsing attributes in process `syz.4.454'. [ 92.901060][ T7486] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7486 comm=syz.4.454 [ 92.961599][ T7440] dvb-usb: bulk message failed: -22 (7/0) [ 92.965636][ T7440] ttusb2: there might have been an error during control message transfer. (rlen = 3, was 0) [ 92.969907][ T7440] ttusb2: i2c transfer failed. [ 92.983663][ T42] audit: type=1400 audit(1785891316.495:648): avc: denied { cmd } for pid=7437 comm="iou-wrk-7440" path="/dev/ublk-control" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 93.079730][ T7496] syzkaller0: entered promiscuous mode [ 93.080239][ T848] usb 7-1: USB disconnect, device number 9 [ 93.081524][ T7496] syzkaller0: entered allmulticast mode [ 93.136330][ T848] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 93.764068][ T7509] kvm: pic: single mode not supported [ 93.764099][ T7509] kvm: pic: level sensitive irq not supported [ 93.964240][ T7514] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 94.629034][ T7524] FAULT_INJECTION: forcing a failure. [ 94.629034][ T7524] name failslab, interval 1, probability 0, space 0, times 0 [ 94.634394][ T7524] CPU: 2 UID: 0 PID: 7524 Comm: syz.3.465 Not tainted syzkaller #0 PREEMPT(full) [ 94.634420][ T7524] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.634431][ T7524] Call Trace: [ 94.634458][ T7524] [ 94.634467][ T7524] dump_stack_lvl+0x100/0x190 [ 94.634515][ T7524] should_fail_ex.cold+0x5/0xa [ 94.634552][ T7524] should_failslab+0xc2/0x120 [ 94.634587][ T7524] kmem_cache_alloc_noprof+0x91/0x6a0 [ 94.634616][ T7524] ? vhost_task_create+0x1db/0x370 [ 94.634642][ T7524] ? kvm_mmu_post_init_vm+0x1b3/0x360 [ 94.634676][ T7524] ? kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 94.634714][ T7524] ? alloc_pid+0x1bd/0x1910 [ 94.634747][ T7524] alloc_pid+0x1bd/0x1910 [ 94.634768][ T7524] ? __pfx_alloc_pid+0x10/0x10 [ 94.634794][ T7524] ? __lock_acquire+0x49f/0x1a40 [ 94.634825][ T7524] ? avc_has_perm_noaudit+0x145/0x3b0 [ 94.634872][ T7524] ? fpu_clone+0x226/0x7a0 [ 94.634902][ T7524] ? copy_thread+0x729/0xbe0 [ 94.634930][ T7524] copy_process+0x5485/0x8030 [ 94.634977][ T7524] ? __pfx_copy_process+0x10/0x10 [ 94.635003][ T7524] ? __kasan_kmalloc+0xaa/0xb0 [ 94.635024][ T7524] ? lockdep_init_map_type+0x5c/0x250 [ 94.635049][ T7524] ? lockdep_init_map_type+0x5c/0x250 [ 94.635073][ T7524] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 94.635093][ T7524] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 94.635124][ T7524] vhost_task_create+0x1db/0x370 [ 94.635146][ T7524] ? __pfx_vhost_task_create+0x10/0x10 [ 94.635172][ T7524] ? __pfx_vhost_task_fn+0x10/0x10 [ 94.635195][ T7524] ? __pfx___mutex_lock+0x10/0x10 [ 94.635249][ T7524] ? kasan_quarantine_put+0x104/0x240 [ 94.635276][ T7524] kvm_mmu_post_init_vm+0x1b3/0x360 [ 94.635304][ T7524] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 94.635330][ T7524] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 94.635366][ T7524] kvm_vcpu_ioctl+0x730/0x1700 [ 94.635389][ T7524] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 94.635424][ T7524] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 94.635458][ T7524] ? do_vfs_ioctl+0x226/0x13e0 [ 94.635494][ T7524] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.635520][ T7524] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 94.635562][ T7524] ? __fget_files+0x215/0x3d0 [ 94.635589][ T7524] ? hook_file_ioctl_common+0x140/0x440 [ 94.635624][ T7524] ? selinux_file_ioctl+0x13b/0x290 [ 94.635651][ T7524] ? selinux_file_ioctl+0xb6/0x290 [ 94.635679][ T7524] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 94.635700][ T7524] __x64_sys_ioctl+0x18e/0x210 [ 94.635727][ T7524] do_syscall_64+0x115/0x870 [ 94.635754][ T7524] ? clear_bhb_loop+0x40/0x90 [ 94.635779][ T7524] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.635797][ T7524] RIP: 0033:0x7f006ff9df99 [ 94.635813][ T7524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.635830][ T7524] RSP: 002b:00007f0070ee9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.635867][ T7524] RAX: ffffffffffffffda RBX: 00007f0070225fa0 RCX: 00007f006ff9df99 [ 94.635880][ T7524] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 94.635890][ T7524] RBP: 00007f0070ee9090 R08: 0000000000000000 R09: 0000000000000000 [ 94.635901][ T7524] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 94.635910][ T7524] R13: 00007f0070226038 R14: 00007f0070225fa0 R15: 00007fffee785a38 [ 94.635936][ T7524] [ 95.814650][ T7479] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 95.916712][ T7534] netlink: 28 bytes leftover after parsing attributes in process `syz.2.470'. [ 95.937533][ T64] Bluetooth: hci1: unexpected event for opcode 0x202d [ 95.957590][ T5737] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 95.964391][ T5737] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 95.973698][ T5737] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 95.978180][ T7535] kvm: pic: level sensitive irq not supported [ 95.980015][ T5737] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 95.985846][ T5737] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 96.274684][ T7536] xfrm0 speed is unknown, defaulting to 1000 [ 96.340543][ T5833] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 96.349700][ T7568] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 96.355424][ T7570] netlink: 28 bytes leftover after parsing attributes in process `syz.3.478'. [ 96.356920][ T5833] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.397050][ T64] Bluetooth: hci2: unexpected event for opcode 0x202d [ 96.473714][ T5833] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 96.478755][ T5833] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.570190][ T5833] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 96.581461][ T5833] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.615707][ T7572] could not allocate digest TFM handle xcbc(camellia-asm) [ 96.645831][ T7536] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.649328][ T7536] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.652546][ T7536] bridge_slave_0: entered allmulticast mode [ 96.660083][ T7536] bridge_slave_0: entered promiscuous mode [ 96.668502][ T7536] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.671667][ T7536] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.674865][ T7536] bridge_slave_1: entered allmulticast mode [ 96.683881][ T7536] bridge_slave_1: entered promiscuous mode [ 96.719238][ T7536] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.739371][ T7598] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 96.747735][ T7536] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.750656][ T7601] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 96.758452][ T5833] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 96.759819][ T7601] overlayfs: NFS export requires an index dir, falling back to nfs_export=off. [ 96.761699][ T5833] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.766992][ T64] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 96.786368][ T1045] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 96.837748][ T7536] team0: Port device team_slave_0 added [ 96.846804][ T7536] team0: Port device team_slave_1 added [ 96.874445][ T7536] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.879458][ T7536] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.890250][ T7536] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.896162][ T7536] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.899058][ T7536] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.910244][ T7536] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.941122][ T7614] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2525402522 (323251522816 ns) > initial count (185678303104 ns). Using initial count to start timer. [ 96.945627][ T7536] hsr_slave_0: entered promiscuous mode [ 96.950937][ T7536] hsr_slave_1: entered promiscuous mode [ 96.953125][ T7536] debugfs: 'hsr0' already exists in 'hsr' [ 96.956559][ T7536] Cannot create hsr debugfs directory [ 96.991042][ T5811] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.050527][ T5811] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.095758][ T5811] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.125927][ T5811] netdevsim netdevsim1 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.166696][ T5833] bridge_slave_1: left allmulticast mode [ 97.171318][ T5833] bridge_slave_1: left promiscuous mode [ 97.175324][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.185422][ T5833] bridge_slave_0: left allmulticast mode [ 97.187831][ T5833] bridge_slave_0: left promiscuous mode [ 97.191862][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.342169][ T5833] bond2 (unregistering): (slave gretap1): Releasing active interface [ 97.373446][ T5833] bond0 (unregistering): left promiscuous mode [ 97.375397][ T5833] bond_slave_0: left promiscuous mode [ 97.377156][ T5833] bond_slave_1: left promiscuous mode [ 97.379019][ T5833] team0: left promiscuous mode [ 97.380568][ T5833] team_slave_0: left promiscuous mode [ 97.382598][ T5833] team_slave_1: left promiscuous mode [ 97.386232][ T5833] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 97.392321][ T5833] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 97.398131][ T5833] bond0 (unregistering): (slave team0): Releasing backup interface [ 97.402788][ T5833] bond0 (unregistering): Released all slaves [ 97.408683][ T5833] bond1 (unregistering): Released all slaves [ 97.421504][ T5833] bond2 (unregistering): Released all slaves [ 97.459916][ T7628] A link change request failed with some changes committed already. Interface ipvlan0 may have been left with an inconsistent configuration, please check. [ 97.592938][ T42] kauditd_printk_skb: 10 callbacks suppressed [ 97.592955][ T42] audit: type=1400 audit(1785891321.118:659): avc: denied { write } for pid=7637 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.674372][ T42] audit: type=1400 audit(1785891321.208:660): avc: denied { write } for pid=7640 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.697451][ T7536] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 97.713076][ T7536] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.720133][ T7536] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 97.727277][ T7536] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.736698][ T7536] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 97.747859][ T7536] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.765494][ T7536] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 97.770434][ T7536] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.780796][ T5446] 8021q: adding VLAN 0 to HW filter on device eth1 [ 97.791741][ T40] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 97.853186][ T7536] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.859058][ T5833] batadv0: left promiscuous mode [ 97.869476][ T5833] hsr_slave_0: left promiscuous mode [ 97.875293][ T5833] hsr_slave_1: left promiscuous mode [ 97.877261][ T5833] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 97.881802][ T5833] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 97.885683][ T5833] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 97.888606][ T5833] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 97.897473][ T42] audit: type=1400 audit(1785891321.429:661): avc: denied { write } for pid=7649 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.905604][ T5833] veth1_macvtap: left promiscuous mode [ 97.908607][ T5833] veth0_macvtap: left promiscuous mode [ 97.910902][ T5833] veth1_vlan: left promiscuous mode [ 97.914495][ T5833] veth0_vlan: left promiscuous mode [ 97.942829][ T40] usb 7-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 0, changing to 4 [ 97.946244][ T40] usb 7-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 97.949915][ T40] usb 7-1: config 0 interface 0 has no altsetting 0 [ 97.955881][ T40] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 97.959013][ T40] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 97.961952][ T40] usb 7-1: Product: syz [ 97.963401][ T40] usb 7-1: Manufacturer: syz [ 97.964959][ T40] usb 7-1: SerialNumber: syz [ 97.967343][ T42] audit: type=1400 audit(1785891321.499:662): avc: denied { write } for pid=7652 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.969465][ T40] usb 7-1: config 0 descriptor?? [ 97.984231][ T40] usb 7-1: selecting invalid altsetting 0 [ 98.002093][ T64] Bluetooth: hci4: command tx timeout [ 98.192481][ T40] usb 7-1: USB disconnect, device number 10 [ 98.283738][ T5833] team0 (unregistering): Port device team_slave_1 removed [ 98.306085][ T5833] team0 (unregistering): Port device team_slave_0 removed [ 98.359966][ T7610] kexec: Could not allocate control_code_buffer [ 98.460163][ T5446] 8021q: adding VLAN 0 to HW filter on device eth2 [ 98.467037][ T7669] efs: device does not support 512 byte blocks [ 98.471125][ T7669] device does not support 512 byte blocks [ 98.471125][ T7669] [ 98.479797][ T7536] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.483226][ T7666] faux_driver vkms: [drm] Unknown color mode 2048; guessing buffer size. [ 98.483743][ T7669] efs: device does not support 512 byte blocks [ 98.489578][ T7669] device does not support 512 byte blocks [ 98.489578][ T7669] [ 98.504783][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.508235][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.535073][ T1175] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.538137][ T1175] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.556828][ T7674] netlink: 28 bytes leftover after parsing attributes in process `syz.3.500'. [ 98.567620][ T64] Bluetooth: hci2: unexpected event for opcode 0x202d [ 98.617175][ T42] audit: type=1400 audit(1785891322.150:663): avc: denied { write } for pid=7675 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 98.651669][ T42] audit: type=1400 audit(1785891322.150:664): avc: denied { write } for pid=7677 comm="syz.3.501" name="usb_gadget" dev="configfs" ino=6245 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 98.662700][ T42] audit: type=1400 audit(1785891322.150:665): avc: denied { write } for pid=7677 comm="syz.3.501" name="functions" dev="configfs" ino=22434 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 98.671518][ T42] audit: type=1400 audit(1785891322.180:666): avc: denied { write } for pid=7677 comm="syz.3.501" name="uncompressed" dev="configfs" ino=22456 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 98.744281][ T42] audit: type=1400 audit(1785891322.281:667): avc: denied { write } for pid=7686 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 98.799729][ T42] audit: type=1400 audit(1785891322.341:668): avc: denied { append } for pid=7688 comm="syz.3.502" name="nullb0" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 98.821337][ T5446] 8021q: adding VLAN 0 to HW filter on device eth3 [ 98.871437][ T7699] tmpfs: Bad value for 'mpol' [ 98.890515][ T7689] kvm: pic: single mode not supported [ 98.890546][ T7689] kvm: pic: level sensitive irq not supported [ 98.928096][ T7706] netlink: 'syz.4.505': attribute type 3 has an invalid length. [ 98.951357][ T7706] netlink: 64 bytes leftover after parsing attributes in process `syz.4.505'. [ 98.993598][ T7536] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.086938][ T7724] netlink: 28 bytes leftover after parsing attributes in process `syz.2.508'. [ 99.092458][ T5446] 8021q: adding VLAN 0 to HW filter on device eth4 [ 99.100949][ T64] Bluetooth: hci1: unexpected event for opcode 0x202d [ 99.255409][ T7536] veth0_vlan: entered promiscuous mode [ 99.277384][ T7536] veth1_vlan: entered promiscuous mode [ 99.311990][ T7536] veth0_macvtap: entered promiscuous mode [ 99.319223][ T7536] veth1_macvtap: entered promiscuous mode [ 99.334884][ T7536] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.346848][ T64] Bluetooth: hci1: unexpected event for opcode 0x2035 [ 99.348993][ T7536] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.357314][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.365868][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.381306][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.387112][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.472770][ T1166] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.477523][ T1166] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.514472][ T109] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.517947][ T109] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.524655][ T7758] program syz.3.516 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 99.572805][ T7762] iommufd_mock iommufd_mock0: Adding to iommu group 2 [ 99.581575][ T7761] iommufd_mock iommufd_mock1: Adding to iommu group 9 [ 99.815932][ T7792] netlink: 16 bytes leftover after parsing attributes in process `syz.5.527'. [ 99.817256][ T7794] IPVS: set_ctl: invalid protocol: 113 172.20.20.170:20003 [ 99.951686][ T7809] veth1_to_bond: mtu less than device minimum [ 100.000843][ T7815] ip6gre1: entered promiscuous mode [ 100.002830][ T7815] ip6gre1: entered allmulticast mode [ 100.003517][ T7816] netlink: 28 bytes leftover after parsing attributes in process `syz.5.533'. [ 100.171964][ T7826] vcan0: tx address claim with dest, not broadcast [ 100.430679][ T7840] dlm: no locking on control device [ 100.876349][ T12] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 100.881181][ T12] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 100.907146][ T5845] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 101.085169][ T5845] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 101.115168][ T5845] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 101.165029][ T7843] netlink: 28 bytes leftover after parsing attributes in process `syz.4.542'. [ 101.231787][ T7849] netlink: 100 bytes leftover after parsing attributes in process `syz.3.541'. [ 101.236125][ T7849] team0: No ports can be present during mode change [ 101.327160][ T7854] netlink: 112 bytes leftover after parsing attributes in process `syz.4.545'. [ 101.590070][ T7863] netlink: 68 bytes leftover after parsing attributes in process `syz.4.548'. [ 101.781897][ T7871] netlink: 28 bytes leftover after parsing attributes in process `syz.4.551'. [ 101.934167][ T7880] netlink: 14 bytes leftover after parsing attributes in process `syz.4.554'. [ 102.084120][ T64] Bluetooth: hci4: command tx timeout [ 102.085698][ T7890] netlink: 8 bytes leftover after parsing attributes in process `syz.4.557'. [ 102.091277][ T7890] netlink: 60 bytes leftover after parsing attributes in process `syz.4.557'. [ 102.366896][ T7900] netlink: 28 bytes leftover after parsing attributes in process `syz.5.561'. [ 102.602389][ T7917] netlink: 'syz.4.565': attribute type 1 has an invalid length. [ 102.605161][ T7918] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7918 comm=syz.4.565 [ 102.680633][ T7933] netlink: 28 bytes leftover after parsing attributes in process `syz.4.570'. [ 102.695855][ T7931] usb usb2: usbfs: interface 0 claimed by hub while 'syz.3.569' sets config #0 [ 102.857221][ T48] Bluetooth: hci0: Frame reassembly failed (-84) [ 102.868638][ T7957] Bluetooth: hci0: Frame reassembly failed (-84) [ 102.938692][ T7970] misc userio: Can't change port type on an already running userio instance [ 103.059056][ T7979] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 103.062417][ T7979] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 103.067018][ T7980] overlayfs: inode number too big (/, ino=4611686018427387905, xinobits=3) [ 103.111916][ T7982] PID 7982 killed due to inadequate hugepage pool [ 103.113229][ T7982] netlink: 'syz.4.585': attribute type 1 has an invalid length. [ 103.136046][ T7982] bond2: entered promiscuous mode [ 103.136432][ T7982] 8021q: adding VLAN 0 to HW filter on device bond2 [ 103.137672][ T7990] overlayfs: failed to decode file handle (len=8, type=8192, flags=0, err=-22) [ 103.138085][ T7990] overlay: filesystem on ./file0 not supported as upperdir [ 103.195573][ T42] kauditd_printk_skb: 23 callbacks suppressed [ 103.195589][ T42] audit: type=1400 audit(1785891326.739:692): avc: denied { setopt } for pid=7993 comm="syz.4.590" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 103.457977][ T42] audit: type=1400 audit(1785891327.000:693): avc: denied { create } for pid=8022 comm="syz.5.598" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 103.466062][ T42] audit: type=1400 audit(1785891327.000:694): avc: denied { write } for pid=8022 comm="syz.5.598" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 103.497675][ T8028] openvswitch: netlink: Actions may not be safe on all matching packets [ 103.516521][ T42] audit: type=1400 audit(1785891327.060:695): avc: denied { setopt } for pid=8027 comm="syz.5.600" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 103.533755][ T42] audit: type=1400 audit(1785891327.070:696): avc: denied { cmd } for pid=8027 comm="syz.5.600" path="socket:[27567]" dev="sockfs" ino=27567 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 103.544672][ T42] audit: type=1400 audit(1785891327.090:697): avc: denied { unmount } for pid=7536 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 103.724964][ T8042] trusted_key: syz.4.607 sent an empty control message without MSG_MORE. [ 103.731421][ T8044] set match dimension is over the limit! [ 103.858717][ T8049] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 103.866709][ T8049] VFS: Can't find a romfs filesystem on dev nullb0. [ 103.866709][ T8049] [ 103.966217][ T42] audit: type=1400 audit(1785891327.510:698): avc: denied { mmap_zero } for pid=8056 comm="syz.4.613" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 104.149577][ T5737] Bluetooth: hci4: command tx timeout [ 104.507626][ T8072] syzkaller1: entered promiscuous mode [ 104.512851][ T8072] syzkaller1: entered allmulticast mode [ 104.871040][ T5737] Bluetooth: hci0: command 0x1003 tx timeout [ 104.871193][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 104.883696][ T64] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 104.891835][ T42] audit: type=1400 audit(1785891328.442:699): avc: denied { ioctl } for pid=8083 comm="syz.3.620" path="socket:[25039]" dev="sockfs" ino=25039 ioctlcmd=0x9367 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 104.917563][ T8084] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=8084 comm=syz.3.620 [ 104.930042][ T8084] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=8084 comm=syz.3.620 [ 104.949191][ T42] audit: type=1326 audit(1785891328.502:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8085 comm="syz.4.621" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0f5d59df99 code=0x0 [ 105.025922][ T42] audit: type=1400 audit(1785891328.572:701): avc: denied { map } for pid=8087 comm="syz.2.623" path="/dev/sg0" dev="devtmpfs" ino=722 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 105.030959][ T8090] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8090 comm=syz.3.622 [ 105.055609][ T8092] vhci_hcd: not connected 4 [ 105.154883][ T8095] kvm: pic: level sensitive irq not supported [ 105.155422][ T8103] 9p: Unknown uid 00000000004294967295 [ 106.098627][ T8155] tmpfs: Bad value for 'mpol' [ 106.148401][ T8161] syz.5.645: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 106.155242][ T8161] CPU: 3 UID: 0 PID: 8161 Comm: syz.5.645 Tainted: G L syzkaller #0 PREEMPT(full) [ 106.155273][ T8161] Tainted: [L]=SOFTLOCKUP [ 106.155279][ T8161] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.155289][ T8161] Call Trace: [ 106.155314][ T8161] [ 106.155320][ T8161] dump_stack_lvl+0x100/0x190 [ 106.155368][ T8161] warn_alloc.cold+0x94/0xa8 [ 106.155387][ T8161] ? __pfx_warn_alloc+0x10/0x10 [ 106.155415][ T8161] ? register_lock_class+0x40/0x560 [ 106.155448][ T8161] ? kasan_save_stack+0x3f/0x50 [ 106.155476][ T8161] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 106.155503][ T8161] ? xskq_create+0x52/0x1d0 [ 106.155531][ T8161] ? xsk_setsockopt+0x743/0xab0 [ 106.155556][ T8161] ? do_sock_setsockopt+0xf3/0x1d0 [ 106.155587][ T8161] ? __sys_setsockopt+0x195/0x220 [ 106.155612][ T8161] ? __x64_sys_setsockopt+0xbd/0x160 [ 106.155634][ T8161] ? do_syscall_64+0x115/0x870 [ 106.155661][ T8161] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.155685][ T8161] ? xskq_create+0xfb/0x1d0 [ 106.155700][ T8161] __vmalloc_node_range_noprof+0x136c/0x1630 [ 106.155752][ T8161] ? xskq_create+0xfb/0x1d0 [ 106.155776][ T8161] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 106.155804][ T8161] ? kasan_save_track+0x14/0x30 [ 106.155823][ T8161] ? __kasan_kmalloc+0xaa/0xb0 [ 106.155844][ T8161] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 106.155871][ T8161] ? xskq_create+0xfb/0x1d0 [ 106.155886][ T8161] vmalloc_user_noprof+0x9e/0xe0 [ 106.155915][ T8161] ? xskq_create+0xfb/0x1d0 [ 106.155931][ T8161] xskq_create+0xfb/0x1d0 [ 106.155949][ T8161] xsk_setsockopt+0x743/0xab0 [ 106.155991][ T8161] ? __pfx_xsk_setsockopt+0x10/0x10 [ 106.156014][ T8161] ? find_held_lock+0x2b/0x80 [ 106.156037][ T8161] ? __fget_files+0x215/0x3d0 [ 106.156063][ T8161] ? selinux_socket_setsockopt+0x6a/0x80 [ 106.156091][ T8161] ? __pfx_xsk_setsockopt+0x10/0x10 [ 106.156114][ T8161] do_sock_setsockopt+0xf3/0x1d0 [ 106.156137][ T8161] __sys_setsockopt+0x195/0x220 [ 106.156158][ T8161] __x64_sys_setsockopt+0xbd/0x160 [ 106.156174][ T8161] ? do_syscall_64+0x90/0x870 [ 106.156189][ T8161] ? lockdep_hardirqs_on+0x78/0x100 [ 106.156211][ T8161] do_syscall_64+0x115/0x870 [ 106.156226][ T8161] ? clear_bhb_loop+0x40/0x90 [ 106.156243][ T8161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.156258][ T8161] RIP: 0033:0x7f34ac99df99 [ 106.156271][ T8161] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.156285][ T8161] RSP: 002b:00007f34ad950028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 106.156315][ T8161] RAX: ffffffffffffffda RBX: 00007f34acc25fa0 RCX: 00007f34ac99df99 [ 106.156324][ T8161] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004 [ 106.156333][ T8161] RBP: 00007f34aca34ec4 R08: 0000000000000029 R09: 0000000000000000 [ 106.156342][ T8161] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 106.156350][ T8161] R13: 00007f34acc26038 R14: 00007f34acc25fa0 R15: 00007ffe5a5ea688 [ 106.156370][ T8161] [ 106.182608][ T8161] Mem-Info: [ 106.282000][ T8161] active_anon:9941 inactive_anon:38 isolated_anon:0 [ 106.282000][ T8161] active_file:31 inactive_file:61893 isolated_file:0 [ 106.282000][ T8161] unevictable:1768 dirty:310 writeback:0 [ 106.282000][ T8161] slab_reclaimable:12047 slab_unreclaimable:71454 [ 106.282000][ T8161] mapped:25292 shmem:2067 pagetables:1428 [ 106.282000][ T8161] sec_pagetables:295 bounce:0 [ 106.282000][ T8161] kernel_misc_reclaimable:0 [ 106.282000][ T8161] free:375750 free_pcp:7035 free_cma:0 [ 106.300002][ T8161] Node 0 active_anon:39432kB inactive_anon:152kB active_file:124kB inactive_file:247368kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:101124kB dirty:1232kB writeback:0kB shmem:4724kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11072kB pagetables:4608kB sec_pagetables:1180kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 106.301913][ T8171] __nla_validate_parse: 14 callbacks suppressed [ 106.301929][ T8171] netlink: 80 bytes leftover after parsing attributes in process `syz.2.647'. [ 106.314032][ T8161] Node 1 active_anon:332kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:44kB dirty:8kB writeback:0kB shmem:3544kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:416kB pagetables:1104kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 106.314098][ T8161] Node 0 DMA free:5260kB boost:0kB min:340kB low:424kB high:508kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:360kB local_pcp:128kB free_cma:0kB [ 106.314144][ T8161] lowmem_reserve[]: 0 1225 1225 1225 1225 [ 106.314173][ T8161] Node 0 DMA32 free:30252kB boost:0kB min:27396kB low:34244kB high:41092kB reserved_highatomic:0KB free_highatomic:0KB active_anon:39428kB inactive_anon:152kB active_file:124kB inactive_file:247368kB unevictable:3536kB writepending:1232kB zspages:0kB present:2080628kB managed:1255244kB mlocked:0kB bounce:0kB free_pcp:11108kB local_pcp:8496kB free_cma:0kB [ 106.357241][ T8161] lowmem_reserve[]: 0 0 0 0 0 [ 106.359637][ T8161] Node 1 Normal free:1439884kB boost:0kB min:39840kB low:49800kB high:59760kB