last executing test programs: 16m34.013990755s ago: executing program 2 (id=847): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f00000000c0)={0xa, @pix_mp={0x1, 0x4, 0x20323159, 0x4, 0xc, [{0x8001, 0x7}, {0x8, 0x7}, {0x0, 0x1}, {0x4e, 0x1}, {0x4, 0x5}, {0x1, 0x3}, {0x0, 0x2}, {0x9, 0x9}], 0x4, 0x9, 0x1, 0x2, 0x2}}) 16m33.87774177s ago: executing program 2 (id=848): socket$kcm(0x10, 0x2, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7040000000080b8785d960001810600000000000000000000000000000000000000000000000c00", "2809e8dbe101000000224ad54afac11d875397bdb7819e02177d3d458dd4992861ac00000000ae00ffff00", "9001001c551265406c7f306003d8a0f4bd0000000300", [0x0, 0x10000000]}}) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a140efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e6222103472bc55704cdb737ae996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be500e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef1d7ee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) mmap(&(0x7f0000111000/0x2000)=nil, 0x2000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r1, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r1, 0x5001, 0x0) r2 = gettid() r3 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0) ioctl$CEC_TRANSMIT(r3, 0xc0386105, &(0x7f0000000480)={0x5, 0xfffffffffffffffe, 0x7, 0x0, 0x0, 0x0, "0ff8000000000000c5c6ff0717c3a86d", 0x0, 0x2, 0x0, 0x6, 0x0, 0x4, 0xff}) ioctl$BTRFS_IOC_SET_FEATURES(0xffffffffffffffff, 0x40309439, &(0x7f0000000080)={0x0, 0x2, 0x1}) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r1, 0xc0045009, &(0x7f0000000040)=0x2dff) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x0, 0x4}, 0xc) setsockopt$MRT6_DEL_MIF(0xffffffffffffffff, 0x29, 0xcb, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000040)=@urb_type_interrupt={0x1, {0xa, 0x1}, 0x7, 0x0, &(0x7f00000004c0)="16d112c3fb7fb669517e40a2129fcf67fa2acada5ec6d384b523db06ad1fad77241efb02cae9237a084002c46ee792e056586b8c1ee7b017a44342053a373e29a1dc57b55529ea1fbb9ed31542fb65fc1bbd13570c55eebd2f92c7ff796f8bfbf66e992a20bca23b324737f6dabd7fe4575b0be8eb00c67b5bba6a5d279beb6fac4d66b7ea6de04aad83530e3995c35c35a94e9f0ba07c9b036ca3cdc19df1303200ddb885448a95074aa47bea73915708ea124b", 0xb4, 0x6, 0xc2f0, 0x0, 0x1, 0x1, &(0x7f0000001800)="8c530657f8fb9a57e97e1256cbf1eaffb0e6fecdafcbb1728ff73dd87f6c85366d2d05e2ac9acb1ae8a6b652568d5c4e2698c72af76f1f44811e3f7fe260a6df771e06dae7926d07dd253af65e80c75e71ea391dbe2ddfe16cb5451e8611fd47accb41320b27606790ad2aa7ed5e1aeaacb6b89b37d04a64bb15e9dde6b42754e6b2de47caa192328c0a172a1dfaf557c601c3427de8a48343aae193288a961cd61dde44bed885bdf48b598239e5f2a4d13bb8fb601102be159f95cb9d2b0516f1704e7bad5b468864c827d28bada07b7c84c3a7ce9b102b769965f77496b747e158e82c781557ae2bbfdd0f77c4304b8dc048495d2ccb319f7fc738de9c69a6d4f048570d315473aeeb753b9bf254c9caf8d517c0693fcba28b3e046b4df5184af9dbeee9b3b69d7ad6fd95398b40ca9ee52ad8fcb13310db04960ad431b6a7a8c61355b007c03210b97da49c6ec4785bc90b29dc633f2dc087536f9f6f1de0eeb91db42f531de273527f711b8fd3e11f85d28c858059e0a9f18aa7782e67124f8bfc84b0545b33211ea9783fd2568fd1f065925e9bb3562e0bc0817c9b3a976a65d12b3ca8b37fe2097e66494b659dcaf6cb5569ddd48887ddafd48b79e7b612b8ce9852b87d8eddfc4fac70e06e0b5129af781d89b2fbdd8db2468d2a81b6be77eabfc38cae6737cb882226075eb6c150e4e323e6af82cee8611941befc27264a3f2ca1b937b41c9f4542949907c6ce6fdcb7035a980b5d1ccbc0e81f4663025fbb324c69b8ded64308d907d7f0c2dae8ea0c21e9916e23bf60929d8430bcb5127782e0e6c37e955395b7cdafdea99660dc09b7b140d834b8fbc4fbb1b251cb6220032576ba28acd2de1e618a6ecdc6ec87cd80e1c6add9b02bffdda1c5400f24677f26509b42866044e034d47d8eaa17b6f4f4cf99dc52619d8bd9e6b1cdadd7cb4d24cba3917b68021f0244faac81a4838f581c891f3528270577479312680b29d77dc9456535b2849d32a564946ccb5405689d1d39a3c7d93661973555be2f707a19b0bc3e06f5b8cf40828248b781ba67a86710f112195fb0acbd2434d49f94a2bca8a4a30d286a9afe3463cd63df46a03ea3774c53b26be36e9ab0f9371cea89124ae3fcd385ee576e899ac2e7c6068ace5c952f783c3a7d70be1ed21bc21463227897bc2d00ced757cecfbe7cfd5bd5aeac1762fe5c8c73533655b399deb7ea3b0c24efc4aaf496b74f7b7c4aa17ae16d64415db4ead7496c56a3b9c7a2da7180367f4183d746648b1e6c642639fd6430596177461d6b1811eb7c2555be6d67fcb402a995cf0539fa9e5e0c97b801a7b064f96418ced8a28e1f24e8659e58b3e376fffd71b59943944a28b3973b98ae57d7a9ef57c059fdcc9ab7b41f6950055ac3d13e574d3f1908b827064524c2ce16cc06ea49c676356b7b1aedae89adf70f5be7f2fb917fa8fc125bee2b9ff5fe7f90302b81bcfcf514e5eb768631789959bb325449a35fdbc3dda50122e6940812c546c18a86cb7b81f03f593ad285c9167dc4ccfa005f6185ce75e022ffa63749d2fa66a48f19109653f5f609bc29fd8ee6603401449f210d5bfd24227595bb44d318820b8f6adcb6fdb27edc06d4c64b254318a0bcc4de205c197da1b1affb5b12a5a200e369e4e8bbda21779dbbdd4af4d8f6cadcd438c8f094128531c825183d8c3762919300ebadef2a6fb7bc271e6b8ca536f7ed392cfdedebd5ed6bd994a923d8ae9cb576e55a8b37d8febbbefff319304f9ba08ed1492862cbd55e44d4f3a023a0f4d919ffb986d4de1171e79aba5e81524be5787a66279b9132180613997b1d1a2396f6f08f24c4fa547772c7c5f566dd055a2f9b787a5742da37e03676f4d61c22d9c073f83263319261adb8ce034cb643550cfe0338f7dbf4392e31276fd7e65ab10b1ea903497fb7a162e0ee75088e0f291844fa2159d54f5d68a00632b3e66d270ebbbd5435400dfea80528cfec07fae7d96551c09a44e390a223e054bc54db39349c3f2f3440b614d274f3cfd3a3cfbbc1b2b879571ed37269896257d6535750286f1da32ef03d1b04313c2c51e256274a50662a39cce999298c5fc940900e405990cfb7b48eaf5eec1013eba7b0f401409451beb171d563ec18606a604dbab3b27a4e6e7e21393d5af8d79d35f2a52ed3b75ec61d8ddfb8224b931e774f2bee74989f4e8d39eae5fc7c1297edd3b3672b411842bb009202cf4971b44c26370326c9532c99c192e091a408b54b235b3ce1799aff7887f361777abeb94d122c79c18818f0e68088ec498a19196a686603ad1e7a982ee974b521f2101af6c58a053dfe2f70a88a4de9b623d25b7b574548ebeb61be771cd515116e4be95a72d37668c9a5aafa6ccaada71fe8ac4fbcb33cbe03121f5133e6ee5ea46e597362bcdf5115a8af821448d00050e997591af2795d846d41c6a386f860d749bf38e14d33de4803e40640a0b0e44fd0776afd54ec61b6aa4d59663eabbaffb5b5eb8a1ad8eafb6e73354e2cb2aee0f057353c22f37ca30f60f4afea5e5598850fffc686a61980a68835d54906d68ed739556e3d651a71858b247ba5c379a6a0eb4589882a4d85cd501ababb5101c262a103e7c6c6d56ff2b6f86f20d6b585452b5540fd743c9bff6fdd89f8dbfc31d83f0c99f8a5f327b0b48218998e00e30537348efe5df33c423e928260e77de6e777f8fc1fbaa0b57887b283c12e202d18a8779e3106bce41dc4f00a7d83cde071989f9dc8e0756c019c85efa6f8dfce8ebf93aa6dbf5a68065b9f08d548ce4c1977e8838bd5244c370184d271b07106829d7dc64200351ad8a382d3a22ffd88a736c632c826982f089d29e9d042d3c4a38ccc45378989a0e5de8e0f7b101fadce8859bb46db8ba375c69108c1963b1037c7aa8d8d4a6399463d5031cbee9092c4d6f155eed1f680abe0541f6e7293365718c963ae97f6ea293919d3d991d38d91479b3a8bc8be9f437fc1f01da769622dc3efbe9b794023de70d731ac7bce8c227a1efb6ed02b9a611cfcbd421a268f4f4f8f37876c3d92763dee6cfe950b127af20ae8f6299f0b7ffe3e24852f30ee9b349d2fff4684f4e11149456353d328e264ccd2db137f56e3964ce46bf4fe8c99beabcc1689688d5de81d0ddbf082f8e8f927f9ad1addd500354514bef73bdf66103d7388c9d354bcdf8cd2bb27d44361fef5c30f2deb96d950bf58e9b39d497101a89aa930ef3ed9020af3967862bc71f3498081f68d9bc0371275fdd9b48e0742eb159b98f13352f7dadad8c1e625a790e19c06eaced1db0de1d72a2cc5da51fdb73e88cc19f965b120f5cf52c163aec1161e4f104da038829f587f939088437dd2b51376c42d1279cdeea2cb875ab962ff11b2171c4f83d320c1900213539c2241a5a18851d22397f245c419a8fec9a4becc9ca1dec21d9ab8932f773babfebf7c921243af6c5c9ab8f97587f2938f9e1b64f5d4b576aad981691b18d8185337a4c94717ae7fc5c12045bf6726d7cba658a37209b11841df01b69cdbd4882f1d882657a057201393b8a6fb3bde23565f0d5c2d287e4bdc6f634e01db54ececd89d26cacb11095bca5a3cdbb6940fe2119f707a1e9df1da5ef2b1eb7547f17b049db63fdc5e93f75f40e8becc26ce05efc576eac0e42835d7ca4b8a49c869c32557249d3b05a7745ee0830628b56d1018307f6521fc21978e9bf138a31765ef7a074da8d8b0337fc6911a689e415f119c3818919e1939f3a4828f85dedcbf2163ef8c5c15b1638cd404ecb02094d7298d7730769708fcb378b760b85750001793076d64938c08fc376e92250204ccf39afa085bd1e2f3eb1d8ad6a1dfe91f567f5db7dd36f894e7810b2de5eaa5fb937232129a73b2109cc27e6360e6f775265bdedf10b09c2856304cff4ba7ee4e7a39067e4ff6acd61e52b83dd62c297957f38e0da2b11d605c26b4c6a1d4043650b9ab78394a21f5a0a8aec531da422ece8ddeb6fae2acfadaf76ccda26e6e30eaa2fe4bd11db15fc93c74fedff9ac8ddf42624d3fbe14a008c1a985735f8d2a68b8e9665189d2def733b6c937a472276fb8b3d9af545fd524a181316a9a5f885938fb88443573716a923b8ff41d2c48a1fcb2d4b082d26c31cd7e5b516c0484500300f6772be68d706dac2f1876fae6d5e0cc00fc90916eaed46d87b37abafec22db2577db133c48a9c8fed26b68b4749c5500d7e1ffef56cb90c2ca22939a382569010cefa857b6708439b2ff83d411dd417d49aec46d5a88e07427d09e4c11ae5287a81ef73b9c30fc37b778753ed0ef7cc19c2fe620870d74c2dc4c8c0b918735884e25828c73ade90d0df79ec586ef583f390e8c9e7b6c1ed6e2d57b10ed4263150c0acfbedd9dbad09a976f69e4e73c856ec283ec5f281e36f39be1c02eced9f9076be09f1106b0faa61c74b7a0306dfb43163932ea851709280cbb354380e282df74c463a3416536da7b18bdb8df6ef3b64a2c96bd1aa7af95c1bec323866739d9494ab0743fb1909a519d5c7aaa7279d327cd25beb51f1b257cde30bff055f3122f9b228fc49c5a62bcadfa979c97b5b2f2ee5b38b1cb7f88b68159ce482dee1ac9859f299ef48910b7ee85b0672e3ed25805e12506cf4f4bbc4d067cf95048d6ba3e9f94e5feec099cd09fc5421528c0e0df76ff131a1e97e7c53478708ff27eaa5f24e26faaded0daee81738762a36badaec1049450b75ba847580caa1071d6742f865a934244d5425cdd869b20542005cd4511e25dbf9b198c471d754f1184c98ff5c17aabeb99c633774f67bfa4242931f6617c532b07f66fe9c34ae7f18fe535933d65717a16cc3fa81e216c42310a4472031a1e4f5db16e2767d8c42c058160292a745a95af308a8cb759ab4b35ba935b4c8ed818c6833443e80940d7926055bca8ea21b2857c9f452c3b2df0f8681ced6c97e7b2f408a5339e27452bf90a39f5045c7abab16b8b0b79996568e647e048ac0174a99fd0f03385f07685b180c0dce80fc9b0d6ab6aaa5489c95011efc1197cdbce6a23a53cbcc2a0778cf3d41d2810c811fc89f09c49d0cd7167e46e99a5e0833274f1646516a6dc986f9303f5654188de13b6df8c69254e175a20aad17a0f4b177a15639e6e7bd912d863173169760e1a152800485d368a46db417afa16f3363d883825d1c4fe74effdd9b6a5a5a44a795122a6cbe6d91b7a20f00c83a0ff4c4c545f91dd2cfa8136784cf0b9121fbdfaa8e6bd1b430e946e22ee997dbf4138ab5e318100a95b8152a2b71649a4520d797e353b3ad47455f483fddb933041cff359cf40b1e2d61ecdfd75cccbb03ed1dec22e1cc66e030d1afb7625a0e71fabfc108c702ebe81e0c33ea2210854886d920efb3d3d7aee087a49bd8eb68f92071aff2da4ec1a9aba8cdb7fad0240ee19362116c1afd4495a562a8fd23f45e9dc37aab30b5a6a820eab9c216a0db344e50c432ceffa258dc51b7ac798f52a6c00d819d003d5f9527596fe146f3a76600e371106e60353b090f1d3b9429e307c902cb20cfd44b0cdc68cb585909fdc86ae050e5326a7455c51285bab7887ba49f501c"}) 16m32.940498273s ago: executing program 2 (id=852): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) (async) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) getitimer(0x1, 0x0) r4 = dup2(r3, r2) (async) r5 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x0) ioctl$MON_IOCG_STATS(r5, 0x80089203, 0x0) (async) sendmsg$unix(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000640)=[{0x0}, {0x0}, {&(0x7f0000000480)="797fda868441a8afb40d0297", 0xc}, {&(0x7f00000004c0)="6c244b8e3b9043bbac5c3437fcedb72093875d1fdf7e6278849bf96d1a4eae5d2cea8d172bc95c5177a307263e54f11ca7823e0b579a1b9b4f2263bee5e24a3a064de858fc7a3c5f8620b8677de0aa2c2f28095652095ce79f7bb84c221b5b2fce1a7da6e65ded45f5ac79020b010b3c82c23aace52190912c025982a83321bd35eddf1756eb13", 0x87}, {&(0x7f0000000580)}, {&(0x7f00000005c0)="fa277b38579194b7f14f1cd2ac7d92a324b5be5ce1a24d80de4863e99c7602ae71bb761363b53ac0625516b7a22a", 0x2e}], 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="25000060000140000000000000000000a9efa173c49f5a73b8aa1f8a81207b4dd4ff4a561ebe86cc17a840ae08deee82f524e0ce284d3514edb4ab4b4a85f8c12a2d802d958ac2f538108e41814ee9e69f", @ANYRES32=r2, @ANYRES32=r2, @ANYRES32=r4, @ANYRES32=r2, @ANYRES32=r2, @ANYRES8=r0, @ANYRES32=r2, @ANYRES32=r5, @ANYRES32=r3], 0x38, 0x1}, 0x400a004) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000580)={@in={{0x2, 0x4e23, @empty}}, 0x0, 0x0, 0x2f, 0x0, "ede10c90e0d6d4b2b1651d4ddc62e17b5f4fa4a45bc87ce8b6cab0b0bf7f4a73a775b18b108887c58ce5057146437a52ff5d0f912a8eff0b48b4c25e7d5ae1e974f8cdaa3dccaccd26482b83f2a4afd0"}, 0xd8) (async) setsockopt$inet_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f00000002c0)={@in={{0x2, 0x4e21, @remote}}, 0x0, 0x0, 0x1f, 0x0, "fec34e77f1263643b52aa7beb3171ddb9cbe0cfef7c87cb4af8b03bc9f40e8d97a8de1e0af2e350dce1d05f076b9cb42ce8acf171c1499fd401e7e756a5653ea39b4ecd9805ee428eb40cef5df6ef362"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(r6, 0x6, 0x20, &(0x7f0000000080)={@in={{0x2, 0x0, @multicast2}}, 0x3, 0x0, 0x1a, 0x0, "5ec800000000000000fabcaff49c2eeb8c4614c85b196a0c67a7768e058e3008931c08d43101cb8242bc42b8e0662749302c1ffcd1d1190000000000000000000000000000000000000000000200"}, 0xd8) (async) r7 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000080)='ip\x00\x03cr\x80e\x83', &(0x7f0000000240)='.\x8bR\xafH\xd6e\x11\'\xec\xbb\xcb\xa0/\x1f\x16\xcf\xe2\xb5\xfc\xeb1\x12\xfdC\xb8\xa0\x01\xa3~\x971W\x96\xec\xaf\x1c\x91\xeb\xa8e\xfe\x17\x02xEA\x0f\x14\r\xae\xc1\xfe\x06\x12\beSb{~R\xf0\x06\x00\x00\x00\xf92\xce\x81p\x1fC\n\x9f(\x00\xc5\x1d\x9c\xccCq\x06\x1b-\f\xc9\xd9+\xa4\x14\xd8\xf4\xef\xf5^2\x14\xb8=\x03\x00\xd5M\x04\xf4{H\xd0\xc8\xf7\x10\xe1R \x9a^\xdfq*L\xc4lP6\x8f\xff&>\x94\x882\x1c\x00\x00\xc5\xbdD(\xa5\x17\x11\xd6\t\x12\x7fe\xba\xfc\x93\xf4\xd8\xb5\x04\xcb\x98\xd1QF\xe5\x1b\xb30x/\x86\x02\x1ct\xc7\x88\xd2\xce\xd5\x9e1\xef`\xad\x05\x11\xc9\xd8<\xc6~\x97\xd5\xde\xe3Eh\\\x84\x14\x9e\b\xe1\x9b\x00\'\xe8!\x8c\xc3\x97\x8a\xcf\xfc\x8fe\xa6\x0f\x8b\x912c\x1b>8\xc5\xa3_\xab\xf1\xf5\r\xb6\xe7\xfcS9\xd1.\x8b\xf3\xbc,?\xb2\x9aBDPY=r\xfa8I\x16\xa2\x18\xd4\xa5\x8b\xaf\xd1\x8a\xbb\x0e\x15O\xc9p@\xadaw\x84\xc9\xdd\x87a[\xdf\xc2\xa4\xf9@T/\xf5\xd1t\xc7\xeb\x04y\rr\xba^\x9f\xf4\xfb\xaa#\xf6lX\'\x03u\xc6XZ\x8eK*Zs\xdb\xcaV\x92\x84\xc5\x05i]\xb6N\xa9&a\xe6\xa1\xedgd\xc2\x8b1Kq\x90U\xe0\x9a\xee\xd6BdU?\r\xd2\x13}u\xf6\x9entz\vW\x04\x968\xc5v\xe0t:\xe0D\xe8\xca\xb8\xd5\xb0\x89\x90\x928\x1d\r\x8b\xf2#8\xf5rI=6\xa1L\x19>I\f\xe7\xab\x98\xd2x\x82\x820\xf6\x8b]T\xd1\xe0\xefD\xc3\x94O\xdd\\\xd6\xb5z.\xc9z>\xdab\xcdw\xbf\x91\x190we\xa5\xfc\xf9\xaf\xedA&\xd50\xa9\xf0\xbeX\xe8\xd0', 0x0) (async) bpf$MAP_CREATE(0x0, 0x0, 0x50) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) (async) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file5\x00', 0x82c0, 0x101) r9 = fanotify_init(0xf00, 0x0) fanotify_mark(r9, 0x105, 0x5000003a, r8, 0x0) (async) fanotify_mark(r9, 0x451, 0x40000009, r8, 0x0) r10 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0xa880, 0x97) fanotify_mark(0xffffffffffffffff, 0x8, 0x4800003c, r10, 0x0) 16m32.69843505s ago: executing program 2 (id=854): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@delchain={0x24, 0x5f, 0x333, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r2, {}, {0x8, 0xe}, {0x0, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c1}, 0x80) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmsg$rds(r3, &(0x7f0000001f00)={&(0x7f0000000640)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000001ec0)=[{&(0x7f0000000780)=""/89, 0x59}, {&(0x7f0000001d00)=""/214, 0xd6}, {&(0x7f0000001e00)=""/168, 0xa8}], 0x3, 0x0, 0x0, 0x15}, 0x814) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendto$unix(r5, &(0x7f0000000200)="137c3486d6535a4af9f9c29d372812d08c043850790ef5380d8fde994c86432ce66f2978d8756f173a5ec679eb4a7b9deb91af75c0596ea829330377d10b2bd90fa096ed58015a5cceaef47bdef554b571e4385fdac824a4c5c56e5e25b0731a292a07dd0d584cb32a9337df8c0bc89d3039b0ce3943bbd41c751a96605a2354c70e24b28c779265779d0d4ddaf01f6d6bb5566fdb0b0ec89b8abb52f21abb7dca117cacb64fd2664f92d2762ae6a0c5e44507d87f4a574d0db20c8ea9f51759b5309c153cfbc92508e75f650b287cdfd4949d", 0xd3, 0x84, &(0x7f0000000300)=@file={0x1, './file0\x00'}, 0x6e) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) r6 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$IP6T_SO_GET_ENTRIES(r6, 0x29, 0x41, &(0x7f0000000500)={'filter\x00', 0x14, "62c822c4d787836dab89b7ef182b91b189888973"}, &(0x7f0000000540)=0x38) pivot_root(&(0x7f0000000600)='./file0\x00', &(0x7f00000001c0)='./file0/../file0\x00') recvmmsg$unix(r5, &(0x7f0000001c40), 0x0, 0x40000001, &(0x7f0000001cc0)) sendmsg$rds(r3, &(0x7f0000000800)={&(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000900)=[@fadd={0x58, 0x114, 0x6, {{0x3, 0x6}, 0x0, 0x0, 0x4, 0x7, 0x100000001, 0x100000000, 0x0, 0x1001}}, @zcopy_cookie={0x18, 0x114, 0xc, 0x5}], 0x70, 0x4044004}, 0x40) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002e000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007b00000095"], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r7, 0x0, 0xe, 0x0, &(0x7f0000000680)="5f3a2f830ad298b15b9dbcfbf6f1", 0x0, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 16m32.481865087s ago: executing program 2 (id=856): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000220000000400000002"], 0x48) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000300)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x1c, 0x0, 0x7ffc1ffb}]}) link(0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r2}, &(0x7f0000000280), &(0x7f00000002c0)=r0}, 0x20) r3 = landlock_create_ruleset(&(0x7f0000000040)={0x14002, 0xf, 0x3, 0x0, 0x1, 0x3}, 0x30, 0x0) landlock_restrict_self(r3, 0x3) r4 = socket$inet6(0xa, 0x2, 0x0) sendto$phonet(r4, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x23, 0x89, 0x3e, 0x1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_int(r6, 0x11e, 0x1, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f00000e6000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r7 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r7, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r7, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e0000002ac1414aa"], 0x1c) syz_emit_ethernet(0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="0180c2aaaaaaaaaaaa080045000028006400000a02907802000000e000000211009078e00000020001000100000000000000000000007f2eef83c7453d3758cb93ed5181e3a6d84252a0237f43e96f60c887dd86479be6cbae8ba5a4da0bf2d291bae0177a40d82c8cf7bc42831fa3ab04c064692a7002230955370742f523ab3a273e3399dcc363b1f8662a9736dff8ae8d7f8cbf7d2442d5c554fbcf5c6a74e94bf958a06ba7e5158301df7aa8bfc147ad5819b626ae68"], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r8 = io_uring_setup(0x1b7d, &(0x7f0000000040)={0x0, 0xc89d, 0xc000, 0xa, 0x3c}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0x0, 0xfff0}, {0xe, 0xffe0}}}, 0x24}}, 0x0) io_uring_enter(r8, 0x2e80, 0x7721, 0x44, 0x0, 0x0) r9 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) sched_setscheduler(r5, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 16m32.002480109s ago: executing program 2 (id=858): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) socket$inet6_mptcp(0xa, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x11, 0x4, 0x4, 0x5, 0x0, 0xffffffffffffffff, 0x9d}, 0x50) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {0xffff}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 16m31.692676589s ago: executing program 32 (id=858): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) socket$inet6_mptcp(0xa, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x11, 0x4, 0x4, 0x5, 0x0, 0xffffffffffffffff, 0x9d}, 0x50) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {0xffff}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 11m26.559465187s ago: executing program 5 (id=1797): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x70, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbba, {0x0, 0x0, 0x0, r2, {0xc, 0xc}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x40, 0x2, [@TCA_BASIC_EMATCHES={0x3c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x5}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x0, 0x86}, {0x5, 0x7}}}]}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x1, 0x7, 0x2}, {{0x3, 0x0, 0x1}, {0x4, 0x0, 0x1}}}}]}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x20041090}, 0x4880) r3 = socket$unix(0x1, 0x2, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$kcm(r4, 0x0, 0x884) 11m25.79373316s ago: executing program 5 (id=1802): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$9p_unix(&(0x7f0000002600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000003600)='.\x00', &(0x7f0000003640), 0x2000000, &(0x7f0000003680)) syz_usb_connect(0x6, 0x24, 0x0, 0x0) r3 = socket(0x21, 0x6, 0x3ff) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x103400, 0x0) readv(r4, &(0x7f0000000240)=[{&(0x7f00000000c0)=""/15, 0xf}, {0x0, 0xfffffd76}], 0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_HANDLE={0xfffffffffffffd54, 0x4, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}]}, @NFT_MSG_NEWRULE={0x12c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_USERDATA={0x103, 0x7, 0x1, 0x0, "09f6b6b9df39b9e4250398a5f6dc81538b0709edb4e55e6e35a8cfcd9090c25633c4a439f6ac7b9b539c0b84059946d9531598444ced6c25784b0673b19b37a4d292d88d046c82e199c4ccbc8650212430e3baab717b8321cd83df8977badebf9e2e46208ef31b795c57e20eb0652521fdf23775e8c5fbdec01f263340cddd2f9e36ef873a6d7a873ecd4bf7e2e81f33d87b2194f4ee2c90dfd385e81d05ab5b3ad23920dc3a400ae01204762ca66abb51124d653834301392e68b1d20ef52df8cbb0ffcbc9542f6ec133a908375a12ad005dcca4a60b6b3a9e662a15b867772823d8ebbfad7ebe13f2887a8eb78dd09e0ffe232490221ac5cf895882050d5"}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x1a0}}, 0x0) r6 = socket$key(0xf, 0x3, 0x2) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r7, r7, 0x200000000000000) r8 = syz_open_procfs$namespace(r0, &(0x7f0000000100)='ns/pid_for_children\x00') r9 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000009c0)=@bpf_tracing={0x1a, 0x11, &(0x7f0000000840)=@raw=[@jmp={0x5, 0x1, 0x3, 0x0, 0x2, 0x0, 0xfffffffffffffff0}, @btf_id={0x18, 0x7, 0x3, 0x0, 0x5}, @map_idx={0x18, 0xa, 0x5, 0x0, 0x2}, @map_fd={0x18, 0x5, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x3}, @map_fd={0x18, 0x3, 0x1, 0x0, r3}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r8}}], &(0x7f0000000540)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, 0x11, r4, 0x8, &(0x7f0000000580)={0x3, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x9ea1, r4, 0x1, &(0x7f0000000940)=[0xffffffffffffffff, r4, r4, r4, 0xffffffffffffffff, r4], &(0x7f0000000980)=[{0x1, 0x2, 0x5, 0x6}], 0x10, 0xa}, 0x94) syz_emit_ethernet(0x141, &(0x7f0000000a80)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x10b, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @dest_unreach={0x1, 0x3, 0x0, 0x1, '\x00', {0xe, 0x6, "266ccf", 0x400, 0x3c, 0x1, @private0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', [@routing={0x0, 0x10, 0x1, 0x5, 0x0, [@ipv4={'\x00', '\xff\xff', @multicast2}, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', @remote, @private1={0xfc, 0x1, '\x00', 0x1}, @private1, @empty, @empty]}, @hopopts={0x33, 0x4, '\x00', [@ra={0x5, 0x2, 0x2}, @ra={0x5, 0x2, 0x6}, @padn={0x1, 0x2, [0x0, 0x0]}, @pad1, @enc_lim={0x4, 0x1, 0x3a}, @hao={0xc9, 0x10, @local}]}], "2030ba940bf9ff6aa4c8d22be521d01ef5a5244485052b1dec93bca5969c4b751b7bf5"}}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r9, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r10 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup=r10, 0x11, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000640)={@cgroup=r11, 0x24, 0x0, 0xffff, &(0x7f0000000000)=[0x0], 0x40e8, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$key(r6, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000e80)=ANY=[], 0x80}, 0x1, 0x7}, 0x0) listen(r3, 0x0) setsockopt$sock_timeval(r3, 0x1, 0x14, &(0x7f0000454ff0)={0x0, 0x2710}, 0x10) 11m22.704688084s ago: executing program 5 (id=1809): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000280)={'gre0\x00', &(0x7f0000000180)={'gre0\x00', 0x0, 0x10, 0x8000, 0x9, 0x7, {{0x30, 0x4, 0x2, 0x8, 0xc0, 0x68, 0x0, 0x9, 0x0, 0x0, @rand_addr=0x64010101, @multicast2, {[@timestamp_prespec={0x44, 0x44, 0xbd, 0x3, 0xe, [{@remote, 0x8}, {@multicast2, 0x474b}, {@local, 0x6}, {@empty, 0x5}, {@private=0xa010100, 0x8595}, {@broadcast, 0x4}, {@private=0xa010100, 0x4816}, {@rand_addr=0x64010101, 0xfffffff8}]}, @end, @ssrr={0x89, 0x7, 0x6c, [@rand_addr=0x64010101]}, @timestamp_addr={0x44, 0x24, 0x17, 0x1, 0x2, [{@local, 0x7}, {@remote, 0x488}, {@rand_addr=0x64010100, 0x7d}, {@remote, 0xae}]}, @timestamp={0x44, 0x18, 0x9b, 0x0, 0x6, [0x3, 0x200, 0x401, 0x6, 0xffffffff]}, @lsrr={0x83, 0x7, 0x32, [@remote]}, @lsrr={0x83, 0x7, 0x98, [@loopback]}, @noop, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x9, [0x0, 0x9, 0x9, 0xd2]}]}}}}}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e000000040000000800000005", @ANYRES8], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r4, r6, 0x25, 0x2, @val=@netfilter={0x0, 0x0, 0x5}}, 0x20) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wg1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wg1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000480)={'gre0\x00', &(0x7f0000000340)={'gretap0\x00', 0x0, 0x8000, 0x8000, 0x9, 0x81, {{0x3b, 0x4, 0x1, 0x17, 0xec, 0x66, 0x0, 0x9, 0x2f, 0x0, @loopback, @local, {[@rr={0x7, 0xf, 0x6c, [@loopback, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp={0x44, 0x1c, 0x45, 0x0, 0x6, [0x7, 0x8001, 0x9e5, 0xffff, 0x1, 0x40008000]}, @noop, @lsrr={0x83, 0x1b, 0xa6, [@multicast2, @multicast1, @remote, @dev={0xac, 0x14, 0x14, 0xa}, @private=0xa010100, @broadcast]}, @generic={0x83, 0x5, "fa88c8"}, @lsrr={0x83, 0x13, 0x67, [@remote, @broadcast, @remote, @private=0xa010101]}, @ssrr={0x89, 0x13, 0xe8, [@private=0xa010100, @empty, @private=0xa010100, @local]}, @timestamp={0x44, 0x8, 0x11, 0x0, 0x6, [0x698a]}, @timestamp={0x44, 0x18, 0xf2, 0x0, 0x1, [0x8, 0x2, 0x3ff, 0x7, 0x3]}, @timestamp_prespec={0x44, 0x44, 0x55, 0x3, 0xe, [{@dev={0xac, 0x14, 0x14, 0x13}, 0x2}, {@multicast2, 0x1000}, {@remote, 0x7ff}, {@multicast2, 0x8}, {@rand_addr=0x64010102, 0x82cc}, {@remote, 0x58581b2d}, {@empty}, {@rand_addr=0x64010101, 0x9}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000540)={'ip6gre0\x00', &(0x7f00000004c0)={'syztnl0\x00', 0x0, 0x2f, 0x81, 0x0, 0x7ff, 0x22, @dev={0xfe, 0x80, '\x00', 0x21}, @loopback, 0x8, 0x8010, 0x7, 0x9}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000600)={'ip_vti0\x00', &(0x7f0000000580)={'ip_vti0\x00', 0x0, 0x7, 0x8, 0x3, 0x3, {{0xc, 0x4, 0x1, 0x4, 0x30, 0x67, 0x0, 0xf9, 0x4, 0x0, @remote, @rand_addr=0x64010101, {[@noop, @ssrr={0x89, 0x1b, 0x22, [@remote, @loopback, @remote, @local, @multicast1, @loopback]}]}}}}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000940)={0xffffffffffffffff, 0xe0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x6, &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xf1, &(0x7f0000000700)=[{}, {}], 0x10, 0x10, &(0x7f0000000780), &(0x7f00000007c0), 0x8, 0xef, 0x8, 0x8, &(0x7f0000000800)}}, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r0, &(0x7f0000000b40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000b80)=ANY=[@ANYBLOB="58010000", @ANYRES16=r1, @ANYBLOB="20002dbd7000fddbdf25110000007400018008000100", @ANYRES32=r2, @ANYBLOB="140002006970366772653000000000000000000008000100", @ANYRES32=r6, @ANYBLOB="140002006361696630000000000000000000000008000100", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="140002006c6f00000000000000000000000000001400020076657468315f746f5f627269646765002c0001801400020070696d726567300000000000000000001400020064766d727031000000000000000000000c00018008000100", @ANYRES32=r8, @ANYBLOB="14000180a9531a45e508000300000000000800010000bf5bc8", @ANYRES32=r9, @ANYBLOB="3c00018008000100", @ANYRES32=r10, @ANYBLOB="1400020076657468305f746f5f6873720000000008000100", @ANYRES32=r11, @ANYBLOB="140002006e657464657673696d3000000000000020000180140002007369743000000000000000000000000008000300020000002800018008000300020000001400020076657468305f766972745f776966690008000100", @ANYRES32=r12, @ANYBLOB], 