last executing test programs: 15.119389517s ago: executing program 3 (id=1558): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000640)=ANY=[@ANYBLOB="fc008c2ac7c201002db9706d23a8e52d17c75a96c30000000000ac1e00010000f7000000000000000000ac1414aa00000000000000000000000000000000000000000a000000e5000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f000000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff0000000001000600000000004400050000000000000000000000ffffe0000001000000003c0000000200000000000000000000000000ffffac1e010106000000040300000100"/180], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0xffd8) r3 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r3, &(0x7f0000000040)={0x1a, 0x8, 0x0, 0x0, 0xf7, 0x42}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000004c0)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], 0x0}, 0x94) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) io_uring_setup(0x7fc0, &(0x7f0000000000)={0x0, 0x3, 0x40}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0xc40, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r5 = io_uring_setup(0xc, &(0x7f0000000040)={0x0, 0xc92e, 0xdb00, 0x8, 0x29}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r5, 0x2219, 0x7721, 0x1f, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r4, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xc, 0x67f, 0x83, 0x8, 0x46e00, 0xffffffffffffffff, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x2000, 0x1, 0x5}, 0x50) r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000600000000000000", @ANYRES32=0x1, @ANYBLOB='\b\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000000000000200000000000000000000000000000000000000502798070c4abff07ec0a8f6c38ad018dfe86c14eac3fe410259ac62bb90859d9439f5168c60c59a5f53047b42de59224d7f9190355868f19196767011d94c604bfc6df9235694472dea19859ea9a728dfb0d3cd8fcf294797b65fb82be17c8664703c94fb5dd119a915f6"], 0x50) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000bc0)=@bpf_ext={0x1c, 0x1c, &(0x7f0000000880)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7}, [@jmp={0x5, 0x0, 0x8, 0x2, 0x2, 0xfffffffffffffffe, 0xfffffffffffffffc}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x9}}, @map_val={0x18, 0x2, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x1}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffff7}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}}]}, &(0x7f0000000980)='syzkaller\x00', 0xfffffc0d, 0x6, &(0x7f00000009c0)=""/6, 0x40f00, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000a00)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000a40)={0x5, 0x0, 0xfffffffb, 0x6}, 0x10, 0x240f, 0xffffffffffffffff, 0x5, &(0x7f0000000b00)=[r7, r0, 0x1, 0xffffffffffffffff], &(0x7f0000000b40)=[{0x3, 0x3, 0x10, 0x2}, {0x3, 0x5, 0x9, 0x8}, {0x3, 0x1, 0x8, 0xc}, {0x5, 0x3, 0xe, 0xa}, {0x2, 0x4, 0x1, 0x4}], 0x10, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r8, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) 12.356958384s ago: executing program 3 (id=1561): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, 0x0, &(0x7f0000000080)) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) lstat(0x0, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x16, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8ab8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000006900000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x66, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000000)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x8004401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 11.396370915s ago: executing program 3 (id=1563): pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8042, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f0000000600)={0x2, 0x0, {0xf3db, @usage=0x8001, 0x0, 0x967c, 0x10000, 0xcc4, 0x0, 0x2, 0x8, @struct={0x3, 0x2}, 0x6, 0x6, [0x7, 0xffffffffffffff16, 0x100, 0x7fff, 0x81, 0xfff]}, {0xcfd2, @usage=0x7ff, 0x0, 0xf9b, 0xf6, 0xfffffffffffffffe, 0x5, 0xf36, 0x2, @struct={0x1, 0x100}, 0xed, 0xe70, [0x6, 0x10000, 0x8, 0xb1, 0x300000000, 0x5]}, {0x0, @usage, 0x0, 0x0, 0x4, 0x7, 0x7, 0x1, 0x61, @struct={0x1, 0x3}, 0x6, 0x6, [0x4, 0x72, 0x1, 0xdb1, 0x3ff, 0x8]}, {0x6, 0x7, 0x1000}}) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000000a00)={r3, "0f0a3e11991c2ba32080c0dcd1e07349"}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000040)={0xfffffffe}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x4, 0x7, 0x2, 0x180, 0x2004, 0x14, 0xf1, 0x50, 0x12, 0x5, 0x0, 0x29, 0x0, 0x6, 0x0, 0xbda], 0x4, 0x53500}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = socket$netlink(0x10, 0x3, 0x4) write(r7, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb000000000000000040000000", 0x6f) r8 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_genetlink_get_family_id$wireguard(&(0x7f0000000300), r0) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f00000003c0)={[0x400007, 0x1000000000, 0x0, 0x43, 0x2000001, 0x0, 0x2004cb, 0x0, 0xa7c, 0x68ff, 0x5, 0x9, 0x3], 0xeeee8000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0xeeee0000, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x7, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x42, 0x5, 0x7d, 0x6, 0x36, 0xfd, 0x2, 0x87}, {0x0, 0xdddd0000, 0xe, 0x1, 0x3, 0x4, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0x9, 0x6, 0x5, 0x42, 0xb, 0xff, 0x8, 0x9, 0xe}, {0xeeee0000, 0xd000, 0xf, 0x3, 0x16, 0x7, 0xab, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0x2000, 0x0, 0xb, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x31, 0x0, 0x7}, {0x3000, 0x3000, 0x4, 0x5, 0x7, 0x5, 0x80, 0x3, 0x8, 0x81, 0x40, 0x70}, {0xd000, 0x4000, 0xa, 0x5, 0xcd, 0x7, 0x1, 0x9, 0x2, 0xc, 0xb0, 0x81}, {0x4000, 0x30}, {0x8000000, 0x7}, 0x0, 0x0, 0x3000, 0x2024, 0x2, 0x0, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) 10.851683769s ago: executing program 0 (id=1570): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r0, &(0x7f0000001500)=[{&(0x7f0000000080)=""/4080, 0x1044}], 0x1, 0x1, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x15, 0x3, &(0x7f0000000000)=@framed={{0xdb, 0xa, 0xa, 0xfe00, 0xa0, 0x71, 0x10, 0x15}}, &(0x7f0000000480)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x67, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x24, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0x7, 0xffff}, {0x9, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRESDEC], 0x0) 10.819828153s ago: executing program 2 (id=1571): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000100)={0x0, 0x4}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000001c0), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x7, 0x0, &(0x7f0000000300)="e02742e8680d85", 0x0, 0x4002, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r2, 0x0, 0xffffffffffffff9c, 0x0, 0x75) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r2, 0x18, &(0x7f00000001c0)={0x2, r1, 0x30, {0x1, 0x5}, 0x6}, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x24000851}, 0x240c8080) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) clock_nanosleep(0x0, 0x1, 0x0, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) syz_open_procfs$userns(0x0, &(0x7f0000000280)) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0xf5ffffff, 0x4000000}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, 0x1, 0x4, 0x5, 0x0, 0x0, {0xa}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc010}, 0x22000004) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00'}) 8.403268311s ago: executing program 4 (id=1574): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, 0x0, &(0x7f0000000080)) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) lstat(0x0, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x16, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8ab8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000006900000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x66, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000000)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x8004401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 8.320128986s ago: executing program 2 (id=1575): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001500)=ANY=[@ANYBLOB="8025000041000701fefffffffeffffff017c0000040042800c00018006000600800a00005a250280bc1314"], 0x2580}, 0x1, 0x0, 0x0, 0x4048011}, 0x4000000) 7.467229077s ago: executing program 4 (id=1576): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001500)=ANY=[@ANYBLOB="8025000041000701fefffffffeffffff017c0000040042800c00018006000600800a00005a250280bc1314"], 0x2580}, 0x1, 0x0, 0x0, 0x4048011}, 0x4000000) (fail_nth: 1) 7.438201656s ago: executing program 0 (id=1577): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x6}]}, &(0x7f00000002c0)='syzkaller\x00', 0x4}, 0x94) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xdffffffe, 0x80, 0x2, 0x21b}, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140)) (async) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xdffffffe, 0x80, 0x2, 0x21b}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000005c0)=@IORING_OP_RECV=@pass_buffer={0x1b, 0xe, 0x0, r0, 0x0, 0x0, 0x0, 0x40000000}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x3, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r1, 0x18, &(0x7f0000000080)={0x9, 0xffffffffffffffff, 0xc, {0xfff, 0x7}}, 0x1) 7.332101546s ago: executing program 1 (id=1578): r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r0, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @empty}, 0x10, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71", 0x33}], 0x2, &(0x7f00000011c0)=ANY=[@ANYBLOB="1400000000000000010000002500000002010000000000004800000000000000080000000700000010000034366567f2219787566400007300000000000000000000000008000000ef3820f3439cb150a3651e799e1459c9c9a7521737a8879e3ef4dca1e3c32158996e4b2abde5342e22f2ba8b679121ac0b0ad62ade31fb2c47f0bbf781eb8bd1e3064141e90e9eac25b189c0da98b676571bbeefba392c3e15a10e03dee4ae1dfe99793e51ec0c6bb5fa6d7b357d249502f5919ef251e5d0e5bed378265b8bd55fde4689cb509b14fa754813a27e72d175e8d677420e10d651833e6e2ab8168b1d633b1bb9a7d4d59ebdc708", @ANYRES32=0x0, @ANYBLOB="e1212f0409000000e70bcf35ac837225dd355ad309a5ec6096633ba38e1ef5baf006020e5f45c993cb5680017c6720bea9b7c451516a8cff7f00000000000019f20b784b2336d43c8a0f7347801a596dfb0b078a967980ccec1d115c7a0000000000000000000000fed6260fdf140498f1274bc569d0d87656d0d18d903580f0ec0915e89bd286b2c25165043f6a001d53f84eaabf01cc310ff28c7c76867ce1a2c9c91b1db7295614e2a4f8711ec37ae999180cb5bbb9c5382120076e117539d423a2ec0f468db35960831f5f884c1fa9f46b3472327697495b8e8ba8e2f3defbe93e1fc733b06dfc74890a3f63b154e9681d69cdd9894c914ee45c286462888ff84e401a6d8895ffda88a171b7359f815d7b6f7562fba1bbff4cba08f7a39a8e88b66a4717b3c318f85aecbe8b5f3485f8d31bf5a57b9dd53b382ec017a33d1fabe09daf76b3b0"], 0x6b}, 0x0) close(r0) 7.14305882s ago: executing program 1 (id=1579): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000240)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0x2}]}) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_REMOVE(r4, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x94, 0x0, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}]}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x43}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xb}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast1}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x40004}, 0x10041) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0x2, @remote, 0x7}, 0x1c) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, 0x0, 0x0) sendmmsg$inet(r0, &(0x7f0000001940)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="01", 0x1}], 0x1}}], 0x1, 0xc0) 7.138596984s ago: executing program 3 (id=1580): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000240)={0x1f, 0x3, @none, 0x0, 0x2}, 0xe) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000180), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000005580)=""/102392, 0x18ff8) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x5, 0x4, 0x9, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xe, 0xc, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x63}}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @sk_skb=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) openat$sysfs(0xffffff9c, 0x0, 0x42242, 0x73) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000780)={0x44, 0x0, &(0x7f0000000900)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 7.138128579s ago: executing program 4 (id=1581): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/wireless\x00') open$dir(&(0x7f00000002c0)='./file0\x00', 0x101300, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f00000042c0)=ANY=[@ANYBLOB="120100033f8401e400200d09045601000301020900"/36], &(0x7f0000004cc0)={0x0, 0x0, 0x0, 0x0}) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x100002b3, 0x4) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) prlimit64(0x0, 0xe, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000018000000000000000000000000a20000000000a010400000000000000000100000309000100737900000000000000010000000900010073797a30000000000900030073797a320000000050000000060a010400000000000000000100000208000b4000000000280004802400018008000100636d70001800028004000380080001400000000f08000240000000fd0900010073797a3000000000140000001100010000000000000000000000000a00"/196], 0xc4}}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) setresuid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) prlimit64(0x0, 0xd, &(0x7f0000000340)={0xcf44, 0xfffffffffffffff7}, 0x0) r4 = semget(0x1, 0x3, 0x2) r5 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000004c0)={'vxcan0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=@ipv6_newaddrlabel={0x5c, 0x48, 0xec3567ed724bdc4d, 0x70bd2d, 0x25dfdbfe, {0xa, 0x0, 0x40, 0x0, r6, 0xfffff001}, [@IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_LABEL={0x8}, @IFAL_ADDRESS={0x14, 0x1, @private0}, @IFAL_ADDRESS={0x14, 0x1, @remote}, @IFAL_LABEL={0x8, 0x2, 0x7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x8081) stat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000001c0)=0x0, &(0x7f0000000200), &(0x7f0000000240)) stat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) semctl$IPC_SET(r4, 0x0, 0x1, &(0x7f00000003c0)={{0x1, r7, r8, r9, 0xffffffffffffffff, 0x0, 0xc9}, 0xd0, 0x7, 0x0, 0x0, 0x0, 0x0, 0xd}) r10 = io_uring_setup(0x5ce3, &(0x7f00000000c0)={0x0, 0x6a0d, 0x3000, 0x1, 0x387}) io_uring_register$IORING_REGISTER_RESIZE_RINGS(r10, 0x21, &(0x7f0000000340)={0x0, 0x2fc3f, 0x10, 0x2, 0x377, 0x0, r10}, 0x1) 7.124000391s ago: executing program 2 (id=1582): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000008850000007600000095"], &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe468}, 0x94) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=@newtaction={0x64, 0x30, 0xffffffffffffffff, 0x0, 0x0, {}, [{0x50, 0x1, [@m_bpf={0x4c, 0x1, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1, 0x0, 0x10000000, 0x5, 0x8}}, @TCA_ACT_BPF_FD={0x8, 0x5, r1}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7000000}}}}]}]}, 0x64}}, 0x0) 7.043146562s ago: executing program 0 (id=1583): openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x2, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x10, &(0x7f0000000100)=0x6, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r2, r1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x105c42, 0x0) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x6, @mcast1}, 0x1c) sendto$inet6(r3, &(0x7f0000000800)="0d0ad7", 0x3, 0x6d91fb6102d8914c, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$inet(r3, &(0x7f0000003f40)={0x0, 0x0, 0x0}, 0x880) recvfrom(r3, &(0x7f0000001a80)=""/4050, 0xfd2, 0x0, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2004890, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000005580)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f0000005ac0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001400)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}], 0x20, 0x8811}}], 0x2, 0x40044) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xe, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000fdffffff18150000", @ANYBLOB], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @sk_skb=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 6.947844414s ago: executing program 2 (id=1584): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b0000008000000001000000ffff000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640), &(0x7f00000006c0), 0x10000ca, r1}, 0x38) socket$nl_netfilter(0x10, 0x3, 0xc) capset(0x0, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4000000000000, 0xffffffffffbffffe, 0x7f}, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x10c062) sendfile(r2, r2, 0x0, 0x2000000000409) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) connect$x25(r3, &(0x7f0000000a80), 0x12) io_uring_setup(0x2fac, 0x0) setsockopt$SO_BINDTODEVICE_wg(r3, 0x1, 0x19, &(0x7f0000000000)='wg2\x00', 0x4) bpf$MAP_CREATE(0x0, 0x0, 0x48) accept(r3, &(0x7f0000000140)=@can, &(0x7f00000001c0)=0xbf) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000880)=[{0x0}], 0x1}, 0x40012040) timer_create(0x3, &(0x7f0000000100)={0x0, 0x24, 0x2, @thr={0x0, 0x0}}, 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = dup(r4) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0xfffffffffffffffd) syz_kvm_setup_cpu$x86(r5, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0xe, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) 6.600368902s ago: executing program 1 (id=1585): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x2080) (async) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 32) socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x79}) r5 = userfaultfd(0x1) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000100)={{&(0x7f00008e4000/0x3000)=nil, 0x3000}, 0x1}) (async, rerun: 32) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0xc41, 0x0, 0x0, 0x1000, 0x7, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) (async, rerun: 32) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000380)={0x0, 0x2, 0x2000, 0xfffffffe, 0x238, 0x0, r8}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x704, 0x100, 0x1000000, 0x2033f, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x4, 0x0, 0xdd}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa057, 0x400}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x4000, 0x0, 0xdfffffff}}], 0x1, 0x0, 0x0) 6.54414494s ago: executing program 0 (id=1586): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, 0x0, &(0x7f0000000080)) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) lstat(0x0, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x16, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8ab8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000006900000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x66, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000000)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x8004401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.608959116s ago: executing program 0 (id=1587): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r0, &(0x7f0000001500)=[{&(0x7f0000000080)=""/4080, 0x1044}], 0x1, 0x1, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x15, 0x3, &(0x7f0000000000)=@framed={{0xdb, 0xa, 0xa, 0xfe00, 0xa0, 0x71, 0x10, 0x15}}, &(0x7f0000000480)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x67, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x24, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0x7, 0xffff}, {0x9, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100007add152045058080010300", @ANYRESDEC], 0x0) 5.272411626s ago: executing program 3 (id=1588): socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x185042, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000240), 0x47dfffc, 0x105381) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001ac0)={r0, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fa, 