last executing test programs: 8m51.984602551s ago: executing program 2 (id=987): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r2, 0x2fa77e8ce0582f97, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0xc005}, 0x400c814) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000140)=ANY=[@ANYBLOB="0014af"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) r6 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r7 = fsopen(&(0x7f0000000000)='erofs\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r7, 0x2, &(0x7f0000000040)='dax\x00', &(0x7f00000004c0)="b071", 0x2) (async) r8 = syz_pidfd_open(r6, 0x0) (async) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380000004800010000000000000000000a00806b0800000000000000140001800d2a79075a27af5aa534d6815c2e93f1080002"], 0x38}}, 0x20048800) (async) setns(r8, 0x24020000) (async) r10 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_int(r10, 0x0, 0x1e, &(0x7f0000000180)=0x200, 0x4) (async, rerun: 32) mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) (async, rerun: 32) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r11 = socket(0x400000000010, 0x3, 0x0) (async) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000e40)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r13, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xd, 0xd0ea, 0x20000001, 0x3, 0x4}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x50}, 0x0) 8m50.250664842s ago: executing program 2 (id=993): r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) ioctl$EVIOCGBITSND(r0, 0x40044591, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="d80000001e0081054e81f782060000000000000006007c095dd2466518000e800a00142603600e1208000f0000000406a80016c00800094013000000035c0461c1d67f6f94007134cf6efb8007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791433a5ee4ce1b14d6d930dfe1d9d33dfe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad909d5e1cace81ed0bffece0b42a9eca0200e6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a9410000", 0xd8}], 0x1}, 0x40080c4) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000001400)={'pcm3724\x00', [0x100, 0xd, 0x4d0, 0x2, 0x1, 0x100, 0x2001, 0x20000000, 0x8, 0x8, 0x0, 0xf, 0x1, 0x401, 0xfffd, 0x0, 0x0, 0x8, 0xea9, 0x401, 0x7, 0x12, 0x8, 0x9, 0x3, 0x7, 0x7, 0x0, 0x7, 0x7, 0x8]}) 8m50.221901791s ago: executing program 2 (id=994): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r0, 0x0, 0x8004) 8m50.184404849s ago: executing program 2 (id=995): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="000001001800000000ebff0018000000180000000200000000000000beaecfd850a95c5ed497b3007dc09c85d1d2f91100000003000000000372"], 0x0, 0x32, 0x0, 0x1}, 0x28) socket(0x10, 0x803, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_emit_ethernet(0x76, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x9, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000200), 0x2, 0x8}}, 0x20) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) syz_open_procfs(0x0, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r3, 0x40285107) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/snmp\x00') lseek(r5, 0x38, 0x0) setsockopt$MRT6_TABLE(r5, 0x29, 0xcf, 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_RW(0xffffffffffffffff, 0x3ba0, &(0x7f0000001200)={0x48, 0x8, r6, 0x0, 0xffff, 0x1, &(0x7f0000000480)='|', 0x5}) 8m49.249062084s ago: executing program 2 (id=997): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x13, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./sys/kernel/tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000040)='./bus\x00', 0x107) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000380)={0x60, 0x3, &(0x7f0000a88000/0x4000)=nil, &(0x7f0000265000/0x2000)=nil, 0x7ff, &(0x7f0000000480)=[{0x6, 0xf, 0x6}, {0x2, 0x4264, 0x2}, {0x9, 0x1, 0x4}, {0x8f, 0xff}], 0x4, 0x4, 0x29, 0xb, 0x0, 0x19}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) r4 = syz_usb_connect(0x2, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040cc1769190001010203010902450001010080320904000002ffffff0007058102400000070501024000000904000104ffffff00070581024000000705010240"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_ep_read(r4, 0x1, 0x0, 0x0) syz_usb_ep_write(r4, 0x81, 0xf, &(0x7f0000000080)="010000000002001a940d6c00000000") syz_open_dev$tty1(0xc, 0x4, 0x2) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan1\x00'}) connect$can_j1939(r5, 0x0, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f00000000c0)={0x1d, r7, 0x0, {0x0, 0x0, 0x4}}, 0x18) connect$can_j1939(r6, &(0x7f0000000040)={0x1d, r7, 0x0, {0x3, 0xf0, 0x1}, 0xfe}, 0x18) mount(&(0x7f0000000100), &(0x7f0000000000)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x44, &(0x7f0000000100)='trans=rdma,\xd6\x17\x0foQW\xbe\xbf\x16S\x84j\xea1Z\x8e\xe9\xc7\x0ep*\xd9\x94Mk\xb9\xc6\x9e\xcf\xd7\x9eoc\xe2(\x03\xc3\xc90$A\x7fL0R\v!{\x8aY\x17\xd0\xa3\xfe\xe3/\xc4\f\b2t\x1c4\x93/^\x91\xe8\xabK\x9e\x14j\xb3\x92\x13\x80sm\xc7\x96\"\xcb\xdc\xcc\xd8\x18\"\x9eT\x97Kh5i\x8f\xfc\xd8=\x8b\xe9\x1b\xce\xf2\xf5$\xf1sa,\x8f\xb6\x89\xcfZ\xa0\xae>Xs=\xadu\x9aQ\xe2z\xaf\x90\x90\x9b\x92\x9b\xeb\aQb#\xec}\xa79\xd7\xe6<6\xadL\xd8$\xd3\xa9\x1d\xd9W\x8a\xb9F\x982%g!\x8a\"@*\xb8\xc6\xddw\xefY\xefJ\x0e\xc5%S.\n\xde\x95l\xd9\x1cPp\xb3\xfe+rY\xc2') 8m46.142850537s ago: executing program 2 (id=1010): r0 = syz_open_dev$dri(&(0x7f0000000a40), 0x1, 0x181000) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f0000000040)={&(0x7f0000000a80)='a', 0x1}) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f0000000180)={&(0x7f0000000000)="dd", 0x1}) close(r0) socket$unix(0x1, 0x1, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r1, 0x7a9, &(0x7f0000000340)={{@hyper, 0x2}, 0xe148, 0x3, 0x69c9, 0x4, 0xd, 0x385a2d2f, 0x4, 0x100000000}) socket$inet_sctp(0x2, 0x1, 0x84) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x10040, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r1, 0x0, 0x81, 0x0, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x100, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000100)={0x7, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f00000001c0)={"0080bced01eb0100000000000000000700000000000000c900", r5}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x48) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x200000000000004e, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000d0000000000000000000000850000000500000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000000)='syzkaller\x00', 0xb, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4b0c}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0xe, 0x0, &(0x7f00000001c0)="581f9239658ea95ed371ea3dd361", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) ioctl$SW_SYNC_IOC_INC(r2, 0x40045701, &(0x7f0000000280)=0xfffffffc) ioctl$SW_SYNC_IOC_INC(r3, 0x40045701, &(0x7f0000000240)=0xffff) ioctl$SYNC_IOC_FILE_INFO(r4, 0x40103e05, &(0x7f00000003c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x106, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r8, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xffff, 0x647, @empty, 0xa098}, {0xa, 0x4ea5, 0x9, @dev={0xfe, 0x80, '\x00', 0x42}, 0xc}, 0xffffffffffffffff, 0x8001}}, 0x48) writev(r5, &(0x7f0000000500)=[{&(0x7f0000000400)="47bd93a44f9306c31007d4de65424480382bc6ba668b2e9f8912bda4f350fd3289cc1a44de2d10694cd29780ff51e243af6283b104b1bb7f84e69b5800c51bf5f5f5459bfc5259120c85bca12b8b539e1cdbbc7cb089677408f8bdf738b7cfd9ad7d3c6b6c0aca1ffaf248c318503293d2a4edd72491ace3affed7e14dab7afd34084152a4e82c010f9f4fd2c6c3134e40b66f23312600f1001e3cbf3fbfe24cd2f7fbebd25da3ab10b03d7ca18f95d5b8e678432224300ff746714a9a3d0b4f9c3bc6e30b4acd1f78a9ed1c9aa97a65878d542a3c876b40918a25263ce9ebb9f3710acc34e4b8b6598ca23586ff04a1da1b76586f1ea8", 0xf7}], 0x1) 8m30.405013281s ago: executing program 32 (id=1010): r0 = syz_open_dev$dri(&(0x7f0000000a40), 0x1, 0x181000) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f0000000040)={&(0x7f0000000a80)='a', 0x1}) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f0000000180)={&(0x7f0000000000)="dd", 0x1}) close(r0) socket$unix(0x1, 0x1, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r1, 0x7a9, &(0x7f0000000340)={{@hyper, 0x2}, 0xe148, 0x3, 0x69c9, 0x4, 0xd, 0x385a2d2f, 0x4, 0x100000000}) socket$inet_sctp(0x2, 0x1, 0x84) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x10040, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r1, 0x0, 0x81, 0x0, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x100, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000100)={0x7, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f00000001c0)={"0080bced01eb0100000000000000000700000000000000c900", r5}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x48) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x200000000000004e, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000d0000000000000000000000850000000500000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000000)='syzkaller\x00', 0xb, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4b0c}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0xe, 0x0, &(0x7f00000001c0)="581f9239658ea95ed371ea3dd361", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) ioctl$SW_SYNC_IOC_INC(r2, 0x40045701, &(0x7f0000000280)=0xfffffffc) ioctl$SW_SYNC_IOC_INC(r3, 0x40045701, &(0x7f0000000240)=0xffff) ioctl$SYNC_IOC_FILE_INFO(r4, 0x40103e05, &(0x7f00000003c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x106, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r8, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xffff, 0x647, @empty, 0xa098}, {0xa, 0x4ea5, 0x9, @dev={0xfe, 0x80, '\x00', 0x42}, 0xc}, 0xffffffffffffffff, 0x8001}}, 0x48) writev(r5, &(0x7f0000000500)=[{&(0x7f0000000400)="47bd93a44f9306c31007d4de65424480382bc6ba668b2e9f8912bda4f350fd3289cc1a44de2d10694cd29780ff51e243af6283b104b1bb7f84e69b5800c51bf5f5f5459bfc5259120c85bca12b8b539e1cdbbc7cb089677408f8bdf738b7cfd9ad7d3c6b6c0aca1ffaf248c318503293d2a4edd72491ace3affed7e14dab7afd34084152a4e82c010f9f4fd2c6c3134e40b66f23312600f1001e3cbf3fbfe24cd2f7fbebd25da3ab10b03d7ca18f95d5b8e678432224300ff746714a9a3d0b4f9c3bc6e30b4acd1f78a9ed1c9aa97a65878d542a3c876b40918a25263ce9ebb9f3710acc34e4b8b6598ca23586ff04a1da1b76586f1ea8", 0xf7}], 0x1) 12.060351973s ago: executing program 3 (id=2534): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="130229bd7000fbdbdf251700000008000300", @ANYBLOB="0a0006"], 0x34}, 0x1, 0x0, 0x0, 0x4004}, 0x24000014) 11.667729115s ago: executing program 3 (id=2535): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000004c0), 0x4000, 0x0) dup(r0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/vlan/vlan1\x00') bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000000), &(0x7f0000000080)=@tcp6=r5, 0x2}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r4, r2, 0x25, 0x0, @val=@tcx={@void, @value=r4}}, 0x1c) syz_emit_ethernet(0x3a, &(0x7f0000010800)={@remote, @empty, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x5, 0x1, 0x1}}, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x1, 0x8, 0x24, 0x66, 0x0, 0x4, 0x21, 0x0, @loopback, @multicast1}, {{0x4e24, 0x4e22, 0x4, 0x1, 0x6, 0x0, 0x0, 0x7, 0x3, "3abd73", 0x70, ' Y\b'}}}}}}, 0x0) 10.499385807s ago: executing program 3 (id=2538): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r1, &(0x7f0000000280)=ANY=[@ANYBLOB='lock io'], 0xc) close_range(r0, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs\x00', 0x117) lsetxattr(&(0x7f0000000300)='./file0\x00', &(0x7f0000000440)=@known='user.incfs.size\x00', &(0x7f0000000480)=']\xba\x00', 0x3, 0x1) mount(0x0, &(0x7f0000000080)='./my_configfs\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) ppoll(&(0x7f00000004c0)=[{r2, 0x204}], 0x1, &(0x7f0000000500), &(0x7f0000000540)={[0x2]}, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./my_configfs/usb_gadget/g1\x00', 0x1ff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000201, 0x0, &(0x7f0000000540)='./tracing\x00') prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x6}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x44}}, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000340), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a80)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000100)={0x20004, r5}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r6, 0x5402, &(0x7f0000000000)={0x3fd, 0x0, 0x10000, 0xb998, 0xff, "194f2f83c2e798c3584770116cddc8819592b1"}) openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) 10.397229453s ago: executing program 4 (id=2539): mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05080000000000000000070000060900010073797a30000000003c000000090a010400000000000000000700000308000a40000000000900020073797a31000000000900010073797a30000000000800054000000021900000000c0a01030000000000000000070000000900020073797a31000000000900010073797a3000000000640003806000008004000180580007800b000100746172676574000048000280080002400000000230000300b08c674515113085726709225a7547b6f14c1aa7a7202afc081161"], 0x114}}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0xfff, 0x4000000007}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x1, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000540)={@rand_addr=0x64010100, @multicast1}, 0xc) io_setup(0x8, &(0x7f0000000240)) syz_open_procfs(0x0, &(0x7f0000000080)='net/llc/socket\x00') syz_open_dev$sg(&(0x7f0000000200), 0x3, 0x400) modify_ldt$write2(0x11, 0x0, 0x0) modify_ldt$read(0x0, 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = fsopen(&(0x7f0000000280)='hugetlbfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x82) fchdir(r3) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'gre0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001340)=@newtaction={0x3f4, 0x30, 0x300, 0x70bd28, 0x25dfdbff, {}, [{0x354, 0x1, [@m_mpls={0x11c, 0x5, 0x0, 0x0, {{0x9}, {0x90, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x4, 0x3d62, 0x3, 0x6, 0x4}, 0x4}}, @TCA_MPLS_BOS={0x5, 0x8, 0x1}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x23b96b5d, 0x0, 0x2, 0x3, 0x9}, 0x4}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x600c}, @TCA_MPLS_PROTO={0x6, 0x4, 0x201}, @TCA_MPLS_LABEL={0x8, 0x5, 0x2fd87}, @TCA_MPLS_TTL={0x5, 0x7, 0xf1}, @TCA_MPLS_TTL={0x5, 0x7, 0x8}, @TCA_MPLS_BOS={0x5}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x9, 0x8, 0x6, 0x7, 0x3}, 0x4}}]}, {0x61, 0x6, "e94a2f115b6ec53ce7f3447f6a5b161247204f49c9eae4d1cf502873d2cf674ca56f5344dc284dffd595d7a7defaf0b3181d18e67fa966c620fa7e3ffd416d9237edb5cd5be37e23bb0b5936876017dc3e95cdaa22c19747efbbb0c5d8"}, {0xc}, {0xc, 0x8, {0xfdd6e1f1da76e08c}}}}, @m_nat={0x16c, 0x20, 0x0, 0x0, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0x1000, 0x3, 0x7, 0x1}, @local, @multicast2, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x8, 0x3, 0xb18adffae50f4e8b, 0x6, 0x80000001}, @empty, @multicast1, 0xffffff00}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x8, 0x8, 0x5, 0x7}, @local, @remote, 0xff000000}}]}, {0xcb, 0x6, "b9d91ac80dbaa665c26a6c617fe8fb1a84c4416d829cf1792331df797a6b2d420f6ea8af7636bfc7b2514707ec77bfb860e140d774612e2439e77a6707087b2777a7ce4d3671be8539169271ac0c047d893722a38b8e454682cc888942223b10c31495a2b9096a19a8e7a9059094c1fd7b6ca6cfe478cdcdb29fabc506777326683e5f0ec5502823828e3f7eb53b3b148ffbcb3d9d97cc8c7f51cc508d9291deecd7ac9140a2c68122c7985f116bfd522302ee719298a82069acad5bb251890a82577ba47fa19c"}, {0xc}, {0xc, 0x8, {0x3, 0x1}}}}, @m_gact={0xc8, 0x18, 0x0, 0x0, {{0x9}, {0x4}, {0x9a, 0x6, "5e428e6344e335ecb2ab999d0fce7b39d67c6ac7d49539eaa6f03429b3db56a0734d3b4764f0d7ae0c798d5c6af0eb3c6a4fc7ce996b1dd70d5fb0a6704fc18846154266a3cdf7e98370a20f19dcfe8abc24c22749fe3359c1211d5e21e2fa28ea2bceaabef117ba4a79e625876518dcfa5f91239809cad95072e8633311eb2a1efa66f1ba12f7f2a9418096fc1f93d2aea1e712d472"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}]}, {0x8c, 0x1, [@m_ife={0x88, 0x2, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @link_local}, @TCA_IFE_METALST={0x24, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0xb}, @IFE_META_PRIO={0x8, 0x3, @val=0x7}, @IFE_META_PRIO={0x8, 0x3, @val=0x7}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x6}]}, @TCA_IFE_PARMS={0x1c, 0x1, {{0xfffffff8, 0x5, 0x8, 0x101, 0x4}, 0x1}}, @TCA_IFE_METALST={0x4}, @TCA_IFE_DMAC={0xa}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x3f4}, 0x1, 0x0, 0x0, 0x20041890}, 0x0) 10.100235699s ago: executing program 0 (id=2542): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="000001001800000000ebff0018000000180000000200000000000000beaecfd850a95c5ed497b3007dc09c85d1d2f911000000"], 0x0, 0x32, 0x0, 0x1}, 0x28) socket(0x10, 0x803, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_emit_ethernet(0x76, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x9, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000200), 0x2, 0x8}}, 0x20) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) syz_open_procfs(0x0, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r3, 0x40285107) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/snmp\x00') lseek(r6, 0x38, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r5, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r5, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r4, 0x3ba0, &(0x7f0000001200)={0x48, 0x8, r7, 0x0, 0xffff, 0x1, &(0x7f0000000480)='|', 0x5}) 8.610470251s ago: executing program 3 (id=2544): syz_clone(0x4100000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) socket$pppoe(0x18, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r1, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x8, 0x3, 0x0, @random="58ec07e4203a"}, 0x10) sendmmsg(r1, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) (fail_nth: 3) 8.549725602s ago: executing program 4 (id=2545): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="130229bd7000fbdbdf251700000008000300", @ANYBLOB="0a0006"], 0x34}, 0x1, 0x0, 0x0, 0x4004}, 0x24000014) 8.452410001s ago: executing program 0 (id=2546): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000002600), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044085}, 0x24008840) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan1\x00'}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000000500)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) close(r1) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r5 = accept(r3, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x80}, 0x0) recvfrom(r4, &(0x7f0000000280)=""/90, 0xfffffffffffffe4a, 0x500, 0x0, 0x0) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) r7 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f0000000200)={0x2e, 0xa1328f59b7fd100f, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x2, 0x65d, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x60}}}, &(0x7f0000000480)=0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) r13 = dup(r12) syz_ublk_setup_queues(r13, r11, &(0x7f0000000180)={0x0, 0x188d, 0x500, 0x1, 0x257, 0x0, r13}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x36c, 0x80000, 0x0, 0x10000004, 0x0, r13}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffdfffc, 0x1000, 0x0, 0x45}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x1000, 0x2, 0x82}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x0, 0xffffffff}}], 0x1, &(0x7f0000000340)={0x2e, 0x0, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x5, 0x0, 0x0}}, 0x0) 8.390320788s ago: executing program 4 (id=2547): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) cachestat(r1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000100)) r5 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_REWIND(r5, 0x40084146, &(0x7f0000000140)=0xfff) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB="364000001a00913a09b51bcb3cc5a05f0a"], 0xfe33) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)}, {&(0x7f0000000200)="68cabf2dfb58fc0a01008888ffff0200258f", 0x12}], 0x2}, 0x0) socket$kcm(0xa, 0x5, 0x0) r6 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x8916, &(0x7f0000000000)={r6}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001200)=ANY=[@ANYBLOB="61128c00000000006113300000000000bf300000000000002500070007ffffffbd0201000000000095002000000000006916320000000000bf6700000000000007070000b964b01a4607feff00200000540700000ee60090bf050000000000000c5700000000000065070000d23700002c030000000000001f75000000000000bf54000000000000070000000400f9ffad430100000000007c000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c4ed68ecf264e0f84f9f17d3c30e3c7bdd2d17f2f175455000078af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd390700000500000000f18c30907d7bee45a0100000fe9de56c9d05000000c6c60bef0d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cac3f055af65727546e7c955ccefa1f6ab689ffffff7f63ede202fa4e0a2127b8b83c71a51445dc8dfd13ff15f852a39e5b2ab7bcb8f512036a5ba6d04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6901fcecc8158f0200000000c8fb735fd552bdc268694aeb0763f65e439ec1120843e326c819b6cf5c8ac86f8a297dff0445a13d0045fb3cda30a673a6037ed8c85f21ec2c081bdce431e56723888fb126a19bc1172b84b3ebe174aba210d739a018f9bbec63222d20cecac4d03723f1c921b5bbf7949632cacfdd32b3a6aa57f1ad2e99e0e67a993716dbf580469f0f53acbb400001e3abd5dedd3f7d2cf5834f2af97787f696649a46e17e090000000000000045eac1720e83b7838e3eede14308d582685e1becd6f35154bcb400000000000000000000008129277dc467148670ad3e2b26539cebca8f4ddc211bc3ccf0bd9d42ca019dd5d022cf74686e9fbe2562979eaed840a7afaab43176e65ec1118d46d1e827f3472f4445d353887a5ad103649afa1769080584f800031e03a651bb04000000ab04871bc47287cd31cc43ea0ffb567b4040c1458d0320ce7d0000413a0000000000000000005f37983f84e98a523d80bd56a57fa82b82f639601ae899a559944cb9a62a29ab028acfc1cb26a0f6a5480a55d624a0c544ba0dc828c22fe30000aa391598000000437d57fcf8295f63a70837f5cd4e5e77964522dc7ca3aa3476b7f2d851d27fd4de6eabb43e0799dc8d9fb7dc6c523ffbd74a6a40e4acb1ac872ade9d1f2ab779b8dbe843aeeda0426c767c00327b8c95b2bb6ddb55117669d9598c0f3598073f3a921c76beceff7e4fbfea5011db9020823b83abe54346c7af0a99fa077ffe7000feb9e44023a1749eb1d0d572b77d6e0d0fcd74031c8ef2629f5ecff4626746d6abe98a255e92c3c4f79bfcd0d91741380000cfeb73dec68ed56b5d3dfdf0cb8b71ad79000000000000000000000000000000dd434a25e95d0ec29d3adaccf89d0888031ecdfdb4dfbe444673be099ece7e4009c76c7108ef0a7e59fd6d906fbc3c9b412e0478cfee4485f423c63f49db43833c92eeeb647cebd4d7a93a17bcbb6bae5ff876375d4fe39cc2d292691672cc18ca372104ceb83a35ecedd97fc191d8f64d2b1d60c6d12911aada66c26aa4802c3514c3d92ec905000000b13f14c3f2ed6c64ec90000022d600000000000000000000028026b80c3899543223a6079ee96198b9a326db3be3a48af415ca28ca51c502550044ed8e29af8d763ef9b1f31befcad2ce5394601c7cdc233ba3d4ce26ed703dcb9fb3ad650f77e339768924dfdbeead13b88371154d743544a6091ec93e0d3fd5b4dc42911c17d51f964727bfd5cc5ba15370f6e1141d2271eded0b15e4316a1e4623272beb249a0928c417720be14c898f397411c88a7bcf3df46ab3efe7cd5e160c2afd3cc945f75011a102d952c7ad17a58d9be6910023a26faea764fae160cc2260bd028162917807ce89e11b5f261052ee0dde18efa1d802af2b7beecaaa61e7a726571df5cf6f8af41933cea0d0343261bccf64ca1c81045153eafbefdb91fbdff9ee3307d4a1837963b2dc2a3698d90e7915b098f19392e792adaea86052f4e948184001b6494e906925a092483adc7e9c8f7a29d226763c100aecae7f00619c36bceb9fb6dd7e55487d8485e498fdfc377fd3d266d21d46ab2f6b2ce22cd0aebba9b0ffbfe8ec3143c3734967c90b16ebbeeae1ce2baaae05aed6bf0f40c8a323f9235dc99698bd0b800067a901a79daada03cc77e74feb98b1586946b452764ff917a8ecc10e529c5bea49cad70e22df522c2803b6ef65df70223c6e22c3433e322d8dbd6e9b040065a9d6b3d5ae276cffe935d559bea88e1aa36b4e6c19e78457904297e77370e013b705a96548d47c609a93c45f4d1382b39c05dcc07d5b49ad75ddb3ce5b5b9416e03995da046c7aa5e6fc1a6f5d663380967ccef9de49a90ced031335e3219ebd9d06c257a50497ec523f5ff7361261ccfe239d603364a42e2e81fc068fcbb9792b673827fe7018a988fbce55bb74cdb327ce27e134548032a307871cea4c89d4b77b8743fb3cb72cc280b9f62e4f92f46a19600b802cba88b7d0a938d9e0e6cfe5d66b8748d004179e5b6025c0e1050faec7ecd9de190a975db2f8c06a551236278c4766d7e22e3b85168c9851de6266c791252f919