last executing test programs: 12m42.522068852s ago: executing program 4 (id=304): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='dctcp', 0x5) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000400)="02", 0x1, 0x0, 0x0, 0x0) (fail_nth: 1) socket$inet6(0x10, 0x2, 0x4) 12m42.007228396s ago: executing program 4 (id=307): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000ff0d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r2 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r3 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="00001000252155b2"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r1, r4, 0x25, 0x0, @val=@netkit={@void, @value=r1}}, 0x1c) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r0}, &(0x7f00000004c0), &(0x7f0000000500)=r5}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r5, r7, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x28, &(0x7f0000000300)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @val={@void, {0x8100, 0x1, 0x1, 0x4}}, {@arp={0x806, @generic={0x4d99d0b4842805fb, 0x8906, 0x6, 0x2, 0x3, @local, "30d2", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x42}}}}}, 0x0) (fail_nth: 1) 12m41.648492392s ago: executing program 4 (id=309): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x10, 0x11, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000040000000000000000700000018010000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000a0000000b70900000000000055090100000000009500000000000000180000000c0000000000000007000000bf91080000000000b7020000010000048500000084000000b70000000000000095"], &(0x7f0000000140)='GPL\x00', 0x3, 0x0, 0x0, 0x41100}, 0x94) 12m41.29416825s ago: executing program 4 (id=311): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000040000a2c000000060a09040000000000000000020000000900010073797a30000000000900020073797a32000000002c000000080a01030000000000000000020000000900020073797a32000000000900010073797a30000000001402000011000100000000000096ff000000000aae00da6182048c351ff13414f9491a7b2042d95e9cc1be800f0286e73b93c608e9e46e409748bcb0f356612031eafcfa577445cd43c98a2033e345dfcd600863611c3b2cc3f6bd0e970f80d02b926b4f3aa9b6754f037398701964009503cb4a93c9d7afb59175fe8d2b6849856729036681fa28bd3b97a9968998637440025902e1dfa74449d693411fa0a5e286fcaa1dd9d7e59f77d5255dba0e9301291b21ad46139354f81298b7adb82750a48625f12c109abf9c391a4ce13f"], 0x80}}, 0x0) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0xffffffff, 0xb6, &(0x7f000000cf3d)=""/182, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x800}, 0x94) (async) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0xb, 0x3, 0xff) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmsg$rds(r2, &(0x7f0000000a40)={&(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f0000000a00)=[{&(0x7f0000000340)=""/166, 0xa6}], 0x1, 0x0, 0x0, 0x4000050}, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000200)=ANY=[@ANYBLOB="680000e50106050000000000000001000403000000000100060000000500050002000000000900020028d09073797a31000000001c000780150592ea52b97485621601078b00064000000009080012400000697d08000840000000901100030068617368"], 0x68}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14, 0x9, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0xffff}}, 0x14}, 0x1, 0x0, 0x0, 0x4000020}, 0x200c0095) (async) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) (async) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x20010, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT, @ANYBLOB=',rootmode=0000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) chroot(&(0x7f0000000440)='./file0\x00') (async) unshare(0x20020000) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000100)=0x0) (async) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r8) (async) ptrace$getregs(0xc, r8, 0x69, &(0x7f00000000c0)=""/97) kcmp$KCMP_EPOLL_TFD(r7, r8, 0x7, r2, &(0x7f0000000280)={r6, 0xffffffffffffffff, 0xefed}) (async) renameat2(r6, &(0x7f00000006c0)='./mnt\x00', r6, &(0x7f00000021c0)='./bus\x00', 0x0) (async) close(r1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) (async) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRESHEX=r7, @ANYRES16=r3, @ANYRESHEX, @ANYRESDEC=r8], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) (async) recvmsg$unix(r9, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x101) 12m41.155594541s ago: executing program 4 (id=314): socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x7a, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) syz_clone3(&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, {0x3c}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12m40.83731338s ago: executing program 4 (id=315): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x5, &(0x7f0000000280), 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x106, 0x2}}, 0x20) io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x153a, 0x0, 0x2, 0x17a}) ppoll(&(0x7f00000000c0)=[{}, {r1}], 0x2, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 12m40.539071793s ago: executing program 32 (id=315): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x5, &(0x7f0000000280), 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x106, 0x2}}, 0x20) io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x153a, 0x0, 0x2, 0x17a}) ppoll(&(0x7f00000000c0)=[{}, {r1}], 0x2, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 10.173489868s ago: executing program 3 (id=3998): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) connect(r2, &(0x7f0000002440)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x80) r3 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000002c0)='s\xefurce', &(0x7f0000000300)='\xb0\xfb\xd9\x9a\xbe\r\xcc:\x9b\xd0}\xe8\xff\xff\xff\xff\xff\xff\xff\x7f\xce\xf5\x1a\x01\xd6\a\xfe\xb8\x92~wS\x87\xd9\x9e0y\xc9\x8cw-zu(ht\xa1~\x9a\x8d^+\x9f\xee\x9a(&W\\\xbb\xd5W\xeb\x06\x9dva\x06\xe3\x97\xa1\x88\x83W{\x00\xff\xff\xff\xff\xff\xff\xff\xe9\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00)o\b~\xe3t`\xc9=;o\xe5\xb4T)\x04\xf9k\xfb%t\xa7\x80c\xbb\xeb\x10\xb8\x01', 0x0) userfaultfd(0x1) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) recvmmsg(r4, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000440)=""/240, 0xf0}], 0x1}, 0xa5f}], 0x2, 0x40000163, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}}, 0x8000000) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 9.888011492s ago: executing program 5 (id=3999): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) connect(r2, &(0x7f0000002440)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x80) r3 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000002c0)='s\xefurce', &(0x7f0000000300)='\xb0\xfb\xd9\x9a\xbe\r\xcc:\x9b\xd0}\xe8\xff\xff\xff\xff\xff\xff\xff\x7f\xce\xf5\x1a\x01\xd6\a\xfe\xb8\x92~wS\x87\xd9\x9e0y\xc9\x8cw-zu(ht\xa1~\x9a\x8d^+\x9f\xee\x9a(&W\\\xbb\xd5W\xeb\x06\x9dva\x06\xe3\x97\xa1\x88\x83W{\x00\xff\xff\xff\xff\xff\xff\xff\xe9\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00)o\b~\xe3t`\xc9=;o\xe5\xb4T)\x04\xf9k\xfb%t\xa7\x80c\xbb\xeb\x10\xb8\x01', 0x0) userfaultfd(0x1) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) recvmmsg(r4, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000440)=""/240, 0xf0}], 0x1}, 0xa5f}], 0x2, 0x40000163, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}}, 0x8000000) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 8.327505877s ago: executing program 3 (id=4003): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x4206, r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7, 0x0, 0x1, 0x335}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x11}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xc, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r2}, 0xc) ptrace(0x4208, r0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r4 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000080e372208c106801b284010203110902240001000010000904020002f8fd00000905060200020d0006090582020002"], 0x0) syz_usb_ep_read(r4, 0x6, 0x4e, &(0x7f0000000040)=""/78) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000140)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_disconnect(r4) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r5, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r5, 0x7a0, &(0x7f0000000000)={@my=0x0}) openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x18e3441a97ade84b, 0x0) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r5, 0x7b1, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x10000008}) 8.143074707s ago: executing program 5 (id=4004): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket(0x26, 0x1, 0x1) r2 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@rand_addr=0x64010100, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {0x0, 0x0, 0xfffffffffffffff7, 0x4}, 0x0, 0x6e6bb9, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0xfffffffc, 0x6c}, 0x0, @in6=@empty, 0xfffffffc, 0x0, 0x2, 0x7, 0x200}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0x0) connect$inet(r1, &(0x7f0000000300)={0x2, 0x0, @remote}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xea8, 0xe) getpid() getpid() syz_clone3(0x0, 0x0) r3 = geteuid() lstat(&(0x7f0000002180)='./file0\x00', &(0x7f00000021c0)) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=@newsa={0xfc, 0x16, 0x633, 0x0, 0x80000000, {{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, r3}, {@in=@broadcast, 0x4d2, 0x32}, @in6=@loopback, {}, {0x5, 0xffffffffffffffff, 0x0, 0xc1}, {0x4, 0x2}, 0x6, 0x2, 0xa, 0x4, 0x18, 0x19}, [@mark={0xc, 0x15, {0x35075c, 0x1}}]}, 0xfc}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e24, @private=0xa010102}, 0x10) setsockopt$inet_tcp_int(r4, 0x6, 0xc, &(0x7f0000000000)=0x7, 0x4) socket$nl_route(0x10, 0x3, 0x0) fanotify_mark(0xffffffffffffffff, 0x10, 0x40000000, 0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00') 7.400860802s ago: executing program 5 (id=4005): syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) syz_open_dev$MSR(0x0, 0x0, 0x0) socket$inet6(0xa, 0x3, 0x3c) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f00000000c0)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000200)=""/4, 0x4}], 0x1}, 0x4}], 0x1, 0x40000121, 0x0) r1 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) openat$mixer(0xffffffffffffff9c, 0x0, 0x90903, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=@newlink={0x30, 0x10, 0x1, 0x70bd29, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x49815, 0x3}, [@IFLA_TXQLEN={0x8, 0xd, 0x1}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) mount(&(0x7f00000003c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000300)='udf\x00', 0x200480, 0x0) sendmsg$kcm(r1, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0xfffe, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca) gettid() openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x16ba82, 0x1) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGKBDIACR(r4, 0x4bfa, &(0x7f0000000080)=""/2) syz_extract_tcp_res(&(0x7f00000000c0), 0x9, 0xfffffffb) pipe(&(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)) socket(0x10, 0x3, 0x0) 7.208329057s ago: executing program 2 (id=4007): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x6a, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000013c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001f7ff04b7050000670000006a0a00fe00000000850000000b000000b70000000000000095000000000000009cc6b3fcd62c061c6207005d43a4505f80e39c9f3c530cf08e467b592f868ee3b0a435df0a0e8c1bf176db2a6b2feb4b77d3d5707bfd2d84aaa3b1d4e984c46ea7e2b347a36f5662403e1b2be4284322a4908a0d411a9872971c7c56f0979bd10b97163c066d0e196bf02f46c7953ab1abdaf9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000200000000b0c2c125080963f63223b7b80197aa3161f45346b100000000000000000089e399f6609876b588743794298b79dc192dff048fc207c81f28bdd3e26a1a8a0481e9f0da43bb6ca66e2f55a9ff19ffcafe3e64be06000000000000005064caec04a367c23d9fb6a6991ddb737d527d6acb15426406991c3b404984dfa2c6e94bd0339454c13ad3c328a182c15dc760a313e3b3ca5d3393404029e98fa883c71949a34d84030323e3d54fc5b29d27643453ad9211e3550ee5520211d9370175133f260c6882a146880b9387f1beb5418618bc83a3becf9bb5d80efd7da7ba8b913c685fc6700848dc6665d73248c1f74e08ad04ce905faf32706e0000249a028044ede964362cfb2f30a246c3b2f60000fc4deb91da1368b0960b8d69bd99c64893d44f962524429dc058528e7e541c903869d96989b9a986620cb2c95c83f2a082c52764f49e51188f9418b01bcd8ae164acdac95318ec8b2c6feacdcf4b528e5e58219bc54f6ad5679e7f430e6960ed048c46e1dccca05bfa1d67c83795eae2d31968c055d325a9c794ef88b30c2de4a274878b73c05ffa88b7073be648b12bb1fee58958d6a6f31bfe5682159fbde59dad00008a73b40f09cf018cd496b36050d7fd45e3620c28f76749262e33e16429a6da35ceb1a989de81c3f8b8bc348ef2ac3781b847611fcb0a26acafdd6d9a1b17dcb9f7c493d8f8cd344a1d470ca0d6f16ab0293774b5509fb0e7113936d59d5a60dbd84a938476adeebab9ff44f531bb0200000000000000cc1fbc455a64fd449284f71761092a0302000000000000008a05d36fd9b814b4292745418c92d94462d2d8f7e1d24cabe17ad4135d8872935ceac6eb4f046f2acc1b0efb4438abddcabb4e4e72a450aab72b589bec83bbb688e659fb426cb43d0ee993516fd4e867232cde69b6ffad447dcd92e0ef8234ff850ec3948dd1fa7afb77d951fe4abf618121b7894c106beb49a71c62df5544ef221973432ccc7e62b151eb898a01010a7ec5acd0a5dcb2de443880c8a682515d1da9a3048744acb44384d1591df789883c0560495cb0cb32283529926d25e5c7f481112ab8a82247e927fb6f256830dab3671f00500d36a17790bab7d0e89e6c15314f2b963bfc867953476b0505c7d728326d666f39e82cfcf7e7a85df288d75df24c5e4d529c349923f9a4fb882310391dd58b4cbd8def239a227724d39c3e6c40e20e07e68a22888a5c3941b7a765b92bcb37f302487bcbd93ccf3a104021ff34ddf7ffcca1a04eae963e25516a114573779b24a341dfb2e80f1f345c6d96493ffc2a18478b5bf3aab2ea59c51cf0678e1a57d0ea042d911548ff612002ddb2d54d42fbddaf686c4f64d26b42e7d613e42b56887003d27468225b2594a05044baf314113e889468cf13dd92aa0d7744db6b56557a5adad95cb9a69d4de50642b4b9d6d3ba7eb534b00d0fea62f0a61535dfc4da06e7f8695be614c557caed7eb0120516e1351fed7d8ffa31c8f4be364185469cfc5f25c90d71bce745dd2d58a30e0844f12c4cbbdd7a08465e665c2620d78673dfb6d9263ed7def8924cfcd48a8a3534f1a3eac9ee9f18a18106ba3d7c7a62330f5c0e98cb7982dd7bad02c8dba9c13894185bfc4bd2520b6e2043fcb3fc5eb55ecf9e6e363ea2ac40a14a6f00f0ffffa0fdb6487c51ef12c27b30255bc4f8813be88beeb5aa6f6a4151cfb90644e50630ed474df7d1635afcb1ea3f6c47b5acbba2ce5099a9387c7acb9bbd1da497611ceda25049e48ddacccbb58dddaf9a3510d65383829a51e0f41e661fa80ca1eaaa6cf0824305ba4ec80400c50ffe83ccb0e6fef321190c58aca8c7c8c6d26ff5cbc2cadebda8e1219e04f8dacffd33db1a0a2e74c9eb978d80a12d0b5327bfd053000000000000000000be0d02a14708504412fa93d335992b2983c5addc191b4a21c7b340d0536b01958e15315eb5f3f9f4992c18f666359f40295fa73284c4b607669bae75bd68c3e2b770c324a0ab26b6065d7e95a7bd80052db57506ec7cc861bf3998d07484c66630ca8173fea3f06ed1dfc70a8b90418e2dc76137e0f68cb1c8a908aef9f0f85647dba54e05028c33d94d463fb20d2e7547184b8d3611e45dff02144387f342ef9b9bf650e9d049bf65258a7bc094a6965e24611c077e1ca0891362a9d68f3ec7610c0449acf18459500f024f9b75885cd79ba32776e4a511c8a4ad922b00000000000000a9241220dfbf7d02ef507ec6fc7f5d37d835f7bed71283c431b9d8cbd9003972bf1dc6a71bedad8e19efc3edd2a7a7e555d5f3176af69920471e6e5bcb8966c813c132d65e2b99d3015e06b372e1aefaae14ee3fbc6349af362c19b59c214de66912d1a9a98d92dc197a51c29443de62caca334c46d110e50896fe50d0477771d387f40c8ef05750ca651e6e69a237dcf78666d6ab2bda1f853525494e4efdd93be38bb5fc671f8794002d7a951fd336aaf4ed1166cb459df70218c571ba1c40b028234505e5477e268326af8812c2fbb8785a223fce0a0601c2a3b58bea8c6216eadabcabe86ab46e4cd3d58ef7ce8d3c4b0bc5952e81dfc0a490d8568db6f9c51fe703c6864fae0053d2f91f49e977cdc1962dbc28c29471a72199862bc8fc6e211d13d8579cab4fba94b2b613c9b8148d05e0690a4c4ab35aabc45801d2b82081e62b23a01b58b1ffb624f63ad2246796796160cd3682374364edac52f1becb7c6eff50823b75fb2ef516ec4ec1cb20a2535b504502d744f2099674e58f2c117c980cf0d041c8ea5c4f166bab4aa5ed200ef4dcff96f7c9c1ab8c22db0f439b23b04bcd41ffc3a0e01976ca1cf43e12d7d72f3faa4979faabd62e2dc54a980eae4d5e8c6498de331c3aba1144ef1190ea6cda641d9416c4560cab2d819eac7b04c70f141754c3ffd79da363fe8859afee531710caf1b2bf5a51142f4755cbb700c28083525a9093790096cb93417f1216000000000000000000000000000040ceb244e4cae2b65a76d41793aabccd3d0c50486eae6793e1f54814a8ee2779c14ca94759266200229b58c12279817869e831cade7b09ddffffff9d93e2ad25eed43c0b9ee4fd209b5b919a42f676b9d7236fc8dd5040899d0676291407ce9ac8101dd3512f5b3ac8cf8179d1749de324000030d0f942ec4604c28d5c287d1435956784003a53eb5fe535ead8857acf0166dbd9f30a9b9c8a9b9faf1356faf269cded935b07863e4fdad8aab52686c81babd1c08f6700a2fadd413443022ea5c774ffefdd426abed08d437a4db48611fc82a18ab9f54758a1aad86d95cd186ceb55fafa3930090467b8b7bb8adef4de2076dc538bb97502b4b4350e633dc0a53c2fc9a01bc5cfae0245f1fab843c633446f5f3a43226109b7dafe7815773bd6969f04cbe15236b90000000000000000000000000000000000000000000000000000ff0779b9c005da21073c6d9680d4e547cb727addb2efe11b8b3a706569f1522b57d71bb0beccab7c8fe9e1330b2f501b2ac3cf4eba7ceda6ff8a0c8b18c5e9e2f505e833217557abb257d61af8e8c473a7585436730db75da167481ab8921fe051b250f8d8ef9c8481bb28a137d15040b0181c28dfad7c17b30c452a64c43a117cb948247c33abc765a6ba695c3cea5e32a4d1ae2dcbec2ff4268e03aad15efc6004e6b3d7f0edf8b5d4ae7846a6d43c16c90b7c5dc13ac2ff0439ab693498964cad2bb533bcd240778b7e49145c48efde42b44c01517f1a7c7707b4c4fc0900e7086ec40354504590696282286db9030f0320e2fcba8723939005347b3f744ff1973431000000000000000000000000000000000000003495d69aaf9a1d83e83511a3bf44fe753b8ad83bc34ea4d46b397e000ff267c50122aa5aaf8474ec2e57d960d963900bef84a4b3c7dd01ae4d6b5522aa8a35ae7996e298bcfe3f31a34e3e12c58cf172a4d3677a67b52041ec21ae8003aa1c9969178b1b00e4d12ac9745b3cabc908e623403c013907523c77f8acc20b9e2fd224ca8f21fab2b10991881e2112f4e1c4f54b9ca7c9a0c8298d60b8b6eaa023418992d6d62b0e9faca4a3b3a805e859137cd933ef5eb8db16f159f32505725da51414562d064b551246dacd586f42d06c790000087bb52ae4bc09f3846c785d1b278e661ed01fbc2415288bc9c808c4aef648d431b3029da0dec8886c3ee9cad996843d00a3b5eb54e270dd2e96c8f2fdb4c27c2d1bd467f2a14867dec67730d8a68329839d9feff688dfbe25c73f936338e7b057980da58a6303d95f17712d667d5a1066ae457ae32925ce658b559c1182a74e267da57fe25b19153f1cdebaddf3f7a3479c09f2303dff449c0513b552a75ed48215cc31264a6ff648a95daa0d599dbce303b3b5307572df30429a3b4b115cab0a018f2501272048dd9e69877535e20078e7c28a98f26ace2fa90c68166396a2398d7a266bdc15ce904f25ec7fb2434ee7b5b69bed702ba1e7ed72942f452f1a98a2d949450091075efa823b11f5f5eccd921c04c7c15a5a05750cd85b1300fc00ce275de7559e117f87cb6c3c9a4b9f96149e3fcffa44d7258e9fc818ab3d76ab660a254d998592c310"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffeb6}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r1, 0x18000000000002a0, 0x204, 0x0, &(0x7f0000000040)="5aee41dea43e63a3f7fb7f110800", 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000180)=0xb27, 0x4) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) sendmmsg(r0, &(0x7f0000007200)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000004c0)="600b8e2e903910b8d6f3adc53a98f381d92be4313ac90a485319f239", 0x1c}, {&(0x7f00000005c0)="7e5afa8cb7f898a5de4a55750ee9b2491fb3645850225e3c06", 0x19}, {&(0x7f0000000640)="b84b50897a8890009fc1048aa911c9029fd716f80e5ee15fe2d773877bb0dda523649467f678aba296d8", 0x2a}], 0x3}}], 0x1, 0xc840) 7.062300533s ago: executing program 2 (id=4009): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000002280), r1) sendmsg$NFC_CMD_LLC_SET_PARAMS(r0, &(0x7f0000002380)={0x0, 0x0, &(0x7f0000002340)={&(0x7f0000002300)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fbdbdf251000000008000100", @ANYRES32=0x0, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x4000840}, 0x14) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0xb, &(0x7f0000000000)=0x2, 0x4) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=@newtaction={0x68, 0x1c, 0x300, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x54, 0x1, [@m_mirred={0x50, 0x0, 0x0, 0x0, {{0xb, 0x3}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x20000000, 0x0, 0x9}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0xa8c0}, 0x2000a004) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() vmsplice(r4, &(0x7f0000003b00)=[{&(0x7f0000001680)="982bb1369dba234abab1e7b29236707ee0f441f278731ef72b8d76f42e5c034ce48cb396e01d05dc4f1c4f9021c97cdae1bcce315ff19c51a4e76bfa54bad5937b40cc84c9ae70d217b6e864b07e04fd2e1bc1a9d45ebe8bd9452cbaf2669aa513ac89b7758d83b49fb1051dd0684437f098985239d7412c6835f1faea07c904a859d533a25143c7c7a57c60ab6751cf77d9e179506634c7488659dfa81d1f18eec87c76af635ec7307d1eeed7d98c59a00e5315b98042f97f46259d8f430aad63e81df06438e62da537398936114aa468b725c730c1aa807ce3caa637acc1c4609b778d5f60fa0351c7bd944e4e34e6ec5c0560d741d6dcd587ed313c92fc89a18b7f9ce1907853f14f4dcaed4927e94635b2d5888f7e633323526ee2938badbd2b04774ccbbb489425bcb9f77ba45436193cb6773b5982713a0b98456fe404ca9a54deb07a53d6b05b85cd5ae75065d2172d3df4a82d34c0f72111494d80315a7de839a2bbd56473994329590362cbff5742c335fdc6a04a6748cd46436d66a4afe7d2e06465a0f04b920e51a8562670d37e911003114f6436a9b38391e3d3fcc9071ea3ab78e52f001a6e0058055a220703712fa07efa4c085a53ac199f4d27f65449476461957920383147331be7625e179524ef15d0caab8fa23627bd13feb6e270de7aa5bbca91b69ef91772a7d57048f8b02be1cc4654315ae841940ce9e078b3980eb50851050ab20151021184eea0947ea3975e9abbba06752088ccc67f741a220ba5183fa416e72fea30a0eb384b9742caef8f44bdfe25f5e985924f7f9c65ad82510ad0ecd67ecb1bd03a84e83fc3f16902cdbea981afe40f09e890834ecbf817f3e7e5a8aab347bacc60269b6f60acc1b201f2ea8e71865c4f4757b3ed23e13bd916bc99f76a97c31e4f2372e047c47cb509885b46e7c9273bd1663c58473f81d528054d9b5a32878f11eebd72db7d6136522b5bba0cd49bfd1907acbf78feb3541dab52262abcf05090e6c0488d218991c9ca6a1a22391137c4413792bae668b7dd76460c3b0a87f735ece03033d71341ee4224705ebc182f616f52e7f75b0ff2114964420933749a351b3df53233db08344e76a299f60bff65f9a2de05cd65d03c96d345f118bfc4f084eb47a5dbcc8c21fc094b4e93f1af913b63c5aaf73dcd415701514c732acf72ef54df74a7845e2791bd1e1211c7a471c5038520546abdf41d0b746ef80cf9501d4259d65b767b270b37178d46d368898b2a12bb2c68094726aea386ed2ab186619469655f3abd4a51c7313cda7bc8e8e9775191c1175266650d29a0ce198c0de9947a4cf06cb5961f265fe5a7b2b9e98fd7f6159752c6aaec6f85130f3766fd70496ff476c5539f85f3206d6e2957f43fce9228f2862a81155d796ccb8f37a798bfc8a3bef7b71c131ffa8fcced5af3fef3fed3de50f971ee5c9271b6c173526972c31797da093f1aa4b8ef22d2c2c22b6f873d979570815587a8eacd11f361c3113703f5e3369be825767b18d6d2c3a7665c251f818856b2b2a7446506988402835c76d6d90a1495885c398d0836b953680878825c8caf2d9c70206413d9295f669804c3ebc857afd712ea8f80d8c0cf925c7be2008fbacc211e4777777353c1d6c155851cf74d0424d4997072bd0005fdf917e7b1458d372746fd57aab64dd1293b42fac4e41010e6bc0eb0d8011d9137607364e3549a3fcad9a79f7413e085ff38a3d64954b8947be00c705f7fbdb05e6d502f4fdb10387c5eb7308c787a671f1557a4a890b2dc5b44429306619ee4f0070824931fbd6aaf792d175bff48b170cf7c3414a224cda968670cb4da7afe28ebc2caecf8b49140ce74df7263a88274fca8c7285f3bec6fa9e1fc04d6359956cc1e6bacc0ace2f4618002100bbea3d7993339616fca7a2310635d956808d7ea7bb786c9ea5379d8918fae283d51f7499b3b538a91db26cf36662c6378d3cb3e6c666994285e2bf4c82ba953715cac163838486e228bc31770b2382708aeb68781b993535d4f4f567047c33fe5ad54e472a19c46d8d64b553957c4fc1c7c5156498fadb8b8021c8555b51aaa281f60eb0ebbeadf0b5fd15657207a07fd9e0a98bb640bdf917a673801cd3721e5e0511ac3cc8bec9a2cd86ab83833f97562f2b8b0d76ef70ef5c006fc135b20144a325f3df774d92a3fe3c99421e0d1458e20a88566cffabe8f9352bd789e72b24bc46e1d61871e8b7da8b2ae3d9d3767a276159cef2ff2a9749965dc757133ac6ef462f98a1623c9d4ccdc842d6d5c030ab2a2aa778332d35d270d95c725d0e7d17a9a0113918f0805f731c7b36270ea69c07e8732d1c40ce662ceba03781fc53ce5034161499f301084a16fe1027c1718c3083c58b9d0c4d53d6b5bd5b8d0ac0b3212fe57929d67f2d7ab90fe50f9f938165d5df4fd29f60572bb759d6b9e257ce2ea5a0d7a751068d92f6fe436f26af8b2bd67f1bc799ad781f09dcf97ee5bbf75cced4180032d969f3bd17140f521eade4b32ab7dd07ad1541f6710e2e946468b2efbab9b53081fdb7c14aceb5d3ea68293d2a2dbc8746909bd703495f3b1ca8e584b5cb023b3530a745f2dd71e3063a932be4cb0622ec4f90769dec916b2cec28c6c4197bfa486d0dea8707bd2d1905efc6a1d1e36e03383450a9b896da5b47a811edf8c2556a0079074a17c004be5fa665cccff89449a45c6a5a626c5196dddbd274e5b3000f9560cb0b6074e545f92b122ac0e0a4c1205e52172f10d3bbaef5d3b75ba299b3ff94ecfb86a20d983f5adca84207df0e0ca693b3e268e4bf081b298b07f8f041cd5a821a201e471f1ba4f50c4a2a3d43b5da25b1937a74f170febf5af5fdf045eeef1a2d5f6a09d1247f6858194de527dec108394b126a276cf50eccef156a7c5278d762c0cfe65979dd5bda864535524a430322e56147d9e91914ebc82e62846c060ddeb3b9391bb6249bc573c419e1a8b0b42964fbcff817d6cfe4a394b8f072eb23f9cd73e79a4877363db39a6b4648cccf10490901d04ef9cf4dff74975c3fc1767ea6ccefcc55c00e7eed94bb5eaf3c40813142f4b105317c8