0x0, 0x0, 0x1c, 0x4, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1cac3f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174f050500000000e354b98ef0000000000000000000004000", [0x6, 0x3fd]}}) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000001c00)={0x8, {"b0476b76ba5d044f65271519727e4ff1ff0d12c0e6bdf3ea1f52e24f60ca698457b32832b83d7e96694c1feb5809bd67002f71e0b97c0d5270c04ffa64f63b2e18ee4b7b572fe2f4d03cad38bcd106ff12f53b443ac6fc81da518f54b9004a44859529c07a2b1b8feddc0180a0f37b13babba1dd0813b7ea56dac4b7ffe9a2ef54221439ecc55223ef2d40f4ba8108c10387ddffbaed25d41e7692bf26ddfa747a666caff49843e38c86cac7323f784a17df6beaa49c3f4a98fb4013f4e573e2ef77b0965d4bfbdf7d5eada69406ca93f422495e00addfca1518085a40f10284ff59388ecf476a12ef1a540163922098d600519ae8cf3ef544344e9d968f341af618503b455f3976b76975270e94d714302382c63de5b7c1fad1fa373b369916cb3b4d583a9ebbaeb262884d25a0e1d9fb141de60df7e64cb38b6f7167991f8fba06bffe2d49133bbb462cd8a9493177eee5f03875b15c7a92c3cd6a3fdfc64f236e14fa05a0e8d3c45f13eecd22e13528c74186dc50e0e2af44177e26bded1161e5533375508dadb83db5126cc810f4e30d4e24ec12c3b99e5220aacf42c58f2960bd43c337dbd318aeeb5c9a6cd5ffd3bf1497bb48ab7bcb32c9c33c9f5b9bc4645b96f23f9e0d826b780030444ffb925f55df587ef5ca5ea74ccd66afc7981da496d6f037efbb0b08f3f5078c60ffb4db18d1b59996bd9b1513442785bf4ece8587b39d8176dc9c735d5ea25133b2053bba227b81faab7220326f8814a9df4eba4ecc6acdd82f70b653b56a18cc9dfa4deb0a112c797ab89a51a103c3a9085d828523370c4d79d9484f4dc910735a2c9b5b85197cd9c073df7a54b40df8e1bf595bab957900c2a1a7dc40e88ed0c55c362ffbb7f88a0725a6ae73b936a639e951faf9c45ae74a2ece2f6f88e425ee41d2c60cb083a2fd6d07381908a7f629e32f89a553cf0794f54b8bdc7bd541d88464a4f80ac0b8b625a803a55de4b05a95fc7f8fc3d6d79858ccb269b7b8b21657654164a9aa29f4e8462377e9d234a41ea69841a4aaa1e5f89f9b074f6f71cb1ffaa450c3160b0e319ec81ad30101db66218b0c69f97c234465dc45849fcfd62d396f2b50ddcc0ed7dd8651431534232ab6d1186d7760770a1fc6c77553a79d0297194f794997ee47781094a76d9dccf632dcbb527b3e68950d9bb534245c7f08ae1d6ef2750292ae28e5e6dcfe2a69737dd7a1e453f3902ae90789e98c212905422099904d3bfb949bde187682a59c01aa8e6a9972a63d6aaef4d4139b10a24e063707f1aba79bd59e3f9709a873dff401d1f356c4be5e449ae0e2633a1fe50ed367fe56b0499957c3b6cabb42256547995ea998f3937d153897d1c83f1ad922d6835bdfa3b986dc6f4bd927a4ca13fbaa99b7b43758e2329d588f40fac718b16cca855468643f3818496b4915fe9a2bdd3e68889fea24bc1dfa6287a801d49a7bb84654147448550d2919e4df3a943a88cf616befea4e7a4fddb7969311c6837f9529966241be1e57ed2d773debc542986d09866905a3f63b6e1820086d52a70f039154e839da7ea852c33bf3722a048f61bbf068519e050b8788370fb130a42e9f5322dfff65b15d588f9e926b70e4530e8b66697cabb1e8514831431fa0eaecb49f9613ed5fd7bc50f897bda36d24d4296e143e2480e325ec09a77c03a07b4f86eb703085313ebeee94ef5b1cde3f6a7efd785772eb4034039f598c07819b769416a223fab824c4ac50086e78042a1ccf47b6c7ede8540cded4bd4c920ce6c2b7493a5634c5e96bb761373623ab473b121d555bfd5a8bc3f5c5418bed83ffd0d6492840550fccc0c35746370396d0190b7b1d2cadcc150877e0d197f692f97cec790c95e3d3959dc7c68aca37306c1bc13ad33848395dba5e3c9ce8090bc0e7e8312091773641be56411921e3d473321c6d8bd10b7d3f5aedd6620bcaa06474bbb298bc77297b8b5dcb9e6b33dbe676460cca825609857724cee245306d07fda287d5fe57c424c27cf9b6cf0f16d2c6a8071bd57c826d7371841cf43dab1b42421ce416d0d3a9c80bc807d2e6761e53f06b3e63c0af1b4548d820118421205f040f4ab35307871e4c7a21ff28082c29e02e89486064661898c0eb1811c70a6124c1f25d62c38794a3e87c312c870db7b60d0df8b57860c94d1a9c561b327fae3a68ce9ff4551e418eb00766f0341c5e796e3cbbbe6b4864928b966110256d5475eb1fd7b2893b60e19e859baaf23c9233a1b064771671ee2d07c151e2e99c37a116a338788052a726a8519b8335e9ff4f71d00ab634543c20ddea1bf57d4f2b797182ff19618b6974d2b69d9f052934d527a1830bf2785842f35eaf32b65b7c9fdd6f0c41756072a59c0cce0b7305740729f1daa14e0092da9d022321b726d658fcef55affa2bbf36ad788f1f423b7dfd328435b4d5df315143d8b8028ba4bea6134a3dc9720c73d5e66b8b8168752eea6b78c75f04efd9677dbe419f13f5e1c9764276a83821b710307d8f85359b34d038ff17de45e8739d4b647fd1a8d794a3273d922af3374f5d3c75b8345b9dfdabb2c0418a358921e0e73d0fe88caab1741b913673e22ff4b59afa0f653a423d9b2bb20cbf07951a349eea18a891b4f4dc6df8e42a6181284f643de5fd2924ae54f672a1920343476c67333e1e8205bf4877b1251a83f417936714edb1c6975ba7969d2fcc2e69024a4669ac2f998116ade1bd84568b8f3f1fccbe95df9ed21db77315b7469f30bfae418415d9cb5aeea627ba6811e30d56d4f4bfe5f794ea4243e3cdfad3ef55199699b8433083b6f72f95effc5f2f613cfcefaf0b94e801ebcb7095a1474ee93142b82c9bf9886617b6bf69d08c83c76cd21d4cce5872d99de8e54bbff915ab923b2d24bb3aa178dd50b44fd0eb880ef33ca51d4bf5f0fbc8ffe18afe4245397f277e4efad955baa10cf56613481253d69c02e7661714b68be0fd64f29bdafbc8b4a0b30bd6709c67fe8e8915d0479b3902b1d0169fb5486b02e966ad5d8a2bcf42ecba59177cd85e17239667f6b045d1f873ce24733ae17e2d8432709062e786a32ac925121f1b0d46c66d4fb9088f4aa0cfe2149f6c2cb5b75d45349bc88fbd47e01ea07e7cd573335aab8d389846566800dd084bc3caa95f7632719c651f2d33be0fb56347c063b3c6e3e75c5e58caeb4c37574859b78c1ed018fbeed788a4305a9ee1c1ef65a0c83a7cd717a8c08ecd4e86370ffffd6d40a89a0b1e8c15a10ad5406e867e49319ad83bfbb925d5e240b4bd44fd751e7510d5ea03a6cab95f37155d1fd69aaea1db4a1f53714eb90e669209cf634f84a50c85bdc51838ebbb545b4387790df67f0122740c2abc910cf83230394172a56c9ffda6675bb8bb39846730a1bf764aeb92407c90a194da880cb8a4efb5b57a8311d864209c7fd226b93582b6b11eec559abfbba653c0569c219d3a2e60555cb739f9d32d564f23c4e98be78aa553610822af426f961df0df2185c61ccaa22b2a6aa6fb3e917bdfb2be9c3ffb8a50821321119c4cf4917db39548abc17bfba267fa50f6af15c560a21055f967f1ca6f656ddb556f9c7e17a771eeef7e80940d1c14ddf2c27647686fd0526460036aeea395fb10abef2be2ea96c9bb380370c08d1568d30eea0f3e6b7cf8f7edc7b36d4d0affd249330707b54ee620f208d885791171eb67a25a80fcc6922e0258c9673b6576564949dfa5bed9a0299bf952aade654de16e22d54fcd391ded6adab94ff621efcd91ef69acf8dfa1b22692ba3e49cd1d3fbed6db1402065ab37e457056877977ebac33ef566f28a19b9acb67a9cc53feb156814e880b3dd5a9119ffdbc5a45c20ea375f2882575b9a28740eebf63f2895d9ffac1ec33cbdcdede98a201424d000df1efd64dd7268cc1b2366ccfb09754822dafdb1821de5e6ebee09608e82e679fafb7a5100172f26998d31d7f27c2b310f0372c3b5e888f8e6efb56074177bf6a2a5bbd9ed070ad5aaf23ce144d1ac86cad110e5916a8a57e1e7fc3d37353f84f2f6d43d92ab8b35040467f3f8b1d23fac021bbac3710edc8e2e26d794db38e48020f63e94d4b4dca3e015537a8e3008274d55f81af931a0faf1a438444b6a0489b93f7b88f81f761eae0f82e60cb0cf2745ca8c9e30d3cc189c1405b1994ed71b00d90ea7a94102916cdc915620c363d04e51eabaaca6c2814a7c1e7aaeec80bdc13135b813e6d0eea83446a5c57ec29695c302c0d8da65b61fe8ada51a36e1aff34d449f9eb70cb94931226121ab121a971c2fc070ca84272d122c1696f52fbd5ed06783abe188dcf133c4d41e10295f6ffda69fa8c5a7c0fec3425a2d60523a60d280b5ce34eac5911268172e772fefba63a6f5c6dafa9e500a5e1355fb614613f8fc1ef5e5466fa19212bcdc349a865f4cee6ea80b11a410bb6e4ad677393973e38621d25ff6c4876ef8a8d2ba651be4a78d2ba9fafadcea8eff9cca3f4ab71a0b84917794e521220dad099ac8aaf32abd162348879e4299e4d46395f9d55267b635e18ca2e2fc96146b96c8a8055130b8d8cb10cc31382df34057bd8637f86e48adc854af408226752a04df8d0362db263e0959f2bd7e8a4d33a8c4b257e19d308280baf40cced1b3cd3a86ee22df0da49d750539eee1104e99a9f8a065e5499c73125a8a8430eda7aee156821a97c237611b50f682a2cccd0969304f0a50ae98800dfb32ee1bcfeab98182c34a51e67fa5bd738c22c44fc1269ce73f464edd2f31296e92e62df51cf55798ae2e3c33c57b09f4ecd13469122095a3563f95f0a04cf58dcea4aed5e8bdda7617863cbc37a97ebadb46d679f7e30014d96d0ac7ce9484368fa5fd19cbc3d139410a2bd7ffacef1bdf76dd1d5f34d2392fcb91c7585fc1ae7d8ba2aa8ded9645d5a5e76e2279b6e0692101137da946dfbd3836476f5dad7fed70115d716dce87b5ad755e5653a709f5aa42265ec9657ed406cc9256af3628c0116b8e1d23306983e9adbc19dec354870c98e2e76566895df933a80c4c36b617db4bbda1a4ca7d6c80a43734471fc92d0bdeacfc125dddd73febd8f7ef84f221d52ae71372cee802d59013a15958e850f8fdf46d8fd3b874633daf3b1f346470456c05722258480959dd6afcffa1f3f2ca033011339c5cb85b7d1c9b5916fb8dc9c2783df64eb5cca5af83a74fe5bb259f93722842eb4ac851e71f3cfd67a39590e7f8e20f018744b9277e6eb46b5f211df5f767ef29dc9a972e14c40ea2d4624f187f301c1116d3a61adeb5c6f7ccc021ac5e18d8b40d7f1f19daf4445c06e72db8701c267c0144c92cddd49af7a87aca5aa05d0e380dd27cc780d2f7db3bef26cc4fd358543e19d73179b879f7bdc702ab405270c93a3ed64153e20b5b663773a2ad4e8e3e1e8eaf39ec80d75d02f74ff94f0e095240a564eeece4fc9bcf19bf2243c700e1dae14a1b0217013977bfa05f681abc37714fe462d0a632044ce52fdaa1c1a806b1eb4370e23ca0247e536165aa9f1c2af8adfea369ee1f4a2c7823a7baef028a1e77501db48db6aa0d7e30969f7197368db02d443803b53b2899315f7e2ba9c5ae952a3866b4ea60f3d669e0a91f7ef640cd938646bf8822fe455f0302fccf87c7fad6daf38fde038fa596b83a9fd5bf675669a6cb2bab44c6617f07950bf34edb93bbcb4174630f275dbda7a0631c4b456e5f80eb6258c1874e77d426743e478917fe44b73dc203baa2cc442b84b5818409abae99d97a28754969bd393df", 0x1000}}, 0xfffffe38) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x162682, 0x0) r4 = dup(r3) fallocate(r4, 0x10, 0x2000, 0x1062200) syz_usb_control_io$uac2(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000240)={0x0, 0x3e, 0x2, "c5d7"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) rt_sigtimedwait(&(0x7f00000001c0)={[0xee]}, 0x0, &(0x7f0000000240)={0x0, 0x3938700}, 0x8) r5 = socket$inet(0x2, 0x2000000080002, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x100000000000000, 0x80, &(0x7f00000001c0)=@broute={'broute\x00', 0x4000, 0x0, 0x90, [], 0x2, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007a0503e39a063df01729ade1d50f212af70a61d9e40c2c8539eabdac12c4e64cb38a1b556813339471b798018c704c942abd643964afff1273d2a5d15ef36788dc78a76b8938eae75bef577d288f400b588b904f53addabf69bdd9d4b2c693214bfbf43719757b827d7901174823a5849628b62dc36ae01995e6aa0d242f662b560a98244f0e3a8d769a8ab1beb34ef77e9ca7ee7a9c"]}, 0x19e) r6 = socket$nl_route(0x10, 0x3, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) prctl$PR_CAPBSET_READ(0x59616d61, 0xffffffff) ptrace(0x10, 0x1) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e23, 0x950, @mcast2, 0x6}}, 0x0, 0x6}, 0x90) sendmsg$nl_route_sched(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0x70, 0x30, 0x1, 0x70bd2b, 0x25dfdbde, {}, [{0x5c, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x25, 0xf2, 0x3, 0x7}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) 5.163575417s ago: executing program 1 (id=1589): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$selinux_access(r0, &(0x7f0000000040)={'system_u:object_r:systemd_notify_exec_t:s0', 0x20, '/usr/sbin/ntpd', 0x20, 0xd11}, 0x4f) r1 = openat$6lowpan_enable(0xffffffffffffff9c, 0x0, 0x2, 0x0) read(r1, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000780)=ANY=[@ANYBLOB="d80000001b000100000000000000000000000000000000000000000000000001fe88000000000000000000000000000100000000000000000000002000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000feff6dc9ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00080008000800010000000c00150000bc3500000000008ee66543a2b0ed54ddf8f2782573e9a44784c31d569957e4edaabbd9bf96d0530c71f413efb7646e65c311ee20f584b2dfd6d5923e60b89536aa1c6b045b8e1ebde2d3b88700"], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40c00, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000940)=ANY=[@ANYBLOB="fc0000001900010000000000000000002001000000000000000000000000000064010102000000000000000000000000000000050000000302002000000000", @ANYRES32=0x0, @ANYRESHEX=r3, @ANYBLOB="0000000000000000ac00000000000000ff0f000000000000ffffffffffffffff00159775ae000000ffff0300bfffffffffffff7f00000000000001000000000002000000000f0000000a00000000000000000000000000080000000000e9ff0001000003000000004400050000000000000000000000000000000000000004d23c0000000a000000ffcc9c1569e134695f8fd9ffffff00000000000000000000000000000000000308004900"], 0xfc}}, 0x0) execve(&(0x7f0000000740)='\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) mknodat$loop(0xffffffffffffff9c, 0x0, 0x1000, 0x0) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x200, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) read$msr(r5, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000580)={{0x0, @multicast2, 0x4e25, 0x3, 'lblcr\x00', 0x2, 0x4, 0x7b}, {@loopback, 0x4e22, 0x2, 0xc8, 0x80012d58, 0x12d5c}}, 0x44) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="10000000040000000800000008"], 0x50) ioctl$PIO_UNIMAP(r4, 0x4b67, &(0x7f0000000040)={0x3ffffffffffffe96, &(0x7f0000000000)=[{0x2000, 0x5}]}) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) syslog(0x2, &(0x7f0000000000)=""/238, 0xee) 4.474463968s ago: executing program 1 (id=1590): r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r0, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @empty}, 0x10, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71", 0x33}], 0x2, &(0x7f00000011c0)=ANY=[@ANYBLOB="1400000000000000010000002500000002010000000000004800000000000000080000000700000010000034366567f2219787566400007300000000000000000000000008000000ef3820f3439cb150a3651e799e1459c9c9a7521737a8879e3ef4dca1e3c32158996e4b2abde5342e22f2ba8b679121ac0b0ad62ade31fb2c47f0bbf781eb8bd1e3064141e90e9eac25b189c0da98b676571bbeefba392c3e15a10e03dee4ae1dfe99793e51ec0c6bb5fa6d7b357d249502f5919ef251e5d0e5bed378265b8bd55fde4689cb509b14fa754813a27e72d175e8d677420e10d651833e6e2ab8168b1d633b1bb9a7d4d59ebdc7083d93d35c", @ANYRES32=0x0, @ANYBLOB="e1212f0409000000e70bcf35ac837225dd355ad309a5ec6096633ba38e1ef5baf006020e5f45c993cb5680017c6720bea9b7c451516a8cff7f00000000000019f20b784b2336d43c8a0f7347801a596dfb0b078a967980ccec1d115c7a0000000000000000000000fed6260fdf140498f1274bc569d0d87656d0d18d903580f0ec0915e89bd286b2c25165043f6a001d53f84eaabf01cc310ff28c7c76867ce1a2c9c91b1db7295614e2a4f8711ec37ae999180cb5bbb9c5382120076e117539d423a2ec0f468db35960831f5f884c1fa9f46b3472327697495b8e8ba8e2f3defbe93e1fc733b06dfc74890a3f63b154e9681d69cdd9894c914ee45c286462888ff84e401a6d8895ffda88a171b7359f815d7b6f7562fba1bbff4cba08f7a39a8e88b66a4717b3c318f85aecbe8b5f3485f8d31bf5a57b9dd53b382ec017a33d1fabe09daf76b3b0"], 0x6b}, 0x0) close(r0) 4.351807471s ago: executing program 1 (id=1591): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00220f000000b01b4550182185f57586"], 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r2, 0xc018480b, 0x0) ioctl$HIDIOCGREPORT(r2, 0x400c4807, &(0x7f0000000000)={0x1, 0x3, 0x2}) syz_usb_control_io$hid(r1, 0x0, &(0x7f00000007c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x0}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r0}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x1, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000a50000002f000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xf99017019b42da6b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) setpgid(0x0, 0x0) socket(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x9, 0x0, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r3, &(0x7f0000000100)={0x2c, 0xa}, 0x10) wait4(0x0, 0x0, 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) eventfd(0xfffffff9) r6 = syz_io_uring_setup(0x27c8, &(0x7f0000000540)={0x0, 0x800069ea, 0x3000, 0x3, 0x8000d}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x8, 0x1, 0x0, 0x0, 0x14}) io_uring_enter(r6, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_setup(0x124e, &(0x7f0000000200)={0x0, 0x72de, 0x0, 0x0, 0x3a8}, &(0x7f0000000140), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x7, 0x4, 0x900, 0x7, 0x28, r4}, 0x50) 4.017910122s ago: executing program 4 (id=1592): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2cc600, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x400, 0xb, 0x4}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4004884) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031c00d3fc14e5fd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 3.882491021s ago: executing program 3 (id=1593): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r1 = syz_open_dev$sndpcmc(&(0x7f0000004240), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS64(r1, 0x40084146, &(0x7f0000000080)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2cc600, 0x0) syz_emit_vhci(&(0x7f0000000400)=@HCI_SCODATA_PKT={0x3, {0xc9, 0x7d}, "ffc60fa70c00535fb68f267f9fc3e6e37cee011cff02cc441770b5c2f9b77c0255e28ad1104238cdcbbec1f8e89e949e5350b848f0156132f8d93f5aeb57cba14ccb6d10a3bd1ef85bcde6a3ead21e73e9b1a8770f573411e6155ca0e9a5b16ed234eda0b52af8df8cd96a4425c8bfa8b3f419e4bd9421a7389e86fcc9"}, 0x81) ioctl$TUNGETDEVNETNS(r3, 0x54e3, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0xffff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x18}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x400, 0xb, 0x4}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4004884) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f00000000c0)={'macsec0\x00'}) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) msgget$private(0x0, 0x100) sendto$packet(r6, &(0x7f00000002c0)="05031c00d3fc14e5fd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) 3.754447533s ago: executing program 2 (id=1594): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f00000001c0)={0xf0380ff, 0x1, 0xa646, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f906, 0x4, '\x00', @value=0xcb}}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000030000000000000009000000850000002e000000850000001100000095"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 3.749878303s ago: executing program 4 (id=1595): r0 = socket$kcm(0x11, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r2, &(0x7f00000001c0)="5cba", 0x2) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x12, &(0x7f0000000000)={&(0x7f0000000240)=""/187, 0xbb, 0x0, &(0x7f0000000680)=""/211, 0xd0}}, 0x10) r3 = io_uring_setup(0xf06, &(0x7f00000003c0)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) io_uring_register$IORING_REGISTER_FILES(r3, 0x20, &(0x7f0000000000)=[r3], 0x1) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d00000000000000000000000851000000600000018", @ANYRES32, @ANYBLOB="00000000000000007608000000c0000018000000000000000000000000000000950000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000740)=@ieee802154={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x80, &(0x7f0000001ac0)=[{&(0x7f0000000200)="27031c00160014000200", 0xa}, {&(0x7f0000000480)="7d3ed2ea1f2f210c0784b2ce65c9e34b1100301a03df46a4853ed1b3f1dc15569532310f59192357c9a926b74955e3d836f3b20c", 0x34}], 0x2}, 0x400c0c8) 973.281215ms ago: executing program 4 (id=1596): r0 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r2 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r3 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r1, r4, 0x25, 0x0, @val=@netkit={@void, @value=r1}}, 0x1c) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="44000000100003052bbd70000007000000000000", @ANYRES32=0x0, @ANYBLOB="00000000001000001c00128009000100626f6e64000000000c000280050001000500000008000a", @ANYRES32=r5], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) 817.216654ms ago: executing program 2 (id=1597): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001400000014000000070000000000000000000081"], 0x0, 0x33, 0x0, 0x1}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYRESHEX], 0x48) r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x11e, 0x83, 0x0, &(0x7f0000001100)=0xffffffffffffff33) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="54000000020601020000000000000000000000000c0007800800064005e7b00010000300686173683a69702c6d616300050005000a00000005000400000000000900020073797a31000000000500010007000000f2df70dc984601e8cdf7499ae323f71b009a94f32b3fb1bed407b42598d315bee327c5c8a1a4d0b96e29c540dccbfda2fb3c8ce5b3fb00e2dfeb0f0fc59822f8aa09449927a8d7d89aa9c92847c8175bd08de0c59180955f6175975c"], 0x54}}, 0x0) setpriority(0x1, 0xffffffffffffffff, 0x3) syz_io_uring_setup(0x400738a, &(0x7f0000000680)={0x0, 0x779b, 0x4, 0x3, 0x21b}, &(0x7f0000000640), &(0x7f00000000c0), &(0x7f0000000000)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="04140601c9"], 0x9) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000400)={@in={{0x2, 0x4e20, @private=0xa010102}}, 0x0, 0x0, 0x24, 0x0, "698e86252c563a2eb894ac1de863c518984bfa5ff139aeeef086eed112e6f0ffba88c7d0888990f99dc2416c1cbccf99d18464a65c3587c97aee9217b992893cebfc606ada5e14e782e63da22a6fe97d"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000001c0)={@in={{0x2, 