last executing test programs: 3m46.394818991s ago: executing program 32 (id=1021): socket$inet_icmp(0x2, 0x2, 0x1) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = signalfd(r2, 0x0, 0x0) r4 = openat$incfs(0xffffffffffffffff, &(0x7f0000000b80)='.pending_reads\x00', 0x1090c1, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000bc0)={{{@in6=@dev, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private2}, 0x0, @in6=@empty}}, &(0x7f0000000cc0)=0xe8) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x3, 0x13, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff400, 0x0, 0x0, 0x0, 0x9}, [@printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}, {0x85, 0x0, 0x0, 0x17}}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$unix(r2, &(0x7f0000000e00)={&(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000000940)=[{&(0x7f0000000300)="76a7c6415bec6e0dbcb81df45134bc6449f697abe1e6727d38c13002955a349344eef1f452809b3936526d139c9374935865bcaae8cf0e00d0ee027ab1391e4e9d6a2072d9787cf392503716374c192993a9931bbbbac70a3ff9e961dc0b5a5d5b3497baae3f791cfb85c66bdaec992625b678a22456ec4d81ed16fcc9b54f22fd33cbbcc681c2634e03fae94cd794ebe2299da7b75f15ff336cf7d2591457cfbcaf47806636179ac922bd15cc94946e5ab5a1cdb2df50af2155a8e5719fb5d37d865d483d2f23afef65f9f6cf4b46c9ecf6ac4257ac68743093", 0xda}, {&(0x7f0000000400)}, {&(0x7f0000000440)="fa47dc2a426565738410210dcd8f0393844d766780e7f4b5948cdd635c430b08da8df85013d4d4a6", 0x28}, {&(0x7f0000000540)="72b38e6e087bfb74a366b4ac40d688eb9400a3d455bdc8b788b73556acac3e5ee0c5d413c93bdf4a93da5b39657b1ea61c707b3ee80bef0e90eccfe680d6a7fb28f4a7083093709f1344d830840e6339d601af9566911d5dae54ba2b13ed6d886bf2d4a3575579cb0a10490808e3079e901ac7682f41e9dac3823e74dc08fc7e1dd46d03c80b52c502a80a2816d5255f2ae39d7d343844e1c17ee4388ef0671ddf60bcbd286b38ee1dd021cd728c4cf51072a1c4f3bae0d2944232ad57817c2326494c4de9a5111440ba220439fdbfd6", 0xd0}, {&(0x7f0000000640)="56d7ae012a2fbf03dedab3f58e7e1d9e02b8282a935d5a5be5766f7a10f59745c1fd556bda3d6d9d50e4074e4a4b0913f668e0fc3a9c0a511391f710c568613ecaf648f4b2580e6f21c7579ce0c50ba86a15b0aa37c5456f534bfee0fac32abb6cbfaa2251c7cb9b8c3cfbd5523a605e6d323a8b8a47c73f3cf91d691c8f815963b219627f9fe333dbab36478188746ccf083f0a995141a5f2424a3a87b2ff9c67be130f41d64a093369e4ef61fcec4e5f23dd8062f6be0805e0b7f596a5428be6a5ed623e1283952025df8a74812716683afaba06440f82df22dbc7fb09c28a5965dfca4eed503d", 0xe8}, {&(0x7f0000000740)="a1a4c4cc21e94459f1f86d5e64f0c22316109180feee1b9c8561c4620fcbe9ab9d75a97d8f459e14de24da1e24fdd4a9ff3b586a134a4410d592088eed7c898322eda927c10ead7f4175bb98b69f9fdf4f2a758d6e7869ecf01d47699954a61545872ce948337f8ad5d115b4517b2aa1e49531d9df7d1009a2f2ebbc1c6eb77715e36abcf6f409c5766492ce831797cc6a176ca94ddd92e934f74d472dd1b1e2eddccf1df061dfad8d05e6549073b23322dc822c48c18dd1f793508797529e80", 0xc0}, {&(0x7f0000000840)="888b0bd1772a376a12ec114fc6a589db87b31d8a4c4bbb79168c7583ebb41a2f8819617630bd7dfa5758685afe3b96cd8f6433eedd65e1afdeabd55e365845fca66a31be8b35512b2d33b47babd341f8bea234e5ff84c7fa6d62870ace8b26a00e0ac75946fbc37ee2f5a0a3bf57b3ed3cc7df9c15283cb57dfef2622a5b6008d67932604bebb4c98d52d6b7ed450e201b027573c2db581e7b0131d76a6ed35266ec4590153f20e281b504911992", 