e4ea8b07ec4cf40343de8d688f827aac564004a5995e328122eab3bc49c18c3c38cfd7de18ef89138fcff417ed5d9ad5bea78d87c34c8e16f58852f2531ef7c15c142882e811911d9eaf10f70b6f08e56a748c7567eb90ab99c1c72057f4fbb09a64d2b358ddcd835d954fc0121f4b43af8024b542ca49c75ba6a2accf25464e181efbd02a297c0ed38eaa5fb9d42c45eaf7e75c1a809d2be2ca327b4881f7e2381e74bb2e5413146821c10c305bf9820a361cbda9365d2f75d997520788508a3d5b69d73d565d7d838c71a7ddcdb0187c1ab31ce32696c322861e8404d2821efe2e41c590e1a179dd62cf37a097c23ecfa76bb27f816d4bfcdd1e998a1ea85c97118c9ebf5e52f1e0314592f54212647946184f00f3b6d2cc5a905c2a1cefbc4415e58b767707a2fdf5bc431b462caa5a6fb00b615ef9249cfd74a9926e7c7961e4fe2d8e53c03092f5d438edba7bc3c0e658c3c8afb7384463c87ed5c99657409a7485cc749c46b3e81626b30916a8bea4b0e4b83eff3f756ad10ab06f5bc1fdd91b64ae919901317c7f26a27df0ca6e950fdc9b9464ba3461d99be06b6cddc479fc0431c3a13f2dc63c233597d1bc85dbf2b018d1af2d4c1070d81b1c51a8e2ea3b7bab9bd933261676a99afe0ed21e1cade7c34dd9f22fa92fe8762eb97e09d3c27843719dc2cf21ebb522d9902b8352836669c114cfcff1df6dc931e67ec0b6cfb173e05f5887906fdafcd3db0098d9afa72acba0e9419c30c61062415d9dc4d61f7db33353aa0bd335e39e7fcaf5eaca4a1743690b338e12c033b83a0ba1a3e4740779c6e3916bf93a0693566a53ac99e820525cd345c241e48b04825fad4bed450fbcb2fa17d1cc58014f76ec9844400ee4fef6bf3066a560e83f454f789682c9d341518e0e6a82be674a451a688a60dfb03da78f8a836fd344993e4cdf9718f8ee2db1026a4559e50ae950d75250ef64efc26f3b01f5e7941830476c20578e4b8de5540cc39bd183f8675f0128079f7d45f56235d9c8c346cee04c26f01aecd8103f5cad80d908e8bca373a476f130dcf8e19d7f8d029c33371abcc849f70eb2ba7dd57df091fe10c9c2b4f1b4dd7479e8d00fd5311ee376624c5d195b02b0edfd87492375b2430e93c07abe7750e0ba46137655d9c890d70766bd7df936b05a2cb8bc466d02c5b358f5f60ab30d5664f575c5c3c1af048359aeefee7ce04b594673443c058a5436279e68fba6c69bee38c68f7f54a72df774f10cba027ecfb786eba1f3b4edaac0a715e9a0be28a1e328cd66ee8b8313152de4c4a6ff67b8ee32716e3a845fbb5c8dbf5dff33375be0a7a565f66633c42eaea0419072c7d6bbd88c082224181c9a9d2ed90610d13c47898c25c97794a581f353285dda446b4e0edff794b159ef65c4beabbbbc00f7886c75fa910f5a75e9542980381d73f5619f9a20cb46ca25d1ca09d641a33ca7278469aa228d6169192c1b6b97dbf0582014c20336eca8c87d74701f7c3509e9743ad77a78cda49aba3c4d3f84913ac9242ce3d64677c47eb2b1989140d07d9c191c40888c384d708ee53e74b7c183bfc94454cd4c533089005734af88c72c877525e75d85d83551649868fb06bf7ce618a16c19398b27dc1195f4bc01a5cdc8e7faeff6d581c7adde79e2208b43a39ca95deeb0f85985be19a8844f1753994fd8418f45b4fcc6434761101e0a4b217c6a9d599f7cc7328cc57e248dd9d5b2d5babacf4b3989c97805dae27e519d929a1089db1b3333fa520dcc386e91e83a241b8bb56e8118212c33fe030b8a52d4f8e5b51e7765d6683f7fd3a400d3890dd7e5240ed621c12d5e3d021275f7993287340cd8766dbe5fe461818c1d939e7a6d9d1577f7ddfeafef975dc1960f9722e1f9b49684fb51d58d565eb0f2b675c116c105ca62634813f8b5cc6d60db37de305797f1bd791d365d39509930299535fca79a542aff6b36a7eb4db54d0a8a781985fd6e0bd2381c43e52513267356a0372c2c17c1f2021bffe4775272b5385528f4a0b63663d7477a06d36fecd4989a07911e22b172a75e0917c89872cbf89ff2964c86cb4a3f50fd6be6ca0bc5d1e610b5312cd9f424f52901b68adf9057a5695ba65cc3ff26348a201ac4823c793f76c2ddf0caa6b7470f80f191de6df8a029568dfaf0f3e1d47dbaf35b033fc2aeb59f8a1b14de989a97ee201435729a60c8b0712c31fa39ddc8fb6cdb1985c8d57a11c032a2ed0264e1d7b5a9eaf8d809c87c7c0c0ba936ed14b355097c52108eaa4e6eae279355c7bfe17fdee90f296a23b65c2695a92e6ee5c3bfa3af0417df05b4c042144bda87508a55bb310b19ed5511699d8a16a834b31c5c6c31821473ed535c77e6d877d2d780336497b8ad20c5630f035e39b781ceb17c08924232d46f443428436eb048d55f454827ae5758644ce6ec6f04a2315e604b78203af78015177da90ca47f91b596d3e2d0cb41b7ffb1214a66641c0006bff5728c855e208d644b9c3144c7d41203023b4fc6e015e8d3b18ee8242c7561b80441a9320647796be5d2aeecb9251bdfca12664e603f1952f92a98dc1025601613aeee0b256f1a837fbd66bac4b2e2a2ddea2cb71763e503eddc66d6e85571ad10233ad233fc255432eb8e23ca622112b76194cf270873606ce614fefc95479286", 0x1000}, {&(0x7f0000002680)="1d014f47c5334756d68cace7d5349a48379e14128c37b0d2aabee9d117734fcf86868b6a89617a89c597cb11ddf27cc9a5f56da1eae07238ae05293530251b0c7ac4e1ca2d7267a64caf379b1fdde3ca20622b0636f2a160a50e8226f97571bce354fffea110ecdb3a4a1dac159883aab31105", 0x73}, {&(0x7f0000002700)="7c44c1c376daa9fa56276c79e32cc9e33d69801ce57d116727c4da86142d1a8100098b41dae673ef0fe861e8a607f662009082358c2a50770ca1d1f8dec5f1b11dee3cb79002a9d6d7373570f54a7ed31ebcd23a2616a0f23f46b08fcbc0df42bc8cee4ed2fd676027a6f68e26c2f3b7821d1ef8d5633eef9032735c53b34f22de6ff7481c146eba", 0x88}, {&(0x7f00000027c0)}, {&(0x7f0000002800)="7b81c4ac99948467a7bbf24cd3e5b1c174f62e80349e8719c3efba621eb1afd5442f24b2378b969e7b026b28d94f030877940ab177d94b211a5a458c574f44dc501274c8ff6de7a8141a3544779e7a3ef1c31b95153172f63ecee2faaa2616ec494a3d7be8f599d7e12a808aaa3866699c2b27940fee667918471b971ea165618a6c61f4169843aa3f41b2044731dcf32f271cf5ea4ecd6186a4aa5a984acb49565ef0b05161a1202e9a9d6640c5348df46566a2c1e195d8a271b20421e6105b6efd559c7ff24e63e579a119ee35221795e5373bbdd8f91b892c779d673df3165d118784610152d438b72707bbdf62d751dcdcaf937fb0daa4e721967aec", 0xfe}, {&(0x7f0000002900)="fd0e98941327e727d5090196962ea228135dd5d1f9aa971696c617bced69317edab1f23317416503f0a6d2c503b59cb1aa060c07a939a6c1b5d49e25fea335f305b8d51398ec0282ae296d94caafb0c36411715e46006d29c68d5245c7e63f713819f221c119482bd8171a99be38a323f91de83ad1c7b04a31fa061135a3efcb17b4ec2cda", 0x85}, {&(0x7f00000029c0)="9410c08d8c424f42fda40ff940ce74cf5a4d2dc929fc096696ce69a421e9ec3f6a6ecbbdc451013bf7bf95bfd4879a959f5781bb40c4d59ee041a1ecdf8eab71251c651526f996e4eb411760f6ccf75d3ba10d92d261ecfad24eb857a2560b83b0f052237b6b0e985d1b13c53ce7c5c4479f88ef62e65839516c5ee41faa0151b189f38f59b1b9eaa3ec4b4f2416d0bdfe0c3e728be1ad7547d02f10f8104a8a55dd77a787ae48743b67a0410514a9c62b969d60ebc6a95434c82405dd0d789652e847fb79b2f257d175af1d30ad5bbc2305a7493dc92b318811ab05e2aea8281b136038f7885a369fb94e91a9dadd38e53a35cb48937dd348ab5574d16f42b2b659d356153d1b83d5c82cc677fc1a9eb2216810d1699362b7c6a37de0e8e28e059fc4cb4367edcd822be39b171827bb226518f1d4b09a4c7973a78b58ab69c5162a01ba21aa6101c57450905358a6f38dbd3b067a88840245df58afa3a00c391040e83f6ec5901417c739062404ddaf2d0b899defc5c16c880e6c74675c156061aee04e24efdbbea0f32e407af84d7303b6aada9fb420b6403f6b3d9d88fb4a5f17fb7395a27693ad828d080a13997702f344b49a9e0c5afbbfc8a193da4c60ed33527cc2c3178530e35ba4b5b7b260b7e96334c3b238f0666909c34417d430c5249b3e78dff13f8f5de3a4b07ac53eef33cf4ea1280735e891ec65d20fdecddfb7003981e54428da55b3feae7831f887547fd2f94a31203cabdcc4b2797fc9c81fb633c0822cf8742824ea7d4e12a91c57e48bb183d925e7744da4b56043ffd23cfed72978d4936a62ae785309f69abf1c3c375d117579b6b2a02b9097c53b044d4ac749caca81a655d9987e177067863d09113b782c27e2816c5af01143471ef8c84deef001b92b1ecd40fc02f1b5b7e26a2012fa8ebbff42e00dce2569738f69ccd1d335990bf857a0610a95e637eb6daacdd5819d49e165da305f15974a685517c020a9366a750f850488589e94ff7522b4631afc69f28fc87b4fb70963e9ab78bce57c9ddbdcb1b92ed915d5d33c0496271f2654390fbe6edbb5fb041b1c66da57fdea9c429d88d3f2797cd50a647c18ec002b3a79f0fe5a900b260e84e1cf50f884eca10395ebc80d720d36a2cf7068f3fcebb3b50a1f2e079926762dbc7c8fdc140cba78df3505f77f9299283a0808476aa74b1c3fbfd77fe895bcadf49373517578944a42e2781827aa35775d6c5e1c31dd2d82474ad2ba8160a675064b094c792845ae52c61c847318cc65ac37ea9dfe883c7a2cd3a926ec65c807e0b99c8bca74fb532f4fd233667519f630ca70465a5837dfeb5107430117cef677d3ac18936596b5101a6cfe343dc5c556f1f20685e116bf78e284ed619eb80043dfc347a43ed89d5c20cf42739c2a0d1a948518710633de1b47ef57b6d45f35eb38782cca95b902bb9dc778ef4f72070e601b75f509449802652966ccc6dcc23db6f8daaf18b06a5c4ca31047bd86c66d450313abbcdc086c9faf0d25463efcc76baee1d2ee2a4213eec4df815e6566618bcb31041b41a20acb9ad8065e6078e03b42892dafcf2572f2bd85f81a8e440174656c9ca699d1f61ea62a91a774fe9613a01e9e5ed6a1ab6c355008930ac2ccebd7bad0524e2c22a06bd2e5b6189ea1ab0e1415d21ca7dddb4bfc2fe30087241df0fa9c3fedb105d07b62ca2bb11d447b91b91125d9de34c4e9855b717e553480e5e791bf8c79367d755d0f7784e3bd1f3fe0f6869a41dd462380ef525470e2ad00d64132f9d7df3d2d9e68dc0fb976e666594d0a112c36bba9f9ed9c0b4aa295054dad67de9b6896cd278e869adb5c25203b1f2c74baa7876ab2be6b5bdb38606b5bf5ac81a3f924c7f3c851216f71e601e9904897b9b926cd8823fa197b015e92cd0727273a0181ca79da867981cc3ce2c81ba15ede2addbd1454db68c5f4f82743b46729bf24cc82c9ab069e6f13526ce9593ea92fbdbe2b1938c849436eff069c0a5213e0c0da73ce767fc1c73f5cc7ecc78acb2d622897ea647edf52a7a9f279bb60ef5b66b45a3492ec90f51a976e6673318a2f937ee8a30d00a20e89a297c3973ea72128067e6be601e785a13dcd5f0fd76ddf3f5302e875dbdd311ba8bc3e693301c715876d0fe6b75a342a7f39ca4b3d862927b171931381d34084e62cc0b185e9fd7d3efeab11bb93831e4eae99b3431defb6d4940164534bf0cd4f2ba51c35ebec9c2b74cb51776b9ebbfca70f9ace49dec3c9673a8ff25e3b04f6fe73efc427b201a87d845d822f04b3798a5d63c129e3d8c9f9bac94d8d87e1e8b2d8d26039604454438ada319ea57becd3d75b65d1850bc8dcca8632cc0cb5176517a6364616cf6ccc505f76c511af1ce0d98a359526cf84b9f42ddbe523520a8ecc07082cd5f8fc019d48c5f6c08ee9331f298a86614d243a534e2130926980040a0c0d03804e3aa87a4a81fe382129c135216de0528e5e5686fff1c4b47179f89eb25d049080aa25e79f8d7a7edd29bcd11085dbdea261849cf3e63f7e521b7ad60938ee8cfaa2143cbec59e17bb15a03ee58b631dc167c45a1d8f11c70304363f5940bd536d2c31a479e937090f0c2f222cb777c933bfac641ea5e84e4cbbd3e94294a6281cf167cf179facd5216a504c7e01f05d6eaaa26a2169cdd299b9c738c4425d9179a5f087416328eaad0223d104461be0e7af0602f6350cd605e648c883dd09cbaad3bba51ba8a23ef2b600f6603eefff3d9df4ef4b79f1c66f41eae800b27096a799fe937aa75cb25f35d3aa6d65e756b3b6115679b08aeab8b52ce8865249ab2dd0ede659ed9143e4d56a5d48b63dc03f7a53e14393c56c3728c6cc87344da02c012ccc06c0b803113865bf287d8b66b917958a657fe02228cfa3773200e14193fd95168984dc5a16c181ee089468820ae246213c61d328ba52d9377d8dad8c2440d2ab5b0414b305d1634617c620fca76f15a780561a52b1cb4a99562d7e8c50a0cf921c78da12ce86851e26c8bdcdda8d857b51eadf30bb4e2a01d168fe6d9c6c55b326b4ecec2048527a7ce23214660ea755db8d53f639d8a84006f033b70c5c7b587a61d4c8d3adf6e296cdbccc94120e4b977ae3a635f02af0ba88f0f1a8ba2152727b7ea440f99e4eaa2a954860a153c7e1082f3e9a110ea60aa7c62cabf741ec87175606d78b8d884e58d855740a9a741826f9465b4aed10938fcd0c2c0ccbb35708a47489180151021c5b1c25e5f65aa7ebe30b0e9f056dc855538362bbb5de4f5c3f6e0b5cefcc01b9612f66cd50e438b91645da1acc8efb0b14b7bdb35d90a33b99f5527b88faa45ddf3bea7ac7d29c20b8852cfe6f16a41b57a0a7cc57b534fad5f77b6e9c5b1f310c20edd43dc3795bf72c2d485d8f571555b870eec94440ef019a465c8c108d3586c0d560c77243387cf0f05688abbb39369f4098b2203e1296620268fbd4f77dba6777b8c19afd63af2184a69638773cf6d8befce225eb444f0410853ca8f2aae65f9b4b2543bb404d185e0732639007bc0fee5129942a0af2dc40bde312ed2687aedcb1f9372294ee5bec205410665723832930afb61cba64ebfd5c404e4e838e0aa921fb162d49cf14b67300020372b302b623797001039d4340e24973d3b0ac063a74112e8fd947f8243844751f4b648fff53b4a9d1c9fdfb1b4478144438cb54321194a02468a7d11d19480f2ff2fd0c3d1746cd925524c9be92bd98932f8111b83d56bd34141dfdc71fe5cf5b0073a01d83ebc64755b50dedaf376623c0975f9ab60f06a51418bbed1f940a9d3ac2aa00a80b237758eb82c1549c9f72db35dd0f563f32765864482d4d02510275090a07474bdd13d7767ea709c5bd01340ad16643783310ca740b523b870e10f11882ccf1ff4cf7a72c6e60b182ae46c31c231d95a604217d002bb5e8fee90321dd940a57097499f65dc109e203eade2224b895377c4730ff6199db274cfad63f7437c5cb736e92abee0f0e55c2ab2c99ba14a409ea5b79304137554e89541a99dd57fd7c609946e5df1f84b1c192cef7a1d99a9ac8cccfca0f584508540ca41245f860fdc5eca8c8dd31e91e6a4a2c8a0f23f23371eeb876603269c40086ede6b3e4cc6d1ba61973832959b6ebe688bd2fd96e6d67237f5d9a8f28b93d327238775513f846b3413f096b37751a38677c76ac24c77aa8432fde1880316a40baca7bddaa660b732d4b50e0b6caa921830e96f7df450ac4380a04a4c605991cd256ec7abf2f88b9231165bb67df4b144396b1ede39364438474971dc5e85c3ee77c635dbbcfb5e416b8e00393b0bdf567bd88554ccbf207d74818e168a01b7a27d4fbe2b4775c678c7f04711e18cf3fa5bd9e1083ea0e2eaedfc34c1740b953b3e9a8a865cd9e14656b0c82f53861767aa147b909f7b4822d3441cc3fd8c227eaf17bca094a50e58734b60cb48557a38f321cef195c14f23677dd94a4ea206ebcdf8dc5466ca472f256b9a115b237d33699eded58dd9caa80616ca7619e2c0b31ed4c2f2d221738ec7c58b5d4a1ce826b3e8da966a8986b1be91027847f85492b6589b3c36b950dfd67f99dab3dc9fe703bdb331a00243f884a4918ff9c9a0522f6aeb37aca0b511aee18f253fd6bbddc69b68731cf352dcd3bcd53dbfbe9e84f0541b196eeb6dc9b70f659726287cf191d5973b3fa022c3d7a010e519602bf6b70c88f9c97a805df4dc7bfeb2d5d1caf31a561262dab6d31008a57aca626e030be3f6a02823606d6db4e23fd9aeeff16cf0cc53e0cd1bf926596c26af321659758365211126b4d798af64baf43c3a04a0eaa1001859180e4e8cd923401802ee2046ae1bb8ccaa69d2487ebea67954d0777f431cf30c71da3348d0ff09e07516d14f0ea6ab976e3906080f0592331fa03d2c6e7c9f5eee703fcd59ebe29ad7294b136eda72b944133f91af946eec9b1d43b887be6355a4d835d9a6261abc4b6e52320a8a136a63db30c73a3ceea8222c252cf1c21e1ee8bafb57e41ab9130ddf654bec97f7882776cd7a605c8f5345165c6b265791097f90c7a88768adda3419a95fa03dabe6e2f778e5ab8d8fab785ce0268a7d5a75ce10fe3f18dc4844a2f739cab6590aee6ce7f97bcf237f8bb6977e1ab22fe67c5bb7a6ef8130b5ad8d67c792cc795f3f0e77872692a7327e988231fad821e031a4396916b5febcabdea7545f15f885eec1d00e95aecaa034025eb8114edccc9bb798660719e2ca3ba4836af2059fe6d452c88b0b68347511581f3b5cdf9e21e3ca418d22cc0c81b4b1bec7e9dd03119da761bba08892316cc3ca5b1a04f49bb1dcab9118dbfe4675d86916101cee78ba84ca43dffaf15997ffb50d21178853ee1269f20b3d541fbf6b40f0f81fc3f391ada08086b52e27a139c1b83fe257118e39e607dfe2b854e3f60b6ee7976d10e1d9461051733b454db137d75c91504fefef77ac1a659547200d97b7cb6e272e1f977cf28d5458b304226992924dd35c6dcb3094cea98ed20e00b6fb8934211b443612b70c76b75932af1f3d6ecdfc2971f2e617980bac075e755f9ebaf4a1ac708f9915d51568d48e76d1b1ba6178c33cb1e1e8b400793d1e470e32bec177002d09154d4836f381ba3d01742755e65cf2dd8921e72217769b7acda2907df0c4d6bb52f0e1ddc038cbc9529978f9e56c39abf5fe94c3d8ba445af4010925cdc1362bbef40fd772679b464fe8592d1ffaea84b81324cef4e1ceaec0f40bd7b32fc2171871f100d", 0x1000}, {&(0x7f00000039c0)="f987d6f64af22e201ed7dda62a7b8feda84e5270a551065917977b77451a4f00149b3f6a60ab2b5ca1f2fb6879df780bc0369d1d6b4bab3cb203ed657544d695c32b4b99d7c4606ca82c4d6981d6bc0d387b58f3a455b73e488bb052b38e227246d1211e0c52a8ad4fdbb3e7524819d5c487edd9c79e30c797bcbc3159b577fbb557629384f177a818dd83eb16dbd7785a09c78037c672014ab6db7e77ff4e3b5b518f4dea7e36bd4aff4de88fca11f11f4a440a0b5256b7a54bfb49e54960f2dacc88ac26e2269101479a6e08a6c17631db1bf617fc43e19ba9b9d5f740cbca303155fe5e26978ce81b61de291be0c1eb141edf913e", 0xf6}, {&(0x7f0000003ac0)="fb37b59441639edea1dc3a9f9a6ea13944b3e0d928448ee37724a72864cda43bd8e067ca4048cc9259eea1ba606ed112", 0x30}], 0x9, 0xb) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r6, 0x400455c8, 0x8) 7.057310452s ago: executing program 1 (id=4010): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) connect(r2, &(0x7f0000002440)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x80) r3 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000002c0)='s\xefurce', &(0x7f0000000300)='\xb0\xfb\xd9\x9a\xbe\r\xcc:\x9b\xd0}\xe8\xff\xff\xff\xff\xff\xff\xff\x7f\xce\xf5\x1a\x01\xd6\a\xfe\xb8\x92~wS\x87\xd9\x9e0y\xc9\x8cw-zu(ht\xa1~\x9a\x8d^+\x9f\xee\x9a(&W\\\xbb\xd5W\xeb\x06\x9dva\x06\xe3\x97\xa1\x88\x83W{\x00\xff\xff\xff\xff\xff\xff\xff\xe9\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00)o\b~\xe3t`\xc9=;o\xe5\xb4T)\x04\xf9k\xfb%t\xa7\x80c\xbb\xeb\x10\xb8\x01', 0x0) userfaultfd(0x1) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) recvmmsg(r4, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000440)=""/240, 0xf0}], 0x1}, 0xa5f}], 0x2, 0x40000163, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}}, 0x8000000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 6.813241138s ago: executing program 2 (id=4011): openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x44040) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000001100010027bd7000fddbdf", @ANYRES32=0x0, @ANYBLOB="20100000"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETSW2(r2, 0x402c542c, &(0x7f00000000c0)={0x8, 0xad0, 0x207, 0x2, 0xf6, "03000001000000000800feffff8214ff012000", 0x808, 0x1}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0x3) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x1) read$FUSE(r0, &(0x7f0000001540)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) socket(0x2b, 0x80801, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0) pipe2(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) readv(r4, &(0x7f0000002940)=[{&(0x7f0000002a40)=""/197, 0xc5}, {&(0x7f0000001840)=""/233, 0xe9}, {&(0x7f0000001940)=""/4096, 0x1000}], 0x3) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000100)="19", 0x1}], 0x1) ioctl$EXT4_IOC_CHECKPOINT(r5, 0x4004662b, &(0x7f0000000140)=0x1) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket$inet_udp(0x2, 0x2, 0x0) sched_setscheduler(r3, 0x0, &(0x7f0000003580)=0x3) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x7800, 0x8000, 0x1, 0x5, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x3, 0x0, 0x1, 0x4, 0x0, @local, @loopback}}}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x3c1, 0x3, 0x13c0, 0x11e0, 0xc8, 0x8, 0x0, 0x5803, 0x12f0, 0x2e8, 0x2e8, 0x12f0, 0x2e8, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xffffff00, 0xffffff00, 0xff, 0xffffff00], [0x0, 0x0, 0xff000000, 0xff000000], 'virt_wifi0\x00', 'netdevsim0\x00', {0xff}, {}, 0x1d, 0x4, 0x7, 0x45}, 0x0, 0x1198, 0x11e0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x2, 0x3}}, @common=@unspec=@cgroup1={{0x1030}, {0xfc, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0xfffffffffffffffc}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x81, 0x8, 0xe, 'netbios-ns\x00', {0x1}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1420) 6.316906458s ago: executing program 0 (id=4012): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r3 = socket$key(0xf, 0x3, 0x2) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pipe2$watch_queue(0x0, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0xc3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0}, 0x0) sched_setaffinity(r5, 0x8, &(0x7f00000002c0)=0x2) r6 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="650a5f840000000061119c550e3737a072152300"/30], &(0x7f0000000000)='GPL\x00'}, 0x94) pipe2$watch_queue(0x0, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0xe2) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r4, 0x62) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r3, &(0x7f0000000180), 0x400008a, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500090000001400040073"], 0x58}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000f00)) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) 5.736107237s ago: executing program 0 (id=4013): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket(0x26, 0x1, 0x1) r2 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@rand_addr=0x64010100, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {0x0, 0x0, 0xfffffffffffffff7, 0x4}, 0x0, 0x6e6bb9, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0xfffffffc, 0x6c}, 0x0, @in6=@empty, 0xfffffffc, 0x0, 0x2, 0x7, 0x200}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0x0) connect$inet(r1, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000200)="e1", 0xfea8, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xea8, 0xe) r3 = getpid() r4 = getpid() syz_clone3(&(0x7f0000001e00)={0x200000, &(0x7f0000000cc0), &(0x7f0000000d00), 0x0, {0x32}, &(0x7f0000000d80)=""/4096, 0x1000, &(0x7f0000001d80)=""/36, &(0x7f0000001dc0)=[r3, r3, r4, r4, r3], 0x5}, 0x58) r5 = geteuid() lstat(&(0x7f0000002180)='./file0\x00', &(0x7f00000021c0)) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=@newsa={0xfc, 0x16, 0x633, 0x0, 0x80000000, {{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, r5}, {@in=@broadcast, 0x4d2, 0x32}, @in6=@loopback, {}, {0x5, 0xffffffffffffffff, 0x0, 0xc1}, {0x4, 0x2}, 0x6, 0x2, 0xa, 0x4, 0x18, 0x19}, [@mark={0xc, 0x15, {0x35075c, 0x1}}]}, 0xfc}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e24, @private=0xa010102}, 0x10) setsockopt$inet_tcp_int(r6, 0x6, 0xc, &(0x7f0000000000)=0x7, 0x4) socket$nl_route(0x10, 0x3, 0x0) fanotify_mark(0xffffffffffffffff, 0x10, 0x40000000, 0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00') 5.410616942s ago: executing program 5 (id=4014): r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x54) socket(0x2b, 0x80801, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) stat(&(0x7f0000000000)='./cgroup/file0\x00', &(0x7f0000000240)) getpid() bpf$MAP_CREATE(0x0, 0x0, 0x50) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x102) connect$inet6(0xffffffffffffffff, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2000000000000) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x439, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, 0x49801, 0x59fc9}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIXLEN={0x6, 0xd, 0xfffb}, @IFLA_IPTUN_LINK={0x8, 0x1, r1}]}}}]}, 0x40}}, 0x0) 4.887609888s ago: executing program 2 (id=4015): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01080000000000000000010000000900030073797a32000000001400048008000240fffffffe08000140000000040900010073797a30000000004c000000060a010400000000000000000100000208000b40000000000900010073797a30000000002400048020"], 0xd4}, 0x1, 0x0, 0x0, 0x2000c045}, 0x24000004) 4.867686294s ago: executing program 3 (id=4016): syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x403, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad, 0x5e801}}, 0x20}}, 0x440088c4) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e20, @loopback}, {0x2, 0x4e26, @local}, {0x2, 0x4ea3, @empty}, 0x3c7, 0x0, 0x0, 0x0, 0x7, 0x0, 0x7, 0x416, 0x800}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}}, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000240)=r2) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) sendmsg$nl_route_sched(r0, &(0x7f0000000680)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)=@gettaction={0x194, 0x32, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x6a31}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x80, 0x1, [{0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xec6a}}]}, @action_gd=@TCA_ACT_TAB={0x74, 0x1, [{0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xa}}, {0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x10, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe95f}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xff}}]}, @action_gd=@TCA_ACT_TAB={0x64, 0x1, [{0x10, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x6}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}]}, 0x194}, 0x1, 0x0, 0x0, 0x40}, 0xc000) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) r5 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x48) r6 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r5, &(0x7f0000000280), &(0x7f0000001840)=@udp6=r6}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r5, &(0x7f0000000140), &(0x7f0000000000)=""/82}, 0x20) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000200)={&(0x7f0000000080)=[{0x50, 0x8001, 0x0, 0x0}, {0xd, 0x4001, 0x0, 0x0}], 0x2}) mbind(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2, &(0x7f0000000040)=0x9, 0xfffffffffffffffd, 0x7) 4.823021665s ago: executing program 1 (id=4017): r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x54) socket(0x2b, 0x80801, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) stat(&(0x7f0000000000)='./cgroup/file0\x00', &(0x7f0000000240)) getpid() bpf$MAP_CREATE(0x0, 0x0, 0x50) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x2000000000000) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x439, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, 0x49801, 0x59fc9}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIXLEN={0x6, 0xd, 0xfffb}, @IFLA_IPTUN_LINK={0x8, 0x1, r1}]}}}]}, 0x40}}, 0x0) 4.739420966s ago: executing program 5 (id=4018): syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) syz_open_dev$MSR(0x0, 0x0, 0x0) socket$inet6(0xa, 0x3, 0x3c) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000200)=""/4, 0x4}], 0x1}, 0x4}], 0x1, 0x40000121, 0x0) r1 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) openat$mixer(0xffffffffffffff9c, 0x0, 0x90903, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=@newlink={0x30, 0x10, 0x1, 0x70bd29, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x49815, 0x3}, [@IFLA_TXQLEN={0x8, 0xd, 0x1}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) mount(&(0x7f00000003c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000300)='udf\x00', 0x200480, 0x0) sendmsg$kcm(r1, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0xfffe, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca) gettid() openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x16ba82, 