0x4e20, @multicast2}}, 0x0, 0x0, 0x0, 0x0, "f6458f5dce812b9bef6dfd6a024e48c070287c1a02ff37122221178c5eb9fefc9712655b257de87936d391a75e740d2875bd0814b73c57aaf87eb5a05188b46a2f53f1a865528508f3585c3857199fa4"}, 0xd8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r0, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) close_range(r0, r1, 0x2) r6 = socket$kcm(0xa, 0xf, 0x106) sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) sendmsg$kcm(r6, &(0x7f0000000480)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r5, 0x1c}, 0x80, 0x0}, 0x24000891) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc01100, 0x0, 0x0, 0x0, 0x2) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x810) sendmsg$RDMA_NLDEV_CMD_DELLINK(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a0878"], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) 0s ago: executing program 0 (id=1598): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14fff9900000008000300", @ANYRES32=r2, @ANYBLOB="d50633008000009effff"], 0x6f4}}, 0x0) kernel console output (not intermixed with test programs): 5][ T5710] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 312.891833][ T5710] usb 4-1: Product: syz [ 312.896607][ T5710] usb 4-1: Manufacturer: syz [ 312.901234][ T5710] usb 4-1: SerialNumber: syz [ 313.152246][T10470] FAULT_INJECTION: forcing a failure. [ 313.152246][T10470] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 313.165904][T10470] CPU: 0 UID: 0 PID: 10470 Comm: syz.4.1325 Not tainted syzkaller #0 PREEMPT(full) [ 313.165965][T10470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 313.165975][T10470] Call Trace: [ 313.165983][T10470] [ 313.165990][T10470] dump_stack_lvl+0x100/0x190 [ 313.166014][T10470] should_fail_ex.cold+0x5/0xa [ 313.166035][T10470] _copy_from_user+0x2e/0xd0 [ 313.166058][T10470] copy_msghdr_from_user+0x9f/0x4c0 [ 313.166083][T10470] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 313.166115][T10470] ___sys_sendmsg+0x106/0x1e0 [ 313.166138][T10470] ? __pfx____sys_sendmsg+0x10/0x10 [ 313.166159][T10470] ? __lock_acquire+0x49f/0x1a40 [ 313.166177][T10470] ? get_pid_task+0x106/0x250 [ 313.166224][T10470] __sys_sendmsg+0x160/0x210 [ 313.166242][T10470] ? __pfx___sys_sendmsg+0x10/0x10 [ 313.166272][T10470] do_syscall_64+0x115/0x870 [ 313.166287][T10470] ? clear_bhb_loop+0x40/0x90 [ 313.166305][T10470] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.166320][T10470] RIP: 0033:0x7fe446b9de99 [ 313.166333][T10470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 313.166348][T10470] RSP: 002b:00007fe447add028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 313.166363][T10470] RAX: ffffffffffffffda RBX: 00007fe446e25fa0 RCX: 00007fe446b9de99 [ 313.166372][T10470] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 313.166381][T10470] RBP: 00007fe447add090 R08: 0000000000000000 R09: 0000000000000000 [ 313.166390][T10470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 313.166398][T10470] R13: 00007fe446e26038 R14: 00007fe446e25fa0 R15: 00007fff96c395e8 [ 313.166419][T10470] [ 313.406683][T10472] FAULT_INJECTION: forcing a failure. [ 313.406683][T10472] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 313.426483][T10472] CPU: 1 UID: 0 PID: 10472 Comm: syz.4.1326 Not tainted syzkaller #0 PREEMPT(full) [ 313.426510][T10472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 313.426521][T10472] Call Trace: [ 313.426527][T10472] [ 313.426533][T10472] dump_stack_lvl+0x100/0x190 [ 313.426560][T10472] should_fail_ex.cold+0x5/0xa [ 313.426583][T10472] _copy_from_user+0x2e/0xd0 [ 313.426617][T10472] __sys_bpf+0x2f5/0x4e80 [ 313.426642][T10472] ? __pfx___sys_bpf+0x10/0x10 [ 313.426658][T10472] ? find_held_lock+0x2b/0x80 [ 313.426683][T10472] ? get_pid_task+0xfc/0x250 [ 313.426706][T10472] ? get_pid_task+0xfc/0x250 [ 313.426737][T10472] ? find_held_lock+0x2b/0x80 [ 313.426766][T10472] ? rcu_read_lock_any_held+0x6a/0xa0 [ 313.426780][T10472] ? find_held_lock+0x2b/0x80 [ 313.426795][T10472] ? ksys_write+0x190/0x250 [ 313.426814][T10472] ? ksys_write+0x190/0x250 [ 313.426854][T10472] ? fput+0x79/0x100 [ 313.426876][T10472] ? __x64_sys_bpf+0xce/0x140 [ 313.426891][T10472] __x64_sys_bpf+0xce/0x140 [ 313.426902][T10472] ? do_syscall_64+0x90/0x870 [ 313.426915][T10472] do_syscall_64+0x115/0x870 [ 313.426925][T10472] ? clear_bhb_loop+0x40/0x90 [ 313.426938][T10472] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.426949][T10472] RIP: 0033:0x7fe446b9de99 [ 313.426962][T10472] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 313.426978][T10472] RSP: 002b:00007fe447add028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 313.426996][T10472] RAX: ffffffffffffffda RBX: 00007fe446e25fa0 RCX: 00007fe446b9de99 [ 313.427006][T10472] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 313.427015][T10472] RBP: 00007fe447add090 R08: 0000000000000000 R09: 0000000000000000 [ 313.427025][T10472] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 313.427034][T10472] R13: 00007fe446e26038 R14: 00007fe446e25fa0 R15: 00007fff96c395e8 [ 313.427049][T10472] [ 313.656953][ T5710] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 313.669111][ T5710] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 313.953912][ T3210] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 314.125795][ T3210] usb 5-1: Using ep0 maxpacket: 32 [ 314.132483][ T3210] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 314.144784][ T3210] usb 5-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 314.161533][ T3210] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.170031][ T3210] usb 5-1: Product: syz [ 314.174305][ T3210] usb 5-1: Manufacturer: syz [ 314.179065][ T3210] usb 5-1: SerialNumber: syz [ 314.187260][ T3210] usb 5-1: config 0 descriptor?? [ 314.198525][ T3210] usb 5-1: expecting 3 got 0 endpoints! Bailing out. [ 314.442095][ T3210] usb 5-1: USB disconnect, device number 31 [ 314.568207][T10456] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1311'. [ 314.590632][ T5717] usb 3-1: USB disconnect, device number 26 [ 314.610408][T10477] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6gretap0, syncid = 4, id = 0 [ 314.627009][T10458] IPVS: stopping backup sync thread 10477 ... [ 314.671909][ T5710] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 314.705770][ T5710] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 314.726670][ T5710] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 314.773445][ T5710] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 314.797761][ T29] audit: type=1400 audit(1785061380.233:526): avc: denied { write } for pid=10486 comm="syz.2.1332" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 314.810205][ T5710] usb 4-1: USB disconnect, device number 33 [ 314.904346][T10492] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1331'. [ 315.100922][T10496] syzkaller0: entered promiscuous mode [ 315.106614][T10496] syzkaller0: entered allmulticast mode [ 315.132364][T10498] trusted_key: syz.2.1335 sent an empty control message without MSG_MORE. [ 315.143229][T10498] FAULT_INJECTION: forcing a failure. [ 315.143229][T10498] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 315.157504][T10498] CPU: 0 UID: 0 PID: 10498 Comm: syz.2.1335 Not tainted syzkaller #0 PREEMPT(full) [ 315.157526][T10498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 315.157537][T10498] Call Trace: [ 315.157542][T10498] [ 315.157549][T10498] dump_stack_lvl+0x100/0x190 [ 315.157574][T10498] should_fail_ex.cold+0x5/0xa [ 315.157596][T10498] _copy_from_user+0x2e/0xd0 [ 315.157620][T10498] copy_msghdr_from_user+0x9f/0x4c0 [ 315.157648][T10498] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 315.157674][T10498] ? find_held_lock+0x2b/0x80 [ 315.157705][T10498] ? __lock_acquire+0x49f/0x1a40 [ 315.157725][T10498] ? get_pid_task+0x106/0x250 [ 315.157752][T10498] ___sys_recvmsg+0xdd/0x1a0 [ 315.157779][T10498] ? __pfx____sys_recvmsg+0x10/0x10 [ 315.157809][T10498] ? find_held_lock+0x2b/0x80 [ 315.157850][T10498] __x64_sys_recvmsg+0x19a/0x260 [ 315.157872][T10498] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 315.157906][T10498] do_syscall_64+0x115/0x870 [ 315.157924][T10498] ? clear_bhb_loop+0x40/0x90 [ 315.157946][T10498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 315.157963][T10498] RIP: 0033:0x7f6cce19de99 [ 315.157979][T10498] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 315.157995][T10498] RSP: 002b:00007f6cceff8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 315.158012][T10498] RAX: ffffffffffffffda RBX: 00007f6cce425fa0 RCX: 00007f6cce19de99 [ 315.158023][T10498] RDX: 0000000000001021 RSI: 0000200000000840 RDI: 0000000000000004 [ 315.158037][T10498] RBP: 00007f6cceff8090 R08: 0000000000000000 R09: 0000000000000000 [ 315.158047][T10498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 315.158057][T10498] R13: 00007f6cce426038 R14: 00007f6cce425fa0 R15: 00007ffed7a03108 [ 315.158086][T10498] [ 315.225109][ T5717] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 315.239494][ T5710] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 315.391755][ T5710] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 315.405273][ T5710] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.438916][ T5710] usb 1-1: Product: syz [ 315.448879][ T5710] usb 1-1: Manufacturer: syz [ 315.454179][ T5710] usb 1-1: SerialNumber: syz [ 315.541984][T10500] netlink: 'syz.2.1336': attribute type 1 has an invalid length. [ 315.557240][ T5717] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 315.577790][T10500] 8021q: adding VLAN 0 to HW filter on device bond5 [ 315.583702][ T5717] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 315.595896][T10500] bond5: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 315.607138][ T5717] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 315.616700][ T5717] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.625104][T10500] bond5: entered allmulticast mode [ 315.632766][ T5717] usb 2-1: config 0 descriptor?? [ 315.652492][T10500] bond5: (slave ip6gretap1): Enslaving as an active interface with an up link [ 315.719196][ T29] audit: type=1400 audit(1785061381.152:527): avc: denied { lock } for pid=10517 comm="syz.3.1341" path="socket:[26355]" dev="sockfs" ino=26355 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 315.877360][ T5710] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 315.918154][ T5710] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 316.083283][T10535] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10535 comm=syz.4.1344 [ 316.326509][ T5717] usbhid 2-1:0.0: can't add hid device: -71 [ 316.339594][ T5717] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 316.372515][T10485] IPVS: stopping backup sync thread 8426 ... [ 316.375189][ T5717] usb 2-1: USB disconnect, device number 34 [ 316.396039][ T5710] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 316.413287][ T29] audit: type=1400 audit(1785061381.842:528): avc: denied { ioctl } for pid=10523 comm="syz.2.1342" path="socket:[27428]" dev="sockfs" ino=27428 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 316.419749][ T5710] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 316.520652][ T5710] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 316.558851][ T5710] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 316.617250][ T5710] usb 1-1: USB disconnect, device number 38 [ 316.623493][T10548] netlink: 'syz.3.1347': attribute type 5 has an invalid length. [ 316.637105][T10549] FAULT_INJECTION: forcing a failure. [ 316.637105][T10549] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 316.664577][T10549] CPU: 1 UID: 0 PID: 10549 Comm: syz.4.1349 Not tainted syzkaller #0 PREEMPT(full) [ 316.664604][T10549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 316.664614][T10549] Call Trace: [ 316.664620][T10549] [ 316.664627][T10549] dump_stack_lvl+0x100/0x190 [ 316.664654][T10549] should_fail_ex.cold+0x5/0xa [ 316.664676][T10549] _copy_from_user+0x2e/0xd0 [ 316.664701][T10549] __sys_bpf+0x2f5/0x4e80 [ 316.664726][T10549] ? __pfx___sys_bpf+0x10/0x10 [ 316.664741][T10549] ? find_held_lock+0x2b/0x80 [ 316.664766][T10549] ? get_pid_task+0xfc/0x250 [ 316.664790][T10549] ? get_pid_task+0xfc/0x250 [ 316.664819][T10549] ? find_held_lock+0x2b/0x80 [ 316.664846][T10549] ? rcu_read_lock_any_held+0x6a/0xa0 [ 316.664862][T10549] ? find_held_lock+0x2b/0x80 [ 316.664887][T10549] ? ksys_write+0x190/0x250 [ 316.664910][T10549] ? ksys_write+0x190/0x250 [ 316.664949][T10549] ? fput+0x79/0x100 [ 316.664972][T10549] ? __x64_sys_bpf+0xce/0x140 [ 316.664988][T10549] __x64_sys_bpf+0xce/0x140 [ 316.665006][T10549] ? do_syscall_64+0x90/0x870 [ 316.665025][T10549] do_syscall_64+0x115/0x870 [ 316.665042][T10549] ? clear_bhb_loop+0x40/0x90 [ 316.665063][T10549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.665080][T10549] RIP: 0033:0x7fe446b9de99 [ 316.665095][T10549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 316.665111][T10549] RSP: 002b:00007fe447add028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 316.665128][T10549] RAX: ffffffffffffffda RBX: 00007fe446e25fa0 RCX: 00007fe446b9de99 [ 316.665139][T10549] RDX: 0000000000000050 RSI: 0000200000000380 RDI: 000000000000000a [ 316.665150][T10549] RBP: 00007fe447add090 R08: 0000000000000000 R09: 0000000000000000 [ 316.665159][T10549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 316.665169][T10549] R13: 00007fe446e26038 R14: 00007fe446e25fa0 R15: 00007fff96c395e8 [ 316.665193][T10549] [ 317.111932][T10552] xt_hashlimit: size too large, truncated to 1048576 [ 317.388770][T10562] warning: `syz.2.1352' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 317.474047][T10570] overlayfs: failed to resolve './file2': -2 [ 317.504088][ T29] audit: type=1400 audit(1785061382.931:529): avc: denied { write } for pid=10568 comm="syz.4.1356" name="ppp" dev="devtmpfs" ino=710 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 317.882042][T10575] netlink: 'syz.3.1355': attribute type 4 has an invalid length. [ 318.644950][T10570] netlink: 'syz.4.1356': attribute type 49 has an invalid length. [ 318.670653][T10570] bond0: (slave bond_slave_0): Releasing backup interface [ 318.762780][T10570] bond_slave_0: entered promiscuous mode [ 318.771227][T10570] bond_slave_0: entered allmulticast mode [ 318.806385][ T5717] usb 2-1: new low-speed USB device number 35 using dummy_hcd [ 318.840365][ T29] audit: type=1400 audit(1785061384.261:530): avc: denied { search } for pid=5271 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 318.864168][ T29] audit: type=1400 audit(1785061384.271:531): avc: denied { search } for pid=5271 comm="dhcpcd" name="udev" dev="tmpfs" ino=9 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 318.888636][ T29] audit: type=1400 audit(1785061384.271:532): avc: denied { search } for pid=5271 comm="dhcpcd" name="data" dev="tmpfs" ino=13 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 318.918186][ T29] audit: type=1400 audit(1785061384.271:533): avc: denied { read } for pid=5271 comm="dhcpcd" name="n508" dev="tmpfs" ino=6476 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 318.941849][ T29] audit: type=1400 audit(1785061384.271:534): avc: denied { open } for pid=5271 comm="dhcpcd" path="/run/udev/data/n508" dev="tmpfs" ino=6476 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 318.966384][ T3210] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 318.978037][ T29] audit: type=1400 audit(1785061384.271:535): avc: denied { getattr } for pid=5271 comm="dhcpcd" path="/run/udev/data/n508" dev="tmpfs" ino=6476 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 319.004347][ T5717] usb 2-1: config index 0 descriptor too short (expected 561, got 49) [ 319.013112][ T5717] usb 2-1: config 0 has an invalid interface number: 0 but max is -1 [ 319.021677][ T5717] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 319.033346][ T5717] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 319.043052][ T5717] usb 2-1: New USB device found, idVendor=0421, idProduct=0335, bcdDevice=5f.0e [ 319.054298][ T5717] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 319.081689][ T5717] usb 2-1: config 0 descriptor?? [ 319.121413][ T5717] rndis_host 2-1:0.0: rndis: master #0/ffff88807968f000 slave #1/0000000000000000 [ 319.130990][ T3210] usb 5-1: Using ep0 maxpacket: 8 [ 319.138477][ T3210] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 48, changing to 7 [ 319.160922][ T3210] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 319.198223][ T3210] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.210202][ T3210] usb 5-1: Product: syz [ 319.214549][ T3210] usb 5-1: Manufacturer: syz [ 319.220087][ T3210] usb 5-1: SerialNumber: syz [ 319.371520][ T5717] usb 2-1: USB disconnect, device number 35 [ 319.405908][ T29] audit: type=1400 audit(1785061384.831:536): avc: denied { read } for pid=10592 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 319.525733][ T3210] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 319.568363][ T3210] usb 5-1: found format II with max.bitrate = 1025, frame size=32767 [ 319.595757][ T3210] usb 5-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 319.664341][T10600] FAULT_INJECTION: forcing a failure. [ 319.664341][T10600] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 319.715268][T10600] CPU: 1 UID: 0 PID: 10600 Comm: syz.3.1362 Not tainted syzkaller #0 PREEMPT(full) [ 319.715293][T10600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 319.715304][T10600] Call Trace: [ 319.715310][T10600] [ 319.715317][T10600] dump_stack_lvl+0x100/0x190 [ 319.715340][T10600] should_fail_ex.cold+0x5/0xa [ 319.715355][T10600] _copy_from_user+0x2e/0xd0 [ 319.715372][T10600] copy_msghdr_from_user+0x9f/0x4c0 [ 319.715390][T10600] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 319.715413][T10600] ___sys_sendmsg+0x106/0x1e0 [ 319.715430][T10600] ? __pfx____sys_sendmsg+0x10/0x10 [ 319.715446][T10600] ? __lock_acquire+0x49f/0x1a40 [ 319.715458][T10600] ? get_pid_task+0x106/0x250 [ 319.715490][T10600] __sys_sendmsg+0x160/0x210 [ 319.715503][T10600] ? __pfx___sys_sendmsg+0x10/0x10 [ 319.715523][T10600] do_syscall_64+0x115/0x870 [ 319.715534][T10600] ? clear_bhb_loop+0x40/0x90 [ 319.715547][T10600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.715561][T10600] RIP: 0033:0x7fdd1a79de99 [ 319.715571][T10600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 319.715581][T10600] RSP: 002b:00007fdd1b611028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.715592][T10600] RAX: ffffffffffffffda RBX: 00007fdd1aa25fa0 RCX: 00007fdd1a79de99 [ 319.715599][T10600] RDX: 0000000004008840 RSI: 00002000000003c0 RDI: 0000000000000003 [ 319.715606][T10600] RBP: 00007fdd1b611090 R08: 0000000000000000 R09: 0000000000000000 [ 319.715611][T10600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 319.715618][T10600] R13: 00007fdd1aa26038 R14: 00007fdd1aa25fa0 R15: 00007ffdbc345b68 [ 319.715631][T10600] [ 319.925558][ T3210] usb 5-1: USB disconnect, device number 32 [ 320.007574][ T6325] udevd[6325]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 320.023883][ T5833] usb 1-1: new low-speed USB device number 39 using dummy_hcd [ 320.071127][T10608] netlink: 'syz.3.1363': attribute type 2 has an invalid length. [ 320.080545][T10608] netlink: 'syz.3.1363': attribute type 2 has an invalid length. [ 320.090915][T10608] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1363'. [ 320.126550][T10608] netlink: 15 bytes leftover after parsing attributes in process `syz.3.1363'. [ 320.151563][T10608] netlink: 'syz.3.1363': attribute type 6 has an invalid length. [ 320.185706][ T5833] usb 1-1: Invalid ep0 maxpacket: 64 [ 320.327848][ T5833] usb 1-1: new low-speed USB device number 40 using dummy_hcd [ 320.497792][ T5833] usb 1-1: Invalid ep0 maxpacket: 64 [ 320.519635][ T5833] usb usb1-port1: attempt power cycle [ 320.586655][ T5725] usb 4-1: new full-speed USB device number 34 using