0xae}, {&(0x7f0000000900)="3062b2cfdb98a53a9cff4c47a193dd31870a7aaf7ef44a759fb4d22f1f681fe5", 0x20}], 0x8, &(0x7f0000000d00)=[@rights={{0x24, 0x1, 0x1, [r1, r2, r1, r1, r1]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, r2, r2, r3, r1, r4, r2, r2, r1, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [r2, r2, r1]}}, @rights={{0x10}}, @cred={{0x1c, 0x1, 0x2, {r0, r5, 0xffffffffffffffff}}}, @rights={{0x18, 0x1, 0x1, [r1, r6]}}], 0xe8, 0x20004044}, 0x20000840) chdir(&(0x7f0000000140)='./file0\x00') r7 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r7, 0x0, 0x0, 0x1000f4) sendfile(r7, r7, 0x0, 0x40000000800) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) fallocate(r8, 0x100000000000011, 0x2000, 0x2f93) 3m5.912155601s ago: executing program 33 (id=1151): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x300) syz_open_dev$video4linux(&(0x7f0000000040), 0x8e3, 0x88800) close(0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0x7, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) open(&(0x7f00000000c0)='./file1\x00', 0x66842, 0x21) bind$pptp(0xffffffffffffffff, &(0x7f0000000100)={0x18, 0x2, {0x0, @private=0xa010100}}, 0x1e) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000010000c0000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a31000000002c000000050a01020000000000000000010020000c00024000000000000000010900010073797a"], 0xc8}}, 0x0) 2m19.343676302s ago: executing program 34 (id=1254): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x777) r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='0', 0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) (fail_nth: 1) 2m15.391017743s ago: executing program 35 (id=1269): bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0a000000400000000600000008"], 0x50) socket$netlink(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001240)=ANY=[@ANYBLOB="cbe4d4f299449a37ad3b0a619ce7e9a939839300560d95546cb2c3120e1756ffbb48dfd4ed6b44aa89b67350fd28fa3c7a5e0662281a6069e0bd64f939c9b31812a921e537e0dc8b9b2708ea2fc75412c80edb44caf828f34f23a73b49ecd5b123c71ed9a167f1e1e4e34c9c10f94587b2a909b9af8d9a15f98985a2ae74e505af18732601f76122999c6d"], 0x2c}}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x340, 0x168, 0x6c, 0x0, 0x0, 0x0, 0x270, 0x258, 0x258, 0x270, 0x258, 0x3, 0x0, {[{{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @local, [0xff, 0xffffff00, 0x1000000fe], [0xff000000], 'macvlan0\x00', 'rose0\x00', {}, {0xff}, 0x2f, 0xf2, 0x0, 0x20}, 0x0, 0x100, 0x168, 0x0, {}, [@common=@srh={{0x30}, {0x5e, 0x2, 0x8, 0x4, 0x6, 0x208, 0x858}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x5, '\x00', 'syz1\x00', {0x1}}}}, {{@uncond, 0x0, 0xd0, 0x108, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x4000, 0x0, 0x4}, {}, {0x0, 0x4}, 0x0, 0x7}}}], {{'\x00', 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2001}}, {0x28}}}}, 0x3a0) socket(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv', 0x2) write$binfmt_script(r1, &(0x7f0000000200), 