reserved_highatomic:0KB free_highatomic:0KB active_anon:332kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:3536kB writepending:8kB zspages:0kB present:2097152kB managed:1781884kB mlocked:0kB bounce:0kB free_pcp:16436kB local_pcp:2828kB free_cma:0kB [ 106.372210][ T8161] lowmem_reserve[]: 0 0 0 0 0 [ 106.374199][ T8161] Node 0 DMA: 1*4kB (M) 1*8kB (U) 2*16kB (UM) 1*32kB (M) 1*64kB (M) 2*128kB (UM) 1*256kB (M) 1*512kB (M) 2*1024kB (UM) 1*2048kB (M) 0*4096kB = 5260kB [ 106.380516][ T8161] Node 0 DMA32: 26*4kB (UM) 46*8kB (UM) 120*16kB (UME) 94*32kB (UME) 71*64kB (ME) 40*128kB (ME) 22*256kB (ME) 20*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 30936kB [ 106.387711][ T8161] Node 1 Normal: 1*4kB (U) 1*8kB (U) 1*16kB (M) 1*32kB (M) 2*64kB (UE) 0*128kB 0*256kB 1*512kB (E) 2*1024kB (UE) 2*2048kB (ME) 348*4096kB (M) = 1432252kB [ 106.395200][ T8161] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 106.399594][ T8161] Node 0 hugepages_total=4 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 106.403416][ T8161] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 106.407228][ T8161] Node 1 hugepages_total=1 hugepages_free=0 hugepages_surp=1 hugepages_size=2048kB [ 106.410954][ T8161] 63212 total pagecache pages [ 106.412899][ T8161] 0 pages in swap cache [ 106.414624][ T8161] Free swap = 124996kB [ 106.416475][ T8161] Total swap = 124996kB [ 106.418190][ T8161] 1048443 pages RAM [ 106.419761][ T8161] 0 pages HighMem/MovableOnly [ 106.421679][ T8161] 285321 pages reserved [ 106.423442][ T8161] 0 pages cma reserved [ 106.602589][ T8187] netlink: 868 bytes leftover after parsing attributes in process `syz.5.652'. [ 106.638818][ T8187] netlink: 868 bytes leftover after parsing attributes in process `syz.5.652'. [ 106.654024][ T8187] netlink: 868 bytes leftover after parsing attributes in process `syz.5.652'. [ 106.833094][ T64] Bluetooth: hci2: unexpected event for opcode 0x1408 [ 106.886642][ T8205] netlink: 40 bytes leftover after parsing attributes in process `syz.3.657'. [ 107.064683][ T173] Bluetooth: hci0: Frame reassembly failed (-84) [ 107.468726][ T8225] netlink: 4 bytes leftover after parsing attributes in process `syz.5.664'. [ 107.543670][ T8236] netlink: 28 bytes leftover after parsing attributes in process `syz.5.667'. [ 107.775245][ T8262] netlink: 232 bytes leftover after parsing attributes in process `syz.5.673'. [ 107.787819][ T8251] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 107.790549][ T8251] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 107.792758][ T8251] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 107.795530][ T8251] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 107.802092][ T8251] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 107.812615][ T8251] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 107.817409][ T8251] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 107.822552][ T8251] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 107.945215][ T8258] syzkaller0: entered promiscuous mode [ 107.949380][ T8258] syzkaller0: entered allmulticast mode [ 107.975030][ T8276] netlink: 28 bytes leftover after parsing attributes in process `syz.4.676'. [ 108.028506][ T5737] Bluetooth: hci3: unexpected event for opcode 0x002d [ 108.230570][ T42] kauditd_printk_skb: 24 callbacks suppressed [ 108.230589][ T42] audit: type=1400 audit(1785891331.776:726): avc: denied { write } for pid=8280 comm="syz.5.678" name="ppp" dev="devtmpfs" ino=731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 108.296860][ T6623] IPVS: starting estimator thread 0... [ 108.364159][ T42] audit: type=1400 audit(1785891331.916:727): avc: denied { ioctl } for pid=8280 comm="syz.5.678" path="/dev/ppp" dev="devtmpfs" ino=731 ioctlcmd=0x7438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 108.425804][ T8282] IPVS: using max 27 ests per chain, 64800 per kthread [ 108.576013][ T42] audit: type=1400 audit(1785891332.127:728): avc: denied { append } for pid=8284 comm="syz.5.679" name="mice" dev="devtmpfs" ino=940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 108.849264][ T8290] netlink: 14 bytes leftover after parsing attributes in process `syz.5.680'. [ 109.105046][ T64] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 109.195060][ T42] audit: type=1400 audit(1785891332.737:729): avc: denied { write } for pid=8292 comm="syz.2.681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 109.473179][ T8302] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2569 sclass=netlink_route_socket pid=8302 comm=syz.2.684 [ 109.477776][ T8302] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2578 sclass=netlink_route_socket pid=8302 comm=syz.2.684 [ 109.482449][ T8302] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2572 sclass=netlink_route_socket pid=8302 comm=syz.2.684 [ 109.488500][ T8302] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2566 sclass=netlink_route_socket pid=8302 comm=syz.2.684 [ 109.493139][ T8302] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2565 sclass=netlink_route_socket pid=8302 comm=syz.2.684 [ 109.497004][ T8302] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2569 sclass=netlink_route_socket pid=8302 comm=syz.2.684 [ 109.694580][ T8304] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.716304][ T42] audit: type=1400 audit(1785891333.268:730): avc: denied { unmount } for pid=5740 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 109.819644][ T8314] netlink: 'syz.3.686': attribute type 7 has an invalid length. [ 109.822346][ T64] Bluetooth: hci4: command 0x0405 tx timeout [ 109.832631][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 109.832794][ T5737] Bluetooth: hci1: command 0x0c1a tx timeout [ 109.839587][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.966290][ T42] audit: type=1400 audit(1785891333.518:731): avc: denied { write } for pid=8326 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 109.974481][ T42] audit: type=1400 audit(1785891333.518:732): avc: denied { mount } for pid=8321 comm="syz.5.691" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 110.018460][ T42] audit: type=1400 audit(1785891333.568:733): avc: denied { write } for pid=8332 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.062096][ T5446] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 110.076210][ T8338] netlink: 'syz.2.690': attribute type 1 has an invalid length. [ 110.131263][ T42] audit: type=1400 audit(1785891333.678:734): avc: denied { write } for pid=8340 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.183841][ T42] audit: type=1400 audit(1785891333.738:735): avc: denied { write } for pid=8343 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.700137][ T8319] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 110.702582][ T8319] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 110.704600][ T8319] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 110.707907][ T8319] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 110.746506][ T5737] Bluetooth: hci3: unexpected event for opcode 0x202d [ 110.768701][ T8349] overlayfs: invalid redirect (./bus) [ 110.856127][ T8364] MTRR 1 not used [ 110.971113][ T848] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 111.044411][ T8382] macvlan0: entered allmulticast mode [ 111.046294][ T8382] e1000 0000:00:06.0 eth0: entered allmulticast mode [ 111.057155][ T8382] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 111.105378][ T8385] binder: BINDER_SET_CONTEXT_MGR already set [ 111.108044][ T8385] binder: 8384:8385 ioctl 4018620d 200000000100 returned -16 [ 111.123979][ T848] usb 7-1: config index 0 descriptor too short (expected 8228, got 36) [ 111.127603][ T848] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 111.133443][ T848] usb 7-1: config 0 has no interfaces? [ 111.136131][ T848] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 111.140086][ T848] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.149510][ T848] usb 7-1: config 0 descriptor?? [ 111.210942][ T29] usb 8-1: new full-speed USB device number 4 using dummy_hcd [ 111.285182][ T12] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.365621][ T848] usb 7-1: string descriptor 0 read error: -71 [ 111.372981][ T848] usb 7-1: USB disconnect, device number 11 [ 111.386142][ T29] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 111.390187][ T29] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 111.397239][ T29] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 111.406841][ T29] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.409450][ T12] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.517805][ T12] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.526724][ T64] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 111.539058][ T64] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 111.546962][ T64] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 111.551278][ T64] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 111.556564][ T64] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 111.596379][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.623463][ T29] usb 8-1: usb_control_msg returned -32 [ 111.625403][ T29] usbtmc 8-1:16.0: can't read capabilities [ 111.681560][ T5811] netdevsim netdevsim5 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.715209][ T5811] netdevsim netdevsim5 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.729780][ T5811] netdevsim netdevsim5 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.741418][ T5811] netdevsim netdevsim5 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.748360][ T12] bridge_slave_1: left allmulticast mode [ 111.750092][ T12] bridge_slave_1: left promiscuous mode [ 111.752312][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.756523][ T12] bridge_slave_0: left allmulticast mode [ 111.758314][ T12] bridge_slave_0: left promiscuous mode [ 111.760144][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.857689][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 111.864140][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 111.868928][ T12] bond0 (unregistering): Released all slaves [ 111.903822][ T8404] xfrm0 speed is unknown, defaulting to 1000 [ 111.980767][ T64] Bluetooth: hci1: command 0x0c1a tx timeout [ 112.004164][ T8428] __nla_validate_parse: 9 callbacks suppressed [ 112.004175][ T8428] netlink: 28 bytes leftover after parsing attributes in process `syz.3.704'. [ 112.010928][ T64] Bluetooth: hci2: unexpected event for opcode 0x202d [ 112.108663][ T5446] 8021q: adding VLAN 0 to HW filter on device eth5 [ 112.209393][ T10] usb 8-1: USB disconnect, device number 4 [ 112.401748][ T8404] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.421618][ T8404] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.425928][ T8404] bridge_slave_0: entered allmulticast mode [ 112.436784][ T8404] bridge_slave_0: entered promiscuous mode [ 112.442750][ T8404] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.445534][ T8404] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.448440][ T8404] bridge_slave_1: entered allmulticast mode [ 112.454446][ T8404] bridge_slave_1: entered promiscuous mode [ 112.465690][ T12] hsr_slave_0: left promiscuous mode [ 112.474408][ T12] hsr_slave_1: left promiscuous mode [ 112.480043][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 112.486533][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 112.496113][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 112.513123][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 112.522818][ T12] veth1_macvtap: left promiscuous mode [ 112.525171][ T12] veth0_macvtap: left promiscuous mode [ 112.527657][ T12] veth1_vlan: left promiscuous mode [ 112.530448][ T12] veth0_vlan: left promiscuous mode [ 112.562597][ T8477] netlink: 4 bytes leftover after parsing attributes in process `syz.4.719'. [ 112.761107][ T12] team0 (unregistering): Port device team_slave_1 removed [ 112.772534][ T12] team0 (unregistering): Port device team_slave_0 removed [ 112.902916][ T5446] 8021q: adding VLAN 0 to HW filter on device eth6 [ 112.919934][ T8404] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 112.931873][ T8404] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 112.974294][ T8404] team0: Port device team_slave_0 added [ 112.979275][ T8404] team0: Port device team_slave_1 added [ 113.035256][ T8404] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 113.044219][ T8404] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.054129][ T8404] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 113.061043][ T8404] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 113.063802][ T8404] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 113.073752][ T8404] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 113.111412][ T848] bridge0: entered promiscuous mode [ 113.141904][ T8404] hsr_slave_0: entered promiscuous mode [ 113.144954][ T8404] hsr_slave_1: entered promiscuous mode [ 113.229787][ T5446] 8021q: adding VLAN 0 to HW filter on device eth7 [ 113.339610][ T8501] xt_hashlimit: size too large, truncated to 1048576 [ 113.360468][ T8502] netlink: 232 bytes leftover after parsing attributes in process `syz.4.723'. [ 113.365730][ T42] kauditd_printk_skb: 22 callbacks suppressed [ 113.365746][ T42] audit: type=1400 audit(1785891336.921:758): avc: denied { write } for pid=8498 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 113.370362][ T12] IPVS: stop unused estimator thread 0... [ 113.418857][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 113.424908][ T42] audit: type=1400 audit(1785891336.981:759): avc: denied { mounton } for pid=8499 comm="syz.2.725" path="/syzcgroup/unified/syz2" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 113.446624][ T42] audit: type=1400 audit(1785891336.991:760): avc: denied { write } for pid=8507 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 113.461609][ T8506] affs: No valid root block on device sr0 [ 113.504179][ T8510] netlink: 8 bytes leftover after parsing attributes in process `syz.4.726'. [ 113.510936][ T8510] netlink: 'syz.4.726': attribute type 10 has an invalid length. [ 113.514417][ T8404] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 113.514733][ T8510] netlink: 12 bytes leftover after parsing attributes in process `syz.4.726'. [ 113.526820][ T8404] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 113.531320][ T5446] 8021q: adding VLAN 0 to HW filter on device eth8 [ 113.550053][ T8510] geneve2: entered promiscuous mode [ 113.552362][ T8510] geneve2: entered allmulticast mode [ 113.578387][ T8404] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 113.585925][ T8404] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 113.589801][ T8404] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 113.596918][ T8404] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 113.604068][ T8404] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 113.610031][ T8404] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 113.662343][ T64] Bluetooth: hci0: command tx timeout [ 113.721557][ T8404] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.739908][ T8404] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.756144][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.759099][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.775991][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.778958][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.931009][ T8551] netlink: 232 bytes leftover after parsing attributes in process `syz.4.733'. [ 114.036856][ T42] audit: type=1400 audit(1785891337.592:761): avc: denied { checkpoint_restore } for pid=8548 comm="syz.3.734" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 114.087147][ T8404] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.112272][ T8569] netlink: 'syz.4.736': attribute type 2 has an invalid length. [ 114.117015][ T8571] [U] zͻi[27| [ 114.119918][ T8571] [U] BswAerOU]~A`1eX!j5i5y2ڂ_S"qh$6\P[2*/Wb_$0A7 Xۖ(wc# =g< [ 114.119936][ T8569] netlink: 68 bytes leftover after parsing attributes in process `syz.4.736'. [ 114.124247][ T8571] [U] Iwub:lEeiBHk^VI|ȥ\xd [ 114.124377][ T8571] [U] |KIH;F~{Iӎ=Mkq%hd9!