b4f8b25055e786734e5142e4666c67aef5b7b2f88c6640995434aa8636993089c73f196c54ae829ad4307132655b075ae534fa7f1ea9a17e62357b0bd2bd1d62d34bfc136464025013665b1cf26a863a5cb3e8acc806611792add8254e705fefd2a44d5b15e3b36f6b75c97c9c04c511d8cf9e24c61c8284a913a381cb1a56c4f3f265a09628878040000000000000017b68afd95d4abd79286692439ee7acca2adc3d83d72b1b778e30c2bf2efbbcd054cf51f5705eb0faa8a0d9f18135cb1d8d567c3436fa697b72c5035d98b9e4f7f3379c0b3339debc78352b2e65299223d7ef2bd540e78167a3ac92a4c4f826f6d0e5c4ebf4f7a70c03e2f5ddbebf168586331eb5995d2288a167b7c6b20b32116b0c528dab6d0c4fe2ee402348104bc5d4012babedee898c6d3e1017be2e9bc759d3ab4d615f5000000000000000000000000000000000000000000007fff0000000000e693e314adf7dc9f517d04f1e6ca367d30d31d3647c6059db6e1e9529eb1623ef99e2d9ac2ab4872f8e784b07a31110bef6d000000a6f9e89e6d50ee06ce716f94da60f1f22db669560d296287c13c92070000ee7553eb2df17a39542fa88d09f000e88a90cf4406b9000000000000000000000000f441d6a6f516c235c6f5863e7f454ee0e16b9aa2593eb31fa3836703e7765aaeb77a8770e518efaa6d3dd85e03b3b133eb749057cea9af75a0e6f633532f2891b8e263cb6eecea691842827bc7c887081c8d320642389f5f0c42dba0ff75a257310f2d92cb1d1e16468949f5675262ee6609cf26ae4a8f5eac0ebf318e735930b01d8f586e34537bcff7d6196f494cdcf3a712078d745db0f5687a78ee6d000b3d171a0f08299b52d207f32e9da311ca090000003a42732808515eec574f892622c5be497fc3d9ca122d7c18b9e54637812c8debc61f0e42d838e44a819b74bce1a56108bb0f72c4a02475920532309c55b2c9ae9f281391ec5cc72a5e94cca1cbf1a706ec201eedfa5fbdb537a0c52bd45a9f966c25616cec30c3ea3246cb8e6aac7cf273638e6656a3e4ccadc348f0172028c99cc5f6d5c6d09ed65aa54549e73c28b7c8ad06ad3c5e3c27eec0eff1a6c84f1189919eefcee8072d1f88cb781e4cdb04af00ac92f1080211c4bee74381a0e31021918f27863fdbafb50f70857d52a1f7df51935a80b1980a4778d35f183ea517f55a98c5a471f3521956f8da6a4ccf2071095305701ab3f3ae43f06e91bc7d85e3800b46926944fba9805a985e63e53a62232fcd3f01dbe1728f300e247a7ebe344f9749818ff3961b2a42664ccd680a90bbb6ab400e286acc8f9febef64594777f848ed1cf980a3da2f0f7745760a05887d0c28060d613dd6539d392fc21fee0b5131609664b821d7a994e6c5965a4fa1ec1790c54e54586907dcc5a071ba22251e2de8bac16e79da9c2444d52facb7ab49420900000000000000f888a94365b99b72796fde1b922fc9ae09b526efca65faf1546c17cbb1d2d2fd12cb1a49cad501a3ca218c595b667b634606c57987ebfb0783a4948e4561d5cda158fe74453ff4a837be14d6a483842c57d6005b544b4f80003386edfd3d4a88a667bd41eefe0d808abed08a29e6bc370a80cc0366fb4080bfbaaa946fd47ab662c79c846e403910bbc3a48bb276cbb08a8eab145c06221ef16a238e3d50ad18aea9a2cec97d3c2d0569caabe2bffe02506bc9cb7294c5d020536dd5e7a6351642112df3b55d0215aaec7e45598995e79699e47567e353e68b03f82be860b188554b734e1192f9c1a867b815ef52cdc3307c0cc9be0000fdde69c350e59f11f1d26a4d04d8c8b2c4a4d23ee931d14bc7807db773a614b670acf46f83f7c65a0f8d43c5f647e1f0d27c46d4b686e867e9b0be76a7978a8f962bb5a070df97f2bf7612115cfe5ebdc7ad0bc5a5f3ace25347d0e5c347279d55aa67a967380000000000000000000000000000000000000000000000ed0942d980c754c6c69ef65c375ad018824f78b260d5f51bc3feba504408a8c8141d84f3f417603b5081680faa8cf38dbe4ae19e936511966965ce268b6345a0001c0f26a32e0a999fc869292e939dcf89b9bfd794f9c12d41959a00688cca43015a9eec58f647796adea520cd2abeb0b55c22949d10e5a05fee4543fdc1e02554a55b5fef2427a6e5708edc38fac53c2f961945a3f83cdf01979939b49bc6b1aef8c733401bbe473de8d64efbe0d123739f387d1c0d9e74f2175c174ada1678c7db79492e8dd0f34e2ccf419cf7f14ffa408b50a52685b36aed14aa22ad928191d5a2697646edc52a1c0c5d720ae690add2b34aed161f51cc1cb424f76098e1e1921e5a405f9d298a8461f2da30e47b7c6ed7c95c84c745f58723e4cddffae3b53b5b947f9435e589f9ae55b30ecd3827b2de5df31976870823da8058c2538c04e397f3d0ef90c11c74da984fa558697ecb57224ce8fa6f79aadbd7dbf3678e74d790bc2ee72769a3ada1dd504f8e4133ce1effd446bc9a2f139e65cc4bd83912af3122352506c7c2191b3705113a5ce1c99193886d6008d3565b00000000000000000000000000000000001c260fc175785ca04e31790f542c0f17b6599e93134792eae9878638b299e1d2b38d367be0d5c99d179c6bde265caebbae48bae74338f9d4f12f"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe50}, 0x48) 7.364068649s ago: executing program 4 (id=2549): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) setgroups(0x0, &(0x7f0000000140)) open(0x0, 0x0, 0x0) setgroups(0x5, &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0]) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYRES64=r2, @ANYRES8=r1], 0x0, 0x4e}, 0x28) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) ioctl$PTP_SYS_OFFSET(r3, 0x43403d05, &(0x7f0000000900)={0x19}) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_open_dev$video4linux(&(0x7f0000000040), 0x2, 0x200) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc040564a, &(0x7f0000000000)={0x0, 0x1, 0x100c, 0xffffffffffffffff, 0x0, 0x0}) sendmsg(r5, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000c00)="1400000025000103010000000000000002010000", 0x14}], 0x1}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x18, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000800000018100000", @ANYRES32=r4, @ANYBLOB="0000000000000000c31028030100525f0a8c000000000000"], &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x6}, 0x94) mkdir(&(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="70010000", @ANYRES16=0x0, @ANYBLOB="04012ebd7000fcdbdf25080000000c0006800800060008000000e00001800e0001006574683a776c616e300000002c00028008000300ff7f00000800010016000000080001000e000000080003000300000008000200060000002c0004001400010002004e20e000000200000000000000001400020002004e20ac1414aa000000000000000008000300eb0000000d0001007564703a73797a30000000000d0001007564703a73797a310000000044000400200001000a004e2000000002fc010000000000000000000000000000008000002000c33f4259ce0291801099a301dd162702000a004e2000000004fc00000000000000000000000000000137d500000800030000100000640006800400020008000600ff01000008000600000000004900040067636d2861657329000000000000000000000000000000000000000000000000210000007a6c1f9a61f198060a17f0ea0d3cc4be97d8bef1cb850b66f9041ec72ee6d1f325"], 0x170}, 0x1, 0x0, 0x0, 0x20004094}, 0x4000000) r7 = socket$netlink(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="3400000013000100000000000000000007000000", @ANYRES32=r9, @ANYBLOB="100a06000908010014001a8010000580"], 0x34}, 0x1, 0x0, 0x0, 0x200080d0}, 0x14) 7.234623373s ago: executing program 3 (id=2550): pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_xfrm(0x10, 0x3, 0x6) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r2 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x3818c1, 0x0) syz_open_procfs(0x0, &(0x7f0000000280)='mountstats\x00') ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) ppoll(&(0x7f0000000380)=[{r0, 0x4a0}, {r1, 0x4000}, {r2, 0x480}, {r0, 0x10}, {r1, 0x505}], 0x3, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, 0x0) add_key$keyring(&(0x7f0000000200), 0x0, 0x0, 0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) getpid() r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000001c0)={0x28, 0x4, r6, 0x0, &(0x7f00007d4000/0x4000)=nil, 0x4000, 0x4000000002}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f00000002c0)={0x48, 0x2, r6, 0x0, 0x0, 0x0, 0x0, 0x1}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000240)="fb", 0x1}], 0x1, 0x1) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_usb_connect(0x0, 0x3a, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x49, 0xcd, 0xb4, 0x40, 0x424, 0xcf19, 0x7190, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x28, 0x1, 0xff, 0x2b, 0x20, 0x6, "", [{{0x9, 0x4, 0x61, 0x9, 0x0, 0x2, 0x2, 0xff, 0x7, [@uac_control={{0xa, 0x24, 0x1, 0x2, 0x16}, [@input_terminal={0xc, 0x24, 0x2, 0x1, 0x403, 0x1, 0xf8, 0x0, 0x7, 0xb}]}]}}]}}]}}, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) bind$bt_hci(r7, 0x0, 0x0) 7.233717048s ago: executing program 0 (id=2551): socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs\x00', 0x117) mount(0x0, &(0x7f0000000080)='./my_configfs\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./my_configfs/usb_gadget/g1\x00', 0x1ff) lsm_get_self_attr(0x64, 0xffffffffffffffff, &(0x7f0000000040)=0x19, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000002380)=ANY=[@ANYBLOB="180200000020000000000000000000008500000005000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x25}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x2f, 0x2000, 0x0, &(0x7f0000000140)="e0b9547ed387dbe9abc89b6f5b2e", 0x0, 0xa5bc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a00000154000480500001800b00010074617267657400004000028008000240000000012c0003007339f2f10455afb9fdd672ba2600fb78c7699c74e891a0c70000000000000000000000000000000008000100544545000900020073797a32000000000900010073797a3100000000140000001100"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) preadv(r1, &(0x7f0000000200)=[{&(0x7f0000000340)=""/127, 0x7f}], 0x1, 0x6, 0x0) linkat(r1, &(0x7f0000000400)='./my_configfs\x00', r1, &(0x7f0000000380)='./my_configfs/usb_gadget/g1\x00', 0x600) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/functions/obex.usb1\x00', 0x1ff) symlinkat(&(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/obex.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/configs/c.1/obex.usb0\x00') symlinkat(&(0x7f0000000280)='./my_configfs/usb_gadget/g1/functions/obex.usb1\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./my_configfs/usb_gadget/g1/configs/c.1/obex.usb1\x00') (fail_nth: 3) write(0xffffffffffffffff, &(0x7f0000000340)='dummy_udc.0', 0xb) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r3, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x8, 0x400, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x7ff, 0x1, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0xfffffffe, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xfffffffc, 0x0, 0x0, 0x8000, 0x7f, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x0, 0x3, 0x5, 0x0, 0x0, 0xfffffffd, 0x800, 0x32, 0x0, 0x0, 0x80000, 0x85, 0xfffffffd, 0x5, 0x8, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x10000, 0x925, 0x0, 0x0, 0x3, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0xfffffffe, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0xd6c, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x10, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0xc, 0x3, 0x0, 0x4b2b, 0x8000, 0x0, 0x105, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r3, 0x5501) socket$inet_tcp(0x2, 0x1, 0x0) socket$kcm(0x10, 0x2, 0x0) 6.242306161s ago: executing program 0 (id=2552): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@mpls_delroute={0x24, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_TTL_PROPAGATE={0x5, 0x1e}]}, 0x24}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="10000000040000000400000008"], 0x50) socket$netlink(0x10, 0x3, 0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r2 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000000000010711e0920000000000001090224000100000000090400090103000100092105000001220500090581030002"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b\x00\x00'], 0x0, 0x0, 0x0, 0x0}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@call={0x85, 0x0, 0x0, 0x2a}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r3, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x58, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}, @IPSET_ATTR_IFACE={0x14}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) 6.16766165s ago: executing program 4 (id=2553): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000600000004000000000000010400000020040000000000000000000d040000000000000000000010040000000400000000000008030000000000000061"], 0x0, 0x52}, 0x28) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x47) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32=r2], 0x78}, 0x1, 0x0, 0x0, 0x24008040}, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="080008000700020000000900000067b60f9c010511fffe8000000000000000000000000000aaff0200000000000000000000000000013b0e0000000000000770962ef92bb176e338aca5dafdde88dfcefd64a41dda95836e14771bfde34853376b2ec18543d137a0baed6fa38100bfb27fed1e86e0b3d537150e3ab371ee1d82dd5479451e47a2be4ade0100115b82a412c076966a7051b45c4b5d9757e9941e25447ff7036796adaf1da5ec78ff7849050205d5000004000508660000000008020400000000fc000000000000000000000000000000fe8000000000000000000000000000bbfc00000000000000000000000000000000000000000000000000ffff7f0000016c0004b96600000002000009640000004e204e230025907832cf5492b5bc42e95a76"], 0x13b) r5 = openat$dir(0xffffffffffffff9c, 0x0, 0x8880, 0x85) lseek(r5, 0xaeb, 0x1) getdents64(r5, 0x0, 0x4f) socket$packet(0x11, 0x3, 0x300) io_uring_enter(0xffffffffffffffff, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) r6 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) syz_usb_control_io$cdc_ncm(r6, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r6, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 4.342647135s ago: executing program 1 (id=2560): socket$inet6(0xa, 0x3, 0x5) socket$inet6_tcp(0xa, 0x1, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socket$nl_route(0x10, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}]}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x58}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) fcntl$setstatus(r4, 0x4, 0x40800) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r5, 0x2000009) sendfile(r4, r5, 0x0, 0x7ffff004) r6 = openat$null(0xffffff9c, &(0x7f00000000c0), 0x200000, 0x0) ioctl$sock_bt_hci(r6, 0x400448dc, &(0x7f0000000100)="d571dde2fad0400a99dd2a916b630f887b730ef3690bea12efb77f96dd087455299b2de1a4e5a617ce3df076efadb901416612d4ffca5ff06db5f6a244c8afeba75ede1d7b1895aa846fd061f5e54fbe433c9930a72158e3c6f65dba70a6ec7998d41a81b5ea0f72fc1098e5e1745ccc4a8466900a94dbaf9f86bcb3105154542d271007081ec50c19c7ea547514fff9aa61ef66cf209f8f2d196f3308b622edf1592fa34d47b276108c75234d70307f1b5db1aa547a79cde2dcb5236f062b35b718e6236dff3e7b45a7dd457aee7fbb961036a4cf3e1a00a3cc156317a56203ac28608e7550a8c55b6ae6bbc0901547e9fe79350f69459845c58d04007c6fdf4ad1c1b887616ae317f575856cbb5f057eb726eb5b287c3eecc967499e2b37f74633b5a9174085be2caa028c2d7ee742d5867dbf6f39a7065a548dc1cdf248d3e9572c5e5932cac38e9cf6b1602427cc2600be9747c299f23b214963c6831b8706f5f8edd428031379b1b89c4c1ec4dc6e9826c626afde9935bc3595302305fbaf83dbab847f4a187649bd6d4c03b84ce0a742c921feeeefdeeb00a1c5cd237fd2292b7c67f8d77887541f4d193ff1aa54b4fe2617605ca694ab0d34b4a908a2830a8ec7a38db5eb43a9700388fca0a51948f0808ca3bf6e4b1f5cf55b406e265c0e221f7d589f5696a9b4de089ed6970d06b21dd2609963369505f6df1025031d99eeed1673807d0f57223471ae3a94a1d2c4ec7c27dd58b58c5c835cc3621e7b68c602b9c94489ab8b473cc44c9f018d46cffdc605b6dc1c44762b4b170a3af4410e2c56623c8c73abd1875d4ae8ace4c1a9ea5f65c39fa2efb7bb2e0f1afd3e03e2b86888cd33d066b2b5c7d60c96fb15e962f8be3af2caf94896a5c174ee789c7acaaccdc7add626322543ea254662c258db76e46fb7ce6cec0136fcef60abbfc4bde2b7a8725faf4df586148b67bc6b5ad29dc0dc9d6ee50e90f406b98a7e6e35b41026d358b72d90eea911765326ea9a985c7e3d5572005c8055dd50cecc2950f89e52b0d8353673d20a5b3a19884b74f13f1ce8cc6f05dcbd942b8cc7f13daa006484d6a9f0acb852670f904060cf4343688f406359c57b913b9de3f2ac88f632ecbaa323ff93d1d772db7ff92eb10d9641d4cae755c1ee5fe1274f4b29eed5454d6ecb114602ff37bc605ef3396e761e959bfa825201afd104cd2a327ea57a304cc949da94177524768d1499b464ee3ee1e5c7b9fd37b050e1ffcd52cab0be01a27e7c679ccd8676158d034a75f65ce90454d3210164e8ff188bbe0e9d8f20b10d41a7fd54c51e4d265dc915616a570c807baae494a8131479a29b925cb4582efaa0d3564f27825bafb9e32722a4355c63efbf0914ecc2c112ae0d25d702961f18a697b39f2f6da9840e2a31750ef372f78c418ec436d738a02dda0c43b3c8dcea179470218f53f6fc86d5e17cef63c160c02b6b55fde16dfc70b1134bee97e7d01e7b840ccac9038edb42fc3b9c0882d6ab29ee425c892d17e001db0750d18aefe02a60900a9ff7feb8bf5d52dc0ba8a5e6d202a74cf9df47e1637c8c275b8c9116180ad97436217f3e61cc054292f7582a22fe67f09bd1e7d9ab8f027b67a807256e72444474759d80005b9999ae8506595a98ab13f9d18d1fc7f88b8422b24b41e147cdd3eb464a0038a3d047797f17d1e049ed0b804c5c415a07184423bf944dae7a4b465edbea853896a7451651ed35939e4f98be271d23a85bc49c6fe22a2a9d962f471106ac37f56fe72fdd0c03885e65208b31a3a5736fd5f03accd529a0ffa03e112c5e4d2c9496779d85669cc6b50356301f48fcb610544fb2a473e83419e298e6ec8b7f73c3d8fde587f3660e74ed84694a1ee0deaa0f268b95a7d586845f25b62f938852f989277b4211a7d7ad9a666cc734228a7fb09afddc6f2c7c90c3af609f60eed722c34cd06ac41cd27972d0540671bf63300d54fc757eb1fb4d229139c70dac66d2da400f11a87cd20cc43333a4559cedcc2a4a6fdefbf4d26ba09bab4ab532eb12016601a2b84e46c333497ca4ef137433b6494a77c64960ac74616230f6da70da0f6c078204a55b06abb2fb973fdab8d802476646b9cf6a9c306bd60ed3b4206d1d5120857437fe4c9ffa184729926a4692ff08e1eb4eaa86b22a3ed857016f89d03f47474c50d38493495125a500e8bff14bd0cb80076f1c052bd88bce01dfde32f9850e0763a83d2ecf5ba7ff3a8c989bdb93049f9afdc1131df212ce2d0a101f1d19fd8c3416154995fdefcfc1625e3c3cef572c283c48ce2ab963c4baf86cfca0fdbe3d3058e7e6c090ce9bd09feb6db2e3b83be29856863d9958944d01606caa5d7f4b2adbea907f1a66dfeead42d92b11990089a7329ccfd32aa20e5b4b1e06551784e2c7d412ed958a919795689f28c28e34cf67519da87f9e242e744039f9db41d0f06b5f1365fc3417d085ffdc8ad3af8a2914ce4bf0267034c0da14719cf5ec4d132a03474364a79bf27c18f9a274d3d1b518461972e65e912aca0e16d97887f9bc2ef473beaa8a35985b76a1146307db9aff4dcfdaa72c102b397f67376121b9b59a0d6b9dea00a9f2a93aa2cf69683932003e6d75e06254372ffc80cab8a00828f863e19f4e96b7429ce0015ae9ef262c34b7535ac25c3cfb56f9d5dac256f4f3de409efe49015f7aca4cbcae4471a771493a80ccad1c4d0e9478e85339d71e495686dbef88b83973f71086f73f0554d2ae3a0f46aeaeee31e73769556e2240d83642980996074c2d8e0ce51be3c54400738a83738cf67869b959b4709386ab0748da21f2aef05d875f8295356e5af3cc3d8df14d2d0ae07ea3603fec9c7c2c5c36d8027e957c0c218c045ee17af1e01f7ecb9ef38d1ada87057d7ffa442d2118794c8f9616d571065d805760513fd05a69a356d6eea164a5736ae3a99667ac37a0abffca71e707c8033cc7cd7e1bf12352ca7941acbdb5c960c78cc255dda0377f9f3985bd0af4be7dc1fb89aca4eeb2aeab8e1f78a69726cb6c2048a13640fab1c801a480685c25ba4744a5a5425d640fe46b768a18033e58fd4641bd4cd54faf7709dc74ac56daa72f537c58d9721c0b6aa4cd0257e54483162ea0f5cc396be7f7d00d367d6f5190247459ad9a4b7d21056c526c5ac144998aace3da20f59ce8594b144228c71854270b9829ce69445ecf17ba4a433d5fe8cb2cf2b4ba85cfb6cd0c0cb30df88ec07d8b50859d06d38ed3a7d5a8388a686caa0bb3f8fed4a7f391b8347d1fb16fefa5a6418979fc896916f40e353b04e647977933a2222f3cb97d08530a0672eaa450f5b7592091c006ec9c263ba6a7e1dc75d8bdb9cb2e1b269a0ddee947b031e2596901952693b97d99121fe44f34bfcd939b7411a5611da7216a39aaad3ef29d6d8183507dd03f4781a3a9d1909396a5217ea6c75ff7f7727b815576330aad79fbccafaaf67ed68d1cedea3ec8e385d728fa0c1d60016a80ec09f263b99982258471188f1bf96e223a5292697278c54a65ff36afa18d29bdbf03b654ccd58c915638f15581913ed66825f83090365b903d7b45704818c0ca39bf9f7384b635706fc36bf7088c3409c614babaa23fe0c62ad2f973c6763c1527dc3edcf565187452c6ee783cff47317705442af5886ac9a41639c8358045638a09a3ff92c36468dccce88e96ee6cc9abca365deb84154be43c9234857cc899086a31a247c834e63a5652af9aeaade6c58d9bf8c3ceb5af6154ae2eb73f0c050d3029f55655923f24f4edb4e2ffcac0fdf858db0f52b15d811617ebfcb471eb474b1490d85997d26ceefcc2b98249c1ebbd2d132cfd6b7406bd228d4a2efe76c7a2aaf533876147d3b1a6b00b13af150e0c8198fae064ee45cd124fcf16aa3624ded3fac698320d8f0ba4780c059d0d28368ece570b2d89d797f53d2ad040b6e04599a5876ade8be4b9d31fe265232a6e06c1f658c93a4b9e0fb8383173732bdad34a372af3cf053a838094be439742817949989e39ffa22136a00e6dd9e7a07c8c476cf10edd92d53c3f083179df147b4554e63df2ab2f95cf80a21365a43ad5b77e4356794492d735c22f3a580b9b41dd12692cb035def2ee4f518341de3e9efa0abaa933be5b56a3dd282a40a823fa1c6564f93d9c2ab958960fe31eb847c950035f4dfaf701523870387dbdbb5d876d87bb38ba350cab2aa8c8f0d5a9e3cfc9a675c35de0c4de0753482003ac9788e687f92af254f4e348c34b1129bad18048b72fd7ed7ed270c91d8f1f0f5d2bd9cdaf648e5c3d538b36d304700477188f7eadc2d9048428568742ebbb005e5da3cb8361890c420786f0d634214de50f3461697b90dbeebfbdb79fd431a096ad7e6d3cbdb0ef3e350470332122e800564537cd156e2acb55da128b21a0acb050c675bdd7a34d9e1a0d1bad8720f24318d41ab9d89d72621af201c7892f476f6b4f90722083363f6f65d1a888a5776e32787fba07cf442588a4e1678b50ca735643e324004314fc62718f6b12a96fa4332c9e1bf8275da679f6a1e62dfd50e76311ffaeeee36245dc3ee46cf5b54556c3c7b910ce836ca17063fed942b39ebb6f716ac16a44790d42188d350b882d09b9c7b1dcdd4fbc3179e8d0fca54bdce9b8cad823c682894affe988b41a4491fba577ee5d88bd252faa4288f88c86bac563d5bd92d9bf44798be679148c1ab97625004ec0b7e8ea5316b92da0e247d163f41cb6f9635cf5ca338dcf066feadcd6ba8c52680256e2fdce41a9e93f27c0f6298dd40625209cb4a3edcf4fb6f2e16390955f1a444282d982d4e13a90ec431db21e951111a1d8be012aab39f9fda2734a3e99c89c14523c7af2e56567cc3db9f0abc1185841cfe746be44f0d564386bf0e28a50160e21a6d29fb0989c8c88841f79818459ead28d3b497744fa93a28abd1b9043046828f51c110014a64ec0e098a1da223c7fb94b935fb24f5c8492dc5a697b256b9e03d464e5f6b55f4c305004d52d16d51aece6ead17fe0e0c30323b309cd3870c07a8b9d3859c031d8ffef8313feaa9642f332dad4eb51e962309e952c7c3355379f0858923ac23590c651ff0c8747eaa93dde375f7c79b20b02a3e33cd3e5d150dac73afcab5e267f4807b0873cb6f65f9336890414ad59449ed885a83a96df29a5c50b2a30bb0bb6513f075b18c1a45184896073ab165cddd25251138811a1ed90987bb9c97f6b999450f2b77b57788c538840eb2507884fcd94ff2779d786830d25c1584a66908114883265a062f464ad3cb4ed4d38b88fcfa0583a325922cb4ded803d10017342030dda4e8db0c73ba7975aedba89b91dbcf258175ce2f281a441ef75c63da027f8e8203e8e7b697f9b6546f450095ecff0647da2f1263d33c065dd8cb8adde30ab6735b3b7bb1cd30656c982a44f75762ec3b73c23cd2d03e46495d8ad2e04871e9f0f00eee777cf45e121e5c7464a629a8019b0e86596a7dbb6c7075b21c48ff5ba6dbc609a685a9bdab0c2b1c6a2b87bed7f9fe5c4741c8e3e7911fca134130901ae433a135524a330ac843fbdd5c52d763f551ccfaa8ea59b438d148d5e2e40c66f080deb6d96b7c3254ac0396947704edc441f7dad5b8921c9ead4652e4845f721d32e9ef82238b01391a8005972e5a51d9180e4a4763e30109528dd25fbac81beee4b44fbfb8a4f172b7609fe15b54d4c73162ac51a77218a40532156f7d7ac9e1a30b524c169eaff3465") r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_FLUSH(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc011}, 0x800) (fail_nth: 3) 3.69874965s ago: executing program 1 (id=2561): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000002600), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044085}, 0x24008840) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan1\x00'}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000000500)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) close(r1) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r5 = accept(r3, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x80}, 0x0) recvfrom(r4, &(0x7f0000000280)=""/90, 0xfffffffffffffe4a, 0x500, 0x0, 0x0) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) r7 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f0000000200)={0x2e, 0xa1328f59b7fd100f, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x2, 0x65d, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x60}}}, &(0x7f0000000480)=0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) r13 = dup(r12) syz_ublk_setup_queues(r13, r11, &(0x7f0000000180)={0x0, 0x188d, 0x500, 0x1, 0x257, 0x0, r13}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x36c, 0x80000, 0x0, 0x10000004, 0x0, r13}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffdfffc, 0x1000, 0x0, 0x45}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x1000, 0x2, 0x82}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x0, 0xffffffff}}], 0x1, &(0x7f0000000340)={0x2e, 0x0, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x5, 0x0, 0x0}}, 0x0) 3.482729277s ago: executing program 5 (id=2562): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000004c0), 0x4000, 0x0) dup(r0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/vlan/vlan1\x00') bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000000), &(0x7f0000000080)=@tcp6=r5, 0x2}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r4, r2, 0x25, 0x0, @val=@tcx={@void, @value=r4}}, 0x1c) syz_emit_ethernet(0x3a, &(0x7f0000010800)={@remote, @empty, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x5, 0x1, 0x1}}, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x1, 0x8, 0x24, 0x66, 0x0, 0x4, 0x21, 0x0, @loopback, @multicast1}, {{0x4e24, 0x4e22, 0x4, 0x1, 0x6, 0x0, 0x0, 0x7, 0x3, "3abd73", 0x70, ' Y\b'}}}}}}, 0x0) 3.383818594s