0x158}, 0x1, 0x0, 0x0, 0x10}, 0x10) r13 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r13, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000100000000000000000085ff000034000000000000000000000008001c00c9"], 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) r14 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r14, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000100000000000000000085ff000039"], 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) 11m21.67612613s ago: executing program 5 (id=1815): msgget$private(0x0, 0x40) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCMBIS(r2, 0x5416, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x60, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, 0x0, 0x0, 0x0) recvmmsg(r4, 0x0, 0x0, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, 0x0, 0x0) syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x80) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000001, 0x11, 0xffffffffffffffff, 0xc10c3000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) 11m20.785257203s ago: executing program 5 (id=1817): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x37}, 0x24}}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x40002, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000001c0)="00940a37", 0x4) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000100)=0x4) sendto$unix(r2, 0x0, 0x0, 0x800, 0x0, 0x0) recvfrom(r2, &(0x7f00000030c0)=""/4117, 0xffffffffffffffbf, 0x1, 0x0, 0xffffffffffffffb5) write$cgroup_pid(r0, &(0x7f0000000080), 0x12) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x57) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r3 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="dbaa00fee000000071101d38000000009500000000000000"], 0x0, 0x8, 0x0, 0x0, 0x41100, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) 11m20.331873142s ago: executing program 5 (id=1820): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000180)=0x1000000, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000500)={{{@in=@multicast2, @in=@broadcast, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x2}, {0x0, 0x0, 0xfffffffffffffffc, 0x101}, 0x0, 0x0, 0x1, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x2, 0x3, 0xbb, 0xfffffffe, 0x7}}, 0xe8) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000c}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @broadcast}]}}}]}, 0x40}}, 0x4040) 11m4.674470388s ago: executing program 33 (id=1820): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000180)=0x1000000, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000500)={{{@in=@multicast2, @in=@broadcast, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x2}, {0x0, 0x0, 0xfffffffffffffffc, 0x101}, 0x0, 0x0, 0x1, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x2, 0x3, 0xbb, 0xfffffffe, 0x7}}, 0xe8) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000c}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @broadcast}]}}}]}, 0x40}}, 0x4040) 10m30.27815896s ago: executing program 0 (id=1957): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000280)={'gre0\x00', &(0x7f0000000180)={'gre0\x00', 0x0, 0x10, 0x8000, 0x9, 0x7, {{0x30, 0x4, 0x2, 0x8, 0xc0, 0x68, 0x0, 0x9, 0x0, 0x0, @rand_addr=0x64010101, @multicast2, {[@timestamp_prespec={0x44, 0x44, 0xbd, 0x3, 0xe, [{@remote, 0x8}, {@multicast2, 0x474b}, {@local, 0x6}, {@empty, 0x5}, {@private=0xa010100, 0x8595}, {@broadcast, 0x4}, {@private=0xa010100, 0x4816}, {@rand_addr=0x64010101, 0xfffffff8}]}, @end, @ssrr={0x89, 0x7, 0x6c, [@rand_addr=0x64010101]}, @timestamp_addr={0x44, 0x24, 0x17, 0x1, 0x2, [{@local, 0x7}, {@remote, 0x488}, {@rand_addr=0x64010100, 0x7d}, {@remote, 0xae}]}, @timestamp={0x44, 0x18, 0x9b, 0x0, 0x6, [0x3, 0x200, 0x401, 0x6, 0xffffffff]}, @lsrr={0x83, 0x7, 0x32, [@remote]}, @lsrr={0x83, 0x7, 0x98, [@loopback]}, @noop, @timestamp={0x44, 0x14, 0xd4, 0x0, 0x9, [0x0, 0x9, 0x9, 0xd2]}]}}}}}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e000000040000000800000005", @ANYRES8], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r4, r6, 0x25, 0x2, @val=@netfilter={0x0, 0x0, 0x5}}, 0x20) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wg1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wg1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000480)={'gre0\x00', &(0x7f0000000340)={'gretap0\x00', 0x0, 0x8000, 0x8000, 0x9, 0x81, {{0x3c, 0x4, 0x1, 0x17, 0xf0, 0x66, 0x0, 0x9, 0x2f, 0x0, @loopback, @local, {[@rr={0x7, 0x13, 0x6c, [@local, @loopback, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp={0x44, 0x1c, 0x45, 0x0, 0x6, [0x7, 0x8001, 0x9e5, 0xffff, 0x1, 0x40008000]}, @noop, @lsrr={0x83, 0x1b, 0xa6, [@multicast2, @multicast1, @remote, @dev={0xac, 0x14, 0x14, 0xa}, @private=0xa010100, @broadcast]}, @generic={0x83, 0x5, "fa88c8"}, @lsrr={0x83, 0x13, 0x67, [@remote, @broadcast, @remote, @private=0xa010101]}, @ssrr={0x89, 0x13, 0xe8, [@private=0xa010100, @empty, @private=0xa010100, @local]}, @timestamp={0x44, 0x8, 0x11, 0x0, 0x6, [0x698a]}, @timestamp={0x44, 0x18, 0xf2, 0x0, 0x1, [0x8, 0x2, 0x3ff, 0x7, 0x3]}, @timestamp_prespec={0x44, 0x44, 0x55, 0x3, 0xe, [{@dev={0xac, 0x14, 0x14, 0x13}, 0x2}, {@multicast2, 0x1000}, {@remote, 0x7ff}, {@multicast2, 0x8}, {@rand_addr=0x64010102, 0x82cc}, {@remote, 0x58581b2d}, {@empty}, {@rand_addr=0x64010101, 0x9}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000540)={'ip6gre0\x00', &(0x7f00000004c0)={'syztnl0\x00', 0x0, 0x2f, 0x81, 0x0, 0x7ff, 0x22, @dev={0xfe, 0x80, '\x00', 0x21}, @loopback, 0x8, 0x8010, 0x7, 0x9}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000600)={'ip_vti0\x00', &(0x7f0000000580)={'ip_vti0\x00', 0x0, 0x7, 0x8, 0x3, 0x3, {{0x6, 0x4, 0x1, 0x4, 0x18, 0x67, 0x0, 0xf9, 0x4, 0x0, @remote, @rand_addr=0x64010101, {[@noop]}}}}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000940)={0xffffffffffffffff, 0xe0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x6, &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xf1, &(0x7f0000000700)=[{}, {}], 0x10, 0x10, &(0x7f0000000780), &(0x7f00000007c0), 0x8, 0xef, 0x8, 0x8, &(0x7f0000000800)}}, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r0, &(0x7f0000000b40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000b80)=ANY=[@ANYBLOB="58010000", @ANYRES16=r1, @ANYBLOB="20002dbd7000fddbdf25110000007400018008000100", @ANYRES32=r2, @ANYBLOB="140002006970366772653000000000000000000008000100", @ANYRES32=r6, @ANYBLOB="140002006361696630000000000000000000000008000100", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="140002006c6f00000000000000000000000000001400020076657468315f746f5f627269646765002c0001801400020070696d726567300000000000000000001400020064766d727031000000000000000000000c00018008000100", @ANYRES32=r8, @ANYBLOB="14000180a9531a45e508000300000000000800010000bf5bc8", @ANYRES32=r9, @ANYBLOB="3c00018008000100", @ANYRES32=r10, @ANYBLOB="1400020076657468305f746f5f6873720000000008000100", @ANYRES32=r11, @ANYBLOB="140002006e657464657673696d3000000000000020000180140002007369743000000000000000000000000008000300020000002800018008000300020000001400020076657468305f766972745f776966690008000100", @ANYRES32=r12, @ANYBLOB], 0x158}, 0x1, 0x0, 0x0, 0x10}, 0x10) r13 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r13, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000100000000000000000085ff000034000000000000000000000008001c00c9"], 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) r14 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r14, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000100000000000000000085ff000039"], 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) 10m29.629831352s ago: executing program 0 (id=1961): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000047c0)=@raw={'raw\x00', 0x8, 0x3, 0x12b0, 0x0, 0x11, 0x148, 0x1118, 0x0, 0x1218, 0x2a8, 0x2a8, 0x1218, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x10f8, 0x1118, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x136def03, 0x7}}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x1, 0x1, './cgroup.net/syz0\x00', 0xc, {0x3}}}]}, @unspec=@TRACE={0x20}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x1310) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000025300)=""/102392, 0x18ff8) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000240)={0x0, 0xa1, "c6a0d1e15e86a2ecef69665fe8b9b53ed811ace1fe517665c41d3b7eeb817d27ec0b7003adcab5d31852fa613fc2a7d4dc5fafe55555672fe5d3286509982d8153b552ce8e8d5b6aea146163234366d45aeeb2c4561eccdfc0afa7820ad1cb6c1b906405c17ee846afd950d153eb6370252f03a7febacc39fa8b750a9062893313ad89886189de24bb314abaf184457988b389e884b80a7002f66a293bedeb482f"}, &(0x7f0000000300)=0xa9) 10m29.170663139s ago: executing program 0 (id=1964): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000008c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000005e00010028bd7000fbdbdf2500000000", @ANYRES32=r2, @ANYBLOB="04"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20044800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0xc03, 0x0) ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000140)={{0x0, 0x4, 0x0, 0x9}, 'syz0\x00', 0x13}) ioctl$UI_DEV_CREATE(r5, 0x5501) syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0) syz_open_procfs(r4, &(0x7f00000001c0)='net/unix\x00') socket(0x10, 0x80002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1c) socket$rds(0x15, 0x5, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r6) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) 10m28.818662657s ago: executing program 0 (id=1965): r0 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xc, &(0x7f0000000640)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000680), 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') r4 = creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) quotactl_fd$Q_SETINFO(r4, 0xffffffff80000601, 0x0, &(0x7f0000000180)={0x4a0f, 0x2, 0x0, 0x7}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = add_key(0x0, 0x0, &(0x7f00000002c0)="1d", 0x1, 0xfffffffffffffffe) keyctl$revoke(0x3, r5) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) shutdown(r6, 0x1) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(r7, 0x112, 0x13, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x5c8, 0xe0, 0xe0, 0x0, 0x0, 0x1c0, 0x520, 0x520, 0x520, 0x520, 0x520, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe0, 0x0, {0x7a00000010000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x2, 0x1}, {0xffffffffffffffff, 0x4, 0x1}, {0xffffffffffffffff, 0x4}, 0x5, 0x7ff}}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0xa}, [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0x0, 0xffffffff, 0xff], 'macvlan0\x00', 'veth1_vlan\x00', {}, {}, 0x6, 0x1, 0x4}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffff}, {}, {0x87, 0x0, 0x7}}}}, {{@uncond, 0x0, 0x108, 0x130, 0x48000000, {}, [@common=@inet=@udp={{0x30}, {[0x4e20, 0x4e23], [0x4e21, 0x4e21]}}, @common=@srh={{0x30}, {0x33, 0x66, 0xf8, 0xa6, 0x9, 0x440, 0x502}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv4=@empty, 0x2c, 0x16, 0x4}}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@dst={{0x48}, {0x7ff, 0x2, 0x1, [0xff, 0x4239, 0x1, 0x8001, 0xb1, 0xfff5, 0x5, 0xd, 0xfff, 0x3, 0xb, 0xa, 0x5, 0x10, 0x2, 0xc], 0xd}}]}, @HL={0x28, 'HL\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x628) r8 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) unshare(0x22020600) syz_open_dev$usbfs(0x0, 0x77, 0x101301) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r9 = fsmount(r8, 0x0, 0x0) r10 = openat$cgroup(r9, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) syz_clone3(&(0x7f0000000340)={0x201800000, 0x0, 0x0, 0x0, {0x1f}, 0x0, 0x0, 0x0, 0x0, 0x0, {r10}}, 0x58) 10m26.160749291s ago: executing program 0 (id=1973): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000180)=0x6f) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$dsp(r2, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x88a00, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r3 = msgget$private(0x0, 0x508) msgrcv(r3, 0x0, 0x0, 0x1, 0x0) msgctl$IPC_RMID(r3, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x79, 0xfffffffffffffffc, 0x8000, 0x2, 0x10001}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000200)={'macvtap0\x00', &(0x7f0000000000)=@ethtool_cmd={0x4a, 0x20000000, 0x0, 0x7, 0xff, 0x0, 0x5, 0x0, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, [0x0, 0xab]}}) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') ioctl$CEC_TRANSMIT(r4, 0xc0386105, &(0x7f0000000180)={0x8d, 0x1, 0x3, 0x7, 0x3, 0x3, "b8067bdca1a66e65920f2fda16f4192a", 0x7, 0x7, 0xff, 0x9, 0x7, 0x5, 0x5}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r5, &(0x7f0000001600)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001580)={0x1c, 0xe, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x4000040) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x6) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x12, 0xffffffffffffffff, 0xc83b6000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x2, 0xd) 10m23.092649438s ago: executing program 0 (id=1980): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r1 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$zero(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r2, &(0x7f0000000040)={0x400a}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x2000000c}) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) io_uring_register$IORING_REGISTER_MEM_REGION(r5, 0x22, &(0x7f00000001c0)={&(0x7f0000000140)={&(0x7f0000000080)="aad4d7fcbf959c24a8ea75841a9ed441107801b79cad05986931776d678b977de5580771a538", 0x26, 0x1, 0x8, 0x324d}, 0x1}, 0x1) epoll_pwait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x6, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r6, 0x0, 0x20000023896) ioctl$TCSBRKP(r0, 0x5425, 0x9) 10m22.189860738s ago: executing program 34 (id=1980): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r1 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$zero(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r2, &(0x7f0000000040)={0x400a}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x2000000c}) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) io_uring_register$IORING_REGISTER_MEM_REGION(r5, 0x22, &(0x7f00000001c0)={&(0x7f0000000140)={&(0x7f0000000080)="aad4d7fcbf959c24a8ea75841a9ed441107801b79cad05986931776d678b977de5580771a538", 0x26, 0x1, 0x8, 0x324d}, 0x1}, 0x1) epoll_pwait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x6, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r6, 0x0, 0x20000023896) ioctl$TCSBRKP(r0, 0x5425, 0x9) 1m54.323830359s ago: executing program 4 (id=3960): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000000280)={{0x25, 0x0, 0x1ff, 0xffffffff, 'syz1\x00'}, 0x0, [0x0, 0x1ffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, 0x400, 0x1, 0xdffffffffffffffc, 0x91b, 0x0, 0x10000000000000b, 0xffffffffffffffff, 0x8000, 0x7, 0x0, 0x1d4c06aa, 0x3, 0x3ff, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x9, 0x0, 0x4000000000000000, 0x0, 0x9, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x400000000000000, 0x0, 0x0, 0x9d7b, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x0, 0x800000000000000, 0x1, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x75, 0x8, 0x10000200000003, 0x0, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x400000007, 0x0, 0x1000, 0xfffffffffffffff7, 0x0, 0x200000, 0x2000000009, 0x2, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffc, 0x40000000000, 0x0, 0x1, 0x0, 0x3, 0x80000000000, 0x10, 0x100000000, 0x5, 0x100000001, 0x2, 0xfffffffffffffffe, 0x0, 0x400003, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x80000000000000, 0x800000000000000, 0x8, 0x0, 0x0, 0x2, 0x0, 0x10, 0x6, 0x1, 0xfffffffffffffbff, 0x1, 0x0, 0x0, 0xfffffffffffffffe, 0x6, 0x0, 0xfffffffffffffffc]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() prlimit64(r2, 0x0, &(0x7f0000000180)={0x10, 0x100000000}, 0x0) sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000040)={0x8000, 0x8001, {r2}, {0xffffffffffffffff}, 0x7, 0xcfd}) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000080)={0x6, 0x0, 0x6}, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}]) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000ec29000000181100", @ANYRES32=r5], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c00000010001fff26bd70000100000000000000", @ANYRES32=0x0, @ANYBLOB="000000002800010067656e65766500000c00029a05000d000900003805ffffffffffffff077f20ee57c2d01492a3e4e17a9b79f8ca831435f30419b3151273499c325c5a286d0400e5477caf7ce9383f4b33694b179d5a827effcc2c204a3d1bfac6a0c091030947f3998d763c5829f1bd23f3f9ab33351f4bfbbf4b033f903ab4d4b6a73d477b0ac9bdcb7b48e7fea8e5bf9651e6e0981396f4ada8e62b1f24d2cdfaa3104cde4a3d3263"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc) r8 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000008c0)=[0x0, 0x0, 0x0], 0x0, 0x0, 0x0, 0x3}) ioctl$DRM_IOCTL_MODE_GETCRTC(r8, 0xc06864a1, &(0x7f0000000580)={0x0, 0x0, r9, 0x0}) syz_usb_connect(0x0, 0x2f, &(0x7f0000000b40)={{0x12, 0x1, 0x250, 0x91, 0x9c, 0x39, 0x10, 0x1546, 0x1104, 0xb60d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1d, 0x1, 0x3, 0x7, 0x40, 0x1, "", [{{0x9, 0x4, 0x47, 0x8, 0x1, 0x2, 0x6, 0x0, 0x2, [], [{{0x9, 0x5, 0x4, 0x0, 0x10, 0x7f, 0xfe, 0xa2, [@generic={0x2, 0x9}]}}]}}]}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x1, 0x0, 0x0, [{0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="0003b14c066f6953ccc4370982b893e50e78b7abdfa0f72743eb3b11a73250e1ec8db10265672c5985de2adfafd0861801406edcf1cfce81b3887a6a75e361be0d6773e27f7d95ee25e75767bb4f6ba11ef153fa7cc6e940e51dfe2ce0a64bc1ea491a37a04abe0646fa655dcc3bdd4f18cd460536a77d4b71ba9d36aaf60bb35d076b800000000000000021b91c0086794586677c6fd55a2acaed147bd18462fef197dcea891f08e155a558e5b49443d6cb1c8362edcd9c4218eff75bf67bfd88bcb63d9e0a9b734a5a649c392a074e16579f61424cbe8548b75e5f7be8976f16dba86ec8fb59e3ef15d5b072e1a53248cbc17097a77aacf91298a19a7aa256c1124a4842a00ecd69f300c562129928eb35a9020f0922ea6066026532b03221c817d6f1ab404fbc0adf482bd11d7cdb1ffc9afc2ac1b26781adec465b7df4ee3e"]}, {0x0, &(0x7f0000000200)=@lang_id={0x0, 0x3, 0x200a}}, {0x0, &(0x7f0000000780)=@string={0x0, 0x3, "fe212751cd13b34fd033f9d720fcb6afe57bcaffcfd078d93aaaac974ab1a1274e6d886a758c61cdc7c5ecce7109122fdbac2257ce29992ba47ed5bd7b942c0d13c633a7ee4fd3f72bc8824cf59f84f18fa691c189abea5103d1fcddcc502d07e3e063fa8309185bb6a58fef6571021368548c77cb04643491a298a7becaddf3c0f9590635c35c401a69c94020049215a5e5648735acd24e31edbf377a568344bf87e9644779cc5be9389adfd5ef7a929c3dc021b908bfee7445bb2e21a71a70655890f307b053ae3684cc1f25dcc977e68af9204786ac84d076d2d99a9239684c0ba666b3082e7400f52dae"}}, {0x0, &(0x7f00000002c0)=@lang_id={0x0, 0x3, 0x430}}, {0x0, &(0x7f0000000540)=@string={0x0, 0x3, "aec62372712d498b8ff2bc0240c1ab1a0dc7778c939fd3280ae4ac709451c8ffb238a046d763b0ffbb415d6bcf2fb2d0067404c72998c37cf011f00c7d977bee82f5fdcbb2fddb03bbdbdf472984d1e406707926a6524af9a15287735934b451dfd692cf683f8765aa50028dc5c374d22f8835b27500195d30e77457ff6eb469b398eac63151cb3386942f919474666c64894bb3a8bb971dbeb07f8ad5847a4a712e59b89b21dc081c06a8bbb63d7edca816a8d1458b29c4d557328e91a7a456e8cc3a48d4a209a4dfebb7f423d4cc405b667ae368ad847d7072f8ababd67b7ffc8b"}}, {0x0, &(0x7f0000000340)=@lang_id={0x0, 0x3, 0x82c}}, {0x0, &(0x7f0000000380)=@lang_id={0x0, 0x3, 0x40c}}, {0x0, &(0x7f0000000640)=@string={0x0, 0x3, "77252d3a480a34464c0ba0386024c16cfc1170a78338cb95c1be6a3bf2440b7b60e12076d03a09753b862a7aae48cc1fa35b09aa1699cd28168d0ed665750616ce03d96c7a1c3ac5deb398d33d14c903"}}, {0x0, &(0x7f0000000500)=@lang_id={0x0, 0x3, 0x43f}}]}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r8, 0xc01864b0, &(0x7f0000000100)={r9, r10, 0x0, 0x0, 0xfffffffffffffffe}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r8, 0xc01864b0, &(0x7f0000000000)={r9, r10, 0x1, 0x0, 0xd4}) 1m51.229652352s ago: executing program 4 (id=3967): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000000c0)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'xfrm0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="10031200e4ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) 1m50.423305075s ago: executing program 4 (id=3969): socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4004804) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x90, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0x4}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x60, 0x2, {{0x0, [0x10, 0x2, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3, 0x5c4, 0xf4, 0x0, 0x0, 0x3dc, 0x1], [0x0, 0x4, 0x0, 0x0, 0xfffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x1, 0x0, 0x0, 0x1000]}, [@TCA_MQPRIO_SHAPER={0x6}]}}}]}, 0x90}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0x8, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40001}, 0x4040010) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000002b80)=ANY=[@ANYBLOB="ffea86dd0001000000000000006000000000382c00fe8000000000000000000000000000aaff0200000000000000000000000000016c000000000000000100907809000000699951a503ff3c00fe8000000000000000000000000000bbfe8000000000000000000000000000bb00"], 0x6e) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYRES32=r7, @ANYRES32=r7, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r7, @ANYBLOB="a18cfa80e423a39af4b38502022d28"], 0x44}}, 0x884) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r8 = io_uring_setup(0x74ab, &(0x7f0000000400)={0x0, 0x75cd, 0x200, 0x0, 0x116}) io_uring_register$IORING_REGISTER_BUFFERS2(r8, 0xf, &(0x7f0000002380)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x20) openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x141042, 0x26) renameat2(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file3\x00', 0x4) r9 = inotify_init1(0x80800) inotify_add_watch(r9, &(0x7f0000000040)='./file3\x00', 0x80000b08) rename(&(0x7f0000000200)='./file3\x00', &(0x7f0000000240)='./file1\x00') r10 = openat$panthor(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(r10, 0x80046402, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 1m48.15557886s ago: executing program 4 (id=3973): capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0xe, 0x13e, 0x89, 0x2, 0x6}) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) (fail_nth: 7) 1m47.439371049s ago: executing program 4 (id=3976): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='net/dev_snmp6\x00') getdents(r0, &(0x7f0000000080)=""/199, 0xc7) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r1 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x404c2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r1, 0x40049366, 0x0) 1m46.243488594s ago: executing program 4 (id=3983): socket$nl_rdma(0x10, 0x3, 0x14) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000140)={0x0, 0x7ff}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000340)={r1, @in={{0x2, 0x4e23, @local}}, 0x4bab, 0x6, 0x5, 0x8, 0x6}, &(0x7f0000000400)=0x98) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0xffffffffffffff91, 0x0}, &(0x7f0000000240)=0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1bc2, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f9}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) r3 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x10}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043b0a"], 0xd) mkdirat(0xffffffffffffff9c, 0x0, 0x1ec) 1m30.953601176s ago: executing program 35 (id=3983): socket$nl_rdma(0x10, 0x3, 0x14) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000140)={0x0, 0x7ff}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000340)={r1, @in={{0x2, 0x4e23, @local}}, 0x4bab, 0x6, 0x5, 0x8, 0x6}, &(0x7f0000000400)=0x98) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0xffffffffffffff91, 0x0}, &(0x7f0000000240)=0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1bc2, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f9}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) r3 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x10}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043b0a"], 0xd) mkdirat(0xffffffffffffff9c, 0x0, 0x1ec) 22.018761944s ago: executing program 7 (id=4238): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8946, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r1, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, 0x0, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x4, 0x0, 0x0, &(0x7f00007d4000/0x4000)=nil, 0x4000, 0xfffffffffffffffe}) mprotect(&(0x7f00004ef000/0x3000)=nil, 0x3000, 0x1000002) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f00000002c0)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) 21.432237198s ago: executing program 7 (id=4242): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) pipe2$watch_queue(&(0x7f0000000000), 0x80) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x300440c4) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) syz_usb_disconnect(0xffffffffffffffff) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() syz_open_procfs$userns(r0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(0x0, 0x7, 0x2, &(0x7f0000000040)={0x0, 0x3938700}, &(0x7f0000000200), 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000023000701feffffff02000000027c0000040042800c00000000000000000914bb140002"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0x4800) 19.559643321s ago: executing program 7 (id=4245): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a1740, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r0 = socket(0x15, 0x5, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(0xffffffffffffffff, 0x404c4701, 0x0) getsockopt(r0, 0x200000000114, 0x2721, 0x0, &(0x7f0000000000)) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=[@wrmsr={0x65, 0x20, {0x40000000, 0x3}}], 0x20}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16.421265594s ago: executing program 1 (id=4253): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) rseq(0x0, 0x0, 0x0, 0x0) mmap(&(0x7f00007fd000/0x800000)=nil, 0x800000, 0xa, 0x2030, r0, 0x9232b000) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000005c0)) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_FW_DOWNLOAD(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010177bd7000fbdbdf2515000000080014006e66630008000100", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x2400c040) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)={0x0, 0x0}) prlimit64(r4, 0x1, &(0x7f0000000240)={0xc57e, 0x100}, 0x0) eventfd2(0xffff, 0x80800) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r5, 0x40047438, &(0x7f0000000340)=0x1) close(r0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, 0x0) 14.292906505s ago: executing program 1 (id=4256): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) pipe2$watch_queue(&(0x7f0000000000), 