dummy_hcd [ 320.727601][ T29] kauditd_printk_skb: 13 callbacks suppressed [ 320.727616][ T29] audit: type=1400 audit(1785061386.150:550): avc: denied { open } for pid=10639 comm="syz.1.1369" path="/dev/usbmon0" dev="devtmpfs" ino=717 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 320.760338][T10638] syzkaller0: entered promiscuous mode [ 320.766206][T10638] syzkaller0: entered allmulticast mode [ 320.766295][T10640] FAULT_INJECTION: forcing a failure. [ 320.766295][T10640] name failslab, interval 1, probability 0, space 0, times 0 [ 320.775468][T10638] 0: reclassify loop, rule prio 0, protocol 800 [ 320.795631][ T29] audit: type=1400 audit(1785061386.180:551): avc: denied { write } for pid=10641 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 320.801076][ T5725] usb 4-1: config 0 has no interfaces? [ 320.828534][ T29] audit: type=1400 audit(1785061386.190:552): avc: denied { map } for pid=10639 comm="syz.1.1369" path="/dev/usbmon0" dev="devtmpfs" ino=717 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 320.837644][ T5725] usb 4-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 320.853381][T10640] CPU: 1 UID: 0 PID: 10640 Comm: syz.1.1369 Not tainted syzkaller #0 PREEMPT(full) [ 320.853402][T10640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 320.853410][T10640] Call Trace: [ 320.853416][T10640] [ 320.853422][T10640] dump_stack_lvl+0x100/0x190 [ 320.853446][T10640] should_fail_ex.cold+0x5/0xa [ 320.853467][T10640] should_failslab+0xc2/0x120 [ 320.853487][T10640] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 320.853504][T10640] ? copy_process+0x611/0x8030 [ 320.853533][T10640] ? copy_process+0x69a/0x8030 [ 320.853556][T10640] copy_process+0x69a/0x8030 [ 320.853579][T10640] ? __lock_acquire+0x49f/0x1a40 [ 320.853605][T10640] ? __pfx_copy_process+0x10/0x10 [ 320.853626][T10640] ? find_held_lock+0x2b/0x80 [ 320.853660][T10640] kernel_clone+0x176/0x9d0 [ 320.853678][T10640] ? find_held_lock+0x2b/0x80 [ 320.853701][T10640] ? __pfx_kernel_clone+0x10/0x10 [ 320.853726][T10640] ? ksys_write+0x190/0x250 [ 320.853760][T10640] __do_sys_clone+0xd9/0x120 [ 320.853780][T10640] ? __pfx___do_sys_clone+0x10/0x10 [ 320.853799][T10640] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 320.853824][T10640] ? ksys_write+0x1ac/0x250 [ 320.853845][T10640] ? __pfx_ksys_write+0x10/0x10 [ 320.853873][T10640] do_syscall_64+0x115/0x870 [ 320.853889][T10640] ? clear_bhb_loop+0x40/0x90 [ 320.853908][T10640] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.853923][T10640] RIP: 0033:0x7fb41f79de99 [ 320.853936][T10640] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 320.853950][T10640] RSP: 002b:00007fb420745fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 320.853966][T10640] RAX: ffffffffffffffda RBX: 00007fb41fa25fa0 RCX: 00007fb41f79de99 [ 320.853976][T10640] RDX: 0000000000000000 RSI: 0000000000000030 RDI: 0000000000000000 [ 320.853985][T10640] RBP: 00007fb420746090 R08: 0000000000000000 R09: 0000000000000000 [ 320.853994][T10640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 320.854003][T10640] R13: 00007fb41fa26038 R14: 00007fb41fa25fa0 R15: 00007ffe1a823168 [ 320.854024][T10640] [ 320.999173][ T29] audit: type=1400 audit(1785061386.430:553): avc: denied { module_request } for pid=10643 comm="syz.1.1370" kmod="netdev-syzkaller0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 321.000559][ T5833] usb 1-1: new low-speed USB device number 41 using dummy_hcd [ 321.103474][ T5725] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.113776][ T5725] usb 4-1: config 0 descriptor?? [ 321.127122][ T5833] usb 1-1: Invalid ep0 maxpacket: 64 [ 321.157094][ T5710] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 321.261500][ T5833] usb 1-1: new low-speed USB device number 42 using dummy_hcd [ 321.285531][T10656] netlink: 27 bytes leftover after parsing attributes in process `syz.4.1371'. [ 321.309735][ T5833] usb 1-1: Invalid ep0 maxpacket: 64 [ 321.318413][ T5710] usb 3-1: config 0 has no interfaces? [ 321.324489][T10619] FAULT_INJECTION: forcing a failure. [ 321.324489][T10619] name failslab, interval 1, probability 0, space 0, times 0 [ 321.339509][ T5833] usb usb1-port1: unable to enumerate USB device [ 321.345936][ T5710] usb 3-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 321.346828][T10619] CPU: 1 UID: 0 PID: 10619 Comm: syz.3.1365 Not tainted syzkaller #0 PREEMPT(full) [ 321.346848][T10619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 321.346857][T10619] Call Trace: [ 321.346862][T10619] [ 321.346868][T10619] dump_stack_lvl+0x100/0x190 [ 321.346894][T10619] should_fail_ex.cold+0x5/0xa [ 321.346915][T10619] should_failslab+0xc2/0x120 [ 321.346935][T10619] __kmalloc_noprof+0xfc/0x820 [ 321.346953][T10619] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 321.346977][T10619] kernfs_fop_write_iter+0x26a/0x5f0 [ 321.347000][T10619] vfs_write+0x6ac/0x1050 [ 321.347024][T10619] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 321.347045][T10619] ? __pfx_vfs_write+0x10/0x10 [ 321.347082][T10619] ksys_write+0x12a/0x250 [ 321.347103][T10619] ? __pfx_ksys_write+0x10/0x10 [ 321.347132][T10619] do_syscall_64+0x115/0x870 [ 321.347148][T10619] ? clear_bhb_loop+0x40/0x90 [ 321.347166][T10619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.347181][T10619] RIP: 0033:0x7fdd1a79de99 [ 321.347194][T10619] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 321.347209][T10619] RSP: 002b:00007fdd1b5f0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 321.347225][T10619] RAX: ffffffffffffffda RBX: 00007fdd1aa26090 RCX: 00007fdd1a79de99 [ 321.347235][T10619] RDX: 0000000000000002 RSI: 00002000000000c0 RDI: 0000000000000008 [ 321.347244][T10619] RBP: 00007fdd1b5f0090 R08: 0000000000000000 R09: 0000000000000000 [ 321.347253][T10619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 321.347262][T10619] R13: 00007fdd1aa26128 R14: 00007fdd1aa26090 R15: 00007ffdbc345b68 [ 321.347283][T10619] [ 321.433907][T10663] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1373'. [ 321.444116][ T5710] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.556498][ T29] audit: type=1400 audit(1785061386.980:554): avc: denied { write } for pid=10651 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 321.608293][ T5726] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 321.623250][ T5710] usb 3-1: config 0 descriptor?? [ 321.660203][ T29] audit: type=1400 audit(1785061387.090:555): avc: denied { write } for pid=10671 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 321.694570][T10673] FAULT_INJECTION: forcing a failure. [ 321.694570][T10673] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 321.708639][T10673] CPU: 1 UID: 0 PID: 10673 Comm: syz.4.1374 Not tainted syzkaller #0 PREEMPT(full) [ 321.708663][T10673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 321.708674][T10673] Call Trace: [ 321.708680][T10673] [ 321.708687][T10673] dump_stack_lvl+0x100/0x190 [ 321.708713][T10673] should_fail_ex.cold+0x5/0xa [ 321.708736][T10673] _copy_from_user+0x2e/0xd0 [ 321.708759][T10673] do_ipv6_setsockopt+0x73d/0x44a0 [ 321.708784][T10673] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 321.708811][T10673] ? lock_acquire+0x1b9/0x370 [ 321.708836][T10673] ? rcu_is_watching+0x12/0xc0 [ 321.708861][T10673] ? trace_contention_end+0x126/0x160 [ 321.708885][T10673] ? __mutex_lock+0x26d/0x1bd0 [ 321.708905][T10673] ? smc_setsockopt+0x100/0xa40 [ 321.708933][T10673] ? avc_has_perm+0x135/0x1e0 [ 321.708955][T10673] ? __pfx___mutex_lock+0x10/0x10 [ 321.708975][T10673] ? get_pid_task+0x106/0x250 [ 321.709006][T10673] ? ipv6_setsockopt+0xcb/0x170 [ 321.709025][T10673] ipv6_setsockopt+0xcb/0x170 [ 321.709047][T10673] tcp_setsockopt+0xa7/0x100 [ 321.709075][T10673] smc_setsockopt+0x1b6/0xa40 [ 321.709100][T10673] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 321.709129][T10673] ? __pfx_smc_setsockopt+0x10/0x10 [ 321.709153][T10673] ? __fget_files+0x215/0x3d0 [ 321.709174][T10673] ? selinux_socket_setsockopt+0x6a/0x80 [ 321.709200][T10673] ? __pfx_smc_setsockopt+0x10/0x10 [ 321.709227][T10673] do_sock_setsockopt+0xf3/0x1d0 [ 321.709256][T10673] __sys_setsockopt+0x195/0x220 [ 321.709280][T10673] __x64_sys_setsockopt+0xbd/0x160 [ 321.709300][T10673] ? do_syscall_64+0x90/0x870 [ 321.709319][T10673] ? lockdep_hardirqs_on+0x78/0x100 [ 321.709337][T10673] do_syscall_64+0x115/0x870 [ 321.709354][T10673] ? clear_bhb_loop+0x40/0x90 [ 321.709376][T10673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.709392][T10673] RIP: 0033:0x7fe446b9de99 [ 321.709405][T10673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 321.709420][T10673] RSP: 002b:00007fe447add028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 321.709437][T10673] RAX: ffffffffffffffda RBX: 00007fe446e25fa0 RCX: 00007fe446b9de99 [ 321.709447][T10673] RDX: 0000000000000003 RSI: 0000000000000029 RDI: 0000000000000003 [ 321.709456][T10673] RBP: 00007fe447add090 R08: 0000000000000004 R09: 0000000000000000 [ 321.709470][T10673] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 321.709479][T10673] R13: 00007fe446e26038 R14: 00007fe446e25fa0 R15: 00007fff96c395e8 [ 321.709500][T10673] [ 321.966062][ T5726] usb 2-1: Using ep0 maxpacket: 8 [ 321.972639][ T5726] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 321.980121][ T5726] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 322.001198][ T5726] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 322.056418][ T5726] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 322.068874][ T5726] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 322.082551][ T5726] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 322.094183][ T5726] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 322.111465][ T5726] usb 2-1: config 168 interface 0 has no altsetting 0 [ 322.120229][ T5726] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 322.127953][ T5726] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 322.139747][ T5726] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 322.152399][ T5726] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 322.164827][ T5726] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 322.176516][ T5726] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 322.189050][ T5726] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 322.202927][ T29] audit: type=1400 audit(1785061387.620:556): avc: denied { write } for pid=10675 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 322.203028][ T5726] usb 2-1: config 168 interface 0 has no altsetting 0 [ 322.234819][ T5726] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 322.247106][ T5726] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 322.258517][ T5726] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 322.270108][ T5726] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 322.282144][ T5726] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 322.287690][ T3210] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 322.295635][ T5726] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 322.313655][ T5726] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 322.317808][ T29] audit: type=1400 audit(1785061387.750:557): avc: denied { write } for pid=10688 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 322.338197][ T5726] usb 2-1: config 168 interface 0 has no altsetting 0 [ 322.363091][ T5726] usb 2-1: string descriptor 0 read error: -22 [ 322.369734][ T5726] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 322.379953][ T5726] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.397503][ T5726] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 322.448228][ T3210] usb 5-1: Using ep0 maxpacket: 8 [ 322.454790][ T3210] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 322.469030][ T3210] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 322.479465][ T3210] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 322.489189][ T3210] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 173 [ 322.499273][ T3210] usb 5-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 322.508353][ T3210] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 322.522662][ T3210] usb 5-1: config 0 descriptor?? [ 322.534254][T10680] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 322.724596][ T3210] usb 2-1: USB disconnect, device number 36 [ 322.734628][ T29] audit: type=1400 audit(1785061388.159:558): avc: denied { write } for pid=10690 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 323.015018][ T3210] usb 5-1: USB disconnect, device number 33 [ 323.015085][ T5626] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 323.151917][ T29] audit: type=1400 audit(1785061388.579:559): avc: denied { create } for pid=10706 comm="syz.1.1378" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 323.177471][ T5726] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 323.355843][ T5726] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 323.410444][ T5726] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.449792][ T5710] usb 4-1: USB disconnect, device number 34 [ 323.467224][ T5726] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 323.514181][ T5726] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.543553][ T5726] usb 1-1: config 0 descriptor?? [ 323.621560][T10723] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1382'. [ 323.744127][ T3210] usb 3-1: USB disconnect, device number 27 [ 323.777693][ T24] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 324.147766][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 324.357824][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 324.447876][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 324.577955][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 324.586895][ T24] usb 2-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 324.596238][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239 [ 324.604985][ T24] usb 2-1: Product: syz [ 324.615695][ T24] usb 2-1: Manufacturer: syz [ 324.622040][ T24] usb 2-1: SerialNumber: syz [ 324.659013][ T24] usb 2-1: config 0 descriptor?? [ 324.773483][ T24] gspca_main: sq905-2.14.0 probing 2770:9120 [ 325.240743][ T5726] usb 1-1: string descriptor 0 read error: -71 [ 325.263878][ T5726] uclogic 0003:256C:006D.001A: failed retrieving string descriptor #200: -71 [ 325.273990][T10726] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1383'. [ 325.297752][ T5726] uclogic 0003:256C:006D.001A: failed retrieving pen parameters: -71 [ 325.315111][ T5726] uclogic 0003:256C:006D.001A: failed probing pen v2 parameters: -71 [ 325.360752][ T5726] uclogic 0003:256C:006D.001A: failed probing parameters: -71 [ 325.369119][ T5726] uclogic 0003:256C:006D.001A: probe with driver uclogic failed with error -71 [ 325.376572][ T24] gspca_sq905: sq905_command: usb_control_msg failed (-71) [ 325.425064][ T24] sq905 2-1:0.0: probe with driver sq905 failed with error -71 [ 325.437631][ T5726] usb 1-1: USB disconnect, device number 43 [ 325.451248][ T24] usb 2-1: USB disconnect, device number 37 [ 325.598368][ T5725] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 325.701421][T10765] FAULT_INJECTION: forcing a failure. [ 325.701421][T10765] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 325.715245][T10765] CPU: 0 UID: 0 PID: 10765 Comm: syz.1.1387 Not tainted syzkaller #0 PREEMPT(full) [ 325.715268][T10765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 325.715279][T10765] Call Trace: [ 325.715285][T10765] [ 325.715292][T10765] dump_stack_lvl+0x100/0x190 [ 325.715319][T10765] should_fail_ex.cold+0x5/0xa [ 325.715341][T10765] _copy_from_user+0x2e/0xd0 [ 325.715366][T10765] __sys_bpf+0x2f5/0x4e80 [ 325.715391][T10765] ? __pfx___sys_bpf+0x10/0x10 [ 325.715414][T10765] ? find_held_lock+0x2b/0x80 [ 325.715439][T10765] ? get_pid_task+0xfc/0x250 [ 325.715463][T10765] ? get_pid_task+0xfc/0x250 [ 325.715494][T10765] ? find_held_lock+0x2b/0x80 [ 325.715523][T10765] ? rcu_read_lock_any_held+0x6a/0xa0 [ 325.715538][T10765] ? find_held_lock+0x2b/0x80 [ 325.715562][T10765] ? ksys_write+0x190/0x250 [ 325.715585][T10765] ? ksys_write+0x190/0x250 [ 325.715627][T10765] ? fput+0x79/0x100 [ 325.715649][T10765] ? __x64_sys_bpf+0xce/0x140 [ 325.715665][T10765] __x64_sys_bpf+0xce/0x140 [ 325.715682][T10765] ? do_syscall_64+0x90/0x870 [ 325.715702][T10765] do_syscall_64+0x115/0x870 [ 325.715719][T10765] ? clear_bhb_loop+0x40/0x90 [ 325.715738][T10765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.715754][T10765] RIP: 0033:0x7fb41f79de99 [ 325.715769][T10765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 325.715784][T10765] RSP: 002b:00007fb420746028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 325.715800][T10765] RAX: ffffffffffffffda RBX: 00007fb41fa25fa0 RCX: 00007fb41f79de99 [ 325.715809][T10765] RDX: 000000000000000c RSI: 00002000000003c0 RDI: 000000000000000a [ 325.715818][T10765] RBP: 00007fb420746090 R08: 0000000000000000 R09: 0000000000000000 [ 325.715827][T10765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 325.715837][T10765] R13: 00007fb41fa26038 R14: 00007fb41fa25fa0 R15: 00007ffe1a823168 [ 325.715860][T10765] [ 325.822777][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 325.822791][ T29] audit: type=1400 audit(1785061391.248:566): avc: denied { write } for pid=10771 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 325.968696][ T5725] usb 4-1: Using ep0 maxpacket: 16 [ 325.981411][ T5725] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 325.989852][ T5725] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 326.010072][ T5725] usb 4-1: config 0 has no interface number 0 [ 326.028207][ T5725] usb 4-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 326.042296][ T5725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.055863][ T5725] usb 4-1: Product: syz [ 326.075762][ T5725] usb 4-1: Manufacturer: syz [ 326.086944][ T5725] usb 4-1: SerialNumber: syz [ 326.103091][ T5725] usb 4-1: config 0 descriptor?? [ 326.117497][ T5725] uvcvideo 4-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 326.126851][ T5725] uvcvideo 4-1:0.105: No valid video chain found. [ 326.256660][T10786] syzkaller0: entered promiscuous mode [ 326.270292][T10786] syzkaller0: entered allmulticast mode [ 326.317629][ T5725] usb 4-1: USB disconnect, device number 35 [ 326.494037][ T29] audit: type=1400 audit(1785061391.918:567): avc: denied { write } for pid=10776 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 326.617640][T10797] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 326.625951][T10797] overlayfs: failed to set xattr on upper [ 326.631753][T10797] overlayfs: ...falling back to redirect_dir=nofollow. [ 326.638677][T10797] overlayfs: ...falling back to index=off. [ 326.644505][T10797] overlayfs: ...falling back to uuid=null. [ 326.685630][T10798] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 326.692788][T10798] overlayfs: failed to set xattr on upper [ 326.698550][T10798] overlayfs: ...falling back to redirect_dir=nofollow. [ 326.705475][T10798] overlayfs: ...falling back to index=off. [ 326.711355][T10798] overlayfs: ...falling back to uuid=null. [ 326.717358][T10798] overlayfs: conflicting lowerdir path [ 326.812927][ T29] audit: type=1400 audit(1785061392.018:568): avc: denied { mount } for pid=10790 comm="syz.1.1393" name="/" dev="ramfs" ino=27859 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 326.879495][ T29] audit: type=1400 audit(1785061392.028:569): avc: denied { mounton } for pid=10790 comm="syz.1.1393" path="/file0" dev="ramfs" ino=27860 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 326.991584][ T29] audit: type=1400 audit(1785061392.418:570): avc: denied { write } for pid=10800 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 327.108886][ T24] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 328.166624][T10808] FAULT_INJECTION: forcing a failure. [ 328.166624][T10808] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 