ago: executing program 5 (id=2563): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x58, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}, @IPSET_ATTR_IFACE={0x14}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) 3.312232883s ago: executing program 5 (id=2564): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$bt_hci(r2, 0x0, 0x1, &(0x7f00000005c0)=""/199, &(0x7f00000006c0)=0xc7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x38, 0x1403, 0x1, 0x1070bd27, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) socket$netlink(0x10, 0x3, 0x0) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_msfilter(r7, 0x0, 0x29, 0x0, 0x57) r8 = socket$unix(0x1, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r10 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64=r10, @ANYRES64=r9, @ANYRES64=r8, @ANYBLOB="3bf81bb9e9"], 0x20000600}}, 0x0) sendmsg$sock(r10, &(0x7f0000001940)={&(0x7f00000002c0)=@sco={0x1f, @none}, 0x80, &(0x7f0000000000), 0x5, &(0x7f00000008c0)=[@timestamping={{0x14}}], 0x18}, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000000)={0x401, 0x8, 0x2, 0x3, 0x2, 0x0, [{0x6e, 0xc, 0x7, '\x00', 0x2801}, {0x2, 0x373, 0x7, '\x00', 0xa}]}) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000380)={0x631, {{0x2, 0x4e23, @remote}}, 0x1}, 0x90) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r0, 0x7b2, 0x0) 2.6842258s ago: executing program 3 (id=2565): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) accept$unix(0xffffffffffffffff, &(0x7f0000000340)=@abs, &(0x7f00000003c0)=0x6e) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$SNDRV_PCM_IOCTL_UNLINK(0xffffffffffffffff, 0x40044160, 0x3) 2.673887161s ago: executing program 1 (id=2566): r0 = socket$nl_route(0x10, 0x3, 0x0) openat(0xffffffffffffff9c, 0x0, 0x40, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x0, 0x0, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) creat(&(0x7f0000000100)='./file2\x00', 0x1) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r4, &(0x7f0000001180)={0x2020, 0x0, 0x0, 0x0}, 0x2020) pipe2$9p(&(0x7f0000000140), 0x4000) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x1b7b}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x40000, 0x100a8}}}}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x9}]}, 0x50}}, 0x40080) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="1c00508004000400050002000300000009000100b18af861dcfb7fb5546b000000571edfa798a76ae1220aad2d795ddebf53be086ea2f6fd1b0922c7f184103585cd95ab7b5f63be5de0b7b4c89124fc97b992459fd098d6c8ce6fd81df7"], 0x38}, 0x1, 0x0, 0x0, 0x4008000}, 0x4814) 2.586185396s ago: executing program 4 (id=2567): r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/sys/net/ipv6/conf/all/disable_ipv6\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='1', 0x1) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x972, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xf) socket$inet6(0xa, 0x80002, 0x0) r2 = syz_open_dev$sndpcmc(0x0, 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS32(r2, 0x806c4120, &(0x7f0000000300)) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="740000000206010200000000000000000200000314000780080008400000003708000640000008000e0003006269746d61703a6970000000050005000a00000005000400040000000900020073797a310000000005000100070000000d0003006c6973743a73657400000000"], 0x74}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000025300)=""/102392, 0x18ff8) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x14e203, 0x0) ioctl$SNDCTL_SEQ_PANIC(r6, 0x5111) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff2e) r7 = syz_open_pts(0xffffffffffffffff, 0x80) dup3(r7, 0xffffffffffffffff, 0x80000) sendto$inet6(r3, &(0x7f0000000040)="800037bbfa9ba1ce", 0xffe9, 0x0, 0x0, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x0, 0x0, 0x7) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="c00000000002010800000000000000000300000a08000540000000083400018006000340000200000c0002800500010021000000060003400003000014000180080001001700000008000200e000000208000940ba00000008000940000000060600074000030000580003802c00018014000300"/126], 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x800) 2.585319661s ago: executing program 0 (id=2568): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$bt_hci(r2, 0x0, 0x1, &(0x7f00000005c0)=""/199, &(0x7f00000006c0)=0xc7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x38, 0x1403, 0x1, 0x1070bd27, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) socket$netlink(0x10, 0x3, 0x0) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_msfilter(r7, 0x0, 0x29, 0x0, 0x57) r8 = socket$unix(0x1, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000200)={0x1d, r9}, 0x10) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64, @ANYRES64=r9, @ANYRES64=r8, @ANYBLOB="3bf81bb9e9"], 0x20000600}}, 0x0) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001940)={&(0x7f00000002c0)=@sco={0x1f, @none}, 0x80, &(0x7f0000000000), 0x5, &(0x7f00000008c0)=[@timestamping={{0x14}}], 0x18}, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000000)={0x401, 0x8, 0x2, 0x3, 0x2, 0x0, [{0x6e, 0xc, 0x7, '\x00', 0x2801}, {0x2, 0x373, 0x7, '\x00', 0xa}]}) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000380)={0x631, {{0x2, 0x4e23, @remote}}, 0x1}, 0x90) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r0, 0x7b2, 0x0) 1.930555293s ago: executing program 5 (id=2569): mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05080000000000000000070000060900010073797a30000000003c000000090a010400000000000000000700000308000a40000000000900020073797a31000000000900010073797a30000000000800054000000021900000000c0a01030000000000000000070000000900020073797a31000000000900010073797a3000000000640003806000008004000180580007800b000100746172676574000048000280080002400000000230000300b08c674515113085726709225a7547b6f14c1aa7a7202afc081161"], 0x114}}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0xfff, 0x4000000007}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x1, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000540)={@rand_addr=0x64010100, @multicast1}, 0xc) io_setup(0x8, &(0x7f0000000240)) syz_open_procfs(0x0, &(0x7f0000000080)='net/llc/socket\x00') syz_open_dev$sg(&(0x7f0000000200), 0x3, 0x400) modify_ldt$write2(0x11, 0x0, 0x0) modify_ldt$read(0x0, 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = fsopen(&(0x7f0000000280)='hugetlbfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x82) fchdir(r3) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'gre0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001340)=@newtaction={0x3f4, 0x30, 0x300, 0x70bd28, 0x25dfdbff, {}, [{0x354, 0x1, [@m_mpls={0x11c, 0x5, 0x0, 0x0, {{0x9}, {0x90, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x4, 0x3d62, 0x3, 0x6, 0x4}, 0x4}}, @TCA_MPLS_BOS={0x5, 0x8, 0x1}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x23b96b5d, 0x0, 0x2, 0x3, 0x9}, 0x4}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x600c}, @TCA_MPLS_PROTO={0x6, 0x4, 0x201}, @TCA_MPLS_LABEL={0x8, 0x5, 0x2fd87}, @TCA_MPLS_TTL={0x5, 0x7, 0xf1}, @TCA_MPLS_TTL={0x5, 0x7, 0x8}, @TCA_MPLS_BOS={0x5}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x9, 0x8, 0x6, 0x7, 0x3}, 0x4}}]}, {0x61, 0x6, "e94a2f115b6ec53ce7f3447f6a5b161247204f49c9eae4d1cf502873d2cf674ca56f5344dc284dffd595d7a7defaf0b3181d18e67fa966c620fa7e3ffd416d9237edb5cd5be37e23bb0b5936876017dc3e95cdaa22c19747efbbb0c5d8"}, {0xc}, {0xc, 0x8, {0xfdd6e1f1da76e08c}}}}, @m_nat={0x16c, 0x20, 0x0, 0x0, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0x1000, 0x3, 0x7, 0x1}, @local, @multicast2, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x8, 0x3, 0xb18adffae50f4e8b, 0x6, 0x80000001}, @empty, @multicast1, 0xffffff00}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x8, 0x8, 0x5, 0x7}, @local, @remote, 0xff000000}}]}, {0xcb, 0x6, "b9d91ac80dbaa665c26a6c617fe8fb1a84c4416d829cf1792331df797a6b2d420f6ea8af7636bfc7b2514707ec77bfb860e140d774612e2439e77a6707087b2777a7ce4d3671be8539169271ac0c047d893722a38b8e454682cc888942223b10c31495a2b9096a19a8e7a9059094c1fd7b6ca6cfe478cdcdb29fabc506777326683e5f0ec5502823828e3f7eb53b3b148ffbcb3d9d97cc8c7f51cc508d9291deecd7ac9140a2c68122c7985f116bfd522302ee719298a82069acad5bb251890a82577ba47fa19c"}, {0xc}, {0xc, 0x8, {0x3, 0x1}}}}, @m_gact={0xc8, 0x18, 0x0, 0x0, {{0x9}, {0x4}, {0x9a, 0x6, "5e428e6344e335ecb2ab999d0fce7b39d67c6ac7d49539eaa6f03429b3db56a0734d3b4764f0d7ae0c798d5c6af0eb3c6a4fc7ce996b1dd70d5fb0a6704fc18846154266a3cdf7e98370a20f19dcfe8abc24c22749fe3359c1211d5e21e2fa28ea2bceaabef117ba4a79e625876518dcfa5f91239809cad95072e8633311eb2a1efa66f1ba12f7f2a9418096fc1f93d2aea1e712d472"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}]}, {0x8c, 0x1, [@m_ife={0x88, 0x2, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @link_local}, @TCA_IFE_METALST={0x24, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0xb}, @IFE_META_PRIO={0x8, 0x3, @val=0x7}, @IFE_META_PRIO={0x8, 0x3, @val=0x7}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x6}]}, @TCA_IFE_PARMS={0x1c, 0x1, {{0xfffffff8, 0x5, 0x8, 0x101, 0x4}, 0x1}}, @TCA_IFE_METALST={0x4}, @TCA_IFE_DMAC={0xa}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x3f4}, 0x1, 0x0, 0x0, 0x20041890}, 0x0) 1.392434637s ago: executing program 1 (id=2570): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYRES32=r2, @ANYBLOB="0a0006"], 0x34}, 0x1, 0x0, 0x0, 0x4004}, 0x24000014) 1.358481499s ago: executing program 0 (id=2571): syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$XFS_IOC_GETBMAPA(0xffffffffffffffff, 0xc020582c, 0x0) ioctl$MON_IOCQ_RING_SIZE(0xffffffffffffffff, 0x9205) r0 = fsopen(&(0x7f0000000080)='virtiofs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x8, &(0x7f0000000100)=0x3) unshare(0x68040000) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x1c0002, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) io_setup(0x1, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x33, 0x2, @tid=0xffffffffffffffff}) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x10001}}, './file0\x00'}) syz_open_dev$vim2m(0x0, 0x10002, 0x2) 1.010100247s ago: executing program 1 (id=2572): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) cachestat(r1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000100)) r5 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_REWIND(r5, 0x40084146, &(0x7f0000000140)=0xfff) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB="364000001a00913a09b51bcb3cc5a05f0a"], 0xfe33) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)}, {&(0x7f0000000200)="68cabf2dfb58fc0a01008888ffff0200258f", 0x12}], 0x2}, 0x0) socket$kcm(0xa, 0x5, 0x0) r6 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x8916, &(0x7f0000000000)={r6}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001200)=ANY=[@ANYBLOB="61128c00000000006113300000000000bf300000000000002500070007ffffffbd0201000000000095002000000000006916320000000000bf6700000000000007070000b964b01a4607feff00200000540700000ee60090bf050000000000000c5700000000000065070000d23700002c030000000000001f75000000000000bf54000000000000070000000400f9ffad430100000000007c000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c4ed68ecf264e0f84f9f17d3c30e3c7bdd2d17f2f175455000078af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd390700000500000000f18c30907d7bee45a0100000fe9de56c9d05000000c6c60bef0d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cac3f055af65727546e7c955ccefa1f6ab689ffffff7f63ede202fa4e0a2127b8b83c71a51445dc8dfd13ff15f852a39e5b2ab7bcb8f512036a5ba6d04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6901fcecc8158f0200000000c8fb735fd552bdc268694aeb0763f65e439ec1120843e326c819b6cf5c8ac86f8a297dff0445a13d0045fb3cda30a673a6037ed8c85f21ec2c081bdce431e56723888fb126a19bc1172b84b3ebe174aba210d739a018f9bbec63222d20cecac4d03723f1c921b5bbf7949632cacfdd32b3a6aa57f1ad2e99e0e67a993716dbf580469f0f53acbb400001e3abd5dedd3f7d2cf5834f2af97787f696649a46e17e090000000000000045eac1720e83b7838e3eede14308d582685e1becd6f35154bcb400000000000000000000008129277dc467148670ad3e2b26539cebca8f4ddc211bc3ccf0bd9d42ca019dd5d022cf74686e9fbe2562979eaed840a7afaab43176e65ec1118d46d1e827f3472f4445d353887a5ad103649afa1769080584f800031e03a651bb04000000ab04871bc47287cd31cc43ea0ffb567b4040c1458d0320ce7d0000413a0000000000000000005f37983f84e98a523d80bd56a57fa82b82f639601ae899a559944cb9a62a29ab028acfc1cb26a0f6a5480a55d624a0c544ba0dc828c22fe30000aa391598000000437d57fcf8295f63a70837f5cd4e5e77964522dc7ca3aa3476b7f2d851d27fd4de6eabb43e0799dc8d9fb7dc6c523ffbd74a6a40e4acb1ac872ade9d1f2ab779b8dbe843aeeda0426c767c00327b8c95b2bb6ddb55117669d9598c0f3598073f3a921c76beceff7e4fbfea5011db9020823b83abe54346c7af0a99fa077ffe7000feb9e44023a1749eb1d0d572b77d6e0d0fcd74031c8ef2629f5ecff4626746d6abe98a255e92c3c4f79bfcd0d91741380000cfeb73dec68ed56b5d3dfdf0cb8b71ad79000000000000000000000000000000dd434a25e95d0ec29d3adaccf89d0888031ecdfdb4dfbe444673be099ece7e4009c76c7108ef0a7e59fd6d906fbc3c9b412e0478cfee4485f423c63f49db43833c92eeeb647cebd4d7a93a17bcbb6bae5ff876375d4fe39cc2d292691672cc18ca372104ceb83a35ecedd97fc191d8f64d2b1d60c6d12911aada66c26aa4802c3514c3d92ec905000000b13f14c3f2ed6c64ec90000022d600000000000000000000028026b80c3899543223a6079ee96198b9a326db3be3a48af415ca28ca51c502550044ed8e29af8d763ef9b1f31befcad2ce5394601c7cdc233ba3d4ce26ed703dcb9fb3ad650f77e339768924dfdbeead13b88371154d743544a6091ec93e0d3fd5b4dc42911c17d51f964727bfd5cc5ba15370f6e1141d2271eded0b15e4316a1e4623272beb249a0928c417720be14c898f397411c88a7bcf3df46ab3efe7cd5e160c2afd3cc945f75011a102d952c7ad17a58d9be6910023a26faea764fae160cc2260bd028162917807ce89e11b5f261052ee0dde18efa1d802af2b7beecaaa61e7a726571df5cf6f8af41933cea0d0343261bccf64ca1c81045153eafbefdb91fbdff9ee3307d4a1837963b2dc2a3698d90e7915b098f19392e792adaea86052f4e948184001b6494e906925a092483adc7e9c8f7a29d226763c100aecae7f00619c36bceb9fb6dd7e55487d8485e498fdfc377fd3d266d21d46ab2f6b2ce22cd0aebba9b0ffbfe8ec3143c3734967c90b16ebbeeae1ce2baaae05aed6bf0f40c8a323f9235dc99698bd0b800067a901a79daada03cc77e74feb98b1586946b452764ff917a8ecc10e529c5bea49cad70e22df522c2803b6ef65df70223c6e22c3433e322d8dbd6e9b040065a9d6b3d5ae276cffe935d559bea88e1aa36b4e6c19e78457904297e77370e013b705a96548d47c609a93c45f4d1382b39c05dcc07d5b49ad75ddb3ce5b5b9416e03995da046c7aa5e6fc1a6f5d663380967ccef9de49a90ced031335e3219ebd9d06c257a50497ec523f5ff7361261ccfe239d603364a42e2e81fc068fcbb9792b673827fe7018a988fbce55bb74cdb327ce27e134548032a307871cea4c89d4b77b8743fb3cb72cc280b9f62e4f92f46a19600b802cba88b7d0a938d9e0e6cfe5d66b8748d004179e5b6025c0e1050faec7ecd9de190a975db2f8c06a551236278c4766d7e22e3b85168c9851de6266c791252f919b4f8b25055e786734e5142e4666c67aef5b7b2f88c6640995434aa8636993089c73f196c54ae829ad4307132655b075ae534fa7f1ea9a17e62357b0bd2bd1d62d34bfc136464025013665b1cf26a863a5cb3e8acc806611792add8254e705fefd2a44d5b15e3b36f6b75c97c9c04c511d8cf9e24c61c8284a913a381cb1a56c4f3f265a09628878040000000000000017b68afd95d4abd79286692439ee7acca2adc3d83d72b1b778e30c2bf2efbbcd054cf51f5705eb0faa8a0d9f18135cb1d8d567c3436fa697b72c5035d98b9e4f7f3379c0b3339debc78352b2e65299223d7ef2bd540e78167a3ac92a4c4f826f6d0e5c4ebf4f7a70c03e2f5ddbebf168586331eb5995d2288a167b7c6b20b32116b0c528dab6d0c4fe2ee402348104bc5d4012babedee898c6d3e1017be2e9bc759d3ab4d615f5000000000000000000000000000000000000000000007fff0000000000e693e314adf7dc9f517d04f1e6ca367d30d31d3647c6059db6e1e9529eb1623ef99e2d9ac2ab4872f8e784b07a31110bef6d000000a6f9e89e6d50ee06ce716f94da60f1f22db669560d296287c13c92070000ee7553eb2df17a39542fa88d09f000e88a90cf4406b9000000000000000000000000f441d6a6f516c235c6f5863e7f454ee0e16b9aa2593eb31fa3836703e7765aaeb77a8770e518efaa6d3dd85e03b3b133eb749057cea9af75a0e6f633532f2891b8e263cb6eecea691842827bc7c887081c8d320642389f5f0c42dba0ff75a257310f2d92cb1d1e16468949f5675262ee6609cf26ae4a8f5eac0ebf318e735930b01d8f586e34537bcff7d6196f494cdcf3a712078d745db0f5687a78ee6d000b3d171a0f08299b52d207f32e9da311ca090000003a42732808515eec574f892622c5be497fc3d9ca122d7c18b9e54637812c8debc61f0e42d838e44a819b74bce1a56108bb0f72c4a02475920532309c55b2c9ae9f281391ec5cc72a5e94cca1cbf1a706ec201eedfa5fbdb537a0c52bd45a9f966c25616cec30c3ea3246cb8e6aac7cf273638e6656a3e4ccadc348f0172028c99cc5f6d5c6d09ed65aa54549e73c28b7c8ad06ad3c5e3c27eec0eff1a6c84f1189919eefcee8072d1f88cb781e4cdb04af00ac92f1080211c4bee74381a0e31021918f27863fdbafb50f70857d52a1f7df51935a80b1980a4778d35f183ea517f55a98c5a471f3521956f8da6a4ccf2071095305701ab3f3ae43f06e91bc7d85e3800b46926944fba9805a985e63e53a62232fcd3f01dbe1728f300e247a7ebe344f9749818ff3961b2a42664ccd680a90bbb6ab400e286acc8f9febef64594777f848ed1cf980a3da2f0f7745760a05887d0c28060d613dd6539d392fc21fee0b5131609664b821d7a994e6c5965a4fa1ec1790c54e54586907dcc5a071ba22251e2de8bac16e79da9c2444d52facb7ab49420900000000000000f888a94365b99b72796fde1b922fc9ae09b526efca65faf1546c17cbb1d2d2fd12cb1a49cad501a3ca218c595b667b634606c57987ebfb0783a4948e4561d5cda158fe74453ff4a837be14d6a483842c57d6005b544b4f80003386edfd3d4a88a667bd41eefe0d808abed08a29e6bc370a80cc0366fb4080bfbaaa946fd47ab662c79c846e403910bbc3a48bb276cbb08a8eab145c06221ef16a238e3d50ad18aea9a2cec97d3c2d0569caabe2bffe02506bc9cb7294c5d020536dd5e7a6351642112df3b55d0215aaec7e45598995e79699e47567e353e68b03f82be860b188554b734e1192f9c1a867b815ef52cdc3307c0cc9be0000fdde69c350e59f11f1d26a4d04d8c8b2c4a4d23ee931d14bc7807db773a614b670acf46f83f7c65a0f8d43c5f647e1f0d27c46d4b686e867e9b0be76a7978a8f962bb5a070df97f2bf7612115cfe5ebdc7ad0bc5a5f3ace25347d0e5c347279d55aa67a967380000000000000000000000000000000000000000000000ed0942d980c754c6c69ef65c375ad018824f78b260d5f51bc3feba504408a8c8141d84f3f417603b5081680faa8cf38dbe4ae19e936511966965ce268b6345a0001c0f26a32e0a999fc869292e939dcf89b9bfd794f9c12d41959a00688cca43015a9eec58f647796adea520cd2abeb0b55c22949d10e5a05fee4543fdc1e02554a55b5fef2427a6e5708edc38fac53c2f961945a3f83cdf01979939b49bc6b1aef8c733401bbe473de8d64efbe0d123739f387d1c0d9e74f2175c174ada1678c7db79492e8dd0f34e2ccf419cf7f14ffa408b50a52685b36aed14aa22ad928191d5a2697646edc52a1c0c5d720ae690add2b34aed161f51cc1cb424f76098e1e1921e5a405f9d298a8461f2da30e47b7c6ed7c95c84c745f58723e4cddffae3b53b5b947f9435e589f9ae55b30ecd3827b2de5df31976870823da8058c2538c04e397f3d0ef90c11c74da984fa558697ecb57224ce8fa6f79aadbd7dbf3678e74d790bc2ee72769a3ada1dd504f8e4133ce1effd446bc9a2f139e65cc4bd83912af3122352506c7c2191b3705113a5ce1c99193886d6008d3565b00000000000000000000000000000000001c260fc175785ca04e31790f542c0f17b6599e93134792eae9878638b299e1d2b38d367be0d5c99d179c6bde265caebbae48bae74338f9d4f12f"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe50}, 0x48) 934.446564ms ago: executing program 5 (id=2573): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000004c0), 0x4000, 0x0) dup(r0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/vlan/vlan1\x00') bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000000), &(0x7f0000000080)=@tcp6=r4, 0x2}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r3, 0x0, 0x25, 0x0, @val=@tcx={@void, @value=r3}}, 0x1c) syz_emit_ethernet(0x3a, &(0x7f0000010800)={@remote, @empty, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x5, 0x1, 0x1}}, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x1, 0x8, 0x24, 0x66, 0x0, 0x4, 0x21, 0x0, @loopback, @multicast1}, {{0x4e24, 0x4e22, 0x4, 0x1, 0x6, 0x0, 0x0, 0x7, 0x3, "3abd73", 0x70, ' Y\b'}}}}}}, 0x0) 552.8905ms ago: executing program 5 (id=2574): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) r0 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$selinux_user(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="73797389656d5f753a6f626a6563745f723a7363655f743a733020726f6f7400"/43], 0x2b) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) rmdir(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uvc.usb0\x00') 0s ago: executing program 1 (id=2575): ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x9, 0x4, &(0x7f0000000040)=@framed={{0x6, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0xb8}, [@ldst={0x5}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x41000, 0x0, '\x00', r0, @cgroup_sock=0xd, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) accept$alg(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) sched_setscheduler(0x0, 0x5, &(0x7f0000000040)=0x200003) r1 = socket$can_j1939(0x1d, 0x2, 0x7) connect$can_j1939(r1, &(0x7f0000000140)={0x1d, 0x0, 0x3, {0x2, 0xf0, 0x4}, 0x2}, 0x18) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) bind$unix(r3, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) listen(r3, 0x8) timer_create(0x0, &(0x7f0000000240)={0x0, 0x34, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/devices/system/node/node0/reclaim\x00', 0x1, 0x0) write(r4, &(0x7f0000000800)='10000', 0x5) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f0000000080)=0x0) connect$nfc_raw(r4, &(0x7f00000000c0)={0x27, r5, 0xffffffffffffffff, 0x1}, 0x10) kernel console output (not intermixed with test programs): : 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 768.858705][T14168] R13: 00007f235a426038 R14: 00007f235a425fa0 R15: 00007fff690be818 [ 768.858730][T14168] [ 770.340794][T14187] pim6reg: entered allmulticast mode [ 770.356676][T14187] pim6reg: left allmulticast mode [ 770.418493][T14191] 9pnet_virtio: no channels available for device syz [ 770.446577][ T30] audit: type=1400 audit(1786471816.099:883): avc: denied { mounton } for pid=14185 comm="syz.3.2188" path="/syzcgroup/cpu/syz3/cgroup.procs" dev="cgroup" ino=178 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 770.686964][ T5728] usb 6-1: USB disconnect, device number 56 [ 772.149306][T14199] lo speed is unknown, defaulting to 1000 [ 772.302513][T14200] virtio-fs: tag not found [ 772.632072][T14210] 0x000000000007-0x000000020000 : "" [ 772.711443][T14211] netlink: 'syz.5.2191': attribute type 4 has an invalid length. [ 772.747835][T14210] ftl_cs: FTL header corrupt! [ 772.892296][ T5728] usb 1-1: new full-speed USB device number 88 using dummy_hcd [ 773.051549][T14213] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2192'. [ 773.388637][ T5728] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 773.517106][ T5728] usb 1-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 773.773813][ T5728] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 773.792413][ T5728] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 773.811068][ T5728] usb 1-1: Product: syz [ 773.819740][ T5728] usb 1-1: Manufacturer: syz [ 773.831401][ T5728] usb 1-1: SerialNumber: syz [ 774.327208][T14220] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2195'. [ 774.816280][T14232] bridge0: entered allmulticast mode [ 774.838461][T14232] FAULT_INJECTION: forcing a failure. [ 774.838461][T14232] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 774.939080][T14232] CPU: 1 UID: 0 PID: 14232 Comm: syz.5.2198 Tainted: G L syzkaller #0 PREEMPT(full) [ 774.939100][T14232] Tainted: [L]=SOFTLOCKUP [ 774.939104][T14232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 774.939110][T14232] Call Trace: [ 774.939114][T14232] [ 774.939119][T14232] dump_stack_lvl+0x100/0x190 [ 774.939136][T14232] should_fail_ex.cold+0x5/0xa [ 774.939153][T14232] _copy_to_user+0x32/0xd0 [ 774.939170][T14232] simple_read_from_buffer+0xcb/0x170 [ 774.939183][T14232] proc_fail_nth_read+0x1af/0x230 [ 774.939200][T14232] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 774.939218][T14232] ? rw_verify_area+0xce/0x6d0 [ 774.939233][T14232] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 774.939252][T14232] vfs_read+0x1e4/0xb40 [ 774.939270][T14232] ? __pfx_vfs_read+0x10/0x10 [ 774.939286][T14232] ? __fget_files+0x215/0x3d0 [ 774.939301][T14232] ? __fget_files+0x21f/0x3d0 [ 774.939316][T14232] ksys_read+0x12a/0x250 [ 774.939332][T14232] ? __pfx_ksys_read+0x10/0x10 [ 774.939353][T14232] do_syscall_64+0x115/0x870 [ 774.939366][T14232] ? clear_bhb_loop+0x40/0x90 [ 774.939384][T14232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.939402][T14232] RIP: 