0x80) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x300440c4) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) syz_usb_disconnect(0xffffffffffffffff) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() syz_open_procfs$userns(r0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000023000701feffffff02000000027c0000040042800c00000000000000000914bb140002"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0x4800) 12.34759539s ago: executing program 1 (id=4258): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x7) r0 = syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0xff08) getpid() mount$overlay(0x0, &(0x7f0000005100)='./file0\x00', &(0x7f00000054c0), 0xa, &(0x7f0000005500)={[{@index_on}, {@uuid_off}, {@default_permissions}, {@metacopy_on}, {@userxattr}], [{@subj_type}]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x88002, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000980)={0x14, 0x0, 0x0}, &(0x7f0000000bc0)={0x44, &(0x7f00000009c0)=ANY=[@ANYBLOB="20e300000000"], 0x0, &(0x7f0000000a40)={0x0, 0x8, 0x1, 0x4e}, &(0x7f0000000a80)=ANY=[@ANYBLOB="2081011fffdd3e"], &(0x7f0000000ac0)={0x20, 0x82, 0x1, 'g'}, &(0x7f0000000b00)={0x20, 0x83, 0x2, "9aa9"}, 0x0, 0x0}) r2 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r3, 0xc0105b08, &(0x7f0000000040)) 10.19487133s ago: executing program 6 (id=4262): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="3f2826bd15bed52d9990b7aa076fda3e6e04f60bee17b8d6d723020dad21fc3a01830621310ff2a68aef4e1044151fbf9d1f2c6926f11d2c8a506d2e4cf855f0ab"], 0xfdef) 10.194358076s ago: executing program 3 (id=4263): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8946, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r1, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, 0x0, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x4, 0x0, 0x0, &(0x7f00007d4000/0x4000)=nil, 0x4000, 0xfffffffffffffffe}) mprotect(&(0x7f00004ef000/0x3000)=nil, 0x3000, 0x1000002) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f00000002c0)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) 9.95510278s ago: executing program 7 (id=4264): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000240)=@abs={0x1, 0x0, 0x4e21}, 0x6e) ioctl$sock_proto_private(r0, 0x89e0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c00)=@newtaction={0x898, 0x30, 0xffff, 0x70bd29, 0x0, {}, [{0x884, 0x1, [@m_police={0x880, 0x1, 0x0, 0x0, {{0xb}, {0x854, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE64={0xc, 0xb, 0xffffffffffffffff}, @TCA_POLICE_RATE={0x404, 0x2, [0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x4, 0x1, 0x5c4, 0x4000, 0x0, 0x0, 0x9, 0x0, 0x7ff, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x6, 0x0, 0x8000, 0x5, 0x0, 0x4e16, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000002, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffe, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x6, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x8a, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb7fe6bd0, 0x6, 0x1ffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x98, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x402, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x3a4f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x894e, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4000000, 0x9, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4000000, 0x9, 0x0, 0x7fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x10, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4, 0x80000, 0x0, 0x0, 0x319e, 0x4, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffc, 0x0, 0x4, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x401]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0xfffffffd, 0x0, {0x3, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x6, 0x0, 0x0, 0x3, 0x0, 0xff}, 0x0, 0xfffffffe}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x898}}, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000440)=[@code={0xa, 0x58, {"0f380a669766ba6100b000eeb98f090000b88c000000ba000000000f30c4827941fac4e1f96e42e46505e7ee1921b9500b00000f328fe9209b7ce100c403790cde08c461f8ae18"}}], 0x58}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f00000000c0)={0x3}) ioctl$KVM_SET_PIT2(r5, 0x4070aea0, &(0x7f0000000140)={[{0xffffffff, 0xc, 0x6, 0x3, 0x40, 0x2, 0x42, 0x9, 0x1, 0x4, 0x2, 0x8, 0x4}, {0x1, 0x8080, 0x7, 0x0, 0x8, 0x4, 0x49, 0xff, 0x2, 0x1, 0x9, 0xf, 0x20000000006}, {0x2, 0x5, 0x5, 0x84, 0x8, 0x7, 0xfd, 0x40, 0x5, 0x1, 0x2, 0x3}], 0xf87}) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000140)={0xa3, 0x0, 0x0}) ioctl$KVM_RUN(r6, 0xae80, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000dc0)=ANY=[@ANYBLOB="b7000000a5517f5fbfa30000000000000703000028feffff720af0fdf8ffffff71a4f0ff00000000b7060000000000012e400300000000006506020001cd010271187c0000000000c3640000f1f3ff007b0b00fe0000000085000000a000000079a000fe000000009500000000000000023bc065b7a379d179fc9e94af69912435f1b6a693172e6191a12bebf9f9804ea033388cd15b65877ad4b200000000000000000beca090f32050e436fe275daf51efd601b6bf01c8e8b1abe4fef3bef7074815ae98743d1ace4c46631256dd19aed0d600c0b6199fe3ff3128e599b0eaebbdbd7359a48f5b0afc3996792043a6787bac46aa7aa400000000000069669622208266f896ba2c9e73c2efeec2dc565fbafb2cb63f5fef9ab79ff8abaa8a08f54a062107e9bb3e980fff675c8d3e91df6648a7a6aebcb63e0867b75690152af27711f0cbb9c06018d21bf3f87b8eb65323b4267a526d53442db8e48dbc5ce47d67d07441a7975d5e41b14fd0154a8246249952a8b61633ce068220defe09d3b1136af6d03e9cf996c13d1bfcdc54567a9ca80dec2e943fe4ae7c617cc071f7add70cfbd48f8f6b50fe6a8297d88efa73e7e601040000b4a685969f28902bdecf66ef39755de79ed2c711477febc96231a53984d00877301d0ec62427a8e38618fdd1ce9aaed569ebc5f2e58d6028e66139a737cc7146a131d47dcebb32ed67021d76e983223c998aec22242ae54e87f438d26982876b58f9134366952f7399a733f07138a736924f3709000000e97f0c117ec439c6b7b965752bbc06eced08d97a32ae4b1ad4d11c5b6f68ee841975233e4cea13f3ef04b2cab9cc256d4539dbafd888c7097c1169e0bebcc81ca3da40bf34b6c9c1da2d6ed8acaf2a8091820ff4cf6be74ddca8bf2eed0e11b2139e8c3ec95436af5269d5792decda7d8b5dcf8640b504ba23c6d0a7f67cdfd27328100ebf9319a56f0f9cee17deecf747f3493f1dc39551f4c9a40b3e93fa80b8234ccbf39a9ef09bd97321f0dc20956f44ba2c5ec2e7569b05cf4690ddc189f174046a8b214acf23f42fb51ed4819e6b4cb5a8bf2b559d0c198fe0315483b8beb9801d06c58b22dd713fe3b7ef18e21081aacfd091b754125a488cea18255f79bebcb3051f622f8a1d9af1908e88a58774a24f35a4ccdbedea6212286c23dd89c2b4b90647f17231472af8dda7f3ab20f093aad3ce875f7458039ee6d0a50deb7bc8eb393f056a5e7725531c5485278e0362338e2e2710fe00465e0d182a322091022cf5b814eeb9b3cab21196581e4d92d0b6fe5525285eea359274f1f21d69233bbe94941f10ba292100000000000000000000000000000000c18e93a0c5231779f2ee201e9fe7e63e84b57b5f05ecd278919bad330ffcb594b8255b3085b352ca9533d6c31c1a30158c30352f8a126a65cb6582e58aa641007418611df53a601c3a8fb8d2286e86abf98136f345446730f68f5d6d1817a9e1b09e5650d2599fbe719a45337d29eb3fef5f7f565457660dec6fe903a1c2ea4f40a8ea1c179892afa219fc69a44163f0d731de418e9fd82a8c4661caea674b19242d1840d047882f640ea248457288c5ffb63e857da03ff5c0475c3cfff41c4806f1dc750eb1c45ec3a2a0b064834010604d6f88a29e8e9bda2bc9c18d1b53a08f25d62ccaa46bc0235c830a7b3fe64bc6031b431bcad6b698a1ba6027870ea9e55fafbbf140c5f82a33ee4ac793b989c12a5827a7957f4d8136cf918b7cbf5bc5fc64c8001992536584586edded6f65bdd371ac84fd5cc60ab79b84e9e85a1c54d5666a5d133e95eff121621dff14b9de7a188b8c5387f9da63c2cce405bc44079e34e2db2b275bfbb54841d647338cad74be91144b780cf381a6860f641446ef73bd11d45f5e4df8f3c6440d8425fd7382225cf8c2cada01bf3cd5cbc6a403173e0c89a491c75efc3c21b7825a521c6011945eef94abc3000000000000000000000000000000d71b794e9b4c145caf050429937eef4364d9e1cbe9150bccd9b2e73757f1f5e8ac50736cd3cbc029ede2869642841371bb4b9c1aaa8826889a909e6716b60e4b568b6761f8ccc7d35b0e66357746b10fc481b47e67f1e14408c1ef3e018a5e647e3f607654f3bf82bcfb42be038a272d82f8362944f608b3810000000019fda0b1b607f1ab34194ed954973f7a5accc0938d3364ab07574d0b32fc30f3ab73d012b63ee905e98ab6989ec2c840cd216eb18fedfb3b204e94e170bae930660368d3799c9b1bf7556ac57164966791626f06ad2e332341965f72141ec140b80efd7720ccdaa890b79bc4523386bd66553121543c9a35b7adcf2f6b257fefef1d6e1da2ee94d3f822bf45aad21e5b5a3788ab584090664065af39b0f43968dcd7c5f8e5a8dc6298691423fbf7e8e012260bc62f9422434a547ef7ca37953d435098d9b71edd1a03e46d0ade465d0c0db0a51f9e29cac05e5a04f94e"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x45}, 0x48) writev(r3, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) 9.886137362s ago: executing program 3 (id=4266): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) rseq(0x0, 0x0, 0x0, 0x0) mmap(&(0x7f00007fd000/0x800000)=nil, 0x800000, 0xa, 0x2030, r0, 0x9232b000) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000005c0)) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_FW_DOWNLOAD(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010177bd7000fbdbdf2515000000080014006e66630008000100", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x2400c040) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)={0x0, 0x0}) prlimit64(r4, 0x1, &(0x7f0000000240)={0xc57e, 0x100}, 0x0) eventfd2(0xffff, 0x80800) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r5, 0x40047438, &(0x7f0000000340)=0x1) close(r0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, 0x0) 9.769951242s ago: executing program 6 (id=4267): socket(0x10, 0x80002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000079100800000000004000000000000000950000000000000099a1aae9e4a6f8b821bf0e5d67028ff5ec80128ba45db82a5ceb41f4b54ac9b08873f9d351c714258e6f485e7777200852f33e5a35a4b6c55470692389c53123a50ec579c2a5fd1361cea9a10cb1fa3fbb2331f4e5107cf16fdef1eefd0c2da93f02b6ebfa597416bc0a9a0a59754710751e4a61f5a4087262e07e21bc24520f422f8e285daac6822b1d7e5df170c58cb3f553f05beeb6c33605a11f4a78785ac65e6eaaf686ec49c945f976d6a5738cbcd468fdca0541e9c3ca6322ce8eeb56b544525a8d96cab3516df5b0fc42c38e76355f4e888c5f389f872815ad49b813b03b305121a60bb6fa878a6fa46b7d8c54fb5812c4750137376f"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) fanotify_init(0x4, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) getpid() sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) open(&(0x7f0000000280)='.\x00', 0x10000, 0x0) socket(0x40000000015, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0900000009000000008000000100000000000000", @ANYRES32=0x1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/14], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r2}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$net_dm(&(0x7f0000000080), r3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@newlink={0x48, 0x10, 0x4, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3f}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_USE_IFADDR={0x5}, @IFLA_BR_MCAST_QUERY_RESPONSE_INTVL={0xc, 0x22, 0x5}]}}}]}, 0x48}}, 0x0) r5 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000040), r3) sendmsg$NET_DM_CMD_START(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r5, 0x1, 0x70bd2d, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40000) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) close(0x3) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000480)={{0xfffc, 0x9, 0x0, 0x6}, 'syz0\x00', 0x3}) 9.278143129s ago: executing program 3 (id=4268): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) pipe2$watch_queue(&(0x7f0000000000), 0x80) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x300440c4) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) syz_usb_disconnect(0xffffffffffffffff) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() syz_open_procfs$userns(r0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000023000701feffffff02000000027c0000040042800c00000000000000000914bb140002"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0x4800) 8.746014622s ago: executing program 1 (id=4269): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'blake2s-160\x00'}, 0x58) (async) r1 = socket$igmp(0x2, 0x3, 0x2) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000180)={&(0x7f0000000080)=[0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0, 0x0], 0x1, 0x3, 0x1, 0x2}) ioctl$DRM_IOCTL_MODE_CURSOR2(0xffffffffffffffff, 0xc02464bb, &(0x7f00000001c0)={0x3, r2, 0xf, 0x4, 0x2, 0x85a1, 0x100, 0x80000000, 0x3}) (async) sendmsg$inet(r0, &(0x7f0000000400)={&(0x7f0000000200)={0x2, 0x4e23, @loopback}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000240)="b0f0a38913a71aa161c10633f727ee1536dd3ab7a3bce9930aef53c28eed6b0782ed265eb858373af41f3c25c8cb506eebd3ae6f361891d708d8f8a76a143fb5a4c7e91f52e27a7a8141b7f9d5fec7c6c26a97d53cbdd6692b74bed4dc078429a48e5a98c4de1b7100d2cf947530521dd64e56501455c06ae81ac61f9a14ceb50619c5408b54a14f9e697beb25a7be483d19ccb7246ca95dd10a4f474dd3588dbfef78facdb426720fe33c489d71a1af08b47e8dacbe96350da160f65c8de06889732beccf16765e52427bf7357b154c9f576800265eff", 0xd7}, {&(0x7f0000000340)="6b04ae6d76aaeb65d1cd3b0972f5bc1f32ff8df8369d8bef7cf9f6bc65aeeee22760f801b5f74fc5e25794503537417ee226426450d04898", 0x38}, {&(0x7f0000000380)="659392d24364ed5d08e2ef4cbe21bc9c19593d33bb8b0b3f370dedc0c35fe1dd238438ebbf5728545097479c98d754f7be39c07cc8d5", 0x36}], 0x3}, 0x0) (async) ioctl$OCFS2_IOC_UNRESVSP64(r1, 0x4030582b, &(0x7f0000000440)={0x1, 0x0, 0x1, 0xffff, 0x59384d43, 0x9}) (async) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000480), 0x18b905) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r3, 0x80045300, &(0x7f00000004c0)) (async) r4 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000500)='cpuset.cpu_exclusive\x00', 0x2, 0x0) write$cgroup_int(r4, &(0x7f0000000540), 0x12) (async) r5 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x7fff) ioctl$TCXONC(r5, 0x540a, 0x3) (async) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000580)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) close(r6) (async) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f00000005c0)) ioctl$DRM_IOCTL_MODE_GETPROPERTY(0xffffffffffffffff, 0xc04064aa, &(0x7f00000007c0)={&(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000680)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, 0x0, '\x00', 0x9, 0x8}) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x20) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000800)={0x10000, 0x2, 0xc000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) (async) syz_open_dev$MSR(&(0x7f0000000840), 0x5, 0x0) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000880), 0x4) (async) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000008c0), 0x200000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r8, 0xc08c5332, &(0x7f0000000900)={0x81, 0xffff, 0x0, 'queue1\x00', 0x7}) r9 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$XFS_IOC_READLINK_BY_HANDLE(r4, 0xc038586c, &(0x7f0000000ac0)={r9, &(0x7f00000009c0)='blake2s-160\x00', 0x410083, &(0x7f0000000a00)={@align=0x8, {0x3, 0x9, 0x8, 0x2}}, 0x3, &(0x7f0000000a40)={@_ha_fsid}, &(0x7f0000000a80)=0x9}) (async) r10 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000b00), 0x840, 0x0) landlock_restrict_self(r10, 0x4) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000b40)={@map=r10, r10, 0x2c, 0x2004, 0x0, @value=r8}, 0x20) (async) ioctl$DRM_IOCTL_ADD_CTX(r10, 0xc0086420, &(0x7f0000000b80)) (async) recvmmsg(r1, &(0x7f0000002e40)=[{{0x0, 0x0, &(0x7f0000001140)=[{&(0x7f0000000bc0)=""/63, 0x3f}, {&(0x7f0000000c00)=""/149, 0x95}, {&(0x7f0000000cc0)=""/93, 0x5d}, {&(0x7f0000000d40)=""/86, 0x56}, {&(0x7f0000000dc0)=""/170, 0xaa}, {&(0x7f0000000e80)=""/109, 0x6d}, {&(0x7f0000000f00)=""/234, 0xea}, {&(0x7f0000001000)=""/126, 0x7e}, {&(0x7f0000001080)=""/191, 0xbf}], 0x9, &(0x7f0000001200)=""/70, 0x46}, 0x2}, {{&(0x7f0000001280)=@un=@abs, 0x80, &(0x7f00000023c0)=[{&(0x7f0000001300)=""/4096, 0x1000}, {&(0x7f0000002300)=""/186, 0xba}], 0x2, &(0x7f0000002400)=""/80, 0x50}, 0x4}, {{&(0x7f0000002480)=@qipcrtr, 0x80, &(0x7f00000025c0)=[{&(0x7f0000002500)=""/178, 0xb2}], 0x1, &(0x7f0000002600)=""/17, 0x11}, 0x400}, {{&(0x7f0000002640)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000002880)=[{&(0x7f00000026c0)=""/124, 0x7c}, {&(0x7f0000002740)=""/164, 0xa4}, {&(0x7f0000002800)=""/80, 0x50}], 0x3, &(0x7f00000028c0)=""/87, 0x57}, 0xb8a6}, {{&(0x7f0000002940)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000002d00)=[{&(0x7f00000029c0)=""/123, 0x7b}, {&(0x7f0000002a40)=""/223, 0xdf}, {&(0x7f0000002b40)=""/200, 0xc8}, {&(0x7f0000002c40)=""/131, 0x83}], 0x4, &(0x7f0000002d40)=""/255, 0xff}, 0x5}], 0x5, 0x12000, &(0x7f0000002f80)) 8.638528851s ago: executing program 1 (id=4270): r0 = msgget$private(0x0, 0x40) msgsnd(r0, &(0x7f0000000880)=ANY=[@ANYBLOB="030000000000000089f5bf4221b4eab8e298f075c26c0cee0bc1d744d03563e5105826c5b448a570e8505e081bd6e43d0fa36a526b55d54827544e2d3bf1d3aa057eab761386e4dc8e26df007aa9c6cdf0c6f2d37e0a12237de7bfbe6f6c42ec589a67618e0a27466cfd63a1b331cf52016dff5962f5b59352b2ead223b2436172b16a41dd41f20e6a6f099dbcb49ea1e4ec8568c964528b13b718a9ba38ce734ddaec68bc10f4e9d04b8c72699f9db48e778b41b19d2ce5e2133c3ec2a9812dac22e5c78992d87a3428f6565cfa7dc32dfad20fdd056f85869178e90c59a926bab2148185745f25da0e7d4593d886ec9c2b29bc522e95c2c8217622cc6728f30d7b8a99ba11a03f3ebe00d9d9f2c62bfdf1b97e2ac940fdf746c9a1564f81cfbfbdcfb23be65db7c8240c36f2ef7d4baa1b47b4debb2169d8c2918618bca2a9a2d1904055618ce9780c18195b09c9fa33232e4ca4cb261bbb0cc9921f58d3c870021bd8c918ac41ae6ee3c2a66b808d581b19569babc985c6dee6f1b567d0696e9d4de4b0f178948bbefe058aec79dd8c8a515cc6eff215178c917b99e5974075297fcc8f673366d97bbfad559320a5a76ad03b4935a0c1ec91c2ae5151d49c6e9985f6d4c5aba86f82d3f041a6e396db191eca9cd2d086859cb62d35e476bd867022d0ade6c9961130f997d025b6d5a4b71e5942096ede936ce3fa1bfa250343cb3eecbac08c0c3575f7b32d95fdc214d8bfcb60ead6c0c0aae54aa486a82edb1ece5bd41a4b4a1df4e05df84f8ee6e5c3834ef1da2ef1e622a9fae7fd989a22f9833b04ef8dbe3820ddbbb47c60f65da6ec978da1c1f678c552c8bd0f510f9fa3ecddfb1e72af117b4feb470a11b6616077dd44d506b80385b3b4f8095090e57ee1ce9e401bb2d624e702c899a5df0cd9f0b93a863aa0e8d9ec39f75d967f5b370065e2aacb803bf78d0b2560b2880667fdfed7a28bb14d99392f19978078400ecb5e46707c0dbe503376e021a3d60a6df2e7eb8959fd5b5a55f7a385075547455bfc0c8fe03af58e3a73e2d4865baa0cd8ec350072dd4d29dab4d09e9803af9120db6a36f33f2a20df4c99b9afb37ace0cf08ae6a56f1f72b4ba5daec3aae4f9a0485e38640be9b70042442249d628ad2eac61449fd1db95deedb7a1764998f94408c250ff08ff63683dd26eea34c54bb6d56999b159dfae43a923dd6f6d72e740a7a92ee100b4799e2bbb833b4e01582216a63b1c6af6da1da53bc9d9d0733113b3c4a18ccedc10bba5a47655faac2d33bf89c0aaf47568aaffbe6a4348b09c19461bc66fb2ad00f34743c058caa28a83a53108c5878d048aad64f928228a223fc71683e4391f315cdf9b9a25d9945a65670910f642eba541e8deb08a12735852a3d9641ee4bc595fdfe31c6294df99a221ecfea4f8c7870ad4587914fb84d24172018d943695c44b22f4e422eb814e4962fb281cff747c6f8e05f1b38cabbdc93cbc9888"], 0x401, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x0, 0xe8, 0x0, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@multicast1, @broadcast, 0xff000000, 0xff, 0x9, 0x12, {@empty, {[0x0, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, 0x0, 0x3, 0x3, 0xa90a, 0x6, 0x3ff, 'veth0_vlan\x00', 'wg2\x00', {0xff}, {0xff}, 0x0, 0x71}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1f8}}, {{@arp={@empty, @loopback, 0x0, 0xffffffff, 0xe, 0x2, {@mac=@local, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@random="8e932bc3db22", {[0x0, 0xff, 0x0, 0xff]}}, 0x0, 0x0, 0x400, 0x4fd9, 0x0, 0x98dc, 'team_slave_1\x00', 'macsec0\x00', {0xff}, {0xff}, 0x0, 0x280}, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @loopback, 0xf, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, @loopback, @multicast1, 0xf}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) r2 = socket$unix(0x1, 0x5, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCMBIS(r3, 0x5416, &(0x7f0000002300)=0x8) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x60, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, 0x0, 0x0) syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x80) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000001, 0x11, 0xffffffffffffffff, 0xc10c3000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x1}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x1, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x153da}, [@IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4, 0x3f}]}, @IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000880}, 0xc094) socket$xdp(0x2c, 0x3, 0x0) unshare(0x6a040000) msgctl$IPC_RMID(r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0xf, 0x4, 0x4, 0x812}, 0x50) 8.629397435s ago: executing program 6 (id=4271): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313, 0x1000000}], 0x0, 0x1000000, 0x0}) 8.548301701s ago: executing program 7 (id=4272): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001800010027bd7000fddbdf251d010600080005000600ff0715000300", @ANYRESOCT], 0x48}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) prlimit64(0x0, 0xa, 0x0, &(0x7f0000000280)) mount$bind(0x0, &(0x7f00000002c0)='.\x00', 0x0, 0x1002831, 0x0) open(&(0x7f00000001c0)='./file7\x00', 0x4080, 0x89) 6.045846345s ago: executing program 3 (id=4273): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000700)=[{{&(0x7f0000000180)={0x2, 0x4e24, @empty=0xe000}, 0x10, 0x0}}, {{&(0x7f0000000440)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast2, @multicast1}}}], 0x20}}], 0x2, 0x40010) 5.926508114s ago: executing program 6 (id=4274): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x8, 0x3, 0x310, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x278, 0xffffff7a, 0xffffffff, 0x278, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@empty, @multicast1, 0xff000000, 0xffffff00, 'pimreg\x00', 'ip6gretap0\x00', {}, {}, 0x4, 0x1, 0x10}, 0x6, 0x130, 0x158, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x6, 'bm\x00', "00000100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x88, 0x0, {0x4}}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xc0, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x3}}, @inet=@rpfilter={{0x28}, {0xd}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local, 0x2, 0x7, [0x2036, 0x3d, 0x1c, 0x22, 0x31, 0x1d, 0x37, 0x2c, 0x14, 0x7, 0x7, 0x34, 0x13, 0x1a, 0x15, 0xa], 0x0, 0x7fff, 0x6}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x370) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x2b, 0x1, 0x1) sendmsg$IPCTNL_MSG_CT_GET_STATS(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x5, 0x1, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000084}, 0x40084) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0xa, 0x5, 0x0) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e20, @rand_addr=0x64010100}, 0x10) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}, 0x1c) ioctl$SIOCX25SFACILITIES(r0, 0x89e3, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r4, 0x8983, &(0x7f0000000180)={0x3, 'ip6tnl0\x00', {0x7}, 0x100}) 5.923692659s ago: executing program 7 (id=4275): socket$inet6(0xa, 0x1, 0x84) close(0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x107d) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) syz_extract_tcp_res(&(0x7f0000000080), 0x80000000, 0xd) syz_extract_tcp_res$synack(&(0x7f00000001c0), 0x1, 0x0) syz_emit_ethernet(0x6e, 0x0, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000440)="4c0000001200ff09ff3a150099a283ff04b8008000f0ffff0000000600401500240036001fc411a0b598bc593ab6821148a730cc33a49868c62b2ca654a661", 0x3f}, {&(0x7f0000000500)="f02ec70a0e8900b151d826894f", 0xd}], 0x2}, 0x0) syz_emit_ethernet(0xc6, 0x0, &(0x7f0000000540)={0x0, 0x2, [0x43b, 0xb10, 0x33e, 0x6ea]}) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_io_uring_setup(0x38, &(0x7f00000002c0)={0x0, 0x36a9, 0x8, 0x0, 0x55}, 0x0, 0x0, &(0x7f0000000340)) syz_open_dev$sndpcmp(0x0, 0x3, 0x480000) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) syz_clone(0x18200000, 0x0, 0x0, &(0x7f0000000640), 0x0, &(0x7f00000006c0)) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) socket$l2tp6(0xa, 0x2, 0x73) prlimit64(0x0, 0xe, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) socket(0x2, 0x80805, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r3, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002800500190084"], 0x48}}, 0x4084) ioctl$DRM_IOCTL_PANTHOR_BO_SYNC(0xffffffffffffffff, 0xc010644f, &(0x7f0000000740)={{0x18, 0x8, &(0x7f0000000680)=[{0x0, 0x1, 0xffffffffffffad09}, {0x0, 0x0, 0xd2, 0x100000000}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x1, 0x2, 0x100000000}, {0x0, 0x1, 0x5, 0x1}, {0x0, 0x0, 0x0, 0x455}, {0x0, 0x0, 0x3, 0xe}, {0x0, 0x1, 0xbcf3, 0x8000000000000001}]}}) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) 5.722271832s ago: executing program 1 (id=4276): socket$inet6(0xa, 0x1, 0x84) close(0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x107d) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) syz_extract_tcp_res(&(0x7f0000000080), 0x80000000, 0xd) syz_extract_tcp_res$synack(&(0x7f00000001c0), 0x1, 0x0) syz_emit_ethernet(0x6e, 0x0, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000440)="4c0000001200ff09ff3a150099a283ff04b8008000f0ffff0000000600401500240036001fc411a0b598bc593ab6821148a730cc33a49868c62b2ca654a661", 0x3f}, {&(0x7f0000000500)="f02ec70a0e8900b151d826894f", 0xd}], 0x2}, 0x0) syz_emit_ethernet(0xc6, 0x0, &(0x7f0000000540)={0x0, 0x2, [0x43b, 0xb10, 0x33e, 0x6ea]}) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_io_uring_setup(0x38, &(0x7f00000002c0)={0x0, 0x36a9, 0x8, 0x0, 0x55}, 0x0, 0x0, &(0x7f0000000340)) syz_open_dev$sndpcmp(0x0, 0x3, 0x480000) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) syz_clone(0x18200000, 0x0, 0x0, &(0x7f0000000640), 0x0, &(0x7f00000006c0)) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) socket$l2tp6(0xa, 0x2, 0x73) prlimit64(0x0, 0xe, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) socket(0x2, 0x80805, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r3, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002800500190084"], 0x48}}, 0x4084) ioctl$DRM_IOCTL_PANTHOR_BO_SYNC(0xffffffffffffffff, 0xc010644f, &(0x7f0000000740)={{0x18, 0x8, &(0x7f0000000680)=[{0x0, 0x1, 0xffffffffffffad09}, {0x0, 0x0, 0xd2, 0x100000000}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x1, 0x2, 0x100000000}, {0x0, 0x1, 0x5, 0x1}, {0x0, 0x0, 0x0, 0x455}, {0x0, 0x0, 0x3, 0xe}, {0x0, 0x1, 0xbcf3, 0x8000000000000001}]}}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) 5.615935049s ago: executing program 8 (id=4277): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8946, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r1, 0x3ba0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x4, r2, 0x0, &(0x7f00007d4000/0x4000)=nil, 0x4000, 0xfffffffffffffffe}) mprotect(&(0x7f00004ef000/0x3000)=nil, 0x3000, 0x1000002) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f00000002c0)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0, 0x1}) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) 5.309307215s ago: executing program 8 (id=4278): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) rseq(0x0, 0x0, 0x0, 0x0) mmap(&(0x7f00007fd000/0x800000)=nil, 0x800000, 0xa, 0x2030, r0, 0x9232b000) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000005c0)) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_FW_DOWNLOAD(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010177bd7000fbdbdf2515000000080014006e66630008000100", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x2400c040) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)={0x0, 0x0}) prlimit64(r4, 0x1, &(0x7f0000000240)={0xc57e, 0x100}, 0x0) eventfd2(0xffff, 0x80800) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r5, 0x40047438, &(0x7f0000000340)=0x1) close(r0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, 0x0) 4.941776613s ago: executing program 6 (id=4279): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) lseek(0xffffffffffffffff, 0xfffffffffffffff5, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = fsmount(0xffffffffffffffff, 0x0, 0x90) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000000180)=0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f00000001c0)=r5) r6 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r7 = syz_usb_connect(0x0, 0x202, &(0x7f0000000180)=ANY=[@ANYBLOB="1201100152018b401e040740185d000000010902f00101040000030904"], 0x0) syz_usb_control_io$cdc_ecm(r7, 0x0, &(0x7f00000002c0)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x3, 'x&\x00'}, 0x0, 0x0}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000002000000000000000200000408000000000000000300000000000000000000000200000000000000000000000000000200000000000000000000000404"], 0x0, 0x56}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, r8, 0x3, 0x1}, 0x50) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x8, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x1}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) 4.59839349s ago: executing program 8 (id=4280): socket$pppoe(0x18, 0x1, 0x0) syz_emit_ethernet(0x1f, &(0x7f0000000040)=ANY=[], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = socket(0x9, 0xa, 0x3) accept(r0, 0x0, &(0x7f00000003c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_emit_ethernet(0x4e, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a000000040000000600000080"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x6, r2}, 0x38) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r3, 0x4008af25, &(0x7f00000000c0)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x5}, 0x48) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000100)={@my=0x1, 0x1}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001f40)={0xb, 0xc, &(0x7f00000006c0)=ANY=[@ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b7", @ANYRES8=r1], &(0x7f0000000180)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7cd85a90}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r4}, &(0x7f0000000080), 0x0}, 0x20) r5 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000140)={0xffffffffffffffff}, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000005c0)="b9ff03076804268c989e140500c9", 0x0, 0x1, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xa}, 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000280)='\x02\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xbfS\x16 \x04\r\xcd\xdb\x9a\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x00\xfaC\x93\xc0S\xaf\f\x1a\fEik\x86\x15\xab\x909\xf8i\xc0\xa7\xa9\xb1\xbe\xc7\x1d\xe0\x18\xd2\xbaG|\xd5fC\x8d\t\x00/I\x8b\xbf\x94\xf4\x96[us\x96\x90\x8d\x9d\xfb\xdc\x7f0&\xab\x17@)\xf1\xc3Q\xb2M :\xaa\x99G\xdd\xa9E6A]@>\f\xb1n\x1a\x8c\xc6e7{@\x90\x8fz\xfcf\x88\x15A\x0e\xbf\xb8\xff\xa8\xb9\xab\x83>\xf9I0\xdd\x93#\x1e\x00\xed#\xc9\xd0Uk\xa6b\xa6/\x15\x92\xc6,p\xc9\xce\xe1\xc3\xd5\x89Lw\x17\x16\x18\xddh\xc8\x81w\x1e\x7f\xc7\x16\xe5\x96\x03\t\xc3\x94\xc7\xeb\xd6.