328.997405][T10808] CPU: 1 UID: 0 PID: 10808 Comm: syz.2.1396 Not tainted syzkaller #0 PREEMPT(full) [ 328.997432][T10808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 328.997443][T10808] Call Trace: [ 328.997449][T10808] [ 328.997455][T10808] dump_stack_lvl+0x100/0x190 [ 328.997483][T10808] should_fail_ex.cold+0x5/0xa [ 328.997506][T10808] _copy_from_user+0x2e/0xd0 [ 328.997529][T10808] copy_msghdr_from_user+0x9f/0x4c0 [ 328.997557][T10808] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 328.997583][T10808] ? do_raw_spin_unlock+0x145/0x1e0 [ 328.997614][T10808] ? rcu_is_watching+0x12/0xc0 [ 328.997641][T10808] ? trace_hrtimer_start+0x77/0x220 [ 328.997671][T10808] ___sys_sendmsg+0x106/0x1e0 [ 328.997700][T10808] ? __pfx____sys_sendmsg+0x10/0x10 [ 328.997725][T10808] ? __lock_acquire+0x49f/0x1a40 [ 328.997747][T10808] ? finish_task_switch.isra.0+0x2c0/0x10c0 [ 328.997801][T10808] __sys_sendmsg+0x160/0x210 [ 328.997824][T10808] ? __pfx___sys_sendmsg+0x10/0x10 [ 328.997851][T10808] ? trace_hardirqs_off+0x70/0x170 [ 328.997881][T10808] do_syscall_64+0x115/0x870 [ 328.997901][T10808] ? clear_bhb_loop+0x40/0x90 [ 328.997923][T10808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.997942][T10808] RIP: 0033:0x7f6cce19de99 [ 328.997957][T10808] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 328.997974][T10808] RSP: 002b:00007f6cceff8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 328.997992][T10808] RAX: ffffffffffffffda RBX: 00007f6cce425fa0 RCX: 00007f6cce19de99 [ 328.998003][T10808] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 328.998014][T10808] RBP: 00007f6cceff8090 R08: 0000000000000000 R09: 0000000000000000 [ 328.998025][T10808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 328.998036][T10808] R13: 00007f6cce426038 R14: 00007f6cce425fa0 R15: 00007ffed7a03108 [ 328.998067][T10808] [ 329.289691][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 329.388246][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 329.413192][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 329.431019][ T24] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 329.536002][ T24] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 173 [ 329.661674][ T24] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 329.782708][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.025694][ T24] usb 1-1: config 0 descriptor?? [ 330.277942][ T24] usb 1-1: can't set config #0, error -71 [ 330.529233][ T24] usb 1-1: USB disconnect, device number 44 [ 330.878096][T10835] lo speed is unknown, defaulting to 1000 [ 330.982753][T10842] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1402'. [ 330.999873][T10842] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1402'. [ 331.010486][T10842] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1402'. [ 331.076772][T10843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1392'. [ 331.234445][T10844] FAULT_INJECTION: forcing a failure. [ 331.234445][T10844] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 331.381476][T10844] CPU: 0 UID: 0 PID: 10844 Comm: syz.4.1392 Not tainted syzkaller #0 PREEMPT(full) [ 331.381503][T10844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 331.381514][T10844] Call Trace: [ 331.381520][T10844] [ 331.381528][T10844] dump_stack_lvl+0x100/0x190 [ 331.381555][T10844] should_fail_ex.cold+0x5/0xa [ 331.381577][T10844] _copy_from_user+0x2e/0xd0 [ 331.381603][T10844] copy_msghdr_from_user+0x9f/0x4c0 [ 331.381631][T10844] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 331.381662][T10844] ? do_raw_spin_unlock+0x145/0x1e0 [ 331.381688][T10844] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 331.381716][T10844] ? debug_object_assert_init+0x1c4/0x310 [ 331.381741][T10844] ___sys_sendmsg+0x106/0x1e0 [ 331.381769][T10844] ? __pfx____sys_sendmsg+0x10/0x10 [ 331.381793][T10844] ? __lock_acquire+0x49f/0x1a40 [ 331.381843][T10844] __sys_sendmsg+0x160/0x210 [ 331.381866][T10844] ? __pfx___sys_sendmsg+0x10/0x10 [ 331.381892][T10844] ? trace_irq_enable.constprop.0+0x2f/0x160 [ 331.381922][T10844] do_syscall_64+0x115/0x870 [ 331.381941][T10844] ? clear_bhb_loop+0x40/0x90 [ 331.381962][T10844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 331.381980][T10844] RIP: 0033:0x7fe446b9de99 [ 331.381997][T10844] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 331.382014][T10844] RSP: 002b:00007fe447abc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 331.382032][T10844] RAX: ffffffffffffffda RBX: 00007fe446e26090 RCX: 00007fe446b9de99 [ 331.382043][T10844] RDX: 00000000200000e0 RSI: 0000200000000380 RDI: 0000000000000003 [ 331.382053][T10844] RBP: 00007fe447abc090 R08: 0000000000000000 R09: 0000000000000000 [ 331.382064][T10844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 331.382074][T10844] R13: 00007fe446e26128 R14: 00007fe446e26090 R15: 00007fff96c395e8 [ 331.382096][T10844] [ 331.664229][T10846] FAULT_INJECTION: forcing a failure. [ 331.664229][T10846] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 331.677497][T10846] CPU: 0 UID: 0 PID: 10846 Comm: syz.2.1404 Not tainted syzkaller #0 PREEMPT(full) [ 331.677522][T10846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 331.677532][T10846] Call Trace: [ 331.677540][T10846] [ 331.677548][T10846] dump_stack_lvl+0x100/0x190 [ 331.677576][T10846] should_fail_ex.cold+0x5/0xa [ 331.677599][T10846] _copy_from_user+0x2e/0xd0 [ 331.677625][T10846] copy_msghdr_from_user+0x9f/0x4c0 [ 331.677654][T10846] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 331.677694][T10846] ___sys_sendmsg+0x106/0x1e0 [ 331.677721][T10846] ? __pfx____sys_sendmsg+0x10/0x10 [ 331.677747][T10846] ? __lock_acquire+0x49f/0x1a40 [ 331.677798][T10846] __sys_sendmsg+0x160/0x210 [ 331.677820][T10846] ? __pfx___sys_sendmsg+0x10/0x10 [ 331.677854][T10846] do_syscall_64+0x115/0x870 [ 331.677874][T10846] ? clear_bhb_loop+0x40/0x90 [ 331.677896][T10846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 331.677914][T10846] RIP: 0033:0x7f6cce19de99 [ 331.677930][T10846] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 331.677947][T10846] RSP: 002b:00007f6cceff8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 331.677965][T10846] RAX: ffffffffffffffda RBX: 00007f6cce425fa0 RCX: 00007f6cce19de99 [ 331.677977][T10846] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000a [ 331.677987][T10846] RBP: 00007f6cceff8090 R08: 0000000000000000 R09: 0000000000000000 [ 331.677997][T10846] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 331.678008][T10846] R13: 00007f6cce426038 R14: 00007f6cce425fa0 R15: 00007ffed7a03108 [ 331.678031][T10846] [ 331.939373][T10857] FAULT_INJECTION: forcing a failure. [ 331.939373][T10857] name failslab, interval 1, probability 0, space 0, times 0 [ 331.952051][T10857] CPU: 0 UID: 0 PID: 10857 Comm: syz.2.1406 Not tainted syzkaller #0 PREEMPT(full) [ 331.952066][T10857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 331.952073][T10857] Call Trace: [ 331.952078][T10857] [ 331.952083][T10857] dump_stack_lvl+0x100/0x190 [ 331.952101][T10857] should_fail_ex.cold+0x5/0xa [ 331.952115][T10857] should_failslab+0xc2/0x120 [ 331.952130][T10857] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 331.952143][T10857] ? __alloc_skb+0x5b7/0x710 [ 331.952154][T10857] ? __alloc_skb+0x140/0x710 [ 331.952168][T10857] __alloc_skb+0x140/0x710 [ 331.952179][T10857] ? __alloc_skb+0x5b7/0x710 [ 331.952190][T10857] ? __pfx___alloc_skb+0x10/0x10 [ 331.952205][T10857] alloc_skb_with_frags+0xdd/0x760 [ 331.952223][T10857] sock_alloc_send_pskb+0x801/0x980 [ 331.952238][T10857] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 331.952250][T10857] ? raw_sendmsg+0x14c/0x880 [ 331.952262][T10857] ? find_held_lock+0x2b/0x80 [ 331.952278][T10857] ? raw_sendmsg+0x14c/0x880 [ 331.952288][T10857] ? raw_sendmsg+0x14c/0x880 [ 331.952299][T10857] ? __local_bh_enable_ip+0x9e/0x120 [ 331.952320][T10857] raw_sendmsg+0x3d7/0x880 [ 331.952331][T10857] ? __pfx_raw_sendmsg+0x10/0x10 [ 331.952343][T10857] ? selinux_socket_sendmsg+0x198/0x2f0 [ 331.952360][T10857] sock_write_iter+0x53a/0x5b0 [ 331.952376][T10857] ? __pfx_ieee802154_sock_sendmsg+0x10/0x10 [ 331.952386][T10857] ? __pfx_sock_write_iter+0x10/0x10 [ 331.952405][T10857] ? bpf_lsm_file_permission+0x9/0x10 [ 331.952421][T10857] ? security_file_permission+0x76/0x210 [ 331.952439][T10857] ? rw_verify_area+0xce/0x6d0 [ 331.952455][T10857] vfs_write+0x6ac/0x1050 [ 331.952471][T10857] ? __pfx_sock_write_iter+0x10/0x10 [ 331.952488][T10857] ? __pfx_vfs_write+0x10/0x10 [ 331.952503][T10857] ? find_held_lock+0x2b/0x80 [ 331.952526][T10857] ksys_write+0x1f8/0x250 [ 331.952543][T10857] ? __pfx_ksys_write+0x10/0x10 [ 331.952562][T10857] do_syscall_64+0x115/0x870 [ 331.952573][T10857] ? clear_bhb_loop+0x40/0x90 [ 331.952585][T10857] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 331.952596][T10857] RIP: 0033:0x7f6cce19de99 [ 331.952606][T10857] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 331.952616][T10857] RSP: 002b:00007f6cceff8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 331.952627][T10857] RAX: ffffffffffffffda RBX: 00007f6cce425fa0 RCX: 00007f6cce19de99 [ 331.952633][T10857] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 331.952640][T10857] RBP: 00007f6cceff8090 R08: 0000000000000000 R09: 0000000000000000 [ 331.952646][T10857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 331.952652][T10857] R13: 00007f6cce426038 R14: 00007f6cce425fa0 R15: 00007ffed7a03108 [ 331.952665][T10857] [ 332.349194][T10863] IPVS: set_ctl: invalid protocol: 46 100.1.1.2:20002 [ 332.369833][T10863] comedi comedi0: 8255: I/O base address not correctly aligned [ 332.666596][T10863] bridge1: entered promiscuous mode [ 332.672144][T10863] bridge1: entered allmulticast mode [ 332.709965][T10863] team0: Port device bridge1 added [ 332.747708][T10868] syzkaller0: entered promiscuous mode [ 332.820142][T10868] syzkaller0: entered allmulticast mode [ 334.517970][ T29] audit: type=1400 audit(1785061399.946:571): avc: denied { listen } for pid=10874 comm="syz.0.1412" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 334.539537][ T29] audit: type=1400 audit(1785061399.966:572): avc: denied { read } for pid=10874 comm="syz.0.1412" lport=56690 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 334.614618][ T29] audit: type=1400 audit(1785061400.046:573): avc: denied { create } for pid=10879 comm="syz.3.1414" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 334.817645][T10880] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 335.413060][ T29] audit: type=1400 audit(1785061400.066:574): avc: denied { getopt } for pid=10879 comm="syz.3.1414" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 335.433066][ T29] audit: type=1400 audit(1785061400.235:575): avc: denied { ioctl } for pid=10879 comm="syz.3.1414" path="socket:[28983]" dev="sockfs" ino=28983 ioctlcmd=0x7459 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 335.802098][ T24] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 335.805613][ T29] audit: type=1400 audit(1785061401.235:576): avc: denied { create } for pid=10908 comm="syz.4.1419" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 335.954733][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 335.975820][ T24] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 335.996375][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 336.395807][ T24] pvrusb2: Hardware description: Terratec Grabster AV400 [ 336.433524][ T24] pvrusb2: ********** [ 336.449774][ T24] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 336.489908][T10921] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1421'. [ 336.507905][ T24] pvrusb2: Important functionality might not be entirely working. [ 336.535451][T10921] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1421'. [ 336.551429][ T24] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 336.600733][ T24] pvrusb2: ********** [ 336.645908][ T2361] pvrusb2: Invalid write control endpoint [ 336.662299][ T24] usb 3-1: USB disconnect, device number 28 [ 336.746897][ T29] audit: type=1400 audit(1785061402.165:577): avc: denied { getopt } for pid=10927 comm="syz.2.1422" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 336.827611][T10931] syzkaller0: entered promiscuous mode [ 336.857087][T10931] syzkaller0: entered allmulticast mode [ 336.918603][ T2361] pvrusb2: Invalid write control endpoint [ 336.959983][ T2361] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 337.010375][ T2361] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 337.028319][T10939] ieee802154 phy0 wpan0: encryption failed: -22 [ 337.037048][ T2361] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 337.071328][ T2361] pvrusb2: Device being rendered inoperable [ 337.101535][ T2361] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 337.138833][ T29] audit: type=1400 audit(1785061402.565:578): avc: denied { write } for pid=10917 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 337.139367][ T2361] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 337.318124][ T2361] pvrusb2: Attached sub-driver cx25840 [ 337.333562][ T2361] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 337.389528][ T2361] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 337.412375][ T5710] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 337.460338][ T29] audit: type=1400 audit(1785061402.845:579): avc: denied { read write } for pid=10951 comm="syz.4.1429" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 337.725647][ T29] audit: type=1400 audit(1785061402.865:580): avc: denied { open } for pid=10951 comm="syz.4.1429" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 339.259346][T10952] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1429'. [ 339.272874][ T5710] usb 2-1: Using ep0 maxpacket: 8 [ 339.288774][ T5710] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 339.328826][ T5710] usb 2-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d5 [ 339.433918][T10969] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 339.467927][ T5710] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.513134][ T5710] usb 2-1: config 0 descriptor?? [ 339.542511][ T5710] uvcvideo 2-1:0.0: probe with driver uvcvideo failed with error -22 [ 339.884349][ T5710] usb 2-1: USB disconnect, device number 38 [ 339.976122][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 339.976155][ T29] audit: type=1400 audit(1785061405.394:587): avc: denied { execute } for pid=10972 comm="syz.4.1433" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 340.314359][T10976] netlink: 'syz.2.1434': attribute type 21 has an invalid length. [ 340.344855][T10976] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 340.362118][ T29] audit: type=1400 audit(1785061405.784:588): avc: denied { checkpoint_restore } for pid=10977 comm="syz.0.1435" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 340.376898][T10976] netlink: 'syz.2.1434': attribute type 21 has an invalid length. [ 340.405319][T10976] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 340.414225][T10980] syzkaller0: entered promiscuous mode [ 340.422813][T10980] syzkaller0: entered allmulticast mode [ 340.713303][ T24] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 340.820719][T10991] ieee802154 phy0 wpan0: encryption failed: -22 [ 340.883262][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 340.908720][ T24] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 340.929854][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.941996][ T24] usb 1-1: Product: syz [ 340.957133][ T24] usb 1-1: Manufacturer: syz [ 340.962941][ T24] usb 1-1: SerialNumber: syz [ 340.979516][ T24] usb 1-1: config 0 descriptor?? [ 340.989131][ T29] audit: type=1400 audit(1785061406.414:589): avc: denied { ioctl } for pid=11007 comm="syz.1.1441" path="pid:[4026532781]" dev="nsfs" ino=4026532781 ioctlcmd=0xb701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 341.057357][T11017] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1444'. [ 341.258013][T11030] FAULT_INJECTION: forcing a failure. [ 341.258013][T11030] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 341.306496][ T24] RobotFuzz Open Source InterFace, OSIF 1-1:0.0: failure sending bit rate [ 341.323827][T11030] CPU: 1 UID: 0 PID: 11030 Comm: syz.2.1448 Not tainted syzkaller #0 PREEMPT(full) [ 341.323850][T11030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 341.323859][T11030] Call Trace: [ 341.323864][T11030] [ 341.323870][T11030] dump_stack_lvl+0x100/0x190 [ 341.323896][T11030] should_fail_ex.cold+0x5/0xa [ 341.323916][T11030] _copy_from_user+0x2e/0xd0 [ 341.323939][T11030] generic_map_update_batch+0x452/0x800 [ 341.323972][T11030] ? __pfx_generic_map_update_batch+0x10/0x10 [ 341.324005][T11030] ? __pfx_generic_map_update_batch+0x10/0x10 [ 341.324032][T11030] bpf_map_do_batch+0x66f/0x6d0 [ 341.324057][T11030] __sys_bpf+0x4ce/0x4e80 [ 341.324080][T11030] ? __pfx___sys_bpf+0x10/0x10 [ 341.324096][T11030] ? find_held_lock+0x2b/0x80 [ 341.324120][T11030] ? get_pid_task+0xfc/0x250 [ 341.324143][T11030] ? get_pid_task+0xfc/0x250 [ 341.324177][T11030] ? find_held_lock+0x2b/0x80 [ 341.324204][T11030] ? rcu_read_lock_any_held+0x6a/0xa0 [ 341.324220][T11030] ? find_held_lock+0x2b/0x80 [ 341.324243][T11030] ? ksys_write+0x190/0x250 [ 341.324266][T11030] ? ksys_write+0x190/0x250 [ 341.324304][T11030] ? fput+0x79/0x100 [ 341.324325][T11030] ? __x64_sys_bpf+0xce/0x140 [ 341.324340][T11030] __x64_sys_bpf+0xce/0x140 [ 341.324356][T11030] ? do_syscall_64+0x90/0x870 [ 341.324376][T11030] do_syscall_64+0x115/0x870 [ 341.324392][T11030] ? clear_bhb_loop+0x40/0x90 [ 341.324413][T11030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 341.324429][T11030] RIP: 0033:0x7f6cce19de99 [ 341.324444][T11030] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 341.324459][T11030] RSP: 002b:00007f6cceff8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 341.324476][T11030] RAX: ffffffffffffffda RBX: 00007f6cce425fa0 RCX: 00007f6cce19de99 [ 341.324487][T11030] RDX: 0000000000000038 RSI: 0000200000000240 RDI: 000000000000001a [ 341.324496][T11030] RBP: 00007f6cceff8090 R08: 0000000000000000 R09: 0000000000000000 [ 341.324506][T11030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 341.324516][T11030] R13: 00007f6cce426038 R14: 00007f6cce425fa0 R15: 00007ffed7a03108 [ 341.324537][T11030] [ 341.325240][ T24] RobotFuzz Open Source InterFace, OSIF 1-1:0.0: probe with driver RobotFuzz Open Source InterFace, OSIF failed with error -71 [ 341.621836][T11033] binder: 11032:11033 ioctl 89f0 200000000580 returned -22 [ 341.734719][ T24] usb 1-1: USB disconnect, device number 45 [ 341.777047][T11038] syzkaller0: entered promiscuous mode [ 341.812182][T11038] syzkaller0: entered allmulticast mode [ 341.935371][T11044] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1452'. [ 341.954384][T11046] FAULT_INJECTION: forcing a failure. [ 341.954384][T11046] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 341.978048][T11044] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 342.008287][T11046] CPU: 0 UID: 0 PID: 11046 Comm: syz.4.1453 Not tainted syzkaller #0 PREEMPT(full) [ 342.008305][T11046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 342.008311][T11046] Call Trace: [ 342.008315][T11046] [ 342.008320][T11046] dump_stack_lvl+0x100/0x190 [ 342.008337][T11046] should_fail_ex.cold+0x5/0xa [ 342.008351][T11046] _copy_from_user+0x2e/0xd0 [ 342.008366][T11046] copy_msghdr_from_user+0x9f/0x4c0 [ 342.008384][T11046] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 342.008406][T11046] ___sys_sendmsg+0x106/0x1e0 [ 342.008423][T11046] ? __pfx____sys_sendmsg+0x10/0x10 [ 342.008439][T11046] ? __lock_acquire+0x49f/0x1a40 [ 342.008452][T11046] ? get_pid_task+0x106/0x250 [ 342.008482][T11046] __sys_sendmsg+0x160/0x210 [ 342.008495][T11046] ? __pfx___sys_sendmsg+0x10/0x10 [ 342.008514][T11046] do_syscall_64+0x115/0x870 [ 