0xfffffd9d) 2m10.973124967s ago: executing program 36 (id=1284): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x29, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioprio_get$uid(0x3, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}}) r4 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r4, 0x404c534a, 0x0) r5 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r5, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="1695", 0x2}], 0x1}}], 0x2, 0x48000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10) unshare(0x42000000) 2m6.552589526s ago: executing program 37 (id=1295): r0 = creat(&(0x7f0000000100)='./file0\x00', 0x100) newfstatat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) chown(&(0x7f00000003c0)='./file0\x00', r1, 0xee01) lsetxattr$system_posix_acl(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='system.posix_acl_access\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="020000000100010000", @ANYBLOB="04000000000000001000020000000000200000000000000034ee09c3ffc416cf3a0c5984140d3e4ecfd5216a6b94a74abd57b68f441579737694e7e8e1b43d955808d675886f2b8ff5ca71625995c0e1339b34171cb78fe42d59f5c3cb64d0915d5295ac33227c8390c7ef064fc3c066e6069d65183eacae1e3edd"], 0x2c, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x5, [@enum={0x3, 0x1, 0x0, 0xf, 0x4000000, [{0x10}]}, @restrict={0xe, 0x0, 0x0, 0xb, 0x1}]}, {0x0, [0x0, 0x0, 0x2e]}}, &(0x7f0000002200)=""/4110, 0x3d, 0x100e, 0x1}, 0x28) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) syz_emit_ethernet(0xf87, &(0x7f0000001180)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0xf51, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[@routing={0x84, 0x0, 0x0, 0x6}], "223427d5c9a46b9fa14172170a013589317d2af31ba55431762f462a5abc3f46494ee91bfca594d52f8c3785143e92da5d2d81edc09f68f122fbf741257bf1319408347a17c89212dfe27a0fc65362487e5afe673f0954f60d9d08b61276ce0b3aa520b5f30a9f52c4aa53fc003f8570383ca63530d93b78a7875338b3d7645ef2c24ab05db63cfdcde7b3cac2248c9d1c73d0d4382b3f520ad6e9be698eaa9bf5b939ce09919c9485c4725690ee2483315829a196f85a5ae552ebe19a2d6768ce2a6bf60fbb53104c7919b7cf28fa555fc9460df11e72eddebb2fc4eb6f83b16e0d65307e4210dfc209f0c68df65b57f420fd215546b798af6b6ab7bfb2fe6bd6142f877852717370b1ca39d199c149c3ead97c4e16229ce4c08a111a0fc64651c21e9174dd72442a9ae2a42d9433c7b54c8dd4b59203f9a2e227e9b043eb430e606cf98f3428ac8511948dd553bc0728c0626fbda71bd2a1d734d605e27bdb0be93b7b91284689e31fccb70c15f2c39da9011c84d36fe4b4b36ff26e45a34685fc638dbdaa068a3d3d4f5d44b74afc0fc7956e5fcc3fe405ac6d292d1d90f257f18fe14a3192d28ed369956aa2f91f9fee773cf7fb5d90705347eeadc1af86de78a498fa1a20e5b3f481a0595769654d969299506d8ffbc172a7fb9453a8a3787e80b167936863f2cc16c1d03481bd40e1abcf87a292559771572136932bf30e48174012a1d4d5f138f93140af2ceb9c821c7966ea7592d762975b5b33ef141b6b91eb388c91b924945c3231d0f299adb5a36e0c95a17872e7ebf0bc0e33baf5c46f9e2087b77bad0794d519ce7bc8674a70f3545d020454ded22f164185df3b4f952b132947b75333993fd73a6bac5836dd5720e559bcb82a4926734c5c3b1287c5fec219a99f71eb398430001f007306e9232c269c2886357f75d935e8de