\xfa\xb3\xe0\x1f\xa9\x19\xfaS\x1f[T\x1e\xc5nX\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00=0\xc3\xbc\xfd\xce~\xe3\xcaO\"\xbb\xd1\x15\xf2y\xb91\x1d\xab\xeaO\x19\rH4\xc2\xe4\x922~K^K`55\xb7\xd1\n\xba\xb7,\xdb\xc2\x86\xc30bnc\x06\x06q\xe9\x97\fHA<\x94`\xf7H?\x86\xb8C9\b\x18vFWRdNee\xf1A\x06\x8f\x97\x99\xa5A\xfa\x94IfB\xa9\xf5\xd8\x83\xc5\b\x0eL\\Z\x80](f6D\x1a\xf7si\xa4l\xa8\x0f\xcc\xa1\xef\x1bCq\x0e\xf87\xfc\xce\x96cm\x83\x05S\x01Zj`dP:d\xba\x02\x14\xaa\x051\xd7\x87\x1b\xcb\xa2.\x89\x16CRx\x9b\x04\x1f\x8fA\t<\x99/\'tk\xcb\xd7|\x0f\xc9m\x95\x9a\n\v&\xca\xcd\x11\xec\xfd\x17a$.\xe9\x14\x8f\n\x15\x8d\rJ\x99\x8a\x87\x81\xc4S\x85L\xe5w\xa1\xbf\x91Q&6\x8e\xd1\x02\x19K\xd3\xab\xe5\xdc\xac\x05\x8dQ\xf4\x1aa\x86\xbc6\\\x06\xdf\x84\x00+F|\xa6\xc4\xab\x00G\xd0\x14N+\xf9\x84i?C\x81\x8eu\xd3\xcbg\xb7\a\xd9\x9a*\x17>\xac\x9d\x9d\xf6\t\xd8b\x19\x8a\x1e&\xde\x87-%\xf3\x8a2L\x1cQ2\f\x94\xf7\xf9\xadI\xedU\xabr\xe2\xe1\xc2{\b\xa8\xc2\n4\x0f\'\xed\xcc\xd7qG\xa7p\x8ct\xe3/l\v\x93\x8a\x95R\xd6\x19L\x85\x80\x18\x15\xcezn\xa8,i\xf1\x91@\xc0\xb1\a\xfd\xec\x95>\b(\xfa~O\xfd\xe2\a6b\x97\xc6$?;\x8eJ/P\x9d\x17\xaaU\xc4\b') r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) sendfile(r6, r7, 0x0, 0x20000023896) 4.175707765s ago: executing program 3 (id=4281): r0 = msgget$private(0x0, 0x40) msgsnd(r0, &(0x7f0000000880)=ANY=[@ANYBLOB="030000000000000089f5bf4221b4eab8e298f075c26c0cee0bc1d744d03563e5105826c5b448a570e8505e081bd6e43d0fa36a526b55d54827544e2d3bf1d3aa057eab761386e4dc8e26df007aa9c6cdf0c6f2d37e0a12237de7bfbe6f6c42ec589a67618e0a27466cfd63a1b331cf52016dff5962f5b59352b2ead223b2436172b16a41dd41f20e6a6f099dbcb49ea1e4ec8568c964528b13b718a9ba38ce734ddaec68bc10f4e9d04b8c72699f9db48e778b41b19d2ce5e2133c3ec2a9812dac22e5c78992d87a3428f6565cfa7dc32dfad20fdd056f85869178e90c59a926bab2148185745f25da0e7d4593d886ec9c2b29bc522e95c2c8217622cc6728f30d7b8a99ba11a03f3ebe00d9d9f2c62bfdf1b97e2ac940fdf746c9a1564f81cfbfbdcfb23be65db7c8240c36f2ef7d4baa1b47b4debb2169d8c2918618bca2a9a2d1904055618ce9780c18195b09c9fa33232e4ca4cb261bbb0cc9921f58d3c870021bd8c918ac41ae6ee3c2a66b808d581b19569babc985c6dee6f1b567d0696e9d4de4b0f178948bbefe058aec79dd8c8a515cc6eff215178c917b99e5974075297fcc8f673366d97bbfad559320a5a76ad03b4935a0c1ec91c2ae5151d49c6e9985f6d4c5aba86f82d3f041a6e396db191eca9cd2d086859cb62d35e476bd867022d0ade6c9961130f997d025b6d5a4b71e5942096ede936ce3fa1bfa250343cb3eecbac08c0c3575f7b32d95fdc214d8bfcb60ead6c0c0aae54aa486a82edb1ece5bd41a4b4a1df4e05df84f8ee6e5c3834ef1da2ef1e622a9fae7fd989a22f9833b04ef8dbe3820ddbbb47c60f65da6ec978da1c1f678c552c8bd0f510f9fa3ecddfb1e72af117b4feb470a11b6616077dd44d506b80385b3b4f8095090e57ee1ce9e401bb2d624e702c899a5df0cd9f0b93a863aa0e8d9ec39f75d967f5b370065e2aacb803bf78d0b2560b2880667fdfed7a28bb14d99392f19978078400ecb5e46707c0dbe503376e021a3d60a6df2e7eb8959fd5b5a55f7a385075547455bfc0c8fe03af58e3a73e2d4865baa0cd8ec350072dd4d29dab4d09e9803af9120db6a36f33f2a20df4c99b9afb37ace0cf08ae6a56f1f72b4ba5daec3aae4f9a0485e38640be9b70042442249d628ad2eac61449fd1db95deedb7a1764998f94408c250ff08ff63683dd26eea34c54bb6d56999b159dfae43a923dd6f6d72e740a7a92ee100b4799e2bbb833b4e01582216a63b1c6af6da1da53bc9d9d0733113b3c4a18ccedc10bba5a47655faac2d33bf89c0aaf47568aaffbe6a4348b09c19461bc66fb2ad00f34743c058caa28a83a53108c5878d048aad64f928228a223fc71683e4391f315cdf9b9a25d9945a65670910f642eba541e8deb08a12735852a3d9641ee4bc595fdfe31c6294df99a221ecfea4f8c7870ad4587914fb84d24172018d943695c44b22f4e422eb814e4962fb281cff747c6f8e05f1b38cabbdc93cbc9888"], 0x401, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x0, 0xe8, 0x0, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@multicast1, @broadcast, 0xff000000, 0xff, 0x9, 0x12, {@empty, {[0x0, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, 0x0, 0x3, 0x3, 0xa90a, 0x6, 0x3ff, 'veth0_vlan\x00', 'wg2\x00', {0xff}, {0xff}, 0x0, 0x71}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1f8}}, {{@arp={@empty, @loopback, 0x0, 0xffffffff, 0xe, 0x2, {@mac=@local, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@random="8e932bc3db22", {[0x0, 0xff, 0x0, 0xff]}}, 0x0, 0x0, 0x400, 0x4fd9, 0x0, 0x98dc, 'team_slave_1\x00', 'macsec0\x00', {0xff}, {0xff}, 0x0, 0x280}, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @loopback, 0xf, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, @loopback, @multicast1, 0xf}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) r2 = socket$unix(0x1, 0x5, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCMBIS(r3, 0x5416, &(0x7f0000002300)=0x8) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x60, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, 0x0, 0x0) syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x80) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000001, 0x11, 0xffffffffffffffff, 0xc10c3000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x1, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x153da}, [@IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4, 0x3f}]}, @IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000880}, 0xc094) socket$xdp(0x2c, 0x3, 0x0) unshare(0x6a040000) msgctl$IPC_RMID(r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0xf, 0x4, 0x4, 0x812}, 0x50) 3.396371848s ago: executing program 8 (id=4282): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000280)=0x6) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$FAT_IOCTL_GET_VOLUME_ID(r2, 0x80047213, &(0x7f0000000180)) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) (async) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f000052e000/0x2000)=nil, 0x2000, 0xa) (async) process_vm_writev(r3, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) (async) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) (async) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x12a) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, 0x0, 0x0) (async) syz_usbip_server_init(0x1) (async) rt_tgsigqueueinfo(r3, r0, 0x3e, &(0x7f0000000300)={0x9, 0x1, 0x7}) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) chdir(&(0x7f00000001c0)='./bus\x00') r5 = creat(&(0x7f0000000240)='./file1\x00', 0x88) (async) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r6, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r5, &(0x7f0000000000), 0x4000}]) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) 2.065802981s ago: executing program 8 (id=4283): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) pipe2$watch_queue(&(0x7f0000000000), 0x80) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x300440c4) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) syz_usb_disconnect(0xffffffffffffffff) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() syz_open_procfs$userns(r0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000023000701feffffff02000000027c0000040042800c00000000000000000914bb140002"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0x4800) 1.797199295s ago: executing program 6 (id=4284): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x652800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x81) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x6020400) r4 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYRESOCT=r3, @ANYRESOCT=r1, @ANYRES32=r5, @ANYRES16=r1, @ANYRES8, @ANYRESDEC=r4, @ANYRES64=r4], 0x5c}, 0x1, 0x0, 0x0, 0x4000058}, 0x24008844) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b5, &(0x7f0000006680)) clock_settime(0x0, &(0x7f0000000240)={0x77359400}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) getrusage(0x0, &(0x7f0000000280)) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000240), &(0x7f0000000380)=0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYRESOCT=r6], 0x44}}, 0x44000) clock_nanosleep(0x5, 0x1, &(0x7f0000000080)={0x0, 0x3938700}, &(0x7f0000000180)) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) 222.663759ms ago: executing program 8 (id=4285): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty, 0x4000006}, 0x1c) listen(r1, 0x6) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="060000000400000010100000890004dc30e38a9f613e18e2f665b2fd57c1003654da2977929fb5b6c7741dcb331683a0939b07001e5c950f31eb1bacf12e69c561952e77deef318096db5edd1b95a1da"], 0x50) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r2, 0x11c, 0x3, &(0x7f0000000040)=""/185, &(0x7f0000000140)=0xb9) socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8a}, 0x0) r4 = getpgrp(0x0) sched_setaffinity(r4, 0xfffffffffffffdc3, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x2, 0x0) sched_setscheduler(r4, 0x0, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x0, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xe0, 0x0, 0x0, 0x0, 0x7ff}, {{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0x1}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x2, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {0x7, 0x0, 0x0, 0x9}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff1, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) connect$inet(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) r8 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x1, 0x151983) io_setup(0x19, &(0x7f00000009c0)=0x0) io_submit(r9, 0x1, &(0x7f0000000500)=[&(0x7f0000000480)={0x0, 0x0, 0x0, 0x5, 0x0, r8, 0x0, 0x0, 0x0, 0x0, 0x2}]) 0s ago: executing program 3 (id=4286): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0x24, 0x4) setsockopt$inet_int(r0, 0xa7ff, 0x13, &(0x7f0000000000)=0x800, 0x4) kernel console output (not intermixed with test programs): not be entirely working. [ 1184.361384][ T30] kauditd_printk_skb: 68 callbacks suppressed [ 1184.361396][ T30] audit: type=1400 audit(1784571602.208:1918): avc: denied { write } for pid=21198 comm="syz.1.3814" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1184.366003][ T5705] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1184.372412][T21202] random: crng reseeded on system resumption [ 1184.408918][ T5705] pvrusb2: ********** [ 1184.445978][ T30] audit: type=1400 audit(1784571602.218:1919): avc: denied { open } for pid=21198 comm="syz.1.3814" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1184.547747][ T30] audit: type=1400 audit(1784571602.378:1920): avc: denied { allowed } for pid=21185 comm="syz.3.3810" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1184.552238][ T2364] pvrusb2: Invalid write control endpoint [ 1184.561544][ T5705] usb 4-1: USB disconnect, device number 84 [ 1184.708703][T21209] FAULT_INJECTION: forcing a failure. [ 1184.708703][T21209] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1184.708761][T21209] CPU: 0 UID: 0 PID: 21209 Comm: syz.4.3816 Tainted: G L syzkaller #0 PREEMPT(full) [ 1184.708784][T21209] Tainted: [L]=SOFTLOCKUP [ 1184.708790][T21209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1184.708801][T21209] Call Trace: [ 1184.708807][T21209] [ 1184.708813][T21209] dump_stack_lvl+0x100/0x190 [ 1184.708838][T21209] should_fail_ex.cold+0x5/0xa [ 1184.708859][T21209] _copy_to_user+0x32/0xd0 [ 1184.708882][T21209] simple_read_from_buffer+0xcb/0x170 [ 1184.708903][T21209] proc_fail_nth_read+0x1af/0x230 [ 1184.708918][T21209] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1184.708935][T21209] ? rw_verify_area+0xce/0x6d0 [ 1184.708948][T21209] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1184.708963][T21209] vfs_read+0x1e4/0xb40 [ 1184.708980][T21209] ? __pfx_vfs_read+0x10/0x10 [ 1184.708995][T21209] ? __fget_files+0x215/0x3d0 [ 1184.709008][T21209] ? __fget_files+0x21f/0x3d0 [ 1184.709021][T21209] ksys_read+0x12a/0x250 [ 1184.709036][T21209] ? __pfx_ksys_read+0x10/0x10 [ 1184.709055][T21209] do_syscall_64+0x115/0x870 [ 1184.709069][T21209] ? clear_bhb_loop+0x40/0x90 [ 1184.709090][T21209] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1184.709107][T21209] RIP: 0033:0x7fd50c35e6ce [ 1184.709122][T21209] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1184.709137][T21209] RSP: 002b:00007fd50a5f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1184.709150][T21209] RAX: ffffffffffffffda RBX: 00007fd50a5f66c0 RCX: 00007fd50c35e6ce [ 1184.709157][T21209] RDX: 000000000000000f RSI: 00007fd50a5f60a0 RDI: 0000000000000004 [ 1184.709164][T21209] RBP: 00007fd50a5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1184.709170][T21209] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1184.709177][T21209] R13: 00007fd50c626038 R14: 00007fd50c625fa0 R15: 00007fffff4fedb8 [ 1184.709191][T21209] [ 1184.739220][ T2364] pvrusb2: Invalid write control endpoint [ 1184.739269][ T2364] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1184.739299][ T2364] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1184.739304][ T2364] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1184.739310][ T2364] pvrusb2: Device being rendered inoperable [ 1184.747876][ T2364] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1184.747968][ T2364] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1184.783944][ T2364] pvrusb2: Attached sub-driver cx25840 [ 1184.783985][ T2364] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1184.783991][ T2364] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1184.906786][T21212] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 1185.475412][T21232] overlayfs: missing 'lowerdir' [ 1185.627708][T21234] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3820'. [ 1185.787911][ T30] audit: type=1400 audit(1784571603.628:1921): avc: denied { read } for pid=21229 comm="syz.6.3823" dev="nsfs" ino=4026532983 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1185.789319][ T30] audit: type=1400 audit(1784571603.628:1922): avc: denied { open } for pid=21229 comm="syz.6.3823" path="net:[4026532983]" dev="nsfs" ino=4026532983 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1185.853439][T11047] Bluetooth: hci2: link tx timeout [ 1185.854162][T11047] Bluetooth: hci2: link tx timeout [ 1185.854231][T11047] Bluetooth: hci2: link tx timeout [ 1185.854298][T11047] Bluetooth: hci2: link tx timeout [ 1185.854358][T11047] Bluetooth: hci2: link tx timeout [ 1185.854419][T11047] Bluetooth: hci2: link tx timeout [ 1185.854487][T11047] Bluetooth: hci2: link tx timeout [ 1185.854555][T11047] Bluetooth: hci2: link tx timeout [ 1185.854619][T11047] Bluetooth: hci2: link tx timeout [ 1185.854684][T11047] Bluetooth: hci2: link tx timeout [ 1185.854797][T11047] Bluetooth: hci2: link tx timeout [ 1185.854868][T11047] Bluetooth: hci2: link tx timeout [ 1185.854932][T11047] Bluetooth: hci2: link tx timeout [ 1185.854997][T11047] Bluetooth: hci2: link tx timeout [ 1185.855061][T11047] Bluetooth: hci2: link tx timeout [ 1185.855125][T11047] Bluetooth: hci2: link tx timeout [ 1185.855190][T11047] Bluetooth: hci2: link tx timeout [ 1185.855253][T11047] Bluetooth: hci2: link tx timeout [ 1185.855318][T11047] Bluetooth: hci2: link tx timeout [ 1185.855382][T11047] Bluetooth: hci2: link tx timeout [ 1185.855444][T11047] Bluetooth: hci2: link tx timeout [ 1185.855507][T11047] Bluetooth: hci2: link tx timeout [ 1185.855579][T11047] Bluetooth: hci2: link tx timeout [ 1185.855644][T11047] Bluetooth: hci2: link tx timeout [ 1185.855714][T11047] Bluetooth: hci2: link tx timeout [ 1185.855822][T11047] Bluetooth: hci2: link tx timeout [ 1185.855887][T11047] Bluetooth: hci2: link tx timeout [ 1185.855951][T11047] Bluetooth: hci2: link tx timeout [ 1185.856024][T11047] Bluetooth: hci2: link tx timeout [ 1185.856089][T11047] Bluetooth: hci2: link tx timeout [ 1185.856147][T11047] Bluetooth: hci2: link tx timeout [ 1185.856209][T11047] Bluetooth: hci2: link tx timeout [ 1185.856275][T11047] Bluetooth: hci2: link tx timeout [ 1185.856340][T11047] Bluetooth: hci2: link tx timeout [ 1185.856409][T11047] Bluetooth: hci2: link tx timeout [ 1185.856474][T11047] Bluetooth: hci2: link tx timeout [ 1185.856535][T11047] Bluetooth: hci2: link tx timeout [ 1185.856601][T11047] Bluetooth: hci2: link tx timeout [ 1185.856663][T11047] Bluetooth: hci2: link tx timeout [ 1185.856737][T11047] Bluetooth: hci2: link tx timeout [ 1185.856840][T11047] Bluetooth: hci2: link tx timeout [ 1185.856904][T11047] Bluetooth: hci2: link tx timeout [ 1185.856968][T11047] Bluetooth: hci2: link tx timeout [ 1185.857033][T11047] Bluetooth: hci2: link tx timeout [ 1185.857097][T11047] Bluetooth: hci2: link tx timeout [ 1185.857161][T11047] Bluetooth: hci2: link tx timeout [ 1185.857224][T11047] Bluetooth: hci2: link tx timeout [ 1185.857288][T11047] Bluetooth: hci2: link tx timeout [ 1185.857353][T11047] Bluetooth: hci2: link tx timeout [ 1185.857418][T11047] Bluetooth: hci2: link tx timeout [ 1185.857483][T11047] Bluetooth: hci2: link tx timeout [ 1185.857547][T11047] Bluetooth: hci2: link tx timeout [ 1185.857611][T11047] Bluetooth: hci2: link tx timeout [ 1185.857675][T11047] Bluetooth: hci2: link tx timeout [ 1185.857746][T11047] Bluetooth: hci2: link tx timeout [ 1185.857843][T11047] Bluetooth: hci2: link tx timeout [ 1185.857911][T11047] Bluetooth: hci2: link tx timeout [ 1185.857975][T11047] Bluetooth: hci2: link tx timeout [ 1185.858040][T11047] Bluetooth: hci2: link tx timeout [ 1185.858122][T11047] Bluetooth: hci2: link tx timeout [ 1185.858238][T11047] Bluetooth: hci2: link tx timeout [ 1185.858304][T11047] Bluetooth: hci2: link tx timeout [ 1185.858372][T11047] Bluetooth: hci2: link tx timeout [ 1185.858435][T11047] Bluetooth: hci2: link tx timeout [ 1185.858498][T11047] Bluetooth: hci2: link tx timeout [ 1185.858560][T11047] Bluetooth: hci2: link tx timeout [ 1185.858622][T11047] Bluetooth: hci2: link tx timeout [ 1185.858690][T11047] Bluetooth: hci2: link tx timeout [ 1185.858761][T11047] Bluetooth: hci2: link tx timeout [ 1185.858824][T11047] Bluetooth: hci2: link tx timeout [ 1185.863121][T11047] Bluetooth: hci2: link tx timeout [ 1185.863816][T11047] Bluetooth: hci2: link tx timeout [ 1185.863887][T11047] Bluetooth: hci2: link tx timeout [ 1185.863943][T11047] Bluetooth: hci2: link tx timeout [ 1185.864045][T11047] Bluetooth: hci2: link tx timeout [ 1185.864110][T11047] Bluetooth: hci2: link tx timeout [ 1185.864173][T11047] Bluetooth: hci2: link tx timeout [ 1185.864236][T11047] Bluetooth: hci2: link tx timeout [ 1185.864300][T11047] Bluetooth: hci2: link tx timeout [ 1185.864365][T11047] Bluetooth: hci2: link tx timeout [ 1185.864429][T11047] Bluetooth: hci2: link tx timeout [ 1185.864493][T11047] Bluetooth: hci2: link tx timeout [ 1185.864557][T11047] Bluetooth: hci2: link tx timeout [ 1185.864620][T11047] Bluetooth: hci2: link tx timeout [ 1185.864684][T11047] Bluetooth: hci2: link tx timeout [ 1185.864754][T11047] Bluetooth: hci2: link tx timeout [ 1185.864819][T11047] Bluetooth: hci2: link tx timeout [ 1185.864882][T11047] Bluetooth: hci2: link tx timeout [ 1185.864947][T11047] Bluetooth: hci2: link tx timeout [ 1185.865055][T11047] Bluetooth: hci2: link tx timeout [ 1185.865127][T11047] Bluetooth: hci2: link tx timeout [ 1185.865190][T11047] Bluetooth: hci2: link tx timeout [ 1185.865253][T11047] Bluetooth: hci2: link tx timeout [ 1185.865316][T11047] Bluetooth: hci2: link tx timeout [ 1185.865380][T11047] Bluetooth: hci2: link tx timeout [ 1185.865448][T11047] Bluetooth: hci2: link tx timeout [ 1185.865512][T11047] Bluetooth: hci2: link tx timeout [ 1185.865577][T11047] Bluetooth: hci2: link tx timeout [ 1185.865639][T11047] Bluetooth: hci2: link tx timeout [ 1185.865702][T11047] Bluetooth: hci2: link tx timeout [ 1185.865770][T11047] Bluetooth: hci2: link tx timeout [ 1185.865832][T11047] Bluetooth: hci2: link tx timeout [ 1185.865894][T11047] Bluetooth: hci2: link tx timeout [ 1185.865956][T11047] Bluetooth: hci2: link tx timeout [ 1185.866020][T11047] Bluetooth: hci2: link tx timeout [ 1185.866129][T11047] Bluetooth: hci2: link tx timeout [ 1185.866194][T11047] Bluetooth: hci2: link tx timeout [ 1185.866264][T11047] Bluetooth: hci2: link tx timeout [ 1185.866334][T11047] Bluetooth: hci2: link tx timeout [ 1185.866399][T11047] Bluetooth: hci2: link tx timeout [ 1185.866464][T11047] Bluetooth: hci2: link tx timeout [ 1185.866529][T11047] Bluetooth: hci2: link tx timeout [ 1185.866594][T11047] Bluetooth: hci2: link tx timeout [ 1185.866658][T11047] Bluetooth: hci2: link tx timeout [ 1185.866728][T11047] Bluetooth: hci2: link tx timeout [ 1185.866793][T11047] Bluetooth: hci2: link tx timeout [ 1185.866858][T11047] Bluetooth: hci2: link tx timeout [ 1185.866922][T11047] Bluetooth: hci2: link tx timeout [ 1185.866991][T11047] Bluetooth: hci2: link tx timeout [ 1185.867065][T11047] Bluetooth: hci2: link tx timeout [ 1185.867173][T11047] Bluetooth: hci2: link tx timeout [ 1185.867237][T11047] Bluetooth: hci2: link tx timeout [ 1185.867303][T11047] Bluetooth: hci2: link tx timeout [ 1185.867388][T11047] Bluetooth: hci2: link tx timeout [ 1185.867506][T11047] Bluetooth: hci2: link tx timeout [ 1185.867572][T11047] Bluetooth: hci2: link tx timeout [ 1185.867637][T11047] Bluetooth: hci2: link tx timeout [ 1185.867701][T11047] Bluetooth: hci2: link tx timeout [ 1185.867772][T11047] Bluetooth: hci2: link tx timeout [ 1185.867838][T11047] Bluetooth: hci2: link tx timeout [ 1185.867901][T11047] Bluetooth: hci2: link tx timeout [ 1185.867967][T11047] Bluetooth: hci2: link tx timeout [ 1185.868033][T11047] Bluetooth: hci2: link tx timeout [ 1185.868144][T11047] Bluetooth: hci2: link tx timeout [ 1185.868210][T11047] Bluetooth: hci2: link tx timeout [ 1185.868274][T11047] Bluetooth: hci2: link tx timeout [ 1185.868338][T11047] Bluetooth: hci2: link tx timeout [ 1185.868407][T11047] Bluetooth: hci2: link tx timeout [ 1185.868473][T11047] Bluetooth: hci2: link tx timeout [ 1185.868537][T11047] Bluetooth: hci2: link tx timeout [ 1185.868602][T11047] Bluetooth: hci2: link tx timeout [ 1185.868667][T11047] Bluetooth: hci2: link tx timeout [ 1185.868737][T11047] Bluetooth: hci2: link tx timeout [ 1185.868802][T11047] Bluetooth: hci2: link tx timeout [ 1185.868866][T11047] Bluetooth: hci2: link tx timeout [ 1185.868930][T11047] Bluetooth: hci2: link tx timeout [ 1185.868999][T11047] Bluetooth: hci2: link tx timeout [ 1185.869063][T11047] Bluetooth: hci2: link tx timeout [ 1185.869127][T11047] Bluetooth: hci2: link tx timeout [ 1185.869233][T11047] Bluetooth: hci2: link tx timeout [ 1185.869297][T11047] Bluetooth: hci2: link tx timeout [ 1185.869365][T11047] Bluetooth: hci2: link tx timeout [ 1185.869430][T11047] Bluetooth: hci2: link tx timeout [ 1185.869495][T11047] Bluetooth: hci2: link tx timeout [ 1185.869560][T11047] Bluetooth: hci2: link tx timeout [ 1185.869625][T11047] Bluetooth: hci2: link tx timeout [ 1185.869690][T11047] Bluetooth: hci2: link tx timeout [ 1185.869760][T11047] Bluetooth: hci2: link tx timeout [ 1185.869825][T11047] Bluetooth: hci2: link tx timeout [ 1185.869894][T11047] Bluetooth: hci2: link tx timeout [ 1185.869959][T11047] Bluetooth: hci2: link tx timeout [ 1185.870025][T11047] Bluetooth: hci2: link tx timeout [ 1185.870089][T11047] Bluetooth: hci2: link tx timeout [ 1185.870154][T11047] Bluetooth: hci2: link tx timeout [ 1185.870261][T11047] Bluetooth: hci2: link tx timeout [ 1185.870326][T11047] Bluetooth: hci2: link tx timeout [ 1185.870392][T11047] Bluetooth: hci2: link tx timeout [ 1185.870456][T11047] Bluetooth: hci2: link tx timeout [ 1185.870521][T11047] Bluetooth: hci2: link tx timeout [ 1185.870587][T11047] Bluetooth: hci2: link tx timeout [ 1185.870652][T11047] Bluetooth: hci2: link tx timeout [ 1185.870722][T11047] Bluetooth: hci2: link tx timeout [ 1185.870786][T11047] Bluetooth: hci2: link tx timeout [ 1185.870852][T11047] Bluetooth: hci2: link tx timeout [ 1185.870922][T11047] Bluetooth: hci2: link tx timeout [ 1185.870987][T11047] Bluetooth: hci2: link tx timeout [ 1185.871051][T11047] Bluetooth: hci2: link tx timeout [ 1185.871115][T11047] Bluetooth: hci2: link tx timeout [ 1185.871179][T11047] Bluetooth: hci2: link tx timeout [ 1185.871289][T11047] Bluetooth: hci2: link tx timeout [ 1185.871355][T11047] Bluetooth: hci2: link tx timeout [ 1185.871420][T11047] Bluetooth: hci2: link tx timeout [ 1185.871485][T11047] Bluetooth: hci2: link tx timeout [ 1185.871551][T11047] Bluetooth: hci2: link tx timeout [ 1185.871616][T11047] Bluetooth: hci2: link tx timeout [ 1185.871682][T11047] Bluetooth: hci2: link tx timeout [ 1185.871751][T11047] Bluetooth: hci2: link tx timeout [ 1185.871830][T11047] Bluetooth: hci2: link tx timeout [ 1185.871941][T11047] Bluetooth: hci2: link tx timeout [ 1185.872007][T11047] Bluetooth: hci2: link tx timeout [ 1185.872072][T11047] Bluetooth: hci2: link tx timeout [ 1185.872137][T11047] Bluetooth: hci2: link tx timeout [ 1185.872204][T11047] Bluetooth: hci2: link tx timeout [ 1185.872311][T11047] Bluetooth: hci2: link tx timeout [ 1185.872377][T11047] Bluetooth: hci2: link tx timeout [ 1185.872443][T11047] Bluetooth: hci2: link tx timeout [ 1185.872506][T11047] Bluetooth: hci2: link tx timeout [ 1185.872575][T11047] Bluetooth: hci2: link tx timeout [ 1185.872641][T11047] Bluetooth: hci2: link tx timeout [ 1185.872711][T11047] Bluetooth: hci2: link tx timeout [ 1185.872776][T11047] Bluetooth: hci2: link tx timeout [ 1185.872841][T11047] Bluetooth: hci2: link tx timeout [ 1185.872911][T11047] Bluetooth: hci2: link tx timeout [ 1185.872975][T11047] Bluetooth: hci2: link tx timeout [ 1185.873040][T11047] Bluetooth: hci2: link tx timeout [ 1185.873185][T11047] Bluetooth: hci2: link tx timeout [ 1185.874457][T11047] Bluetooth: hci2: link tx timeout [ 1185.919524][T13956] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1185.925727][T11047] Bluetooth: hci2: link tx timeout [ 1186.017965][ T30] audit: type=1400 audit(1784571603.858:1923): avc: denied { setattr } for pid=21229 comm="syz.6.3823" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1186.039825][T11047] Bluetooth: hci2: link tx timeout [ 1186.103702][T13956] usb 4-1: device descriptor read/64, error -71 [ 1187.227131][T21247] FAULT_INJECTION: forcing a failure. [ 1187.227131][T21247] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1187.250443][T21247] CPU: 0 UID: 0 PID: 21247 Comm: syz.1.3826 Tainted: G L syzkaller #0 PREEMPT(full) [ 1187.250473][T21247] Tainted: [L]=SOFTLOCKUP [ 1187.250479][T21247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1187.250490][T21247] Call Trace: [ 1187.250497][T21247] [ 1187.250504][T21247] dump_stack_lvl+0x100/0x190 [ 1187.250532][T21247] should_fail_ex.cold+0x5/0xa [ 1187.250555][T21247] _copy_to_user+0x32/0xd0 [ 1187.250580][T21247] simple_read_from_buffer+0xcb/0x170 [ 1187.250610][T21247] proc_fail_nth_read+0x1af/0x230 [ 1187.250637][T21247] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1187.250665][T21247] ? rw_verify_area+0xce/0x6d0 [ 1187.250687][T21247] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1187.250712][T21247] vfs_read+0x1e4/0xb40 [ 1187.250741][T21247] ? __pfx_vfs_read+0x10/0x10 [ 1187.250765][T21247] ? __fget_files+0x215/0x3d0 [ 1187.250787][T21247] ? __fget_files+0x21f/0x3d0 [ 1187.250810][T21247] ksys_read+0x12a/0x250 [ 1187.250834][T21247] ? __pfx_ksys_read+0x10/0x10 [ 1187.250866][T21247] do_syscall_64+0x115/0x870 [ 1187.250883][T21247] ? clear_bhb_loop+0x40/0x90 [ 1187.250905][T21247] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1187.250923][T21247] RIP: 0033:0x7ff68655e6ce [ 1187.250938][T21247] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1187.250955][T21247] RSP: 002b:00007ff6873defe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1187.250972][T21247] RAX: ffffffffffffffda RBX: 00007ff6873df6c0 RCX: 00007ff68655e6ce [ 1187.250983][T21247] RDX: 000000000000000f RSI: 00007ff6873df0a0 RDI: 0000000000000004 [ 1187.250994][T21247] RBP: 00007ff6873df090 R08: 0000000000000000 R09: 0000000000000000 [ 1187.251004][T21247] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1187.251014][T21247] R13: 00007ff686826038 R14: 00007ff686825fa0 R15: 00007ffc961caa68 [ 1187.251039][T21247] [ 1187.495499][T21248] 9p: Bad value for 'wfdno' [ 1187.683724][T13956] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1187.866965][T13956] usb 4-1: device descriptor read/64, error -71 [ 1187.998116][T13956] usb usb4-port1: attempt power cycle [ 1188.082141][ T30] audit: type=1400 audit(1784571605.918:1924): avc: denied { cmd } for pid=21260 comm="syz.1.3831" path="/dev/ublk-control" dev="devtmpfs" ino=697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 1188.641124][T21279] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3834'. [ 1189.249903][ T30] audit: type=1400 audit(1784571607.068:1925): avc: denied { read write } for pid=21274 comm="syz.1.3835" name="vbi4" dev="devtmpfs" ino=981 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1189.579281][ T30] audit: type=1400 audit(1784571607.088:1926): avc: denied { open } for pid=21274 comm="syz.1.3835" path="/dev/vbi4" dev="devtmpfs" ino=981 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1189.580181][T21283] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3837'. [ 1189.905385][ T10] usb 7-1: new full-speed USB device number 42 using dummy_hcd [ 1190.028193][T13956] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1190.600913][T21308] loop2: detected capacity change from 0 to 7 [ 1190.620720][T21308] Dev loop2: unable to read RDB block 7 [ 1190.626367][T21308] loop2: unable to read partition table [ 1190.632183][T21308] loop2: partition table beyond EOD, truncated [ 1190.638451][T21308] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1190.759080][T21294] xt_CT: No such helper "syz0" [ 1190.806352][ T10] usb 7-1: not running at top speed; connect to a high speed hub [ 1190.831065][ T10] usb 7-1: config 7 has an invalid interface number: 238 but max is 2 [ 1191.200522][T21313] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65520 sclass=netlink_route_socket pid=21313 comm=syz.4.3846 [ 1191.229770][ T10] usb 7-1: config 7 contains an unexpected descriptor of type 0x1, skipping [ 1191.239050][ T10] usb 7-1: config 7 has an invalid interface number: 161 but max is 2 [ 1191.248059][T13956] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1191.258158][T13956] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 1191.269896][ T10] usb 7-1: config 7 has an invalid interface number: 3 but max is 2 [ 1191.280304][ T10] usb 7-1: config 7 has an invalid interface number: 136 but max is 2 [ 1191.288575][T13956] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1191.298376][ T10] usb 7-1: config 7 has 4 interfaces, different from the descriptor's value: 3 [ 1191.307423][T13956] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 1191.317359][ T10] usb 7-1: config 7 has no interface number 0 [ 1191.323479][T13956] usb 4-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 1191.335706][ T10] usb 7-1: config 7 has no interface number 1 [ 1191.344316][T13956] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1191.355487][ T10] usb 7-1: config 7 has no interface number 2 [ 1191.361652][ T10] usb 7-1: config 7 interface 238 altsetting 248 endpoint 0x4 has invalid maxpacket 1024, setting to 64 [ 1191.374775][T13956] usb 4-1: config 0 descriptor?? [ 1191.381213][ T10] usb 7-1: config 7 interface 238 altsetting 248 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 1191.393099][ T10] usb 7-1: config 7 interface 238 altsetting 248 has a duplicate endpoint with address 0xA, skipping [ 1191.410970][ T10] usb 7-1: config 7 interface 238 altsetting 248 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 1191.424867][ T10] usb 7-1: config 7 interface 238 altsetting 248 has an invalid descriptor for endpoint zero, skipping [ 1191.438484][ T10] usb 7-1: config 7 interface 238 altsetting 248 endpoint 0xD has an invalid bInterval 0, changing to 10 [ 1191.453438][ T10] usb 7-1: config 7 interface 238 altsetting 248 endpoint 0xE has invalid maxpacket 1719, setting to 64 [ 1191.532037][ T10] usb 7-1: config 7 interface 3 altsetting 11 has a duplicate endpoint with address 0x8, skipping [ 1191.552007][ T10] usb 7-1: config 7 interface 3 altsetting 11 has an invalid descriptor for endpoint zero, skipping [ 1191.581295][ T10] usb 7-1: config 7 interface 3 altsetting 11 has a duplicate endpoint with address 0xD, skipping [ 1191.607498][T13956] hdpvr 4-1:0.0: unexpected answer of status request, len -71 [ 1191.627470][ T10] usb 7-1: config 7 interface 3 altsetting 11 has a duplicate endpoint with address 0xA, skipping [ 1191.648816][T13956] hdpvr 4-1:0.0: device init failed [ 1191.665086][T13956] hdpvr 4-1:0.0: probe with driver hdpvr failed with error -12 [ 1191.680390][ T10] usb 7-1: config 7 interface 3 altsetting 11 has an invalid descriptor for endpoint zero, skipping [ 1191.707448][T13956] usb 4-1: USB disconnect, device number 88 [ 1191.717291][ T10] usb 7-1: config 7 interface 3 altsetting 11 endpoint 0x6 has invalid maxpacket 1024, setting to 1023 [ 1191.738256][ T10] usb 7-1: config 7 interface 3 altsetting 11 has an endpoint descriptor with address 0x5E, changing to 0xE [ 1191.750119][ T10] usb 7-1: config 7 interface 3 altsetting 11 has a duplicate endpoint with address 0xE, skipping [ 1191.769180][T21322] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3848'. [ 1191.780040][ T10] usb 7-1: config 7 interface 3 altsetting 11 has a duplicate endpoint with address 0xA, skipping [ 1191.794577][ T10] usb 7-1: config 7 interface 3 altsetting 11 has a duplicate endpoint with address 0xE, skipping [ 1191.805455][ T10] usb 7-1: config 7 interface 3 altsetting 11 has a duplicate endpoint with address 0x2, skipping [ 1191.816774][ T10] usb 7-1: config 7 interface 3 altsetting 11 has a duplicate endpoint with address 0x9, skipping [ 1191.829594][ T10] usb 7-1: config 7 interface 3 altsetting 11 has a duplicate endpoint with address 0x6, skipping [ 1191.841964][ T10] usb 7-1: config 7 interface 3 altsetting 11 has a duplicate endpoint with address 0x9, skipping [ 1191.985123][ T10] usb 7-1: config 7 interface 3 altsetting 11 has 16 endpoint descriptors, different from the interface descriptor's value: 15 [ 1191.998487][ T10] usb 7-1: config 7 interface 136 altsetting 229 has 0 endpoint descriptors, different from the interface descriptor's value: 10 [ 1192.011902][ T10] usb 7-1: config 7 interface 238 has no altsetting 0 [ 1192.019186][ T10] usb 7-1: config 7 interface 161 has no altsetting 0 [ 1192.026536][ T10] usb 7-1: config 7 interface 3 has no altsetting 0 [ 1192.033159][ T10] usb 7-1: config 7 interface 136 has no altsetting 0 [ 1192.042148][ T10] usb 7-1: Dual-Role OTG device on HNP port [ 1192.048514][ T10] usb 7-1: New USB device found, idVendor=04b4, idProduct=931d, bcdDevice=8e.c2 [ 1192.058130][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1192.066318][ T10] usb 7-1: Product: Ђ [ 1192.070428][ T10] usb 7-1: Manufacturer: ÑŠ [ 1192.075280][ T10] usb 7-1: SerialNumber: 鳜箌︽駴ìªï¶•å³¥é‹ƒí’¸ê©œè¹“á«‚ã‡¿è·§î»ƒê‹®è²¯ï´†ä»‡ç§‰çš®äŠ [ 1192.163705][T13615] usb 2-1: new full-speed USB device number 97 using dummy_hcd [ 1192.657683][T13615] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1192.713985][T13615] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1192.774620][ T10] usb 7-1: can't set first interface for hiFace device. [ 1192.785821][T13615] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1192.803976][ T10] snd-usb-hiface 7-1:7.238: probe with driver snd-usb-hiface failed with error -5 [ 1192.813806][T13615] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1192.897870][ T10] usb 7-1: can't set first interface for hiFace device. [ 1193.045494][ T10] snd-usb-hiface 7-1:7.161: probe with driver snd-usb-hiface failed with error -5 [ 1193.214771][T13615] usb 2-1: usb_control_msg returned -32 [ 1193.226026][ T10] usb 7-1: can't set first interface for hiFace device. [ 1193.236865][T13615] usbtmc 2-1:16.0: can't read capabilities [ 1193.260691][ T10] snd-usb-hiface 7-1:7.3: probe with driver snd-usb-hiface failed with error -5 [ 1193.314144][ T10] usb 7-1: can't set first interface for hiFace device. [ 1193.333732][ T10] snd-usb-hiface 7-1:7.136: probe with driver snd-usb-hiface failed with error -5 [ 1193.362984][ T10] usb 7-1: USB disconnect, device number 42 [ 1193.887616][T21360] FAULT_INJECTION: forcing a failure. [ 1193.887616][T21360] name failslab, interval 1, probability 0, space 0, times 0 [ 1193.900331][T21360] CPU: 1 UID: 0 PID: 21360 Comm: syz.6.3856 Tainted: G L syzkaller #0 PREEMPT(full) [ 1193.900360][T21360] Tainted: [L]=SOFTLOCKUP [ 1193.900367][T21360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1193.900377][T21360] Call Trace: [ 1193.900383][T21360] [ 1193.900390][T21360] dump_stack_lvl+0x100/0x190 [ 1193.900416][T21360] should_fail_ex.cold+0x5/0xa [ 1193.900439][T21360] should_failslab+0xc2/0x120 [ 1193.900462][T21360] __kmalloc_noprof+0xfc/0x820 [ 1193.900482][T21360] ? tomoyo_encode2+0xfb/0x3c0 [ 1193.900513][T21360] tomoyo_encode2+0xfb/0x3c0 [ 1193.900542][T21360] tomoyo_encode+0x29/0x50 [ 1193.900567][T21360] tomoyo_realpath_from_path+0x18c/0x690 [ 1193.900600][T21360] tomoyo_path_number_perm+0x23c/0x580 [ 1193.900621][T21360] ? tomoyo_path_number_perm+0x22e/0x580 [ 1193.900643][T21360] ? print_kernel_ident+0x14/0x40 [ 1193.900671][T21360] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1193.900695][T21360] ? rcu_is_watching+0x12/0xc0 [ 1193.900741][T21360] ? find_held_lock+0x2b/0x80 [ 1193.900765][T21360] ? __fget_files+0x215/0x3d0 [ 1193.900781][T21360] ? hook_file_ioctl_common+0x140/0x440 [ 1193.900798][T21360] ? __fget_files+0x215/0x3d0 [ 1193.900819][T21360] ? __fget_files+0x21f/0x3d0 [ 1193.900840][T21360] security_file_ioctl+0xd3/0x230 [ 1193.900866][T21360] __x64_sys_ioctl+0xb7/0x210 [ 1193.900893][T21360] do_syscall_64+0x115/0x870 [ 1193.900910][T21360] ? clear_bhb_loop+0x40/0x90 [ 1193.900932][T21360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1193.900950][T21360] RIP: 0033:0x7ff22539de99 [ 1193.900966][T21360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1193.900983][T21360] RSP: 002b:00007ff2235d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1193.901000][T21360] RAX: ffffffffffffffda RBX: 00007ff225626180 RCX: 00007ff22539de99 [ 1193.901012][T21360] RDX: 0000000000000000 RSI: 00000000c008551a RDI: 0000000000000007 [ 1193.901022][T21360] RBP: 00007ff2235d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1193.901033][T21360] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1193.901044][T21360] R13: 00007ff225626218 R14: 00007ff225626180 R15: 00007fffba523938 [ 1193.901069][T21360] [ 1193.901152][T21360] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1194.379268][T21366] netlink: 'syz.3.3860': attribute type 10 has an invalid length. [ 1194.633188][ T804] usb 2-1: USB disconnect, device number 97 [ 1195.034823][T21370] FAULT_INJECTION: forcing a failure. [ 1195.034823][T21370] name failslab, interval 1, probability 0, space 0, times 0 [ 1195.048861][T21370] CPU: 0 UID: 0 PID: 21370 Comm: syz.6.3862 Tainted: G L syzkaller #0 PREEMPT(full) [ 1195.048886][T21370] Tainted: [L]=SOFTLOCKUP [ 1195.048891][T21370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1195.048899][T21370] Call Trace: [ 1195.048905][T21370] [ 1195.048911][T21370] dump_stack_lvl+0x100/0x190 [ 1195.048935][T21370] should_fail_ex.cold+0x5/0xa [ 1195.048953][T21370] should_failslab+0xc2/0x120 [ 1195.048971][T21370] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1195.048988][T21370] ? dst_alloc+0x99/0x1a0 [ 1195.049002][T21370] ? __pfx_ip6_dst_gc+0x10/0x10 [ 1195.049022][T21370] dst_alloc+0x99/0x1a0 [ 1195.049037][T21370] ip6_pol_route+0x9fd/0x1310 [ 1195.049055][T21370] ? __pfx_ip6_pol_route+0x10/0x10 [ 1195.049070][T21370] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 1195.049093][T21370] ? fib6_get_table+0x1f/0x130 [ 1195.049114][T21370] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 1195.049128][T21370] fib6_rule_action+0x762/0x910 [ 1195.049151][T21370] ? __pfx_fib6_rule_action+0x10/0x10 [ 1195.049172][T21370] fib_rules_lookup+0x418/0x1060 [ 1195.049194][T21370] ? __pfx_fib_rules_lookup+0x10/0x10 [ 1195.049217][T21370] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 1195.049231][T21370] fib6_rule_lookup+0x18b/0x720 [ 1195.049251][T21370] ? irqentry_exit+0x24d/0xa00 [ 1195.049264][T21370] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 1195.049284][T21370] ? irqentry_exit+0x24d/0xa00 [ 1195.049300][T21370] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 1195.049323][T21370] ip6_route_input+0x662/0xc50 [ 1195.049341][T21370] ? __pfx_ip6_route_input+0x10/0x10 [ 1195.049368][T21370] ? nf_hook.constprop.0+0x2e3/0x750 [ 1195.049384][T21370] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 1195.049405][T21370] ip6_rcv_finish_core.isra.0+0x1b1/0x1260 [ 1195.049428][T21370] ipv6_rcv+0x1e8/0x3d0 [ 1195.049444][T21370] ? __pfx_ipv6_rcv+0x10/0x10 [ 1195.049459][T21370] __netif_receive_skb_one_core+0x12d/0x1e0 [ 1195.049482][T21370] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 1195.049506][T21370] ? lock_acquire+0x1b9/0x370 [ 1195.049531][T21370] __netif_receive_skb+0x1f/0x120 [ 1195.049557][T21370] netif_receive_skb+0x139/0x7d0 [ 1195.049583][T21370] ? __pfx_netif_receive_skb+0x10/0x10 [ 1195.049609][T21370] ? lockdep_hardirqs_on+0x78/0x100 [ 1195.049640][T21370] tun_rx_batched.isra.0+0x3f6/0x750 [ 1195.049674][T21370] ? __pfx___schedule+0x10/0x10 [ 1195.049700][T21370] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 1195.049738][T21370] tun_get_user+0x1e31/0x3c20 [ 1195.049775][T21370] ? __pfx_tun_get_user+0x10/0x10 [ 1195.049805][T21370] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1195.049837][T21370] ? find_held_lock+0x2b/0x80 [ 1195.049863][T21370] ? tun_get+0x191/0x370 [ 1195.049885][T21370] ? tun_get+0x191/0x370 [ 1195.049916][T21370] tun_chr_write_iter+0xdc/0x200 [ 1195.049945][T21370] vfs_write+0x6ac/0x1050 [ 1195.049973][T21370] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 1195.050002][T21370] ? __pfx_vfs_write+0x10/0x10 [ 1195.050026][T21370] ? find_held_lock+0x2b/0x80 [ 1195.050067][T21370] ksys_write+0x12a/0x250 [ 1195.050093][T21370] ? __pfx_ksys_write+0x10/0x10 [ 1195.050125][T21370] do_syscall_64+0x115/0x870 [ 1195.050142][T21370] ? clear_bhb_loop+0x40/0x90 [ 1195.050163][T21370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1195.050181][T21370] RIP: 0033:0x7ff22535e6ce [ 1195.050198][T21370] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1195.050214][T21370] RSP: 002b:00007ff226193fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1195.050232][T21370] RAX: ffffffffffffffda RBX: 00007ff2261946c0 RCX: 00007ff22535e6ce [ 1195.050243][T21370] RDX: 000000000000004e RSI: 00002000000006c0 RDI: 00000000000000c8 [ 1195.050254][T21370] RBP: 00007ff226194090 R08: 0000000000000000 R09: 0000000000000000 [ 1195.050265][T21370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1195.050274][T21370] R13: 00007ff225626038 R14: 00007ff225625fa0 R15: 00007fffba523938 [ 1195.050299][T21370] [ 1195.735708][T21312] syz.4.3846 (21312): drop_caches: 3 [ 1195.875398][T21385] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3867'. [ 1196.000061][T21389] hub 8-0:1.0: USB hub found [ 1196.075444][ T804] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1196.132395][T21389] hub 8-0:1.0: 1 port detected [ 1196.234856][ T804] usb 5-1: Using ep0 maxpacket: 8 [ 1196.246928][ T804] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1196.256405][ T804] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1196.354664][ T804] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1196.402732][ T804] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1196.530296][ T804] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1196.809345][ T804] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1196.900460][ T804] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1197.033759][T21405] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3873'. [ 1197.071800][T11047] Bluetooth: hci2: link tx timeout [ 1197.093730][ T804] usb 5-1: config 168 interface 0 has no altsetting 0 [ 1197.102538][ T804] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1197.110634][ T804] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1197.121901][ T804] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1197.133989][ T804] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1197.145941][ T804] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1197.157405][ T804] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1197.169310][ T804] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1197.182989][ T804] usb 5-1: config 168 interface 0 has no altsetting 0 [ 1197.191166][ T804] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1197.196614][T21409] ip6erspan2: entered allmulticast mode [ 1197.204481][ T804] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1197.216691][ T804] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1197.228349][ T804] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1197.253739][ T804] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1197.265918][ T804] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1197.273688][T13615] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1197.277510][ T804] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1197.285162][ T10] usb 2-1: new full-speed USB device number 98 using dummy_hcd [ 1197.299549][ T804] usb 5-1: config 168 interface 0 has no altsetting 0 [ 1197.336187][ T804] usb 5-1: string descriptor 0 read error: -22 [ 1197.342586][ T804] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1197.363678][ T804] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1197.391094][ T804] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1197.467565][T13615] usb 4-1: Using ep0 maxpacket: 32 [ 1197.477429][T13615] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 1197.486488][T13615] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1197.497287][T13615] usb 4-1: config 0 has no interface number 0 [ 1197.497408][ T10] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1197.513866][T13615] usb 4-1: config 0 interface 132 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1197.528099][ T10] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1197.544853][T21416] IPVS: persistence engine module ip_vs_pe_• not found [ 1197.552434][ T10] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1197.562879][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1197.571343][T13615] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1197.581611][T13615] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1197.610018][T13615] usb 4-1: Product: syz [ 1197.620472][T13615] usb 4-1: Manufacturer: syz [ 1197.630036][T13615] usb 4-1: SerialNumber: syz [ 1197.644264][T13615] usb 4-1: config 0 descriptor?? [ 1197.807334][ T10] usb 2-1: usb_control_msg returned -32 [ 1197.819984][ T10] usbtmc 2-1:16.0: can't read capabilities [ 1199.388943][T21437] xt_CT: No such helper "syz0" [ 1199.779206][ T30] audit: type=1400 audit(1784571617.618:1927): avc: denied { mounton } for pid=21403 comm="syz.3.3875" path="/117/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 1200.139355][T13615] usb 5-1: USB disconnect, device number 75 [ 1200.169178][ T804] usb 2-1: USB disconnect, device number 98 [ 1200.639081][T21461] mac80211_hwsim hwsim17 wlan0: entered promiscuous mode [ 1200.646327][T21461] mac80211_hwsim hwsim17 wlan0: entered allmulticast mode [ 1200.758674][T13615] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 1200.787590][T21460] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1200.871786][T21466] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3888'. [ 1200.880990][T21466] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3888'. [ 1200.907037][ T10] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1200.919435][T21466] genirq: Flags mismatch irq 31. 