0033:0x7f525f35e90e [ 774.939418][T14232] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 774.939434][T14232] RSP: 002b:00007f5260204fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 774.939445][T14232] RAX: ffffffffffffffda RBX: 00007f52602056c0 RCX: 00007f525f35e90e [ 774.939452][T14232] RDX: 000000000000000f RSI: 00007f52602050a0 RDI: 0000000000000005 [ 774.939459][T14232] RBP: 00007f5260205090 R08: 0000000000000000 R09: 0000000000000000 [ 774.939465][T14232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 774.939471][T14232] R13: 00007f525f626038 R14: 00007f525f625fa0 R15: 00007ffcd5d09dc8 [ 774.939495][T14232] [ 775.179775][T14234] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2193'. [ 775.223824][ C1] usb 1-1: received EP1 urb->status = -71 [ 775.252351][ T5728] snd-usb-caiaq 1-1:1.0: unable to initialize device, too many streams. [ 775.262587][ T5728] snd-usb-caiaq 1-1:1.0: Unable to set up audio system (ret=-22) [ 775.270400][ T5728] usb 1-1: unable to init card! (ret=-22) [ 775.276733][ T5728] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 775.287538][ T5728] usb 1-1: USB disconnect, device number 88 [ 775.765979][ T804] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 776.030537][ T804] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 776.164147][ T804] usb 6-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 776.311600][ T804] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 776.322838][ T804] usb 6-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 776.354191][T14248] syzkaller0: entered promiscuous mode [ 776.359754][T14248] syzkaller0: entered allmulticast mode [ 776.378562][ T804] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 776.389544][ T804] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 776.430142][ T804] usb 6-1: Product: syz [ 776.450987][ T804] usb 6-1: Manufacturer: syz [ 776.458712][ T804] usb 6-1: SerialNumber: syz [ 776.500776][ T804] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 776.516640][ T804] ti_usb_3410_5052 6-1:2.0: missing endpoints [ 776.545544][ T5707] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 776.662337][T14260] netlink: 100 bytes leftover after parsing attributes in process `syz.0.2206'. [ 776.677807][ T5707] usb 2-1: device descriptor read/64, error -71 [ 776.888842][ T5721] usb 6-1: USB disconnect, device number 57 [ 776.907667][T14265] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 776.926379][ T5707] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 777.077802][ T5707] usb 2-1: device descriptor read/64, error -71 [ 777.206615][ T5707] usb usb2-port1: attempt power cycle [ 777.214353][T14276] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2209'. [ 777.408258][ T804] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 777.557178][ T5707] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 777.588246][ T804] usb 1-1: config 255 has an invalid interface number: 97 but max is 0 [ 777.607295][ T804] usb 1-1: config 255 has no interface number 0 [ 777.613690][ T5707] usb 2-1: device descriptor read/8, error -71 [ 777.620444][ T804] usb 1-1: config 255 interface 97 has no altsetting 0 [ 777.630052][ T804] usb 1-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 777.646375][ T804] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 777.654381][ T804] usb 1-1: Product: syz [ 777.659905][ T804] usb 1-1: Manufacturer: syz [ 777.664518][ T804] usb 1-1: SerialNumber: syz [ 777.778167][T14282] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2211'. [ 778.091436][ T5707] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 778.124132][ T804] rndis_host 1-1:255.97: ACM capabilities 01, not really RNDIS? [ 778.157505][ T5707] usb 2-1: device descriptor read/8, error -71 [ 778.182942][ T804] usb 1-1: USB disconnect, device number 89 [ 778.298008][ T5707] usb usb2-port1: unable to enumerate USB device [ 778.406653][T14294] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 778.458228][T14294] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 779.665936][T14306] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2219'. [ 779.708550][T14306] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2219'. [ 779.790300][T14311] netlink: 'syz.0.2219': attribute type 1 has an invalid length. [ 780.128409][ T804] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 780.328594][ T804] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 780.340091][ T804] usb 4-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 780.358208][ T804] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 780.370637][ T804] usb 4-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 780.397752][ T804] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 780.414473][ T804] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.424520][ T804] usb 4-1: Product: syz [ 780.429551][ T804] usb 4-1: Manufacturer: syz [ 780.434714][ T804] usb 4-1: SerialNumber: syz [ 780.509644][ T804] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 780.556295][ T804] ti_usb_3410_5052 4-1:2.0: missing endpoints [ 780.707273][T14311] 8021q: adding VLAN 0 to HW filter on device bond1 [ 780.786615][T14313] bond1: (slave geneve2): making interface the new active one [ 780.799870][T14313] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 780.808790][T14319] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2222'. [ 781.534901][T14331] lo speed is unknown, defaulting to 1000 [ 781.562152][T14333] virtio-fs: tag not found [ 781.954117][ T992] usb 4-1: USB disconnect, device number 100 [ 784.686745][T14353] Bluetooth: MGMT ver 1.23 [ 785.062032][T14358] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2233'. [ 785.424314][T14372] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 785.447025][T14374] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2239'. [ 785.457309][ T30] audit: type=1400 audit(1786471831.097:884): avc: denied { read } for pid=14371 comm="syz.5.2238" name="trace_pipe" dev="tracefs" ino=1728 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 785.487060][T14374] syzkaller1: entered promiscuous mode [ 785.496388][T14374] syzkaller1: entered allmulticast mode [ 785.542366][ T5857] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 785.599662][T14387] FAULT_INJECTION: forcing a failure. [ 785.599662][T14387] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 785.625830][T14387] CPU: 1 UID: 0 PID: 14387 Comm: syz.0.2242 Tainted: G L syzkaller #0 PREEMPT(full) [ 785.625848][T14387] Tainted: [L]=SOFTLOCKUP [ 785.625852][T14387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 785.625858][T14387] Call Trace: [ 785.625862][T14387] [ 785.625866][T14387] dump_stack_lvl+0x100/0x190 [ 785.625883][T14387] should_fail_ex.cold+0x5/0xa [ 785.625897][T14387] _copy_from_iter+0x1f4/0x1690 [ 785.625915][T14387] ? __asan_memset+0x23/0x50 [ 785.625926][T14387] ? __pfx__copy_from_iter+0x10/0x10 [ 785.625942][T14387] ? __pfx___alloc_skb+0x10/0x10 [ 785.625961][T14387] netlink_sendmsg+0x808/0xda0 [ 785.625976][T14387] ? __pfx_netlink_sendmsg+0x10/0x10 [ 785.625989][T14387] ? selinux_socket_sendmsg+0x198/0x2f0 [ 785.626008][T14387] ____sys_sendmsg+0xa4d/0xbe0 [ 785.626024][T14387] ? __pfx_netlink_sendmsg+0x10/0x10 [ 785.626037][T14387] ? __pfx_____sys_sendmsg+0x10/0x10 [ 785.626060][T14387] ___sys_sendmsg+0x190/0x1e0 [ 785.626072][T14387] ? __pfx____sys_sendmsg+0x10/0x10 [ 785.626082][T14387] ? __lock_acquire+0x49f/0x1a40 [ 785.626096][T14387] ? get_pid_task+0x106/0x250 [ 785.626120][T14387] __sys_sendmsg+0x160/0x210 [ 785.626134][T14387] ? __pfx___sys_sendmsg+0x10/0x10 [ 785.626155][T14387] do_syscall_64+0x115/0x870 [ 785.626175][T14387] ? clear_bhb_loop+0x40/0x90 [ 785.626188][T14387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.626199][T14387] RIP: 0033:0x7fd3b539e0d9 [ 785.626209][T14387] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 785.626219][T14387] RSP: 002b:00007fd3b627a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 785.626230][T14387] RAX: ffffffffffffffda RBX: 00007fd3b5625fa0 RCX: 00007fd3b539e0d9 [ 785.626237][T14387] RDX: 0000000000000004 RSI: 0000200000000000 RDI: 0000000000000003 [ 785.626244][T14387] RBP: 00007fd3b627a090 R08: 0000000000000000 R09: 0000000000000000 [ 785.626250][T14387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 785.626256][T14387] R13: 00007fd3b5626038 R14: 00007fd3b5625fa0 R15: 00007ffe2380e728 [ 785.626270][T14387] [ 785.861495][ T5857] usb 4-1: Using ep0 maxpacket: 8 [ 785.878003][ T5857] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 785.888930][ T5857] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 785.898103][ T5857] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 785.906160][ T992] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 785.937641][ T5857] usb 4-1: config 0 descriptor?? [ 785.981557][ T5721] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 786.075560][ T992] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 786.106366][ T992] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 786.131289][ T992] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 786.141198][ T992] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.152349][ T5721] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 786.169463][ T992] usb 2-1: Product: syz [ 786.193758][ T992] usb 2-1: Manufacturer: syz [ 786.322528][ T992] usb 2-1: SerialNumber: syz [ 786.816100][ T5721] usb 5-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 786.819094][ T992] cdc_mbim 2-1:1.0: skipping garbage [ 786.829970][ T5721] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 786.837396][ T5857] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 786.844781][ T5721] usb 5-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 786.872155][ T5721] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 786.881285][ T5721] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.890610][ T5721] usb 5-1: Product: syz [ 786.904180][ T5721] usb 5-1: Manufacturer: syz [ 786.907916][T14397] overlayfs: only single ':' or double '::' sequences of unescaped colons in lowerdir mount option allowed. [ 786.908870][ T5721] usb 5-1: SerialNumber: syz [ 786.950420][T14374] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 786.961292][ T5721] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 786.983478][ T30] audit: type=1400 audit(1786471832.626:885): avc: denied { mounton } for pid=14398 comm="syz.0.2245" path="/470/file0" dev="tmpfs" ino=2573 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 786.985839][ T5721] ti_usb_3410_5052 5-1:2.0: missing endpoints [ 787.051757][T14399] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2245'. [ 787.270907][ T5721] usb 4-1: USB disconnect, device number 101 [ 787.336052][ T992] cdc_mbim 2-1:1.0: failed GET_NTB_PARAMETERS [ 787.342322][ T992] cdc_mbim 2-1:1.0: bind() failure [ 787.365826][ T992] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 787.374234][ T992] cdc_ncm 2-1:1.1: bind() failure [ 787.419969][ T992] usb 2-1: USB disconnect, device number 92 [ 787.590383][ T5857] usb 5-1: USB disconnect, device number 98 [ 787.652025][T14412] rdma_rxe: rxe_newlink: failed to add lo [ 788.272658][ T804] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 789.938204][T14434] lo speed is unknown, defaulting to 1000 [ 789.965879][T14436] virtio-fs: tag not found [ 790.294155][ T804] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 790.304416][ T804] usb 1-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 790.319653][ T804] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 790.332547][ T804] usb 1-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 790.354374][ T804] usb 1-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 790.368806][ T804] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 790.377733][ T804] usb 1-1: Product: syz [ 790.418878][ T804] usb 1-1: Manufacturer: syz [ 790.423515][ T804] usb 1-1: SerialNumber: syz [ 790.440689][ T804] ti_usb_3410_5052 1-1:2.0: TI USB 5052 2 port adapter converter detected [ 790.456114][ T804] ti_usb_3410_5052 1-1:2.0: missing endpoints [ 791.048376][T14449] virtio-fs: tag not found [ 791.478647][T14447] lo speed is unknown, defaulting to 1000 [ 791.576673][ T804] usb 1-1: USB disconnect, device number 90 [ 792.358189][T14465] 0x000000000007-0x000000020000 : "" [ 792.381855][T14465] ftl_cs: FTL header corrupt! [ 792.430081][T14466] netlink: 'syz.0.2266': attribute type 4 has an invalid length. [ 793.006422][ T804] usb 4-1: new full-speed USB device number 102 using dummy_hcd [ 793.286979][ T804] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 793.331018][T14471] netlink: 100 bytes leftover after parsing attributes in process `syz.5.2268'. [ 793.355656][ T804] usb 4-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 793.374191][ T804] usb 4-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 793.383357][ T804] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 793.395599][ T804] usb 4-1: Product: syz [ 793.399924][ T804] usb 4-1: Manufacturer: syz [ 793.406000][ T804] usb 4-1: SerialNumber: syz [ 793.539709][T14473] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 793.826087][T14475] netlink: 100 bytes leftover after parsing attributes in process `syz.0.2269'. [ 793.904613][ T5746] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 793.990185][T14477] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 794.094160][ T5746] usb 6-1: config 255 has an invalid interface number: 97 but max is 0 [ 794.095766][T14479] syz2: rxe_newlink: already configured on lo [ 794.137071][ T5746] usb 6-1: config 255 has no interface number 0 [ 794.215702][ T5746] usb 6-1: config 255 interface 97 has no altsetting 0 [ 794.326628][ T5746] usb 6-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 794.354724][ T5746] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.364482][ T5746] usb 6-1: Product: syz [ 794.374629][ T5746] usb 6-1: Manufacturer: syz [ 794.380981][ T5746] usb 6-1: SerialNumber: syz [ 794.413527][T14482] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2270'. [ 794.444803][ T992] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 794.466161][T14482] syzkaller1: entered promiscuous mode [ 794.478935][ C1] usb 4-1: received EP1 urb->status = -71 [ 794.485864][T14482] syzkaller1: entered allmulticast mode [ 794.491785][ T804] snd-usb-caiaq 4-1:1.0: unable to initialize device, too many streams. [ 794.500282][ T804] snd-usb-caiaq 4-1:1.0: Unable to set up audio system (ret=-22) [ 794.513987][ T804] usb 4-1: unable to init card! (ret=-22) [ 794.520061][ T804] snd-usb-caiaq 4-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 794.531426][ T804] usb 4-1: USB disconnect, device number 102 [ 794.610073][ T992] usb 1-1: config 255 has an invalid interface number: 97 but max is 0 [ 794.618658][ T992] usb 1-1: config 255 has no interface number 0 [ 794.625859][ T992] usb 1-1: config 255 interface 97 has no altsetting 0 [ 794.636052][ T992] usb 1-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 794.645292][ T992] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.653456][ T992] usb 1-1: Product: syz [ 794.657719][ T992] usb 1-1: Manufacturer: syz [ 794.662316][ T992] usb 1-1: SerialNumber: syz [ 794.754692][ T5857] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 794.814704][ T5735] usb 2-1: new full-speed USB device number 93 using dummy_hcd [ 794.906067][ T5857] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 794.917220][ T5857] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 794.930444][ T5857] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 794.940469][ T5857] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.948687][ T5857] usb 5-1: Product: syz [ 794.953078][ T5857] usb 5-1: Manufacturer: syz [ 794.957928][ T5857] usb 5-1: SerialNumber: syz [ 794.966298][ T5857] cdc_mbim 5-1:1.0: skipping garbage [ 794.973178][ T5735] usb 2-1: unable to get BOS descriptor or descriptor too short [ 794.983778][ T5735] usb 2-1: not running at top speed; connect to a high speed hub [ 794.992717][ T5735] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 795.004944][ T5735] usb 2-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice= e.3d [ 795.014289][ T5735] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 795.022600][ T5735] usb 2-1: Product: syz [ 795.027069][ T5735] usb 2-1: Manufacturer: syz [ 795.031680][ T5735] usb 2-1: SerialNumber: syz [ 795.169275][T14482] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 795.278435][ T5735] peak_usb 2-1:1.0 can0: sending cmd f=0x6 n=0x1 failure: -22 [ 795.286339][ T5735] peak_usb 2-1:1.0: unable to read PCAN-USB serial number (err -22) [ 795.335994][ T5735] peak_usb 2-1:1.0: probe with driver peak_usb failed with error -22 [ 795.353780][ T5735] usb 2-1: USB disconnect, device number 93 [ 795.581385][ T5857] cdc_mbim 5-1:1.0: failed GET_NTB_PARAMETERS [ 795.597275][ T5857] cdc_mbim 5-1:1.0: bind() failure [ 795.616634][ T5857] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 795.623753][ T5857] cdc_ncm 5-1:1.1: bind() failure [ 795.643971][ T5857] usb 5-1: USB disconnect, device number 99 [ 795.850041][T14493] 0x000000000007-0x000000020000 : "" [ 795.898522][T14493] ftl_cs: FTL header corrupt! [ 795.943779][T14494] netlink: 'syz.1.2272': attribute type 4 has an invalid length. [ 796.678744][ T5746] rndis_host 6-1:255.97: ACM capabilities 01, not really RNDIS? [ 797.294186][T14502] tipc: Started in network mode [ 797.339140][T14502] tipc: Node identity ac14142f, cluster identity 4711 [ 797.502919][ T992] rndis_host 1-1:255.97: ACM capabilities 01, not really RNDIS? [ 797.509387][T14502] tipc: New replicast peer: 172.20.20.170 [ 797.611085][T14502] tipc: Enabled bearer , priority 10 [ 797.743267][T14505] tipc: New replicast peer: 0.0.0.0 [ 797.834082][T14505] FAULT_INJECTION: forcing a failure. [ 797.834082][T14505] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 797.910049][ T5746] usb 6-1: USB disconnect, device number 58 [ 797.951739][T14505] CPU: 1 UID: 0 PID: 14505 Comm: syz.3.2274 Tainted: G L syzkaller #0 PREEMPT(full) [ 797.951767][T14505] Tainted: [L]=SOFTLOCKUP [ 797.951774][T14505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 797.951784][T14505] Call Trace: [ 797.951791][T14505] [ 797.951798][T14505] dump_stack_lvl+0x100/0x190 [ 797.951825][T14505] should_fail_ex.cold+0x5/0xa [ 797.951849][T14505] _copy_to_user+0x32/0xd0 [ 797.951876][T14505] simple_read_from_buffer+0xcb/0x170 [ 797.951898][T14505] proc_fail_nth_read+0x1af/0x230 [ 797.951927][T14505] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 797.951956][T14505] ? rw_verify_area+0xce/0x6d0 [ 797.951987][T14505] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 797.952014][T14505] vfs_read+0x1e4/0xb40 [ 797.952044][T14505] ? __pfx_vfs_read+0x10/0x10 [ 797.952070][T14505] ? __fget_files+0x215/0x3d0 [ 797.952095][T14505] ? __fget_files+0x21f/0x3d0 [ 797.952121][T14505] ksys_read+0x12a/0x250 [ 797.952147][T14505] ? __pfx_ksys_read+0x10/0x10 [ 797.952181][T14505] do_syscall_64+0x115/0x870 [ 797.952203][T14505] ? clear_bhb_loop+0x40/0x90 [ 797.952225][T14505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.952243][T14505] RIP: 0033:0x7f235a15e90e [ 797.952259][T14505] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 797.952277][T14505] RSP: 002b:00007f235b026fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 797.952294][T14505] RAX: ffffffffffffffda RBX: 00007f235b0276c0 RCX: 00007f235a15e90e [ 797.952306][T14505] RDX: 000000000000000f RSI: 00007f235b0270a0 RDI: 0000000000000005 [ 797.952316][T14505] RBP: 00007f235b027090 R08: 0000000000000000 R09: 0000000000000000 [ 797.952326][T14505] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 797.952337][T14505] R13: 00007f235a426128 R14: 00007f235a426090 R15: 00007fff690be818 [ 797.952362][T14505] [ 797.959961][ T992] usb 1-1: USB disconnect, device number 91 [ 798.271528][T14518] 0x000000000007-0x000000020000 : "" [ 798.288505][T14518] ftl_cs: FTL header corrupt! [ 798.349595][T14519] netlink: 'syz.3.2279': attribute type 4 has an invalid length. [ 798.749271][ T804] tipc: Node number set to 2886997039 [ 799.630150][T14527] rdma_rxe: rxe_newlink: failed to add lo [ 799.640210][T14530] FAULT_INJECTION: forcing a failure. [ 799.640210][T14530] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 799.680357][T14530] CPU: 0 UID: 0 PID: 14530 Comm: syz.1.2282 Tainted: G L syzkaller #0 PREEMPT(full) [ 799.680385][T14530] Tainted: [L]=SOFTLOCKUP [ 799.680391][T14530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 799.680403][T14530] Call Trace: [ 799.680409][T14530] [ 799.680416][T14530] dump_stack_lvl+0x100/0x190 [ 799.680443][T14530] should_fail_ex.cold+0x5/0xa [ 799.680466][T14530] _copy_to_user+0x32/0xd0 [ 799.680494][T14530] simple_read_from_buffer+0xcb/0x170 [ 799.680516][T14530] proc_fail_nth_read+0x1af/0x230 [ 799.680545][T14530] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 799.680573][T14530] ? rw_verify_area+0xce/0x6d0 [ 799.680597][T14530] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 799.680624][T14530] vfs_read+0x1e4/0xb40 [ 799.680653][T14530] ? __pfx_vfs_read+0x10/0x10 [ 799.680680][T14530] ? __fget_files+0x215/0x3d0 [ 799.680704][T14530] ? __fget_files+0x21f/0x3d0 [ 799.680729][T14530] ksys_read+0x12a/0x250 [ 799.680754][T14530] ? __pfx_ksys_read+0x10/0x10 [ 799.680786][T14530] do_syscall_64+0x115/0x870 [ 799.680809][T14530] ? clear_bhb_loop+0x40/0x90 [ 799.680833][T14530] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 799.680851][T14530] RIP: 0033:0x7f86e6d5e90e [ 799.680866][T14530] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 799.680883][T14530] RSP: 002b:00007f86e7bc5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 799.680900][T14530] RAX: ffffffffffffffda RBX: 00007f86e7bc66c0 RCX: 00007f86e6d5e90e [ 799.680911][T14530] RDX: 000000000000000f RSI: 00007f86e7bc60a0 RDI: 0000000000000004 [ 799.680923][T14530] RBP: 00007f86e7bc6090 R08: 0000000000000000 R09: 0000000000000000 [ 799.680940][T14530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 799.680951][T14530] R13: 00007f86e7026038 R14: 00007f86e7025fa0 R15: 00007ffee86b1bf8 [ 799.680976][T14530] [ 799.929127][T14535] netlink: 'syz.0.2285': attribute type 2 has an invalid length. [ 799.937070][T14535] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2285'. [ 800.043383][T14540] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2286'. [ 800.097066][T14540] syzkaller1: entered promiscuous mode [ 800.102572][T14540] syzkaller1: entered allmulticast mode [ 800.245908][ T992] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 800.345981][ T5857] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 800.385973][ T804] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 800.397220][ T992] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 800.407384][ T992] usb 1-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 800.421391][ T992] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 800.431584][ T992] usb 1-1: config 2 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 5 [ 800.446542][ T992] usb 1-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 800.455573][ T992] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.463592][ T992] usb 1-1: Product: syz [ 800.467816][ T992] usb 1-1: Manufacturer: syz [ 800.472426][ T992] usb 1-1: SerialNumber: syz [ 800.483406][ T992] ti_usb_3410_5052 1-1:2.0: TI USB 5052 2 port adapter converter detected [ 800.492778][ T992] ti_usb_3410_5052 1-1:2.0: missing endpoints [ 800.500461][ T5857] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 800.515656][ T5857] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 800.529155][ T5857] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 800.538389][ T5857] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.546598][ T5857] usb 2-1: Product: syz [ 800.550764][ T5857] usb 2-1: Manufacturer: syz [ 800.555450][ T5857] usb 2-1: SerialNumber: syz [ 800.555982][ T804] usb 6-1: Using ep0 maxpacket: 8 [ 800.569581][ T5857] cdc_mbim 2-1:1.0: skipping garbage [ 800.681052][ T804] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 800.689428][ T804] usb 6-1: config 0 has no interface number 0 [ 800.695721][ T804] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 800.708496][ T804] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 800.787110][ T804] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 800.798336][ T804] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 800.866775][T14551] lo speed is unknown, defaulting to 1000 [ 801.263956][ T804] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 801.273286][ T804] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 801.284574][ T30] audit: type=1400 audit(1786471846.442:886): avc: denied { create } for pid=14547 comm="syz.4.2289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 801.289987][T14540] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 801.306236][ T30] audit: type=1400 audit(1786471846.452:887): avc: denied { sys_admin } for pid=14547 comm="syz.4.2289" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 801.354849][ T5721] usb 1-1: USB disconnect, device number 92 [ 801.369356][ T804] usb 6-1: config 0 descriptor?? [ 801.461587][ T804] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 801.551602][T14557] geneve3: entered promiscuous mode [ 801.902076][T14557] geneve3: entered allmulticast mode [ 801.913108][ T30] audit: type=1400 audit(1786471847.542:888): avc: denied { map } for pid=14545 comm="syz.5.2288" path="socket:[53933]" dev="sockfs" ino=53933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 801.942710][T14561] netlink: 332 bytes leftover after parsing attributes in process `syz.3.2290'. [ 801.960458][ T30] audit: type=1400 audit(1786471847.542:889): avc: denied { read write } for pid=14545 comm="syz.5.2288" path="socket:[53933]" dev="sockfs" ino=53933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 802.271244][ T5721] usb 6-1: USB disconnect, device number 59 [ 802.271326][ C0] ldusb 6-1:0.55: usb_submit_urb failed (-19) [ 802.323568][ T5857] cdc_mbim 2-1:1.0: failed GET_NTB_PARAMETERS [ 802.375839][ T5857] cdc_mbim 2-1:1.0: bind() failure [ 802.738553][ T5857] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 802.745377][ T5857] cdc_ncm 2-1:1.1: bind() failure [ 802.760148][ T5721] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 802.768459][ T5857] usb 2-1: USB disconnect, device number 94 [ 802.878502][ T30] audit: type=1400 audit(1786471848.512:890): avc: denied { create } for pid=14570 comm="syz.4.2295" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 802.945737][ T30] audit: type=1400 audit(1786471848.542:891): avc: denied { connect } for pid=14570 comm="syz.4.2295" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 803.137970][T14579] FAULT_INJECTION: forcing a failure. [ 803.137970][T14579] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 803.155636][T14579] CPU: 0 UID: 0 PID: 14579 Comm: syz.3.2296 Tainted: G L syzkaller #0 PREEMPT(full) [ 803.155665][T14579] Tainted: [L]=SOFTLOCKUP [ 803.155672][T14579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 803.155683][T14579] Call Trace: [ 803.155689][T14579] [ 803.155696][T14579] dump_stack_lvl+0x100/0x190 [ 803.155723][T14579] should_fail_ex.cold+0x5/0xa [ 803.155746][T14579] _copy_to_user+0x32/0xd0 [ 803.155775][T14579] bpf_test_finish.isra.0+0x4aa/0x650 [ 803.155807][T14579] ? __pfx_bpf_test_finish.isra.0+0x10/0x10 [ 803.155841][T14579] ? eth_type_trans+0x2e3/0x720 [ 803.155863][T14579] bpf_prog_test_run_skb+0x248e/0x3540 [ 803.155893][T14579] ? __fget_files+0x121/0x3d0 [ 803.155918][T14579] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 803.155940][T14579] ? fput+0x79/0x100 [ 803.155964][T14579] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 803.155983][T14579] __sys_bpf+0x2a12/0x4e80 [ 803.156009][T14579] ? __pfx___sys_bpf+0x10/0x10 [ 803.156027][T14579] ? find_held_lock+0x2b/0x80 [ 803.156043][T14579] ? get_pid_task+0xfc/0x250 [ 803.156059][T14579] ? get_pid_task+0xfc/0x250 [ 803.156082][T14579] ? find_held_lock+0x2b/0x80 [ 803.156099][T14579] ? rcu_read_lock_any_held+0x6a/0xa0 [ 803.156115][T14579] ? find_held_lock+0x2b/0x80 [ 803.156128][T14579] ? ksys_write+0x190/0x250 [ 803.156142][T14579] ? ksys_write+0x190/0x250 [ 803.156172][T14579] ? fput+0x79/0x100 [ 803.156194][T14579] ? __x64_sys_bpf+0xce/0x140 [ 803.156211][T14579] __x64_sys_bpf+0xce/0x140 [ 803.156227][T14579] ? do_syscall_64+0x90/0x870 [ 803.156250][T14579] do_syscall_64+0x115/0x870 [ 803.156269][T14579] ? clear_bhb_loop+0x40/0x90 [ 803.156291][T14579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 803.156308][T14579] RIP: 0033:0x7f235a19e0d9 [ 803.156322][T14579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 803.156341][T14579] RSP: 002b:00007f235b048028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 803.156358][T14579] RAX: ffffffffffffffda RBX: 00007f235a425fa0 RCX: 00007f235a19e0d9 [ 803.156370][T14579] RDX: 0000000000000050 RSI: 0000200000000c40 RDI: 000000000000000a [ 803.156380][T14579] RBP: 00007f235b048090 R08: 0000000000000000 R09: 0000000000000000 [ 803.156391][T14579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 803.156407][T14579] R13: 00007f235a426038 R14: 00007f235a425fa0 R15: 00007fff690be818 [ 803.156432][T14579] [ 803.506661][ T5707] usb 5-1: new full-speed USB device number 100 using dummy_hcd [ 803.577791][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 803.584659][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 803.675647][T14585] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2299'. [ 803.736321][T14585] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2299'. [ 803.793052][T14589] 0x000000000007-0x000000020000 : "" [ 803.854385][T14590] netlink: 'syz.5.2299': attribute type 1 has an invalid length. [ 803.879595][T14591] netlink: 'syz.3.2300': attribute type 4 has an invalid length. [ 803.901791][ T5707] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 803.965207][T14589] ftl_cs: FTL header corrupt! [ 804.762181][ T5707] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 804.771160][ T5707] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 804.781227][ T5707] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 804.813107][ T5707] usb 5-1: config 0 descriptor?? [ 804.821134][ T5707] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 804.824582][T14590] 8021q: adding VLAN 0 to HW filter on device bond2 [ 804.827777][ T5707] dvb-usb: bulk message failed: -22 (3/0) [ 804.835777][T14600] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2302'. [ 804.851944][ T5707] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 804.862077][ T5707] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 804.871446][ T5707] usb 5-1: media controller created [ 804.878554][ T5707] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 804.934847][ T5707] dvb-usb: bulk message failed: -22 (6/0) [ 804.963213][ T5707] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 804.992114][ T5707] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input14 [ 805.159722][T14604] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 805.185113][T14582] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=30698 sclass=netlink_route_socket pid=14582 comm=syz.4.2297 [ 805.199850][T14581] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=30698 sclass=netlink_route_socket pid=14581 comm=syz.4.2297 [ 805.199920][ T5707] dvb-usb: schedule remote query interval to 150 msecs. [ 805.222158][ T5707] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 805.493975][ T5707] dvb-usb: bulk message failed: -22 (1/0) [ 805.522674][ T5707] dvb-usb: error while querying for an remote control event. [ 805.535258][ T804] usb 5-1: USB disconnect, device number 100 [ 805.612324][ T804] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 805.628753][ T5746] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 805.788949][ T5746] usb 2-1: config 255 has an invalid interface number: 97 but max is 0 [ 805.797312][ T5746] usb 2-1: config 255 has no interface number 0 [ 805.808937][ T5746] usb 2-1: config 255 interface 97 has no altsetting 0 [ 805.827200][ T5746] usb 2-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 805.849181][ T5746] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 805.863137][ T5746] usb 2-1: Product: syz [ 805.872664][ T5746] usb 2-1: Manufacturer: syz [ 805.885148][ T5746] usb 2-1: SerialNumber: syz [ 805.936885][ T5707] usb 1-1: new full-speed USB device number 93 using dummy_hcd [ 806.066802][ T5707] usb 1-1: device descriptor read/64, error -71 [ 806.167487][ T804] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 806.306848][ T5707] usb 1-1: new full-speed USB device number 94 using dummy_hcd [ 806.318413][ T804] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 806.329559][ T804] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 806.342287][ T804] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 806.351504][ T804] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 806.359509][ T804] usb 4-1: Product: syz [ 806.363718][ T804] usb 4-1: Manufacturer: syz [ 806.368344][ T804] usb 4-1: SerialNumber: syz [ 806.377182][ T804] cdc_mbim 4-1:1.0: skipping garbage [ 806.457043][ T5707] usb 1-1: device descriptor read/64, error -71 [ 806.554018][T14635] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2314'. [ 806.566066][T14635] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2314'. [ 806.577294][ T5707] usb usb1-port1: attempt power cycle [ 806.704488][ T804] cdc_mbim 4-1:1.0: bind() failure [ 806.724283][ T804] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 806.751117][ T804] cdc_ncm 4-1:1.1: bind() failure [ 806.774192][ T804] usb 4-1: USB disconnect, device number 103 [ 806.909443][T14643] 0x000000000007-0x000000020000 : "" [ 806.937801][ T5707] usb 1-1: new full-speed USB device number 95 using dummy_hcd [ 806.983524][T14644] netlink: 'syz.4.2317': attribute type 4 has an invalid length. [ 806.996284][T14643] ftl_cs: FTL header corrupt! [ 807.093832][ T5707] usb 1-1: device descriptor read/8, error -71 [ 807.432053][ T5707] usb 1-1: new full-speed USB device number 96 using dummy_hcd [ 807.535288][ T5707] usb 1-1: device descriptor read/8, error -71 [ 807.681483][ T5707] usb usb1-port1: unable to enumerate USB device [ 807.892229][ T30] audit: type=1400 audit(1786471853.521:892): avc: denied { write } for pid=14651 comm="syz.3.2319" name="core" dev="configfs" ino=1602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 807.924670][ T30] audit: type=1400 audit(1786471853.521:893): avc: denied { write } for pid=14651 comm="syz.3.2319" name="usb_gadget" dev="configfs" ino=17457 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 807.950494][ T5746] rndis_host 2-1:255.97: ACM capabilities 01, not really RNDIS? [ 807.964777][ T5746] usb 2-1: USB disconnect, device number 95 [ 807.974076][ T30] audit: type=1400 audit(1786471853.531:894): avc: denied { write } for pid=14651 comm="syz.3.2319" name="naa.6001405123456789" dev="configfs" ino=54622 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 808.007505][ T30] audit: type=1800 audit(1786471853.561:895): pid=14653 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.2319" name="idProduct" dev="configfs" ino=54625 res=0 errno=0 [ 808.101315][ T30] audit: type=1400 audit(1786471853.561:896): avc: denied { write } for pid=14651 comm="syz.3.2319" name="configs" dev="configfs" ino=17452 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 808.158768][ T30] audit: type=1400 audit(1786471853.561:897): avc: denied { write } for pid=14651 comm="syz.3.2319" name="functions" dev="configfs" ino=17451 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 809.130038][ T30] audit: type=1400 audit(1786471853.591:898): avc: denied { write } for pid=14651 comm="syz.3.2319" name="c.1" dev="configfs" ino=54626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 809.349381][ T30] audit: type=1400 audit(1786471854.931:899): avc: denied { unmount } for pid=5617 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 809.723837][T14680] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2328'. [ 809.861426][T14668] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2326'. [ 811.074898][ T5612] usb 1-1: new full-speed USB device number 97 using dummy_hcd [ 811.457605][ T5612] usb 1-1: device descriptor read/64, error -71 [ 811.528476][ T5746] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 811.727047][ T5612] usb 1-1: new full-speed USB device number 98 using dummy_hcd [ 811.769191][ T30] audit: type=1400 audit(1786471857.351:900): avc: denied { getopt } for pid=14715 comm="syz.5.2338" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 811.792763][ T5746] usb 5-1: Using ep0 maxpacket: 32 [ 811.849899][ T5746] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 811.874899][ T5612] usb 1-1: device descriptor read/64, error -71 [ 811.912891][ T5746] usb 5-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 811.912951][ T5746] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.912980][ T5746] usb 5-1: Product: syz [ 811.913019][ T5746] usb 5-1: Manufacturer: syz [ 811.913056][ T5746] usb 5-1: SerialNumber: syz [ 811.967110][T14719] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2339'. [ 811.970907][ T5746] usb 5-1: config 0 descriptor?? [ 811.973131][ T5746] cdc_ether 5-1:0.0: missing cdc header descriptor [ 811.976674][ T5746] usb 5-1: unsupported MDLM descriptors [ 811.978497][ T5612] usb usb1-port1: attempt power cycle [ 812.094054][T14721] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 812.210986][ T5746] usb 5-1: USB disconnect, device number 101 [ 812.317686][ T5612] usb 1-1: new full-speed USB device number 99 using dummy_hcd [ 812.387748][ T5857] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 812.448141][ T5612] usb 1-1: device descriptor read/8, error -71 [ 813.142797][T14726] lo speed is unknown, defaulting to 1000 [ 813.181309][T14728] virtio-fs: tag not found [ 813.613664][ T5812] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 813.629464][ T5857] usb 4-1: config 255 has an invalid interface number: 97 but max is 0 [ 813.638681][ T5857] usb 4-1: config 255 has no interface number 0 [ 813.644956][ T5857] usb 4-1: config 255 interface 97 has no altsetting 0 [ 813.654369][ T5857] usb 4-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 813.666382][ T5857] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 813.674590][ T5857] usb 4-1: Product: syz [ 813.678983][ T5612] usb 1-1: new full-speed USB device number 100 using dummy_hcd [ 813.686981][ T5857] usb 4-1: Manufacturer: syz [ 813.691946][ T5857] usb 4-1: SerialNumber: syz [ 813.708814][ T5612] usb 1-1: device descriptor read/8, error -71 [ 813.823288][ T5812] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 813.834823][ T5612] usb usb1-port1: unable to enumerate USB device [ 813.844297][ T5812] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 813.879025][ T5812] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 813.884573][T14735] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2344'. [ 813.917442][ T5812] cdc_acm 2-1:1.0: probe with driver cdc_acm failed with error -12 [ 813.920060][T14735] nbd: illegal input index 65508 [ 814.154695][ T5612] usb 2-1: USB disconnect, device number 96 [ 814.400924][T14744] syz2: rxe_newlink: already configured on lo [ 815.176977][T14750] rdma_rxe: rxe_newlink: failed to add lo [ 815.434301][ T5857] rndis_host 4-1:255.97: ACM capabilities 01, not really RNDIS? [ 815.497532][T14748] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 815.654664][T14759] lo: entered allmulticast mode [ 815.877420][T14754] lo: left allmulticast mode [ 815.888282][T14758] FAULT_INJECTION: forcing a failure. [ 815.888282][T14758] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 815.890833][ T5857] usb 4-1: USB disconnect, device number 104 [ 815.922534][T14758] CPU: 1 UID: 0 PID: 14758 Comm: syz.1.2348 Tainted: G L syzkaller #0 PREEMPT(full) [ 815.922562][T14758] Tainted: [L]=SOFTLOCKUP [ 815.922569][T14758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 815.922579][T14758] Call Trace: [ 815.922585][T14758] [ 815.922593][T14758] dump_stack_lvl+0x100/0x190 [ 815.922620][T14758] should_fail_ex.cold+0x5/0xa [ 815.922643][T14758] _copy_to_user+0x32/0xd0 [ 815.922671][T14758] simple_read_from_buffer+0xcb/0x170 [ 815.922693][T14758] proc_fail_nth_read+0x1af/0x230 [ 815.922721][T14758] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 815.922750][T14758] ? rw_verify_area+0xce/0x6d0 [ 815.922774][T14758] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 815.922801][T14758] vfs_read+0x1e4/0xb40 [ 815.922831][T14758] ? __pfx_vfs_read+0x10/0x10 [ 815.922857][T14758] ? __fget_files+0x215/0x3d0 [ 815.922882][T14758] ? __fget_files+0x21f/0x3d0 [ 815.922906][T14758] ksys_read+0x12a/0x250 [ 815.922933][T14758] ? __pfx_ksys_read+0x10/0x10 [ 815.922967][T14758] do_syscall_64+0x115/0x870 [ 815.922988][T14758] ? clear_bhb_loop+0x40/0x90 [ 815.923010][T14758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 815.923028][T14758] RIP: 0033:0x7f86e6d5e90e [ 815.923043][T14758] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 815.923060][T14758] RSP: 002b:00007f86e7bc5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 815.923077][T14758] RAX: ffffffffffffffda RBX: 00007f86e7bc66c0 RCX: 00007f86e6d5e90e [ 815.923089][T14758] RDX: 000000000000000f RSI: 00007f86e7bc60a0 RDI: 0000000000000004 [ 815.923100][T14758] RBP: 00007f86e7bc6090 R08: 0000000000000000 R09: 0000000000000000 [ 815.923110][T14758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 815.923121][T14758] R13: 00007f86e7026038 R14: 00007f86e7025fa0 R15: 00007ffee86b1bf8 [ 815.923145][T14758] [ 816.137337][T14748] kvm: pic: level sensitive irq not supported [ 816.137611][T14748] kvm: pic: non byte read [ 816.148749][T14748] kvm: pic: level sensitive irq not supported [ 816.148801][T14748] kvm: pic: non byte read [ 816.181450][ T30] audit: type=1400 audit(1786471861.820:901): avc: denied { mounton } for pid=14764 comm="syz.4.2352" path="/493/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 816.181474][T14765] fuse: Unknown parameter 'fuse' [ 816.226075][T14765] device-mapper: ioctl: Invalid data size in the ioctl structure: 3137143096 [ 816.329960][ T992] memory length for this resource is wrong [ 816.343673][T14770] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2354'. [ 816.376467][T14770] syzkaller1: entered promiscuous mode [ 816.388655][T14770] syzkaller1: entered allmulticast mode [ 816.395226][T14766] isp1760 0000:00:06.0: probe with driver isp1760 failed with error -12 [ 816.539857][T14776] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2357'. [ 816.567493][T14776] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2357'. [ 816.594005][T14781] netlink: 'syz.5.2357': attribute type 1 has an invalid length. [ 816.667791][T11358] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 816.769320][ T30] audit: type=1400 audit(1786471862.400:902): avc: denied { connect } for pid=14786 comm="syz.3.2360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 816.797278][T14787] netlink: 420 bytes leftover after parsing attributes in process `syz.3.2360'. [ 816.839610][T11358] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 816.855777][T11358] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 816.879825][T11358] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 816.889242][T11358] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.910575][T11358] usb 2-1: Product: syz [ 816.921738][T11358] usb 2-1: Manufacturer: syz [ 816.940064][T11358] usb 2-1: SerialNumber: syz [ 816.985699][T11358] cdc_mbim 2-1:1.0: skipping garbage [ 817.792498][T14770] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 818.379251][T11358] cdc_mbim 2-1:1.0: failed GET_NTB_PARAMETERS [ 818.388378][T11358] cdc_mbim 2-1:1.0: bind() failure [ 818.398602][T11358] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 818.398640][T11358] cdc_ncm 2-1:1.1: bind() failure [ 818.402573][T11358] usb 2-1: USB disconnect, device number 97 [ 818.653625][T14808] kAFS: bad VL server IP address [ 818.653668][T14808] FAULT_INJECTION: forcing a failure. [ 818.653668][T14808] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 818.653686][T14808] CPU: 0 UID: 0 PID: 14808 Comm: syz.5.2367 Tainted: G L syzkaller #0 PREEMPT(full) [ 818.653702][T14808] Tainted: [L]=SOFTLOCKUP [ 818.653712][T14808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 818.653719][T14808] Call Trace: [ 818.653723][T14808] [ 818.653728][T14808] dump_stack_lvl+0x100/0x190 [ 818.653744][T14808] should_fail_ex.cold+0x5/0xa [ 818.653758][T14808] _copy_from_user+0x2e/0xd0 [ 818.653775][T14808] kstrtouint_from_user+0xd6/0x1d0 [ 818.653787][T14808] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 818.653798][T14808] ? __lock_acquire+0x49f/0x1a40 [ 818.653818][T14808] proc_fail_nth_write+0x83/0x220 [ 818.653835][T14808] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 818.653856][T14808] vfs_write+0x2aa/0x1050 [ 818.653873][T14808] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 818.653891][T14808] ? __pfx_vfs_write+0x10/0x10 [ 818.653907][T14808] ? __fget_files+0x215/0x3d0 [ 818.653922][T14808] ? __fget_files+0x21f/0x3d0 [ 818.653936][T14808] ksys_write+0x12a/0x250 [ 818.653946][T14808] ? __pfx_ksys_write+0x10/0x10 [ 818.653960][T14808] do_syscall_64+0x115/0x870 [ 818.653974][T14808] ? clear_bhb_loop+0x40/0x90 [ 818.653987][T14808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.653998][T14808] RIP: 0033:0x7f525f35e90e [ 818.654008][T14808] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 818.654021][T14808] RSP: 002b:00007f5260204fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 818.654032][T14808] RAX: ffffffffffffffda RBX: 00007f52602056c0 RCX: 00007f525f35e90e [ 818.654039][T14808] RDX: 0000000000000001 RSI: 00007f52602050a0 RDI: 0000000000000004 [ 818.654046][T14808] RBP: 00007f5260205090 R08: 0000000000000000 R09: 0000000000000000 [ 818.654052][T14808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 818.654058][T14808] R13: 00007f525f626038 R14: 00007f525f625fa0 R15: 00007ffcd5d09dc8 [ 818.654073][T14808] [ 818.835825][T14812] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 818.835857][T14812] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 818.839983][T14812] vhci_hcd vhci_hcd.0: Device attached [ 818.866334][T14812] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(5) [ 818.866353][T14812] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 818.866381][T14812] vhci_hcd vhci_hcd.0: Device attached [ 818.901414][T14812] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 818.917574][T14812] vhci_hcd vhci_hcd.0: pdev(5) rhport(3) sockfd(11) [ 818.917594][T14812] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 818.917618][T14812] vhci_hcd vhci_hcd.0: Device attached [ 818.996443][ T30] audit: type=1400 audit(1786471864.630:903): avc: denied { sys_module } for pid=14811 comm="syz.5.2368" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 819.088306][ T804] usb 43-1: new low-speed USB device number 2 using vhci_hcd [ 819.367988][T11358] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 819.502108][T11358] usb 6-1: device descriptor read/64, error -71 [ 819.754442][T11358] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 