054341ac36f1df1fc77fbc347d90660f4d5658cfeb9e289f70968a7c0b38ae34c4bfa46b47964e223ac34f472e3231e8c285add5713592c76c062c3477beb55b279846f04f8d6a5ce2743c6a2020f0c5164953b8dca7e57239dc8a7f507bcf77767ab0b4602437171a09c8e80f5a165c4c37eaae386cfcb927dd1a935fa717fa1608792b34bafbc20cf11a678455894ede62788309ab7a7075535847a2b48260a613e521b01d75648263ad78e6176528dbf3e6c4e4d72066e617be5387183a51dd97d2e846c5d173b51e17a4c8d78a49c914cbe44236c52c78de45b44f9d80bc6f77c75135922a84579bce77baa71311889f5b7b90c5124b8298d5e9c81c442d60df00795854d3213a1ac254c8963c109f68b3ff5451c381f6fb56c116f86b71f988d1e9f732280cbf3d4e9791fefc4bdec5dc293fb77b02d5aab6bd8cd179b7e425126b7f78c0d004bc6470ecc2bbc422bd06a6bd8f717009509e6a88b01347b7a62b9dea6f7a7446a371f422499a6e66eeb6a7b0beb4a86a61f875a9bfe0f5d5f0d0e4c85852afaea97d74ebc80d6491a8a1c998c4b5bc34b3edaeba2df902cd5e14e016720e6c3c8b15287b2471c34251e26dc442720cd5d984e30b110b7370f233f865b9ac129fdf49ff02b303d7d4f91039d3bb58a9d64d7a72d8b8eba6b45a000370d4f0e9c0d411768441372e7112e5d4e7d70a9d6b428b8b85ee6209d6f73e7b024740c052166deeb843e4ab78d1d354d75a5827ff0d49d8964e75785f3594c7299c0917b48f3b2efb81a4c3a7d6e0f1cf50efe0360963c2e3ee390ed2a4c39f42e856eced0f2ee7beacd2ecbece493e911ca0460584323ea6d4a0c00864693c979cae38f0c5841bfaeebf609d1075163c120fea0bd0207d2dd07e5e2e0a5afe3efee0ee6bb9a926a8dba7a27a82c5421a5b20bfb5dbdef532a12435fcd899f15603209831711e0dcfaaf2104b2016f087fce44848c70b65a34b9be83df2064391fc5a8d169dc1943d226e57ab5ba06c656273d4efba73a8a61aae19df4d2445f3ce7e649af1b4ffc86106c9092ddd0aafeb45653d181cb32b06a1dd41573495f15c3b8c0019ba72a2eb163dfcbdbb235322ae27d7116af506f295c2424ab9191aa8ce0e4617b212af21983f8d2b19d7fdeec881f6fa448acc7c3e133b6f281583fad4467c05801e69f6ffc1ae2e1f54655534d884c2f8f60303da33ccbe47a293643edb61c7d9fad4e3e54028bc64be8e5b1da53446869b136660b8e96ff96c48641ece275967b27b291c5c240b3399b5b901b699227735f821938bc88ded45bada2b257b1a4bcab7ed6647f2027e5680c87329e9cfdba6bde2f2a9b676be016001702bebbabb2eae3eba01d6f49ab70245a4c5ef0e136b531e1843487b3f69c5b811217d6d2f5e71b47f40c28117bd09a88bb21887a06e2cc164d4281d0df47cbd5781f1524098d89ccae32f24c5f9d86469106685fdc683ad5e873030b621dc00354e0621106da90aca69bb53848dd57251a45bc1898aca9bc84c9a8d2f8aabeed888560771c8cb03aab02620430fec8e9740880790060ccbffd5b8edaa219ca61587eff1b1b03ae8af53059f121efdec8b3ee8aba06f494a5b4575bc848d5a9773d2346f75811cb82a078fc960c9bd374555d78b1b4ba0b438ef00e8aa75810ca5efc5c70936e2cb0e515912cb7f625a2130a9ad58f29e58ae6eac5c3f15f22f0163ee6dead6947c4390b92c8dfb146fec7bfc0b37e8ff2c9de90c30f2d8b5e334107f9835bc47fbc193c60ebd5ac4e677c7fd5b6261ff96e97c185c726ec02941bc2336946f181fd2aff43f0e95f06105a049fcb8e4e3738407d6356856f533f17fae281a3be9f2050ae3d19d1b8350d424087ac9b7875824a9b7e098775b53d6ec960fc052ecd165d17a7897de75f15316a072bb9ccf6ce1ec085bb5356c271b985a437a32f12308fc927410fd444bcded9859e7b8a3cfaaf29ebfb92cc7cbfad2559bbe4f90e189e8708e93827b221869cc78fa41fd5bcb6577b7dfe4c3927dc25a58aa84419f76e71d1f3c10cbb5e52ab2bebe0d39bdffda0fa1b55fe3a03683f882a82dd58498d62b101acd710fd436aa7409fe3cf5352dffb399d560323e14d564bdb3121b89c1f43fc9a892b799