00200000 (pcmmio) vs. 00200000 (virtio1-input.0) [ 1200.937150][T13615] usb 7-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1200.956309][T13615] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1200.972694][T13615] usb 7-1: Product: syz [ 1200.984254][T13615] usb 7-1: Manufacturer: syz [ 1200.990967][T13615] usb 7-1: SerialNumber: syz [ 1201.012273][T13615] usb 7-1: config 0 descriptor?? [ 1201.073701][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 1201.094571][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1201.126314][ T10] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1201.147687][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1201.156942][ T10] usb 5-1: Product: syz [ 1201.163293][ T10] usb 5-1: Manufacturer: syz [ 1201.194750][ T10] usb 5-1: SerialNumber: syz [ 1201.211957][ T10] usb 5-1: config 0 descriptor?? [ 1201.234482][T13607] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1201.243961][ T10] quatech2 5-1:0.0: Quatech 2nd gen USB to Serial Driver converter detected [ 1201.272742][T13956] usb 4-1: USB disconnect, device number 89 [ 1201.311339][ T30] audit: type=1400 audit(1784571619.148:1928): avc: denied { unmount } for pid=18171 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 1201.426266][T13607] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1201.438058][T13607] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1201.448884][T13607] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1201.469887][T21478] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3892'. [ 1201.490483][T13607] usb 2-1: config 0 descriptor?? [ 1201.615608][T21482] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3894'. [ 1201.626366][T21482] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3894'. [ 1201.636525][T21482] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3894'. [ 1201.638684][ C0] raw-gadget.0 gadget.6: ignoring, device is not running [ 1201.646174][T21482] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3894'. [ 1201.667930][T21483] unsupported nlmsg_type 40 [ 1201.673021][T13615] usb 7-1: Firmware version (0.0) predates our first public release. [ 1201.681251][T13615] usb 7-1: Please update to version 0.2 or newer [ 1201.699519][T21482] overlay: Unknown parameter '/' [ 1201.714056][T13607] usbhid 2-1:0.0: can't add hid device: -71 [ 1201.720609][T13607] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1201.723734][T13270] usb 4-1: new full-speed USB device number 90 using dummy_hcd [ 1201.730628][T13607] usb 2-1: USB disconnect, device number 99 [ 1201.752499][T13615] usb 7-1: USB disconnect, device number 43 [ 1201.858109][ T30] audit: type=1400 audit(1784571619.698:1929): avc: denied { sqpoll } for pid=21486 comm="syz.7.3895" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1201.937396][T13270] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1201.952992][T13270] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1201.985378][T13270] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1202.001488][T13270] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1202.003088][ T10] usb 5-1: qt2_attach - failed to power on unit: -71 [ 1202.026776][ T10] quatech2 5-1:0.0: probe with driver quatech2 failed with error -71 [ 1202.046872][ T10] usb 5-1: USB disconnect, device number 76 [ 1202.243770][T13607] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1202.256070][T13270] usb 4-1: usb_control_msg returned -32 [ 1202.266595][T13270] usbtmc 4-1:16.0: can't read capabilities [ 1202.454429][T21501] FAULT_INJECTION: forcing a failure. [ 1202.454429][T21501] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1202.467534][T21501] CPU: 0 UID: 0 PID: 21501 Comm: syz.6.3899 Tainted: G L syzkaller #0 PREEMPT(full) [ 1202.467553][T21501] Tainted: [L]=SOFTLOCKUP [ 1202.467557][T21501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1202.467563][T21501] Call Trace: [ 1202.467568][T21501] [ 1202.467573][T21501] dump_stack_lvl+0x100/0x190 [ 1202.467591][T21501] should_fail_ex.cold+0x5/0xa [ 1202.467605][T21501] _copy_to_user+0x32/0xd0 [ 1202.467619][T21501] simple_read_from_buffer+0xcb/0x170 [ 1202.467638][T21501] proc_fail_nth_read+0x1af/0x230 [ 1202.467654][T21501] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1202.467670][T21501] ? rw_verify_area+0xce/0x6d0 [ 1202.467683][T21501] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1202.467698][T21501] vfs_read+0x1e4/0xb40 [ 1202.467715][T21501] ? __pfx_vfs_read+0x10/0x10 [ 1202.467730][T21501] ? __fget_files+0x215/0x3d0 [ 1202.467743][T21501] ? __fget_files+0x21f/0x3d0 [ 1202.467756][T21501] ksys_read+0x12a/0x250 [ 1202.467771][T21501] ? __pfx_ksys_read+0x10/0x10 [ 1202.467789][T21501] do_syscall_64+0x115/0x870 [ 1202.467800][T21501] ? clear_bhb_loop+0x40/0x90 [ 1202.467813][T21501] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1202.467824][T21501] RIP: 0033:0x7ff22535e6ce [ 1202.467834][T21501] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1202.467845][T21501] RSP: 002b:00007ff226193fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1202.467856][T21501] RAX: ffffffffffffffda RBX: 00007ff2261946c0 RCX: 00007ff22535e6ce [ 1202.467863][T21501] RDX: 000000000000000f RSI: 00007ff2261940a0 RDI: 0000000000000005 [ 1202.467869][T21501] RBP: 00007ff226194090 R08: 0000000000000000 R09: 0000000000000000 [ 1202.467876][T21501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1202.467882][T21501] R13: 00007ff225626038 R14: 00007ff225625fa0 R15: 00007fffba523938 [ 1202.467896][T21501] [ 1202.469761][T13607] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1202.916570][T13607] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1203.063677][T13607] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1203.212023][T13607] usb 2-1: config 0 descriptor?? [ 1203.725081][T21515] FAULT_INJECTION: forcing a failure. [ 1203.725081][T21515] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1203.738387][T21515] CPU: 0 UID: 0 PID: 21515 Comm: syz.4.3902 Tainted: G L syzkaller #0 PREEMPT(full) [ 1203.738413][T21515] Tainted: [L]=SOFTLOCKUP [ 1203.738419][T21515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1203.738427][T21515] Call Trace: [ 1203.738432][T21515] [ 1203.738436][T21515] dump_stack_lvl+0x100/0x190 [ 1203.738456][T21515] should_fail_ex.cold+0x5/0xa [ 1203.738470][T21515] _copy_from_user+0x2e/0xd0 [ 1203.738485][T21515] __x64_sys_sendfile64+0x120/0x220 [ 1203.738496][T21515] ? ksys_write+0x1ac/0x250 [ 1203.738511][T21515] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 1203.738526][T21515] do_syscall_64+0x115/0x870 [ 1203.738536][T21515] ? clear_bhb_loop+0x40/0x90 [ 1203.738549][T21515] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1203.738561][T21515] RIP: 0033:0x7fd50c39de99 [ 1203.738570][T21515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1203.738581][T21515] RSP: 002b:00007fd50a5d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1203.738593][T21515] RAX: ffffffffffffffda RBX: 00007fd50c626090 RCX: 00007fd50c39de99 [ 1203.738600][T21515] RDX: 00002000000000c0 RSI: 0000000000000004 RDI: 0000000000000004 [ 1203.738606][T21515] RBP: 00007fd50a5d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1203.738612][T21515] R10: 00000000006fecb1 R11: 0000000000000246 R12: 0000000000000001 [ 1203.738619][T21515] R13: 00007fd50c626128 R14: 00007fd50c626090 R15: 00007fffff4fedb8 [ 1203.738633][T21515] [ 1204.408501][T13615] usb 4-1: USB disconnect, device number 90 [ 1204.585784][T21519] overlayfs: missing 'lowerdir' [ 1204.637864][T21520] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3903'. [ 1204.845007][T13607] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 1204.854477][T13607] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input78 [ 1204.899589][T13607] usb 2-1: USB disconnect, device number 100 [ 1204.899622][ C0] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1207.221798][T21542] xt_CT: No such helper "syz0" [ 1207.953740][T13615] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 1208.705109][T21554] xt_CT: No such helper "syz0" [ 1209.177492][T21564] netlink: 44 bytes leftover after parsing attributes in process `syz.7.3914'. [ 1209.599994][ T30] audit: type=1400 audit(1784571627.438:1930): avc: denied { unmount } for pid=13062 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 1210.493731][T13270] usb 2-1: new full-speed USB device number 101 using dummy_hcd [ 1210.963805][T13270] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1211.193473][T13270] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1211.248090][T13270] usb 2-1: Product: syz [ 1211.294407][T13270] usb 2-1: Manufacturer: syz [ 1211.365579][T21594] xt_CT: No such helper "syz0" [ 1211.555832][T13270] usb 2-1: SerialNumber: syz [ 1212.055672][T13270] usb 2-1: config 0 descriptor?? [ 1212.375217][T13270] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1212.563664][T21618] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1213.210590][T21621] input: syz0 as /devices/virtual/input/input79 [ 1213.471424][T21632] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3932'. [ 1213.497232][ T30] audit: type=1400 audit(1784571631.338:1931): avc: denied { execmod } for pid=21630 comm="syz.7.3933" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=73431 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 1213.565002][T21635] syzkaller0: entered promiscuous mode [ 1213.588895][T21635] syzkaller0: entered allmulticast mode [ 1213.628170][T21635] FAULT_INJECTION: forcing a failure. [ 1213.628170][T21635] name failslab, interval 1, probability 0, space 0, times 0 [ 1213.650141][T21635] CPU: 1 UID: 0 PID: 21635 Comm: syz.4.3934 Tainted: G L syzkaller #0 PREEMPT(full) [ 1213.650179][T21635] Tainted: [L]=SOFTLOCKUP [ 1213.650186][T21635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1213.650196][T21635] Call Trace: [ 1213.650203][T21635] [ 1213.650211][T21635] dump_stack_lvl+0x100/0x190 [ 1213.650239][T21635] should_fail_ex.cold+0x5/0xa [ 1213.650263][T21635] should_failslab+0xc2/0x120 [ 1213.650285][T21635] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 1213.650306][T21635] ? __alloc_skb+0x5b7/0x710 [ 1213.650324][T21635] ? __alloc_skb+0x140/0x710 [ 1213.650345][T21635] __alloc_skb+0x140/0x710 [ 1213.650361][T21635] ? __alloc_skb+0x5b7/0x710 [ 1213.650378][T21635] ? __pfx___alloc_skb+0x10/0x10 [ 1213.650394][T21635] ? up_write+0x2e5/0x5c0 [ 1213.650421][T21635] alloc_skb_with_frags+0xdd/0x760 [ 1213.650449][T21635] sock_alloc_send_pskb+0x801/0x980 [ 1213.650477][T21635] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1213.650508][T21635] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1213.650537][T21635] ? find_held_lock+0x2b/0x80 [ 1213.650562][T21635] ? dev_get_by_index+0x180/0x380 [ 1213.650580][T21635] ? dev_get_by_index+0x180/0x380 [ 1213.650605][T21635] packet_sendmsg+0x1eda/0x5100 [ 1213.650624][T21635] ? avc_has_perm_noaudit+0x2f0/0x3b0 [ 1213.650652][T21635] ? sock_has_perm+0x25a/0x2f0 [ 1213.650674][T21635] ? __pfx_sock_has_perm+0x10/0x10 [ 1213.650702][T21635] ? __pfx_packet_sendmsg+0x10/0x10 [ 1213.650727][T21635] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1213.650755][T21635] ____sys_sendmsg+0xa4d/0xbe0 [ 1213.650779][T21635] ? __pfx_packet_sendmsg+0x10/0x10 [ 1213.650799][T21635] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1213.650834][T21635] ___sys_sendmsg+0x190/0x1e0 [ 1213.650862][T21635] ? __pfx____sys_sendmsg+0x10/0x10 [ 1213.650886][T21635] ? __lock_acquire+0x49f/0x1a40 [ 1213.650906][T21635] ? get_pid_task+0x106/0x250 [ 1213.650959][T21635] __sys_sendmsg+0x160/0x210 [ 1213.650980][T21635] ? __pfx___sys_sendmsg+0x10/0x10 [ 1213.651013][T21635] do_syscall_64+0x115/0x870 [ 1213.651031][T21635] ? clear_bhb_loop+0x40/0x90 [ 1213.651054][T21635] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1213.651072][T21635] RIP: 0033:0x7fd50c39de99 [ 1213.651089][T21635] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1213.651105][T21635] RSP: 002b:00007fd50a5f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1213.651124][T21635] RAX: ffffffffffffffda RBX: 00007fd50c625fa0 RCX: 00007fd50c39de99 [ 1213.651135][T21635] RDX: 0000000020004014 RSI: 00002000000000c0 RDI: 0000000000000007 [ 1213.651151][T21635] RBP: 00007fd50a5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1213.651161][T21635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1213.651172][T21635] R13: 00007fd50c626038 R14: 00007fd50c625fa0 R15: 00007fffff4fedb8 [ 1213.651196][T21635] [ 1213.995667][ T5705] usb 4-1: new full-speed USB device number 91 using dummy_hcd [ 1214.176211][ T5705] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1214.186217][ T5705] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1214.199258][ T5705] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1214.208327][ T5705] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1214.217942][T13270] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1214.228813][T13270] usb 2-1: USB disconnect, device number 101 [ 1214.496531][ T5705] usb 4-1: usb_control_msg returned -32 [ 1215.085237][ T5705] usbtmc 4-1:16.0: can't read capabilities [ 1216.338287][T21661] xt_CT: No such helper "syz0" [ 1216.404940][ T30] audit: type=1400 audit(1784571634.248:1932): avc: denied { accept } for pid=21645 comm="syz.6.3938" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1216.411531][T13270] usb 4-1: USB disconnect, device number 91 [ 1216.720733][T13607] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 1216.897794][T13607] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1216.918643][T13607] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1217.131275][T13607] usb 2-1: Product: syz [ 1217.150422][T13607] usb 2-1: Manufacturer: syz [ 1217.169010][T13607] usb 2-1: SerialNumber: syz [ 1217.199586][T13607] usb 2-1: config 0 descriptor?? [ 1217.231641][T21679] syzkaller0: entered promiscuous mode [ 1217.238329][T21679] syzkaller0: entered allmulticast mode [ 1217.262095][ T30] audit: type=1400 audit(1784571635.098:1933): avc: denied { ioctl } for pid=21678 comm="syz.6.3948" path="/dev/video5" dev="devtmpfs" ino=940 ioctlcmd=0x5605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1217.298011][T21679] tipc: Started in network mode [ 1217.304610][T21679] tipc: Node identity aa64de7113a1, cluster identity 4711 [ 1217.312098][T21679] tipc: Enabled bearer , priority 0 [ 1217.351554][T21678] tipc: Resetting bearer [ 1217.357797][T13270] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1217.613855][T13270] usb 4-1: Using ep0 maxpacket: 32 [ 1217.626634][T21678] tipc: Disabling bearer [ 1217.632502][T13270] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 1217.641179][T13270] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1217.704903][T21688] 9pnet_fd: p9_fd_create_unix (21688): address too long: ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 1217.711821][T21688] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3950'. [ 1217.869700][ C0] raw-gadget.0 gadget.1: ignoring, device is not running [ 1217.940057][T13270] usb 4-1: config 0 has no interface number 0 [ 1217.946695][T13270] usb 4-1: config 0 interface 132 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1217.946734][T13607] usb 2-1: Firmware version (0.0) predates our first public release. [ 1217.961693][T13270] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1217.977320][T13270] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1217.985647][T13270] usb 4-1: Product: syz [ 1217.989880][T13270] usb 4-1: Manufacturer: syz [ 1218.014789][T13270] usb 4-1: SerialNumber: syz [ 1218.023891][T13607] usb 2-1: Please update to version 0.2 or newer [ 1218.046327][T13270] usb 4-1: config 0 descriptor?? [ 1218.120576][T13607] usb 2-1: USB disconnect, device number 102 [ 1218.682601][T21701] tmpfs: Unknown parameter 'grpuo' [ 1218.725044][T21703] FAULT_INJECTION: forcing a failure. [ 1218.725044][T21703] name failslab, interval 1, probability 0, space 0, times 0 [ 1218.729023][T21705] loop4: detected capacity change from 0 to 7 [ 1218.761928][T21703] CPU: 0 UID: 0 PID: 21703 Comm: syz.1.3954 Tainted: G L syzkaller #0 PREEMPT(full) [ 1218.761957][T21703] Tainted: [L]=SOFTLOCKUP [ 1218.761964][T21703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1218.761974][T21703] Call Trace: [ 1218.761980][T21703] [ 1218.761987][T21703] dump_stack_lvl+0x100/0x190 [ 1218.762014][T21703] should_fail_ex.cold+0x5/0xa [ 1218.762036][T21703] should_failslab+0xc2/0x120 [ 1218.762057][T21703] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 1218.762076][T21703] ? __alloc_skb+0x5b7/0x710 [ 1218.762093][T21703] ? __alloc_skb+0x140/0x710 [ 1218.762113][T21703] __alloc_skb+0x140/0x710 [ 1218.762129][T21703] ? __alloc_skb+0x5b7/0x710 [ 1218.762145][T21703] ? __pfx___alloc_skb+0x10/0x10 [ 1218.762165][T21703] ? find_held_lock+0x2b/0x80 [ 1218.762195][T21703] alloc_skb_with_frags+0xdd/0x760 [ 1218.762223][T21703] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1218.762255][T21703] ? kernel_text_address+0x8d/0x100 [ 1218.762276][T21703] sock_alloc_send_pskb+0x801/0x980 [ 1218.762313][T21703] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1218.762342][T21703] ? _parse_integer_limit+0x1ac/0x220 [ 1218.762373][T21703] ? _kstrtoull+0x13c/0x1f0 [ 1218.762397][T21703] ? __pfx__kstrtoull+0x10/0x10 [ 1218.762425][T21703] tun_get_user+0x904/0x3c20 [ 1218.762464][T21703] ? __pfx_tun_get_user+0x10/0x10 [ 1218.762493][T21703] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1218.762526][T21703] ? find_held_lock+0x2b/0x80 [ 1218.762550][T21703] ? tun_get+0x191/0x370 [ 1218.762573][T21703] ? tun_get+0x191/0x370 [ 1218.762603][T21703] tun_chr_write_iter+0xdc/0x200 [ 1218.762633][T21703] vfs_write+0x6ac/0x1050 [ 1218.762660][T21703] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 1218.762689][T21703] ? __pfx_vfs_write+0x10/0x10 [ 1218.762712][T21703] ? find_held_lock+0x2b/0x80 [ 1218.762754][T21703] ksys_write+0x12a/0x250 [ 1218.762780][T21703] ? __pfx_ksys_write+0x10/0x10 [ 1218.762812][T21703] do_syscall_64+0x115/0x870 [ 1218.762831][T21703] ? clear_bhb_loop+0x40/0x90 [ 1218.762853][T21703] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1218.762872][T21703] RIP: 0033:0x7ff68655e6ce [ 1218.762889][T21703] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1218.762906][T21703] RSP: 002b:00007ff6873defb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1218.762924][T21703] RAX: ffffffffffffffda RBX: 00007ff6873df6c0 RCX: 00007ff68655e6ce [ 1218.762936][T21703] RDX: 000000000000fef3 RSI: 0000200000000200 RDI: 00000000000000c8 [ 1218.762947][T21703] RBP: 00007ff6873df090 R08: 0000000000000000 R09: 0000000000000000 [ 1218.762958][T21703] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1218.762968][T21703] R13: 00007ff686826038 R14: 00007ff686825fa0 R15: 00007ffc961caa68 [ 1218.762993][T21703] [ 1219.042305][T21705] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 1219.047772][T21705] loop4: partition table partially beyond EOD, truncated [ 1219.055238][T21705] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 1219.247692][ T30] audit: type=1400 audit(1784571637.088:1934): avc: denied { connect } for pid=21704 comm="syz.6.3956" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1219.372076][ T30] audit: type=1400 audit(1784571637.108:1935): avc: denied { getopt } for pid=21704 comm="syz.6.3956" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1220.331930][T13270] usb 4-1: USB disconnect, device number 92 [ 1220.618641][T21723] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1220.834674][ T30] audit: type=1400 audit(1784571638.678:1936): avc: denied { create } for pid=21724 comm="syz.1.3961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 1220.923309][T21730] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3960'. [ 1221.203814][T13270] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 1221.693922][T13270] usb 5-1: Using ep0 maxpacket: 16 [ 1221.708221][T13270] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1221.742453][T13270] usb 5-1: config 3 has an invalid interface number: 71 but max is 0 [ 1221.776126][T13270] usb 5-1: config 3 has no interface number 0 [ 1221.796901][T13270] usb 5-1: config 3 interface 71 has no altsetting 0 [ 1221.825832][T13270] usb 5-1: New USB device found, idVendor=1546, idProduct=1104, bcdDevice=b6.0d [ 1221.849256][T13270] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1221.874323][T13270] usb 5-1: Product: syz [ 1221.890978][T13270] usb 5-1: Manufacturer: syz [ 1221.910813][T13270] usb 5-1: SerialNumber: syz [ 1222.188413][T21739] netlink: 44 bytes leftover after parsing attributes in process `syz.6.3963'. [ 1222.453797][ T804] usb 7-1: new full-speed USB device number 45 using dummy_hcd [ 1222.607967][ T804] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1222.631412][ T804] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1222.655242][ T804] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1222.665463][ T804] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1223.058645][ T804] usb 7-1: usb_control_msg returned -32 [ 1223.076627][ T804] usbtmc 7-1:16.0: can't read capabilities [ 1223.261872][T21745] overlayfs: missing 'lowerdir' [ 1223.271072][T21745] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3965'. [ 1223.516910][T13270] cdc_ether 5-1:3.71: invalid descriptor buffer length [ 1223.565968][T13270] usb 5-1: No union descriptors [ 1223.586972][T13270] usb 5-1: USB disconnect, device number 77 [ 1224.587479][T21760] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3969'. [ 1225.318753][T21767] 9pnet_fd: p9_fd_create_unix (21767): address too long: ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 1225.323296][T21767] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3970'. [ 1225.631360][ T5705] usb 7-1: USB disconnect, device number 45 [ 1225.952902][T21774] FAULT_INJECTION: forcing a failure. [ 1225.952902][T21774] name failslab, interval 1, probability 0, space 0, times 0 [ 1225.966166][T21774] CPU: 0 UID: 0 PID: 21774 Comm: syz.6.3972 Tainted: G L syzkaller #0 PREEMPT(full) [ 1225.966197][T21774] Tainted: [L]=SOFTLOCKUP [ 1225.966204][T21774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1225.966214][T21774] Call Trace: [ 1225.966221][T21774] [ 1225.966228][T21774] dump_stack_lvl+0x100/0x190 [ 1225.966257][T21774] should_fail_ex.cold+0x5/0xa [ 1225.966281][T21774] should_failslab+0xc2/0x120 [ 1225.966304][T21774] __kmalloc_cache_noprof+0x91/0x6c0 [ 1225.966333][T21774] ? __io_queue_proc+0x2c2/0x900 [ 1225.966362][T21774] __io_queue_proc+0x2c2/0x900 [ 1225.966391][T21774] snd_rawmidi_poll+0x494/0x6a0 [ 1225.966422][T21774] ? __pfx_io_async_queue_proc+0x10/0x10 [ 1225.966445][T21774] ? lockdep_hardirqs_on+0x78/0x100 [ 1225.966476][T21774] __io_arm_poll_handler+0x44b/0x1270 [ 1225.966501][T21774] ? __pfx_snd_rawmidi_poll+0x10/0x10 [ 1225.966534][T21774] io_arm_apoll+0x661/0xa60 [ 1225.966561][T21774] ? __pfx_io_arm_apoll+0x10/0x10 [ 1225.966585][T21774] ? __pfx_io_async_queue_proc+0x10/0x10 [ 1225.966614][T21774] ? __io_issue_sqe+0x14a/0x7a0 [ 1225.966645][T21774] io_arm_poll_handler+0x21f/0x2b0 [ 1225.966671][T21774] io_queue_async+0x159/0x290 [ 1225.966696][T21774] io_req_task_submit+0x266/0x290 [ 1225.966721][T21774] ? __pfx_io_req_task_submit+0x10/0x10 [ 1225.966753][T21774] io_poll_task_func+0xa2a/0xde0 [ 1225.966782][T21774] ? __pfx_io_poll_task_func+0x10/0x10 [ 1225.966808][T21774] ? __mutex_lock+0x26d/0x1bd0 [ 1225.966826][T21774] ? io_run_local_work+0x25/0x50 [ 1225.966859][T21774] __io_run_local_work+0x2be/0xa80 [ 1225.966891][T21774] ? __pfx___io_run_local_work+0x10/0x10 [ 1225.966916][T21774] ? __pfx___schedule+0x10/0x10 [ 1225.966949][T21774] io_run_local_work+0x34/0x50 [ 1225.966974][T21774] ? io_cqring_wait+0xdcd/0x2980 [ 1225.967001][T21774] io_cqring_wait+0xe83/0x2980 [ 1225.967036][T21774] ? __pfx_io_cqring_wait+0x10/0x10 [ 1225.967062][T21774] ? __do_sys_io_uring_enter+0x1794/0x1b10 [ 1225.967088][T21774] ? __pfx_io_wake_function+0x10/0x10 [ 1225.967134][T21774] __do_sys_io_uring_enter+0x1136/0x1b10 [ 1225.967162][T21774] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1225.967182][T21774] ? __fget_files+0x21f/0x3d0 [ 1225.967199][T21774] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 1225.967228][T21774] ? fput+0x79/0x100 [ 1225.967259][T21774] do_syscall_64+0x115/0x870 [ 1225.967276][T21774] ? clear_bhb_loop+0x40/0x90 [ 1225.967298][T21774] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1225.967317][T21774] RIP: 0033:0x7ff22539de99 [ 1225.967335][T21774] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1225.967352][T21774] RSP: 002b:00007ff2235f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1225.967372][T21774] RAX: ffffffffffffffda RBX: 00007ff225626090 RCX: 00007ff22539de99 [ 1225.967384][T21774] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000009 [ 1225.967394][T21774] RBP: 00007ff2235f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1225.967404][T21774] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 1225.967415][T21774] R13: 00007ff225626128 R14: 00007ff225626090 R15: 00007fffba523938 [ 1225.967440][T21774] [ 1226.842844][T21778] FAULT_INJECTION: forcing a failure. [ 1226.842844][T21778] name failslab, interval 1, probability 0, space 0, times 0 [ 1226.855623][T21778] CPU: 1 UID: 0 PID: 21778 Comm: syz.4.3973 Tainted: G L syzkaller #0 PREEMPT(full) [ 1226.855651][T21778] Tainted: [L]=SOFTLOCKUP [ 1226.855657][T21778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1226.855667][T21778] Call Trace: [ 1226.855673][T21778] [ 1226.855681][T21778] dump_stack_lvl+0x100/0x190 [ 1226.855708][T21778] should_fail_ex.cold+0x5/0xa [ 1226.855731][T21778] should_failslab+0xc2/0x120 [ 1226.855753][T21778] __kmalloc_cache_noprof+0x91/0x6c0 [ 1226.855782][T21778] ? comedi_open+0x9b/0x5e0 [ 1226.855805][T21778] ? __pfx_comedi_open+0x10/0x10 [ 1226.855824][T21778] comedi_open+0x9b/0x5e0 [ 1226.855845][T21778] ? __pfx_comedi_open+0x10/0x10 [ 1226.855865][T21778] chrdev_open+0x234/0x6a0 [ 1226.855884][T21778] ? __pfx_chrdev_open+0x10/0x10 [ 1226.855902][T21778] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 1226.855928][T21778] do_dentry_open+0x6ab/0x14d0 [ 1226.855953][T21778] ? __pfx_chrdev_open+0x10/0x10 [ 1226.855975][T21778] vfs_open+0x82/0x3f0 [ 1226.855997][T21778] path_openat+0x2873/0x4280 [ 1226.856025][T21778] ? __pfx_path_openat+0x10/0x10 [ 1226.856048][T21778] do_file_open+0x20e/0x430 [ 1226.856066][T21778] ? __pfx_do_file_open+0x10/0x10 [ 1226.856100][T21778] ? alloc_fd+0x471/0x7a0 [ 1226.856120][T21778] ? do_getname+0x191/0x390 [ 1226.856149][T21778] do_sys_openat2+0x10f/0x1e0 [ 1226.856170][T21778] ? __pfx_do_sys_openat2+0x10/0x10 [ 1226.856191][T21778] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1226.856211][T21778] ? __fget_files+0x21f/0x3d0 [ 1226.856231][T21778] __x64_sys_openat+0x12d/0x210 [ 1226.856252][T21778] ? __pfx___x64_sys_openat+0x10/0x10 [ 1226.856270][T21778] ? ksys_write+0x1ac/0x250 [ 1226.856303][T21778] do_syscall_64+0x115/0x870 [ 1226.856319][T21778] ? clear_bhb_loop+0x40/0x90 [ 1226.856341][T21778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1226.856357][T21778] RIP: 0033:0x7fd50c39de99 [ 1226.856370][T21778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1226.856384][T21778] RSP: 002b:00007fd50a5f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1226.856398][T21778] RAX: ffffffffffffffda RBX: 00007fd50c625fa0 RCX: 00007fd50c39de99 [ 1226.856408][T21778] RDX: 0000000000000001 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 1226.856416][T21778] RBP: 00007fd50a5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1226.856424][T21778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1226.856433][T21778] R13: 00007fd50c626038 R14: 00007fd50c625fa0 R15: 00007fffff4fedb8 [ 1226.856451][T21778] [ 1227.399193][T21780] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1227.674606][T21790] No control pipe specified [ 1227.707774][ T30] audit: type=1400 audit(1784571645.548:1937): avc: denied { mounton } for pid=21787 comm="syz.4.3976" path="/152/file1/file0" dev="autofs" ino=73804 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=dir permissive=1 [ 1228.162788][T21802] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3979'. [ 1228.174523][T21802] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3979'. [ 1228.555619][T13270] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 1228.644811][T21806] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3982'. [ 1228.725087][T13270] usb 7-1: Using ep0 maxpacket: 16 [ 1228.736262][T13270] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1228.759905][T13270] usb 7-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 1228.820636][T13270] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1228.837425][T13270] usb 7-1: config 0 descriptor?? [ 1228.898126][T13956] usb 4-1: new full-speed USB device number 93 using dummy_hcd [ 1229.065891][T13956] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1229.083686][T13956] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1229.108438][T13956] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1229.123286][T21814] overlayfs: failed to resolve './file0redirect_dir=follow': -2 [ 1229.127771][T13956] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1229.158412][T21796] wg1: entered promiscuous mode [ 1229.163456][T21796] wg1: entered allmulticast mode [ 1229.199380][T13270] usbhid 7-1:0.0: can't add hid device: -71 [ 1229.213418][T13270] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1229.231356][T13270] usb 7-1: USB disconnect, device number 46 [ 1229.443242][T13956] usb 4-1: usb_control_msg returned -32 [ 1229.478371][T13956] usbtmc 4-1:16.0: can't read capabilities [ 1229.632945][T21827] overlayfs: conflicting lowerdir path [ 1229.642028][ T30] audit: type=1400 audit(1784571647.458:1938): avc: denied { mounton } for pid=21823 comm="syz.1.3989" path="/137/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 1230.478733][ T30] audit: type=1400 audit(1784571648.318:1939): avc: denied { mount } for pid=21844 comm="syz.1.3997" name="/" dev="pstore" ino=4041 