0x1) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGKBDIACR(r4, 0x4bfa, &(0x7f0000000080)=""/2) syz_extract_tcp_res(&(0x7f00000000c0), 0x9, 0xfffffffb) pipe(&(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)) socket(0x10, 0x3, 0x0) 4.717107449s ago: executing program 0 (id=4019): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000100010000000900010073797a30000000000900020073797a3000000000400003800800014000000000080002400000fbff2b0003801400010067656e6576653000000000000000000014000100776732000000000000000000c6e49c0f5c000000180a0101000b000000000000010000000900020073797a3000000000090001"], 0x110}}, 0x0) (fail_nth: 1) 4.332686802s ago: executing program 2 (id=4020): r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000180)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x80800) sendmsg$inet(r3, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000c80)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x3}}], 0x18}, 0x10) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r4 = openat$zero(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x8400, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) syslog(0x2, &(0x7f0000000080)=""/27, 0x1b) r5 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000005c0)={'hsr0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="170000000000000004000000ede6d67200000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="006690e5020000000000000000000800eeff00530931f52f0513007929be2ca2aff2edbc05d9a365def90bb9e5d54754526ae01e9b46468e5eace41c153b4bfa7372e420d9"], 0x48) bind$packet(r5, &(0x7f00000001c0)={0x11, 0x0, r6}, 0x14) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_tcp_int(r7, 0x6, 0x1, 0x0, &(0x7f0000000240)) io_uring_setup(0x516, &(0x7f0000000640)={0x0, 0xddaa, 0x2, 0x503fa, 0x8100014e}) bind$tipc(0xffffffffffffffff, 0x0, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r8, 0xc0a85320, &(0x7f0000000c40)={{0x80}, 'port0\x00', 0x72, 0x11cfa, 0x0, 0x8000008, 0x1000003, 0x4, 0x1, 0x0, 0x7cce8c743ee810df}) 4.303938261s ago: executing program 1 (id=4021): syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000040)={0x3ff, 0xa, 0x101, 0x4, 0x9c62, 0x3}) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffc000/0x3000)=nil) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r3 = memfd_secret(0x80000) mmap$KVM_VCPU(&(0x7f0000ffe000/0x1000)=nil, r2, 0x2, 0x110, r3, 0x0) ioctl$OCFS2_IOC_GROUP_EXTEND(r3, 0x40046f01, &(0x7f0000000080)=0x800) read$msr(r3, &(0x7f00000000c0)=""/92, 0x5c) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x103100, 0x0) ioctl$TIOCOUTQ(r4, 0x5411, &(0x7f0000000180)) ioctl$KVM_SET_USER_MEMORY_REGION2(r3, 0x40a0ae49, &(0x7f00000001c0)={0x10201, 0x3, 0x1, 0x2000, &(0x7f0000ffc000/0x2000)=nil, 0x7, r3}) connect$pppoe(r3, &(0x7f0000000280)={0x18, 0x0, {0x2, @random="83c02a312436", 'veth1_to_bridge\x00'}}, 0x1e) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f00000002c0)="6a9d519e1158f411ec51de1a2ebea79cfb96f70d052638549ea0397ee274d54e94060e996ddc18c6d3a6ce745bddddfd5701cf16be1b2bece951baf80e4a") r5 = syz_open_dev$MSR(&(0x7f0000000300), 0x1, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f0000000340)=@x86={0x99, 0x5, 0x1, 0x0, 0x81, 0x3, 0x1, 0xf, 0x3, 0x9, 0x6, 0x7f, 0x0, 0x401, 0xf4c, 0xcb, 0x9, 0xc6, 0x6, '\x00', 0x81, 0x40}) readv(r5, &(0x7f00000016c0)=[{&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/15, 0xf}, {&(0x7f00000013c0)=""/159, 0x9f}, {&(0x7f0000001480)=""/217, 0xd9}, {&(0x7f0000001580)=""/141, 0x8d}, {&(0x7f0000001640)=""/37, 0x25}, {&(0x7f0000001680)=""/60, 0x3c}], 0x7) ioctl$USBDEVFS_GET_CAPABILITIES(r3, 0x8004551a, &(0x7f0000001740)) r6 = ioctl$USERFAULTFD_IOC_NEW(r3, 0xaa00) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000001780)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x4}) socket$alg(0x26, 0x5, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000017c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r7, &(0x7f0000001900)=[{&(0x7f0000001800)="5ce65fa9fc99a755a75ad5534638b513301e2b2493442a6d2f2248b0e14499ec5dc6c9594aedbe36adb4cdba3d1c6d60e6a4cefb22148f58c0f55d45be232eff01263ee1d3d62b66aba6a9dd508efb29513ab2bf4d6bf358574920c38c88a57aebe71ca610eaf5525a0f12d5a36b60d0dc46032357e408360f2541f0cc22200086c0080e1ab4461d7855d37ac14dca40bdf8c897100d50f13b4460380a57bedf30786d313fa21a175e9c44825178026f0a697fa42333d5d0a592ddeb7a5322931bbe29a7933801e5c1964217844a13a40e0c214453a5e467", 0xd8}], 0x1, 0xc) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r3, 0x110, 0x3) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001980), r3) sendmsg$NL80211_CMD_DEL_INTERFACE(r3, &(0x7f0000001a40)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001a00)={&(0x7f00000019c0)={0x20, r8, 0x800, 0x70bd26, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x200, 0x54}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x800) sendmsg$NL80211_CMD_ABORT_SCAN(r3, &(0x7f0000001b40)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x1c, r8, 0x2, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, ["", "", "", "", ""]}, 0x1c}}, 0x20008040) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000001b80)={0x1b}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r3, 0xc010641d, &(0x7f0000001c40)={0x0, &(0x7f0000001c00)=""/47}) 3.983556135s ago: executing program 0 (id=4022): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000980)=ANY=[], 0x94}, 0x1, 0x0, 0x0, 0x24000840}, 0x40) r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000600), 0x1, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x482000, 0x0) 3.855973653s ago: executing program 1 (id=4023): socket$kcm(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, 0x0) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) epoll_create1(0x80000) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/hardlockup_count', 0x800, 0x4) read$char_usb(r4, &(0x7f0000000040)=""/236, 0xec) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) mount$nfs4(&(0x7f00000001c0)='./binderfs/binder0\x00', &(0x7f0000000340)='./file0\x00', &(0x7f00000003c0), 0x80000, &(0x7f00000006c0)=ANY=[@ANYBLOB='/dev/snd/midiC#D#\x00,,\x00,s,/\\^,obj_user=%(,fowner=', @ANYRESDEC=0x0, @ANYBLOB="2c6d61736b3d4d41595f524541442c657569643d675cafee043a05b0e627e97b91635cecd2164d3dc7cf18c604cf0100001b000000809e5b0442adf7720da178", @ANYRESDEC=0x0, @ANYBLOB=',context=staff_u,\x00']) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYRES8], &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f00000000c0)={0xa, 0x1}, 0x8}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x9e, &(0x7f0000000640)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000400)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, 0x3a, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r7, 0x0, 0x0, 0x0, 0x10, 0x4a7}, 0x94) 3.65656195s ago: executing program 2 (id=4024): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) connect(r2, &(0x7f0000002440)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x80) fsopen(&(0x7f0000000040)='afs\x00', 0x0) userfaultfd(0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r5, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r3}, 0x20) recvmmsg(r3, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000440)=""/240, 0xf0}], 0x1}, 0xa5f}], 0x2, 0x40000163, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}}, 0x8000000) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 2.912083157s ago: executing program 1 (id=4025): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) connect(r2, &(0x7f0000002440)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x80) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) userfaultfd(0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r5, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r3}, 0x20) recvmmsg(r3, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000440)=""/240, 0xf0}], 0x1}, 0xa5f}], 0x2, 0x40000163, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}}, 0x8000000) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 2.510426668s ago: executing program 3 (id=4026): syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000340)=@ethtool_gstrings={0x1b, 0x8}}) r1 = openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = add_key(&(0x7f0000000840)='keyring\x00', &(0x7f0000000880)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000180)='asymmetric\x00', 0x0, &(0x7f0000000200)="1f10", 0xfffff, r2) socket(0x10, 0x800, 0xffffffc0) socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(0xffffffffffffffff, 0x6f2d, 0x6) r3 = getpid() r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00003ffe0000000000000008000f00fd000000", 0x24) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x1, 0x4, 0x101, 0x0, 0x0, {0x364547f0da26e060, 0x0, 0xa}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0xffffffff}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c811}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000940)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r8, 0xc05064a7, &(0x7f0000000a00)={0x0, 0x0, 0x0, &(0x7f0000000900), 0x0, 0x0, 0x0, 0x0, r9}) 1.531255163s ago: executing program 3 (id=4027): openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) syslog(0x2, &(0x7f0000000bc0)=""/27, 0x1b) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_tcp_int(r4, 0x6, 0x1, 0x0, &(0x7f0000000240)) connect$inet(r3, &(0x7f0000003580)={0x2, 0x0, @dev}, 0x10) io_uring_setup(0x516, &(0x7f0000000640)={0x0, 0xddaa, 0x2, 0x503fa, 0x8100014e}) r5 = socket$tipc(0x1e, 0x2, 0x0) read$msr(r2, &(0x7f0000000280)=""/140, 0x8c) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000000)={0x2001}, 0x10) bind$tipc(r5, 0x0, 0x0) r6 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x2) readv(r6, &(0x7f0000000980)=[{&(0x7f0000000000)=""/58, 0x3a}], 0x1) 1.304580128s ago: executing program 0 (id=4028): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r4 = fsopen(&(0x7f0000000000)='binfmt_misc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fsmount(r4, 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r3, 0x7a5, &(0x7f00000000c0)={{@my=0x0}, 0x1}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0100000007000000060000000900000000000000", @ANYRES32, @ANYBLOB="00ff0f00000000000000000100000023ecd2e4f16c00000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) ioctl$OCFS2_IOC_UNRESVSP64(r5, 0x4030582b, &(0x7f0000000040)={0x0, 0x1, 0x100000001, 0x7, 0xfffffff9, 0xffffffff}) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r6 = memfd_create(&(0x7f0000000840)='\x01\xfd\xae.+\xa6\x8c\xb6?2\x199\x94S,|x?Ue[\xbd\xe1!\x033\xbc\'#\xff\x17\x9b%\xf3[d \x06\x00\x00\x00\x97A\xc2\xd8\xf0Uq!\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xe5,\x82\x03\x00\x19\x8d\xff\xff\xff\xff\xb4\x99\x8a\x19\xe5\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xcc\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\x16\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xe7!\x8f\xf6]-\xf1k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7c\x06\x00\x00\x00\x00\x00\x00\x001\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6\xbel\x9b.o\xbe\x80\x9dx\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9k\x83\xfc\xa4\xad4\x03\xa2X\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfc^\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\xaf\xa2\x14]p+\x96\x1ei|n\xda\xee\\\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\xf8\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11X\xe6:\x03\xce\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xfc\xbc\xeb[^\xc7\xc0v/\xdfY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0a\x86\t\xaf\vi\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xed\x86\xd7\x15&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96?\x00\x00\x00\x9f\x0f\x00\x00\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKl\xcc\xa4:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcb\xcaXe\xe1\xa2\xaa\x02\x86\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01O\xd3r\x93>m\xd7q\'\xdf\xfajo\xd8n\xa7\xecJi\xde\xdf\x7f\xe3\xc4*Z 4\xe8S$\xa1H=\xdf\x05\xf3\xc3T\xd1\xdd\xc6f\xa4\xb4\x96\\\xa0\xf9\x0f\x17\x11{\xb6\x9d\xd21\xc1\x90Vj\x13r\x00\x00\xde\x03\xab\xff\x8as0\xc6E\xca\"\xd9*\x9a\x15\xb95r\x8f\xaaj\x82\xd6\xd2%\xed\xa2WQ\xec2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xccX\xfdRB\xffU\xe9\xfa\x1f\xf6\xce\b\xde@\x061\xc6z\xe4\xe0\xc9?\xa7\x94>\x9c\xd1\xa5o\x04\xaaim\xae\xfe\xc7f\xa3\x96\xd7\xb4c)r{\r#\xddI&\n\xf2\xec\xd4\xff\x9f\x136zZ-2\x80\xfbH+\x9b8\xf3\xed\xdf\xa2my\xb28c[\xc3\xfe\xb5M\x84\x97\xa5\'s\xe9\xdc=)I\xabLt2\x9c\v\xd9S\x00\x00\x00\x00\x00\x00\x00', 0x6) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000280)=ANY=[@ANYBLOB="34000023f800", @ANYRES16=r8, @ANYBLOB="010026bd7000ffdbdf250200000008000300", @ANYRES32=r9, @ANYBLOB="0500180128000000050019010c000000080026006c090000"], 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) fallocate(r6, 0x0, 0xb, 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r6, 0x0) socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000100)=@ethtool_pauseparam={0x13, 0x10, 0x41, 0x5}}) 671.189321ms ago: executing program 5 (id=4029): syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000340)=@ethtool_gstrings={0x1b, 0x8}}) r1 = openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = add_key(&(0x7f0000000840)='keyring\x00', &(0x7f0000000880)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000180)='asymmetric\x00', 0x0, &(0x7f0000000200)="1f10", 0xfffff, r2) socket(0x10, 0x800, 0xffffffc0) socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(0xffffffffffffffff, 0x6f2d, 0x6) r3 = getpid() r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00003ffe0000000000000008000f00fd000000", 0x24) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x1, 0x4, 0x101, 0x0, 0x0, {0x364547f0da26e060, 0x0, 0xa}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0xffffffff}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c811}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000940)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r8, 0xc05064a7, &(0x7f0000000a00)={0x0, 0x0, 0x0, &(0x7f0000000900), 0x0, 0x0, 0x0, 0x0, r9}) 550.283021ms ago: executing program 3 (id=4030): sendmsg$IEEE802154_LIST_IFACE(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4010}, 0x4000) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000b80)=ANY=[], 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1f, 0xc, 0x0, &(0x7f0000000000)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000680)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000bf080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000020000b7050000080000001c00000000000000bf9800000000000056080000000000008500000006000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 546.32988ms ago: executing program 1 (id=4031): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r4 = fsopen(&(0x7f0000000000)='binfmt_misc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fsmount(r4, 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r3, 0x7a5, &(0x7f00000000c0)={{@my=0x0}, 0x1}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0100000007000000060000000900000000000000", @ANYRES32, @ANYBLOB="00ff0f00000000000000000100000023ecd2e4f16c00000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) ioctl$OCFS2_IOC_UNRESVSP64(r5, 0x4030582b, &(0x7f0000000040)={0x0, 0x1, 0x100000001, 0x7, 0xfffffff9, 0xffffffff}) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r6 = memfd_create(&(0x7f0000000840)='\x01\xfd\xae.+\xa6\x8c\xb6?2\x199\x94S,|x?Ue[\xbd\xe1!\x033\xbc\'#\xff\x17\x9b%\xf3[d \x06\x00\x00\x00\x97A\xc2\xd8\xf0Uq!\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xe5,\x82\x03\x00\x19\x8d\xff\xff\xff\xff\xb4\x99\x8a\x19\xe5\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xcc\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\x16\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xe7!\x8f\xf6]-\xf1k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7c\x06\x00\x00\x00\x00\x00\x00\x001\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6\xbel\x9b.o\xbe\x80\x9dx\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9k\x83\xfc\xa4\xad4\x03\xa2X\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfc^\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\xaf\xa2\x14]p+\x96\x1ei|n\xda\xee\\\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\xf8\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11X\xe6:\x03\xce\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xfc\xbc\xeb[^\xc7\xc0v/\xdfY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0a\x86\t\xaf\vi\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xed\x86\xd7\x15&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96?\x00\x00\x00\x9f\x0f\x00\x00\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKl\xcc\xa4:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcb\xcaXe\xe1\xa2\xaa\x02\x86\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01O\xd3r\x93>m\xd7q\'\xdf\xfajo\xd8n\xa7\xecJi\xde\xdf\x7f\xe3\xc4*Z 4\xe8S$\xa1H=\xdf\x05\xf3\xc3T\xd1\xdd\xc6f\xa4\xb4\x96\\\xa0\xf9\x0f\x17\x11{\xb6\x9d\xd21\xc1\x90Vj\x13r\x00\x00\xde\x03\xab\xff\x8as0\xc6E\xca\"\xd9*\x9a\x15\xb95r\x8f\xaaj\x82\xd6\xd2%\xed\xa2WQ\xec2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xccX\xfdRB\xffU\xe9\xfa\x1f\xf6\xce\b\xde@\x061\xc6z\xe4\xe0\xc9?\xa7\x94>\x9c\xd1\xa5o\x04\xaaim\xae\xfe\xc7f\xa3\x96\xd7\xb4c)r{\r#\xddI&\n\xf2\xec\xd4\xff\x9f\x136zZ-2\x80\xfbH+\x9b8\xf3\xed\xdf\xa2my\xb28c[\xc3\xfe\xb5M\x84\x97\xa5\'s\xe9\xdc=)I\xabLt2\x9c\v\xd9S\x00\x00\x00\x00\x00\x00\x00', 0x6) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000280)=ANY=[@ANYBLOB="34000023f800", @ANYRES16=r8, @ANYBLOB="010026bd7000ffdbdf250200000008000300", @ANYRES32=r9, @ANYBLOB="0500180128000000050019010c000000080026006c090000"], 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) fallocate(r6, 0x0, 0xb, 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r6, 0x0) socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000100)=@ethtool_pauseparam={0x13, 0x10, 0x41, 0x5}}) 0s ago: executing program 0 (id=4032): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000003c0)={'wg1\x00', 0x0}) getpeername$packet(0xffffffffffffffff, &(0x7f00000004c0)={0x11, 0x0, 0x0}, &(0x7f0000000500)=0x14) sendmmsg$inet(r0, &(0x7f0000000600)=[{{&(0x7f0000004740)={0x2, 0x4e24, @empty}, 0x10, 0x0}}, {{&(0x7f0000000140)={0x2, 0x4e22, @empty}, 0x10, 0x0}}, {{&(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3e}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="a2e613814d00000000", 0x9}, {&(0x7f0000000280)="37fef323882a78b143807702d0a1acd8f03a30f86c5ccb9b1f4921", 0x1b}, {&(0x7f00000002c0)="c73b7a71481ae3acdf7a39abfd8118ed7ba0fcda504b7dfc3432a3674494a3cb9006603fba85298d60881692e7ba36bf4efbc9f42514dd1f", 0x38}, {&(0x7f0000000340)="ab05377e3783c13807a9f0f202c309e7e23ffd4d556e041810d2c871ab90902c51bdd2157dcbd0583d33e45b01bcde11a5b948b391382da2c884a146a2", 0x3d}], 0x4, &(0x7f0000000400)=[@ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @dev={0xac, 0x14, 0x14, 0x11}, @rand_addr=0x64010101}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x7}}], 0x68}}, {{&(0x7f0000000480)={0x2, 0x4e22, @local}, 0x10, 0xfffffffffffffffd, 0x0, &(0x7f0000000540)=[@ip_ttl={{0x14, 0x0, 0x2, 0x6}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5a}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x7f}}, @ip_ttl={{0x14, 0x0, 0x2, 0xff}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @multicast1, @private=0xa010101}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @loopback, @multicast2}}}], 0xa0}}], 0x4, 0x0) clock_settime(0x0, &(0x7f0000000040)={0x77359400}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) mmap$panthor(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x30, r5, 0x3) ioctl$DRM_IOCTL_GET_CAP(r5, 0xc010640c, &(0x7f0000000300)={0x13}) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a78000000060a0b160000000000000000020000084c00048018000180080001006f7366000c000280080001400000000430000180080001006e6174002400028008000140000000000800034000000014080002400000000208000440000000140900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a9c10fc6d1339d4d022c230004bc09e742110836aad7765ea3f4d91c700ceb84e8303e8963f2c70ef913158f6f6eef4683f6ecb1696842a92ba"], 0xa0}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) kernel console output (not intermixed with test programs): 801520][ T5701] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 772.818558][ T5701] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 772.853130][ T5701] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 773.370286][ T5701] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now attached [ 773.654323][ T5708] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 773.703084][T19490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3675'. [ 773.790714][ T5701] usb 3-1: USB disconnect, device number 91 [ 773.800281][ T5701] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 773.834623][ T5708] usb 2-1: Using ep0 maxpacket: 16 [ 773.886093][ T5708] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 773.952155][T19495] syzkaller0: entered promiscuous mode [ 773.957968][T19495] syzkaller0: entered allmulticast mode [ 774.148757][ T5708] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.159728][ T5708] usb 2-1: Product: syz [ 774.164251][ T5708] usb 2-1: Manufacturer: syz [ 774.168929][ T5708] usb 2-1: SerialNumber: syz [ 774.203308][ T5708] usb 2-1: config 0 descriptor?? [ 774.261062][T19498] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3678'. [ 774.901749][ T5708] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 774.913533][ T5708] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 774.924157][ T5708] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 774.932606][ T5708] usb 2-1: media controller created [ 774.950325][ T5708] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 775.176159][ T5708] zl10353_read_register: readreg error (reg=127, ret==0) [ 775.184790][ T5708] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 775.193196][ T5708] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 775.250187][ T5708] usb 2-1: USB disconnect, device number 63 [ 775.560594][ T5708] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 775.671124][T19507] netlink: 'syz.0.3681': attribute type 49 has an invalid length. [ 776.085417][T19529] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3685'. [ 777.241858][T19544] netlink: 'syz.2.3688': attribute type 49 has an invalid length. [ 777.972379][T19556] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 777.980670][T19556] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 777.989783][T19556] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 777.998008][T19556] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock [ 778.650473][T19567] kAFS: unable to lookup cell 'ÿ' [ 778.995570][T17476] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 779.175322][T17476] usb 4-1: Using ep0 maxpacket: 16 [ 779.200705][T17476] usb 4-1: config 252 has an invalid interface number: 15 but max is 0 [ 779.212059][T19582] kAFS: unable to lookup cell 'ÿ' [ 779.235788][T17476] usb 4-1: config 252 has no interface number 0 [ 779.265376][T17476] usb 4-1: config 252 interface 15 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 779.315632][T17476] usb 4-1: config 252 interface 15 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 779.353591][T17476] usb 4-1: config 252 interface 15 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 779.454223][T17476] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 779.463415][T17476] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 779.499495][T17476] usb 4-1: Product: syz [ 779.507947][T17476] usb 4-1: Manufacturer: syz [ 779.557251][T17476] usb 4-1: SerialNumber: syz [ 779.571098][T19569] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 779.587583][T17476] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 780.632489][ T7916] usb 4-1: Failed to submit usb control message: -110 [ 781.209717][ T7916] usb 4-1: unable to send the bmi data to the device: -110 [ 781.217705][ T7916] usb 4-1: unable to get target info from device [ 781.224460][ T7916] usb 