cd32f7ce2ededb868920b4547735ef0bf3e148251a4f65dddb7f96b2f33734522a8cffdc51520ac98926b3406e96618cf15a042a67239e755afc70ec6a9c99f8e08ec2946e5901364d85223a63d49572519137d93b6b0798e72acf9da120e706ee73367dec1450a68def886c149bcd734469e10b933899501011cd548e99d638821d5709fde050ab382d4896ecfd7999d40ea9c690c26d396545224c8f9e19705593df2688eb592e2476a0193f7054ab6f703d41c545a80bf285bbc7cc735bd306c9ea5eb64f40752fd4c741d9b6e03cd41b636ef8f5e810047a21c0b24c6fde1f2e98f2f27730c90d93af9e7564e4e209a61ff626b666fcc4f75f7d560da688169ff0af5e674a0b89a99fb54bb438a65f953c2db0faec2ce09cec33b6d25620b5a0393ac473fed48a38beaca5223997419876d571ce969b83b5b3ae54de83dd89fd92ed2a93c087828bef49a24ed1a97778c47fdc691a94fd5b437dfe494b5c6fadf499d9d15583b0439d3d5ecb61a32a2508a6960be6009accfd1d5d75a16dbc4121c6ef07bda12646792449c18a56e7aa3893f3f0e55a8e09ca64193dd29ea24ed8614ee8e717f046dd99a8e3750506655331125a502aa89c0d7e8e30c36a4be22cd911322695144d3bf034f38ef32d49431d50da583d08a3e4c5862483cdd52d031b12c89fdaafc3334e877e464134baece883d301193a9c27311a987d4dae82a061f48182cc747cd64441e88b68e26e4975f0fdde3129a9e6af80009962581d5349676df9c73b81514b175709d9193749660f480bd4009b528c1db4f76f42b6a175126603c39a374e890f871c97b2eebb4500451d827cc15497dc5ae89edc6f47f25db7efa4b4b2afbbb2ee543e3db8d20fe93faf300247f59075921e8b2f2a025af8a1d46f274e0c6cb4be0293c7c16c88e98d7d189e9733e4c0e3b96be4aa3fa6ecf42732e0b1432d38aeaf2330d92713cd5580ce42bfe47fb98fea64783de23f456300dd193008211a5ba408d32dedbf12aa8237a6e1a2c9890a2c1011855241fea186906a5139d1c300be57dc7ff493de80010520d10fc3eda0ee9cd413e075d3dc02258fdab567a16e43edbeecc366a69d8d75512f43a2b79cbb9132cdcd00c531730d05f1eabf66613d6e7ebb8c4c3f4f7efd415d41049786352808b22a3bde40121968af39c8f00296001662adc72b7963c8bafab4a496b50f3237a29d19ad4a51a62b1c77a04c14004734189cf7ec49e3d041a1e5658d080f09df77f39782e7133968c1f39ab3ae2a5f24a60073288f3c5825dafd614a379b8b905aaf961caa14ffa38de0d632918d31e4a9291b0f0789248e232e4276840a1ed0257300e522d83111dffd424b1b33148981e3794b2b649ba9174e6697bcc96049f4f3dcc7cf4ca97e2006ec8a146014bb49184632e4fb159a34b6530e959e60a6b4e0427cc697f14cfe6bb7a662a6f5012744f3cf2307abc19c58449864d98fcfebc5d598cd32a1c38c207896468fe8da75eb1edb1d6e7cb1eab671e4e92f139c81d79f15df2a2dc075acc982dec769e2f49aad0fdf594cb590e054616e4f4582b6c4a149ae45d844903ef68d211df2a180178e178b7c7a5012ccf8a1e677586588620365e6111f5192ecfdbd97e2284128de02e08ebc13d4bb4d114faa1e6c16c51c12da2c52d68f73640ce866ce4e794b9fafdc392c91c1f824bc301b3069a02b9c86d2ffac3ed63ddee130cbc248d6a3345d3f9553db78077072d569a6633f8bdbdb1a209a8be9b6830225994f9021b57ddd6a44e8ea40b205c6cf437f45bffaef053a5916dcc6de62ee02bdb8ce3acec8ad97fc95dab1307d254790c71f32e4678957cf0121dccabe73a03c6cacbcbdaad8801b04d9836555a982c357a06e2db7e9bf62aed8cdebbb7a71a2410b929015b61f16e54bffd038996a717b9c7cc3696d8a1205e8266bf782c3a45b0e31461d6a3ed62396088833f69248b24fbf6f81dcc08b98826c3bd2325ade54f614f2d4a153e3e3527d93978483f2bfeada6b64bc43f2a725c30e843d13e6ab34cfc38d488b3ef50cd04318fac1f89905f017644cfa2de058ad399871d1316264813c2289d0b6cfeddfbca36ce93fd4a1bfc93bb74453cfbb9c6ca22320ffc9cb0a3fff046a5678