342.008525][T11046] ? clear_bhb_loop+0x40/0x90 [ 342.008538][T11046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.008548][T11046] RIP: 0033:0x7fe446b9de99 [ 342.008558][T11046] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 342.008568][T11046] RSP: 002b:00007fe447add028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 342.008579][T11046] RAX: ffffffffffffffda RBX: 00007fe446e25fa0 RCX: 00007fe446b9de99 [ 342.008585][T11046] RDX: 0000000020000114 RSI: 0000200000000180 RDI: 0000000000000003 [ 342.008592][T11046] RBP: 00007fe447add090 R08: 0000000000000000 R09: 0000000000000000 [ 342.008598][T11046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.008604][T11046] R13: 00007fe446e26038 R14: 00007fe446e25fa0 R15: 00007fff96c395e8 [ 342.008619][T11046] [ 342.249155][ T24] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 342.321290][ T29] audit: type=1400 audit(1785061407.743:590): avc: denied { read write } for pid=11053 comm="syz.4.1455" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 342.356764][ T5726] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 342.377068][T11049] ieee802154 phy0 wpan0: encryption failed: -22 [ 342.386496][ T29] audit: type=1400 audit(1785061407.743:591): avc: denied { open } for pid=11053 comm="syz.4.1455" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 342.433711][ T24] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 342.442464][ T24] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 342.468022][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 342.498789][ T24] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 342.530020][ T24] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 342.556236][ T5726] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 342.557151][ T24] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 342.590985][ T24] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 342.592659][ T5726] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 342.632764][ T5726] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 342.652885][ T24] usb 1-1: Product: syz [ 342.657776][ T24] usb 1-1: Manufacturer: syz [ 342.668919][ T29] audit: type=1400 audit(1785061408.093:592): avc: denied { connect } for pid=11020 comm="syz.3.1446" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 342.711147][ T24] cdc_wdm 1-1:1.0: skipping garbage [ 342.717863][T11028] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1446'. [ 342.724960][ T24] cdc_wdm 1-1:1.0: skipping garbage [ 342.732104][ T5726] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 342.746397][ T24] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 342.751015][ T5726] usb 2-1: config 0 descriptor?? [ 342.758046][T11066] netlink: 'syz.4.1458': attribute type 1 has an invalid length. [ 342.769467][T11052] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1446'. [ 342.772707][ T24] cdc_wdm 1-1:1.0: Unknown control protocol [ 342.791110][ T5726] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 342.821198][ T5726] dvb-usb: bulk message failed: -22 (3/0) [ 342.852100][T11066] 8021q: adding VLAN 0 to HW filter on device bond10 [ 342.898381][ T5726] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 342.919127][ T29] audit: type=1400 audit(1785061408.343:593): avc: denied { read write } for pid=10981 comm="syz.0.1437" name="cdc-wdm0" dev="devtmpfs" ino=3239 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 342.945214][ C1] cdc_wdm 1-1:1.0: unknown notification 112 received: index 29797 len 25902 [ 342.964338][ T29] audit: type=1400 audit(1785061408.343:594): avc: denied { open } for pid=10981 comm="syz.0.1437" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3239 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 342.998990][ T5726] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 343.013664][ T5726] usb 2-1: media controller created [ 343.024896][T11069] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 343.029915][ T5726] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 343.042403][T11044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 343.091522][T11044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 343.148777][T11044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 343.167747][ T5726] dvb-usb: bulk message failed: -22 (6/0) [ 343.192231][ T5726] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 343.201760][T11044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 343.212734][T10982] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 343.226967][T11074] syzkaller0: entered promiscuous mode [ 343.234186][ T5726] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input16 [ 343.253108][T10982] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 343.281929][T11074] syzkaller0: entered allmulticast mode [ 343.293287][ T5726] dvb-usb: schedule remote query interval to 150 msecs. [ 343.299510][ T29] audit: type=1400 audit(1785061408.713:595): avc: denied { read } for pid=4961 comm="acpid" name="event4" dev="devtmpfs" ino=3250 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 343.325593][ T5726] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 343.341619][T11075] 0: reclassify loop, rule prio 0, protocol 800 [ 343.356131][ T5726] usb 2-1: USB disconnect, device number 39 [ 343.397554][ T5726] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 343.413733][ T24] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 343.421737][ T29] audit: type=1400 audit(1785061408.713:596): avc: denied { open } for pid=4961 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3250 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 343.592595][T11077] xt_hashlimit: size too large, truncated to 1048576 [ 343.604843][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 343.612520][ T24] usb 3-1: config 0 has no interfaces? [ 343.621321][ T24] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 343.632361][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.641807][ T24] usb 3-1: Product: syz [ 343.654377][ T24] usb 3-1: Manufacturer: syz [ 343.661675][ T24] usb 3-1: SerialNumber: syz [ 343.672341][ T24] usb 3-1: config 0 descriptor?? [ 345.118890][ T30] usb 1-1: USB disconnect, device number 46 [ 346.226794][ T30] usb 3-1: USB disconnect, device number 29 [ 346.536228][T11094] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 346.819065][T11092] syzkaller0: entered promiscuous mode [ 346.845193][T11092] syzkaller0: entered allmulticast mode [ 348.524065][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 348.524078][ T29] audit: type=1400 audit(1785061413.932:599): avc: denied { write } for pid=11086 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 348.998105][T11115] netlink: 596 bytes leftover after parsing attributes in process `syz.2.1468'. [ 349.837709][ T5833] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 349.847773][ T29] audit: type=1400 audit(1785061415.251:600): avc: denied { unmount } for pid=5605 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 349.952395][T11107] ieee802154 phy0 wpan0: encryption failed: -22 [ 350.000345][ T29] audit: type=1400 audit(1785061415.421:601): avc: denied { write } for pid=11123 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 350.022834][ T5833] usb 4-1: Using ep0 maxpacket: 32 [ 350.037163][ T5833] usb 4-1: unable to get BOS descriptor or descriptor too short [ 350.046037][ T5833] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 350.059377][ T5833] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 350.094169][ T5833] usb 4-1: config 14 has no interface number 0 [ 350.121787][ T5833] usb 4-1: config 14 has no interface number 1 [ 350.152346][ T5833] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 350.199590][ T5833] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 350.225705][ T5833] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 350.256859][ T5833] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 350.282990][ T5833] usb 4-1: config 14 interface 228 altsetting 5 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 350.316232][ T5833] usb 4-1: config 14 interface 57 has no altsetting 0 [ 350.325697][ T5833] usb 4-1: config 14 interface 228 has no altsetting 0 [ 350.342525][ T5833] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 350.356795][ T5833] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.373124][ T5833] usb 4-1: Product: syz [ 350.384490][ T5833] usb 4-1: Manufacturer: syz [ 350.400918][ T5833] usb 4-1: SerialNumber: syz [ 350.507825][T11138] syzkaller0: entered promiscuous mode [ 350.514220][T11138] syzkaller0: entered allmulticast mode [ 350.546413][T11138] 0: reclassify loop, rule prio 0, protocol 800 [ 350.778567][ T29] audit: type=1400 audit(1785061416.201:602): avc: denied { ioctl } for pid=11142 comm="syz.2.1476" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 350.807074][T11146] syzkaller0: entered promiscuous mode [ 350.812611][T11146] syzkaller0: entered allmulticast mode [ 350.853563][ T5833] legousbtower 4-1:14.57: interrupt endpoints not found [ 351.054945][ T5833] legousbtower 4-1:14.228: interrupt endpoints not found [ 351.071596][T11155] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1480'. [ 351.149379][T11155] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1480'. [ 351.810397][T11170] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 352.045700][T11175] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1484'. [ 352.386106][ T5785] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 352.576119][ T5785] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 352.606629][ T5785] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.624420][T11158] syz.1.1481 (11158) used greatest stack depth: 18072 bytes left [ 352.628398][ T5785] usb 5-1: Product: syz [ 352.665543][ T5785] usb 5-1: Manufacturer: syz [ 352.683991][ T5785] usb 5-1: SerialNumber: syz [ 352.754602][T11190] syzkaller0: entered promiscuous mode [ 352.761248][T11192] FAULT_INJECTION: forcing a failure. [ 352.761248][T11192] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 352.778839][T11190] syzkaller0: entered allmulticast mode [ 352.790423][T11192] CPU: 0 UID: 0 PID: 11192 Comm: syz.1.1490 Not tainted syzkaller #0 PREEMPT(full) [ 352.790448][T11192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 352.790457][T11192] Call Trace: [ 352.790464][T11192] [ 352.790470][T11192] dump_stack_lvl+0x100/0x190 [ 352.790496][T11192] should_fail_ex.cold+0x5/0xa [ 352.790517][T11192] _copy_from_user+0x2e/0xd0 [ 352.790538][T11192] copy_msghdr_from_user+0x9f/0x4c0 [ 352.790556][T11192] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 352.790584][T11192] ? find_held_lock+0x2b/0x80 [ 352.790614][T11192] ? __lock_acquire+0x49f/0x1a40 [ 352.790633][T11192] ? get_pid_task+0x106/0x250 [ 352.790655][T11192] ___sys_recvmsg+0xdd/0x1a0 [ 352.790672][T11192] ? __pfx____sys_recvmsg+0x10/0x10 [ 352.790690][T11192] ? find_held_lock+0x2b/0x80 [ 352.790720][T11192] __x64_sys_recvmsg+0x19a/0x260 [ 352.790741][T11192] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 352.790774][T11192] do_syscall_64+0x115/0x870 [ 352.790791][T11192] ? clear_bhb_loop+0x40/0x90 [ 352.790804][T11192] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 352.790815][T11192] RIP: 0033:0x7fb41f79de99 [ 352.790825][T11192] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 352.790836][T11192] RSP: 002b:00007fb420746028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 352.790847][T11192] RAX: ffffffffffffffda RBX: 00007fb41fa25fa0 RCX: 00007fb41f79de99 [ 352.790855][T11192] RDX: 0000000000001021 RSI: 0000200000000840 RDI: 0000000000000004 [ 352.790865][T11192] RBP: 00007fb420746090 R08: 0000000000000000 R09: 0000000000000000 [ 352.790874][T11192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 352.790883][T11192] R13: 00007fb41fa26038 R14: 00007fb41fa25fa0 R15: 00007ffe1a823168 [ 352.790905][T11192] [ 353.158696][T11185] mmap: syz.0.1487 (11185) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 353.226220][ T5785] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 353.256169][ T5785] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 353.276389][ T30] usb 4-1: USB disconnect, device number 36 [ 353.454902][T11206] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 353.462816][ T5726] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 353.497140][T11206] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1495'. [ 353.506302][ T5710] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 353.620196][ T30] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 353.620973][ T5726] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 353.643803][ T5726] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 353.652455][ T29] audit: type=1400 audit(1785061419.071:603): avc: denied { mounton } for pid=11209 comm="syz.0.1496" path="/file0" dev="bpf" ino=28557 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:bpf_t tclass=dir permissive=1 [ 353.655739][ T5726] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 353.686985][ T5726] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 353.698278][ T5726] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 353.712393][ T5710] usb 2-1: config 2 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 353.723762][ T5710] usb 2-1: config 2 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 353.724139][T11174] IPVS: stopping backup sync thread 11212 ... [ 353.733836][T11212] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6gretap0, syncid = 4, id = 0 [ 353.733960][ T5710] usb 2-1: config 2 interface 0 has no altsetting 0 [ 353.733992][ T5710] usb 2-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 353.734015][ T5710] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.735164][ T5726] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 353.764650][T11214] FAULT_INJECTION: forcing a failure. [ 353.764650][T11214] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.769284][ T5726] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 353.777372][T11214] CPU: 1 UID: 0 PID: 11214 Comm: syz.0.1497 Not tainted syzkaller #0 PREEMPT(full) [ 353.777393][T11214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 353.777402][T11214] Call Trace: [ 353.777407][T11214] [ 353.777413][T11214] dump_stack_lvl+0x100/0x190 [ 353.777439][T11214] should_fail_ex.cold+0x5/0xa [ 353.777458][T11214] _copy_from_user+0x2e/0xd0 [ 353.777479][T11214] copy_msghdr_from_user+0x9f/0x4c0 [ 353.777503][T11214] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 353.777536][T11214] ___sys_sendmsg+0x106/0x1e0 [ 353.777560][T11214] ? __pfx____sys_sendmsg+0x10/0x10 [ 353.777581][T11214] ? __lock_acquire+0x49f/0x1a40 [ 353.777600][T11214] ? get_pid_task+0x106/0x250 [ 353.777646][T11214] __sys_sendmsg+0x160/0x210 [ 353.777664][T11214] ? __pfx___sys_sendmsg+0x10/0x10 [ 353.777694][T11214] do_syscall_64+0x115/0x870 [ 353.777711][T11214] ? clear_bhb_loop+0x40/0x90 [ 353.777729][T11214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.777744][T11214] RIP: 0033:0x7f9af679de99 [ 353.777757][T11214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.777771][T11214] RSP: 002b:00007f9af75ad028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 353.777787][T11214] RAX: ffffffffffffffda RBX: 00007f9af6a25fa0 RCX: 00007f9af679de99 [ 353.777797][T11214] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 353.777806][T11214] RBP: 00007f9af75ad090 R08: 0000000000000000 R09: 0000000000000000 [ 353.777815][T11214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 353.777824][T11214] R13: 00007f9af6a26038 R14: 00007f9af6a25fa0 R15: 00007ffd4bff0f78 [ 353.777845][T11214] [ 353.797565][ T30] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 353.826957][ T5726] usb 3-1: Product: syz [ 353.853803][ T30] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 353.896804][ T5726] usb 3-1: Manufacturer: syz [ 353.902591][ T5785] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 353.932266][ T5726] cdc_wdm 3-1:1.0: skipping garbage [ 353.937424][ T5785] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 353.947930][ T5726] cdc_wdm 3-1:1.0: skipping garbage [ 353.952317][ T5785] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 353.989049][ T5726] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 353.991095][ T30] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 353.994239][ T5726] cdc_wdm 3-1:1.0: Unknown control protocol [ 354.004187][ T30] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 354.079295][ T5785] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 354.092827][ T5785] usb 5-1: USB disconnect, device number 34 [ 354.109410][ T30] usb 4-1: config 0 descriptor?? [ 354.137682][ T5703] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 354.295519][ T5710] elo 0003:04E7:0009.001B: unknown main item tag 0x0 [ 354.297711][ T5703] usb 1-1: Using ep0 maxpacket: 8 [ 354.309051][ T5710] elo 0003:04E7:0009.001B: unknown main item tag 0x0 [ 354.310984][ T5703] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 354.315804][ T5710] elo 0003:04E7:0009.001B: unknown main item tag 0x0 [ 354.323781][ T5703] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 354.335413][ T5710] elo 0003:04E7:0009.001B: unknown main item tag 0x0 [ 354.343501][ T5703] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 354.343532][ T5703] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 354.343573][ T5703] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 354.343595][ T5703] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 354.343618][ T5703] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 354.343641][ T5703] usb 1-1: config 168 interface 0 has no altsetting 0 [ 354.344555][ T5703] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 354.344583][ T5703] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 354.344631][ T5703] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 354.344654][ T5703] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 354.344675][ T5703] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 354.344695][ T5703] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 354.344714][ T5703] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 354.344735][ T5703] usb 1-1: config 168 interface 0 has no altsetting 0 [ 354.347931][ T5703] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 354.353004][ T5710] elo 0003:04E7:0009.001B: unknown main item tag 0x0 [ 354.371049][ T5703] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 354.383460][ T5710] elo 0003:04E7:0009.001B: hidraw0: USB HID vff.ff Device [HID 04e7:0009] on usb-dummy_hcd.1-1/input0 [ 354.406383][ T5703] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 354.580885][ T29] audit: type=1400 audit(1785061419.990:604): avc: denied { read } for pid=11199 comm="syz.2.1492" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 354.607650][T11202] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 354.616302][T11202] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 354.726579][ T29] audit: type=1400 audit(1785061420.120:605): avc: denied { bind } for pid=11201 comm="syz.1.1493" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 354.734420][ T5703] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 354.765612][ T5703] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 354.777601][ T5703] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 354.789854][ T5703] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 354.803833][ T5703] usb 1-1: config 168 interface 0 has no altsetting 0 [ 354.836987][ T29] audit: type=1400 audit(1785061420.180:606): avc: denied { open } for pid=11199 comm="syz.2.1492" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 354.837104][ T5703] usb 1-1: string descriptor 0 read error: -22 [ 354.868029][ T5703] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 354.877239][ T5703] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.897881][ T5726] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 354.986437][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 355.073111][ T5703] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 355.143927][ T5725] usb 2-1: USB disconnect, device number 40 [ 355.199383][ T5726] usb 5-1: Using ep0 maxpacket: 8 [ 355.199647][ T30] usb 4-1: string descriptor 0 read error: -71 [ 355.221645][ T5726] usb 5-1: New USB device found, idVendor=041e, idProduct=3040, bcdDevice= 0.40 [ 355.225006][ T30] uclogic 0003:256C:006D.001C: failed retrieving string descriptor #200: -71 [ 355.236529][ T5726] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 355.242961][ T30] uclogic 0003:256C:006D.001C: failed retrieving pen parameters: -71 [ 355.255926][ T30] uclogic 0003:256C:006D.001C: failed probing pen v2 parameters: -71 [ 355.264972][ T30] uclogic 0003:256C:006D.001C: failed probing parameters: -71 [ 355.272802][ T30] uclogic 0003:256C:006D.001C: probe with driver uclogic failed with error -71 [ 355.272805][ T5726] usb 5-1: Product: syz [ 355.284421][ T30] usb 4-1: USB disconnect, device number 37 [ 355.292384][ T5726] usb 5-1: Manufacturer: syz [ 355.324768][ T5726] usb 5-1: SerialNumber: syz [ 355.401921][ T5703] usb 1-1: USB disconnect, device number 47 [ 355.550253][ T5726] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 355.560373][ T5726] usb 5-1: unit 35 not found! [ 355.622879][ T5726] usb 5-1: USB disconnect, device number 35 [ 356.397990][T11236] syzkaller0: entered promiscuous mode [ 356.410444][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 356.417242][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 356.424105][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 356.430703][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 356.437103][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 356.443686][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 356.449931][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 356.456513][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 356.462765][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 356.469368][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 356.475930][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 356.482512][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 356.488917][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 356.495522][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 356.501807][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 356.508399][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 356.514668][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 356.521249][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 356.527505][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 356.534085][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 356.549158][ T5710] usb 3-1: USB disconnect, device number 30 [ 356.555148][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 356.582893][T11236] syzkaller0: entered allmulticast mode [ 357.457054][ T5726] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 357.475629][ T29] audit: type=1400 audit(1785061422.890:607): avc: granted { setsecparam } for pid=11248 comm="syz.2.1504" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 357.890706][ T5726] usb 5-1: Using ep0 maxpacket: 32 [ 358.127750][ T5703] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 358.318140][ T5703] usb 2-1: Using ep0 maxpacket: 8 [ 358.363657][ T5703] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 358.402723][ T5703] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 358.475693][ T5703] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 358.541035][ T5703] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 358.614458][ T5703] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 358.685789][ T5703] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 358.827429][ T5703] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 359.804914][ T5703] usb 2-1: config 168 interface 0 has no altsetting 0 [ 359.815782][ T5703] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 359.824594][ T5703] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 359.836784][ T5703] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 359.849510][ T5703] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 359.920286][T11259] syzkaller0: entered promiscuous mode [ 359.961762][ T5703] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 359.980171][T11259] syzkaller0: entered allmulticast mode [ 360.068766][ T5703] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 360.100618][T11257] 0: reclassify loop, rule prio 0, protocol 800 [ 360.116794][ T5726] usb 5-1: device descriptor read/all, error -71 [ 360.139650][T11267] netlink: 'syz.3.1511': attribute type 1 has an invalid length. [ 360.160989][ T5703] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 360.209417][ T5703] usb 2-1: config 168 interface 0 has no altsetting 0 [ 360.231249][ T5703] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 360.250471][ T5703] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 360.277605][ T5703] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 360.307492][T11267] 8021q: adding VLAN 0 to HW filter on device bond9 [ 360.314348][ T5703] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 360.331017][ T5703] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 360.343883][ T5703] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 360.452910][ T5626] Bluetooth: hci0: unexpected event for opcode 0x2060 [ 361.028982][ T5703] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 361.042688][ T5703] usb 2-1: config 168 interface 0 has no altsetting 0 [ 361.054039][T11267] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1511'. [ 361.200172][ T5703] usb 2-1: string descriptor 0 read error: -71 [ 361.223965][ T5703] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 361.255850][ T5703] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.283438][ T5703] usb 2-1: can't set config #168, error -71 [ 361.300598][ T29] audit: type=1400 audit(1785061426.719:608): avc: denied { setopt } for pid=11283 comm="syz.1.1515" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 361.322592][ T5703] usb 2-1: USB disconnect, device number 41 [ 361.326867][T11282] syzkaller0: entered promiscuous mode [ 361.342504][T11282] syzkaller0: entered allmulticast mode [ 361.539190][T11294] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1518'. [ 363.722922][T11326] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1523'. [ 363.735424][T11327] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 363.742122][T11327] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 363.760124][T11327] vhci_hcd vhci_hcd.0: Device attached [ 364.154529][ T5710] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 364.214894][T11335] syzkaller0: entered promiscuous mode [ 364.220715][T11335] syzkaller0: entered allmulticast mode [ 364.242289][ T29] audit: type=1400 audit(1785061429.658:609): avc: denied { accept } for pid=11338 comm="syz.2.1526" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 364.301848][ T29] audit: type=1400 audit(1785061429.698:610): avc: denied { name_bind } for pid=11340 comm="syz.1.1527" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 364.428441][ T5726] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 364.430936][T11349] netlink: 348 bytes leftover after parsing attributes in process `syz.1.1529'. [ 364.505775][ T29] audit: type=1400 audit(1785061429.918:611): avc: denied { map } for pid=11351 comm="syz.1.1530" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 364.571119][ T5726] usb 1-1: device descriptor read/64, error -71 [ 364.644828][ T803] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 364.673321][T11356] syzkaller0: entered promiscuous mode [ 364.679470][T11356] syzkaller0: entered allmulticast mode [ 364.776515][ T29] audit: type=1400 audit(1785061430.158:612): avc: denied { call } for pid=11351 comm="syz.1.1530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 364.838466][ T803] usb 4-1: Using ep0 maxpacket: 32 [ 364.869433][ T803] usb 4-1: config 0 has no interfaces? [ 364.912578][ T5726] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 365.044555][ T803] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 365.064646][ T803] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.078781][ T803] usb 4-1: Product: syz [ 365.083161][ T803] usb 4-1: Manufacturer: syz [ 365.097743][ T803] usb 4-1: SerialNumber: syz [ 365.113471][ T803] usb 4-1: config 0 descriptor?? [ 365.189965][ T5726] usb 1-1: device descriptor read/64, error -71 [ 365.244153][ T29] audit: type=1400 audit(1785061430.658:613): avc: denied { connect } for pid=11361 comm="syz.2.1533" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 365.273547][T11364] syzkaller0: entered promiscuous mode [ 365.279393][T11364] syzkaller0: entered allmulticast mode [ 365.308841][ T5726] usb usb1-port1: attempt power cycle [ 365.349486][T11328] vhci_hcd: unknown pdu 2 [ 365.354850][ T803] usb 4-1: USB disconnect, device number 38 [ 365.371713][T10464] vhci_hcd vhci_hcd.3: stop threads [ 365.385856][T10464] vhci_hcd vhci_hcd.3: release socket [ 365.393545][T10464] vhci_hcd vhci_hcd.3: disconnect device [ 365.538641][ T5833] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 365.659934][ T5726] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 365.680036][ T5726] usb 1-1: device descriptor read/8, error -71 [ 365.698719][ T5833] usb 2-1: Using ep0 maxpacket: 32 [ 365.705628][ T5833] usb 2-1: config 0 has an invalid interface number: 196 but max is 0 [ 365.714425][ T5833] usb 2-1: config 0 has no interface number 0 [ 365.721321][ T5833] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 365.730146][T11379] ieee802154 phy0 wpan0: encryption failed: -22 [ 365.731769][ T5833] usb 2-1: config 0 interface 196 has no altsetting 0 [ 365.748455][ T5833] usb 2-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 365.757987][ T5833] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.767746][ T5833] usb 2-1: Product: syz [ 365.775040][ T5833] usb 2-1: Manufacturer: syz [ 365.781073][ T5833] usb 2-1: SerialNumber: syz [ 365.788487][ T5833] usb 2-1: config 0 descriptor?? [ 365.799470][T11366] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 365.813799][T11384] syzkaller0: entered promiscuous mode [ 365.819587][T11384] syzkaller0: entered allmulticast mode [ 365.830407][T11384] 0: reclassify loop, rule prio 0, protocol 800 [ 365.928849][ T5726] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 365.950309][ T29] audit: type=1400 audit(1785061431.368:614): avc: denied { shutdown } for pid=11385 comm="syz.3.1539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 365.987275][ T5726] usb 1-1: device descriptor read/8, error -71 [ 366.000967][ T29] audit: type=1400 audit(1785061431.368:615): avc: denied { accept } for pid=11385 comm="syz.3.1539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 366.094726][T11395] 9p: Bad value for 'rfdno' [ 366.103389][ T5726] usb usb1-port1: unable to enumerate USB device [ 366.128515][ T29] audit: type=1400 audit(1785061431.538:616): avc: denied { bind } for pid=11387 comm="syz.4.1540" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 366.408818][ T5726] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 366.430093][ T5833] ipheth 2-1:0.196: ipheth_enable_ncm: usb_control_msg: 0 [ 366.440328][ T803] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 366.459847][ T5833] ipheth 2-1:0.196: Apple iPhone USB Ethernet device attached [ 366.485253][ T29] audit: type=1400 audit(1785061431.898:617): avc: denied { read } for pid=5271 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 366.558813][ T5726] usb 5-1: Using ep0 maxpacket: 16 [ 366.567369][ T5726] usb 5-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 366.577286][ T5726] usb 5-1: New USB device strings: Mfr=1, Product=6, SerialNumber=3 [ 366.590884][ T5726] usb 5-1: Product: syz [ 366.597604][ T5726] usb 5-1: Manufacturer: syz [ 366.606873][ T5726] usb 5-1: SerialNumber: syz [ 366.612001][ T803] usb 3-1: Using ep0 maxpacket: 32 [ 366.623334][ T803] usb 3-1: unable to get BOS descriptor or descriptor too short [ 366.633454][ T5726] usb 5-1: config 0 descriptor?? [ 366.646087][ T803] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 366.658227][ T803] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 366.660619][ T5726] ums-onetouch 5-1:0.0: USB Mass Storage device detected [ 366.679504][ T803] usb 3-1: config 14 has no interface number 0 [ 366.685776][ T803] usb 3-1: config 14 has no interface number 1 [ 366.693691][ T803] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 366.705978][ T803] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 366.728687][ T803] usb 3-1: config 14 interface 57 has no altsetting 0 [ 366.741705][ T803] usb 3-1: config 14 interface 228 has no altsetting 0 [ 366.756247][ T803] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 366.777350][ T803] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.797652][ T803] usb 3-1: Product: syz [ 366.827217][ T803] usb 3-1: Manufacturer: syz [ 366.832790][ T803] usb 3-1: SerialNumber: syz [ 366.879250][T11408] syzkaller0: entered promiscuous mode [ 366.884829][T11408] syzkaller0: entered allmulticast mode [ 366.931424][ T29] audit: type=1400 audit(1785061432.348:618): avc: denied { write } for pid=11399 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 366.997439][ T29] audit: type=1400 audit(1785061432.408:619): avc: denied { write } for pid=11417 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 367.047528][T11420] netlink: 172 bytes leftover after parsing attributes in process `syz.0.1545'. [ 367.051390][ C0] ipheth 2-1:0.196: ipheth_rcvbulk_callback: callback retval: -22 [ 367.272012][ T803] legousbtower 3-1:14.57: interrupt endpoints not found [ 367.281129][ T30] usb 2-1: USB disconnect, device number 42 [ 367.289133][ T5611] Bluetooth: hci4: command 0x0406 tx timeout [ 367.319352][ T29] audit: type=1400 audit(1785061432.738:620): avc: denied { write } for pid=11422 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 367.326024][ T24] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 367.413816][ T29] audit: type=1400 audit(1785061432.828:621): avc: denied { write } for pid=11433 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 367.438517][ T30] ipheth 2-1:0.196: Apple iPhone USB Ethernet now disconnected [ 367.472962][ T803] legousbtower 3-1:14.228: interrupt endpoints not found [ 367.530287][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 367.543349][ T24] usb 1-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 367.553936][ T24] usb 1-1: config 6 has 1 interface, different from the descriptor's value: 3 [ 367.567691][ T24] usb 1-1: New USB device found, idVendor=0763, idProduct=2012, bcdDevice= 0.40 [ 367.581377][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.593361][ T24] usb 1-1: Product: syz [ 367.597533][ T24] usb 1-1: Manufacturer: syz [ 367.604168][ T24] usb 1-1: SerialNumber: syz [ 367.616408][ T24] usb 1-1: Fast Track Pro config OK [ 367.622888][ T24] usb 1-1: cannot find UAC_HEADER [ 367.675665][ T24] snd-usb-audio 1-1:6.0: probe with driver snd-usb-audio failed with error -22 [ 367.726286][ T29] audit: type=1400 audit(1785061433.138:622): avc: denied { write } for pid=11435 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 367.733682][ T5615] udevd[5615]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:6.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 367.787212][T11447] netlink: 'syz.3.1546': attribute type 1 has an invalid length. [ 367.831832][T11420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 367.837914][ T29] audit: type=1400 audit(1785061433.248:623): avc: denied { write } for pid=11448 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 367.846191][T11420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 367.877678][ T24] usb 1-1: USB disconnect, device number 52 [ 367.881709][T11447] 8021q: adding VLAN 0 to HW filter on device bond10 [ 367.918515][T11453] FAULT_INJECTION: forcing a failure. [ 367.918515][T11453] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 367.932363][T11454] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1546'. [ 367.935456][T11453] CPU: 0 UID: 0 PID: 11453 Comm: syz.1.1547 Not tainted syzkaller #0 PREEMPT(full) [ 367.935478][T11453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 367.935487][T11453] Call Trace: [ 367.935494][T11453] [ 367.935500][T11453] dump_stack_lvl+0x100/0x190 [ 367.935524][T11453] should_fail_ex.cold+0x5/0xa [ 367.935545][T11453] _copy_from_user+0x2e/0xd0 [ 367.935566][T11453] __sys_bpf+0x2f5/0x4e80 [ 367.935588][T11453] ? __pfx___sys_bpf+0x10/0x10 [ 367.935603][T11453] ? find_held_lock+0x2b/0x80 [ 367.935625][T11453] ? get_pid_task+0xfc/0x250 [ 367.935647][T11453] ? get_pid_task+0xfc/0x250 [ 367.935676][T11453] ? find_held_lock+0x2b/0x80 [ 367.935703][T11453] ? rcu_read_lock_any_held+0x6a/0xa0 [ 367.935717][T11453] ? find_held_lock+0x2b/0x80 [ 367.935739][T11453] ? ksys_write+0x190/0x250 [ 367.935761][T11453] ? ksys_write+0x190/0x250 [ 367.935797][T11453] ? fput+0x79/0x100 [ 367.935818][T11453] ? __x64_sys_bpf+0xce/0x140 [ 367.935833][T11453] __x64_sys_bpf+0xce/0x140 [ 367.935848][T11453] ? do_syscall_64+0x90/0x870 [ 367.935866][T11453] do_syscall_64+0x115/0x870 [ 367.935881][T11453] ? clear_bhb_loop+0x40/0x90 [ 367.935899][T11453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 367.935915][T11453] RIP: 0033:0x7fb41f79de99 [ 367.935929][T11453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 367.935943][T11453] RSP: 002b:00007fb420746028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 367.935959][T11453] RAX: ffffffffffffffda RBX: 00007fb41fa25fa0 RCX: 00007fb41f79de99 [ 367.935969][T11453] RDX: 0000000000000050 RSI: 0000200000000000 RDI: 000000000000000a [ 367.935978][T11453] RBP: 00007fb420746090 R08: 0000000000000000 R09: 0000000000000000 [ 367.935987][T11453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 367.935995][T11453] R13: 00007fb41fa26038 R14: 00007fb41fa25fa0 R15: 00007ffe1a823168 [ 367.936016][T11453] [ 368.285397][ T29] audit: type=1400 audit(1785061433.698:624): avc: denied { write } for pid=11456 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 368.308590][ T803] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 368.326616][T11465] ieee802154 phy0 wpan0: encryption failed: -22 [ 368.374167][ T29] audit: type=1400 audit(1785061433.788:625): avc: denied { write } for pid=11475 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 368.419184][ T29] audit: type=1400 audit(1785061433.828:626): avc: denied { ioctl } for pid=11476 comm="syz.3.1550" path="socket:[31000]" dev="sockfs" ino=31000 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 368.479159][ T803] usb 2-1: Using ep0 maxpacket: 32 [ 368.488871][ T803] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 368.506062][ T803] usb 2-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 368.530075][ T803] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.552739][ T803] usb 2-1: Product: syz [ 368.561425][ T803] usb 2-1: Manufacturer: syz [ 368.574301][ T803] usb 2-1: SerialNumber: syz [ 368.625935][ T803] snd-ua101 2-1:1.1: sample format descriptor not found [ 368.634862][ T803] snd-ua101 2-1:1.0: invalid num_altsetting [ 368.640876][T11484] netlink: 'syz.0.1552': attribute type 1 has an invalid length. [ 368.668492][T11484] 8021q: adding VLAN 0 to HW filter on device bond4 [ 369.095510][T11484] bond4: (slave geneve5): making interface the new active one [ 369.106315][T11484] bond4: (slave geneve5): Enslaving as an active interface with an up link [ 369.127845][ T803] usb 5-1: USB disconnect, device number 38 [ 369.204036][T11491] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1554'. [ 