4-1: could not get target info (-110) [ 781.230593][ T7916] usb 4-1: could not probe fw (-110) [ 782.312921][ T5708] usb 4-1: USB disconnect, device number 89 [ 782.512272][ T29] audit: type=1400 audit(1782216988.129:689): avc: denied { write } for pid=19604 comm="syz.5.3706" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 782.535987][T19610] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=53 sclass=netlink_route_socket pid=19610 comm=syz.5.3706 [ 782.685093][ T5730] usb 1-1: new full-speed USB device number 91 using dummy_hcd [ 782.857281][ T5730] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 782.880976][T19618] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8 sclass=netlink_route_socket pid=19618 comm=syz.2.3708 [ 782.881204][ T5730] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 782.905606][ T5730] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 782.919242][T19606] SELinux: ebitmap: empty map [ 782.924154][T19606] SELinux: invalid class [ 782.929765][T19606] SELinux: failed to load policy [ 782.938834][ T5730] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 782.950364][ T29] audit: type=1400 audit(1782216988.539:690): avc: denied { load_policy } for pid=19604 comm="syz.5.3706" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 782.985196][ T5730] usb 1-1: config 0 descriptor?? [ 782.992872][ T5730] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 783.013904][ T5730] dvb-usb: bulk message failed: -22 (3/0) [ 783.036185][ T5730] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 783.047860][T19618] syzkaller0: entered promiscuous mode [ 783.047922][ T5730] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 783.061479][ T5730] usb 1-1: media controller created [ 783.068981][ T5730] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 783.074815][T19618] syzkaller0: entered allmulticast mode [ 783.104339][ T5730] dvb-usb: bulk message failed: -22 (6/0) [ 783.118136][ T5730] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 783.127303][ T5730] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input90 [ 783.155656][ T5730] dvb-usb: schedule remote query interval to 150 msecs. [ 783.172170][ T5730] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 783.294849][T19608] dvb-usb: bulk message failed: -22 (2/0) [ 783.309342][ T5730] usb 1-1: USB disconnect, device number 91 [ 783.310087][T19634] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 783.326861][T19634] UDF-fs: Scanning with blocksize 512 failed [ 783.336593][ T5729] usb 4-1: new full-speed USB device number 90 using dummy_hcd [ 783.365260][T19634] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 783.391699][ T5730] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 783.405593][T19634] UDF-fs: Scanning with blocksize 1024 failed [ 783.412398][T19634] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 783.419982][T19634] UDF-fs: Scanning with blocksize 2048 failed [ 783.426625][T19634] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 783.435410][T19634] UDF-fs: Scanning with blocksize 4096 failed [ 783.535371][ T5729] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 783.546487][ T5729] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 783.556073][ T5729] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 783.565334][ T5729] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 783.594258][ T5729] usb 4-1: config 0 descriptor?? [ 783.615703][ T5729] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 783.623637][ T5729] dvb-usb: bulk message failed: -22 (3/0) [ 783.644085][ T5729] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 783.655641][ T5729] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 783.663314][ T5729] usb 4-1: media controller created [ 783.670003][ T5729] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 783.763830][ T5729] dvb-usb: bulk message failed: -22 (6/0) [ 783.778812][ T5729] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 783.789109][ T5729] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input91 [ 783.816045][T19628] dvb-usb: bulk message failed: -22 (2/0) [ 783.823189][ T5729] dvb-usb: schedule remote query interval to 150 msecs. [ 783.842204][ T5729] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 783.900991][ T5729] usb 4-1: USB disconnect, device number 90 [ 783.961481][ T5729] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 784.146738][T19644] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3718'. [ 784.703705][T19612] Bluetooth: hci3: command 0x0406 tx timeout [ 784.709994][T14177] Bluetooth: hci4: command 0x0406 tx timeout [ 784.788953][T19659] netlink: 'syz.5.3721': attribute type 49 has an invalid length. [ 785.273296][T19660] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3723'. [ 785.288289][T19667] loop2: detected capacity change from 0 to 7 [ 785.303071][T19667] Dev loop2: unable to read RDB block 7 [ 785.322192][T19667] loop2: unable to read partition table [ 785.341174][T19667] loop2: partition table beyond EOD, truncated [ 785.355152][T19667] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 785.535392][T19677] binder_alloc: 19670: binder_alloc_buf, no vma [ 785.634039][T19681] kAFS: unable to lookup cell 'ÿ' [ 785.786601][T19684] FAULT_INJECTION: forcing a failure. [ 785.786601][T19684] name failslab, interval 1, probability 0, space 0, times 0 [ 785.829835][T19684] CPU: 1 UID: 0 PID: 19684 Comm: syz.0.3728 Tainted: G L syzkaller #0 PREEMPT(full) [ 785.829865][T19684] Tainted: [L]=SOFTLOCKUP [ 785.829871][T19684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 785.829880][T19684] Call Trace: [ 785.829886][T19684] [ 785.829893][T19684] dump_stack_lvl+0x100/0x190 [ 785.829920][T19684] should_fail_ex.cold+0x5/0xa [ 785.829941][T19684] ? fs_reclaim_acquire+0x70/0x100 [ 785.829962][T19684] should_failslab+0xc2/0x120 [ 785.829981][T19684] __kmalloc_noprof+0xfc/0x820 [ 785.829998][T19684] ? rcu_is_watching+0x12/0xc0 [ 785.830021][T19684] ? tomoyo_realpath_from_path+0xb6/0x690 [ 785.830041][T19684] tomoyo_realpath_from_path+0xb6/0x690 [ 785.830062][T19684] tomoyo_path_number_perm+0x23c/0x580 [ 785.830086][T19684] ? tomoyo_path_number_perm+0x22e/0x580 [ 785.830117][T19684] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 785.830143][T19684] ? preempt_count_add+0x76/0x150 [ 785.830166][T19684] ? rcu_is_watching+0x12/0xc0 [ 785.830189][T19684] ? __fget_files+0x215/0x3d0 [ 785.830204][T19684] ? hook_file_ioctl_common+0x140/0x440 [ 785.830226][T19684] ? lock_release+0x24d/0x310 [ 785.830246][T19684] ? __fget_files+0x21f/0x3d0 [ 785.830262][T19684] security_file_ioctl+0xd3/0x230 [ 785.830280][T19684] __x64_sys_ioctl+0xb7/0x210 [ 785.830304][T19684] do_syscall_64+0x115/0x870 [ 785.830331][T19684] ? clear_bhb_loop+0x40/0x90 [ 785.830350][T19684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.830368][T19684] RIP: 0033:0x7f03ae59ce59 [ 785.830381][T19684] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 785.830398][T19684] RSP: 002b:00007f03ac7f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 785.830416][T19684] RAX: ffffffffffffffda RBX: 00007f03ae815fa0 RCX: 00007f03ae59ce59 [ 785.830428][T19684] RDX: 0000200000000000 RSI: 00000000c028aa05 RDI: 0000000000000003 [ 785.830439][T19684] RBP: 00007f03ac7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 785.830450][T19684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 785.830461][T19684] R13: 00007f03ae816038 R14: 00007f03ae815fa0 R15: 00007ffec15c4088 [ 785.830478][T19684] [ 785.833262][T19684] ERROR: Out of memory at tomoyo_realpath_from_path. [ 786.419925][T19689] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3730'. [ 786.619632][T19693] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 786.631199][T19693] UDF-fs: Scanning with blocksize 512 failed [ 786.642833][T19693] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 786.663581][T19693] UDF-fs: Scanning with blocksize 1024 failed [ 786.671155][T19693] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 786.693628][T19693] UDF-fs: Scanning with blocksize 2048 failed [ 786.748282][T19693] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 786.769921][T19693] UDF-fs: Scanning with blocksize 4096 failed [ 786.780158][T19699] kAFS: unable to lookup cell 'ÿ' [ 788.093376][ T5729] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 788.227563][T19726] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 788.233386][ T5729] usb 4-1: device descriptor read/64, error -71 [ 788.265900][T19726] UDF-fs: Scanning with blocksize 512 failed [ 788.285540][T19726] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 788.294464][T19726] UDF-fs: Scanning with blocksize 1024 failed [ 788.360145][T19726] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 788.382235][T19726] UDF-fs: Scanning with blocksize 2048 failed [ 788.573931][ T5729] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 788.742596][T19726] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 788.767082][T19726] UDF-fs: Scanning with blocksize 4096 failed [ 788.780529][T19737] kAFS: unable to lookup cell 'ÿ' [ 788.863409][ T5729] usb 4-1: device descriptor read/64, error -71 [ 788.983541][ T5729] usb usb4-port1: attempt power cycle [ 789.366213][T19749] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 789.374404][T19749] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 789.383313][T19749] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 789.391410][T19749] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 789.563338][ T5729] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 789.593983][ T5729] usb 4-1: device descriptor read/8, error -71 [ 789.853298][ T5729] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 789.893618][ T5729] usb 4-1: device descriptor read/8, error -71 [ 790.030564][ T5729] usb usb4-port1: unable to enumerate USB device [ 792.396476][T19767] /dev/nullb0: Can't open blockdev [ 792.432960][T19782] kAFS: unable to lookup cell 'ÿ' [ 792.753387][ T5730] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 793.163137][ T5730] usb 1-1: Using ep0 maxpacket: 8 [ 793.174439][ T5730] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 793.213168][ T5730] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 793.256336][ T5730] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 793.290789][ T5730] usb 1-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 793.319250][T19790] kAFS: unable to lookup cell 'ÿ' [ 793.324647][ T5730] usb 1-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 793.345920][ T5730] usb 1-1: Product: syz [ 793.361126][ T5730] usb 1-1: Manufacturer: syz [ 793.375607][ T5730] usb 1-1: SerialNumber: syz [ 793.402841][ T5730] usb 1-1: config 0 descriptor?? [ 793.459154][T19793] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3755'. [ 793.552575][ T29] audit: type=1400 audit(1782216999.170:691): avc: denied { getopt } for pid=19795 comm="syz.2.3756" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 793.577979][ T5730] rc_core: IR keymap rc-imon-rsc not found [ 793.584533][ T5730] Registered IR keymap rc-empty [ 793.594260][ T5730] rc rc0: iMON Station as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 793.599832][T19794] xt_cgroup: path and classid specified [ 793.728308][ T5730] input: iMON Station as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input92 [ 793.742300][T19776] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 794.232070][T19776] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 794.633000][ T5701] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 794.776154][ T5729] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 794.803062][ T5701] usb 3-1: Using ep0 maxpacket: 16 [ 794.811827][ T5701] usb 3-1: config 252 has an invalid interface number: 15 but max is 0 [ 794.826086][ T5701] usb 3-1: config 252 has no interface number 0 [ 794.838319][ T5701] usb 3-1: config 252 interface 15 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 794.862752][ T5701] usb 3-1: config 252 interface 15 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 794.879577][ T5701] usb 3-1: config 252 interface 15 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 794.906148][ T5701] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 794.922984][ T5701] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.934468][ T5701] usb 3-1: Product: syz [ 794.941281][ T5701] usb 3-1: Manufacturer: syz [ 794.949229][ T5701] usb 3-1: SerialNumber: syz [ 794.954073][ T5729] usb 6-1: Using ep0 maxpacket: 16 [ 794.961210][ T5729] usb 6-1: config 252 has an invalid interface number: 15 but max is 0 [ 794.973870][T19805] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 794.974541][ T5729] usb 6-1: config 252 has no interface number 0 [ 794.990025][ T5729] usb 6-1: config 252 interface 15 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 794.990622][ T5701] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 795.022419][ T5729] usb 6-1: config 252 interface 15 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 795.051365][ T5729] usb 6-1: config 252 interface 15 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 795.091456][ T5729] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 795.102801][ T5729] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 795.118810][T19814] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 795.130530][ T5729] usb 6-1: Product: syz [ 795.135317][ T5729] usb 6-1: Manufacturer: syz [ 795.140432][ T5729] usb 6-1: SerialNumber: syz [ 795.154378][T19807] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 795.172439][ T5729] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 795.186612][T19814] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 795.237078][T19814] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 795.258049][T19814] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 796.113403][ T35] usb 3-1: Failed to submit usb control message: -110 [ 796.113590][ T35] usb 3-1: unable to send the bmi data to the device: -110 [ 796.113690][ T35] usb 3-1: unable to get target info from device [ 796.113754][ T35] usb 3-1: could not get target info (-110) [ 796.113854][ T35] usb 3-1: could not probe fw (-110) [ 796.233453][ T12] usb 6-1: Failed to submit usb control message: -110 [ 796.233655][ T12] usb 6-1: unable to send the bmi data to the device: -110 [ 796.233758][ T12] usb 6-1: unable to get target info from device [ 796.233822][ T12] usb 6-1: could not get target info (-110) [ 796.233913][ T12] usb 6-1: could not probe fw (-110) [ 796.674721][ T5730] usb 1-1: USB disconnect, device number 92 [ 796.971239][T19834] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3762'. [ 797.483201][ T5709] usb 1-1: new full-speed USB device number 93 using dummy_hcd [ 797.686187][ T5730] usb 3-1: USB disconnect, device number 92 [ 797.727333][ T5709] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 797.738845][ T5709] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 797.766390][ T5709] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 797.786555][ T5709] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 797.874545][ T5709] usb 1-1: config 0 descriptor?? [ 797.882607][T19845] vlan2: entered allmulticast mode [ 797.887882][T19845] bond0: entered allmulticast mode [ 797.890412][ T5709] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 797.900117][T19845] bond_slave_0: entered allmulticast mode [ 797.906305][T19845] bond_slave_1: entered allmulticast mode [ 797.906748][ T5709] dvb-usb: bulk message failed: -22 (3/0) [ 798.148193][ T5709] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 798.180044][ T5709] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 798.180088][ T5709] usb 1-1: media controller created [ 798.181046][ T5709] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 798.194695][ T5709] dvb-usb: bulk message failed: -22 (6/0) [ 798.194727][ T5709] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 798.208275][T19853] dvb-usb: bulk message failed: -22 (2/0) [ 798.210810][ T5709] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input93 [ 798.212239][ T5709] dvb-usb: schedule remote query interval to 150 msecs. [ 798.212267][ T5709] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 798.262238][T19854] kAFS: unable to lookup cell 'ÿ' [ 798.372796][ T5709] dvb-usb: bulk message failed: -22 (1/0) [ 798.372830][ T5709] dvb-usb: error while querying for an remote control event. [ 798.543107][ T5709] dvb-usb: bulk message failed: -22 (1/0) [ 798.549477][ T5709] dvb-usb: error while querying for an remote control event. [ 798.583077][ T5701] usb 3-1: new full-speed USB device number 93 using dummy_hcd [ 798.603435][ T804] usb 1-1: USB disconnect, device number 93 [ 798.615839][ T804] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 798.747479][ T5701] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 798.758906][ T5701] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 798.768132][ T5701] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 798.778138][ T5701] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 798.843263][ T5701] usb 3-1: config 0 descriptor?? [ 798.869049][ T5701] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 798.879039][ T5701] dvb-usb: bulk message failed: -22 (3/0) [ 798.895951][ T5701] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 798.907981][ T5701] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 798.915565][ T5701] usb 3-1: media controller created [ 798.922554][ T5701] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 798.943241][ T5701] dvb-usb: bulk message failed: -22 (6/0) [ 798.957035][ T5701] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 798.979454][ T5701] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input94 [ 799.006397][ T5701] dvb-usb: schedule remote query interval to 150 msecs. [ 799.033324][ T5701] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 799.192959][ T5701] dvb-usb: bulk message failed: -22 (1/0) [ 799.202067][ T5701] dvb-usb: error while querying for an remote control event. [ 799.256796][T19861] dvb-usb: bulk message failed: -22 (2/0) [ 799.305493][ T5701] usb 3-1: USB disconnect, device number 93 [ 799.347233][ T5701] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 799.382063][T19863] kAFS: unable to lookup cell 'ÿ' [ 799.596238][ T29] audit: type=1326 audit(1782217005.220:692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19864 comm="syz.1.3770" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc3d039ce59 code=0x0 [ 799.716796][T19871] netlink: 'syz.3.3771': attribute type 11 has an invalid length. [ 800.124594][ T5709] usb 6-1: USB disconnect, device number 40 [ 800.547529][T19884] syzkaller0: entered promiscuous mode [ 800.553333][T19884] syzkaller0: entered allmulticast mode [ 800.719443][T19885] kAFS: unable to lookup cell 'ÿ' [ 801.865245][T19895] netlink: 'syz.0.3777': attribute type 1 has an invalid length. [ 801.992706][ T5709] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 802.196092][ T5709] usb 4-1: Using ep0 maxpacket: 16 [ 802.269259][ T5709] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 802.298889][ T5709] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 802.312900][ T5709] usb 4-1: Product: syz [ 802.600800][ T5709] usb 4-1: Manufacturer: syz [ 802.612570][ T5709] usb 4-1: SerialNumber: syz [ 802.646411][ T5709] usb 4-1: config 0 descriptor?? [ 802.672302][T19906] kAFS: unable to lookup cell 'ÿ' [ 802.931322][T19912] netlink: 'syz.2.3782': attribute type 11 has an invalid length. [ 803.176335][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 803.185818][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 803.185855][ T5709] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 803.202553][ T804] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 803.238185][ T5709] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 803.283135][ T5709] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 803.327534][ T5709] usb 4-1: media controller created [ 803.354027][T19914] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3783'. [ 803.364093][ T804] usb 1-1: Using ep0 maxpacket: 16 [ 803.378263][ T804] usb 1-1: unable to get BOS descriptor or descriptor too short [ 803.379159][ T5709] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 803.400466][ T804] usb 1-1: string descriptor 0 read error: -22 [ 803.411592][ T804] usb 1-1: New USB device found, idVendor=041e, idProduct=3263, bcdDevice= 0.40 [ 803.454736][ T804] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 803.471368][ T804] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 803.504067][ T5709] zl10353_read_register: readreg error (reg=127, ret==0) [ 803.522699][ T5709] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 803.531159][ T5709] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 803.566743][ T5709] usb 4-1: USB disconnect, device number 95 [ 803.638143][ T5709] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 803.684536][T19908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3781'. [ 803.701649][T19917] xt_cgroup: path and classid specified [ 803.732829][T19908] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 803.742467][ T29] audit: type=1400 audit(1782217009.350:693): avc: denied { mounton } for pid=19907 comm="syz.0.3781" path="/file0" dev="ramfs" ino=74167 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 803.766174][T19908] overlayfs: fs on '.' does not support file handles, falling back to index=off,nfs_export=off. [ 803.826957][T19908] overlayfs: failed to get uuid (/file0, err=-95); falling back to uuid=null. [ 803.880808][ T804] usb 1-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 803.898596][ T804] usb 1-1: 2:1 : invalid channels 0 [ 804.040044][ T804] usb 1-1: USB disconnect, device number 94 [ 804.306585][T19926] syzkaller0: entered promiscuous mode [ 804.312160][T19926] syzkaller0: entered allmulticast mode [ 804.616114][T19931] binder_alloc: 19927: binder_alloc_buf, no vma [ 804.712172][T19934] netlink: 'syz.3.3788': attribute type 11 has an invalid length. [ 804.803836][ T5709] usb 6-1: new full-speed USB device number 41 using dummy_hcd [ 805.047438][T19939] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8 sclass=netlink_route_socket pid=19939 comm=syz.0.3789 [ 805.081160][T19939] syzkaller0: entered promiscuous mode [ 805.094097][T19939] syzkaller0: entered allmulticast mode [ 805.106014][ T5709] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 805.117979][ T5709] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 805.140430][T19941] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 805.142087][ T5709] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 805.159637][T19941] UDF-fs: Scanning with blocksize 512 failed [ 805.167057][ T5709] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 805.176223][T19941] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 805.184473][T19941] UDF-fs: Scanning with blocksize 1024 failed [ 805.193333][ T5709] usb 6-1: config 0 descriptor?? [ 805.207786][T19941] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 805.210537][ T5709] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 805.225679][T19941] UDF-fs: Scanning with blocksize 2048 failed [ 805.229970][ T5709] dvb-usb: bulk message failed: -22 (3/0) [ 805.239367][T19941] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 805.241789][ T5709] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 805.247074][T19941] UDF-fs: Scanning with blocksize 4096 failed [ 805.264144][ T5709] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 805.283909][ T5709] usb 6-1: media controller created [ 805.308392][ T5709] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 805.338719][T19946] kAFS: unable to lookup cell 'ÿ' [ 805.345507][ T5709] dvb-usb: bulk message failed: -22 (6/0) [ 805.351939][ T5709] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 805.375092][ T5709] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input95 [ 805.430046][ T5709] dvb-usb: schedule remote query interval to 150 msecs. [ 805.458891][T19950] dvb-usb: bulk message failed: -22 (2/0) [ 805.475886][ T5709] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 