c066e617cd3ac024dfead04b99877f448b78208938585c7563efe815ff0cc47da5fff521d9730ddc89f4aeceadd06f2ea6b9ae72c9407aa550a0155db3b4bc6aaa382a30552f699cb6a1af9972a8ccc483f98952dfbde3d712ea8673eacdbb77490d833fc90f0f02e7c073d2917db70831496a88defc10667dc4c1b7399191bdc7857eb090e79c332bf9f71bb5377178e6232800c93d22318dc5ab8d5dfa2f074a6c23acb61c89f2f078ec91e9817e11a4c8295c19634b5ca2df74"}}}}}, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f00000003c0)={'comedi_parport\x00', [0x140, 0x0, 0x7, 0x0, 0x2, 0x4, 0x4, 0x2, 0x7, 0x2, 0x4000004, 0x7, 0x3009, 0x8, 0x400004ce, 0x9e9b, 0x40103, 0x80000006, 0x6, 0x2, 0x7, 0x2, 0x2f, 0x81, 0xffd, 0x6, 0xab, 0x1, 0x283, 0x40, 0x400006]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x4e22, 0xb, @dev={0xfe, 0x80, '\x00', 0x21}, 0xfffffffe}, {0xa, 0x4e20, 0xf, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xc6}, 0xffffffffffffffff, {[0x80, 0x5, 0xea, 0x7, 0x8, 0x964, 0x1, 0x5]}}, 0x5c) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x15, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x54b2ac04}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff01}, 0x94) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f00000000c0)=0x207, 0x4) sendto$packet(r7, &(0x7f00000002c0)="05031600d3fc142e00004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) ioctl$COMEDI_SETRSUBD(r2, 0x6410) 1m32.23476935s ago: executing program 9 (id=1384): syz_usb_connect(0x0, 0x55, &(0x7f0000000180)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c00109040000010202010005240010010424020205240100010524060001"], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000180), 0x10) io_setup(0x9, &(0x7f0000000240)=0x0) io_submit(r2, 0x1, &(0x7f0000000100)=[&(0x7f00000000c0)={0x400000, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f00000000000029ffffff000000", 0x38, 0x0, 0x0, 0x2}]) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000004c0)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r0) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xf, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./bus\x00', 0x1ff) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000140)='./bus\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r6 = open(&(0x7f0000000280)='./file0\x00', 0x35527e, 0x5f) fallocate(r6, 0x0, 0x0, 0x1000f4) sendfile(r6, r6, 0x0, 0x40000000800) r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) fallocate(r7, 0x100000000000011, 0x2000, 0x2f93) 1m27.255944642s ago: executing program 9 (id=1396): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000000240)='btrfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000002c0)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='rdma\n', 0x5) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, r3, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_BSS_CTS_PROT={0x5, 0x1c, 0x5}, @NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x40000) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0x7}, {0xffff, 0xffff}, {0x19, 0x10}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x33c, 0x4, 