819.769556][T14828] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2370'. [ 819.928079][T11358] usb 6-1: device descriptor read/64, error -71 [ 820.042164][T11358] usb usb6-port1: attempt power cycle [ 820.378246][T11358] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 820.413716][T11358] usb 6-1: device descriptor read/8, error -71 [ 820.436125][ T30] audit: type=1400 audit(1786471866.070:904): avc: denied { rename } for pid=14835 comm="syz.3.2374" name="file0" dev="tmpfs" ino=2505 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 820.533806][ T30] audit: type=1400 audit(1786471866.170:905): avc: denied { cmd } for pid=14839 comm="syz.0.2375" path="/dev/ublk-control" dev="devtmpfs" ino=697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 820.668009][T11358] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 820.718591][T11358] usb 6-1: device descriptor read/8, error -71 [ 820.731165][T14834] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2372'. [ 820.867674][T11358] usb usb6-port1: unable to enumerate USB device [ 821.446421][T14857] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2379'. [ 821.763230][T14859] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 821.907133][T14817] vhci_hcd: connection closed [ 821.924587][T14815] vhci_hcd: connection closed [ 821.929361][T14813] vhci_hcd: connection reset by peer [ 822.018135][ T1113] vhci_hcd vhci_hcd.5: stop threads [ 822.049470][T14864] 0x000000000007-0x000000020000 : "" [ 822.089763][ T1113] vhci_hcd vhci_hcd.5: release socket [ 822.131233][T14865] netlink: 'syz.0.2380': attribute type 4 has an invalid length. [ 822.149974][T14864] ftl_cs: FTL header corrupt! [ 822.192520][ T1113] vhci_hcd vhci_hcd.5: disconnect device [ 822.294260][ T1113] vhci_hcd vhci_hcd.5: stop threads [ 822.309905][ T1113] vhci_hcd vhci_hcd.5: release socket [ 822.333507][ T1113] vhci_hcd vhci_hcd.5: disconnect device [ 822.364070][ T1113] vhci_hcd vhci_hcd.5: stop threads [ 822.389342][ T1113] vhci_hcd vhci_hcd.5: release socket [ 822.424937][ T1113] vhci_hcd vhci_hcd.5: disconnect device [ 822.518126][ T5728] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 823.689919][T14874] lo speed is unknown, defaulting to 1000 [ 823.720545][T14876] virtio-fs: tag not found [ 824.109553][ T5728] usb 2-1: config 255 has an invalid interface number: 97 but max is 0 [ 824.153817][ T5728] usb 2-1: config 255 has no interface number 0 [ 824.173218][ T5728] usb 2-1: config 255 interface 97 has no altsetting 0 [ 824.226322][ T804] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 824.255529][ T5728] usb 2-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 824.288895][ T5728] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 824.306315][ T5728] usb 2-1: Product: syz [ 824.318346][ T5728] usb 2-1: Manufacturer: syz [ 824.338078][ T5728] usb 2-1: SerialNumber: syz [ 824.484032][ T5728] rndis_host 2-1:255.97: ACM capabilities 01, not really RNDIS? [ 824.546789][ T5728] usb 2-1: USB disconnect, device number 98 [ 824.686375][T14892] FAULT_INJECTION: forcing a failure. [ 824.686375][T14892] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 824.736505][T14892] CPU: 1 UID: 0 PID: 14892 Comm: syz.0.2388 Tainted: G L syzkaller #0 PREEMPT(full) [ 824.736532][T14892] Tainted: [L]=SOFTLOCKUP [ 824.736539][T14892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 824.736549][T14892] Call Trace: [ 824.736555][T14892] [ 824.736563][T14892] dump_stack_lvl+0x100/0x190 [ 824.736589][T14892] should_fail_ex.cold+0x5/0xa [ 824.736612][T14892] _copy_from_iter+0x1f4/0x1690 [ 824.736650][T14892] ? __pfx__copy_from_iter+0x10/0x10 [ 824.736677][T14892] ? stack_trace_save+0x8e/0xc0 [ 824.736696][T14892] ? __pfx_stack_trace_save+0x10/0x10 [ 824.736720][T14892] ping_common_sendmsg+0xc4/0x2e0 [ 824.736744][T14892] ping_v4_sendmsg+0x192/0x19d0 [ 824.736768][T14892] ? check_prev_add+0x354/0xe60 [ 824.736790][T14892] ? __pfx_ping_v4_sendmsg+0x10/0x10 [ 824.736824][T14892] ? reacquire_held_locks+0xce/0x1e0 [ 824.736845][T14892] ? release_sock+0x21/0x280 [ 824.736882][T14892] ? inet_autobind+0x145/0x1a0 [ 824.736902][T14892] ? find_held_lock+0x2b/0x80 [ 824.736922][T14892] ? lockdep_hardirqs_on+0x78/0x100 [ 824.736944][T14892] ? inet_autobind+0x145/0x1a0 [ 824.736962][T14892] ? __local_bh_enable_ip+0x9e/0x120 [ 824.736985][T14892] ? inet_autobind+0x14a/0x1a0 [ 824.737005][T14892] ? __pfx_ping_v4_sendmsg+0x10/0x10 [ 824.737028][T14892] inet_sendmsg+0x11c/0x140 [ 824.737053][T14892] ____sys_sendmsg+0x9c9/0xbe0 [ 824.737077][T14892] ? __pfx_inet_sendmsg+0x10/0x10 [ 824.737103][T14892] ? __pfx_____sys_sendmsg+0x10/0x10 [ 824.737139][T14892] ___sys_sendmsg+0x190/0x1e0 [ 824.737157][T14892] ? __pfx____sys_sendmsg+0x10/0x10 [ 824.737174][T14892] ? __lock_acquire+0x49f/0x1a40 [ 824.737196][T14892] ? get_pid_task+0x106/0x250 [ 824.737240][T14892] __sys_sendmsg+0x160/0x210 [ 824.737264][T14892] ? __pfx___sys_sendmsg+0x10/0x10 [ 824.737301][T14892] do_syscall_64+0x115/0x870 [ 824.737323][T14892] ? clear_bhb_loop+0x40/0x90 [ 824.737345][T14892] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 824.737363][T14892] RIP: 0033:0x7fd3b539e0d9 [ 824.737379][T14892] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 824.737397][T14892] RSP: 002b:00007fd3b627a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 824.737415][T14892] RAX: ffffffffffffffda RBX: 00007fd3b5625fa0 RCX: 00007fd3b539e0d9 [ 824.737427][T14892] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 824.737438][T14892] RBP: 00007fd3b627a090 R08: 0000000000000000 R09: 0000000000000000 [ 824.737449][T14892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 824.737459][T14892] R13: 00007fd3b5626038 R14: 00007fd3b5625fa0 R15: 00007ffe2380e728 [ 824.737483][T14892] [ 826.108422][ T992] usb 2-1: new full-speed USB device number 99 using dummy_hcd [ 826.208344][ T5721] usb 6-1: new full-speed USB device number 64 using dummy_hcd [ 826.238488][ T992] usb 2-1: device descriptor read/64, error -71 [ 826.368485][ T5721] usb 6-1: device descriptor read/64, error -71 [ 826.498283][ T992] usb 2-1: new full-speed USB device number 100 using dummy_hcd [ 826.618558][ T5721] usb 6-1: new full-speed USB device number 65 using dummy_hcd [ 826.658324][ T992] usb 2-1: device descriptor read/64, error -71 [ 826.759939][ T5721] usb 6-1: device descriptor read/64, error -71 [ 826.779010][ T992] usb usb2-port1: attempt power cycle [ 826.881467][ T5721] usb usb6-port1: attempt power cycle [ 826.946715][ T30] audit: type=1400 audit(1786471872.580:906): avc: denied { connect } for pid=14910 comm="syz.0.2393" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 827.023652][ T30] audit: type=1400 audit(1786471872.600:907): avc: denied { unmount } for pid=5611 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 827.232577][T14918] rdma_rxe: rxe_newlink: failed to add lo [ 827.472619][ T992] usb 2-1: new full-speed USB device number 101 using dummy_hcd [ 827.517229][ T992] usb 2-1: device descriptor read/8, error -71 [ 827.629929][ T5721] usb 6-1: new full-speed USB device number 66 using dummy_hcd [ 827.693705][ T5721] usb 6-1: device descriptor read/8, error -71 [ 827.799244][ T992] usb 2-1: new full-speed USB device number 102 using dummy_hcd [ 827.864732][ T992] usb 2-1: device descriptor read/8, error -71 [ 827.978702][ T5721] usb 6-1: new full-speed USB device number 67 using dummy_hcd [ 828.031832][ T5721] usb 6-1: device descriptor read/8, error -71 [ 828.040928][ T30] audit: type=1400 audit(1786471873.680:908): avc: denied { name_bind } for pid=14925 comm="syz.0.2398" src=1792 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 828.048543][ T992] usb usb2-port1: unable to enumerate USB device [ 828.100477][T14929] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5611] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[14929] [ 828.154123][ T5721] usb usb6-port1: unable to enumerate USB device [ 828.268393][ T5812] usb 4-1: new full-speed USB device number 105 using dummy_hcd [ 828.348686][ T5612] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 828.418501][ T992] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 828.447913][ T5812] usb 4-1: New USB device found, idVendor=0582, idProduct=000c, bcdDevice= 0.40 [ 828.465519][ T5812] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 828.487475][ T5812] usb 4-1: Product: syz [ 828.500735][ T5812] usb 4-1: Manufacturer: syz [ 828.513021][ T5812] usb 4-1: SerialNumber: syz [ 828.543629][ T5612] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 828.578583][ T5612] usb 5-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 828.589036][ T992] usb 1-1: Using ep0 maxpacket: 8 [ 828.618405][ T5612] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.703361][T14930] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 828.733163][T14930] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 828.757440][T14924] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 828.766180][T14929] syz_tun: entered allmulticast mode [ 828.783101][T14924] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 828.865386][T11358] usb 5-1: USB disconnect, device number 102 [ 828.922768][T14934] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2399'. [ 829.035352][ T30] audit: type=1400 audit(1786471874.670:909): avc: denied { bind } for pid=14923 comm="syz.3.2395" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 829.063097][T14936] kAFS: bad VL server IP address [ 829.107969][T14938] netlink: 100 bytes leftover after parsing attributes in process `syz.5.2401'. [ 829.318970][ T5812] usb 4-1: 1:1 : format type 0 is detected, processed as PCM [ 829.350656][T14944] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 829.511193][ T5812] usb 4-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 829.550284][ T5812] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 829.566777][ T5812] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 829.605958][ T5812] usb 4-1: 1:1 : format type 0 is detected, processed as PCM [ 829.638830][ T5812] usb 4-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 829.646780][T14946] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2402'. [ 829.655644][ T5812] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 829.672835][ T5812] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 829.700048][ T5812] usb 4-1: 1:1 : format type 0 is detected, processed as PCM [ 829.724024][ T5812] usb 4-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 829.742855][ T5812] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 829.764584][T14948] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2403'. [ 829.780887][ T5612] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 829.799921][T14948] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2403'. [ 829.835787][T14948] netlink: 'syz.4.2403': attribute type 1 has an invalid length. [ 829.871019][ T5812] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 829.910675][ T5812] usb 4-1: USB disconnect, device number 105 [ 829.933437][T14948] 8021q: adding VLAN 0 to HW filter on device bond2 [ 829.954827][ T5957] udevd[5957]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 829.989549][ T5612] usb 6-1: config 255 has an invalid interface number: 97 but max is 0 [ 830.007814][ T5612] usb 6-1: config 255 has no interface number 0 [ 830.034616][ T5612] usb 6-1: config 255 interface 97 has no altsetting 0 [ 830.045398][ T5612] usb 6-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 830.061280][ T5612] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 830.086126][ T5612] usb 6-1: Product: syz [ 830.091826][T14951] bond2: (slave geneve2): making interface the new active one [ 830.095291][ T5612] usb 6-1: Manufacturer: syz [ 830.116932][ T5612] usb 6-1: SerialNumber: syz [ 830.125876][T14951] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 830.505245][T14958] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2405'. [ 831.151731][T14964] rdma_rxe: rxe_newlink: failed to add lo [ 831.215446][ T992] usb 1-1: unable to get BOS descriptor or descriptor too short [ 831.266024][ T992] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 831.302822][ T992] usb 1-1: can't read configurations, error -71 [ 831.700225][T14975] syz2: rxe_newlink: already configured on lo [ 832.184091][ T5612] rndis_host 6-1:255.97: ACM capabilities 01, not really RNDIS? [ 832.202867][T14977] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2411'. [ 832.262864][ T992] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 832.381614][ T5612] usb 6-1: USB disconnect, device number 68 [ 832.509619][ T992] usb 1-1: Using ep0 maxpacket: 32 [ 832.554107][ T992] usb 1-1: unable to get BOS descriptor or descriptor too short [ 832.605411][ T992] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 832.648445][ T992] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 832.726177][ T992] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000c, bcdDevice= 0.40 [ 832.738437][T11358] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 832.762929][ T992] usb 1-1: New USB device strings: Mfr=2, Product=2, SerialNumber=3 [ 832.804612][ T992] usb 1-1: Product: syz [ 832.830098][ T992] usb 1-1: Manufacturer: syz [ 832.869747][ T992] usb 1-1: SerialNumber: syz [ 833.614567][ T992] usb 1-1: 3:0: cannot get min/max values for control 2 (id 3) [ 833.637236][ T992] usb 1-1: applying playback min mute quirk [ 833.653586][ T992] usb 1-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 833.675725][ T992] usb 1-1: [3] FU [Й Playback Volume] ch = 1, val = 0/1/1 [ 833.704996][ T992] usb 1-1: 3:0: cannot get min/max values for control 8 (id 3) [ 833.718509][T11358] usb 5-1: device descriptor read/64, error -71 [ 833.736768][ T992] usb 1-1: 3:0: failed to get current value for ch 1 (-71) [ 833.777722][ T992] usb 1-1: 3:0: failed to get current value for ch 1 (-71) [ 833.876091][T14998] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2417'. [ 833.909956][T14998] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2417'. [ 833.918102][ T992] usb 1-1: USB disconnect, device number 102 [ 833.927327][T14999] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2416'. [ 833.944785][T15000] netlink: 'syz.1.2417': attribute type 1 has an invalid length. [ 833.986433][T11358] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 834.003867][T15000] 8021q: adding VLAN 0 to HW filter on device bond2 [ 834.030496][T14998] bond2: (slave geneve2): making interface the new active one [ 834.062103][T14998] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 834.149134][T11358] usb 5-1: device descriptor read/64, error -71 [ 834.279746][T11358] usb usb5-port1: attempt power cycle [ 834.415404][T15007] FAULT_INJECTION: forcing a failure. [ 834.415404][T15007] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 834.464059][T15007] CPU: 1 UID: 0 PID: 15007 Comm: syz.0.2419 Tainted: G L syzkaller #0 PREEMPT(full) [ 834.464080][T15007] Tainted: [L]=SOFTLOCKUP [ 834.464085][T15007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 834.464092][T15007] Call Trace: [ 834.464096][T15007] [ 834.464100][T15007] dump_stack_lvl+0x100/0x190 [ 834.464120][T15007] should_fail_ex.cold+0x5/0xa [ 834.464134][T15007] _copy_from_user+0x2e/0xd0 [ 834.464151][T15007] get_user_ifreq+0xe7/0x250 [ 834.464168][T15007] bt_sock_ioctl+0x2f8/0x580 [ 834.464180][T15007] ? __pfx_bt_sock_ioctl+0x10/0x10 [ 834.464192][T15007] ? find_held_lock+0x2b/0x80 [ 834.464206][T15007] ? tomoyo_path_number_perm+0x188/0x580 [ 834.464224][T15007] rfcomm_sock_ioctl+0x50/0xf0 [ 834.464241][T15007] sock_do_ioctl+0x118/0x280 [ 834.464258][T15007] ? __pfx_sock_do_ioctl+0x10/0x10 [ 834.464278][T15007] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 834.464295][T15007] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 834.464315][T15007] sock_ioctl+0x599/0x6b0 [ 834.464327][T15007] ? __pfx_sock_ioctl+0x10/0x10 [ 834.464337][T15007] ? hook_file_ioctl_common+0x140/0x440 [ 834.464354][T15007] ? selinux_file_ioctl+0x13b/0x290 [ 834.464370][T15007] ? selinux_file_ioctl+0xb6/0x290 [ 834.464388][T15007] ? __pfx_sock_ioctl+0x10/0x10 [ 834.464402][T15007] __x64_sys_ioctl+0x18e/0x210 [ 834.464425][T15007] do_syscall_64+0x115/0x870 [ 834.464439][T15007] ? clear_bhb_loop+0x40/0x90 [ 834.464452][T15007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 834.464463][T15007] RIP: 0033:0x7fd3b539e0d9 [ 834.464473][T15007] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 834.464483][T15007] RSP: 002b:00007fd3b627a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 834.464494][T15007] RAX: ffffffffffffffda RBX: 00007fd3b5625fa0 RCX: 00007fd3b539e0d9 [ 834.464501][T15007] RDX: 0000200000000100 RSI: 0000000000008946 RDI: 0000000000000004 [ 834.464508][T15007] RBP: 00007fd3b627a090 R08: 0000000000000000 R09: 0000000000000000 [ 834.464514][T15007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 834.464520][T15007] R13: 00007fd3b5626038 R14: 00007fd3b5625fa0 R15: 00007ffe2380e728 [ 834.464533][T15007] [ 834.768493][T11358] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 834.790159][T11358] usb 5-1: device descriptor read/8, error -71 [ 834.958283][T15013] netlink: 100 bytes leftover after parsing attributes in process `syz.0.2422'. [ 835.038483][T11358] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 835.070771][T11358] usb 5-1: device descriptor read/8, error -71 [ 835.117583][T15018] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 835.210416][T11358] usb usb5-port1: unable to enumerate USB device [ 835.588510][ T5612] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 835.673907][T15029] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2427'. [ 835.746913][T15029] 8021q: adding VLAN 0 to HW filter on device bond3 [ 835.764057][ T5612] usb 1-1: config 255 has an invalid interface number: 97 but max is 0 [ 836.292013][ T5612] usb 1-1: config 255 has no interface number 0 [ 836.318529][ T5612] usb 1-1: config 255 interface 97 has no altsetting 0 [ 836.345382][ T5612] usb 1-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 836.351161][T15031] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 836.365355][ T5612] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.396093][ T5612] usb 1-1: Product: syz [ 836.404031][ T5612] usb 1-1: Manufacturer: syz [ 836.420014][ T5612] usb 1-1: SerialNumber: syz [ 836.489012][T15034] bond3 (unregistering): (slave gretap1): Releasing backup interface [ 836.603483][T15034] bond3 (unregistering): Released all slaves [ 836.713943][T15043] tipc: Started in network mode [ 836.735109][T15043] tipc: Node identity da5465996c07, cluster identity 4711 [ 836.763804][T15043] tipc: Enabled bearer , priority 0 [ 836.819153][ T992] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 836.835202][T15040] syzkaller0: entered promiscuous mode [ 836.850856][T15040] syzkaller0: entered allmulticast mode [ 836.893358][T15031] lo speed is unknown, defaulting to 1000 [ 836.903535][T15040] device-mapper: ioctl: only supply one of name or uuid, cmd(9) [ 836.931276][T15038] tipc: Resetting bearer [ 836.992887][ T992] usb 6-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 837.003001][T15038] tipc: Disabling bearer [ 837.018818][ T992] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 837.037056][ T992] usb 6-1: Product: 祳z [ 837.047104][ T992] usb 6-1: Manufacturer: 祳z [ 837.057224][ T992] usb 6-1: SerialNumber: 祳z [ 837.078766][ T992] etas_es58x 6-1:1.0: Starting 祳z 祳z (Serial Number 祳z) [ 837.164947][T15047] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2432'. [ 837.248684][ T5728] usb 5-1: new full-speed USB device number 107 using dummy_hcd [ 837.507084][ T5728] usb 5-1: device descriptor read/64, error -71 [ 837.768545][ T5728] usb 5-1: new full-speed USB device number 108 using dummy_hcd [ 837.828992][T15029] lo speed is unknown, defaulting to 1000 [ 837.918526][ T5728] usb 5-1: device descriptor read/64, error -71 [ 837.949579][ T5612] rndis_host 1-1:255.97: ACM capabilities 01, not really RNDIS? [ 837.996154][ T5612] usb 1-1: USB disconnect, device number 103 [ 838.060309][ T5728] usb usb5-port1: attempt power cycle [ 838.615073][ T992] etas_es58x 6-1:1.0: could not retrieve the product info string [ 838.654362][ T5728] usb 5-1: new full-speed USB device number 109 using dummy_hcd [ 838.671998][ T5612] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 838.729330][ T5728] usb 5-1: device descriptor read/8, error -71 [ 838.855655][ T5612] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 838.889606][ T5612] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 838.925829][ T5612] usb 1-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 838.949046][ T992] usb 6-1: USB disconnect, device number 69 [ 838.965688][ T5612] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 838.976373][ T992] etas_es58x 6-1:1.0: Disconnecting 祳z 祳z [ 838.988798][ T5728] usb 5-1: new full-speed USB device number 110 using dummy_hcd [ 839.025929][ T5728] usb 5-1: device descriptor read/8, error -71 [ 839.149517][ T5728] usb usb5-port1: unable to enumerate USB device [ 839.319349][ T5612] usb 1-1: USB disconnect, device number 104 [ 839.976402][T15069] rdma_rxe: rxe_newlink: failed to add lo [ 839.976407][T15081] rdma_rxe: rxe_newlink: failed to add lo [ 840.217163][ T30] audit: type=1400 audit(1786471885.849:910): avc: denied { write } for pid=15074 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 840.407983][ T30] audit: type=1400 audit(1786471886.039:911): avc: denied { write } for pid=15099 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 840.450064][ T5612] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 840.568590][ T5728] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 840.613325][ T5612] usb 6-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 840.626282][ T5612] usb 6-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 840.645619][ T5612] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 841.167062][ T5728] usb 1-1: device descriptor read/64, error -71 [ 841.201618][T15091] FAULT_INJECTION: forcing a failure. [ 841.201618][T15091] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 841.249081][T15091] CPU: 1 UID: 0 PID: 15091 Comm: syz.5.2439 Tainted: G L syzkaller #0 PREEMPT(full) [ 841.249111][T15091] Tainted: [L]=SOFTLOCKUP [ 841.249118][T15091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 841.249129][T15091] Call Trace: [ 841.249135][T15091] [ 841.249143][T15091] dump_stack_lvl+0x100/0x190 [ 841.249171][T15091] should_fail_ex.cold+0x5/0xa [ 841.249195][T15091] _copy_to_user+0x32/0xd0 [ 841.249222][T15091] simple_read_from_buffer+0xcb/0x170 [ 841.249245][T15091] proc_fail_nth_read+0x1af/0x230 [ 841.249273][T15091] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 841.249303][T15091] ? rw_verify_area+0xce/0x6d0 [ 841.249328][T15091] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 841.249355][T15091] vfs_read+0x1e4/0xb40 [ 841.249386][T15091] ? __pfx_vfs_read+0x10/0x10 [ 841.249412][T15091] ? __fget_files+0x215/0x3d0 [ 841.249442][T15091] ? __fget_files+0x21f/0x3d0 [ 841.249468][T15091] ksys_read+0x12a/0x250 [ 841.249494][T15091] ? __pfx_ksys_read+0x10/0x10 [ 841.249529][T15091] do_syscall_64+0x115/0x870 [ 841.249551][T15091] ? clear_bhb_loop+0x40/0x90 [ 841.249573][T15091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 841.249592][T15091] RIP: 0033:0x7f525f35e90e [ 841.249608][T15091] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 841.249626][T15091] RSP: 002b:00007f5260204fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 841.249643][T15091] RAX: ffffffffffffffda RBX: 00007f52602056c0 RCX: 00007f525f35e90e [ 841.249655][T15091] RDX: 000000000000000f