805.535940][ T5709] usb 6-1: USB disconnect, device number 41 [ 805.565133][ T5709] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 805.912383][ T5730] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 806.082997][ T5730] usb 2-1: Using ep0 maxpacket: 16 [ 806.117603][ T5730] usb 2-1: config 252 has an invalid interface number: 15 but max is 0 [ 806.135664][T19964] kAFS: unable to lookup cell 'ÿ' [ 806.142700][ T5730] usb 2-1: config 252 has no interface number 0 [ 806.159830][ T5730] usb 2-1: config 252 interface 15 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 806.203772][ T5730] usb 2-1: config 252 interface 15 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 806.236749][ T5730] usb 2-1: config 252 interface 15 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 806.259295][T19967] binder_alloc: 19965: binder_alloc_buf, no vma [ 806.273273][ T5730] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 806.293432][ T5730] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 806.327505][ T5730] usb 2-1: Product: syz [ 806.343169][ T5730] usb 2-1: Manufacturer: syz [ 806.359683][ T5730] usb 2-1: SerialNumber: syz [ 806.381677][T19954] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 806.399662][ T5730] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 807.423043][ T7923] usb 2-1: Failed to submit usb control message: -110 [ 807.423137][ T7923] usb 2-1: unable to send the bmi data to the device: -110 [ 807.423207][ T7923] usb 2-1: unable to get target info from device [ 807.423271][ T7923] usb 2-1: could not get target info (-110) [ 807.423337][ T7923] usb 2-1: could not probe fw (-110) [ 807.996961][T19979] binder_alloc: 19977: binder_alloc_buf, no vma [ 808.271472][T19985] netlink: 'syz.3.3801': attribute type 49 has an invalid length. [ 808.312435][ T5729] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 808.492465][ T5729] usb 1-1: Using ep0 maxpacket: 8 [ 808.510971][ T5729] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 808.519931][ T5729] usb 1-1: config 0 has no interface number 0 [ 808.522210][ T5730] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 808.534100][ T5729] usb 1-1: config 0 interface 1 has no altsetting 0 [ 808.548897][ T5729] usb 1-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 808.558303][ T5729] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 808.568162][ T5729] usb 1-1: Product: syz [ 808.578855][ T5729] usb 1-1: Manufacturer: syz [ 808.584176][ T5729] usb 1-1: SerialNumber: syz [ 808.592958][ T5729] usb 1-1: config 0 descriptor?? [ 808.742256][ T5730] usb 3-1: Using ep0 maxpacket: 8 [ 808.749524][ T5730] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 808.759711][ T5730] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 808.771860][ T5730] usb 3-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 808.781494][ T5730] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 808.797535][ T5730] usb 3-1: Product: syz [ 808.802276][ T5730] usb 3-1: Manufacturer: syz [ 808.812215][ T5730] usb 3-1: SerialNumber: syz [ 808.852413][ T5730] usb 3-1: config 0 descriptor?? [ 809.054737][ T5729] i2c-cp2615 1-1:0.1: probe with driver i2c-cp2615 failed with error -22 [ 809.129935][ T5729] usb 1-1: USB disconnect, device number 95 [ 809.186835][ T5709] usb 2-1: USB disconnect, device number 64 [ 809.401324][T19986] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 809.410917][T19986] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 809.429126][T19986] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3802'. [ 809.440295][T19986] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3802'. [ 809.456796][T19986] syzkaller0: entered promiscuous mode [ 809.462873][T19986] syzkaller0: entered allmulticast mode [ 809.622150][ T5729] usb 6-1: new full-speed USB device number 42 using dummy_hcd [ 809.632328][ T5730] usb 3-1: USB disconnect, device number 94 [ 809.793626][ T5729] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 809.850353][ T5729] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 810.113209][ T5729] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 810.122747][ T5729] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 810.131863][ T5729] usb 6-1: config 0 descriptor?? [ 810.138767][ T5729] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 810.148611][ T5729] dvb-usb: bulk message failed: -22 (3/0) [ 810.173378][ T5729] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 810.206422][ T5729] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 810.228160][ T5729] usb 6-1: media controller created [ 810.245957][ T5729] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 810.264075][ T5729] dvb-usb: bulk message failed: -22 (6/0) [ 810.273646][ T5729] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 810.287639][ T5729] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input96 [ 810.312897][ T5729] dvb-usb: schedule remote query interval to 150 msecs. [ 810.322668][ T5729] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 810.342930][T20000] dvb-usb: bulk message failed: -22 (2/0) [ 810.360820][ T5729] usb 6-1: USB disconnect, device number 42 [ 810.387006][ T5729] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 810.521861][T20013] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3809'. [ 811.228818][T20024] kAFS: unable to lookup cell 'ÿ' [ 812.210694][T20034] kAFS: unable to lookup cell 'ÿ' [ 812.538945][T20039] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3814'. [ 812.806277][T20043] FAULT_INJECTION: forcing a failure. [ 812.806277][T20043] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 812.821514][T20043] CPU: 0 UID: 0 PID: 20043 Comm: syz.1.3818 Tainted: G L syzkaller #0 PREEMPT(full) [ 812.821541][T20043] Tainted: [L]=SOFTLOCKUP [ 812.821548][T20043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 812.821557][T20043] Call Trace: [ 812.821563][T20043] [ 812.821569][T20043] dump_stack_lvl+0x100/0x190 [ 812.821595][T20043] should_fail_ex.cold+0x5/0xa [ 812.821618][T20043] _copy_from_user+0x2e/0xd0 [ 812.821643][T20043] copy_msghdr_from_user+0x9f/0x4c0 [ 812.821667][T20043] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 812.821693][T20043] ? kstrtouint_from_user+0x13c/0x1d0 [ 812.821713][T20043] ___sys_sendmsg+0x106/0x1e0 [ 812.821737][T20043] ? __pfx____sys_sendmsg+0x10/0x10 [ 812.821759][T20043] ? get_pid_task+0x106/0x250 [ 812.821783][T20043] ? rcu_is_watching+0x12/0xc0 [ 812.821810][T20043] __sys_sendmsg+0x160/0x210 [ 812.821826][T20043] ? __pfx___sys_sendmsg+0x10/0x10 [ 812.821845][T20043] ? rcu_is_watching+0x12/0xc0 [ 812.821866][T20043] do_syscall_64+0x115/0x870 [ 812.821887][T20043] ? clear_bhb_loop+0x40/0x90 [ 812.821902][T20043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 812.821927][T20043] RIP: 0033:0x7fc3d039ce59 [ 812.821942][T20043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 812.821957][T20043] RSP: 002b:00007fc3d1308028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 812.821974][T20043] RAX: ffffffffffffffda RBX: 00007fc3d0615fa0 RCX: 00007fc3d039ce59 [ 812.821985][T20043] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 812.821995][T20043] RBP: 00007fc3d1308090 R08: 0000000000000000 R09: 0000000000000000 [ 812.822005][T20043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 812.822015][T20043] R13: 00007fc3d0616038 R14: 00007fc3d0615fa0 R15: 00007ffdec597bf8 [ 812.822030][T20043] [ 813.217353][T20046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3817'. [ 815.406867][ T5709] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 815.422201][ T4928] Bluetooth: hci1: command 0x0406 tx timeout [ 815.561842][ T5709] usb 4-1: Using ep0 maxpacket: 8 [ 815.570861][ T5709] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 815.582754][ T5709] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 815.606057][ T5709] usb 4-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 815.621611][ T5709] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 815.630132][ T5709] usb 4-1: Product: syz [ 815.634624][ T5709] usb 4-1: Manufacturer: syz [ 815.640188][ T5709] usb 4-1: SerialNumber: syz [ 815.649134][ T5709] usb 4-1: config 0 descriptor?? [ 815.819270][T20089] kAFS: unable to lookup cell 'ÿ' [ 815.861108][T20071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 815.897356][T20071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 816.000448][T20091] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3828'. [ 816.009547][T20071] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3824'. [ 816.029940][T20071] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3824'. [ 816.083011][T20071] syzkaller0: entered promiscuous mode [ 816.089669][T20071] syzkaller0: entered allmulticast mode [ 816.184862][T20095] kAFS: unable to lookup cell 'ÿ' [ 816.232387][ T5709] usb 4-1: USB disconnect, device number 96 [ 816.496767][T20102] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3832'. [ 817.429504][T20104] netlink: 'syz.3.3834': attribute type 1 has an invalid length. [ 817.452841][T20106] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3833'. [ 817.464482][ T29] audit: type=1400 audit(1782217023.091:694): avc: denied { map } for pid=20105 comm="syz.0.3833" path="socket:[74464]" dev="sockfs" ino=74464 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 818.213107][T20122] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 818.228345][T20122] UDF-fs: Scanning with blocksize 512 failed [ 818.254818][T20122] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 818.286962][T20122] UDF-fs: Scanning with blocksize 1024 failed [ 818.343358][T20122] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 818.391331][T20122] UDF-fs: Scanning with blocksize 2048 failed [ 818.482068][T20122] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 818.489924][T20122] UDF-fs: Scanning with blocksize 4096 failed [ 818.721688][ T5729] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 818.738232][T20133] kAFS: unable to lookup cell 'ÿ' [ 818.815598][T20135] kAFS: unable to lookup cell 'ÿ' [ 818.882294][ T5729] usb 1-1: Using ep0 maxpacket: 8 [ 818.900646][ T5729] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 818.924268][ T5729] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 819.008312][ T5729] usb 1-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 819.062452][ T5729] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 819.105672][ T5729] usb 1-1: Product: syz [ 819.115504][ T5729] usb 1-1: Manufacturer: syz [ 819.121177][ T5729] usb 1-1: SerialNumber: syz [ 819.128740][ T5729] usb 1-1: config 0 descriptor?? [ 819.353164][T20125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 819.374450][T20125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 819.403467][T20125] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3838'. [ 819.437570][T20125] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3838'. [ 819.484997][T20125] syzkaller0: entered promiscuous mode [ 819.513707][T20125] syzkaller0: entered allmulticast mode [ 819.594877][ T804] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 819.622104][ T5729] usb 1-1: USB disconnect, device number 96 [ 819.763465][ T804] usb 4-1: Using ep0 maxpacket: 16 [ 819.782251][ T804] usb 4-1: config 252 has an invalid interface number: 15 but max is 0 [ 819.801992][ T804] usb 4-1: config 252 has no interface number 0 [ 819.824130][ T804] usb 4-1: config 252 interface 15 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 819.871686][ T804] usb 4-1: config 252 interface 15 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 819.943675][ T804] usb 4-1: config 252 interface 15 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 819.980077][ T804] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 819.995336][ T804] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 820.013038][ T804] usb 4-1: Product: syz [ 820.020131][ T804] usb 4-1: Manufacturer: syz [ 820.025093][ T804] usb 4-1: SerialNumber: syz [ 820.033528][T20139] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 820.047052][ T804] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 820.251647][ T5729] usb 3-1: new full-speed USB device number 95 using dummy_hcd [ 820.416129][ T5729] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 820.479985][ T5729] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 820.490358][T20159] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3846'. [ 820.521591][ T5729] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 821.102084][T15907] usb 4-1: Failed to submit usb control message: -110 [ 821.102213][T15907] usb 4-1: unable to send the bmi data to the device: -110 [ 821.102286][T15907] usb 4-1: unable to get target info from device [ 821.102379][T15907] usb 4-1: could not get target info (-110) [ 821.102518][T15907] usb 4-1: could not probe fw (-110) [ 821.481120][ T5729] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 821.539839][ T5729] usb 3-1: config 0 descriptor?? [ 821.600318][T20154] xt_cgroup: path and classid specified [ 821.620618][ T5729] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 821.670253][ T5729] dvb-usb: bulk message failed: -22 (3/0) [ 821.686733][ T5729] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 821.699625][ T5729] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 821.725590][ T5729] usb 3-1: media controller created [ 821.734664][ T5729] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 822.045281][ T5729] dvb-usb: bulk message failed: -22 (6/0) [ 822.060763][ T5729] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 822.085324][T20167] syzkaller0: entered promiscuous mode [ 822.090943][T20167] syzkaller0: entered allmulticast mode [ 822.099159][ T5729] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input97 [ 822.121888][ T5729] dvb-usb: schedule remote query interval to 150 msecs. [ 822.135483][ T5729] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 822.256083][T20145] dvb-usb: bulk message failed: -22 (2/0) [ 822.278453][ T5729] usb 3-1: USB disconnect, device number 95 [ 822.327655][ T5729] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 822.332157][T20178] kAFS: unable to lookup cell 'ÿ' [ 822.434162][T20182] netlink: 'syz.1.3851': attribute type 49 has an invalid length. [ 822.718988][ T5708] usb 4-1: USB disconnect, device number 97 [ 822.911146][T20188] netlink: 'syz.1.3853': attribute type 1 has an invalid length. [ 822.920600][ T804] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 823.171744][ T804] usb 1-1: Using ep0 maxpacket: 8 [ 823.337615][ T804] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 823.350339][ T804] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 823.365797][ T804] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 823.380937][ T804] usb 1-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 823.399355][ T804] usb 1-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 823.421470][ T804] usb 1-1: Product: syz [ 823.425672][ T804] usb 1-1: Manufacturer: syz [ 823.431051][ T804] usb 1-1: SerialNumber: syz [ 823.444909][ T804] usb 1-1: config 0 descriptor?? [ 823.580914][ T29] audit: type=1326 audit(1782217029.191:695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20196 comm="syz.2.3856" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f45a339ce59 code=0x0 [ 823.660863][ T804] rc_core: IR keymap rc-imon-rsc not found [ 823.681148][ T804] Registered IR keymap rc-empty [ 823.692511][ T804] rc rc0: iMON Station as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 823.714624][ T804] input: iMON Station as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input98 [ 823.854006][T20207] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8 sclass=netlink_route_socket pid=20207 comm=syz.3.3857 [ 823.911511][T20207] syzkaller0: entered promiscuous mode [ 823.929737][T20207] syzkaller0: entered allmulticast mode [ 823.996030][T20212] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 824.071594][ T804] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 824.271611][ T804] usb 3-1: Using ep0 maxpacket: 32 [ 824.280778][ T804] usb 3-1: too many configurations: 17, using maximum allowed: 8 [ 824.302603][ T804] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 824.314108][ T804] usb 3-1: config 0 has no interface number 0 [ 824.357621][ T804] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 824.367389][ T804] usb 3-1: config 0 has no interface number 0 [ 824.386268][ T804] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 824.397018][ T804] usb 3-1: config 0 has no interface number 0 [ 824.410814][ T804] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 824.426111][ T804] usb 3-1: config 0 has no interface number 0 [ 824.434809][ T804] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 824.444967][ T804] usb 3-1: config 0 has no interface number 0 [ 824.452977][ T804] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 824.463784][ T804] usb 3-1: config 0 has no interface number 0 [ 824.470663][ T804] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 824.480164][ T804] usb 3-1: config 0 has no interface number 0 [ 824.487315][ T804] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 824.495759][ T804] usb 3-1: config 0 has no interface number 0 [ 824.504624][ T804] usb 3-1: New USB device found, idVendor=108c, idProduct=0168, bcdDevice=84.b2 [ 824.528870][ T804] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 824.545216][ T804] usb 3-1: Product: syz [ 824.554753][ T804] usb 3-1: Manufacturer: syz [ 824.570624][ T804] usb 3-1: SerialNumber: syz [ 824.585333][ T804] usb 3-1: config 0 descriptor?? [ 824.601954][ T804] etas_es58x 3-1:0.2: Starting syz syz (Serial Number syz) [ 824.617257][T20221] xt_CT: You must specify a L4 protocol and not use inversions on it [ 824.822981][T20228] netlink: 'syz.3.3864': attribute type 49 has an invalid length. [ 825.073607][T20229] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3865'. [ 825.379214][T20236] kAFS: unable to lookup cell 'ÿ' [ 825.398319][ T5708] usb 1-1: USB disconnect, device number 97 [ 825.405101][ T804] etas_es58x 3-1:0.2: could not parse product info: '424242424242' [ 826.135482][T20257] kAFS: unable to lookup cell 'ÿ' [ 826.199105][ T29] audit: type=1400 audit(1782217031.821:696): avc: denied { write } for pid=20244 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 826.332237][T20263] kAFS: unable to lookup cell 'ÿ' [ 826.427633][ T29] audit: type=1400 audit(1782217032.041:697): avc: denied { write } for pid=20264 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 826.616191][ T5272] etas_es58x 3-1:0.2 can0: bit-timing not yet defined [ 826.623757][ C0] etas_es58x 3-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 826.632915][ C0] etas_es58x 3-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 826.642053][ C0] etas_es58x 3-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 826.651190][ C0] etas_es58x 3-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 826.660325][ C0] etas_es58x 3-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 826.669753][ T804] usb 3-1: USB disconnect, device number 96 [ 826.676438][ T804] etas_es58x 3-1:0.2: Disconnecting syz syz [ 826.718645][ T5272] etas_es58x 3-1:0.2 can0: es58x_open: Could not open the network device: -EINVAL [ 827.154565][T20275] syzkaller0: entered promiscuous mode [ 827.160193][T20275] syzkaller0: entered allmulticast mode [ 827.520844][T20283] xt_cgroup: path and classid specified [ 827.883953][T20292] kAFS: unable to lookup cell 'ÿ' [ 828.069918][ T29] audit: type=1400 audit(1782217033.692:698): avc: denied { write } for pid=20267 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 828.209121][ T29] audit: type=1400 audit(1782217033.832:699): avc: denied { write } for pid=20298 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 828.519586][T20310] kAFS: unable to lookup cell 'ÿ' [ 828.590318][T20312] kAFS: unable to lookup cell 'ÿ' [ 829.157142][ T29] audit: type=1400 audit(1782217034.772:700): avc: denied { write } for pid=20301 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 829.239678][ T29] audit: type=1400 audit(1782217034.862:701): avc: denied { write } for pid=20325 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 829.820230][T20339] kAFS: unable to lookup cell 'ÿ' [ 829.861024][ T5701] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 829.954466][ T29] audit: type=1400 audit(1782217035.582:702): avc: denied { write } for pid=20327 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 830.023265][ T5701] usb 1-1: Using ep0 maxpacket: 16 [ 830.053695][ T5701] usb 1-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 830.099227][ T5701] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 830.149751][ T5701] usb 1-1: Product: syz [ 830.171131][ T5701] usb 1-1: Manufacturer: syz [ 830.171208][ T29] audit: type=1400 audit(1782217035.792:703): avc: denied { write } for pid=20344 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 830.229016][ T5701] usb 1-1: SerialNumber: syz [ 830.252311][ T5701] usb 1-1: config 0 descriptor?? [ 830.401428][ T5730] usb 4-1: new full-speed USB device number 98 using dummy_hcd [ 830.473447][T20349] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3883'. [ 830.517290][T20349] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3883'. [ 830.526850][ T7924] netdevsim netdevsim5 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 830.548009][ T7924] netdevsim netdevsim5 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 830.548294][T20352] FAULT_INJECTION: forcing a failure. [ 830.548294][T20352] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 830.580177][ T7924] netdevsim netdevsim5 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 830.589446][ T7924] netdevsim netdevsim5 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 830.600263][T20352] CPU: 0 UID: 0 PID: 20352 Comm: syz.1.3884 Tainted: G L syzkaller #0 PREEMPT(full) [ 830.600291][T20352] Tainted: [L]=SOFTLOCKUP [ 830.600298][T20352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 830.600308][T20352] Call Trace: [ 830.600315][T20352] [ 830.600322][T20352] dump_stack_lvl+0x100/0x190 [ 830.600348][T20352] should_fail_ex.cold+0x5/0xa [ 830.600368][T20352] _copy_from_user+0x2e/0xd0 [ 830.600394][T20352] copy_msghdr_from_user+0x9f/0x4c0 [ 830.600420][T20352] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 830.600446][T20352] ? __pfx__kstrtoull+0x10/0x10 [ 830.600465][T20352] ? putname+0xb1/0x110 [ 830.600483][T20352] ___sys_sendmsg+0x106/0x1e0 [ 830.600507][T20352] ? __pfx____sys_sendmsg+0x10/0x10 [ 830.600536][T20352] ? rcu_is_watching+0x12/0xc0 [ 830.600567][T20352] __sys_sendmmsg+0x20c/0x440 [ 830.600599][T20352] ? __pfx___sys_sendmmsg+0x10/0x10 [ 830.600617][T20352] ? rcu_is_watching+0x12/0xc0 [ 830.600640][T20352] ? ksys_write+0x190/0x250 [ 830.600674][T20352] __x64_sys_sendmmsg+0x9c/0x100 [ 830.600694][T20352] do_syscall_64+0x115/0x870 [ 830.600719][T20352] ? clear_bhb_loop+0x40/0x90 [ 830.600737][T20352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 830.600753][T20352] RIP: 0033:0x7fc3d039ce59 [ 830.600767][T20352] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 830.600783][T20352] RSP: 002b:00007fc3d1308028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 830.600800][T20352] RAX: ffffffffffffffda RBX: 00007fc3d0615fa0 RCX: 00007fc3d039ce59 [ 830.600811][T20352] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000004 [ 830.600822][T20352] RBP: 00007fc3d1308090 R08: 0000000000000000 R09: 0000000000000000 [ 830.600831][T20352] R10: 0000000000000810 R11: 0000000000000246 R12: 0000000000000001 [ 830.600840][T20352] R13: 00007fc3d0616038 R14: 00007fc3d0615fa0 R15: 00007ffdec597bf8 [ 830.600856][T20352] [ 830.601743][ T5730] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 830.781723][ T5701] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 830.839037][T20349] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3883'. [ 830.852522][ T5701] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 830.868558][ T5701] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 830.869382][T20349] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3883'. [ 830.876735][ T5701] usb 