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 1230.625022][ T30] audit: type=1400 audit(1784571648.468:1940): avc: denied { ioctl } for pid=21849 comm="syz.7.3999" path="socket:[73976]" dev="sockfs" ino=73976 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1232.453563][T21860] xt_CT: No such helper "syz0" [ 1232.815452][ T1222] usb 4-1: USB disconnect, device number 93 [ 1232.958728][ T30] audit: type=1400 audit(1784571650.798:1941): avc: denied { read } for pid=21867 comm="syz.6.4003" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1232.996292][ T30] audit: type=1400 audit(1784571650.798:1942): avc: denied { open } for pid=21867 comm="syz.6.4003" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1233.031214][ T30] audit: type=1400 audit(1784571650.798:1943): avc: denied { ioctl } for pid=21867 comm="syz.6.4003" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1233.119314][ T30] audit: type=1400 audit(1784571650.808:1944): avc: denied { cmd } for pid=21865 comm="syz.3.4002" path="socket:[73993]" dev="sockfs" ino=73993 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1233.163905][T13956] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 1233.683707][T13956] usb 2-1: Using ep0 maxpacket: 8 [ 1233.697430][T13956] usb 2-1: config index 0 descriptor too short (expected 74, got 45) [ 1233.706010][T13956] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 1233.717522][T13956] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1233.730663][T13956] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 65535, setting to 1024 [ 1233.742255][T13956] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1233.768252][T13956] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1233.865002][T13956] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1233.874377][T13956] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1234.109178][T13956] usb 2-1: GET_CAPABILITIES returned 0 [ 1234.115249][T13956] usbtmc 2-1:16.0: can't read capabilities [ 1234.426349][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1234.495189][T21864] usbtmc 2-1:16.0: Unable to send data, error -71 [ 1234.997989][ T804] usb 2-1: USB disconnect, device number 103 [ 1235.078506][T21898] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4012'. [ 1235.139678][T21906] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1235.214300][T21909] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4017'. [ 1235.593580][T21919] fuse: fd is not a fuse device [ 1235.803689][ T804] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 1235.853345][T21926] netlink: 40 bytes leftover after parsing attributes in process `syz.7.4023'. [ 1235.893862][T21927] syzkaller0: entered promiscuous mode [ 1235.914429][T21927] syzkaller0: entered allmulticast mode [ 1235.973757][ T804] usb 7-1: Using ep0 maxpacket: 32 [ 1235.987529][ T804] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1236.008673][ T804] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1236.029602][ T804] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1236.047262][ T804] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1236.068979][ T804] usb 7-1: config 0 descriptor?? [ 1236.084517][ T804] hub 7-1:0.0: USB hub found [ 1236.300274][ T804] hub 7-1:0.0: config failed, can't read hub descriptor (err -22) [ 1236.318328][ T804] usbhid 7-1:0.0: can't add hid device: -71 [ 1236.333024][ T804] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1236.364928][ T804] usb 7-1: USB disconnect, device number 47 [ 1236.945463][T21938] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1236.963243][ T30] audit: type=1400 audit(1784571654.798:1945): avc: denied { ioctl } for pid=21939 comm="syz.3.4029" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=737 ioctlcmd=0x550a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:xen_device_t:s0" [ 1236.995023][T21940] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1237.165436][T13270] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 1237.276122][T21953] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4035'. [ 1237.338904][T13270] usb 2-1: Using ep0 maxpacket: 8 [ 1237.355068][T13270] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1237.368503][T13270] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1237.378808][T13270] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1237.389098][T13270] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1237.402736][T13270] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1237.412439][T13270] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1237.654392][T13270] usb 2-1: GET_CAPABILITIES returned 0 [ 1237.659963][T13270] usbtmc 2-1:16.0: can't read capabilities [ 1237.864575][ C1] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1237.882555][T13270] usb 2-1: USB disconnect, device number 104 [ 1238.977626][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 1240.731972][T11047] Bluetooth: hci2: link tx timeout [ 1240.746023][T11047] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 1240.781156][T11047] Bluetooth: hci2: link tx timeout [ 1240.810487][T21996] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4049'. [ 1241.003919][T13607] usb 4-1: new full-speed USB device number 95 using dummy_hcd [ 1241.093947][ T10] usb 2-1: new full-speed USB device number 105 using dummy_hcd [ 1241.207407][T13607] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1241.276499][T13607] usb 4-1: not running at top speed; connect to a high speed hub [ 1241.314570][T13607] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 1241.351592][T13607] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 208, changing to 4 [ 1241.398114][T13607] usb 4-1: New USB device found, idVendor=041e, idProduct=0005, bcdDevice= 0.40 [ 1241.410744][T13607] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1241.426284][T13607] usb 4-1: Product: syz [ 1241.448255][T13607] usb 4-1: Manufacturer: syz [ 1241.460832][T13607] usb 4-1: SerialNumber: syz [ 1241.723722][T22002] tc_dump_action: action bad kind [ 1241.844818][T22007] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4052'. [ 1242.121916][T22009] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1242.824905][T11047] Bluetooth: hci2: command 0x0406 tx timeout [ 1244.171234][T13607] usb 4-1: USB disconnect, device number 95 [ 1245.602206][T11047] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1245.679665][T22044] netlink: 44 bytes leftover after parsing attributes in process `syz.6.4063'. [ 1245.750043][T17780] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1245.759179][T17780] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1245.772907][T17780] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1246.288935][T17780] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1246.525814][T22040] netlink: 40 bytes leftover after parsing attributes in process `syz.7.4064'. [ 1246.785622][T22048] xt_CT: No such helper "syz0" [ 1247.682032][T22065] overlayfs: missing 'lowerdir' [ 1247.703229][ T30] audit: type=1400 audit(1784571665.548:1946): avc: denied { write } for pid=22059 comm="syz.1.4067" name="cgroup.subtree_control" dev="cgroup2" ino=383 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1247.762239][ T30] audit: type=1400 audit(1784571665.578:1947): avc: denied { open } for pid=22059 comm="syz.1.4067" path="" dev="cgroup2" ino=383 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1247.794124][ T5615] Bluetooth: hci2: command 0x0406 tx timeout [ 1248.229893][T10859] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1248.696525][ T5615] Bluetooth: hci3: command tx timeout [ 1249.330398][T22085] xt_CT: No such helper "syz0" [ 1250.069308][T10859] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1250.170378][T22093] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input80 [ 1250.265980][T22095] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4072'. [ 1250.366983][T22094] syzkaller0: entered promiscuous mode [ 1250.372749][T22094] syzkaller0: entered allmulticast mode [ 1250.639386][T10859] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1250.735804][ T5615] Bluetooth: hci3: command tx timeout [ 1251.286235][ T5705] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 1252.195405][T10859] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1252.473765][T13956] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 1252.635563][T13956] usb 4-1: Using ep0 maxpacket: 32 [ 1252.650955][T13956] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 1252.663324][T13956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1252.693742][T13956] usb 4-1: Product: syz [ 1252.724820][T13956] usb 4-1: Manufacturer: syz [ 1252.740750][T13956] usb 4-1: SerialNumber: syz [ 1252.784688][T13956] usb 4-1: config 0 descriptor?? [ 1252.814446][ T5615] Bluetooth: hci3: command tx timeout [ 1252.836752][ T5705] usb 7-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1252.863668][ T5705] usb 7-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1252.884698][ T5705] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1252.935524][ T5705] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1253.077135][T10859] batman_adv: batadv0: Removing interface: macsec1 [ 1253.090654][T10859] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1253.105635][T10859] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1253.115581][T10859] bond0 (unregistering): Released all slaves [ 1253.124985][T10859] bond1 (unregistering): Released all slaves [ 1253.228293][T13956] airspy 4-1:0.0: Board ID: 00 [ 1253.233310][T13956] airspy 4-1:0.0: Firmware version: [ 1253.662437][T13956] airspy 4-1:0.0: usb_control_msg() failed -71 request 0e [ 1253.688510][T13956] airspy 4-1:0.0: Registered as swradio24 [ 1253.696827][T13956] airspy 4-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 1253.710523][T13956] usb 4-1: USB disconnect, device number 96 [ 1254.025538][ T5705] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -71 [ 1254.132360][ T5705] stv0680 7-1:4.0: STV(e): camera ping failed!! [ 1254.221999][ T5705] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1254.329120][ T5705] stv0680 7-1:4.0: last error: 0, command = 0x0 [ 1254.455677][ T5705] usb 7-1: USB disconnect, device number 49 [ 1254.847809][T22133] xt_CT: No such helper "syz0" [ 1254.899015][ T5615] Bluetooth: hci3: command tx timeout [ 1257.133537][T22038] bridge0: port 1(bridge_slave_0) entered blocking state [ 1257.164127][T13607] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 1257.171928][T22038] bridge0: port 1(bridge_slave_0) entered disabled state [ 1257.290302][T22038] bridge_slave_0: entered allmulticast mode [ 1257.299466][T22038] bridge_slave_0: entered promiscuous mode [ 1257.324175][T22038] bridge0: port 2(bridge_slave_1) entered blocking state [ 1257.334782][T22038] bridge0: port 2(bridge_slave_1) entered disabled state [ 1257.342272][T22038] bridge_slave_1: entered allmulticast mode [ 1257.474828][ T30] audit: type=1400 audit(1784571675.308:1948): avc: denied { ioctl } for pid=22144 comm="syz.6.4081" path="socket:[75529]" dev="sockfs" ino=75529 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1257.508100][T22038] bridge_slave_1: entered promiscuous mode [ 1257.545183][T13607] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1257.579194][T13607] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1257.601037][T10859] hsr_slave_0: left promiscuous mode [ 1257.613706][T13607] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1257.635203][T10859] hsr_slave_1: left promiscuous mode [ 1257.646365][T13607] usb 2-1: config 0 descriptor?? [ 1257.655869][T10859] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1257.773374][T10859] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1257.791931][T10859] veth1_macvtap: left promiscuous mode [ 1257.797484][T10859] veth0_macvtap: left promiscuous mode [ 1257.802976][T10859] veth1_vlan: left promiscuous mode [ 1257.808428][T10859] veth0_vlan: left promiscuous mode [ 1257.890790][T22169] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1258.657690][ T30] audit: type=1400 audit(1784571676.498:1949): avc: denied { write } for pid=22152 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1259.098737][T13607] ath6kl: Failed to read usb control message: -71 [ 1259.111019][T13607] ath6kl: Unable to read the bmi data from the device: -71 [ 1259.130948][T13607] ath6kl: Unable to recv target info: -71 [ 1259.147038][T10859] team0 (unregistering): Port device team_slave_1 removed [ 1259.154431][T13607] ath6kl: Failed to init ath6kl core: -71 [ 1259.169306][T13607] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1259.193159][ T30] audit: type=1400 audit(1784571677.028:1950): avc: denied { write } for pid=22183 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1259.225267][T13607] usb 2-1: USB disconnect, device number 106 [ 1259.236517][T10859] team0 (unregistering): Port device team_slave_0 removed [ 1259.402970][ T5272] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1259.416238][T22038] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1259.440075][T22038] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1259.502027][T22038] team0: Port device team_slave_0 added [ 1259.516783][T22038] team0: Port device team_slave_1 added [ 1259.626701][T22038] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1259.661001][T22038] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1259.733664][T22038] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1259.780765][T22038] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1259.808020][T22038] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1259.834234][T22038] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1259.912847][T13956] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 1260.028683][T22214] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1260.043377][T22214] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 1260.096399][T13956] usb 7-1: Using ep0 maxpacket: 32 [ 1260.114664][T13956] usb 7-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 1260.148195][T22214] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1260.159059][ T30] audit: type=1400 audit(1784571677.998:1951): avc: denied { write } for pid=22196 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1260.162107][T13956] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1260.184976][T22038] hsr_slave_0: entered promiscuous mode [ 1260.204481][T22214] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 1260.241533][T22038] hsr_slave_1: entered promiscuous mode [ 1260.260624][T13956] usb 7-1: Product: syz [ 1260.265495][T22038] debugfs: 'hsr0' already exists in 'hsr' [ 1260.273953][T13956] usb 7-1: Manufacturer: syz [ 1260.276035][T22038] Cannot create hsr debugfs directory [ 1260.310892][T13956] usb 7-1: SerialNumber: syz [ 1260.349562][T13956] usb 7-1: config 0 descriptor?? [ 1260.368316][T13956] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 1260.387405][T22214] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1260.393431][T22214] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 1260.687978][T22233] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1261.124072][T13956] gspca_ov534_9: reg_w failed -110 [ 1261.353981][ T30] audit: type=1400 audit(1784571679.198:1952): avc: denied { write } for pid=22223 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1261.773695][T13956] gspca_ov534_9: Unknown sensor 0000 [ 1261.773769][T13956] ov534_9 7-1:0.0: probe with driver ov534_9 failed with error -22 [ 1262.094850][ T5272] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1262.295966][T22038] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1262.305818][ T1222] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 1262.306262][T22038] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1262.338878][T22038] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1262.349495][T22038] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1262.363164][T22038] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1262.373572][T22038] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1262.384679][T22038] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1262.397082][T22038] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1262.423715][T13956] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 1262.454501][ T1222] usb 2-1: Using ep0 maxpacket: 16 [ 1262.470061][ T1222] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1262.490215][ T1222] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1262.504699][ T1222] usb 2-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1262.522514][ T1222] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1262.536627][T22038] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1262.551360][ T1222] usb 2-1: config 0 descriptor?? [ 1262.578313][T13956] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1262.592783][T22038] 8021q: adding VLAN 0 to HW filter on device team0 [ 1262.604729][T13956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1262.628701][T10859] bridge0: port 1(bridge_slave_0) entered blocking state [ 1262.633498][T13956] usb 4-1: Product: syz [ 1262.636418][T10859] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1262.648144][T13956] usb 4-1: Manufacturer: syz [ 1262.661123][T13956] usb 4-1: SerialNumber: syz [ 1262.710058][T13956] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1262.717416][T10859] bridge0: port 2(bridge_slave_1) entered blocking state [ 1262.725935][T10859] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1262.741680][ T30] audit: type=1400 audit(1784571680.568:1953): avc: denied { write } for pid=22250 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1262.755336][T13607] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1262.988861][ T30] audit: type=1400 audit(1784571680.808:1954): avc: denied { write } for pid=22271 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1262.992155][T22247] Cannot find set identified by id 0 to match [ 1263.022932][ T1222] hid (null): unknown global tag 0xd [ 1263.059013][ T1222] hid (null): global environment stack underflow [ 1263.076355][ T1222] hid (null): unknown global tag 0xab [ 1263.146493][T22278] batadv_slave_1: entered promiscuous mode [ 1263.409273][ T1222] hid (null): unknown global tag 0xc [ 1263.445760][ T1222] hid (null): unknown global tag 0xd [ 1263.453090][ T1222] hid (null): unknown global tag 0x9d [ 1263.655604][ T1222] usb 2-1: string descriptor 0 read error: -71 [ 1263.684774][T22246] batadv_slave_1: left promiscuous mode [ 1263.704618][ T1222] usb 2-1: Max retries (5) exceeded reading string descriptor 200 [ 1263.720393][T13270] usb 4-1: USB disconnect, device number 97 [ 1263.741483][ T1222] letsketch 0003:6161:4D15.000F: probe with driver letsketch failed with error -32 [ 1263.742744][ T5272] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1263.770845][T13956] usb 7-1: USB disconnect, device number 50 [ 1263.806219][ T1222] usb 2-1: USB disconnect, device number 107 [ 1263.856555][T13607] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1263.895542][T13607] ath9k_htc: Failed to initialize the device [ 1263.931357][T13270] usb 4-1: ath9k_htc: USB layer deinitialized [ 1265.438172][T22038] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1265.729881][T22323] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1269.006851][ T30] audit: type=1400 audit(1784571686.768:1955): avc: denied { write } for pid=22293 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1269.455130][T22038] veth0_vlan: entered promiscuous mode [ 1269.602440][T22038] veth1_vlan: entered promiscuous mode [ 1269.727990][ T30] audit: type=1400 audit(1784571687.568:1956): avc: denied { write } for pid=22356 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1269.892594][T22038] veth0_macvtap: entered promiscuous mode [ 1269.962290][ T5272] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1269.980385][T22038] veth1_macvtap: entered promiscuous mode [ 1270.060729][T22038] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1270.156754][T22038] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1270.246131][ T6279] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1270.276114][ T6279] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1270.306201][ T6279] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1270.335469][T22374] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4120'. [ 1270.402517][ T6279] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1270.998749][T22382] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1271.233958][T13920] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1271.258679][T13920] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1271.527808][ T6283] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1271.559271][ T6283] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1271.641200][ T30] audit: type=1400 audit(1784571689.478:1957): avc: denied { mounton } for pid=22038 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 1272.056311][T22397] overlayfs: missing 'lowerdir' [ 1272.164035][ T9] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1272.239358][T22400] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1272.360717][ T9] usb 9-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1272.395302][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1272.428508][ T9] usb 9-1: Product: syz [ 1272.452614][ T9] usb 9-1: Manufacturer: syz [ 1272.480098][ T9] usb 9-1: SerialNumber: syz [ 1272.507506][ T9] usb 9-1: config 0 descriptor?? [ 1272.737741][T22410] netlink: 1787 bytes leftover after parsing attributes in process `syz.3.4129'. [ 1272.765954][T22410] netlink: 3562 bytes leftover after parsing attributes in process `syz.3.4129'. [ 1272.801469][T22408] i2c i2c-0: dtv_property_process_set: SET cmd 0xfb5c80c6 undefined [ 1272.801494][T22409] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4129'. [ 1272.835746][T22414] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1272.906390][T11047] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1272.922839][T11047] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1272.934496][T11047] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1272.950099][T11047] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1272.963404][T11047] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1273.206208][T22431] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4132'. [ 1273.366006][ T9] usb 9-1: Firmware version (0.0) predates our first public release. [ 1273.388257][ T9] usb 9-1: Please update to version 0.2 or newer [ 1274.172279][ T9] usb 9-1: USB disconnect, device number 2 [ 1274.832894][T22457] overlayfs: missing 'workdir' [ 1274.972011][T22459] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4139'. [ 1275.056615][ T5615] Bluetooth: hci1: command tx timeout [ 1275.083830][T22459] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4139'. [ 1276.504183][T22464] xt_CT: No such helper "syz0" [ 1276.794430][T22486] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4143'. [ 1276.899940][ T64] bond0: (slave netdevsim1): Releasing backup interface [ 1277.134377][ T5615] Bluetooth: hci1: command tx timeout [ 1277.319922][T22505] overlayfs: missing 'workdir' [ 1277.534096][T13607] usb 4-1: new low-speed USB device number 98 using dummy_hcd [ 1277.716729][T13607] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1277.782310][T13607] usb 4-1: config 8 has an invalid interface number: 109 but max is 0 [ 1278.050276][T22513] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1278.092408][T13607] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1278.141228][T13607] usb 4-1: config 8 has no interface number 0 [ 1278.373396][T22523] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1278.434182][T13607] usb 4-1: too many endpoints for config 8 interface 109 altsetting 2: 120, using maximum allowed: 30 [ 1278.463454][T13607] usb 4-1: config 8 interface 109 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 120 [ 1279.286536][ T5615] Bluetooth: hci1: command tx timeout [ 1279.455676][T13607] usb 4-1: config 8 interface 109 has no altsetting 0 [ 1279.472009][T13607] usb 4-1: string descriptor 0 read error: -22 [ 1279.478454][T13607] usb 4-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 1279.487570][T13607] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1279.502292][T13607] metro_usb 4-1:8.109: required endpoints missing [ 1280.562605][ T30] audit: type=1400 audit(1784571697.868:1958): avc: denied { append } for pid=22529 comm="syz.8.4155" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1281.106243][T13270] usb 4-1: USB disconnect, device number 98 [ 1281.275801][ T30] audit: type=1400 audit(1784571698.278:1959): avc: denied { mounton } for pid=22529 comm="syz.8.4155" path="/5/file0" dev="tmpfs" ino=47 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1281.300541][ T30] audit: type=1400 audit(1784571698.468:1960): avc: denied { setopt } for pid=22529 comm="syz.8.4155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1281.304809][ T5615] Bluetooth: hci1: command tx timeout [ 1281.329472][T22543] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4156'. [ 1281.682274][T22555] overlayfs: missing 'workdir' [ 1282.092000][ T30] audit: type=1400 audit(1784571699.928:1961): avc: denied { write } for pid=22525 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1283.153810][T13270] usb 4-1: new full-speed USB device number 99 using dummy_hcd [ 1283.235349][ T64] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1283.323357][T22575] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1283.548637][ T13] smbdirect: ib_dev[syz1] removed [ 1283.569915][ T64] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1283.579194][ T30] audit: type=1400 audit(1784571701.408:1962): avc: denied { write } for pid=22573 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1283.620327][ T64] bond0 (unregistering): Released all slaves [ 1283.697623][ T64] bond1 (unregistering): Released all slaves [ 1283.759675][ T5272] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1283.879873][T22415] bridge0: port 1(bridge_slave_0) entered blocking state [ 1283.888238][T22415] bridge0: port 1(bridge_slave_0) entered disabled state [ 1283.895851][T22415] bridge_slave_0: entered allmulticast mode [ 1283.915886][T22415] bridge_slave_0: entered promiscuous mode [ 1283.938767][T22415] bridge0: port 2(bridge_slave_1) entered blocking state [ 1283.946611][T22415] bridge0: port 2(bridge_slave_1) entered disabled state [ 1283.969390][T22415] bridge_slave_1: entered allmulticast mode [ 1283.972108][T22581] binder: BINDER_SET_CONTEXT_MGR already set [ 1283.977062][T22415] bridge_slave_1: entered promiscuous mode [ 1284.014649][T22581] binder: 22580:22581 ioctl 4018620d 200000001000 returned -16 [ 1284.787509][T22415] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1284.816781][T22415] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1285.041053][T22588] netlink: 'syz.3.4166': attribute type 2 has