@a*lz~`E=[>meLhc`'u~+ۤmͷLXX舂i 'j3e=:3/C_81(FW [ 114.145621][ T8571] [U] 8)X)YvxRĻbmbN@ox;JD, [ 114.148759][ T8571] [U] *Cn3v7KEXgt_3 [ 114.150297][ T8571] [U] D/QazҬEHgE1$_ks=R@ [ 114.152129][ T8571] [U] ϼcEv @ [ 114.153289][ T8571] [U] a% [ 114.154340][ T8571] [U] @cÏ_-ƱZ&<Z9ah_L@bKÈs3JJ5D;wWˆUuyLbҳ53ż{4XRQrH=M"/@ opS~{Pӡ~i*T~W)Q~ȵ_ߜͬz~Vq۪` [ 114.161402][ T8571] [U] f1p3 [ 114.162550][ T8571] [U] N0[L;a_l&kMC [ 114.164108][ T8571] [U] r6w^gP$u4~GCߚpkFtw~@L1 [ 114.227759][ T8571] [U] :K!:Y咑;Rdma9tbt= Ҫ+sS i-YJc (ґx|]k|_V҉T8MNi׎ͪY΃zAM"ev3KěO0q]^)?ס8ⅴS ܝXeݢ%4 1 [ 114.486920][ T8404] veth1_macvtap: entered promiscuous mode [ 114.490106][ T5737] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 114.501040][ T5737] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 114.506805][ T8404] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.508236][ T8283] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 114.508339][ T5737] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 114.517234][ T8404] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.517427][ T5737] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 114.526600][ T5782] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.529727][ T5782] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.532992][ T42] audit: type=1400 audit(1785891338.092:762): avc: denied { write } for pid=8585 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 114.533763][ T5782] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.554830][ T5782] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.559369][ T29] usb 9-1: device descriptor read/64, error -71 [ 114.576485][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 114.581624][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 114.585625][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.595652][ T42] audit: type=1400 audit(1785891338.152:763): avc: denied { write } for pid=8590 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 114.676342][ T173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.686912][ T173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.688453][ T8283] usb 7-1: Using ep0 maxpacket: 8 [ 114.696366][ T8283] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 114.700876][ T8283] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 114.705290][ T8283] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 114.710597][ T8283] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 114.714684][ T8283] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 114.724299][ T8283] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 114.727110][ T8283] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.738932][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 114.743397][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 114.752151][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.785516][ T234] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.789340][ T234] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.796768][ T42] audit: type=1400 audit(1785891338.352:764): avc: denied { mounton } for pid=8404 comm="syz-executor" path="/syzkaller.tELSpF/syz-tmp" dev="sda1" ino=2040 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 114.807990][ T29] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 114.862429][ T8600] binder_alloc: 8599: binder_alloc_buf, no vma [ 114.865066][ T42] audit: type=1400 audit(1785891338.422:765): avc: denied { call } for pid=8599 comm="syz.6.709" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 114.875482][ T13] netdevsim netdevsim3 eth9: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.904163][ T8583] xfrm0 speed is unknown, defaulting to 1000 [ 114.904355][ T13] netdevsim netdevsim3 eth10: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.938392][ T8580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.942394][ T8580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.957579][ T8283] usb 7-1: usb_control_msg returned -32 [ 114.958088][ T29] usb 9-1: device descriptor read/64, error -71 [ 114.959506][ T8283] usbtmc 7-1:16.0: can't read capabilities [ 114.972869][ T5782] netdevsim netdevsim3 eth11: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.988907][ T5782] netdevsim netdevsim3 eth12: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.029312][ T12] bridge_slave_1: left allmulticast mode [ 115.033448][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.037659][ T12] bridge_slave_0: left allmulticast mode [ 115.040373][ T12] bridge_slave_0: left promiscuous mode [ 115.043611][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.067828][ T29] usb usb9-port1: attempt power cycle [ 115.162409][ T64] Bluetooth: hci0: Malformed MSFT vendor event: 0x02 [ 115.162518][ T8610] netlink: 4 bytes leftover after parsing attributes in process `syz.6.742'. [ 115.193345][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 115.197611][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 115.201290][ T12] bond0 (unregistering): Released all slaves [ 115.205901][ T12] bond1 (unregistering): Released all slaves [ 115.218157][ T8611] tmpfs: Bad value for 'mpol' [ 115.340494][ T42] audit: type=1400 audit(1785891338.903:766): avc: denied { write } for pid=8615 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 115.414024][ T42] audit: type=1400 audit(1785891338.973:767): avc: denied { write } for pid=8624 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 115.418042][ T29] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 115.433641][ T64] Bluetooth: hci0: adv larger than maximum supported [ 115.460958][ T29] usb 9-1: device descriptor read/8, error -71 [ 115.483286][ T5446] 8021q: adding VLAN 0 to HW filter on device eth9 [ 115.556140][ T8583] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.563783][ T8583] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.566947][ T8583] bridge_slave_0: entered allmulticast mode [ 115.572314][ T8583] bridge_slave_0: entered promiscuous mode [ 115.585945][ T8583] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.594816][ T8583] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.598846][ T8583] bridge_slave_1: entered allmulticast mode [ 115.605050][ T8583] bridge_slave_1: entered promiscuous mode [ 115.621158][ T12] hsr_slave_0: left promiscuous mode [ 115.624292][ T12] hsr_slave_1: left promiscuous mode [ 115.627325][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 115.644131][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 115.677923][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 115.680286][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 115.706820][ T12] veth1_macvtap: left promiscuous mode [ 115.709438][ T12] veth0_macvtap: left promiscuous mode [ 115.713544][ T12] veth1_vlan: left promiscuous mode [ 115.716454][ T12] veth0_vlan: left promiscuous mode [ 115.727185][ T29] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 115.728170][ T8646] netlink: 232 bytes leftover after parsing attributes in process `syz.6.747'. [ 115.747019][ T64] Bluetooth: hci0: command tx timeout [ 115.747615][ T29] usb 9-1: device descriptor read/8, error -71 [ 115.857294][ T29] usb usb9-port1: unable to enumerate USB device [ 115.863779][ T12] team0 (unregistering): Port device team_slave_1 removed [ 115.927393][ T8653] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 115.931304][ T8653] block device autoloading is deprecated and will be removed. [ 115.984947][ T8650] can0: slcan on ttynull. [ 115.986139][ T5446] 8021q: adding VLAN 0 to HW filter on device eth10 [ 116.000619][ T8583] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 116.006138][ T8583] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 116.030683][ T8583] team0: Port device team_slave_0 added [ 116.034750][ T8583] team0: Port device team_slave_1 added [ 116.061778][ T8583] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 116.064129][ T8583] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.072841][ T8583] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 116.078485][ T8583] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 116.080869][ T8583] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.088936][ T8583] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 116.152298][ T8583] hsr_slave_0: entered promiscuous mode [ 116.154673][ T8583] hsr_slave_1: entered promiscuous mode [ 116.157183][ T8583] debugfs: 'hsr0' already exists in 'hsr' [ 116.159083][ T8583] Cannot create hsr debugfs directory [ 116.222798][ T8649] can0 (unregistered): slcan off ttynull. [ 116.334792][ T5446] 8021q: adding VLAN 0 to HW filter on device eth11 [ 116.378539][ T8583] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 116.387609][ T8583] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 116.392312][ T8583] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 116.401047][ T8583] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 116.404213][ T8583] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 116.415855][ T8583] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 116.418994][ T8583] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 116.426358][ T8583] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 116.493785][ T8583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.526191][ T8583] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.540581][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.543674][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.575728][ T234] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.578690][ T234] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.617918][ T64] Bluetooth: hci2: command tx timeout [ 116.641149][ T5446] 8021q: adding VLAN 0 to HW filter on device eth12 [ 116.893811][ T8698] netlink: 232 bytes leftover after parsing attributes in process `syz.6.755'. [ 116.944791][ T8583] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 117.059163][ T8702] syzkaller0: entered promiscuous mode [ 117.060797][ T8702] syzkaller0: entered allmulticast mode [ 117.162711][ T8583] veth0_vlan: entered promiscuous mode [ 117.174358][ T8583] veth1_vlan: entered promiscuous mode [ 117.194559][ T8583] veth0_macvtap: entered promiscuous mode [ 117.198898][ T8583] veth1_macvtap: entered promiscuous mode [ 117.213344][ T8583] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 117.227665][ T8583] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 117.240560][ T12] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.244117][ T12] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.253325][ T12] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.259754][ T12] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.272786][ T34] usb 7-1: USB disconnect, device number 12 [ 117.352905][ T8717] iommufd_mock iommufd_mock0: Adding to iommu group 2 [ 117.423763][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.428513][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.472544][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.476292][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.539057][ T8734] nbd: must specify an index to disconnect [ 117.718203][ T8753] No buffer was provided with the request [ 117.818017][ T64] Bluetooth: hci0: command tx timeout [ 117.849799][ T8769] netlink: 12 bytes leftover after parsing attributes in process `syz.2.773'. [ 117.922884][ T8773] netlink: 'syz.2.775': attribute type 4 has an invalid length. [ 117.932710][ T8773] netlink: 'syz.2.775': attribute type 4 has an invalid length. [ 117.933734][ T8774] netlink: 'syz.2.775': attribute type 4 has an invalid length. [ 118.005543][ T34] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 118.046651][ T8781] netlink: 16 bytes leftover after parsing attributes in process `syz.2.776'. [ 118.168775][ T34] usb 12-1: config 56 has an invalid interface number: 57 but max is 3 [ 118.175581][ T34] usb 12-1: config 56 has an invalid interface number: 106 but max is 3 [ 118.185339][ T34] usb 12-1: config 56 has an invalid interface number: 154 but max is 3 [ 118.188927][ T34] usb 12-1: config 56 has an invalid interface number: 211 but max is 3 [ 118.192412][ T34] usb 12-1: config 56 contains an unexpected descriptor of type 0x1, skipping [ 118.196325][ T34] usb 12-1: config 56 contains an unexpected descriptor of type 0x1, skipping [ 118.200081][ T34] usb 12-1: config 56 has an invalid interface association descriptor of length 3, skipping [ 118.204139][ T34] usb 12-1: config 56 has no interface number 0 [ 118.207536][ T34] usb 12-1: config 56 has no interface number 1 [ 118.210288][ T34] usb 12-1: config 56 has no interface number 2 [ 118.213089][ T34] usb 12-1: config 56 has no interface number 3 [ 118.217394][ T34] usb 12-1: config 56 interface 57 altsetting 9 endpoint 0x9 has invalid maxpacket 1023, setting to 64 [ 118.222127][ T34] usb 12-1: config 56 interface 57 altsetting 9 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 118.227058][ T34] usb 12-1: config 56 interface 57 altsetting 9 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 118.231495][ T34] usb 12-1: config 56 interface 57 altsetting 9 has an endpoint descriptor with address 0x7B, changing to 0xB [ 118.237499][ T34] usb 12-1: config 56 interface 57 altsetting 9 endpoint 0xB has invalid maxpacket 41085, setting to 1024 [ 118.242138][ T34] usb 12-1: config 56 interface 57 altsetting 9 bulk endpoint 0xB has invalid maxpacket 1024 [ 118.246819][ T34] usb 12-1: config 56 interface 57 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 118.251487][ T34] usb 12-1: config 56 interface 57 altsetting 9 has a duplicate endpoint with address 0x4, skipping [ 118.256111][ T34] usb 12-1: config 56 interface 57 altsetting 9 endpoint 0xD has invalid maxpacket 1024, setting to 64 [ 118.260641][ T34] usb 12-1: config 56 interface 57 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 118.264908][ T34] usb 12-1: config 56 interface 57 altsetting 9 endpoint 0xF has invalid wMaxPacketSize 0 [ 118.269545][ T34] usb 12-1: config 56 interface 57 altsetting 9 bulk endpoint 0xF has invalid maxpacket 0 [ 118.273680][ T34] usb 12-1: config 56 interface 57 altsetting 9 has a duplicate endpoint with address 0xB, skipping [ 118.278373][ T34] usb 12-1: config 56 interface 57 altsetting 9 has a duplicate endpoint with address 0x4, skipping [ 118.282903][ T34] usb 12-1: config 56 interface 57 altsetting 9 bulk endpoint 0xC has invalid maxpacket 8 [ 118.287087][ T34] usb 12-1: config 56 interface 57 altsetting 9 has a duplicate endpoint with address 0xC, skipping [ 118.291491][ T34] usb 12-1: config 56 interface 57 altsetting 9 has a duplicate endpoint with address 0x2, skipping [ 118.296931][ T34] usb 12-1: config 56 interface 57 altsetting 9 has a duplicate endpoint with address 0x4, skipping [ 118.301454][ T34] usb 12-1: config 56 interface 57 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 118.306149][ T34] usb 12-1: config 56 interface 57 altsetting 9 has 17 endpoint descriptors, different from the interface descriptor's value: 16 [ 118.311920][ T34] usb 12-1: config 56 interface 106 altsetting 75 has a duplicate endpoint with address 0xD, skipping [ 118.316624][ T34] usb 12-1: config 56 interface 106 altsetting 75 has an invalid descriptor for endpoint zero, skipping [ 118.321346][ T34] usb 12-1: config 56 interface 154 altsetting 60 has a duplicate endpoint with address 0xB, skipping [ 118.326392][ T34] usb 12-1: config 56 interface 154 altsetting 60 has a duplicate endpoint with address 0x9, skipping [ 118.331302][ T34] usb 12-1: config 56 interface 154 altsetting 60 has a duplicate endpoint with address 0x5, skipping [ 118.336030][ T34] usb 12-1: config 56 interface 154 altsetting 60 has an invalid descriptor for endpoint zero, skipping [ 118.340697][ T34] usb 12-1: config 56 interface 154 altsetting 60 has an invalid descriptor for endpoint zero, skipping [ 118.346216][ T34] usb 12-1: config 56 interface 154 altsetting 60 has a duplicate endpoint with address 0xD, skipping [ 118.350863][ T34] usb 12-1: config 56 interface 154 altsetting 60 has a duplicate endpoint with address 0xD, skipping [ 118.356062][ T34] usb 12-1: config 56 interface 154 altsetting 60 has a duplicate endpoint with address 0xF, skipping [ 118.360668][ T34] usb 12-1: config 56 interface 154 altsetting 60 has a duplicate endpoint with address 0x2, skipping [ 118.365388][ T34] usb 12-1: config 56 interface 211 altsetting 1 has a duplicate endpoint with address 0x4, skipping [ 118.370054][ T34] usb 12-1: config 56 interface 211 altsetting 1 has a duplicate endpoint with address 0x1, skipping [ 118.374649][ T34] usb 12-1: config 56 interface 211 altsetting 1 has a duplicate endpoint with address 0xD, skipping [ 118.380106][ T34] usb 12-1: config 56 interface 211 altsetting 1 has a duplicate endpoint with address 0xB, skipping [ 118.384837][ T34] usb 12-1: config 56 interface 211 altsetting 1 has a duplicate endpoint with address 0xF, skipping [ 118.389838][ T34] usb 12-1: config 56 interface 57 has no altsetting 0 [ 118.392833][ T34] usb 12-1: config 56 interface 106 has no altsetting 0 [ 118.396017][ T34] usb 12-1: config 56 interface 154 has no altsetting 0 [ 118.398992][ T34] usb 12-1: config 56 interface 211 has no altsetting 0 [ 118.404119][ T34] usb 12-1: New USB device found, idVendor=1f4d, idProduct=0237, bcdDevice=25.51 [ 118.408141][ T34] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.409196][ T8798] netlink: 'syz.2.781': attribute type 1 has an invalid length. [ 118.411648][ T34] usb 12-1: Product: 굸薊鮁⵸밇욎ﴒ橎䎴躬댨憃覫匽㨠ꑠ烈럲耸䅔Ī涧ớ뻿욕㛤澞쾧頎糷ׇ醠˱䈗䃞拠ㆬ⯫馸᧞聊압茇贮擏着遴옺䋟춰䄜೒⹬퇇⛮ଌ㛍∖㊡य़હꯓ떏؜튆됓❿ᮣ쩕哶ቺ奏୫ [ 118.414926][ T8798] netlink: 5120 bytes leftover after parsing attributes in process `syz.2.781'. [ 118.425291][ T34] usb 12-1: Manufacturer: І [ 118.425313][ T34] usb 12-1: SerialNumber: 碑垵層뢏冲쭞䐭䗧骋ḞꚄ﮻굤뚕뙸⻳뺒㼒뒊ⳕ㟋ꛪ긳썱褸瓶䒪ᝬ뿅၊잙☏脉֨펳솴訖퀩꽠揼쿣ճ䵐厌஬߭뒦程ᾚꝛ [ 118.430376][ T8762] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 118.444390][ T8762] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 118.449249][ T8762] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 118.482724][ T42] kauditd_printk_skb: 20 callbacks suppressed [ 118.482740][ T42] audit: type=1400 audit(1785891342.035:788): avc: denied { write } for pid=8799 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 118.540586][ T42] audit: type=1400 audit(1785891342.095:789): avc: denied { write } for pid=8803 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 118.659675][ T8806] binder: 8805:8806 ioctl c0306201 200000000080 returned -14 [ 118.662251][ T8762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 118.669945][ T8762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 118.677304][ T8762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 118.686476][ T8806] binder: 8805:8806 ioctl 40086607 200000000280 returned -22 [ 118.689190][ T8762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 118.695140][ T64] Bluetooth: hci2: command tx timeout [ 118.948078][ T8824] loop5: detected capacity change from 0 to 2640 [ 118.961143][ T8824] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.962502][ T8825] syz.2.787: attempt to access beyond end of device [ 118.962502][ T8825] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 118.966385][ T5745] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.971635][ T8825] gfs2: error -5 reading superblock [ 118.976698][ T8824] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.976732][ T8824] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.976757][ T8824] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.987329][ T8824] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.990482][ T5745] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.995407][ T8824] Buffer I/O error on dev loop5, logical block 0, async page read [ 118.998865][ T8824] Buffer I/O error on dev loop5, logical block 0, async page read [ 119.002085][ T8824] Buffer I/O error on dev loop5, logical block 0, async page read [ 119.005929][ T8824] ldm_validate_partition_table(): Disk read failed. [ 119.008768][ T8824] Dev loop5: unable to read RDB block 0 [ 119.011527][ T8824] loop5: unable to read partition table [ 119.014167][ T8824] loop_reread_partitions: partition scan of loop5 (3 ) failed (rc=-5) [ 119.023042][ T8825] ldm_validate_partition_table(): Disk read failed. [ 119.024906][ T5840] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 119.026100][ T8825] Dev loop5: unable to read RDB block 0 [ 119.031577][ T8825] loop5: unable to read partition table [ 119.157532][ T8828] netlink: 28 bytes leftover after parsing attributes in process `syz.2.788'. [ 119.162772][ T64] Bluetooth: hci1: unexpected event for opcode 0x202d [ 119.178992][ T5840] usb 11-1: unable to get BOS descriptor or descriptor too short [ 119.183706][ T5840] usb 11-1: config 129 has an invalid interface number: 135 but max is 0 [ 119.187231][ T5840] usb 11-1: config 129 has an invalid interface number: 5 but max is 0 [ 119.189994][ T5840] usb 11-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 119.193690][ T5840] usb 11-1: config 129 has no interface number 0 [ 119.196088][ T5840] usb 11-1: config 129 has no interface number 1 [ 119.198614][ T5840] usb 11-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 119.203843][ T5840] usb 11-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 119.208374][ T5840] usb 11-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 119.213598][ T5840] usb 11-1: config 129 interface 135 has no altsetting 0 [ 119.217167][ T5840] usb 11-1: config 129 interface 5 has no altsetting 0 [ 119.224477][ T5840] usb 11-1: string descriptor 0 read error: -22 [ 119.226977][ T5840] usb 11-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00 [ 119.230598][ T5840] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.267680][ T5840] usb 11-1: Quirk or no altset; falling back to MIDI 1.0 [ 119.271316][ T5840] usb 11-1: MIDIStreaming interface descriptor not found [ 119.281060][ T8830] loop5: detected capacity change from 0 to 2640 [ 119.285123][ T8830] ldm_validate_partition_table(): Disk read failed. [ 119.290294][ T8832] qnx4: Unknown parameter 'discard' [ 119.292637][ T8830] Dev loop5: unable to read RDB block 0 [ 119.295908][ T8830] loop5: unable to read partition table [ 119.298923][ T8830] loop_reread_partitions: partition scan of loop5 (3 ) failed (rc=-5) [ 119.300229][ T34] usb 12-1: USB disconnect, device number 2 [ 119.320047][ T8830] ldm_validate_partition_table(): Disk read failed. [ 119.325330][ T8830] Dev loop5: unable to read RDB block 0 [ 119.330264][ T8830] loop5: unable to read partition table [ 119.460411][ T8817] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.474336][ T8817] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.480065][ T5840] usb 11-1: USB disconnect, device number 2 [ 119.540034][ T42] audit: type=1326 audit(1785891343.096:790): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8850 comm="syz.2.793" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f98e2f9df99 code=0x0 [ 119.645764][ T8863] netlink: 28 bytes leftover after parsing attributes in process `syz.4.796'. [ 119.690258][ T8865] netlink: 48 bytes leftover after parsing attributes in process `syz.7.797'. [ 119.894483][ T64] Bluetooth: hci0: command tx timeout [ 119.964432][ T848] usb 12-1: new high-speed USB device number 3 using dummy_hcd [ 119.986060][ T8871] netlink: 232 bytes leftover after parsing attributes in process `syz.4.799'. [ 120.030871][ T8875] netlink: 20 bytes leftover after parsing attributes in process `syz.4.801'. [ 120.107976][ T8878] loop4: detected capacity change from 0 to 7 [ 120.130034][ T8878] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 120.132372][ T8878] loop4: partition table partially beyond EOD, truncated [ 120.134232][ T848] usb 12-1: Using ep0 maxpacket: 8 [ 120.137043][ T8878] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 120.139292][ T848] usb 12-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 120.144912][ T848] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.173811][ T848] pvrusb2: Hardware description: Terratec Grabster AV400 [ 120.181886][ T848] pvrusb2: ********** [ 120.183564][ T848] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 120.188132][ T848] pvrusb2: Important functionality might not be entirely working. [ 120.191368][ T848] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 120.196128][ T848] pvrusb2: ********** [ 120.368353][ T42] audit: type=1400 audit(1785891343.926:791): avc: denied { accept } for pid=8883 comm="syz.4.804" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 120.379779][ T2519] pvrusb2: Invalid write control endpoint [ 120.471879][ T2519] pvrusb2: Invalid write control endpoint [ 120.474835][ T2519] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 120.476480][ T8885] can0: slcan on ptm0. [ 120.478548][ T2519] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 120.484520][ T2519] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 120.491428][ T2519] pvrusb2: Device being rendered inoperable [ 120.497413][ T2519] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 120.500368][ T2519] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 120.505794][ T2519] pvrusb2: Attached sub-driver cx25840 [ 120.508541][ T2519] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 120.511717][ T2519] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 120.523789][ T8896] netlink: 'syz.2.807': attribute type 1 has an invalid length. [ 120.540438][ T42] audit: type=1400 audit(1785891344.096:792): avc: denied { write } for pid=8894 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 120.547156][ T8896] bond6: entered promiscuous mode [ 120.551336][ T8896] 8021q: adding VLAN 0 to HW filter on device bond6 [ 120.564278][ T8896] netlink: 28 bytes leftover after parsing attributes in process `syz.2.807'. [ 120.568063][ T8896] bond6: entered allmulticast mode [ 120.578136][ T8868] pvrusb2: Attempted to execute control transfer when device not ok [ 120.589308][ T5826] usb 12-1: USB disconnect, device number 3 [ 120.602186][ T42] audit: type=1400 audit(1785891344.156:793): avc: denied { write } for pid=8900 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 120.614141][ T8896] bond6: (slave bridge3): making interface the new active one [ 120.617556][ T8896] bridge3: entered promiscuous mode [ 120.620144][ T8896] bridge3: entered allmulticast mode [ 120.629823][ T8896] bond6: (slave bridge3): Enslaving as an active