1-1: media controller created [ 830.881225][ T5701] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 830.908743][ T5730] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 830.947494][ T5730] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 830.982634][ T5701] zl10353_read_register: readreg error (reg=127, ret==0) [ 830.993483][ T5701] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 831.003161][ T5701] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 831.045825][ T5701] usb 1-1: USB disconnect, device number 98 [ 831.063622][ T5730] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 831.101501][ T5729] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 831.102529][ T5730] usb 4-1: config 0 descriptor?? [ 831.117175][ T5701] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 831.142881][ T5730] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 831.149672][ T5730] dvb-usb: bulk message failed: -22 (3/0) [ 831.158152][ T5730] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 831.171409][ T5730] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 831.187086][ T5730] usb 4-1: media controller created [ 831.225241][ T5730] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 831.238665][ T5730] dvb-usb: bulk message failed: -22 (6/0) [ 831.245355][ T5730] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 831.260634][ T5730] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input99 [ 831.261841][ T5729] usb 2-1: Using ep0 maxpacket: 16 [ 831.278550][ T5730] dvb-usb: schedule remote query interval to 150 msecs. [ 831.302132][ T804] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 831.304528][ T5730] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 831.310463][ T5729] usb 2-1: config 252 has an invalid interface number: 15 but max is 0 [ 831.329299][ T5729] usb 2-1: config 252 has no interface number 0 [ 831.336773][ T5729] usb 2-1: config 252 interface 15 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 831.360325][ T5729] usb 2-1: config 252 interface 15 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 831.382578][ T5729] usb 2-1: config 252 interface 15 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 831.398300][ T5729] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 831.408935][ T5729] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 831.418614][ T5729] usb 2-1: Product: syz [ 831.423329][ T5729] usb 2-1: Manufacturer: syz [ 831.428996][ T5729] usb 2-1: SerialNumber: syz [ 831.441943][T20354] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 831.454091][T20346] dvb-usb: bulk message failed: -22 (2/0) [ 831.454216][ T5729] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 831.460939][ T5730] dvb-usb: bulk message failed: -22 (1/0) [ 831.475602][ T5730] dvb-usb: error while querying for an remote control event. [ 831.482896][ T804] usb 6-1: Using ep0 maxpacket: 32 [ 831.485566][T14755] usb 4-1: USB disconnect, device number 98 [ 831.489482][ T804] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 831.528386][ T804] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 831.537697][ T804] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 831.548019][ T804] usb 6-1: config 1 has no interface number 0 [ 831.554185][ T804] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 831.566945][ T804] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 831.580740][T20368] kAFS: unable to lookup cell 'ÿ' [ 831.614703][T14755] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 831.637070][ T804] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 831.662501][ T804] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 831.679182][ T804] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 831.884214][ T804] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now attached [ 832.307351][ T5729] usb 6-1: USB disconnect, device number 43 [ 832.324683][ T5729] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 832.410883][ T804] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 832.461365][ T3404] usb 2-1: Failed to submit usb control message: -110 [ 832.475782][ T3404] usb 2-1: unable to send the bmi data to the device: -110 [ 832.500968][ T3404] usb 2-1: unable to get target info from device [ 832.526744][ T3404] usb 2-1: could not get target info (-110) [ 832.545745][ T3404] usb 2-1: could not probe fw (-110) [ 832.590849][ T804] usb 4-1: Using ep0 maxpacket: 16 [ 832.607577][ T804] usb 4-1: config 0 has no interfaces? [ 832.624144][ T804] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 832.654107][ T804] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 832.687458][ T804] usb 4-1: SerialNumber: syz [ 832.708088][ T804] usb 4-1: config 0 descriptor?? [ 832.920925][T14755] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 832.934895][T20373] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 832.946178][T20373] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 832.957341][T20373] FAULT_INJECTION: forcing a failure. [ 832.957341][T20373] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 832.973013][T20373] CPU: 0 UID: 0 PID: 20373 Comm: syz.3.3890 Tainted: G L syzkaller #0 PREEMPT(full) [ 832.973040][T20373] Tainted: [L]=SOFTLOCKUP [ 832.973047][T20373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 832.973056][T20373] Call Trace: [ 832.973063][T20373] [ 832.973070][T20373] dump_stack_lvl+0x100/0x190 [ 832.973095][T20373] should_fail_ex.cold+0x5/0xa [ 832.973118][T20373] _copy_from_user+0x2e/0xd0 [ 832.973146][T20373] ucma_write+0x128/0x330 [ 832.973176][T20373] ? __pfx_ucma_write+0x10/0x10 [ 832.973199][T20373] ? bpf_lsm_file_permission+0x9/0x10 [ 832.973225][T20373] ? security_file_permission+0x76/0x210 [ 832.973245][T20373] ? rw_verify_area+0xce/0x6d0 [ 832.973269][T20373] ? __pfx_ucma_write+0x10/0x10 [ 832.973291][T20373] vfs_writev+0x5ed/0xdd0 [ 832.973313][T20373] ? get_pid_task+0x106/0x250 [ 832.973342][T20373] ? __pfx_vfs_writev+0x10/0x10 [ 832.973365][T20373] ? preempt_count_add+0x76/0x150 [ 832.973387][T20373] ? rcu_is_watching+0x12/0xc0 [ 832.973416][T20373] ? __fget_files+0x21f/0x3d0 [ 832.973435][T20373] ? do_writev+0x28a/0x340 [ 832.973456][T20373] do_writev+0x28a/0x340 [ 832.973479][T20373] ? __pfx_do_writev+0x10/0x10 [ 832.973503][T20373] ? rcu_is_watching+0x12/0xc0 [ 832.973529][T20373] do_syscall_64+0x115/0x870 [ 832.973555][T20373] ? clear_bhb_loop+0x40/0x90 [ 832.973575][T20373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 832.973593][T20373] RIP: 0033:0x7f912e59ce59 [ 832.973608][T20373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 832.973625][T20373] RSP: 002b:00007f912f53c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 832.973643][T20373] RAX: ffffffffffffffda RBX: 00007f912e815fa0 RCX: 00007f912e59ce59 [ 832.973655][T20373] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000013 [ 832.973666][T20373] RBP: 00007f912f53c090 R08: 0000000000000000 R09: 0000000000000000 [ 832.973676][T20373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 832.973686][T20373] R13: 00007f912e816038 R14: 00007f912e815fa0 R15: 00007ffd41775fc8 [ 832.973703][T20373] [ 833.180853][T14755] usb 1-1: Using ep0 maxpacket: 16 [ 833.218721][T14755] usb 1-1: config 0 has no interfaces? [ 833.226254][T14755] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 833.236868][ T5729] usb 4-1: USB disconnect, device number 99 [ 833.241073][T14755] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 833.263705][T14755] usb 1-1: SerialNumber: syz [ 833.280859][T14755] usb 1-1: config 0 descriptor?? [ 833.575959][T20375] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 833.588224][T20375] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 833.628100][ T804] usb 1-1: USB disconnect, device number 99 [ 833.652006][T20384] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 833.670104][T20384] UDF-fs: Scanning with blocksize 512 failed [ 833.684823][T20384] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 833.700666][T20384] UDF-fs: Scanning with blocksize 1024 failed [ 833.724964][T20384] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 833.740527][T20384] UDF-fs: Scanning with blocksize 2048 failed [ 833.757444][T20384] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 833.850220][T20384] UDF-fs: Scanning with blocksize 4096 failed [ 833.974900][T20391] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8 sclass=netlink_route_socket pid=20391 comm=syz.3.3895 [ 834.002249][T20391] syzkaller0: entered promiscuous mode [ 834.008089][T20391] syzkaller0: entered allmulticast mode [ 834.130796][ T804] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 834.370831][ T804] usb 3-1: Using ep0 maxpacket: 16 [ 834.377160][ T804] usb 3-1: config 0 has no interfaces? [ 834.383853][ T804] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 834.393579][ T804] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 834.417656][ T804] usb 3-1: SerialNumber: syz [ 835.370353][ T804] usb 3-1: config 0 descriptor?? [ 835.554757][T20404] netlink: 'syz.0.3897': attribute type 49 has an invalid length. [ 835.791664][T20388] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 835.811694][T20388] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 835.846642][ T804] usb 3-1: USB disconnect, device number 97 [ 835.989716][T20411] kAFS: unable to lookup cell 'ÿ' [ 836.127431][T14755] usb 2-1: USB disconnect, device number 65 [ 836.264127][T20418] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3901'. [ 836.275178][T20419] kAFS: unable to lookup cell 'ÿ' [ 836.352900][ T5709] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 836.436959][T20421] netlink: 'syz.2.3902': attribute type 1 has an invalid length. [ 836.469953][T20421] bond1: entered promiscuous mode [ 836.478430][T20421] 8021q: adding VLAN 0 to HW filter on device bond1 [ 836.520739][ T5709] usb 1-1: Using ep0 maxpacket: 8 [ 836.528420][T20421] 8021q: adding VLAN 0 to HW filter on device bond1 [ 836.535723][T20421] bond1: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 836.536962][ T5709] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 836.560707][ T5709] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 836.571791][T20421] bond1: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 836.572800][ T5709] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 836.612632][T20421] bond1: (slave ip6gre1): making interface the new active one [ 836.620216][T20421] ip6gre1: entered promiscuous mode [ 836.621976][ T5709] usb 1-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 836.635823][ T5709] usb 1-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 836.645719][ T5709] usb 1-1: Product: syz [ 836.650034][ T5709] usb 1-1: Manufacturer: syz [ 836.654856][ T5709] usb 1-1: SerialNumber: syz [ 836.661236][T20421] bond1: (slave ip6gre1): Enslaving as an active interface with an up link [ 836.663200][ T5709] usb 1-1: config 0 descriptor?? [ 836.690650][ T804] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 836.773097][ T5709] rc_core: IR keymap rc-imon-rsc not found [ 836.787889][ T5709] Registered IR keymap rc-empty [ 836.794370][T20429] binder_alloc: 20427: binder_alloc_buf, no vma [ 836.798827][ T5709] rc rc0: iMON Station as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 836.812516][ T5709] input: iMON Station as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input100 [ 836.850616][ T804] usb 2-1: Using ep0 maxpacket: 32 [ 836.857138][ T804] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 836.873328][ T804] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 836.913716][ T804] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 836.935974][T20412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 836.963562][ T804] usb 2-1: config 1 has no interface number 0 [ 836.977575][ T804] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 836.998054][T20412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 837.014133][ T804] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 837.047198][ T804] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 837.071982][ T804] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 837.108625][ T804] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 837.308246][ T804] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now attached [ 837.735979][ T5701] usb 2-1: USB disconnect, device number 66 [ 837.752981][ T5701] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 837.781409][T20440] kAFS: unable to lookup cell 'ÿ' [ 838.239828][T20444] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 838.248099][T20444] UDF-fs: Scanning with blocksize 512 failed [ 838.255497][T20444] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 838.263206][T20444] UDF-fs: Scanning with blocksize 1024 failed [ 838.269955][T20444] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 838.278011][T20444] UDF-fs: Scanning with blocksize 2048 failed [ 838.285627][T20444] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 838.293329][T20444] UDF-fs: Scanning with blocksize 4096 failed [ 838.855235][T20455] FAULT_INJECTION: forcing a failure. [ 838.855235][T20455] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 838.910604][T20455] CPU: 0 UID: 0 PID: 20455 Comm: syz.2.3910 Tainted: G L syzkaller #0 PREEMPT(full) [ 838.910633][T20455] Tainted: [L]=SOFTLOCKUP [ 838.910639][T20455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 838.910649][T20455] Call Trace: [ 838.910654][T20455] [ 838.910662][T20455] dump_stack_lvl+0x100/0x190 [ 838.910689][T20455] should_fail_ex.cold+0x5/0xa [ 838.910712][T20455] _copy_from_user+0x2e/0xd0 [ 838.910738][T20455] copy_msghdr_from_user+0x9f/0x4c0 [ 838.910763][T20455] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 838.910790][T20455] ? kstrtouint_from_user+0x13c/0x1d0 [ 838.910811][T20455] ___sys_sendmsg+0x106/0x1e0 [ 838.910834][T20455] ? __pfx____sys_sendmsg+0x10/0x10 [ 838.910858][T20455] ? get_pid_task+0x106/0x250 [ 838.910887][T20455] ? rcu_is_watching+0x12/0xc0 [ 838.910918][T20455] __sys_sendmsg+0x160/0x210 [ 838.910937][T20455] ? __pfx___sys_sendmsg+0x10/0x10 [ 838.910958][T20455] ? rcu_is_watching+0x12/0xc0 [ 838.910983][T20455] do_syscall_64+0x115/0x870 [ 838.911007][T20455] ? clear_bhb_loop+0x40/0x90 [ 838.911026][T20455] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 838.911043][T20455] RIP: 0033:0x7f45a339ce59 [ 838.911056][T20455] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 838.911078][T20455] RSP: 002b:00007f45a41bd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 838.911096][T20455] RAX: ffffffffffffffda RBX: 00007f45a3616090 RCX: 00007f45a339ce59 [ 838.911107][T20455] RDX: 0000000020008010 RSI: 0000200000000000 RDI: 0000000000000004 [ 838.911118][T20455] RBP: 00007f45a41bd090 R08: 0000000000000000 R09: 0000000000000000 [ 838.911128][T20455] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 838.911137][T20455] R13: 00007f45a3616128 R14: 00007f45a3616090 R15: 00007fff38461d18 [ 838.911153][T20455] [ 839.161707][ T5730] usb 1-1: USB disconnect, device number 100 [ 839.836187][ T5730] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 839.890727][ T804] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 839.987312][T20470] binder_alloc: 20466: binder_alloc_buf, no vma [ 840.050520][ T804] usb 2-1: Using ep0 maxpacket: 16 [ 840.057072][ T804] usb 2-1: config 0 has no interfaces? [ 840.089711][ T804] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 840.090413][ T5730] usb 1-1: Using ep0 maxpacket: 16 [ 840.100009][ T804] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 840.106447][ T5730] usb 1-1: config 252 has an invalid interface number: 15 but max is 0 [ 840.114122][ T804] usb 2-1: SerialNumber: syz [ 840.123117][ T5730] usb 1-1: config 252 has no interface number 0 [ 840.127563][ T804] usb 2-1: config 0 descriptor?? [ 840.132455][ T5730] usb 1-1: config 252 interface 15 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 840.151730][ T5730] usb 1-1: config 252 interface 15 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 840.165987][ T5730] usb 1-1: config 252 interface 15 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 840.188037][ T5730] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 840.199118][ T5730] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 840.244232][ T5730] usb 1-1: Product: syz [ 840.358940][ T5730] usb 1-1: Manufacturer: syz [ 840.368477][ T5730] usb 1-1: SerialNumber: syz [ 840.381891][T20458] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 840.455690][ T5730] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 840.549807][T20483] netlink: 'syz.3.3917': attribute type 11 has an invalid length. [ 840.604675][T20460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 840.667588][T20460] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 840.927868][ T5701] usb 2-1: USB disconnect, device number 67 [ 841.211584][ T5729] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 841.370379][ T5729] usb 3-1: Using ep0 maxpacket: 16 [ 841.380508][ T5730] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 841.382820][ T5729] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 841.399694][T20494] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 841.415707][ T5729] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.431599][ T5729] usb 3-1: Product: syz [ 841.435863][T20494] UDF-fs: Scanning with blocksize 512 failed [ 841.449449][ T5729] usb 3-1: Manufacturer: syz [ 841.462151][ T5729] usb 3-1: SerialNumber: syz [ 841.467255][T20494] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 841.472337][ T5729] usb 3-1: config 0 descriptor?? [ 841.487054][T20494] UDF-fs: Scanning with blocksize 1024 failed [ 841.497284][T20494] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 841.501933][ T3404] usb 1-1: Failed to submit usb control message: -110 [ 841.522517][T20494] UDF-fs: Scanning with blocksize 2048 failed [ 841.532060][ T3404] usb 1-1: unable to send the bmi data to the device: -110 [ 841.532082][ T3404] usb 1-1: unable to get target info from device [ 841.532125][ T3404] usb 1-1: could not get target info (-110) [ 841.532141][ T3404] usb 1-1: could not probe fw (-110) [ 841.560430][ T5730] usb 6-1: Using ep0 maxpacket: 32 [ 841.647120][ T5730] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 841.649745][ T5730] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 841.649783][ T5730] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 841.649813][ T5730] usb 6-1: Product: syz [ 841.649839][ T5730] usb 6-1: Manufacturer: syz [ 841.649853][ T5730] usb 6-1: SerialNumber: syz [ 841.653678][ T5730] usb 6-1: config 0 descriptor?? [ 841.654266][T20489] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 841.894452][T20494] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 841.945176][T20494] UDF-fs: Scanning with blocksize 4096 failed [ 841.981462][ T5729] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 841.993040][ T5729] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 842.445737][ T5729] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 842.493502][ T5729] usb 3-1: media controller created [ 842.518103][ T5701] usb 6-1: USB disconnect, device number 44 [ 842.549206][ T5729] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 842.610546][ T5729] zl10353_read_register: readreg error (reg=127, ret==0) [ 842.627467][ T5729] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 842.651842][ T5729] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 842.686865][ T5729] usb 3-1: USB disconnect, device number 98 [ 842.720793][ T804] usb 2-1: new low-speed USB device number 68 using dummy_hcd [ 842.755975][ T5729] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 842.891575][ T804] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 842.918825][ T804] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 842.940022][ T804] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 842.960424][ T804] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 842.992141][ T804] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 843.151874][T20507] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 843.182050][ T804] hub 2-1:1.0: bad descriptor, ignoring hub [ 843.197004][ T804] hub 2-1:1.0: probe with driver hub failed with error -5 [ 843.220269][ T804] cdc_wdm 2-1:1.0: skipping garbage [ 843.242919][ T804] cdc_wdm 2-1:1.0: skipping garbage [ 843.276532][ T804] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 843.314882][ T804] cdc_wdm 2-1:1.0: Unknown control protocol [ 843.369650][T20518] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 843.394554][T20518] UDF-fs: Scanning with blocksize 512 failed [ 843.412009][T20518] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 843.433725][T20518] UDF-fs: Scanning with blocksize 1024 failed [ 843.463573][T20518] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 843.472972][T20518] UDF-fs: Scanning with blocksize 2048 failed [ 843.493337][T20521] kAFS: unable to lookup cell 'ÿ' [ 843.501720][T20518] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 843.519429][T20518] UDF-fs: Scanning with blocksize 4096 failed [ 843.731378][ C0] wdm_int_callback: 8385 callbacks suppressed [ 843.731401][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 843.744050][ C0] wdm_int_callback: 8385 callbacks suppressed [ 843.744073][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 843.756502][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 843.763099][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 843.769348][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 843.775920][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 843.782166][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 843.788743][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 843.795035][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 843.801612][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 843.808234][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 843.814814][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 843.821233][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 843.827807][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 843.834026][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 843.840599][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 843.846806][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 843.853377][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 843.859581][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 843.866152][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 844.179473][T20523] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3927'. [ 844.433577][T20526] binder_alloc: 20524: binder_alloc_buf, no vma [ 844.529119][T20528] FAULT_INJECTION: forcing a failure. [ 844.529119][T20528] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 844.552590][T20528] CPU: 1 UID: 0 PID: 20528 Comm: syz.2.3929 Tainted: G L syzkaller #0 PREEMPT(full) [ 844.552623][T20528] Tainted: [L]=SOFTLOCKUP [ 844.552630][T20528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 844.552640][T20528] Call Trace: [ 844.552646][T20528] [ 844.552653][T20528] dump_stack_lvl+0x100/0x190 [ 844.552680][T20528] should_fail_ex.cold+0x5/0xa [ 844.552702][T20528] _copy_from_user+0x2e/0xd0 [ 844.552729][T20528] get_timespec64+0x8d/0x240 [ 844.552749][T20528] ? __pfx_get_timespec64+0x10/0x10 [ 844.552771][T20528] __x64_sys_recvmmsg+0x166/0x280 [ 844.552793][T20528] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 844.552815][T20528] ? rcu_is_watching+0x12/0xc0 [ 844.552841][T20528] do_syscall_64+0x115/0x870 [ 844.552866][T20528] ? clear_bhb_loop+0x40/0x90 [ 844.552886][T20528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 844.552904][T20528] RIP: 0033:0x7f45a339ce59 [ 844.552918][T20528] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 844.552935][T20528] RSP: 002b:00007f45a41de028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 844.552953][T20528] RAX: ffffffffffffffda RBX: 00007f45a3615fa0 RCX: 00007f45a339ce59 [ 844.552965][T20528] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 844.552976][T20528] RBP: 00007f45a41de090 R08: 0000200000003700 R09: 0000000000000000 [ 