0xc52b}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4c850) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000011c0)=@newtfilter={0x4c, 0x2c, 0xf3f, 0x30bd28, 0x255fdbfd, {0x0, 0x0, 0x0, r6, {0xfff2, 0xc}, {0x0, 0x7}, {0xfff1, 0x300}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_CLASSID={0x8, 0x3, {0xfff6, 0xffe0}}, @TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xf, 0x7, 0x4}]}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20045005}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x20) r7 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x80000) prlimit64(0x0, 0xe, 0x0, 0x0) r8 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x3, 0xff, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x10, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r8, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) socket(0x10, 0x3, 0x0) sendmmsg$alg(r7, &(0x7f0000006f00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@iv={0x18}], 0x18, 0x20000040}], 0x1, 0x4003) 1m22.5795962s ago: executing program 9 (id=1417): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x4, 0x4, 0xe, 0x10, 0xffffffffffffffff, 0xfffffffd}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xb, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000002080000850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0), 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 1m22.231707045s ago: executing program 9 (id=1420): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) (async, rerun: 64) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adff012255f674412d02000000880b5f04596a5e99fce658be2f200c699223886d8be4b50000005ab527ee3697f98125f30e6326996a3cfee33025a30b45bdcf2c69d105e5e55a1d273683623f1a5dc6e3c7e20eb7a98ecf3bd2cf898e924abe26ac296f660e69ba982fd76e00dcff7f0000ca6b78ad833488cfe4109eaf009eddcf21f5c63cde2f00150200000001000000520a0000151d010000000100bf00000000cc587424363da52001a3cdf2000000db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de406e89dcbb7677e65a88a8407a9e7f9c0e91028b0856eb1ed9474480737a55ebb0bd701f7fb21135c6172eba7eb8a341f07e5a2d1e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d93a433f50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56dbe37551b870b2851c3f0a1a9ebfcba105a6ccdd01b0f04edb256c0200000073f6db43661bd7f0e2536ffbfe5ca31b4083145531458b7d1e341c6b351ebc5223f54d6bec93f4ef088e5d1be2515226988d664709ff03f1aa3dc7f1580ace9bf2afd28d0700000000000000d6eb372713255012e028cb2654d493a0b43bf21375709f348f5eda2967199cc936859a538100070000000000dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0c6ef9dd2b6bb700000000000000000c586272c3f4d79bc36315745cb149f3cb385e6add14652003c7cdd3324f07d134d3a6c718bbd1aafe1140cff0be4c6f8df084c5e9734ae30aa9af030025f01ab03a9b1074407136bc506031f0916a39d3057d55183612b39e73ae8e6dc30356886a831836469e2051d937eb85f3f2d5ae2c1dca476b97419a3b76ed62409d004d7fbe362145d19605d760df4c5124ca325d374b371867a79b35c6617fc3327191fbf514573f0e30d1d60be2168fffc2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc9110971b749ccd74089ed6b86f81ca3ba47d8f71d290ed1b1a11f7a67125170c88