interface with an up link [ 120.773904][ T64] Bluetooth: hci2: command tx timeout [ 120.809493][ T8904] Illegal XDP return value 4232957952 on prog (id 85) dev N/A, expect packet loss! [ 120.873942][ T42] audit: type=1400 audit(1785891344.426:794): avc: denied { write } for pid=8905 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 120.924525][ T42] audit: type=1400 audit(1785891344.486:795): avc: denied { write } for pid=8910 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 120.942115][ T8884] can0 (unregistered): slcan off ptm0. [ 120.995497][ T42] audit: type=1400 audit(1785891344.546:796): avc: denied { read write } for pid=8917 comm="syz.2.812" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 120.999469][ T8919] netlink: 28 bytes leftover after parsing attributes in process `syz.4.813'. [ 121.003033][ T42] audit: type=1400 audit(1785891344.546:797): avc: denied { open } for pid=8917 comm="syz.2.812" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 121.030091][ T64] Bluetooth: hci3: unexpected event for opcode 0x202d [ 121.524247][ T64] Bluetooth: hci1: unexpected event for opcode 0x202d [ 121.588879][ T8970] openvswitch: netlink: Tunnel attr 99 out of range max 16 [ 121.743571][ T8995] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 121.752663][ T8987] ip6t_srh: unknown srh invflags 51E8 [ 121.769789][ T9001] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 121.773637][ T9001] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 1th superblock [ 121.778621][ T9001] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 121.781988][ T9001] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 2th superblock [ 121.800796][ T9000] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 121.804814][ T9000] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 1th superblock [ 121.806668][ T9001] nfs: Unknown parameter '/dev/nbd' [ 121.808039][ T9002] nfs: Unknown parameter '/dev/nbd' [ 121.811214][ T9000] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 121.815272][ T9000] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 2th superblock [ 121.921966][ T9009] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=53 sclass=netlink_route_socket pid=9009 comm=syz.4.836 [ 122.020239][ T9020] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2571 sclass=netlink_route_socket pid=9020 comm=syz.4.839 [ 122.025754][ T9020] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2568 sclass=netlink_route_socket pid=9020 comm=syz.4.839 [ 122.031115][ T9020] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2566 sclass=netlink_route_socket pid=9020 comm=syz.4.839 [ 122.036760][ T9020] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2574 sclass=netlink_route_socket pid=9020 comm=syz.4.839 [ 122.164055][ T9017] overlayfs: workdir and upperdir must be separate subtrees [ 122.220527][ T9030] nfs: Unknown parameter 'adSr' [ 122.225087][ T9030] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 122.616184][ T9040] Cannot find del_set index 1 as target [ 122.647213][ T9042] SELinux: syz.6.843 (9042) wrote to user. This is no longer supported. [ 122.651706][ T9042] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 122.656580][ T9042] cramfs: block size(16384) > page size(4096) not supported by filesystem [ 122.663714][ T9042] cramfs: wrong magic [ 122.852948][ T64] Bluetooth: hci2: command tx timeout [ 122.886731][ T9067] CIFS: Unable to determine destination address [ 122.889856][ T9067] 9p: Unknown access argument 00000000004294967295: -22 [ 122.906554][ T9069] __nla_validate_parse: 6 callbacks suppressed [ 122.906570][ T9069] netlink: 232 bytes leftover after parsing attributes in process `syz.4.849'. [ 122.923446][ T9070] netlink: 20 bytes leftover after parsing attributes in process `syz.6.847'. [ 122.926445][ T9070] netlink: 20 bytes leftover after parsing attributes in process `syz.6.847'. [ 123.040552][ T9080] vlan1: entered promiscuous mode [ 123.125518][ T9083] syzkaller1: entered promiscuous mode [ 123.128002][ T9083] syzkaller1: entered allmulticast mode [ 123.157599][ T55] usb 12-1: new high-speed USB device number 4 using dummy_hcd [ 123.325505][ T55] usb 12-1: config index 0 descriptor too short (expected 39, got 27) [ 123.329090][ T55] usb 12-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 123.333627][ T55] usb 12-1: config 0 interface 0 has no altsetting 0 [ 123.338611][ T55] usb 12-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 123.342415][ T55] usb 12-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 123.345904][ T55] usb 12-1: Product: syz [ 123.347620][ T55] usb 12-1: Manufacturer: syz [ 123.349674][ T55] usb 12-1: SerialNumber: syz [ 123.360146][ T55] usb 12-1: config 0 descriptor?? [ 123.364375][ T55] hub 12-1:0.0: bad descriptor, ignoring hub [ 123.366413][ T55] hub 12-1:0.0: probe with driver hub failed with error -5 [ 123.370464][ T55] usb 12-1: selecting invalid altsetting 0 [ 123.411141][ T9096] netlink: 8 bytes leftover after parsing attributes in process `syz.4.858'. [ 123.417327][ T9096] netlink: 8 bytes leftover after parsing attributes in process `syz.4.858'. [ 123.486473][ T42] kauditd_printk_skb: 18 callbacks suppressed [ 123.486491][ T42] audit: type=1400 audit(1785891347.048:816): avc: denied { load_policy } for pid=9097 comm="syz.4.859" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 123.548109][ T9098] SELinux: ebitmap: truncated map [ 123.551639][ T9098] SELinux: invalid class [ 123.593954][ T9098] SELinux: failed to load policy [ 123.669496][ T9102] netlink: 232 bytes leftover after parsing attributes in process `syz.2.860'. [ 123.717591][ T9103] "syz.4.861" (9103) uses obsolete ecb(arc4) skcipher [ 123.801727][ T9116] netlink: 52 bytes leftover after parsing attributes in process `syz.2.865'. [ 123.808102][ T9116] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.816834][ T9116] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.880075][ T42] audit: type=1400 audit(1785891347.438:817): avc: denied { write } for pid=9121 comm="syz.6.866" name="functions" dev="configfs" ino=22434 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 123.885115][ T9122] sysfs: Unknown parameter './config/usb_gadget/g1' [ 123.892611][ T42] audit: type=1800 audit(1785891347.448:818): pid=9122 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.6.866" name="pnp_string" dev="configfs" ino=31543 res=0 errno=0 [ 123.923584][ T9124] ip6t_srh: unknown srh match flags 4000 [ 124.025454][ T9067] usb 12-1: reset high-speed USB device number 4 using dummy_hcd [ 124.198841][ T9067] usb 12-1: device firmware changed [ 124.208879][ T2328] usb 12-1: USB disconnect, device number 4 [ 124.410315][ T9136] netlink: 232 bytes leftover after parsing attributes in process `syz.4.871'. [ 124.422182][ T2328] usb 12-1: new high-speed USB device number 5 using dummy_hcd [ 124.454357][ T42] audit: type=1400 audit(1785891348.018:819): avc: denied { write } for pid=9137 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.524628][ T42] audit: type=1400 audit(1785891348.078:820): avc: denied { write } for pid=9142 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.574487][ T2328] usb 12-1: config index 0 descriptor too short (expected 39, got 27) [ 124.577412][ T2328] usb 12-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 124.580584][ T2328] usb 12-1: config 0 interface 0 has no altsetting 0 [ 124.591137][ T2328] usb 12-1: string descriptor 0 read error: -22 [ 124.594529][ T2328] usb 12-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 124.598053][ T2328] usb 12-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 124.605546][ T2328] usb 12-1: config 0 descriptor?? [ 124.611357][ T2328] hub 12-1:0.0: bad descriptor, ignoring hub [ 124.615315][ T2328] hub 12-1:0.0: probe with driver hub failed with error -5 [ 124.619819][ T2328] usb 12-1: selecting invalid altsetting 0 [ 124.660005][ T9153] netlink: 28 bytes leftover after parsing attributes in process `syz.4.874'. [ 124.736706][ T9153] netlink: 216 bytes leftover after parsing attributes in process `syz.4.874'. [ 124.742463][ T64] Bluetooth: hci3: unexpected event for opcode 0x202d [ 124.922970][ T55] usb 12-1: USB disconnect, device number 5 [ 124.943039][ T42] audit: type=1400 audit(1785891348.508:821): avc: denied { mount } for pid=9172 comm="syz.2.881" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 125.033575][ T9179] iommufd_mock iommufd_mock0: Adding to iommu group 2 [ 125.168700][ T42] audit: type=1400 audit(1785891348.728:822): avc: denied { cmd } for pid=9189 comm="iou-wrk-9190" path="/dev/ublk-control" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 125.250767][ T9193] netlink: 'syz.6.889': attribute type 6 has an invalid length. [ 125.253686][ T9193] netlink: 'syz.6.889': attribute type 5 has an invalid length. [ 125.256250][ T9193] netlink: 'syz.6.889': attribute type 4 has an invalid length. [ 125.283234][ T9195] ip6t_srh: unknown srh invflags 51E8 [ 125.384446][ T9204] xfrm0 speed is unknown, defaulting to 1000 [ 125.592295][ T9217] loop5: detected capacity change from 0 to 7 [ 125.598736][ T9217] Dev loop5: unable to read RDB block 7 [ 125.601173][ T9217] loop5: unable to read partition table [ 125.603827][ T9217] loop5: partition table beyond EOD, truncated [ 125.606567][ T9217] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 125.695569][ T42] audit: type=1400 audit(1785891349.258:823): avc: denied { create } for pid=9224 comm="syz.4.899" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 125.697367][ T64] Bluetooth: hci3: unexpected event for opcode 0x202d [ 125.844822][ T42] audit: type=1400 audit(1785891349.409:824): avc: denied { ioctl } for pid=9228 comm="syz.4.900" path="/dev/rtc0" dev="devtmpfs" ino=945 ioctlcmd=0x7005 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 125.954292][ T42] audit: type=1400 audit(1785891349.519:825): avc: denied { write } for pid=9231 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 126.176903][ T9247] xt_socket: unknown flags 0x4c [ 126.220149][ T9250] random: crng reseeded on system resumption [ 126.247574][ T9253] netlink: 'syz.7.903': attribute type 64 has an invalid length. [ 126.256012][ T9253] netlink: 'syz.7.903': attribute type 4 has an invalid length. [ 126.265269][ T9237] VFS: file-max limit 0 reached [ 126.278728][ T9250] netlink: 'syz.6.904': attribute type 12 has an invalid length. [ 126.415988][ T9257] usb usb9: check_ctrlrecip: process 9257 (syz.6.906) requesting ep 01 but needs 81 [ 126.419865][ T9257] usb usb9: usbfs: process 9257 (syz.6.906) did not claim interface 0 before use [ 126.611612][ T5840] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 126.665546][ T9277] GUP no longer grows the stack in syz.7.907 (9277): 200000007000-20000000a000 (200000004000) [ 126.670995][ T9277] CPU: 3 UID: 0 PID: 9277 Comm: syz.7.907 Tainted: G L syzkaller #0 PREEMPT(full) [ 126.671026][ T9277] Tainted: [L]=SOFTLOCKUP [ 126.671033][ T9277] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 126.671043][ T9277] Call Trace: [ 126.671113][ T9277] [ 126.671120][ T9277] dump_stack_lvl+0x100/0x190 [ 126.671160][ T9277] gup_vma_lookup.cold+0x83/0x96 [ 126.671190][ T9277] __get_user_pages+0x241/0x32a0 [ 126.671232][ T9277] ? down_read_killable+0x35e/0x520 [ 126.671270][ T9277] ? __pfx___get_user_pages+0x10/0x10 [ 126.671302][ T9277] __gup_longterm_locked+0x87d/0x16f0 [ 126.671323][ T9277] ? kernel_text_address+0x8d/0x100 [ 126.671357][ T9277] ? __pfx___gup_longterm_locked+0x10/0x10 [ 126.671383][ T9277] ? lock_acquire+0x1b9/0x370 [ 126.671422][ T9277] gup_fast_fallback+0x16dc/0x2790 [ 126.671466][ T9277] ? __pfx_gup_fast_fallback+0x10/0x10 [ 126.671495][ T9277] ? __lock_acquire+0x49f/0x1a40 [ 126.671516][ T9277] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 126.671555][ T9277] get_user_pages_fast+0xa7/0xf0 [ 126.671579][ T9277] ? __pfx_get_user_pages_fast+0x10/0x10 [ 126.671610][ T9277] __iov_iter_get_pages_alloc+0x8f2/0x1f20 [ 126.671652][ T9277] ? __mutex_lock+0x26d/0x1bd0 [ 126.671675][ T9277] ? pipe_lock+0x69/0x80 [ 126.671704][ T9277] ? __pfx___schedule+0x10/0x10 [ 126.671724][ T9277] ? __pfx___iov_iter_get_pages_alloc+0x10/0x10 [ 126.671758][ T9277] ? __pfx___mutex_lock+0x10/0x10 [ 126.671782][ T9277] ? import_ubuf+0x1b6/0x220 [ 126.671811][ T9277] iov_iter_get_pages2+0xa3/0x100 [ 126.671837][ T9277] ? __pfx_iov_iter_get_pages2+0x10/0x10 [ 126.671861][ T9277] ? wait_for_space+0x2ca/0x3b0 [ 126.671896][ T9277] __do_sys_vmsplice+0x7dd/0x13c0 [ 126.671923][ T9277] ? plist_del+0x308/0x510 [ 126.671964][ T9277] ? __pfx___do_sys_vmsplice+0x10/0x10 [ 126.671986][ T9277] ? futex_private_hash_put+0x115/0x1c0 [ 126.672022][ T9277] ? futex_wake+0x220/0x5e0 [ 126.672045][ T9277] ? __pfx_futex_wake+0x10/0x10 [ 126.672114][ T9277] ? do_syscall_64+0x115/0x870 [ 126.672136][ T9277] do_syscall_64+0x115/0x870 [ 126.672156][ T9277] ? clear_bhb_loop+0x40/0x90 [ 126.672181][ T9277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.672200][ T9277] RIP: 0033:0x7f8dc8d9df99 [ 126.672218][ T9277] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 126.672235][ T9277] RSP: 002b:00007f8dc9bcf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 126.672267][ T9277] RAX: ffffffffffffffda RBX: 00007f8dc9025fa0 RCX: 00007f8dc8d9df99 [ 126.672280][ T9277] RDX: 0000000000000001 RSI: 00002000000013c0 RDI: 0000000000000008 [ 126.672292][ T9277] RBP: 00007f8dc8e34ec4 R08: 0000000000000000 R09: 0000000000000000 [ 126.672303][ T9277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.672315][ T9277] R13: 00007f8dc9026038 R14: 00007f8dc9025fa0 R15: 00007ffd14bb55e8 [ 126.672341][ T9277] [ 126.811545][ T5840] usb 7-1: Using ep0 maxpacket: 16 [ 126.814776][ T5840] usb 7-1: too many configurations: 123, using maximum allowed: 8 [ 126.819362][ T5840] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.826189][ T5840] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.831766][ T5840] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.837741][ T5840] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.844094][ T5840] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.849742][ T5840] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.865127][ T5840] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.877344][ T5840] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.882855][ T5840] usb 7-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 126.891245][ T5840] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 126.897204][ T5840] usb 7-1: SerialNumber: syz [ 126.914802][ T5840] usb 7-1: config 0 descriptor?? [ 126.932814][ T64] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 126.938953][ T5840] input: bcm5974 as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input9 [ 126.939367][ T64] Bluetooth: hci0: Injecting HCI hardware error event [ 126.946052][ T64] Bluetooth: hci0: hardware error 0x00 [ 127.131153][ T8595] usb 12-1: new full-speed USB device number 6 using dummy_hcd [ 127.179494][ T5129] bcm5974 7-1:0.0: could not read from device [ 127.180535][ T1045] usb 7-1: USB disconnect, device number 13 [ 127.209140][ T5737] Bluetooth: hci3: unexpected event for opcode 0x0c24 [ 127.261848][ T8595] usb 12-1: device descriptor read/64, error -71 [ 127.489018][ T9336] overlayfs: conflicting options: userxattr,metacopy=on [ 127.511095][ T8595] usb 12-1: new full-speed USB device number 7 using dummy_hcd [ 127.661143][ T8595] usb 12-1: device descriptor read/64, error -71 [ 127.773778][ T8595] usb usb12-port1: attempt power cycle [ 127.872391][ T9354] MTD: Attempt to mount non-MTD device "/dev/loop6" [ 127.876047][ T9354] cramfs: wrong magic [ 127.980521][ T9363] netlink: 'syz.2.931': attribute type 2 has an invalid length. [ 128.056604][ T9366] fuse: Bad value for 'group_id' [ 128.058724][ T9366] fuse: Bad value for 'group_id' [ 128.116202][ T9366] kvm: kvm [9360]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0xc1) = 0xfffffc00 [ 128.122662][ T9366] kvm: kvm [9360]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0xc2) = 0xfffffc00 [ 128.132041][ T8595] usb 12-1: new full-speed USB device number 8 using dummy_hcd [ 128.144943][ T9366] kvm: kvm [9360]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0xfffffc00 [ 128.164110][ T8595] usb 12-1: device descriptor read/8, error -71 [ 128.175697][ T9366] kvm: kvm [9360]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x186) = 0xfffffc00 [ 128.179747][ T9366] kvm: kvm [9360]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x187) = 0xfffffc00 [ 128.420763][ T8595] usb 12-1: new full-speed USB device number 9 using dummy_hcd [ 128.451142][ T8595] usb 12-1: device descriptor read/8, error -71 [ 128.564765][ T8595] usb usb12-port1: unable to enumerate USB device [ 129.010549][ T64] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 129.967246][ T9392] __nla_validate_parse: 10 callbacks suppressed [ 129.967266][ T9392] netlink: 12 bytes leftover after parsing attributes in process `syz.7.935'. [ 129.974090][ T9392] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 130.030039][ T9395] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:0000 with DS=0x7 [ 130.140218][ T9361] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 130.140624][ T64] Bluetooth: hci1: command 0x0c1a tx timeout [ 130.161459][ T9400] netlink: 'syz.7.938': attribute type 1 has an invalid length. [ 130.181592][ T9400] bond1: option mode: invalid value (8) [ 130.185791][ T9400] bond1 (unregistering): Released all slaves [ 130.213877][ T9402] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64 sclass=netlink_route_socket pid=9402 comm=syz.7.938 [ 130.948580][ T9361] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 130.951337][ T9361] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 130.953630][ T9361] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 130.956912][ T9361] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 131.180881][ T9426] i2c i2c-1: Frontend requested software zigzag, but didn't set the frequency step size [ 131.261269][ T42] kauditd_printk_skb: 34 callbacks suppressed [ 131.261298][ T42] audit: type=1400 audit(1785891354.820:860): avc: denied { append } for pid=9430 comm="syz.4.939" name="event2" dev="devtmpfs" ino=948 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 131.271126][ T9431] openvswitch: netlink: Key type 30 is not supported [ 131.293378][ T9435] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 131.303800][ T42] audit: type=1400 audit(1785891354.870:861): avc: denied { write } for pid=9432 comm="syz.7.947" name="functions" dev="configfs" ino=22434 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 131.314746][ T42] audit: type=1400 audit(1785891354.870:862): avc: denied { write } for pid=9432 comm="syz.7.947" name="c.1" dev="configfs" ino=24261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 131.324334][ T42] audit: type=1400 audit(1785891354.870:863): avc: denied { write } for pid=9432 comm="syz.7.947" name="c.1" dev="configfs" ino=24261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 131.336371][ T42] audit: type=1800 audit(1785891354.870:864): pid=9433 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.7.947" name="UDC" dev="configfs" ino=36309 res=0 errno=0 [ 131.345533][ T42] audit: type=1400 audit(1785891354.870:865): avc: denied { bind } for pid=9432 comm="syz.7.947" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 131.415070][ T9444] openvswitch: netlink: Flow actions attr not present in new flow. [ 131.423488][ T42] audit: type=1400 audit(1785891354.990:866): avc: denied { ioctl } for pid=9432 comm="syz.7.947" path="/32/config/usb_gadget/g1/UDC" dev="configfs" ino=36309 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 131.470124][ T9442] configfs-gadget.g1 gadget.0: HOST MAC aa:4c:5e:42:2e:29 [ 131.488171][ T9442] configfs-gadget.g1 gadget.0: MAC 3e:1f:9d:85:f2:b4 [ 131.604469][ T42] audit: type=1400 audit(1785891355.170:867): avc: denied { write } for pid=9447 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 131.706670][ T42] audit: type=1400 audit(1785891355.270:868): avc: denied { write } for pid=9455 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 131.749912][ T5840] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 131.790988][ T9458] netlink: 232 bytes leftover after parsing attributes in process `syz.4.950'. [ 131.893712][ T42] audit: type=1400 audit(1785891355.460:869): avc: denied { write } for pid=9465 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 131.899568][ T9471] cgroup: No subsys list or none specified [ 131.933251][ T5840] usb 5-1: Dual-Role OTG device on HNP port [ 131.936048][ T5840] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 131.945766][ T5840] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.012088][ T5840] rndis_host 5-1:1.0 usb1: register 'rndis_host' at usb-dummy_hcd.0-1, RNDIS device, aa:4c:5e:42:2e:29 [ 132.020317][ T9481] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 132.121242][ T9487] netlink: 8 bytes leftover after parsing attributes in process `syz.2.958'. [ 132.163999][ T9487] netlink: 'syz.2.958': attribute type 12 has an invalid length. [ 132.219725][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 132.364275][ T9504] ALSA: seq fatal error: cannot create timer (-16) [ 132.612936][ T1444] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.616897][ T1444] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.712186][ T9540] syzkaller1: entered promiscuous mode [ 132.715489][ T9540] syzkaller1: entered allmulticast mode [ 132.828293][ T9548] netlink: 'syz.6.972': attribute type 2 has an invalid length. [ 132.832310][ T9548] netlink: 'syz.6.972': attribute type 1 has an invalid length. [ 132.893381][ T9550] tipc: Trying to set illegal importance in message [ 132.959006][ T9556] netlink: 28 bytes leftover after parsing attributes in process `syz.4.975'. [ 133.009476][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 133.369806][ T1359] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 133.529317][ T1359] usb 11-1: Using ep0 maxpacket: 32 [ 133.533134][ T1359] usb 11-1: unable to get BOS descriptor or descriptor too short [ 133.540219][ T1359] usb 11-1: string descriptor 0 read error: -22 [ 133.543207][ T1359] usb 11-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 133.546675][ T1359] usb 11-1: New USB device strings: Mfr=1, Product=252, SerialNumber=3 [ 133.554179][ T1359] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 133.556950][ T1359] dw2102: su3000_power_ctrl: 1, initialized 0 [ 133.559446][ T1359] dvb-usb: bulk message failed: -22 (2/0) [ 133.569969][ T1359] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 133.578897][ T1359] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 133.583223][ T1359] usb 11-1: media controller created [ 133.585644][ T1359] dvb-usb: bulk message failed: -22 (6/0) [ 133.587835][ T1359] dw2102: i2c transfer failed. [ 133.589842][ T1359] dvb-usb: bulk message failed: -22 (6/0) [ 133.592219][ T1359] dw2102: i2c transfer failed. [ 133.593822][ T1359] dvb-usb: bulk message failed: -22 (6/0) [ 133.595696][ T1359] dw2102: i2c transfer failed. [ 133.597352][ T1359] dvb-usb: bulk message failed: -22 (6/0) [ 133.600547][ T1359] dw2102: i2c transfer failed. [ 133.603070][ T1359] dvb-usb: bulk message failed: -22 (6/0) [ 133.604867][ T1359] dw2102: i2c transfer failed. [ 133.606415][ T1359] dvb-usb: bulk message failed: -22 (6/0) [ 133.608249][ T1359] dw2102: i2c transfer failed. [ 133.613988][ T1359] dvb-usb: MAC address: 02:02:02:02:02:02 [ 133.621689][ T1359] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 133.635253][ T1359] dvb-usb: bulk message failed: -22 (3/0) [ 133.637068][ T1359] dw2102: command 0x0e transfer failed. [ 133.640132][ T1359] dvb-usb: bulk message failed: -22 (3/0) [ 133.642193][ T1359] dw2102: command 0x0e transfer failed. [ 133.841820][ T9583] tmpfs: User quota inode hardlimit too large. [ 133.895645][ T9585] syzkaller0: entered promiscuous mode [ 133.898017][ T9585] syzkaller0: entered allmulticast mode [ 133.918578][ T9585] netlink: 8 bytes leftover after parsing attributes in process `syz.6.987'. [ 133.921830][ T9585] netlink: 12 bytes leftover after parsing attributes in process `syz.6.987'. [ 133.937695][ T9596] netlink: 12 bytes leftover after parsing attributes in process `syz.4.989'. [ 133.943284][ T9596] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 133.953455][ T1359] dvb-usb: bulk message failed: -22 (3/0) [ 133.954110][ T9594] overlayfs: workdir and upperdir must reside under the same mount [ 133.955717][ T1359] dw2102: command 0x0e transfer failed. [ 133.963550][ T1359] dvb-usb: bulk message failed: -22 (3/0) [ 133.965951][ T1359] dw2102: command 0x0e transfer failed. [ 133.970619][ T1359] dvb-usb: bulk message failed: -22 (1/0) [ 133.974658][ T1359] dw2102: command 0x51 transfer failed. [ 134.004579][ T64] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 134.016353][ T1359] DVB: Unable to find symbol ds3000_attach() [ 134.016366][ T1359] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 134.075905][ T9603] Trying to write to read-only block-device nullb0 [ 134.089221][ T1359] rc_core: IR keymap rc-su3000 not found [ 134.091581][ T1359] Registered IR keymap rc-empty [ 134.098653][ T1359] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.6/usb11/11-1/rc/rc0 [ 134.114092][ T1359] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.6/usb11/11-1/rc/rc0/input10 [ 134.161039][ T1359] dvb-usb: schedule remote query interval to 150 msecs. [ 134.169579][ T1359] dw2102: su3000_power_ctrl: 0, initialized 1 [ 134.174536][ T1359] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 134.181323][ T1359] usb 11-1: USB disconnect, device number 3 [ 134.289133][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 134.290746][ T1359] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 134.334003][ T9614] kvm: pic: level sensitive irq not supported [ 134.523337][ T9623] Bluetooth: MGMT ver 1.23 [ 134.794410][ T5826] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 134.885762][ T9630] iommufd_mock iommufd_mock0: Adding to iommu group 2 [ 134.976752][ T5826] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 134.981680][ T5826] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 134.985978][ T5826] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 134.993893][ T5826] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.031022][ T9623] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 135.054890][ T5826] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 135.098650][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 135.291680][ T5826] usb 9-1: USB disconnect, device number 7 [ 135.961427][ T9641] netlink: 1053 bytes leftover after parsing attributes in process `syz.4.1002'. [ 136.214070][ T9644] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.251264][ T9649] kvm: pic: level sensitive irq not supported [ 136.364014][ T9644] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.379364][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 136.408143][ T9660] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1008'. [ 136.442711][ T9664] input: syz0 as /devices/virtual/input/input11 [ 136.594088][ T42] kauditd_printk_skb: 18 callbacks suppressed [ 136.594099][ T42] audit: type=1400 audit(1785891360.161:888): avc: denied { accept } for pid=9672 comm="syz.7.1013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 136.618412][ T9644] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.726326][ T9680] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 136.789441][ T9644] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.808409][ T9684] netlink: 'syz.7.1018': attribute type 1 has an invalid length. [ 136.815710][ T9684] netlink: 193500 bytes leftover after parsing attributes in process `syz.7.1018'. [ 136.819871][ T9684] netlink: 2044 bytes leftover after parsing attributes in process `syz.7.1018'. [ 136.827445][ T9686] kvm: pic: level sensitive irq not supported [ 136.874562][ T9691] IPVS: set_ctl: invalid protocol: 137 224.0.0.2:20004 [ 136.902761][ T8620] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 136.935787][ T8620] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 136.954521][ T9694] dummy_hcd dummy_hcd.0: remove, state 1 [ 136.956999][ T8620] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 136.959373][ T9694] usb usb5: USB disconnect, device number 1 [ 136.962539][ T9694] usb 5-1: USB disconnect, device number 9 [ 136.967612][ T42] audit: type=1400 audit(1785891360.532:889): avc: denied { map } for pid=9695 comm="syz.2.1020" path="socket:[37511]" dev="sockfs" ino=37511 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 136.977908][ T5811] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 136.980795][ T9694] rndis_host 5-1:1.0 usb1: unregister 'rndis_host' usb-dummy_hcd.0-1, RNDIS device [ 136.993434][ T42] audit: type=1400 audit(1785891360.562:890): avc: denied { write } for pid=9695 comm="syz.2.1020" name="/" dev="9p" ino=82313231 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 137.057950][ T42] audit: type=1400 audit(1785891360.622:891): avc: denied { write } for pid=9697 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 137.113855][ T9702] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 137.134758][ T42] audit: type=1400 audit(1785891360.702:892): avc: denied { write } for pid=9707 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 137.168709][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 137.253644][ T9694] dummy_hcd dummy_hcd.0: stopped [ 137.253661][ T9694] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 137.263491][ T42] audit: type=1400 audit(1785891360.832:893): avc: denied { write } for pid=9710 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 137.266240][ T9713] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1023'. [ 137.278035][ T9713] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1023'. [ 137.326928][ T42] audit: type=1400 audit(1785891360.892:894): avc: denied { write } for pid=9715 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 137.394778][ T9724] netlink: 'syz.4.1026': attribute type 1 has an invalid length. [ 137.410681][ T9724] bond3: entered allmulticast mode [ 137.417331][ T9724] bond3: (slave vti0): The slave device specified does not support setting the MAC address [ 137.422769][ T9724] bond3: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 137.427151][ T42] audit: type=1400 audit(1785891360.992:895): avc: denied { write } for pid=9722 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 137.438607][ T9724] bond3: (slave vti0): making interface the new active one [ 137.440903][ T9724] vti0: entered allmulticast mode [ 137.443039][ T9724] bond3: (slave vti0): Enslaving as an active interface with an up link [ 137.481391][ T9730] xfrm0 speed is unknown, defaulting to 1000 [ 137.494260][ T42] audit: type=1400 audit(1785891361.062:896): avc: denied { write } for pid=9731 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 137.514297][ T42] audit: type=1400 audit(1785891361.082:897): avc: denied { mounton } for pid=9728 comm="syz.2.1027" path="/277/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 137.533730][ T9734] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.1027'. [ 137.540419][ T9734] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.1027'. [ 137.878614][ T9757] netlink: 232 bytes leftover after parsing attributes in process `syz.6.1034'. [ 138.252056][ T9778] netlink: 'syz.4.1038': attribute type 7 has an invalid length. [ 138.290235][ T5737] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 138.295191][ T5737] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 138.304819][ T5737] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 138.307793][ T5737] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 138.310823][ T9786] fuse: Unknown parameter 'bl' [ 138.310859][ T5737] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 138.531057][ T9805] FAULT_INJECTION: forcing a failure. [ 138.531057][ T9805] name fail_futex, interval 1, probability 0, space 0, times 1 [ 138.535112][ T9805] CPU: 1 UID: 0 PID: 9805 Comm: syz.6.1048 Tainted: G L syzkaller #0 PREEMPT(full) [ 138.535132][ T9805] Tainted: [L]=SOFTLOCKUP [ 138.535136][ T9805] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 138.535143][ T9805] Call Trace: [ 138.535166][ T9805] [ 138.535170][ T9805] dump_stack_lvl+0x100/0x190 [ 138.535203][ T9805] should_fail_ex.cold+0x5/0xa [ 138.535223][ T9805] ? lockdep_hardirqs_on+0x78/0x100 [ 138.535251][ T9805] should_fail_futex+0x4c/0x60 [ 138.535275][ T9805] __x64_sys_futex+0x1f0/0x4d0 [ 138.535299][ T9805] ? __pfx___x64_sys_futex+0x10/0x10 [ 138.535322][ T9805] do_syscall_64+0x115/0x870 [ 138.535335][ T9805] ? clear_bhb_loop+0x40/0x90 [ 138.535350][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.535363][ T9805] RIP: 0033:0x7f7f0139df99 [ 138.535373][ T9805] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.535386][ T9805] RSP: 002b:00007ffff3e01e98 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 138.535412][ T9805] RAX: ffffffffffffffda RBX: 0000000000021cf2 RCX: 00007f7f0139df99 [ 138.535419][ T9805] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f7f01625fac [ 138.535426][ T9805] RBP: 0000000000000032 R08: 0000000000000001 R09: 0000000000000000 [ 138.535433][ T9805] R10: 00007ffff3e01fa0 R11: 0000000000000246 R12: 00007ffff3e01fc0 [ 138.535440][ T9805] R13: 00007f7f01625fac R14: 0000000000021d24 R15: 00007ffff3e01fa0 [ 138.535455][ T9805] [ 138.535584][ T9805] FAULT_INJECTION: forcing a failure. [ 138.535584][ T9805] name fail_futex, interval 1, probability 0, space 0, times 0 [ 138.551520][ T9784] xfrm0 speed is unknown, defaulting to 1000 [ 138.552791][ T9805] CPU: 1 UID: 0 PID: 9805 Comm: syz.6.1048 Tainted: G L syzkaller #0 PREEMPT(full) [ 138.552810][ T9805] Tainted: [L]=SOFTLOCKUP [ 138.552814][ T9805] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 138.552821][ T9805] Call Trace: [ 138.552825][ T9805] [ 138.552829][ T9805] dump_stack_lvl+0x100/0x190 [ 138.552849][ T9805] should_fail_ex.cold+0x5/0xa [ 138.552864][ T9805] get_futex_key+0x1d2/0x14f0 [ 138.552882][ T9805] ? __pfx_get_futex_key+0x10/0x10 [ 138.552898][ T9805] ? __pfx___schedule+0x10/0x10 [ 138.552908][ T9805] ? __resched_curr+0x42e/0x500 [ 138.552935][ T9805] ? __pfx___resched_curr+0x10/0x10 [ 138.552952][ T9805] futex_wait_setup+0x91/0x540 [ 138.552968][ T9805] __futex_wait+0x19f/0x300 [ 138.552980][ T9805] ? __pfx___futex_wait+0x10/0x10 [ 138.552994][ T9805] ? __pfx_futex_wake_mark+0x10/0x10 [ 138.553007][ T9805] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 138.553030][ T9805] ? __hrtimer_setup+0x208/0x330 [ 138.553048][ T9805] ? ktime_add_safe+0x60/0x70 [ 138.553065][ T9805] futex_wait+0xe6/0x370 [ 138.553076][ T9805] ? __pfx_futex_wait+0x10/0x10 [ 138.553089][ T9805] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 138.553110][ T9805] do_futex+0x265/0x440 [ 138.553127][ T9805] ? __pfx_do_futex+0x10/0x10 [ 138.553143][ T9805] ? ktime_get+0x22c/0x320 [ 138.553157][ T9805] ? lockdep_hardirqs_on+0x78/0x100 [ 138.553171][ T9805] __x64_sys_futex+0x34f/0x4d0 [ 138.553190][ T9805] ? __pfx___x64_sys_futex+0x10/0x10 [ 138.553211][ T9805] do_syscall_64+0x115/0x870 [ 138.553224][ T9805] ? clear_bhb_loop+0x40/0x90 [ 138.553238][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.553249][ T9805] RIP: 0033:0x7f7f0139df99 [ 138.553260][ T9805] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.553270][ T9805] RSP: 002b:00007ffff3e01e98 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 138.553282][ T9805] RAX: ffffffffffffffda RBX: 0000000000021cf7 RCX: 00007f7f0139df99 [ 138.553289][ T9805] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f7f01625fac [ 138.553296][ T9805] RBP: 0000000000000032 R08: 0000000000000001 R09: 0000000000000000 [ 138.553302][ T9805] R10: 00007ffff3e01fa0 R11: 0000000000000246 R12: 00007ffff3e01fc0 [ 138.553308][ T9805] R13: 00007f7f01625fac R14: 0000000000021d29 R15: 00007ffff3e01fa0 [ 138.553322][ T9805] [ 138.554225][ T9806] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1048'. [ 138.788359][ T5446] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 138.792724][ T5446] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 138.795272][ T5446] CPU: 1 UID: 0 PID: 5446 Comm: dhcpcd Tainted: G L syzkaller #0 PREEMPT(full) [ 138.798868][ T5446] Tainted: [L]=SOFTLOCKUP [ 138.800455][ T5446] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 138.804045][ T5446] RIP: 0010:dummy_queue+0x1ba/0xb00 [ 138.805939][ T5446] Code: 00 49 83 bc 24 c8 05 00 00 00 0f 84 a6 07 00 00 e8 2b 2a 39 fa 49 8d 7f 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 4f 07 00 00 45 8b 7f 60 31 ff [ 138.808049][ T9812] fuse: fd is not a fuse device [ 138.812009][ T5446] RSP: 0018:ffffc900063def20 EFLAGS: 00010206 [ 138.812024][ T5446] RAX: dffffc0000000000 RBX: ffff88805c275d10 RCX: ffffffff87d1359f [ 138.812032][ T5446] RDX: 000000000000000c RSI: ffffffff87d13615 RDI: 0000000000000060 [ 138.812039][ T5446] RBP: ffff88802b1c80e0 R08: 0000000000000005 R09: 0000000000000005 [ 138.812046][ T5446] R10: 0000000000000003 R11: 0000000000000000 R12: ffff88802b1c8c00 [ 138.812053][ T5446] R13: ffff88805c275d00 R14: ffff88802b1c80d8 R15: 0000000000000000 [ 138.812060][ T5446] FS: 00007f9aa9ed8780(0000) GS:ffff8880d5edc000(0000) knlGS:0000000000000000 [ 138.812082][ T5446] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 138.812092][ T5446] CR2: 00007ff213c25e9c CR3: 000000003be9e000 CR4: 0000000000352ef0 [ 138.812099][ T5446] Call Trace: [ 138.812114][ T5446] [ 138.812121][ T5446] usb_ep_queue+0xfa/0x3c0 [ 138.812141][ T5446] eth_start_xmit+0x684/0x1390 [ 138.842064][ T5446] dev_hard_start_xmit+0x121/0x760 [ 138.843907][ T5446] sch_direct_xmit+0x1b2/0xc70 [ 138.845648][ T5446] ? lock_acquire+0x1b9/0x370 [ 138.847427][ T5446] ? __pfx_sch_direct_xmit+0x10/0x10 [ 138.849299][ T5446] ? do_raw_spin_lock+0x200/0x260 [ 138.850680][ T5446] __dev_queue_xmit+0x27ac/0x4970 [ 138.852470][ T5446] ? ip6mr_fib_lookup+0x133/0x1a0 [ 138.854243][ T5446] ? look_up_lock_class+0x64/0x120 [ 138.856107][ T5446] ? __pfx___dev_queue_xmit+0x10/0x10 [ 138.857992][ T5446] ? register_lock_class+0x40/0x560 [ 138.859805][ T5446] ? __lock_acquire+0x49f/0x1a40 [ 138.861444][ T5446] ? find_held_lock+0x2b/0x80 [ 138.863058][ T5446] ip6_finish_output2+0xfd4/0x1ce0 [ 138.864797][ T5446] __ip6_finish_output+0x357/0xdf0 [ 138.866497][ T5446] ip6_output+0x2aa/0xa60 [ 138.868014][ T5446] ? __pfx_ip6_output+0x10/0x10 [ 138.869649][ T5446] ? __pfx_ip6_finish_output+0x10/0x10 [ 138.871553][ T5446] ? __flow_hash_from_keys+0xa2/0x4f0 [ 138.873497][ T5446] ip6_mr_output+0x233/0x1180 [ 138.875235][ T5446] ? netlbl_enabled+0x54/0x70 [ 138.877041][ T5446] ? __pfx_ip6_mr_output+0x10/0x10 [ 138.878880][ T5446] ? __ip6_local_out+0x38c/0xaf0 [ 138.880324][ T5446] ? __pfx_dst_output+0x10/0x10 [ 138.882108][ T5446] ? __pfx_ip6_mr_output+0x10/0x10 [ 138.883966][ T5446] ? ip6_local_out+0x1ad/0x1f0 [ 138.885704][ T5446] ip6_local_out+0x1ad/0x1f0 [ 138.887409][ T5446] ip6_send_skb+0x112/0x430 [ 138.889066][ T5446] ip6_push_pending_frames+0x3b/0x50 [ 138.890984][ T5446] rawv6_sendmsg+0x2d0c/0x4420 [ 138.892784][ T5446] ? find_held_lock+0x2b/0x80 [ 138.894503][ T5446] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 138.896378][ T5446] ? __pfx_tomoyo_check_inet_address+0x10/0x10 [ 138.898657][ T5446] ? __pfx_sock_has_perm+0x10/0x10 [ 138.900586][ T5446] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 138.902365][ T5446] ? inet_sendmsg+0x11c/0x140 [ 138.904008][ T5446] inet_sendmsg+0x11c/0x140 [ 138.905648][ T5446] ____sys_sendmsg+0x9c9/0xbe0 [ 138.907415][ T5446] ? __pfx_inet_sendmsg+0x10/0x10 [ 138.909255][ T5446] ? __pfx_____sys_sendmsg+0x10/0x10 [ 138.911192][ T5446] ___sys_sendmsg+0x190/0x1e0 [ 138.912919][ T5446] ? __pfx____sys_sendmsg+0x10/0x10 [ 138.914816][ T5446] ? __pfx_sock_read_iter+0x10/0x10 [ 138.916746][ T5446] ? __pfx_sock_read_iter+0x10/0x10 [ 138.918631][ T5446] ? __pfx_set_user_sigmask+0x10/0x10 [ 138.920585][ T5446] __sys_sendmsg+0x160/0x210 [ 138.922288][ T5446] ? __pfx___sys_sendmsg+0x10/0x10 [ 138.924126][ T5446] do_syscall_64+0x115/0x870 [ 138.925694][ T5446] ? clear_bhb_loop+0x40/0x90 [ 138.927374][ T5446] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.929492][ T5446] RIP: 0033:0x7f9aa9f62407 [ 138.931114][ T5446] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 138.931504][ T9784] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.937894][ T5446] RSP: 002b:00007ffca2b07660 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 138.937920][ T5446] RAX: ffffffffffffffda RBX: 00007f9aa9ed8780 RCX: 00007f9aa9f62407 [ 138.937932][ T5446] RDX: 0000000000000000 RSI: 00007ffca2b17810 RDI: 000000000000000d [ 138.937942][ T5446] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 138.937952][ T5446] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffca2b27a40 [ 138.937961][ T5446] R13: 0000000000000002 R14: 0000000000000010 R15: 00007ffca2b17810 [ 138.937978][ T5446] [ 138.941242][ T9784] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.943871][ T5446] Modules linked in: [ 138.944188][ T5446] ---[ end trace 0000000000000000 ]--- [ 138.947427][ T9784] bridge_slave_0: entered allmulticast mode [ 138.949775][ T5446] RIP: 0010:dummy_queue+0x1ba/0xb00 [ 138.949799][ T5446] Code: 00 49 83 bc 24 c8 05 00 00 00 0f 84 a6 07 00 00 e8 2b 2a 39 fa 49 8d 7f 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 4f 07 00 00 45 8b 7f 60 31 ff [ 138.952973][ T9784] bridge_slave_0: entered promiscuous mode [ 138.955026][ T5446] RSP: 0018:ffffc900063def20 EFLAGS: 00010206 [ 138.955040][ T5446] RAX: dffffc0000000000 RBX: ffff88805c275d10 RCX: ffffffff87d1359f [ 138.955047][ T5446] RDX: 000000000000000c RSI: ffffffff87d13615 RDI: 0000000000000060 [ 138.955054][ T5446] RBP: ffff88802b1c80e0 R08: 0000000000000005 R09: 0000000000000005 [ 138.955061][ T5446] R10: 0000000000000003 R11: 0000000000000000 R12: ffff88802b1c8c00 [ 138.958836][ T9784] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.961201][ T5446] R13: ffff88805c275d00 R14: ffff88802b1c80d8 R15: 0000000000000000 [ 138.961214][ T5446] FS: 00007f9aa9ed8780(0000) GS:ffff8880d5edc000(0000) knlGS:0000000000000000 [ 138.961245][ T5446] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 138.964511][ T9784] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.966236][ T5446] CR2: 00007ff213c25e9c CR3: 000000003be9e000 CR4: 0000000000352ef0 [ 138.966254][ T5446] Kernel panic - not syncing: Fatal exception in interrupt [ 138.969260][ T5446] Kernel Offset: disabled