an invalid length. [ 1285.114073][T22415] team0: Port device team_slave_0 added [ 1285.158369][T22415] team0: Port device team_slave_1 added [ 1285.222654][T22598] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4169'. [ 1285.250135][T22600] overlayfs: missing 'lowerdir' [ 1285.624339][T22415] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1285.668209][T22415] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1285.748723][T22415] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1285.801866][T22415] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1285.827764][T22415] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1285.909432][T22415] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1286.065842][ T64] hsr_slave_0: left promiscuous mode [ 1286.097146][ T64] hsr_slave_1: left promiscuous mode [ 1286.106629][ T64] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1286.114152][ T30] audit: type=1400 audit(1784571703.948:1963): avc: denied { write } for pid=22592 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1286.170174][ T64] veth0_vlan: left promiscuous mode [ 1286.252804][ T30] audit: type=1400 audit(1784571704.088:1964): avc: denied { execute } for pid=22628 comm="syz.6.4165" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=78345 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 1286.480352][ T30] audit: type=1400 audit(1784571704.318:1965): avc: denied { write } for pid=22631 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1286.578209][ T64] team0 (unregistering): Port device team_slave_1 removed [ 1286.624248][ T64] team0 (unregistering): Port device team_slave_0 removed [ 1286.715911][ T30] audit: type=1400 audit(1784571704.558:1966): avc: denied { connect } for pid=22614 comm="syz.1.4173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1286.780482][ T30] audit: type=1400 audit(1784571704.558:1967): avc: denied { bind } for pid=22614 comm="syz.1.4173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1287.199245][ T5272] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1287.679731][T22415] hsr_slave_0: entered promiscuous mode [ 1287.704963][T22415] hsr_slave_1: entered promiscuous mode [ 1287.737400][T22415] debugfs: 'hsr0' already exists in 'hsr' [ 1287.749971][T22415] Cannot create hsr debugfs directory [ 1288.719944][T22657] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1289.077117][ T9] usb 9-1: new full-speed USB device number 4 using dummy_hcd [ 1289.318707][T22668] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1289.336788][ T9] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1289.359306][T22672] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4182'. [ 1289.389951][ T9] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1289.402129][ T64] IPVS: stop unused estimator thread 0... [ 1289.421692][T22655] syzkaller0: entered promiscuous mode [ 1289.441405][T22655] syzkaller0: entered allmulticast mode [ 1289.450970][ T9] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1289.509202][ T9] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1289.537506][ T9] usb 9-1: config 0 descriptor?? [ 1289.551119][ T9] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1289.587776][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 1289.634716][ T30] audit: type=1400 audit(1784571707.478:1968): avc: denied { write } for pid=22646 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1289.689475][ T9] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1289.704172][T22678] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4183'. [ 1289.718467][ T9] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1289.948523][ T9] usb 9-1: media controller created [ 1289.976453][ T30] audit: type=1400 audit(1784571707.818:1969): avc: denied { write } for pid=22684 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1290.951947][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1290.978803][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 1290.993860][ T9] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1291.381219][T22687] xt_CT: No such helper "syz0" [ 1291.441572][ T9] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input81 [ 1291.526445][ T9] dvb-usb: schedule remote query interval to 150 msecs. [ 1291.570133][ T9] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1291.705736][ T9] usb 9-1: USB disconnect, device number 4 [ 1291.747280][ T9] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1293.568450][T22718] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4190'. [ 1293.578249][T22718] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4190'. [ 1293.588051][T22718] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4190'. [ 1293.843181][T22718] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4190'. [ 1293.852890][T22718] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4190'. [ 1293.854720][T10859] netdevsim netdevsim8 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1293.862541][T22718] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4190'. [ 1295.150042][ T30] audit: type=1400 audit(1784571712.988:1970): avc: denied { write } for pid=22698 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1295.700171][ T13] netdevsim netdevsim8 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1297.348654][ T13] netdevsim netdevsim8 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1297.461115][ T13] netdevsim netdevsim8 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1297.515508][ T30] audit: type=1400 audit(1784571715.358:1971): avc: denied { write } for pid=22734 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1297.599897][T22415] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1297.676794][T22415] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1297.719818][T22415] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1297.912078][T22415] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1298.904004][T22415] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1299.345942][T22415] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1299.361620][T22415] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1299.390447][T22415] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1299.692481][T22415] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1299.707169][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 1299.759047][T22415] 8021q: adding VLAN 0 to HW filter on device team0 [ 1299.808806][ T64] bridge0: port 1(bridge_slave_0) entered blocking state [ 1299.816670][ T64] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1299.890245][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1299.897399][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1300.057095][T22782] netlink: 40 bytes leftover after parsing attributes in process `syz.8.4204'. [ 1300.260171][ T30] audit: type=1400 audit(1784571718.098:1972): avc: denied { write } for pid=22764 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1300.575327][T13607] usb 7-1: new high-speed USB device number 52 using dummy_hcd [ 1300.670177][ T30] audit: type=1400 audit(1784571718.498:1973): avc: denied { write } for pid=22800 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1300.790619][T13607] usb 7-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1300.827120][T13607] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1300.863827][T13607] usb 7-1: Product: syz [ 1300.893370][T13607] usb 7-1: Manufacturer: syz [ 1300.931047][T13607] usb 7-1: SerialNumber: syz [ 1300.960494][T13607] usb 7-1: config 0 descriptor?? [ 1301.604572][T13607] usb 7-1: Firmware version (0.0) predates our first public release. [ 1301.604704][T22415] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1301.652323][T13607] usb 7-1: Please update to version 0.2 or newer [ 1301.810578][T13607] usb 7-1: USB disconnect, device number 52 [ 1301.877366][T22830] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1302.019146][ T30] audit: type=1400 audit(1784571719.848:1974): avc: denied { write } for pid=22813 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1302.393988][ T30] audit: type=1400 audit(1784571720.228:1975): avc: denied { write } for pid=22835 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1302.856505][T22415] veth0_vlan: entered promiscuous mode [ 1302.910023][T22415] veth1_vlan: entered promiscuous mode [ 1303.057988][T22415] veth0_macvtap: entered promiscuous mode [ 1303.156177][T22415] veth1_macvtap: entered promiscuous mode [ 1303.316286][T22415] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1303.365761][T22870] netlink: 40 bytes leftover after parsing attributes in process `syz.8.4217'. [ 1303.402136][T22415] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1303.477956][ T6279] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1303.512887][ T6279] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1303.566434][ T6279] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1303.626329][ T6279] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1303.643376][ T30] audit: type=1400 audit(1784571721.478:1976): avc: denied { write } for pid=22853 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1303.979911][ T30] audit: type=1400 audit(1784571721.808:1977): avc: denied { write } for pid=22879 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1304.987357][ T6281] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1305.023144][ T6281] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1305.158394][T22900] futex_wake_op: syz.6.4219 tries to shift op by -1; fix this program [ 1305.349391][T22891] [U]  [ 1305.402934][ T6281] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1305.422762][ T6281] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1305.996545][T22910] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4222'. [ 1306.883953][ T188] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 1306.998037][T22929] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4227'. [ 1307.064248][T13615] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 1307.079445][ T188] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1307.113750][ T188] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1307.138438][ T188] usb 8-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1307.174983][ T188] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1307.197604][ T188] usb 8-1: config 0 descriptor?? [ 1307.238794][ T188] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1307.266797][T13615] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1307.281253][ T188] dvb-usb: bulk message failed: -22 (3/0) [ 1307.284040][ T30] audit: type=1400 audit(1784571725.118:1978): avc: denied { write } for pid=22908 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1307.301443][ T188] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1307.326421][T13615] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1307.364244][T13615] usb 7-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 1307.393255][ T188] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1307.433109][T13615] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1307.451965][ T188] usb 8-1: media controller created [ 1307.468139][T13615] usb 7-1: config 0 descriptor?? [ 1307.482363][ T188] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1307.525732][ T188] dvb-usb: bulk message failed: -22 (6/0) [ 1307.538414][ T188] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1307.668220][ T30] audit: type=1400 audit(1784571725.508:1979): avc: denied { write } for pid=22945 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1310.885732][ T188] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.7/usb8/8-1/input/input82 [ 1310.900316][ T188] dvb-usb: schedule remote query interval to 150 msecs. [ 1310.907500][ T188] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1311.067542][T13615] usbhid 7-1:0.0: can't add hid device: -71 [ 1311.076492][T13607] dvb-usb: bulk message failed: -22 (1/0) [ 1311.112985][T13615] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1311.131117][T13607] dvb-usb: error while querying for an remote control event. [ 1311.202016][T13615] usb 7-1: USB disconnect, device number 53 [ 1311.405461][T13607] dvb-usb: bulk message failed: -22 (1/0) [ 1311.441093][T13607] dvb-usb: error while querying for an remote control event. [ 1311.669090][T22964] overlayfs: missing 'lowerdir' [ 1311.985694][T13615] dvb-usb: bulk message failed: -22 (1/0) [ 1312.110688][T13615] dvb-usb: error while querying for an remote control event. [ 1312.242132][T22968] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4234'. [ 1312.270570][ T30] audit: type=1400 audit(1784571730.108:1980): avc: denied { map } for pid=22971 comm="syz.8.4235" path="socket:[79040]" dev="sockfs" ino=79040 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1312.343886][T13615] dvb-usb: bulk message failed: -22 (1/0) [ 1312.347803][ T30] audit: type=1400 audit(1784571730.108:1981): avc: denied { accept } for pid=22971 comm="syz.8.4235" path="socket:[79040]" dev="sockfs" ino=79040 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1312.407521][T13615] dvb-usb: error while querying for an remote control event. [ 1312.633726][T13615] dvb-usb: bulk message failed: -22 (1/0) [ 1312.647081][T13615] dvb-usb: error while querying for an remote control event. [ 1312.713443][ T5705] usb 8-1: USB disconnect, device number 2 [ 1312.864184][ T5705] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1313.015657][ T30] audit: type=1400 audit(1784571730.848:1982): avc: denied { write } for pid=22959 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1313.021493][T22988] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1313.061807][T22993] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4239'. [ 1313.315894][ T30] audit: type=1400 audit(1784571731.158:1983): avc: denied { write } for pid=22997 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1313.522067][ T30] audit: type=1400 audit(1784571731.358:1984): avc: denied { getopt } for pid=23001 comm="syz.3.4232" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1315.133753][ T5705] usb 9-1: new full-speed USB device number 6 using dummy_hcd [ 1316.978618][ T30] audit: type=1400 audit(1784571734.818:1985): avc: denied { write } for pid=23010 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1317.664604][ T30] audit: type=1400 audit(1784571735.508:1986): avc: denied { write } for pid=23041 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1318.188086][T23057] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1318.595049][T23067] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4253'. [ 1320.820188][ T30] audit: type=1400 audit(1784571738.658:1987): avc: denied { write } for pid=23058 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1320.848654][T23083] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1322.583296][ T30] audit: type=1400 audit(1784571740.418:1988): avc: denied { write } for pid=23090 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1322.758666][T23094] netlink: 'syz.6.4259': attribute type 23 has an invalid length. [ 1323.628946][T23099] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1324.723375][T23109] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1325.088388][T23123] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4266'. [ 1328.729402][T23153] binder: 23148:23153 ioctl c0306201 200000000040 returned -22 [ 1329.350580][T23167] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1329.624899][T23173] netlink: 40 bytes leftover after parsing attributes in process `syz.8.4278'. [ 1330.471411][T23162] syz.7.4275 (23162): drop_caches: 2 [ 1330.825146][T13270] usb 7-1: new high-speed USB device number 54 using dummy_hcd [ 1331.575594][T13270] usb 7-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1332.601327][T13270] usb 7-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1332.616800][T13270] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1332.670724][T23165] syz.1.4276 (23165): drop_caches: 2 [ 1332.865802][T13270] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1334.410536][T13270] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -71 [ 1334.582109][T13270] stv0680 7-1:4.0: STV(e): camera ping failed!! [ 1334.800156][T13270] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1439.883546][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1439.890516][ C0] rcu: 1-...!: (0 ticks this GP) idle=aedc/1/0x4000000000000000 softirq=132803/132805 fqs=0 [ 1439.901848][ C0] rcu: (detected by 0, t=10502 jiffies, g=145169, q=377 ncpus=2) [ 1439.909659][ C0] Sending NMI from CPU 0 to CPUs 1: [ 1439.909684][ C1] NMI backtrace for cpu 1 [ 1439.909699][ C1] CPU: 1 UID: 0 PID: 23207 Comm: syz.6.4284 Tainted: G L syzkaller #0 PREEMPT(full) [ 1439.909718][ C1] Tainted: [L]=SOFTLOCKUP [ 1439.909723][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1439.909731][ C1] RIP: 0010:do_raw_spin_lock+0x128/0x260 [ 1439.909755][ C1] Code: 0f 84 06 01 00 00 48 89 df be 04 00 00 00 c7 44 24 28 00 00 00 00 e8 a7 9d 94 00 be 04 00 00 00 48 8d 7c 24 28 e8 98 9d 94 00 <8b> 44 24 28 ba 01 00 00 00 89 44 24 04 f0 0f b1 13 0f 85 93 00 00 [ 1439.909769][ C1] RSP: 0018:ffffc90000a08cf8 EFLAGS: 00000097 [ 1439.909781][ C1] RAX: 0000000000000001 RBX: ffffffff9b9bc440 RCX: ffffffff81e5c428 [ 1439.909791][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000a08d20 [ 1439.909800][ C1] RBP: ffffffff9b9bc448 R08: 0000000000000001 R09: fffff520001411a4 [ 1439.909809][ C1] R10: 0000000000000003 R11: 0000000000000000 R12: 1ffff920001411a0 [ 1439.909818][ C1] R13: ffffffff9b9bc450 R14: ffff888076d69300 R15: 1ffff920001411b8 [ 1439.909828][ C1] FS: 00007ff2235f66c0(0000) GS:ffff888123ee6000(0000) knlGS:0000000000000000 [ 1439.909844][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1439.909854][ C1] CR2: 00007f1942a00000 CR3: 0000000075ad9000 CR4: 00000000003526f0 [ 1439.909864][ C1] DR0: 0000000000000000 DR1: 0000000000010003 DR2: 0000000000000000 [ 1439.909872][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1439.909882][ C1] Call Trace: [ 1439.909888][ C1] [ 1439.909895][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1439.909913][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 1439.909932][ C1] _raw_spin_lock_irqsave+0x42/0x60 [ 1439.909954][ C1] ? debug_object_deactivate+0x135/0x3b0 [ 1439.909972][ C1] debug_object_deactivate+0x135/0x3b0 [ 1439.909989][ C1] ? __pfx_debug_object_deactivate+0x10/0x10 [ 1439.910007][ C1] ? timerqueue_linked_add+0x260/0x430 [ 1439.910026][ C1] __hrtimer_run_queues+0x2e9/0x9c0 [ 1439.910049][ C1] hrtimer_interrupt+0x3e5/0x940 [ 1439.910073][ C1] __sysvec_apic_timer_interrupt+0x109/0x470 [ 1439.910095][ C1] sysvec_apic_timer_interrupt+0x9e/0xc0 [ 1439.910116][ C1] [ 1439.910120][ C1] [ 1439.910126][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1439.910142][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 1439.910162][ C1] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 56 a0 28 f6 48 89 df e8 de ef 28 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 a5 ff 17 f6 65 8b 05 ee c8 a6 08 85 c0 74 16 5b [ 1439.910175][ C1] RSP: 0018:ffffc90003807858 EFLAGS: 00000246 [ 1439.910187][ C1] RAX: 0000000000000002 RBX: ffff888032b1e480 RCX: 0000000000000040 [ 1439.910197][ C1] RDX: 0000000000000000 RSI: ffffffff8e1a4784 RDI: ffffffff8c401380 [ 1439.910206][ C1] RBP: 0000000000000282 R08: 0000000000000001 R09: 0000000000000000 [ 1439.910215][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888032b1e310 [ 1439.910225][ C1] R13: ffff888032b1e4c0 R14: ffff888032b1de68 R15: ffff888057e2e000 [ 1439.910246][ C1] __unix_dgram_recvmsg+0x31a/0xc30 [ 1439.910268][ C1] ? __pfx___unix_dgram_recvmsg+0x10/0x10 [ 1439.910287][ C1] ? iovec_from_user+0xda/0x140 [ 1439.910305][ C1] unix_dgram_recvmsg+0xcd/0x100 [ 1439.910319][ C1] ? __pfx_unix_dgram_recvmsg+0x10/0x10 [ 1439.910333][ C1] ____sys_recvmsg+0x5eb/0x670 [ 1439.910353][ C1] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1439.910374][ C1] ? rcu_is_watching+0x12/0xc0 [ 1439.910392][ C1] ? ___sys_recvmsg+0x177/0x1a0 [ 1439.910410][ C1] ? kfree+0x1e5/0x6c0 [ 1439.910430][ C1] ___sys_recvmsg+0x16a/0x1a0 [ 1439.910449][ C1] ? __pfx____sys_recvmsg+0x10/0x10 [ 1439.910468][ C1] ? irqentry_exit+0x24d/0xa00 [ 1439.910485][ C1] ? __pfx___might_resched+0x10/0x10 [ 1439.910502][ C1] do_recvmmsg+0x2f3/0x740 [ 1439.910522][ C1] ? __pfx_do_recvmmsg+0x10/0x10 [ 1439.910541][ C1] ? do_futex+0x190/0x440 [ 1439.910562][ C1] ? __x64_sys_futex+0x34f/0x4d0 [ 1439.910581][ C1] __x64_sys_recvmmsg+0x22a/0x280 [ 1439.910597][ C1] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1439.910616][ C1] do_syscall_64+0x115/0x870 [ 1439.910629][ C1] ? clear_bhb_loop+0x40/0x90 [ 1439.910644][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1439.910658][ C1] RIP: 0033:0x7ff22539de99 [ 1439.910671][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1439.910683][ C1] RSP: 002b:00007ff2235f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1439.910696][ C1] RAX: ffffffffffffffda RBX: 00007ff225626090 RCX: 00007ff22539de99 [ 1439.910705][ C1] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1439.910714][ C1] RBP: 00007ff225433eaf R08: 0000000000000000 R09: 0000000000000000 [ 1439.910723][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 1439.910731][ C1] R13: 00007ff225626128 R14: 00007ff225626090 R15: 00007fffba523938 [ 1439.910746][ C1] [ 1439.911679][ C0] rcu: rcu_preempt kthread starved for 10502 jiffies! g145169 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 1440.406269][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1440.416225][ C0] rcu: RCU grace-period kthread stack dump: [ 1440.422109][ C0] task:rcu_preempt state:R running task stack:27592 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1440.435594][ C0] Call Trace: [ 1440.438860][ C0] [ 1440.441784][ C0] __schedule+0x125c/0x6730 [ 1440.446304][ C0] ? __pfx___schedule+0x10/0x10 [ 1440.451148][ C0] ? find_held_lock+0x2b/0x80 [ 1440.455830][ C0] ? schedule+0x225/0x2c0 [ 1440.460161][ C0] schedule+0xdd/0x2c0 [ 1440.464236][ C0] schedule_timeout+0x127/0x280 [ 1440.469080][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1440.474619][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1440.479925][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1440.485733][ C0] ? prepare_to_swait_event+0xdf/0x4a0 [ 1440.491365][ C0] rcu_gp_fqs_loop+0x1a9/0x900 [ 1440.496132][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1440.501414][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 1440.506344][ C0] ? __pfx_rcu_gp_cleanup+0x10/0x10 [ 1440.511539][ C0] rcu_gp_kthread+0x179/0x230 [ 1440.516207][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1440.521397][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1440.527203][ C0] ? __kthread_parkme+0x18c/0x230 [ 1440.532239][ C0] ? kthread+0x13a/0x450 [ 1440.536476][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1440.541663][ C0] kthread+0x370/0x450 [ 1440.545736][ C0] ? __pfx_kthread+0x10/0x10 [ 1440.550333][ C0] ret_from_fork+0x72b/0xd50 [ 1440.554923][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1440.560036][ C0] ? __switch_to+0x800/0x10f0 [ 1440.564702][ C0] ? __pfx_kthread+0x10/0x10 [ 1440.569303][ C0] ret_from_fork_asm+0x1a/0x30 [ 1440.574096][ C0] [ 1440.577127][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 1440.583446][ C0] CPU: 0 UID: 0 PID: 23208 Comm: syz.6.4284 Tainted: G L syzkaller #0 PREEMPT(full) [ 1440.594371][ C0] Tainted: [L]=SOFTLOCKUP [ 1440.598678][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 1440.608716][ C0] RIP: 0010:smp_call_function_many_cond+0x589/0x16c0 [ 1440.615383][ C0] Code: b8 00 00 00 00 00 fc ff df 48 8b 54 24 08 49 89 d5 49 89 d4 49 c1 ed 03 41 83 e4 07 49 01 c5 41 83 c4 03 e8 c9 95 0c 00 f3 90 <41> 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 2c 0f 00 00 8b 45 08 31 [ 1440.634977][ C0] RSP: 0018:ffffc900033c7860 EFLAGS: 00000246 [ 1440.641035][ C0] RAX: 0000000000080000 RBX: 0000000000000001 RCX: ffffc900141b6000 [ 1440.648992][ C0] RDX: 0000000000080000 RSI: ffffffff81fd46d7 RDI: ffff888026260000 [ 1440.656948][ C0] RBP: ffff8880b8541240 R08: 0000000000000005 R09: 0000000000000000 [ 1440.664905][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003 [ 1440.672861][ C0] R13: ffffed10170a8249 R14: 0000000000000001 R15: ffff8880b843c880 [ 1440.680820][ C0] FS: 00007ff2235d56c0(0000) GS:ffff888123de6000(0000) knlGS:0000000000000000 [ 1440.689746][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1440.696320][ C0] CR2: 000000110c26d851 CR3: 0000000075ad9000 CR4: 00000000003526f0 [ 1440.704288][ C0] Call Trace: [ 1440.707565][ C0] [ 1440.710488][ C0] ? __pfx___bpf_arch_ibpb+0x10/0x10 [ 1440.715776][ C0] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 1440.722102][ C0] ? __pfx___bpf_arch_ibpb+0x10/0x10 [ 1440.727378][ C0] on_each_cpu_cond_mask+0x40/0x90 [ 1440.732481][ C0] bpf_prog_pack_alloc+0x2d9/0x8c0 [ 1440.737590][ C0] ? __pfx_jit_fill_hole+0x10/0x10 [ 1440.742700][ C0] bpf_jit_binary_pack_alloc+0xab/0x2b0 [ 1440.748243][ C0] ? __pfx_jit_fill_hole+0x10/0x10 [ 1440.753348][ C0] bpf_int_jit_compile+0x531/0x1790 [ 1440.758551][ C0] ? __pfx_bpf_int_jit_compile+0x10/0x10 [ 1440.764191][ C0] ? __pfx___bpf_prog_run32+0x10/0x10 [ 1440.769547][ C0] __bpf_prog_select_runtime+0x8ac/0xc50 [ 1440.775175][ C0] ? __asan_memcpy+0x3c/0x60 [ 1440.779764][ C0] bpf_prepare_filter+0xd3f/0x11e0 [ 1440.784873][ C0] ? __pfx_seccomp_check_filter+0x10/0x10 [ 1440.790590][ C0] ? __pfx_bpf_prepare_filter+0x10/0x10 [ 1440.796128][ C0] ? __asan_memcpy+0x3c/0x60 [ 1440.800715][ C0] ? kmemdup_noprof+0x49/0x60 [ 1440.805394][ C0] bpf_prog_create_from_user+0x1e8/0x2f0 [ 1440.811020][ C0] ? __pfx_seccomp_check_filter+0x10/0x10 [ 1440.816745][ C0] do_seccomp+0x870/0x27d0 [ 1440.821161][ C0] ? __pfx_do_settimeofday64+0x10/0x10 [ 1440.826609][ C0] ? security_capable+0x80/0x260 [ 1440.831536][ C0] ? cma_modify_qp_rts+0x156/0x210 [ 1440.836645][ C0] ? __pfx_do_seccomp+0x10/0x10 [ 1440.841489][ C0] ? do_sys_settimeofday64+0x1e4/0x260 [ 1440.846938][ C0] ? xfd_validate_state+0x129/0x190 [ 1440.852130][ C0] ? arch_syscall_is_vdso_sigreturn+0xb6/0x200 [ 1440.858289][ C0] ? syscall_user_dispatch+0x76/0x130 [ 1440.863665][ C0] do_syscall_64+0x115/0x870 [ 1440.868247][ C0] ? clear_bhb_loop+0x40/0x90 [ 1440.872917][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1440.878797][ C0] RIP: 0033:0x7ff22539de99 [ 1440.883199][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1440.902882][ C0] RSP: 002b:00007ff2235d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000013d [ 1440.911283][ C0] RAX: ffffffffffffffda RBX: 00007ff225626180 RCX: 00007ff22539de99 [ 1440.919241][ C0] RDX: 0000200000000040 RSI: 000000000000001d RDI: 0000000000000001 [ 1440.927196][ C0] RBP: 00007ff225433eaf R08: 0000000000000000 R09: 0000000000000000 [ 1440.935154][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1440.943117][ C0] R13: 00007ff225626218 R14: 00007ff225626180 R15: 00007fffba523938 [ 1440.951089][ C0]