369.259600][T11492] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1553'. [ 369.279722][ T5710] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 369.454782][T11494] syzkaller0: entered promiscuous mode [ 369.460512][T11494] syzkaller0: entered allmulticast mode [ 369.493518][ T5725] usb 3-1: USB disconnect, device number 31 [ 369.509678][ T5726] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 369.579525][ T803] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 369.628888][T11499] ieee802154 phy0 wpan0: encryption failed: -22 [ 369.684260][ T5726] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 369.708781][ T5726] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.719627][ T803] usb 5-1: device descriptor read/64, error -71 [ 369.726273][ T5726] usb 1-1: Product: syz [ 369.730930][ T5726] usb 1-1: Manufacturer: syz [ 369.735583][ T5726] usb 1-1: SerialNumber: syz [ 369.989465][ T803] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 369.998703][ T5725] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 370.236432][ T803] usb 5-1: device descriptor read/64, error -71 [ 370.318477][ T5725] usb 3-1: config 0 has no interfaces? [ 370.362594][ T5725] usb 3-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 370.407083][ T803] usb usb5-port1: attempt power cycle [ 370.449254][ T5725] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.596319][ T5725] usb 3-1: config 0 descriptor?? [ 370.813073][ T803] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 370.896355][ T803] usb 5-1: device descriptor read/8, error -71 [ 371.200107][ T803] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 371.263226][ T5726] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 371.311145][ T803] usb 5-1: device descriptor read/8, error -71 [ 371.338675][ T5726] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 371.417214][ T5725] usb 2-1: USB disconnect, device number 43 [ 371.441513][ T803] usb usb5-port1: unable to enumerate USB device [ 371.848087][T11506] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6gretap0, syncid = 4, id = 0 [ 371.850708][T11489] IPVS: stopping backup sync thread 11506 ... [ 371.993527][ T5726] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 372.026193][ T5726] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 372.053896][ T5726] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 372.065993][ T5726] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 372.096607][ T5726] usb 1-1: USB disconnect, device number 53 [ 373.496440][ T24] usb 3-1: USB disconnect, device number 32 [ 373.534063][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 373.546169][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 373.609830][T11531] syzkaller0: entered promiscuous mode [ 373.628187][T11531] syzkaller0: entered allmulticast mode [ 373.777242][T11527] kvm: kvm [11526]: vcpu0, guest rIP: 0x9134 Unhandled WRMSR(0x11e) = 0xbe702111 [ 373.979806][T11540] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1570'. [ 374.712868][ T24] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 375.469862][T11545] syz.2.1571 (11545): drop_caches: 2 [ 375.481916][ T24] usb 1-1: device descriptor read/64, error -71 [ 375.954720][ T24] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 376.131550][ T24] usb 1-1: device descriptor read/64, error -71 [ 376.262055][ T24] usb usb1-port1: attempt power cycle [ 377.345036][ T24] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 377.407063][T11563] FAULT_INJECTION: forcing a failure. [ 377.407063][T11563] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 377.429581][T11563] CPU: 0 UID: 0 PID: 11563 Comm: syz.4.1576 Not tainted syzkaller #0 PREEMPT(full) [ 377.429606][T11563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 377.429617][T11563] Call Trace: [ 377.429624][T11563] [ 377.429631][T11563] dump_stack_lvl+0x100/0x190 [ 377.429656][T11563] should_fail_ex.cold+0x5/0xa [ 377.429678][T11563] _copy_from_user+0x2e/0xd0 [ 377.429702][T11563] copy_msghdr_from_user+0x9f/0x4c0 [ 377.429731][T11563] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 377.429767][T11563] ___sys_sendmsg+0x106/0x1e0 [ 377.429793][T11563] ? __pfx____sys_sendmsg+0x10/0x10 [ 377.429818][T11563] ? __lock_acquire+0x49f/0x1a40 [ 377.429841][T11563] ? get_pid_task+0x106/0x250 [ 377.429893][T11563] __sys_sendmsg+0x160/0x210 [ 377.429913][T11563] ? __pfx___sys_sendmsg+0x10/0x10 [ 377.429943][T11563] do_syscall_64+0x115/0x870 [ 377.429961][T11563] ? clear_bhb_loop+0x40/0x90 [ 377.429983][T11563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.430008][T11563] RIP: 0033:0x7fe446b9de99 [ 377.430022][T11563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.430038][T11563] RSP: 002b:00007fe447add028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 377.430055][T11563] RAX: ffffffffffffffda RBX: 00007fe446e25fa0 RCX: 00007fe446b9de99 [ 377.430066][T11563] RDX: 0000000004000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 377.430076][T11563] RBP: 00007fe447add090 R08: 0000000000000000 R09: 0000000000000000 [ 377.430086][T11563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 377.430097][T11563] R13: 00007fe446e26038 R14: 00007fe446e25fa0 R15: 00007fff96c395e8 [ 377.430119][T11563] [ 377.610985][ T24] usb 1-1: device not accepting address 56, error -71 [ 377.758219][T11576] xt_hashlimit: size too large, truncated to 1048576 [ 377.950942][ T3210] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 377.989584][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 377.989597][ T29] audit: type=1400 audit(1785061443.386:630): avc: denied { write } for pid=11575 comm="syz.3.1580" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 378.260839][ T3210] usb 5-1: device descriptor read/64, error -71 [ 378.969312][ T3210] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 379.263437][T11602] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1587'. [ 379.341280][ T3210] usb 5-1: device descriptor read/64, error -71 [ 379.357801][ T29] audit: type=1400 audit(1785061444.776:631): avc: denied { setopt } for pid=11597 comm="syz.2.1584" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 379.494502][ T3210] usb usb5-port1: attempt power cycle [ 379.558262][T11608] loop6: detected capacity change from 0 to 2640 [ 379.636048][ T29] audit: type=1400 audit(1785061445.056:632): avc: denied { compute_member } for pid=11609 comm="syz.1.1589" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 379.650699][ T24] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 379.725052][T11612] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20005 [ 379.728158][ T5615] Buffer I/O error on dev loop6, logical block 0, async page read [ 379.994455][ T5615] Buffer I/O error on dev loop6, logical block 0, async page read [ 380.006571][ T5615] Buffer I/O error on dev loop6, logical block 0, async page read [ 380.015180][ T5615] Buffer I/O error on dev loop6, logical block 0, async page read [ 380.025547][ T5615] Buffer I/O error on dev loop6, logical block 0, async page read [ 380.051820][ T3210] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 380.065190][ T29] audit: type=1400 audit(1785061445.416:633): avc: denied { append } for pid=11607 comm="syz.3.1588" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 380.098418][ T3210] usb 5-1: device descriptor read/8, error -71 [ 380.156052][T11611] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5616] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[11611] [ 380.181773][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 380.193876][ T24] usb 1-1: too many configurations: 52, using maximum allowed: 8 [ 380.205058][ T24] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 380.213034][ T24] usb 1-1: can't read configurations, error -61 [ 380.381179][ T24] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 380.388809][ T3210] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 380.426069][ T3210] usb 5-1: device descriptor read/8, error -71 [ 380.544478][ T3210] usb usb5-port1: unable to enumerate USB device [ 380.573047][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 380.583349][ T24] usb 1-1: too many configurations: 52, using maximum allowed: 8 [ 380.612573][ T24] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 380.621478][ T24] usb 1-1: can't read configurations, error -61 [ 380.631995][ T24] usb usb1-port1: attempt power cycle [ 380.701173][ T5703] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 380.792112][T11620] syzkaller0: entered promiscuous mode [ 380.797879][T11620] syzkaller0: entered allmulticast mode [ 380.897925][ T5703] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 380.924743][ T5703] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 380.951225][ T5703] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 380.981227][ T24] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 380.989051][ T5703] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 381.029596][ T5703] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.043607][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 381.062730][ T24] usb 1-1: too many configurations: 52, using maximum allowed: 8 [ 381.084731][ T24] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 381.093505][ T5703] usb 2-1: config 0 descriptor?? [ 381.111451][ T24] usb 1-1: can't read configurations, error -61 [ 381.144344][T11622] syzkaller0: entered promiscuous mode [ 381.162421][T11622] syzkaller0: entered allmulticast mode [ 381.265134][ T24] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 381.370162][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 381.415695][ T24] usb 1-1: too many configurations: 52, using maximum allowed: 8 [ 381.506129][ T24] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 381.566144][ T24] usb 1-1: can't read configurations, error -61 [ 381.617687][ T5703] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 381.643277][ T24] usb usb1-port1: unable to enumerate USB device [ 381.673210][ T5703] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 381.750679][ T5703] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 381.834758][ T5703] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 381.906616][ T5703] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 382.308327][ T29] audit: type=1400 audit(1785061447.645:634): avc: denied { bind } for pid=11617 comm="syz.1.1591" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 384.280833][T11636] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1596'. [ 384.553118][ T5703] plantronics 0003:047F:FFFF.001D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 384.786781][T11639] siw: device registration error -23 [ 384.826977][T11639] smc: removing ib device syz2 [ 384.868550][T11639] smbdirect: ib_dev[syz2] removed [ 385.351053][T11639] ------------[ cut here ]------------ [ 385.356556][T11639] !xa_empty(&pool->xa) [ 385.356566][T11639] WARNING: drivers/infiniband/sw/rxe/rxe_pool.c:116 at rxe_pool_cleanup+0x46/0x60, CPU#0: syz.2.1597/11639 [ 385.372158][T11639] Modules linked in: [ 385.376200][T11639] CPU: 0 UID: 0 PID: 11639 Comm: syz.2.1597 Not tainted syzkaller #0 PREEMPT(full) [ 385.385598][T11639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 385.395650][T11639] RIP: 0010:rxe_pool_cleanup+0x46/0x60 [ 385.401095][T11639] Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 29 48 83 bb 80 00 00 00 00 75 0b e8 56 19 26 f9 5b e9 10 de d9 02 e8 4b 19 26 f9 90 <0f> 0b 90 e8 42 19 26 f9 5b e9 fc dd d9 02 e8 57 9f 96 f9 eb d0 0f [ 385.420711][T11639] RSP: 0018:ffffc9001ca7f180 EFLAGS: 00010246 [ 385.426774][T11639] RAX: 0000000000080000 RBX: ffff88805456d398 RCX: ffffc90006139000 [ 385.434744][T11639] RDX: 0000000000080000 RSI: ffffffff88e44355 RDI: ffff88805456d418 [ 385.442719][T11639] RBP: ffffffff88e29d80 R08: 0000000000000005 R09: 0000000000000001 [ 385.450663][T11639] R10: 0000000000000002 R11: 0000000000000000 R12: ffff88805456c698 [ 385.458677][T11639] R13: ffff88805456bfe0 R14: ffff88805456bfe0 R15: ffff88805456d0f8 [ 385.466656][T11639] FS: 00007f6cceff86c0(0000) GS:ffff888123dde000(0000) knlGS:0000000000000000 [ 385.475587][T11639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 385.482174][T11639] CR2: 00007f9af672d0c0 CR3: 00000000778e8000 CR4: 00000000003526f0 [ 385.490133][T11639] Call Trace: [ 385.493412][T11639] [ 385.496319][T11639] rxe_dealloc+0x25/0xc0 [ 385.500541][T11639] ib_dealloc_device+0x49/0x230 [ 385.505408][T11639] __ib_unregister_device+0x396/0x480 [ 385.510942][T11639] ? __pfx_rxe_ns_pernet_set_sk6+0x10/0x10 [ 385.516745][T11639] ib_unregister_device_and_put+0x5a/0x80 [ 385.522467][T11639] nldev_dellink+0x308/0x430 [ 385.527043][T11639] ? __pfx_nldev_dellink+0x10/0x10 [ 385.532219][T11639] ? rcu_is_watching+0x12/0xc0 [ 385.536962][T11639] ? cap_capable+0x107/0x430 [ 385.541532][T11639] ? bpf_lsm_capable+0x9/0x10 [ 385.546221][T11639] ? security_capable+0x80/0x260 [ 385.551144][T11639] ? ns_capable+0xd2/0xf0 [ 385.555467][T11639] ? __pfx_nldev_dellink+0x10/0x10 [ 385.560567][T11639] rdma_nl_rcv_msg+0x392/0x6f0 [ 385.565344][T11639] ? __pfx_rdma_nl_rcv_msg+0x10/0x10 [ 385.570620][T11639] ? __lock_acquire+0x49f/0x1a40 [ 385.575573][T11639] rdma_nl_rcv_skb.constprop.0.isra.0+0x2cb/0x410 [ 385.582007][T11639] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 385.588926][T11639] ? netlink_deliver_tap+0x1ae/0xcc0 [ 385.594218][T11639] netlink_unicast+0x585/0x850 [ 385.598957][T11639] ? __pfx_netlink_unicast+0x10/0x10 [ 385.604240][T11639] ? __pfx_sock_has_perm+0x10/0x10 [ 385.609331][T11639] netlink_sendmsg+0x8b0/0xda0 [ 385.614304][T11639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 385.619576][T11639] ? selinux_socket_sendmsg+0x198/0x2f0 [ 385.625137][T11639] ____sys_sendmsg+0xa4d/0xbe0 [ 385.629882][T11639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 385.635173][T11639] ? __pfx_____sys_sendmsg+0x10/0x10 [ 385.640463][T11639] ___sys_sendmsg+0x190/0x1e0 [ 385.645147][T11639] ? __pfx____sys_sendmsg+0x10/0x10 [ 385.650333][T11639] ? __lock_acquire+0x49f/0x1a40 [ 385.655289][T11639] __sys_sendmsg+0x160/0x210 [ 385.659857][T11639] ? __pfx___sys_sendmsg+0x10/0x10 [ 385.664989][T11639] do_syscall_64+0x115/0x870 [ 385.669565][T11639] ? clear_bhb_loop+0x40/0x90 [ 385.674246][T11639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 385.680112][T11639] RIP: 0033:0x7f6cce19de99 [ 385.684538][T11639] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 385.704189][T11639] RSP: 002b:00007f6cceff8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 385.712612][T11639] RAX: ffffffffffffffda RBX: 00007f6cce425fa0 RCX: 00007f6cce19de99 [ 385.720568][T11639] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000007 [ 385.728541][T11639] RBP: 00007f6cce233eaf R08: 0000000000000000 R09: 0000000000000000 [ 385.736521][T11639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 385.744513][T11639] R13: 00007f6cce426038 R14: 00007f6cce425fa0 R15: 00007ffed7a03108 [ 385.752491][T11639] [ 385.755491][T11639] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 385.762764][T11639] CPU: 0 UID: 0 PID: 11639 Comm: syz.2.1597 Not tainted syzkaller #0 PREEMPT(full) [ 385.772120][T11639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 385.782155][T11639] Call Trace: [ 385.785416][T11639] [ 385.788322][T11639] dump_stack_lvl+0x100/0x190 [ 385.792979][T11639] vpanic+0x552/0x970 [ 385.796932][T11639] ? __pfx_vpanic+0x10/0x10 [ 385.801416][T11639] panic+0xd1/0xe0 [ 385.805110][T11639] ? __pfx_panic+0x10/0x10 [ 385.809504][T11639] check_panic_on_warn.cold+0x19/0x34 [ 385.814851][T11639] ? rxe_pool_cleanup+0x46/0x60 [ 385.819684][T11639] __warn.cold+0x191/0x318 [ 385.824076][T11639] __report_bug+0x30f/0x440 [ 385.828564][T11639] ? rxe_pool_cleanup+0x46/0x60 [ 385.833387][T11639] ? __pfx___report_bug+0x10/0x10 [ 385.838386][T11639] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 385.844169][T11639] ? flush_workqueue_prep_pwqs+0x2e9/0x510 [ 385.849953][T11639] ? __flush_workqueue+0x426/0x1200 [ 385.855131][T11639] ? rxe_pool_cleanup+0x46/0x60 [ 385.859955][T11639] report_bug+0xb2/0x220 [ 385.864180][T11639] ? rxe_pool_cleanup+0x46/0x60 [ 385.869002][T11639] handle_bug+0x16a/0x2a0 [ 385.873317][T11639] exc_invalid_op+0x17/0x50 [ 385.877795][T11639] asm_exc_invalid_op+0x1a/0x20 [ 385.882626][T11639] RIP: 0010:rxe_pool_cleanup+0x46/0x60 [ 385.888066][T11639] Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 29 48 83 bb 80 00 00 00 00 75 0b e8 56 19 26 f9 5b e9 10 de d9 02 e8 4b 19 26 f9 90 <0f> 0b 90 e8 42 19 26 f9 5b e9 fc dd d9 02 e8 57 9f 96 f9 eb d0 0f [ 385.907654][T11639] RSP: 0018:ffffc9001ca7f180 EFLAGS: 00010246 [ 385.913692][T11639] RAX: 0000000000080000 RBX: ffff88805456d398 RCX: ffffc90006139000 [ 385.921643][T11639] RDX: 0000000000080000 RSI: ffffffff88e44355 RDI: ffff88805456d418 [ 385.929584][T11639] RBP: ffffffff88e29d80 R08: 0000000000000005 R09: 0000000000000001 [ 385.937528][T11639] R10: 0000000000000002 R11: 0000000000000000 R12: ffff88805456c698 [ 385.945470][T11639] R13: ffff88805456bfe0 R14: ffff88805456bfe0 R15: ffff88805456d0f8 [ 385.953425][T11639] ? __pfx_rxe_dealloc+0x10/0x10 [ 385.958342][T11639] ? rxe_pool_cleanup+0x45/0x60 [ 385.963176][T11639] rxe_dealloc+0x25/0xc0 [ 385.967396][T11639] ib_dealloc_device+0x49/0x230 [ 385.972223][T11639] __ib_unregister_device+0x396/0x480 [ 385.977583][T11639] ? __pfx_rxe_ns_pernet_set_sk6+0x10/0x10 [ 385.983365][T11639] ib_unregister_device_and_put+0x5a/0x80 [ 385.989062][T11639] nldev_dellink+0x308/0x430 [ 385.993637][T11639] ? __pfx_nldev_dellink+0x10/0x10 [ 385.998772][T11639] ? rcu_is_watching+0x12/0xc0 [ 386.003514][T11639] ? cap_capable+0x107/0x430 [ 386.008097][T11639] ? bpf_lsm_capable+0x9/0x10 [ 386.012760][T11639] ? security_capable+0x80/0x260 [ 386.017691][T11639] ? ns_capable+0xd2/0xf0 [ 386.022002][T11639] ? __pfx_nldev_dellink+0x10/0x10 [ 386.027102][T11639] rdma_nl_rcv_msg+0x392/0x6f0 [ 386.031856][T11639] ? __pfx_rdma_nl_rcv_msg+0x10/0x10 [ 386.037118][T11639] ? __lock_acquire+0x49f/0x1a40 [ 386.042033][T11639] rdma_nl_rcv_skb.constprop.0.isra.0+0x2cb/0x410 [ 386.048437][T11639] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 386.055448][T11639] ? netlink_deliver_tap+0x1ae/0xcc0 [ 386.060715][T11639] netlink_unicast+0x585/0x850 [ 386.065453][T11639] ? __pfx_netlink_unicast+0x10/0x10 [ 386.070709][T11639] ? __pfx_sock_has_perm+0x10/0x10 [ 386.075798][T11639] netlink_sendmsg+0x8b0/0xda0 [ 386.080535][T11639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 386.085801][T11639] ? selinux_socket_sendmsg+0x198/0x2f0 [ 386.091411][T11639] ____sys_sendmsg+0xa4d/0xbe0 [ 386.096150][T11639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 386.101406][T11639] ? __pfx_____sys_sendmsg+0x10/0x10 [ 386.106673][T11639] ___sys_sendmsg+0x190/0x1e0 [ 386.111329][T11639] ? __pfx____sys_sendmsg+0x10/0x10 [ 386.116547][T11639] ? __lock_acquire+0x49f/0x1a40 [ 386.121492][T11639] __sys_sendmsg+0x160/0x210 [ 386.126071][T11639] ? __pfx___sys_sendmsg+0x10/0x10 [ 386.131170][T11639] do_syscall_64+0x115/0x870 [ 386.135736][T11639] ? clear_bhb_loop+0x40/0x90 [ 386.140396][T11639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 386.146354][T11639] RIP: 0033:0x7f6cce19de99 [ 386.150741][T11639] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 386.170322][T11639] RSP: 002b:00007f6cceff8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 386.178709][T11639] RAX: ffffffffffffffda RBX: 00007f6cce425fa0 RCX: 00007f6cce19de99 [ 386.186652][T11639] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000007 [ 386.194594][T11639] RBP: 00007f6cce233eaf R08: 0000000000000000 R09: 0000000000000000 [ 386.202542][T11639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 386.210498][T11639] R13: 00007f6cce426038 R14: 00007f6cce425fa0 R15: 00007ffed7a03108 [ 386.218465][T11639] [ 386.221663][T11639] Kernel Offset: disabled [ 386.225961][T11639] Rebooting in 86400 seconds..