RSI: 00007f52602050a0 RDI: 0000000000000004 [ 841.249667][T15091] RBP: 00007f5260205090 R08: 0000000000000000 R09: 0000000000000000 [ 841.249677][T15091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 841.249690][T15091] R13: 00007f525f626038 R14: 00007f525f625fa0 R15: 00007ffcd5d09dc8 [ 841.249715][T15091] [ 841.547680][T15049] usb 6-1: USB disconnect, device number 70 [ 841.618583][ T5728] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 841.715733][T15115] netlink: 100 bytes leftover after parsing attributes in process `syz.5.2443'. [ 841.758894][ T5728] usb 1-1: device descriptor read/64, error -71 [ 841.916372][ T5728] usb usb1-port1: attempt power cycle [ 842.001038][T15124] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 842.030593][T15126] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2446'. [ 842.074684][ T30] audit: type=1400 audit(1786471887.709:912): avc: denied { write } for pid=15104 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 842.189899][T15130] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 842.368691][ T5728] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 842.490781][ T5728] usb 1-1: device descriptor read/8, error -71 [ 842.694661][ T5812] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 842.722509][ T30] audit: type=1400 audit(1786471888.359:913): avc: denied { write } for pid=15132 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 842.803049][T15136] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 843.159413][ T30] audit: type=1400 audit(1786471888.439:914): avc: denied { create } for pid=15133 comm="syz.3.2447" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 843.190455][ T30] audit: type=1400 audit(1786471888.449:915): avc: denied { map } for pid=15133 comm="syz.3.2447" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 843.198626][ T5728] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 843.230787][ T5812] usb 5-1: config 255 has an invalid interface number: 97 but max is 0 [ 843.246768][ T30] audit: type=1400 audit(1786471888.449:916): avc: denied { execute } for pid=15133 comm="syz.3.2447" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 843.274831][ T5812] usb 5-1: config 255 has no interface number 0 [ 843.281216][ T992] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 843.296530][ T5812] usb 5-1: config 255 interface 97 has no altsetting 0 [ 843.325779][ T5728] usb 1-1: device descriptor read/8, error -71 [ 843.327828][ T5812] usb 5-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 843.367719][ T5812] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 843.396111][ T5812] usb 5-1: Product: syz [ 843.405589][ T5812] usb 5-1: Manufacturer: syz [ 843.484345][ T30] audit: type=1400 audit(1786471889.109:917): avc: denied { unlink } for pid=5609 comm="syz-executor" name="file0" dev="tmpfs" ino=2566 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 843.487662][ T5728] usb usb1-port1: unable to enumerate USB device [ 843.542128][ T5812] usb 5-1: SerialNumber: syz [ 843.676102][ T992] usb 6-1: config 255 has an invalid interface number: 97 but max is 0 [ 843.690686][ T992] usb 6-1: config 255 has no interface number 0 [ 843.703936][ T992] usb 6-1: config 255 interface 97 has no altsetting 0 [ 844.112692][T15147] rdma_rxe: rxe_newlink: failed to add lo [ 844.144228][ T992] usb 6-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 844.166053][ T992] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 844.204509][ T992] usb 6-1: Product: syz [ 844.231753][ T992] usb 6-1: Manufacturer: syz [ 844.275902][ T992] usb 6-1: SerialNumber: syz [ 844.769057][ T5728] usb 1-1: new full-speed USB device number 109 using dummy_hcd [ 844.918645][ T5728] usb 1-1: device descriptor read/64, error -71 [ 844.973504][ T992] rndis_host 6-1:255.97: ACM capabilities 01, not really RNDIS? [ 845.013938][ T992] usb 6-1: USB disconnect, device number 71 [ 846.105137][ T5812] rndis_host 5-1:255.97: ACM capabilities 01, not really RNDIS? [ 846.119001][ T5728] usb 1-1: new full-speed USB device number 110 using dummy_hcd [ 846.140556][ T5812] usb 5-1: USB disconnect, device number 111 [ 846.290541][ T5728] usb 1-1: device descriptor read/64, error -71 [ 846.399006][ T5728] usb usb1-port1: attempt power cycle [ 846.723318][ T30] audit: type=1800 audit(1786471892.359:918): pid=15184 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.2455" name="addr_trtype" dev="configfs" ino=57200 res=0 errno=0 [ 846.748763][ T5728] usb 1-1: new full-speed USB device number 111 using dummy_hcd [ 846.779106][ T5728] usb 1-1: device descriptor read/8, error -71 [ 846.878702][ T5812] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 846.984893][T15186] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2460'. [ 847.033834][ T5812] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 847.038692][ T5728] usb 1-1: new full-speed USB device number 112 using dummy_hcd [ 847.114075][ T5728] usb 1-1: device descriptor read/8, error -71 [ 847.116063][ T5812] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 847.250329][ T5728] usb usb1-port1: unable to enumerate USB device [ 847.340954][ T5812] usb 4-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 847.351385][ T5812] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 847.554597][T15192] xt_hashlimit: size too large, truncated to 1048576 [ 847.606187][ T30] audit: type=1400 audit(1786471893.239:919): avc: denied { bind } for pid=15191 comm="syz.0.2462" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 847.609554][T15182] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2459'. [ 848.630847][ T5812] usb 4-1: USB disconnect, device number 106 [ 848.671376][T15208] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35 sclass=netlink_route_socket pid=15208 comm=syz.5.2468 [ 848.941780][T15216] syz2: rxe_newlink: already configured on lo [ 849.176021][T15215] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2470'. [ 849.185112][T15215] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2470'. [ 849.223440][T15215] netlink: 'syz.5.2470': attribute type 1 has an invalid length. [ 849.387986][T15215] 8021q: adding VLAN 0 to HW filter on device bond3 [ 849.754008][T15227] 0x000000000007-0x000000020000 : "" [ 849.794350][T15213] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2469'. [ 849.830650][T15228] netlink: 'syz.5.2472': attribute type 4 has an invalid length. [ 849.850632][T15227] ftl_cs: FTL header corrupt! [ 849.919822][T15049] usb 5-1: new full-speed USB device number 112 using dummy_hcd [ 850.091611][T15049] usb 5-1: device descriptor read/64, error -71 [ 850.381224][T15049] usb 5-1: new full-speed USB device number 113 using dummy_hcd [ 850.513998][ T5857] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 850.730961][T15049] usb 5-1: device descriptor read/64, error -71 [ 850.959698][T15049] usb usb5-port1: attempt power cycle [ 851.308691][T15049] usb 5-1: new full-speed USB device number 114 using dummy_hcd [ 851.329114][T15049] usb 5-1: device descriptor read/8, error -71 [ 851.362154][T15236] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2474'. [ 851.400247][ T5857] usb 4-1: Using ep0 maxpacket: 16 [ 851.407109][ T5857] usb 4-1: unable to get BOS descriptor or descriptor too short [ 851.432585][ T5857] usb 4-1: config 1 has an invalid interface number: 62 but max is 0 [ 851.450136][ T5857] usb 4-1: config 1 has no interface number 0 [ 851.456259][ T5857] usb 4-1: config 1 interface 62 has no altsetting 0 [ 851.465084][ T5857] usb 4-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=b6.61 [ 851.474275][ T5857] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 851.486049][ T5857] usb 4-1: Product: syz [ 851.491391][ T5857] usb 4-1: Manufacturer: syz [ 852.412622][ T5857] usb 4-1: SerialNumber: syz [ 852.419744][ T57] rpcbind: server 127.0.0.1 not responding, timed out [ 852.470889][T15049] usb 5-1: new full-speed USB device number 115 using dummy_hcd [ 852.509170][T15049] usb 5-1: device descriptor read/8, error -71 [ 852.619045][T15049] usb usb5-port1: unable to enumerate USB device [ 852.651843][ T5857] visor 4-1:1.62: Sony Clie 3.5 converter detected [ 852.667600][ T5857] usb 4-1: clie_3_5_startup: get config number failed: -71 [ 852.685972][ T5857] visor 4-1:1.62: probe with driver visor failed with error -71 [ 852.707638][ T5857] usb 4-1: USB disconnect, device number 107 [ 852.788715][ T5812] usb 6-1: new full-speed USB device number 72 using dummy_hcd [ 852.904624][T15258] logitech-hidpp-device 0005:046D:B012.0021: received hid++ report of bad size (5) [ 852.917037][T15258] CPU: 1 UID: 0 PID: 15258 Comm: syz.3.2481 Tainted: G L syzkaller #0 PREEMPT(full) [ 852.917067][T15258] Tainted: [L]=SOFTLOCKUP [ 852.917074][T15258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 852.917086][T15258] Call Trace: [ 852.917093][T15258] [ 852.917101][T15258] dump_stack_lvl+0x100/0x190 [ 852.917129][T15258] hid_report_raw_event.cold+0xbd/0xf0 [ 852.917159][T15258] ? mark_held_locks+0x40/0x70 [ 852.917181][T15258] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 852.917201][T15258] ? lockdep_hardirqs_on+0x78/0x100 [ 852.917227][T15258] __hid_input_report.constprop.0+0x349/0x470 [ 852.917253][T15258] ? __pfx_hidpp_raw_event+0x10/0x10 [ 852.917292][T15258] uhid_char_write+0xb6b/0x10e0 [ 852.917319][T15258] vfs_write+0x2aa/0x1050 [ 852.917350][T15258] ? __pfx_uhid_char_write+0x10/0x10 [ 852.917374][T15258] ? __pfx_vfs_write+0x10/0x10 [ 852.917403][T15258] ? find_held_lock+0x2b/0x80 [ 852.917420][T15258] ? __fget_files+0x215/0x3d0 [ 852.917440][T15258] ? __fget_files+0x215/0x3d0 [ 852.917465][T15258] ? __fget_files+0x21f/0x3d0 [ 852.917490][T15258] ksys_write+0x1f8/0x250 [ 852.917508][T15258] ? __pfx_ksys_write+0x10/0x10 [ 852.917533][T15258] do_syscall_64+0x115/0x870 [ 852.917557][T15258] ? clear_bhb_loop+0x40/0x90 [ 852.917581][T15258] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.917601][T15258] RIP: 0033:0x7f235a19e0d9 [ 852.917617][T15258] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 852.917635][T15258] RSP: 002b:00007f235b048028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 852.917654][T15258] RAX: ffffffffffffffda RBX: 00007f235a425fa0 RCX: 00007f235a19e0d9 [ 852.917666][T15258] RDX: 000000000000000b RSI: 0000200000000300 RDI: 0000000000000005 [ 852.917678][T15258] RBP: 00007f235a235024 R08: 0000000000000000 R09: 0000000000000000 [ 852.917690][T15258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 852.917702][T15258] R13: 00007f235a426038 R14: 00007f235a425fa0 R15: 00007fff690be818 [ 852.917728][T15258] [ 853.187530][ T5812] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 853.263389][T15258] logitech-hidpp-device 0005:046D:B012.0021: received hid++ report of bad size (2) [ 853.338435][ T5812] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 4 [ 853.356289][T15258] CPU: 0 UID: 0 PID: 15258 Comm: syz.3.2481 Tainted: G L syzkaller #0 PREEMPT(full) [ 853.356316][T15258] Tainted: [L]=SOFTLOCKUP [ 853.356324][T15258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 853.356336][T15258] Call Trace: [ 853.356343][T15258] [ 853.356352][T15258] dump_stack_lvl+0x100/0x190 [ 853.356380][T15258] hid_report_raw_event.cold+0xbd/0xf0 [ 853.356411][T15258] ? mark_held_locks+0x40/0x70 [ 853.356435][T15258] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 853.356459][T15258] ? lockdep_hardirqs_on+0x78/0x100 [ 853.356487][T15258] __hid_input_report.constprop.0+0x349/0x470 [ 853.356529][T15258] ? __pfx_hidpp_raw_event+0x10/0x10 [ 853.356558][T15258] uhid_char_write+0xb6b/0x10e0 [ 853.356583][T15258] vfs_write+0x2aa/0x1050 [ 853.356613][T15258] ? __pfx_uhid_char_write+0x10/0x10 [ 853.356635][T15258] ? __pfx_vfs_write+0x10/0x10 [ 853.356663][T15258] ? find_held_lock+0x2b/0x80 [ 853.356680][T15258] ? __fget_files+0x215/0x3d0 [ 853.356700][T15258] ? __fget_files+0x215/0x3d0 [ 853.356724][T15258] ? __fget_files+0x21f/0x3d0 [ 853.356751][T15258] ksys_write+0x1f8/0x250 [ 853.356767][T15258] ? __pfx_ksys_write+0x10/0x10 [ 853.356792][T15258] do_syscall_64+0x115/0x870 [ 853.356815][T15258] ? clear_bhb_loop+0x40/0x90 [ 853.356838][T15258] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 853.356857][T15258] RIP: 0033:0x7f235a19e0d9 [ 853.356874][T15258] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 853.356892][T15258] RSP: 002b:00007f235b048028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 853.356910][T15258] RAX: ffffffffffffffda RBX: 00007f235a425fa0 RCX: 00007f235a19e0d9 [ 853.356922][T15258] RDX: 0000000000000008 RSI: 0000200000000500 RDI: 0000000000000005 [ 853.356934][T15258] RBP: 00007f235a235024 R08: 0000000000000000 R09: 0000000000000000 [ 853.356945][T15258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 853.356957][T15258] R13: 00007f235a426038 R14: 00007f235a425fa0 R15: 00007fff690be818 [ 853.356982][T15258] [ 853.564553][ T5812] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 853.577368][ T5812] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 853.586399][ T5812] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 853.599063][ T5812] usb 6-1: config 0 descriptor?? [ 853.820157][T15049] logitech-hidpp-device 0005:046D:B012.0021: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 853.836756][T15266] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 853.860923][ T5812] ath6kl: Failed to submit usb control message: -71 [ 853.913357][ T5812] ath6kl: unable to send the bmi data to the device: -71 [ 853.933823][ T5812] ath6kl: Unable to send get target info: -71 [ 853.964835][ T5812] ath6kl: Failed to init ath6kl core: -71 [ 853.988076][ T5812] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 854.052091][ T5812] usb 6-1: USB disconnect, device number 72 [ 854.068428][T15277] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2483'. [ 854.086938][T15277] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2483'. [ 854.099024][T15279] netlink: 100 bytes leftover after parsing attributes in process `syz.0.2485'. [ 854.110046][T15277] netlink: 'syz.4.2483': attribute type 1 has an invalid length. [ 854.143004][T15277] 8021q: adding VLAN 0 to HW filter on device bond3 [ 854.854730][T15283] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 855.163457][T15289] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2486'. [ 855.299703][ T5812] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 855.930279][ T5812] usb 1-1: config 255 has an invalid interface number: 97 but max is 0 [ 855.947550][ T5812] usb 1-1: config 255 has no interface number 0 [ 855.965973][ T5812] usb 1-1: config 255 interface 97 has no altsetting 0 [ 855.984377][ T5812] usb 1-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 856.095037][T15303] syzkaller1: entered promiscuous mode [ 856.100584][T15303] syzkaller1: entered allmulticast mode [ 856.351622][T15049] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 856.606287][T15049] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 856.636675][ T5812] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 856.637799][T15049] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 856.685636][T15049] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 856.696751][T15049] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 856.698708][ T5812] usb 1-1: Product: syz [ 856.705635][T15049] usb 5-1: Product: syz [ 856.715427][T15049] usb 5-1: Manufacturer: syz [ 856.722907][T15049] usb 5-1: SerialNumber: syz [ 856.741325][ T5812] usb 1-1: Manufacturer: syz [ 856.742442][T15049] cdc_mbim 5-1:1.0: skipping garbage [ 856.758858][ T5812] usb 1-1: SerialNumber: syz [ 856.967151][T11358] libceph: connect (1)[c::]:6789 error -101 [ 856.969007][T15298] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 856.976156][T11358] libceph: mon0 (1)[c::]:6789 connect error [ 857.005735][T11358] libceph: connect (1)[c::]:6789 error -101 [ 857.015305][T11358] libceph: mon0 (1)[c::]:6789 connect error [ 857.096065][T15316] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2494'. [ 857.169219][T15310] ceph: No mds server is up or the cluster is laggy [ 857.277924][T15324] team0 (unregistering): Port device team_slave_0 removed [ 857.320886][T15324] team0 (unregistering): Port device team_slave_1 removed [ 857.368901][T11358] usb 4-1: new full-speed USB device number 108 using dummy_hcd [ 857.479743][T15049] cdc_mbim 5-1:1.0: failed GET_NTB_PARAMETERS [ 857.492946][T15049] cdc_mbim 5-1:1.0: bind() failure [ 857.517312][T15049] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 857.524677][T11358] usb 4-1: device descriptor read/64, error -71 [ 857.538732][ T29] usb 2-1: new full-speed USB device number 103 using dummy_hcd [ 857.549458][T15049] cdc_ncm 5-1:1.1: bind() failure [ 857.562969][T15049] usb 5-1: USB disconnect, device number 116 [ 857.701111][ T29] usb 2-1: unable to get BOS descriptor or descriptor too short [ 857.722172][ T29] usb 2-1: not running at top speed; connect to a high speed hub [ 857.739720][ T29] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 857.758306][ T29] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 857.769837][ T29] usb 2-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 857.782406][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 857.790538][T11358] usb 4-1: new full-speed USB device number 109 using dummy_hcd [ 857.798810][ T29] usb 2-1: Product: syz [ 857.806004][ T29] usb 2-1: Manufacturer: syz [ 857.810884][ T29] usb 2-1: SerialNumber: syz [ 857.928769][T11358] usb 4-1: device descriptor read/64, error -71 [ 857.928776][ T992] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 858.068234][T11358] usb usb4-port1: attempt power cycle [ 858.081968][ T992] usb 6-1: device descriptor read/64, error -71 [ 858.099162][ T5812] rndis_host 1-1:255.97: ACM capabilities 01, not really RNDIS? [ 858.128909][ T5812] usb 1-1: USB disconnect, device number 113 [ 858.201328][T15321] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 858.227030][T15321] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 858.242043][T15329] SET target dimension over the limit! [ 858.348886][ T992] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 858.369872][ T29] usb 2-1: 3:0: failed to get current value for ch 1 (-71) [ 858.405704][ T29] usb 2-1: 3:0: cannot get min/max values for control 5 (id 3) [ 858.419526][T11358] usb 4-1: new full-speed USB device number 110 using dummy_hcd [ 858.459325][T11358] usb 4-1: device descriptor read/8, error -71 [ 858.483530][ T29] usb 2-1: 3:0: cannot get min/max values for control 5 (id 3) [ 858.495403][ T992] usb 6-1: device descriptor read/64, error -71 [ 858.594091][ T29] usb 2-1: USB disconnect, device number 103 [ 858.640628][ T5950] udevd[5950]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 858.712552][T15341] syz2: rxe_newlink: already configured on lo [ 858.922988][T11358] usb 4-1: new full-speed USB device number 111 using dummy_hcd [ 858.947510][ T992] usb usb6-port1: attempt power cycle [ 858.994630][T11358] usb 4-1: device descriptor read/8, error -71 [ 859.119602][T11358] usb usb4-port1: unable to enumerate USB device [ 859.310814][ T992] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 859.411395][ T992] usb 6-1: device descriptor read/8, error -71 [ 860.873778][ T992] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 861.110275][ T30] audit: type=1400 audit(1786471906.719:920): avc: denied { write } for pid=15334 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 861.201291][T15370] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2506'. [ 861.210452][ T992] usb 6-1: device not accepting address 76, error -71 [ 861.222696][ T992] usb usb6-port1: unable to enumerate USB device [ 861.248084][T15363] netlink: 'syz.1.2504': attribute type 2 has an invalid length. [ 861.279895][ T30] audit: type=1400 audit(1786471906.909:921): avc: denied { write } for pid=15372 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 861.362535][ T5274] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 861.463492][T15378] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2509'. [ 861.470039][T15376] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 861.579689][ T29] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 861.698176][T15380] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 861.930611][ T29] usb 5-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice=c4.36 [ 861.959577][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 861.992134][ T29] usb 5-1: Product: syz [ 862.006351][ T29] usb 5-1: Manufacturer: syz [ 862.026366][ T29] usb 5-1: SerialNumber: syz [ 862.048833][ T5812] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 862.103287][T15049] logitech-hidpp-device 0005:046D:B012.0022: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 862.225866][ T5812] usb 2-1: config 255 has an invalid interface number: 97 but max is 0 [ 862.267665][ T5812] usb 2-1: config 255 has no interface number 0 [ 862.293045][ T29] mdc800 5-1:39.0: probe fails -> wrong Number of Configuration [ 862.302922][T15049] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 862.335770][ T5812] usb 2-1: config 255 interface 97 has no altsetting 0 [ 862.346011][T15383] fido_id[15383]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 862.374730][ T5812] usb 2-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 862.394506][ T5812] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 862.402659][T15385] netlink: 100 bytes leftover after parsing attributes in process `syz.5.2511'. [ 862.426557][ T5812] usb 2-1: Product: syz [ 862.432327][ T29] usb 5-1: USB disconnect, device number 117 [ 862.466106][ T5812] usb 2-1: Manufacturer: syz [ 862.491957][ T5812] usb 2-1: SerialNumber: syz [ 862.523690][T15049] usb 4-1: config 255 has an invalid interface number: 97 but max is 0 [ 862.561344][T15049] usb 4-1: config 255 has no interface number 0 [ 862.588487][T15049] usb 4-1: config 255 interface 97 has no altsetting 0 [ 862.620752][T15049] usb 4-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 862.656691][T15049] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 862.658261][T15387] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 862.719602][T15049] usb 4-1: Product: syz [ 862.736157][T15049] usb 4-1: Manufacturer: syz [ 862.742025][T15049] usb 4-1: SerialNumber: syz [ 862.888577][T15392] FAULT_INJECTION: forcing a failure. [ 862.888577][T15392] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 862.918156][T15392] CPU: 0 UID: 0 PID: 15392 Comm: syz.0.2512 Tainted: G L syzkaller #0 PREEMPT(full) [ 862.918190][T15392] Tainted: [L]=SOFTLOCKUP [ 862.918195][T15392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 862.918205][T15392] Call Trace: [ 862.918214][T15392] [ 862.918222][T15392] dump_stack_lvl+0x100/0x190 [ 862.918247][T15392] should_fail_ex.cold+0x5/0xa [ 862.918269][T15392] _copy_to_user+0x32/0xd0 [ 862.918290][T15392] simple_read_from_buffer+0xcb/0x170 [ 862.918303][T15392] proc_fail_nth_read+0x1af/0x230 [ 862.918320][T15392] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 862.918338][T15392] ? rw_verify_area+0xce/0x6d0 [ 862.918361][T15392] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 862.918386][T15392] vfs_read+0x1e4/0xb40 [ 862.918413][T15392] ? __pfx_vfs_read+0x10/0x10 [ 862.918432][T15392] ? __fget_files+0x215/0x3d0 [ 862.918447][T15392] ? __fget_files+0x21f/0x3d0 [ 862.918461][T15392] ksys_read+0x12a/0x250 [ 862.918478][T15392] ? __pfx_ksys_read+0x10/0x10 [ 862.918507][T15392] do_syscall_64+0x115/0x870 [ 862.918528][T15392] ? clear_bhb_loop+0x40/0x90 [ 862.918548][T15392] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 862.918565][T15392] RIP: 0033:0x7fd3b535e90e [ 862.918575][T15392] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 