844.552986][T20528] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000001 [ 844.552997][T20528] R13: 00007f45a3616038 R14: 00007f45a3615fa0 R15: 00007fff38461d18 [ 844.553018][T20528] [ 845.031042][ T804] usb 1-1: USB disconnect, device number 101 [ 846.137318][ T804] usb 2-1: USB disconnect, device number 68 [ 846.140935][ T5730] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 846.252634][T20552] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8 sclass=netlink_route_socket pid=20552 comm=syz.5.3937 [ 846.354616][T20553] FAULT_INJECTION: forcing a failure. [ 846.354616][T20553] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 846.368890][T20553] CPU: 1 UID: 0 PID: 20553 Comm: syz.1.3936 Tainted: G L syzkaller #0 PREEMPT(full) [ 846.368918][T20553] Tainted: [L]=SOFTLOCKUP [ 846.368925][T20553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 846.368936][T20553] Call Trace: [ 846.368942][T20553] [ 846.368949][T20553] dump_stack_lvl+0x100/0x190 [ 846.368974][T20553] should_fail_ex.cold+0x5/0xa [ 846.368996][T20553] _copy_from_user+0x2e/0xd0 [ 846.369023][T20553] copy_from_sockptr_offset.constprop.0+0x12c/0x150 [ 846.369050][T20553] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 846.369078][T20553] do_sock_getsockopt+0x530/0x6e0 [ 846.369103][T20553] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 846.369126][T20553] ? rcu_is_watching+0x12/0xc0 [ 846.369152][T20553] ? rcu_is_watching+0x12/0xc0 [ 846.369177][T20553] ? __fget_files+0x215/0x3d0 [ 846.369195][T20553] ? __fget_files+0x21f/0x3d0 [ 846.369212][T20553] __sys_getsockopt+0x148/0x260 [ 846.369234][T20553] ? __x64_sys_getsockopt+0xbd/0x160 [ 846.369252][T20553] __x64_sys_getsockopt+0xbd/0x160 [ 846.369270][T20553] ? trace_irq_enable.constprop.0+0x122/0x160 [ 846.369294][T20553] do_syscall_64+0x115/0x870 [ 846.369319][T20553] ? clear_bhb_loop+0x40/0x90 [ 846.369338][T20553] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.369355][T20553] RIP: 0033:0x7fc3d039ce59 [ 846.369369][T20553] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 846.369386][T20553] RSP: 002b:00007fc3d12c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 846.369405][T20553] RAX: ffffffffffffffda RBX: 00007fc3d0616180 RCX: 00007fc3d039ce59 [ 846.369417][T20553] RDX: 0000000000000083 RSI: 0000000000000084 RDI: 0000000000000005 [ 846.369428][T20553] RBP: 00007fc3d12c6090 R08: 0000200000000080 R09: 0000000000000000 [ 846.369438][T20553] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 846.369449][T20553] R13: 00007fc3d0616218 R14: 00007fc3d0616180 R15: 00007ffdec597bf8 [ 846.369465][T20553] [ 846.578823][ T5730] usb 3-1: Using ep0 maxpacket: 16 [ 846.632492][T20554] kAFS: unable to lookup cell 'ÿ' [ 846.683605][ T5730] usb 3-1: config 0 has no interfaces? [ 846.690089][ T5730] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 846.699340][ T5730] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 846.707614][ T5730] usb 3-1: SerialNumber: syz [ 846.713689][ T5730] usb 3-1: config 0 descriptor?? [ 846.927611][T20534] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 846.945870][T20534] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 846.973280][ T804] usb 3-1: USB disconnect, device number 99 [ 847.149111][T20562] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 847.157316][ T5730] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 847.160150][T20562] UDF-fs: Scanning with blocksize 512 failed [ 847.174140][T20562] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 847.181840][T20562] UDF-fs: Scanning with blocksize 1024 failed [ 847.189409][T20562] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 847.197015][T20562] UDF-fs: Scanning with blocksize 2048 failed [ 847.203667][T20562] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 847.211366][T20562] UDF-fs: Scanning with blocksize 4096 failed [ 847.342346][ T5730] usb 4-1: Using ep0 maxpacket: 8 [ 847.349893][ T5730] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 847.361059][ T5701] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 847.361542][T20564] xt_CT: You must specify a L4 protocol and not use inversions on it [ 847.378239][ T5730] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 847.392288][ T5730] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 847.403975][ T29] audit: type=1400 audit(1782217053.023:704): avc: denied { write } for pid=20563 comm="syz.0.3941" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 847.426459][ T5730] usb 4-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 847.436057][ T5730] usb 4-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 847.448526][ T5730] usb 4-1: Product: syz [ 847.454122][ T5730] usb 4-1: Manufacturer: syz [ 847.458975][ T5730] usb 4-1: SerialNumber: syz [ 847.472754][ T5730] usb 4-1: config 0 descriptor?? [ 847.520792][ T5701] usb 6-1: Using ep0 maxpacket: 16 [ 847.536597][ T5701] usb 6-1: config 252 has an invalid interface number: 15 but max is 0 [ 847.549148][ T5701] usb 6-1: config 252 has no interface number 0 [ 847.569352][ T5701] usb 6-1: config 252 interface 15 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 847.590450][ T5701] usb 6-1: config 252 interface 15 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 847.592072][ T5730] rc_core: IR keymap rc-imon-rsc not found [ 847.602941][ T5701] usb 6-1: config 252 interface 15 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 847.604614][ T5701] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 847.630451][ T5701] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 847.644899][ T5701] usb 6-1: Product: syz [ 847.649168][ T5701] usb 6-1: Manufacturer: syz [ 847.663045][ T5701] usb 6-1: SerialNumber: syz [ 847.690899][ T5730] Registered IR keymap rc-empty [ 847.716979][T20557] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 847.725673][ T5730] rc rc0: iMON Station as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 847.739657][T20561] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 847.751485][T20557] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 847.761768][ T5730] input: iMON Station as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input101 [ 847.786400][ T5701] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 847.920072][T14755] usb 3-1: new full-speed USB device number 100 using dummy_hcd [ 848.167625][T14755] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 848.180940][T14755] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 848.206293][T14755] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 848.863073][ T7914] usb 6-1: Failed to submit usb control message: -110 [ 848.863236][ T7914] usb 6-1: unable to send the bmi data to the device: -110 [ 848.863442][ T7914] usb 6-1: unable to get target info from device [ 848.863572][ T7914] usb 6-1: could not get target info (-110) [ 848.863672][ T7914] usb 6-1: could not probe fw (-110) [ 849.212643][T14755] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 849.248118][T14755] usb 3-1: config 0 descriptor?? [ 849.269513][T14755] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 849.288503][T14755] dvb-usb: bulk message failed: -22 (3/0) [ 849.313923][T14755] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 849.347209][T14755] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 849.369776][T14755] usb 3-1: media controller created [ 849.388794][T14755] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 849.426050][T14755] dvb-usb: bulk message failed: -22 (6/0) [ 849.438959][T14755] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 849.463172][T14755] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input102 [ 849.491111][T14755] dvb-usb: schedule remote query interval to 150 msecs. [ 849.499643][T14755] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 849.556926][T20589] binder_alloc: 20585: binder_alloc_buf, no vma [ 849.619764][T20588] dvb-usb: bulk message failed: -22 (2/0) [ 849.642557][ T5729] usb 3-1: USB disconnect, device number 100 [ 849.658077][ T5729] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 849.867744][T14755] usb 4-1: USB disconnect, device number 100 [ 850.353304][T14755] usb 6-1: USB disconnect, device number 45 [ 851.139833][ T5729] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 851.259831][ T4928] Bluetooth: hci0: command 0x0406 tx timeout [ 851.359103][T20610] netlink: 'syz.3.3951': attribute type 49 has an invalid length. [ 851.461581][ T5729] usb 2-1: config 0 has no interfaces? [ 851.473737][ T5729] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 851.488069][ T5729] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 851.521310][ T5729] usb 2-1: config 0 descriptor?? [ 852.041983][T20603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 852.051234][T20603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 852.062497][ T29] audit: type=1400 audit(1782217057.693:705): avc: denied { read } for pid=20602 comm="syz.1.3950" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 852.208105][T20627] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3955'. [ 852.231141][T20628] kAFS: unable to lookup cell 'ÿ' [ 852.485410][T20630] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3956'. [ 852.800706][T20643] kAFS: unable to lookup cell 'ÿ' [ 852.903334][T20637] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 852.913097][T20637] UDF-fs: Scanning with blocksize 512 failed [ 852.990266][T20637] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 853.013656][T20637] UDF-fs: Scanning with blocksize 1024 failed [ 853.033153][T20637] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 853.045859][T20637] UDF-fs: Scanning with blocksize 2048 failed [ 853.067912][T20637] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 853.139055][T20637] UDF-fs: Scanning with blocksize 4096 failed [ 853.346887][T20645] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3960'. [ 853.544807][T20646] xt_cgroup: path and classid specified [ 853.795671][ T10] usb 2-1: USB disconnect, device number 69 [ 854.558692][T20662] kAFS: unable to lookup cell 'ÿ' [ 854.768367][T20666] netlink: 'syz.2.3965': attribute type 49 has an invalid length. [ 855.225556][T20671] FAULT_INJECTION: forcing a failure. [ 855.225556][T20671] name failslab, interval 1, probability 0, space 0, times 0 [ 855.238273][T20671] CPU: 0 UID: 0 PID: 20671 Comm: syz.0.3966 Tainted: G L syzkaller #0 PREEMPT(full) [ 855.238300][T20671] Tainted: [L]=SOFTLOCKUP [ 855.238306][T20671] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 855.238317][T20671] Call Trace: [ 855.238323][T20671] [ 855.238329][T20671] dump_stack_lvl+0x100/0x190 [ 855.238355][T20671] should_fail_ex.cold+0x5/0xa [ 855.238375][T20671] ? __kmalloc_noprof+0xd6/0x820 [ 855.238394][T20671] should_failslab+0xc2/0x120 [ 855.238415][T20671] __kmalloc_noprof+0xfc/0x820 [ 855.238432][T20671] ? tls_sw_sendmsg+0x1c8/0x2b10 [ 855.238456][T20671] ? tls_sw_sendmsg+0x10f4/0x2b10 [ 855.238486][T20671] tls_sw_sendmsg+0x10f4/0x2b10 [ 855.238511][T20671] ? avc_has_perm+0x135/0x1e0 [ 855.238534][T20671] ? __pfx___schedule+0x10/0x10 [ 855.238558][T20671] ? preempt_schedule_irq+0x7b/0x90 [ 855.238581][T20671] ? rcu_is_watching+0x12/0xc0 [ 855.238606][T20671] ? __pfx_tls_sw_sendmsg+0x10/0x10 [ 855.238631][T20671] ? irqentry_exit+0x24d/0xa00 [ 855.238658][T20671] ? __pfx_tls_sw_sendmsg+0x10/0x10 [ 855.238682][T20671] ? inet6_sendmsg+0x4e/0x140 [ 855.238705][T20671] ? __pfx_tls_sw_sendmsg+0x10/0x10 [ 855.238728][T20671] inet6_sendmsg+0x11c/0x140 [ 855.238752][T20671] __sys_sendto+0x36d/0x4e0 [ 855.238771][T20671] ? __pfx___sys_sendto+0x10/0x10 [ 855.238791][T20671] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 855.238821][T20671] ? ksys_write+0x1ac/0x250 [ 855.238846][T20671] ? __pfx_ksys_write+0x10/0x10 [ 855.238870][T20671] __x64_sys_sendto+0xe0/0x1c0 [ 855.238887][T20671] ? trace_irq_enable.constprop.0+0x122/0x160 [ 855.238912][T20671] do_syscall_64+0x115/0x870 [ 855.238935][T20671] ? clear_bhb_loop+0x40/0x90 [ 855.238955][T20671] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 855.238972][T20671] RIP: 0033:0x7f03ae59ce59 [ 855.238985][T20671] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 855.239001][T20671] RSP: 002b:00007f03ac7b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 855.239018][T20671] RAX: ffffffffffffffda RBX: 00007f03ae816180 RCX: 00007f03ae59ce59 [ 855.239030][T20671] RDX: ffffffffffffff69 RSI: 0000200000000240 RDI: 0000000000000003 [ 855.239041][T20671] RBP: 00007f03ac7b4090 R08: 0000000000000000 R09: 0000000000000000 [ 855.239051][T20671] R10: 0000000000008040 R11: 0000000000000246 R12: 0000000000000001 [ 855.239062][T20671] R13: 00007f03ae816218 R14: 00007f03ae816180 R15: 00007ffec15c4088 [ 855.239079][T20671] [ 855.681896][T20675] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 855.689953][T20675] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 855.698550][T20675] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 855.706389][T20675] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 857.124805][T20692] kAFS: unable to lookup cell 'ÿ' [ 857.182841][T20695] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3971'. [ 857.583414][T20700] netlink: 'syz.3.3973': attribute type 11 has an invalid length. [ 858.889800][T20708] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3976'. [ 859.095427][T20711] xt_cgroup: path and classid specified [ 859.184926][ T5729] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 859.199749][ T5701] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 859.302146][T20720] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8 sclass=netlink_route_socket pid=20720 comm=syz.1.3980 [ 859.349442][ T5729] usb 6-1: Using ep0 maxpacket: 32 [ 859.353873][T20721] syzkaller0: entered promiscuous mode [ 859.360229][ T5701] usb 4-1: Using ep0 maxpacket: 16 [ 859.376507][T20721] syzkaller0: entered allmulticast mode [ 859.384122][ T5729] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 859.399524][ T5701] usb 4-1: config 0 has no interfaces? [ 859.405594][ T5729] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 859.415962][ T5729] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 859.427099][ T5701] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 859.442368][ T5729] usb 6-1: config 1 has no interface number 0 [ 859.455686][ T5701] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 859.472972][ T5729] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 859.486604][ T5701] usb 4-1: SerialNumber: syz [ 859.511764][ T5701] usb 4-1: config 0 descriptor?? [ 859.526529][ T5729] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 859.547139][ T5729] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 859.558741][ T5729] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 859.576828][ T5729] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 859.769770][T20713] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 859.790316][T20713] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 859.793065][ T5729] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now attached [ 859.921826][ T5701] usb 4-1: USB disconnect, device number 101 [ 860.671849][ T5701] usb 6-1: USB disconnect, device number 46 [ 860.764660][ T5701] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 861.483417][T20745] syzkaller0: entered promiscuous mode [ 861.489500][T20745] syzkaller0: entered allmulticast mode [ 861.519016][T20747] FAULT_INJECTION: forcing a failure. [ 861.519016][T20747] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 861.533210][T20747] CPU: 0 UID: 0 PID: 20747 Comm: syz.1.3986 Tainted: G L syzkaller #0 PREEMPT(full) [ 861.533238][T20747] Tainted: [L]=SOFTLOCKUP [ 861.533245][T20747] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 861.533255][T20747] Call Trace: [ 861.533260][T20747] [ 861.533267][T20747] dump_stack_lvl+0x100/0x190 [ 861.533292][T20747] should_fail_ex.cold+0x5/0xa [ 861.533313][T20747] _copy_from_user+0x2e/0xd0 [ 861.533336][T20747] copy_msghdr_from_user+0x9f/0x4c0 [ 861.533360][T20747] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 861.533384][T20747] ? __pfx__kstrtoull+0x10/0x10 [ 861.533402][T20747] ? putname+0xb1/0x110 [ 861.533419][T20747] ___sys_sendmsg+0x106/0x1e0 [ 861.533441][T20747] ? __pfx____sys_sendmsg+0x10/0x10 [ 861.533467][T20747] ? rcu_is_watching+0x12/0xc0 [ 861.533496][T20747] __sys_sendmmsg+0x20c/0x440 [ 861.533515][T20747] ? __pfx___sys_sendmmsg+0x10/0x10 [ 861.533532][T20747] ? rcu_is_watching+0x12/0xc0 [ 861.533554][T20747] ? ksys_write+0x190/0x250 [ 861.533582][T20747] ? fput+0x79/0x100 [ 861.533598][T20747] ? ksys_write+0x1ac/0x250 [ 861.533619][T20747] ? __pfx_ksys_write+0x10/0x10 [ 861.533642][T20747] __x64_sys_sendmmsg+0x9c/0x100 [ 861.533661][T20747] do_syscall_64+0x115/0x870 [ 861.533684][T20747] ? clear_bhb_loop+0x40/0x90 [ 861.533702][T20747] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 861.533718][T20747] RIP: 0033:0x7fc3d039ce59 [ 861.533731][T20747] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 861.533747][T20747] RSP: 002b:00007fc3d1308028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 861.533764][T20747] RAX: ffffffffffffffda RBX: 00007fc3d0615fa0 RCX: 00007fc3d039ce59 [ 861.533775][T20747] RDX: 0000000000000003 RSI: 0000200000000d40 RDI: 0000000000000007 [ 861.533785][T20747] RBP: 00007fc3d1308090 R08: 0000000000000000 R09: 0000000000000000 [ 861.533795][T20747] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 861.533804][T20747] R13: 00007fc3d0616038 R14: 00007fc3d0615fa0 R15: 00007ffdec597bf8 [ 861.533819][T20747] [ 862.045287][ T5701] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 862.209204][ T5701] usb 3-1: Using ep0 maxpacket: 16 [ 862.219188][ T5701] usb 3-1: config 252 has an invalid interface number: 15 but max is 0 [ 862.235855][ T5701] usb 3-1: config 252 has no interface number 0 [ 862.250141][ T5701] usb 3-1: config 252 interface 15 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 862.296264][ T5701] usb 3-1: config 252 interface 15 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 862.322724][ T5701] usb 3-1: config 252 interface 15 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 862.350284][ T5701] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 862.369319][ T10] usb 6-1: new full-speed USB device number 47 using dummy_hcd [ 862.428566][ T5701] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 862.442967][ T5701] usb 3-1: Product: syz [ 862.447712][ T5701] usb 3-1: Manufacturer: syz [ 862.453481][ T5701] usb 3-1: SerialNumber: syz [ 862.466258][T20740] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 862.473672][ T29] audit: type=1400 audit(1782217068.093:706): avc: denied { mount } for pid=20760 comm="syz.3.3991" name="/" dev="hugetlbfs" ino=78730 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 862.520884][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 862.531579][ T5701] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 862.541345][ T10] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 862.566263][ T10] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 862.606258][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 862.640169][ T10] usb 6-1: config 0 descriptor?? [ 862.656979][ T10] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 862.666495][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 862.700503][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 862.736186][ T10] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 862.860444][ T5701] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 862.882356][ T10] usb 6-1: media controller created [ 862.900886][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 863.579763][ T7923] usb 3-1: Failed to submit usb control message: -110 [ 863.579894][ T7923] usb 3-1: unable to send the bmi data to the device: -110 [ 863.579984][ T7923] usb 3-1: unable to get target info from device [ 863.580045][ T7923] usb 3-1: could not get target info (-110) [ 863.580115][ T7923] usb 3-1: could not probe fw (-110) [ 863.868919][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 863.874767][ T10] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 863.884075][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input103 [ 863.939090][ T5701] usb 4-1: Using ep0 maxpacket: 16 [ 863.946926][ T5701] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 863.956117][ T5701] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 864.009468][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 864.026181][ T5701] usb 4-1: Product: syz [ 864.033270][ T10] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 864.044983][ T5701] usb 4-1: Manufacturer: syz [ 864.058865][ T5701] usb 4-1: SerialNumber: syz [ 864.069463][T20758] dvb-usb: bulk message failed: -22 (2/0) [ 864.090174][ T5701] usb 4-1: config 0 descriptor?? [ 864.187424][ T24] usb 6-1: USB disconnect, device number 47 [ 864.189095][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 864.209737][ T10] dvb-usb: error while querying for an remote control event. [ 864.253536][ T24] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 864.514079][ T5701] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 864.549618][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 864.556895][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 864.590314][ T5701] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 864.601611][ T5701] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 864.610441][ T5701] usb 4-1: media controller created [ 864.641599][ T10] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 864.653792][ T5701] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 864.937295][ T5701] zl10353_read_register: readreg error (reg=127, ret==0) [ 864.945969][ T5701] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 864.953913][ T5701] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 864.964791][ T5701] usb 4-1: USB disconnect, device number 102 [ 864.984229][ T5701] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 864.998460][ T10] usb 2-1: device descriptor read/64, error -71 [ 865.196262][ T24] usb 3-1: USB disconnect, device number 101 [ 865.271987][T20785] FAULT_INJECTION: forcing a failure. [ 865.271987][T20785] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 865.285685][T20785] CPU: 1 UID: 0 PID: 20785 Comm: syz.5.3995 Tainted: G L syzkaller #0 PREEMPT(full) [ 865.285716][T20785] Tainted: [L]=SOFTLOCKUP [ 865.285723][T20785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 865.285734][T20785] Call Trace: [ 865.285740][T20785] [ 865.285747][T20785] dump_stack_lvl+0x100/0x190 [ 865.285773][T20785] should_fail_ex.cold+0x5/0xa [ 865.285796][T20785] _copy_from_user+0x2e/0xd0 [ 865.285822][T20785] copy_msghdr_from_user+0x9f/0x4c0 [ 865.285848][T20785] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 865.285876][T20785] ? kstrtouint_from_user+0x13c/0x1d0 [ 865.285898][T20785] ___sys_sendmsg+0x106/0x1e0 [ 865.285923][T20785] ? __pfx____sys_sendmsg+0x10/0x10 [ 865.285947][T20785] ? get_pid_task+0x106/0x250 [ 865.285976][T20785] ? rcu_is_watching+0x12/0xc0 [ 865.286014][T20785] __sys_sendmsg+0x160/0x210 [ 865.286033][T20785] ? __pfx___sys_sendmsg+0x10/0x10 [ 865.286056][T20785] ? rcu_is_watching+0x12/0xc0 [ 865.286082][T20785] do_syscall_64+0x115/0x870 [ 865.286107][T20785] ? clear_bhb_loop+0x40/0x90 [ 865.286127][T20785] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 865.286144][T20785] RIP: 0033:0x7f21c419ce59 [ 865.286157][T20785] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 865.286173][T20785] RSP: 002b:00007f21c23b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 865.286191][T20785] RAX: ffffffffffffffda RBX: 00007f21c4416180 RCX: 00007f21c419ce59 [ 865.286203][T20785] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000008 [ 865.286214][T20785] RBP: 00007f21c23b4090 R08: 0000000000000000 R09: 0000000000000000 [ 865.286225][T20785] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 865.286236][T20785] R13: 00007f21c4416218 R14: 00007f21c4416180 R15: 00007ffd14da5758 [ 865.286252][T20785] [ 865.529335][ T10] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 865.799033][ T10] usb 2-1: device descriptor read/64, error -71 [ 866.158492][ T10] usb usb2-port1: attempt power cycle [ 866.356217][T20799] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4000'. [ 866.396833][T20802] kAFS: unable to lookup cell 'ÿ' [ 866.412929][T20803] kAFS: unable to lookup cell 'ÿ' [ 866.518954][ T10] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 866.565910][T20805] xt_cgroup: path and classid specified [ 866.572368][ T10] usb 2-1: device descriptor read/8, error -71 [ 866.819932][ T10] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 866.860347][ T10] usb 2-1: device descriptor read/8, error -71 [ 866.989980][ T10] usb usb2-port1: unable to enumerate USB device [ 867.788893][ T10] usb 2-1: new full-speed USB device number 74 using dummy_hcd [ 867.917598][ T29] audit: type=1326 audit(1782217073.544:707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20811 comm="syz.3.4003" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f912e59ce59 code=0x0 [ 867.962521][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 867.994435][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 868.020125][ T10] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 868.048180][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 868.068895][ T10] usb 2-1: config 0 descriptor?? [ 868.079328][T20820] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4004'. [ 868.079577][ T10] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 868.099989][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 868.108195][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 868.118354][ T10] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 868.129903][ T10] usb 2-1: media controller created [ 868.138732][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 868.155908][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 868.170770][ T10] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 868.184613][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input104 [ 868.203988][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 868.211580][ T10] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 868.268936][ T5701] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 868.368844][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 868.374701][ T10] dvb-usb: error while querying for an remote control event. [ 868.406957][T20824] dvb-usb: bulk message failed: -22 (2/0) [ 868.418848][ T5701] usb 4-1: Using ep0 maxpacket: 32 [ 868.424537][ T5701] usb 4-1: too many configurations: 17, using maximum allowed: 8 [ 868.433410][ T5701] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 868.442491][ T5701] usb 4-1: config 0 has no interface number 0 [ 868.453642][ T5701] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 868.468330][ T5701] usb 4-1: config 0 has no interface number 0 [ 868.480542][ T10] usb 2-1: USB disconnect, device number 74 [ 868.494532][ T5701] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 868.504830][ T5701] usb 4-1: config 0 has no interface number 0 [ 868.512878][ T5701] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 868.531577][ T10] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 868.551254][ T5701] usb 4-1: config 0 has no interface number 0 [ 868.570969][ T5701] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 868.579222][ T5701] usb 4-1: config 0 has no interface number 0 [ 868.594115][ T5701] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 868.602357][ T5701] usb 4-1: config 0 has no interface number 0 [ 868.615511][ T5701] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 868.627718][ T5701] usb 4-1: config 0 has no interface number 0 [ 868.641127][ T5701] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 868.653581][ T5701] usb 4-1: config 0 has no interface number 0 [ 868.666766][ T5701] usb 4-1: New USB device found, idVendor=108c, idProduct=0168, bcdDevice=84.b2 [ 868.682092][ T5701] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 868.700858][ T5701] usb 4-1: Product: syz [ 868.709408][ T5701] usb 4-1: Manufacturer: syz [ 868.719219][ T5701] usb 4-1: SerialNumber: syz [ 868.730771][ T5701] usb 4-1: config 0 descriptor?? [ 868.743858][ T5701] etas_es58x 4-1:0.2: Starting syz syz (Serial Number syz) [ 869.002968][T20835] binder_alloc: 20833: binder_alloc_buf, no vma [ 869.072791][T20836] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 869.078506][T20838] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4009'. [ 869.089872][T20836] UDF-fs: Scanning with blocksize 512 failed [ 869.098190][T20836] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 869.290907][T20836] UDF-fs: Scanning with blocksize 1024 failed [ 869.297940][ T5701] etas_es58x 4-1:0.2: could not parse product info: '424242424242' [ 869.321493][T20845] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4011'. [ 869.342044][T20847] kAFS: unable to lookup cell 'ÿ' [ 869.370791][T20836] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 869.378533][T20836] UDF-fs: Scanning with blocksize 2048 failed [ 869.423948][T20836] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 869.477677][T20836] UDF-fs: Scanning with blocksize 4096 failed [ 869.514712][T20851] xt_cgroup: path and classid specified [ 870.038407][T20863] netlink: 'syz.0.4012': attribute type 11 has an invalid length. [ 870.294196][ T29] audit: type=1400 audit(1782217075.924:708): avc: denied { write } for pid=20850 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 870.548830][ T29] audit: type=1400 audit(1782217076.174:709): avc: denied { write } for pid=20868 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 870.686488][ T5272] etas_es58x 4-1:0.2 can1: bit-timing not yet defined [ 870.693772][ C1] etas_es58x 4-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 870.693861][ T10] usb 4-1: USB disconnect, device number 103 [ 870.702945][ C1] etas_es58x 4-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 870.702989][ C1] etas_es58x 4-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 870.703030][ C1] etas_es58x 4-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 870.736556][ C1] etas_es58x 4-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 870.808000][ T5272] etas_es58x 4-1:0.2 can1: es58x_open: Could not open the network device: -EINVAL [ 870.841567][ T10] etas_es58x 4-1:0.2: Disconnecting syz syz [ 871.311493][T20869] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4013'. [ 871.362449][T20882] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4015'. [ 871.608776][ T10] usb 4-1: new full-speed USB device number 104 using dummy_hcd [ 871.744081][T20888] FAULT_INJECTION: forcing a failure. [ 871.744081][T20888] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 871.806469][T20888] CPU: 0 UID: 0 PID: 20888 Comm: syz.0.4019 Tainted: G L syzkaller #0 PREEMPT(full) [ 871.806496][T20888] Tainted: [L]=SOFTLOCKUP [ 871.806502][T20888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 871.806512][T20888] Call Trace: [ 871.806518][T20888] [ 871.806525][T20888] dump_stack_lvl+0x100/0x190 [ 871.806550][T20888] should_fail_ex.cold+0x5/0xa [ 871.806572][T20888] _copy_from_user+0x2e/0xd0 [ 871.806598][T20888] copy_msghdr_from_user+0x9f/0x4c0 [ 871.806624][T20888] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 871.806652][T20888] ? kstrtouint_from_user+0x13c/0x1d0 [ 871.806674][T20888] ___sys_sendmsg+0x106/0x1e0 [ 871.806699][T20888] ? __pfx____sys_sendmsg+0x10/0x10 [ 871.806723][T20888] ? get_pid_task+0x106/0x250 [ 871.806753][T20888] ? rcu_is_watching+0x12/0xc0 [ 871.806785][T20888] __sys_sendmsg+0x160/0x210 [ 871.806805][T20888] ? __pfx___sys_sendmsg+0x10/0x10 [ 871.806827][T20888] ? rcu_is_watching+0x12/0xc0 [ 871.806852][T20888] do_syscall_64+0x115/0x870 [ 871.806878][T20888] ? clear_bhb_loop+0x40/0x90 [ 871.806896][T20888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 871.806913][T20888] RIP: 0033:0x7f03ae59ce59 [ 871.806926][T20888] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 871.806943][T20888] RSP: 002b:00007f03ac7f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 871.806960][T20888] RAX: ffffffffffffffda RBX: 00007f03ae815fa0 RCX: 00007f03ae59ce59 [ 871.806972][T20888] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 871.806982][T20888] RBP: 00007f03ac7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 871.806992][T20888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 871.807002][T20888] R13: 00007f03ae816038 R14: 00007f03ae815fa0 R15: 00007ffec15c4088 [ 871.807017][T20888] [ 871.967613][ T29] audit: type=1400 audit(1782217077.594:710): avc: denied { write } for pid=20878 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 872.079965][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 872.090114][ T10] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 872.099016][ T10] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 872.108025][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 872.117761][ T10] usb 4-1: config 0 descriptor?? [ 872.126848][ T10] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 872.133434][T20900] /dev/nullb0: Can't open blockdev [ 872.138865][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 872.145688][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 872.274294][ T10] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 872.375230][ T29] audit: type=1400 audit(1782217077.714:711): avc: denied { ioctl } for pid=20905 comm="syz.1.4021" path="socket:[78980]" dev="sockfs" ino=78980 ioctlcmd=0xaea0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 872.434390][T20877] dvb-usb: bulk message failed: -22 (2/0) [ 872.446376][ T10] usb 4-1: media controller created [ 872.458106][T20915] binder: 20910:20915 ioctl c018937b 0 returned -22 [ 872.466224][ T804] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 872.628686][ T804] usb 1-1: Using ep0 maxpacket: 16 [ 872.827015][ T804] usb 1-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 872.860091][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 873.157143][ T29] audit: type=1400 audit(1782217077.904:712): avc: denied { write } for pid=20909 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 873.157704][ T804] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 873.213252][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 873.238765][ T10] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 873.253639][ T804] usb 1-1: Product: syz [ 873.264664][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input105 [ 873.289791][ T804] usb 1-1: Manufacturer: syz [ 873.317037][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 873.325495][ T804] usb 1-1: SerialNumber: syz [ 873.344623][ T10] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 873.367769][ T804] usb 1-1: config 0 descriptor?? [ 873.412752][ T10] usb 4-1: USB disconnect, device number 104 [ 873.452695][ T10] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 873.801297][ T804] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 873.812263][ T804] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 873.836420][ T804] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 874.349412][ T804] usb 1-1: media controller created [ 874.394189][ T804] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 874.425484][ T29] audit: type=1400 audit(1782217080.054:713): avc: denied { write } for pid=20918 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 874.512687][ T804] zl10353_read_register: readreg error (reg=127, ret==0) [ 874.608117][ T804] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 874.641409][ T29] audit: type=1400 audit(1782217080.274:714): avc: denied { write } for pid=20941 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 874.704489][ T804] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 874.767492][ T804] usb 1-1: USB disconnect, device number 102 [ 874.795462][ T29] audit: type=1400 audit(1782217080.354:715): avc: denied { append } for pid=20942 comm="syz.3.4027" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 874.905754][ T804] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 875.263449][ T29] audit: type=1400 audit(1782217080.894:716): avc: denied { bind } for pid=20942 comm="syz.3.4027" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 875.367805][ T29] audit: type=1400 audit(1782217080.894:717): avc: denied { read write } for pid=20942 comm="syz.3.4027" name="mouse0" dev="devtmpfs" ino=924 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 875.481674][ T29] audit: type=1400 audit(1782217080.894:718): avc: denied { open } for pid=20942 comm="syz.3.4027" path="/dev/input/mouse0" dev="devtmpfs" ino=924 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 876.253899][ T29] audit: type=1400 audit(1782217081.814:719): avc: denied { execute } for pid=20963 comm="syz.1.4031" path=2F6D656D66643A01FDAE2E2BA68CB63F32193994532C7C783F55655BBDE1210333BC2723FF179B25F35B642006202864656C6574656429 dev="hugetlbfs" ino=79947 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 981.472464][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 981.479433][ C0] rcu: 1-...!: (1 GPs behind) idle=a844/1/0x4000000000000000 softirq=131452/131453 fqs=179 [ 981.489498][ C0] rcu: (detected by 0, t=10502 jiffies, g=123865, q=705 ncpus=2) [ 981.497297][ C0] Sending NMI from CPU 0 to CPUs 1: [ 981.497324][ C1] NMI backtrace for cpu 1 [ 981.497338][ C1] CPU: 1 UID: 0 PID: 20969 Comm: syz.5.4029 Tainted: G L syzkaller #0 PREEMPT(full) [ 981.497358][ C1] Tainted: [L]=SOFTLOCKUP [ 981.497364][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 981.497372][ C1] RIP: 0010:__kasan_check_write+0x8/0x20 [ 981.497392][ C1] Code: f3 ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 0c 24 <89> f6 ba 01 00 00 00 e9 dc f2 ff ff 66 66 2e 0f 1f 84 00 00 00 00 [ 981.497405][ C1] RSP: 0018:ffffc90000a08df8 EFLAGS: 00000046 [ 981.497418][ C1] RAX: 0000000000000001 RBX: ffff8880b8528400 RCX: ffffffff81e56168 [ 981.497428][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000a08e28 [ 981.497437][ C1] RBP: ffff8880b8528408 R08: 0000000000000001 R09: ffffed10170a5080 [ 981.497446][ C1] R10: ffff8880b8528403 R11: ffffc90000a08ff8 R12: 1ffff920001411c1 [ 981.497456][ C1] R13: ffff8880b8528410 R14: ffff8880b8528640 R15: ffff8880b8528690 [ 981.497465][ C1] FS: 0000000000000000(0000) GS:ffff8881243ef000(0000) knlGS:0000000000000000 [ 981.497480][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 981.497489][ C1] CR2: 0000200000023000 CR3: 000000000e592000 CR4: 00000000003526f0 [ 981.497499][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 981.497508][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 981.497517][ C1] Call Trace: [ 981.497524][ C1] [ 981.497529][ C1] do_raw_spin_lock+0x128/0x260 [ 981.497550][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 981.497570][ C1] __hrtimer_run_queues+0x1b7/0x9c0 [ 981.497593][ C1] hrtimer_interrupt+0x3e5/0x940 [ 981.497609][ C1] __sysvec_apic_timer_interrupt+0x109/0x470 [ 981.497631][ C1] sysvec_apic_timer_interrupt+0x9e/0xc0 [ 981.497656][ C1] [ 981.497661][ C1] [ 981.497666][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 981.497682][ C1] RIP: 0010:unwind_next_frame+0x1561/0x2090 [ 981.497697][ C1] Code: bf 69 02 ba 08 00 00 00 4c 89 ef 4d 8d 7d 34 4c 01 f5 48 89 ee e8 cf e8 ff ff 84 c0 0f 84 f3 ed ff ff 48 89 ef e8 9f e2 ff ff <49> 8d 7d 40 48 89 fa 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 [ 981.497709][ C1] RSP: 0018:ffffc90002566ef0 EFLAGS: 00000202 [ 981.497720][ C1] RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff918b2a32 [ 981.497728][ C1] RDX: ffffc90002567101 RSI: ffffc900025671b0 RDI: ffffc900025671b0 [ 981.497738][ C1] RBP: ffffc900025671b0 R08: 0000000000000001 R09: 0000000000000000 [ 981.497746][ C1] R10: ffffc90002566f60 R11: 0000000000018483 R12: ffffc90002566fb0 [ 981.497755][ C1] R13: ffffc90002566f60 R14: ffffc900025671e0 R15: ffffc90002566f94 [ 981.497769][ C1] ? __reset_page_owner+0x84/0x190 [ 981.497787][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 981.497801][ C1] arch_stack_walk+0x94/0xf0 [ 981.497816][ C1] ? free_unref_folios+0xa44/0x1710 [ 981.497830][ C1] stack_trace_save+0x8e/0xc0 [ 981.497843][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 981.497857][ C1] ? rcu_is_watching+0x12/0xc0 [ 981.497877][ C1] ? trace_irq_enable.constprop.0+0x122/0x160 [ 981.497897][ C1] save_stack+0x162/0x1e0 [ 981.497912][ C1] ? __pfx_save_stack+0x10/0x10 [ 981.497929][ C1] ? rcu_is_watching+0x12/0xc0 [ 981.497948][ C1] ? page_ext_put+0x3e/0xd0 [ 981.497961][ C1] ? lock_release+0x24d/0x310 [ 981.497976][ C1] ? rcu_read_lock_held+0x9/0x50 [ 981.497990][ C1] __reset_page_owner+0x84/0x190 [ 981.498006][ C1] free_unref_folios+0xa44/0x1710 [ 981.498021][ C1] ? rcu_is_watching+0x12/0xc0 [ 981.498039][ C1] ? folios_put_refs+0x51d/0xaa0 [ 981.498058][ C1] ? lock_release+0x24d/0x310 [ 981.498074][ C1] folios_put_refs+0x585/0xaa0 [ 981.498093][ C1] ? __pfx_folios_put_refs+0x10/0x10 [ 981.498112][ C1] ? lock_release+0x24d/0x310 [ 981.498128][ C1] ? folio_batch_remove_exceptionals+0x115/0x1a0 [ 981.498144][ C1] shmem_undo_range+0x5e5/0x1570 [ 981.498161][ C1] ? __pfx_shmem_undo_range+0x10/0x10 [ 981.498180][ C1] ? trace_irq_enable.constprop.0+0x122/0x160 [ 981.498198][ C1] ? irqentry_exit+0x24d/0xa00 [ 981.498223][ C1] ? rcu_is_watching+0x12/0xc0 [ 981.498242][ C1] ? is_bpf_text_address+0x8a/0x1a0 [ 981.498258][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 981.498272][ C1] ? rcu_is_watching+0x12/0xc0 [ 981.498290][ C1] ? percpu_counter_add_batch+0xb9/0x230 [ 981.498310][ C1] shmem_evict_inode+0x3a5/0xbe0 [ 981.498322][ C1] ? is_bpf_text_address+0x94/0x1a0 [ 981.498339][ C1] ? inode_wait_for_writeback+0x171/0x390 [ 981.498359][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 981.498371][ C1] ? arch_stack_walk+0xa6/0xf0 [ 981.498383][ C1] ? __pfx_inode_wait_for_writeback+0x10/0x10 [ 981.498403][ C1] ? evict+0x37e/0xad0 [ 981.498418][ C1] ? rcu_is_watching+0x12/0xc0 [ 981.498436][ C1] ? evict+0x37e/0xad0 [ 981.498450][ C1] ? lock_release+0x24d/0x310 [ 981.498465][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 981.498479][ C1] evict+0x3c2/0xad0 [ 981.498494][ C1] ? rcu_is_watching+0x12/0xc0 [ 981.498518][ C1] ? fsnotify_grab_connector+0x11f/0x290 [ 981.498536][ C1] ? __pfx_evict+0x10/0x10 [ 981.498551][ C1] ? rcu_is_watching+0x12/0xc0 [ 981.498569][ C1] ? iput.part.0+0x981/0x1050 [ 981.498584][ C1] ? lock_release+0x24d/0x310 [ 981.498600][ C1] iput.part.0+0x989/0x1050 [ 981.498617][ C1] iput+0x35/0x40 [ 981.498632][ C1] dentry_unlink_inode+0x284/0x470 [ 981.498652][ C1] dentry_kill+0x25d/0xc20 [ 981.498670][ C1] dput.part.0+0xd7/0x240 [ 981.498686][ C1] dput+0x1f/0x30 [ 981.498701][ C1] __fput+0x519/0xb50 [ 981.498716][ C1] ? trace_irq_enable.constprop.0+0x122/0x160 [ 981.498734][ C1] task_work_run+0x150/0x240 [ 981.498750][ C1] ? __pfx_task_work_run+0x10/0x10 [ 981.498764][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 981.498784][ C1] do_exit+0x951/0x2ae0 [ 981.498805][ C1] ? __pfx_do_exit+0x10/0x10 [ 981.498824][ C1] ? do_raw_spin_lock+0x128/0x260 [ 981.498841][ C1] ? get_signal+0x7e0/0x21e0 [ 981.498858][ C1] do_group_exit+0xd5/0x2a0 [ 981.498872][ C1] get_signal+0x1ec7/0x21e0 [ 981.498891][ C1] ? __pfx_get_signal+0x10/0x10 [ 981.498908][ C1] ? do_futex+0x190/0x440 [ 981.498927][ C1] arch_do_signal_or_restart+0x91/0x7e0 [ 981.498942][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 981.498959][ C1] ? __x64_sys_openat+0x12d/0x210 [ 981.498976][ C1] ? rcu_is_watching+0x12/0xc0 [ 981.498996][ C1] exit_to_user_mode_loop+0x139/0x6f0 [ 981.499014][ C1] ? rcu_is_watching+0x12/0xc0 [ 981.499033][ C1] do_syscall_64+0x666/0x870 [ 981.499053][ C1] ? clear_bhb_loop+0x40/0x90 [ 981.499067][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 981.499081][ C1] RIP: 0033:0x7f21c419ce59 [ 981.499091][ C1] Code: Unable to access opcode bytes at 0x7f21c419ce2f. [ 981.499097][ C1] RSP: 002b:00007f21c23b40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 981.499110][ C1] RAX: fffffffffffffe00 RBX: 00007f21c4416188 RCX: 00007f21c419ce59 [ 981.499119][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f21c4416188 [ 981.499129][ C1] RBP: 00007f21c4416180 R08: 0000000000000000 R09: 0000000000000000 [ 981.499138][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 981.499147][ C1] R13: 00007f21c4416218 R14: 00007ffd14da5670 R15: 00007ffd14da5758 [ 981.499160][ C1] [ 981.499319][ C0] rcu: rcu_preempt kthread starved for 10143 jiffies! g123865 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 982.220744][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 982.230698][ C0] rcu: RCU grace-period kthread stack dump: [ 982.236562][ C0] task:rcu_preempt state:R running task stack:29168 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 982.250041][ C0] Call Trace: [ 982.253303][ C0] [ 982.256218][ C0] __schedule+0x125c/0x6730 [ 982.260715][ C0] ? rcu_is_watching+0x12/0xc0 [ 982.265476][ C0] ? trace_irq_enable.constprop.0+0x122/0x160 [ 982.271535][ C0] ? __pfx___schedule+0x10/0x10 [ 982.276372][ C0] ? rcu_is_watching+0x12/0xc0 [ 982.281123][ C0] ? schedule+0x2bf/0x390 [ 982.285440][ C0] ? lock_release+0x24d/0x310 [ 982.290105][ C0] schedule+0xdd/0x390 [ 982.294164][ C0] schedule_timeout+0x127/0x280 [ 982.299011][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 982.304380][ C0] ? prepare_to_swait_event+0xdf/0x4a0 [ 982.309835][ C0] ? __pfx_process_timeout+0x10/0x10 [ 982.315113][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 982.320914][ C0] ? prepare_to_swait_event+0xdf/0x4a0 [ 982.326363][ C0] rcu_gp_fqs_loop+0x1a9/0x900 [ 982.331118][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 982.336390][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 982.341313][ C0] ? __pfx_rcu_gp_cleanup+0x10/0x10 [ 982.346500][ C0] rcu_gp_kthread+0x179/0x230 [ 982.351162][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 982.356344][ C0] ? trace_irq_enable.constprop.0+0x122/0x160 [ 982.362401][ C0] ? __kthread_parkme+0x18c/0x230 [ 982.367413][ C0] ? kthread+0x13a/0x450 [ 982.371639][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 982.376821][ C0] kthread+0x370/0x450 [ 982.380870][ C0] ? __pfx_kthread+0x10/0x10 [ 982.385442][ C0] ret_from_fork+0x72b/0xd50 [ 982.390022][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 982.395123][ C0] ? __switch_to+0x800/0x10f0 [ 982.399782][ C0] ? __pfx_kthread+0x10/0x10 [ 982.404353][ C0] ret_from_fork_asm+0x1a/0x30 [ 982.409107][ C0] [ 982.412113][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 982.418417][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 982.428900][ C0] Tainted: [L]=SOFTLOCKUP [ 982.433203][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 982.443237][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 982.448859][ C0] Code: 16 86 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 b8 10 00 fb f4 fc 48 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 982.468446][ C0] RSP: 0000:ffffffff8e407e10 EFLAGS: 00000246 [ 982.474496][ C0] RAX: 00000000092e3eec RBX: ffffffff8e491480 RCX: ffffffff8b9ae2d5 [ 982.482451][ C0] RDX: 0000000000000001 RSI: ffffffff8c1e6000 RDI: ffffffff81de4aa7 [ 982.490402][ C0] RBP: fffffbfff1c92290 R08: 0000000000000000 R09: ffffed101708678d [ 982.498355][ C0] R10: ffff8880b8433c6b R11: ffffffff81d51f9c R12: 0000000000000000 [ 982.506307][ C0] R13: 0000000000000000 R14: 1ffffffff1c80fc6 R15: dffffc0000000000 [ 982.514262][ C0] FS: 0000000000000000(0000) GS:ffff8881242ef000(0000) knlGS:0000000000000000 [ 982.523176][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 982.529745][ C0] CR2: 00007f28c34baee4 CR3: 000000002cb3e000 CR4: 00000000003526f0 [ 982.537701][ C0] Call Trace: [ 982.540966][ C0] [ 982.543880][ C0] default_idle+0x9/0x10 [ 982.548104][ C0] default_idle_call+0x6c/0xb0 [ 982.552850][ C0] do_idle+0x3a7/0x5b0 [ 982.556914][ C0] ? __pfx_do_idle+0x10/0x10 [ 982.561493][ C0] cpu_startup_entry+0x4f/0x60 [ 982.566244][ C0] rest_init+0x251/0x260 [ 982.570469][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 982.576004][ C0] start_kernel+0x48e/0x490 [ 982.580495][ C0] x86_64_start_reservations+0x24/0x30 [ 982.585938][ C0] x86_64_start_kernel+0x12b/0x130 [ 982.591036][ C0] common_startup_64+0x13e/0x158 [ 982.595961][ C0]