862.918586][T15392] RSP: 002b:00007fd3b6279fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 862.918597][T15392] RAX: ffffffffffffffda RBX: 00007fd3b627a6c0 RCX: 00007fd3b535e90e [ 862.918604][T15392] RDX: 000000000000000f RSI: 00007fd3b627a0a0 RDI: 0000000000000005 [ 862.918610][T15392] RBP: 00007fd3b627a090 R08: 0000000000000000 R09: 0000000000000000 [ 862.918616][T15392] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 862.918622][T15392] R13: 00007fd3b5626038 R14: 00007fd3b5625fa0 R15: 00007ffe2380e728 [ 862.918642][T15392] [ 863.398746][ T5746] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 863.970922][ T5746] usb 6-1: config 255 has an invalid interface number: 97 but max is 0 [ 863.979816][ T5746] usb 6-1: config 255 has no interface number 0 [ 863.996834][ T5746] usb 6-1: config 255 interface 97 has no altsetting 0 [ 864.012658][ T5746] usb 6-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 864.022354][ T5746] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 864.031340][ T5746] usb 6-1: Product: syz [ 864.035738][ T5746] usb 6-1: Manufacturer: syz [ 864.040454][ T5746] usb 6-1: SerialNumber: syz [ 864.238756][ T5857] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 864.280115][T15405] 0x000000000007-0x000000020000 : "" [ 864.326063][T15405] ftl_cs: FTL header corrupt! [ 864.400953][T15406] netlink: 'syz.0.2516': attribute type 4 has an invalid length. [ 865.020355][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 865.028412][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 865.149739][T15049] rndis_host 4-1:255.97: ACM capabilities 01, not really RNDIS? [ 865.273065][ T5812] rndis_host 2-1:255.97: ACM capabilities 01, not really RNDIS? [ 865.296382][T15049] usb 4-1: USB disconnect, device number 112 [ 865.299230][ T5812] usb 2-1: USB disconnect, device number 104 [ 865.532064][ T5857] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 865.585656][ T5857] usb 5-1: config 2 has 0 interfaces, different from the descriptor's value: 1 [ 865.911461][ T5857] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 865.922267][ T5857] usb 5-1: config 2 has 0 interfaces, different from the descriptor's value: 1 [ 865.941997][ T5857] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 865.967371][ T5857] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 865.982736][ T5857] usb 5-1: Product: syz [ 865.998527][ T5857] usb 5-1: Manufacturer: syz [ 866.009422][ T5857] usb 5-1: SerialNumber: syz [ 866.037879][ T5746] rndis_host 6-1:255.97: ACM capabilities 01, not really RNDIS? [ 866.090388][ T5746] usb 6-1: USB disconnect, device number 77 [ 866.191098][T15422] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2522'. [ 866.250820][T15424] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2520'. [ 867.275146][T15431] lo speed is unknown, defaulting to 1000 [ 867.653714][T15411] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2517'. [ 867.707239][ T5857] usb 5-1: USB disconnect, device number 118 [ 868.755857][T15444] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 868.842249][T15452] rdma_rxe: rxe_newlink: failed to add lo [ 869.179443][ T5857] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 869.196481][T15450] netlink: 512 bytes leftover after parsing attributes in process `syz.3.2528'. [ 869.289560][ T30] audit: type=1400 audit(1786471914.929:922): avc: denied { write } for pid=15449 comm="syz.3.2528" name="functions" dev="configfs" ino=17451 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 869.444140][ T5857] usb 5-1: config 255 has an invalid interface number: 97 but max is 0 [ 869.483767][ T5857] usb 5-1: config 255 has no interface number 0 [ 869.503813][ T5857] usb 5-1: config 255 interface 97 has no altsetting 0 [ 869.615741][ T5857] usb 5-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 870.233363][ T5857] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.249102][ T5857] usb 5-1: Product: syz [ 870.258902][ T5857] usb 5-1: Manufacturer: syz [ 870.264992][ T5857] usb 5-1: SerialNumber: syz [ 870.545007][T15467] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2534'. [ 872.034905][ T5857] rndis_host 5-1:255.97: ACM capabilities 01, not really RNDIS? [ 872.054835][ T30] audit: type=1400 audit(1786471917.689:923): avc: denied { map } for pid=15479 comm="syz.5.2537" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 872.113161][ T30] audit: type=1400 audit(1786471917.719:924): avc: denied { set_context_mgr } for pid=15479 comm="syz.5.2537" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 872.195435][ T30] audit: type=1400 audit(1786471917.799:925): avc: denied { read write } for pid=15481 comm="syz.3.2538" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 872.247987][ T5857] usb 5-1: USB disconnect, device number 119 [ 872.304967][ T30] audit: type=1400 audit(1786471917.799:926): avc: denied { open } for pid=15481 comm="syz.3.2538" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 872.981351][T15488] lo speed is unknown, defaulting to 1000 [ 873.399546][T15493] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2539'. [ 873.971689][T15503] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2545'. [ 874.751463][T15516] FAULT_INJECTION: forcing a failure. [ 874.751463][T15516] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 874.767801][T15516] CPU: 1 UID: 0 PID: 15516 Comm: syz.3.2544 Tainted: G L syzkaller #0 PREEMPT(full) [ 874.767820][T15516] Tainted: [L]=SOFTLOCKUP [ 874.767824][T15516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 874.767830][T15516] Call Trace: [ 874.767834][T15516] [ 874.767839][T15516] dump_stack_lvl+0x100/0x190 [ 874.767856][T15516] should_fail_ex.cold+0x5/0xa [ 874.767870][T15516] _copy_from_user+0x2e/0xd0 [ 874.767886][T15516] copy_msghdr_from_user+0x9f/0x4c0 [ 874.767899][T15516] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 874.767913][T15516] ? find_held_lock+0x2b/0x80 [ 874.767923][T15516] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 874.767940][T15516] ___sys_sendmsg+0x106/0x1e0 [ 874.767952][T15516] ? __pfx____sys_sendmsg+0x10/0x10 [ 874.767963][T15516] ? do_user_addr_fault+0x7de/0x12f0 [ 874.767985][T15516] ? lockdep_hardirqs_on+0x78/0x100 [ 874.768005][T15516] ? irqentry_exit+0x24d/0xa00 [ 874.768022][T15516] ? __pfx___might_resched+0x10/0x10 [ 874.768036][T15516] ? __might_fault+0x111/0x140 [ 874.768048][T15516] __sys_sendmmsg+0x20c/0x440 [ 874.768065][T15516] ? __pfx___sys_sendmmsg+0x10/0x10 [ 874.768078][T15516] ? ksys_write+0x190/0x250 [ 874.768098][T15516] ? fput+0x79/0x100 [ 874.768111][T15516] ? ksys_write+0x1ac/0x250 [ 874.768120][T15516] ? __pfx_ksys_write+0x10/0x10 [ 874.768132][T15516] __x64_sys_sendmmsg+0x9c/0x100 [ 874.768146][T15516] ? lockdep_hardirqs_on+0x78/0x100 [ 874.768160][T15516] do_syscall_64+0x115/0x870 [ 874.768173][T15516] ? clear_bhb_loop+0x40/0x90 [ 874.768186][T15516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 874.768197][T15516] RIP: 0033:0x7f235a19e0d9 [ 874.768207][T15516] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 874.768218][T15516] RSP: 002b:00007f235b027028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 874.768229][T15516] RAX: ffffffffffffffda RBX: 00007f235a426090 RCX: 00007f235a19e0d9 [ 874.768235][T15516] RDX: 03fffffffffffeed RSI: 0000200000001380 RDI: 0000000000000007 [ 874.768242][T15516] RBP: 00007f235b027090 R08: 0000000000000000 R09: 0000000000000000 [ 874.768249][T15516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 874.768255][T15516] R13: 00007f235a426128 R14: 00007f235a426090 R15: 00007fff690be818 [ 874.768268][T15516] [ 874.809422][T15517] tmpfs: Unknown parameter 'grôquopC' [ 875.402716][ T30] audit: type=1400 audit(1786471921.039:927): avc: denied { write } for pid=15524 comm="syz.0.2551" name="functions" dev="configfs" ino=17451 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 875.558668][ T30] audit: type=1400 audit(1786471921.179:928): avc: denied { write } for pid=15524 comm="syz.0.2551" name="c.1" dev="configfs" ino=54626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 875.599259][T15529] FAULT_INJECTION: forcing a failure. [ 875.599259][T15529] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 875.613725][ T30] audit: type=1400 audit(1786471921.229:929): avc: denied { write } for pid=15524 comm="syz.0.2551" name="c.1" dev="configfs" ino=54626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 875.824209][T15529] CPU: 1 UID: 0 PID: 15529 Comm: syz.0.2551 Tainted: G L syzkaller #0 PREEMPT(full) [ 875.824230][T15529] Tainted: [L]=SOFTLOCKUP [ 875.824234][T15529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 875.824241][T15529] Call Trace: [ 875.824245][T15529] [ 875.824250][T15529] dump_stack_lvl+0x100/0x190 [ 875.824268][T15529] should_fail_ex.cold+0x5/0xa [ 875.824282][T15529] _copy_to_user+0x32/0xd0 [ 875.824300][T15529] simple_read_from_buffer+0xcb/0x170 [ 875.824313][T15529] proc_fail_nth_read+0x1af/0x230 [ 875.824330][T15529] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 875.824348][T15529] ? rw_verify_area+0xce/0x6d0 [ 875.824363][T15529] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 875.824379][T15529] vfs_read+0x1e4/0xb40 [ 875.824397][T15529] ? __pfx_vfs_read+0x10/0x10 [ 875.824413][T15529] ? __fget_files+0x215/0x3d0 [ 875.824428][T15529] ? __fget_files+0x21f/0x3d0 [ 875.824442][T15529] ksys_read+0x12a/0x250 [ 875.824458][T15529] ? __pfx_ksys_read+0x10/0x10 [ 875.824483][T15529] do_syscall_64+0x115/0x870 [ 875.824497][T15529] ? clear_bhb_loop+0x40/0x90 [ 875.824510][T15529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.824521][T15529] RIP: 0033:0x7fd3b535e90e [ 875.824532][T15529] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 875.824542][T15529] RSP: 002b:00007fd3b6237fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 875.824553][T15529] RAX: ffffffffffffffda RBX: 00007fd3b62386c0 RCX: 00007fd3b535e90e [ 875.824561][T15529] RDX: 000000000000000f RSI: 00007fd3b62380a0 RDI: 0000000000000005 [ 875.824567][T15529] RBP: 00007fd3b6238090 R08: 0000000000000000 R09: 0000000000000000 [ 875.824573][T15529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 875.824580][T15529] R13: 00007fd3b5626218 R14: 00007fd3b5626180 R15: 00007ffe2380e728 [ 875.824593][T15529] [ 876.165800][T15534] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 876.460823][T15536] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2553'. [ 876.515722][T15536] syzkaller1: entered promiscuous mode [ 876.521505][T15536] syzkaller1: entered allmulticast mode [ 876.615218][T15543] netlink: 512 bytes leftover after parsing attributes in process `syz.5.2554'. [ 876.688745][ T5812] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 876.769853][T15049] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 876.850889][T15547] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2556'. [ 876.868751][T11358] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 876.877701][ T5812] usb 4-1: config 255 has an invalid interface number: 97 but max is 0 [ 876.897544][ T5812] usb 4-1: config 255 has no interface number 0 [ 876.928925][T15049] usb 1-1: Using ep0 maxpacket: 16 [ 876.989793][T15049] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 877.096535][T11358] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 877.224735][ T5812] usb 4-1: config 255 interface 97 has no altsetting 0 [ 877.231174][T15049] usb 1-1: config 0 interface 0 has no altsetting 0 [ 877.240403][T11358] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 877.250615][T15049] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 877.261720][T15049] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 877.274122][T11358] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 877.284584][T15049] usb 1-1: config 0 descriptor?? [ 877.300759][T15545] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2555'. [ 877.311997][T11358] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 877.324608][T11358] usb 5-1: Product: syz [ 877.345038][T11358] usb 5-1: Manufacturer: syz [ 877.351273][T11358] usb 5-1: SerialNumber: syz [ 877.418792][ T5812] usb 4-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 877.690046][ T5812] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 877.705511][ T5812] usb 4-1: Product: syz [ 877.715232][ T5812] usb 4-1: Manufacturer: syz [ 877.717266][T15049] nzxt-smart2 0003:1E71:2009.0023: item fetching failed at offset 0/5 [ 877.742833][T11358] cdc_mbim 5-1:1.0: skipping garbage [ 877.765331][ T5812] usb 4-1: SerialNumber: syz [ 877.765885][T15049] nzxt-smart2 0003:1E71:2009.0023: probe with driver nzxt-smart2 failed with error -22 [ 877.956065][T15536] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 878.261355][T15565] FAULT_INJECTION: forcing a failure. [ 878.261355][T15565] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 878.274618][T15565] CPU: 1 UID: 0 PID: 15565 Comm: syz.1.2560 Tainted: G L syzkaller #0 PREEMPT(full) [ 878.274647][T15565] Tainted: [L]=SOFTLOCKUP [ 878.274653][T15565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 878.274664][T15565] Call Trace: [ 878.274670][T15565] [ 878.274677][T15565] dump_stack_lvl+0x100/0x190 [ 878.274704][T15565] should_fail_ex.cold+0x5/0xa [ 878.274730][T15565] _copy_to_user+0x32/0xd0 [ 878.274755][T15565] simple_read_from_buffer+0xcb/0x170 [ 878.274777][T15565] proc_fail_nth_read+0x1af/0x230 [ 878.274805][T15565] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 878.274833][T15565] ? rw_verify_area+0xce/0x6d0 [ 878.274856][T15565] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 878.274882][T15565] vfs_read+0x1e4/0xb40 [ 878.274911][T15565] ? __pfx_vfs_read+0x10/0x10 [ 878.274937][T15565] ? do_sys_openat2+0x159/0x1e0 [ 878.274958][T15565] ? __pfx_do_sys_openat2+0x10/0x10 [ 878.274986][T15565] ? __sys_sendmsg+0x17f/0x210 [ 878.275010][T15565] ? __pfx___sys_sendmsg+0x10/0x10 [ 878.275035][T15565] ksys_read+0x12a/0x250 [ 878.275061][T15565] ? __pfx_ksys_read+0x10/0x10 [ 878.275095][T15565] do_syscall_64+0x115/0x870 [ 878.275116][T15565] ? clear_bhb_loop+0x40/0x90 [ 878.275138][T15565] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 878.275156][T15565] RIP: 0033:0x7f86e6d5e90e [ 878.275170][T15565] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 878.275187][T15565] RSP: 002b:00007f86e7bc5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 878.275205][T15565] RAX: ffffffffffffffda RBX: 00007f86e7bc66c0 RCX: 00007f86e6d5e90e [ 878.275216][T15565] RDX: 000000000000000f RSI: 00007f86e7bc60a0 RDI: 0000000000000013 [ 878.275227][T15565] RBP: 00007f86e7bc6090 R08: 0000000000000000 R09: 0000000000000000 [ 878.275238][T15565] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 878.275249][T15565] R13: 00007f86e7026038 R14: 00007f86e7025fa0 R15: 00007ffee86b1bf8 [ 878.275273][T15565] [ 878.529638][T11358] cdc_mbim 5-1:1.0: failed GET_NTB_PARAMETERS [ 878.535788][T11358] cdc_mbim 5-1:1.0: bind() failure [ 878.543638][T11358] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 878.550481][T11358] cdc_ncm 5-1:1.1: bind() failure [ 878.558945][T11358] usb 5-1: USB disconnect, device number 120 [ 879.116427][ T5812] rndis_host 4-1:255.97: ACM capabilities 01, not really RNDIS? [ 879.182223][ T5812] usb 4-1: USB disconnect, device number 113 [ 879.418163][T15578] rdma_rxe: rxe_newlink: failed to add lo [ 879.833211][ T5746] usb 1-1: USB disconnect, device number 114 [ 880.225004][T15588] veth3: entered promiscuous mode [ 880.230137][T15588] veth3: entered allmulticast mode [ 880.498929][T15049] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 880.641703][T15591] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2569'. [ 880.746747][T15592] rdma_rxe: rxe_newlink: failed to add lo [ 881.199191][T15049] usb 4-1: device descriptor read/64, error -71 [ 881.469634][T15049] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 881.595882][T15585] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2567'. [ 881.619233][T15049] usb 4-1: device descriptor read/64, error -71 [ 882.168078][T15049] usb usb4-port1: attempt power cycle [ 882.518640][ T30] audit: type=1400 audit(1786471928.149:930): avc: denied { listen } for pid=15605 comm="syz.1.2575" path="/518/file0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 882.557169][T15608] SELinux: syz.5.2574 (15608) wrote to user. This is no longer supported. [ 882.585539][ T30] audit: type=1400 audit(1786471928.219:931): avc: denied { write } for pid=15607 comm="syz.5.2574" name="functions" dev="configfs" ino=17451 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 882.610659][T15608] [ 882.612976][T15608] ====================================================== [ 882.619969][T15608] WARNING: possible circular locking dependency detected [ 882.626955][T15608] syzkaller #0 Tainted: G L [ 882.632900][T15608] ------------------------------------------------------ [ 882.639886][T15608] syz.5.2574/15608 is trying to acquire lock: [ 882.645925][T15608] ffff88801e315170 (&p->frag_sem){++++}-{4:4}, at: configfs_rmdir+0x3fa/0x950 [ 882.654777][T15608] [ 882.654777][T15608] but task is already holding lock: [ 882.662110][T15608] ffff888044ba6740 (&sb->s_type->i_mutex_key#30){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 882.671738][T15608] [ 882.671738][T15608] which lock already depends on the new lock. [ 882.671738][T15608] [ 882.682111][T15608] [ 882.682111][T15608] the existing dependency chain (in reverse order) is: [ 882.691109][T15608] [ 882.691109][T15608] -> #3 (&sb->s_type->i_mutex_key#30){++++}-{4:4}: [ 882.699770][T15608] lock_acquire+0x1b9/0x370 [ 882.704773][T15608] down_write+0x8b/0x1f0 [ 882.709519][T15608] configfs_depend_item_unlocked+0xf3/0x6a0 [ 882.715911][T15608] usbg_make_tpg+0x261/0x620 [ 882.720996][T15608] target_fabric_make_tpg+0xab/0x8c0 [ 882.726776][T15608] configfs_mkdir+0x51e/0xb70 [ 882.728775][T15049] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 882.731952][T15608] vfs_mkdir+0x361/0x850 [ 882.731979][T15608] filename_mkdirat+0x48b/0x5e0 [ 882.749649][T15608] __x64_sys_mkdir+0x6b/0x90 [ 882.754740][T15608] do_syscall_64+0x115/0x870 [ 882.759838][T15608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.766242][T15608] [ 882.766242][T15608] -> #2 (&opts->dep_lock){+.+.}-{4:4}: [ 882.773861][T15608] lock_acquire+0x1b9/0x370 [ 882.779130][T15608] __mutex_lock+0x1a4/0x1bd0 [ 882.784217][T15608] tcm_set_name+0x29/0xb0 [ 882.789045][T15608] function_make+0x21c/0x3f0 [ 882.794128][T15608] configfs_mkdir+0x51e/0xb70 [ 882.799310][T15608] vfs_mkdir+0x361/0x850 [ 882.804052][T15608] filename_mkdirat+0x48b/0x5e0 [ 882.809403][T15608] __x64_sys_mkdir+0x6b/0x90 [ 882.814486][T15608] do_syscall_64+0x115/0x870 [ 882.819586][T15608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.825984][T15608] [ 882.825984][T15608] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 882.834205][T15608] lock_acquire+0x1b9/0x370 [ 882.839216][T15608] __mutex_lock+0x1a4/0x1bd0 [ 882.844301][T15608] uvcg_default_processing_bm_controls_store+0xbd/0x430 [ 882.851732][T15608] configfs_write_iter+0x302/0x4e0 [ 882.857341][T15608] vfs_write+0x6ac/0x1050 [ 882.862178][T15608] ksys_write+0x12a/0x250 [ 882.866997][T15608] do_syscall_64+0x115/0x870 [ 882.872081][T15608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.879082][T15608] [ 882.879082][T15608] -> #0 (&p->frag_sem){++++}-{4:4}: [ 882.886474][T15608] check_prev_add+0xeb/0xe60 [ 882.891565][T15608] __lock_acquire+0x136c/0x1a40 [ 882.896911][T15608] lock_acquire+0x1b9/0x370 [ 882.901911][T15608] down_write_killable+0x93/0x250 [ 882.907436][T15608] configfs_rmdir+0x3fa/0x950 [ 882.912609][T15608] vfs_rmdir+0x328/0x8a0 [ 882.917348][T15608] filename_rmdir+0x31a/0x5c0 [ 882.922517][T15608] __x64_sys_rmdir+0x46/0x70 [ 882.927603][T15608] do_syscall_64+0x115/0x870 [ 882.932689][T15608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.939087][T15608] [ 882.939087][T15608] other info that might help us debug this: [ 882.939087][T15608] [ 882.949284][T15608] Chain exists of: [ 882.949284][T15608] &p->frag_sem --> &opts->dep_lock --> &sb->s_type->i_mutex_key#30 [ 882.949284][T15608] [ 882.963068][T15608] Possible unsafe locking scenario: [ 882.963068][T15608] [ 882.970503][T15608] CPU0 CPU1 [ 882.975837][T15608] ---- ---- [ 882.981174][T15608] lock(&sb->s_type->i_mutex_key#30); [ 882.986617][T15608] lock(&opts->dep_lock); [ 882.993520][T15608] lock(&sb->s_type->i_mutex_key#30); [ 883.001471][T15608] lock(&p->frag_sem); [ 883.005606][T15608] [ 883.005606][T15608] *** DEADLOCK *** [ 883.005606][T15608] [ 883.013720][T15608] 3 locks held by syz.5.2574/15608: [ 883.018892][T15608] #0: ffff88801eb3e450 (sb_writers#19){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 883.028311][T15608] #1: ffff888052ee6740 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 883.039599][T15608] #2: ffff888044ba6740 (&sb->s_type->i_mutex_key#30){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 883.049666][T15608] [ 883.049666][T15608] stack backtrace: [ 883.055538][T15608] CPU: 0 UID: 0 PID: 15608 Comm: syz.5.2574 Tainted: G L syzkaller #0 PREEMPT(full) [ 883.055560][T15608] Tainted: [L]=SOFTLOCKUP [ 883.055564][T15608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 883.055570][T15608] Call Trace: [ 883.055575][T15608] [ 883.055580][T15608] dump_stack_lvl+0x100/0x190 [ 883.055595][T15608] print_circular_bug.cold+0x178/0x1c7 [ 883.055612][T15608] check_noncircular+0x146/0x160 [ 883.055626][T15608] check_prev_add+0xeb/0xe60 [ 883.055639][T15608] __lock_acquire+0x136c/0x1a40 [ 883.055654][T15608] lock_acquire+0x1b9/0x370 [ 883.055666][T15608] ? configfs_rmdir+0x3fa/0x950 [ 883.055680][T15608] ? __pfx___might_resched+0x10/0x10 [ 883.055694][T15608] down_write_killable+0x93/0x250 [ 883.055710][T15608] ? configfs_rmdir+0x3fa/0x950 [ 883.055723][T15608] ? __pfx_down_write_killable+0x10/0x10 [ 883.055738][T15608] ? configfs_rmdir+0x3be/0x950 [ 883.055752][T15608] configfs_rmdir+0x3fa/0x950 [ 883.055767][T15608] ? __pfx_configfs_rmdir+0x10/0x10 [ 883.055781][T15608] ? __pfx_down_write+0x10/0x10 [ 883.055797][T15608] vfs_rmdir+0x328/0x8a0 [ 883.055812][T15608] filename_rmdir+0x31a/0x5c0 [ 883.055824][T15608] ? __pfx_filename_rmdir+0x10/0x10 [ 883.055838][T15608] ? do_getname+0x191/0x390 [ 883.055853][T15608] __x64_sys_rmdir+0x46/0x70 [ 883.055872][T15608] do_syscall_64+0x115/0x870 [ 883.055894][T15608] ? clear_bhb_loop+0x40/0x90 [ 883.055908][T15608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 883.055919][T15608] RIP: 0033:0x7f525f39e0d9 [ 883.055930][T15608] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 883.055940][T15608] RSP: 002b:00007f5260205028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 883.055951][T15608] RAX: ffffffffffffffda RBX: 00007f525f625fa0 RCX: 00007f525f39e0d9 [ 883.055958][T15608] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000200 [ 883.055964][T15608] RBP: 00007f525f435024 R08: 0000000000000000 R09: 0000000000000000 [ 883.055971][T15608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 883.055977][T15608] R13: 00007f525f626038 R14: 00007f525f625fa0 R15: 00007ffcd5d09dc8 [ 883.055987][T15608] [ 883.088781][ T30] audit: type=1400 audit(1786471928.249:932): avc: denied { remove_name } for pid=15607 comm="syz.5.2574" name="uvc.usb0" dev="configfs" ino=59003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 883.376361][ T30] audit: type=1400 audit(1786471928.249:933): avc: denied { rmdir } for pid=15607 comm="syz.5.2574" name="uvc.usb0" dev="configfs" ino=59003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 883.493989][T15610] lo speed is unknown, defaulting to 1000 [ 883.518843][T15049] usb 4-1: device not accepting address 116, error -71 [ 883.528202][T15612] virtio-fs: tag not found