c3b6a50692cc0064fc6bbd312536ac15016c85c6332226401b110da9c786eeca22debc99335587b54c13c3107008fa069af8223b38ced735c2d906551004d8dc10d88738488da01ffa4add56474573c964a270000f2f16625c0c10200000000c7a5ca60fdad159f2e44171f39638410020000004825d081f2d987f05c534187738655d7dc958f2046fa0c1619a6554b82d9c162eb61ca74f1ffdaccf0ea5f06e0fca8b27ff3983ab74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb27f88dba816020be760f7b45e001efada8000000000000fdaf4660402f7b3b79a433e08074ea2462974a00040000eb01352638f56dae0249d15ba8767259658878b7492cfbacde9b57cf4de00788adce638190f3570e0b4c80ef682df22201270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433e866665b98ca2002c804c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc76d7a23d06acb1d2d4c58faea84158bb440df2a694f4cdcaa4f65c22efffffffffffdd00000000d503d79986958115ae07b70f991430b7fb475d77b869ee02000000000000000000001ffff0ef89b2a68d2b05c995445d8a7700bcdfbec74fb2dd163e863315e84498dfb52bb93f6c9084659ce777ddac563c8596c2b1d8180289a61faa95a82bf1cfb7f2fd7252e9322abe282c33445d443a67467893b9bf0d1c8130ae6b226900000635376413c29f7c6f7b7e29b9a0c64e68328661f0c06e21f7d7dc22174ea4447a6f60edef3a4168d40200fbc71104512efe8e5d7d934aa289b4bd2b870000000000000000000007000000002000000000009b777883a02f0593dfc4cb4114b9f9cf4ad155110cc6ace2b322ac31bfa27847c799c8009a1ea5b98e525e6383ad7fd9795170e7b11e247603c2ff49a11459c7f606d729d3979676bffb3049166bb84a0f061991bd57c2566c10c282352aba05b6164ef876915a3f2491e4793e590dcc71de10da96366c1e992c0068c940dd4422c9882d3aa0f8a797b8fea6efcfb5276b7679f15559edaa977504cc0b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd04000000de17e1e13b93669b79556abb722d9c085b189b5fd1f30e8dc813f608830b110001732135e8e7262f290000923bfb6b41ff3792cee2fc37eee739c3e36a4bc80112968ec0d8902eced1fe552018014a463abbbf7ccd6a92a5734e3ebfca9b6e88e031f31de2183652e77c164c646a1cfd3710aa4205d8d4d4f974133ccb1e49feb42664eccd809c0ba8917eda87489e8946d5c8156197bcb66fd5606c63e3389ee9e8552381646365066ef9a36a449c96485c22ad1aa423b7b89efbc6cd54000bb0ea5f4f1e8773144fb6ac9a44d43593d77e66aa7ed7f3d4e7b211590c738888d02b2dbb0b2ba73ec72e1d8d7360a128499dd19e1e7b9b0671f4f58515b45ecb9964f3c4ddb8234391d514f8d996d8d6dd7f8fadfee2d7a0035638ce27c2936cb04b30a0eb0cde0000000000000040000000ec3c12ecee8fc3a40000000000000000e215b00ce2570b930723cbadb4033d1b8aaa2cfb3fb89e4a6e89737fd6232218a9e0c099d1eb59d60b3cca089785642f327139bc4394fb6d547a9b3c22599e780c1da7433fb47615d372e3fffe9703e37d5c87d513165278650738efcc04d27b766cf7f60066edd292f6c8a2174f391ed164bb1816819ceb3e378e776d422bc946cd9501accebeac3a5b31d8abc68ae537cd44a04e6bc21c35a7beab2610c51e593676bf635a20f597f4631b91454d182f826071f5210bd6d93173589929b23801e63c2266fde13b5a04b8d48be057c752bc415a756ea9b4d34156c4f73dd5e5924ef101a5fcdaf37c7ba2c4a9de9b000000000000000000000000000000a73b862e4b63c245616b522345587d0ee65a6902bdd0abd941e8aba37510b222ae544f395edd1b92ad53fc68f08ea00edc5e10d768836169dd296d56b306e8b75778c37571792a6c3d8b02ef378ebd59422cdd008bef6f80a80a68641ea5ed4f1126bb676098c10bf663eb3fb8c839364d28fd046dc64b35f9c3397ce6f4ad357b0000000000090000000088c7a8e2638f650a6f04a6f33a090f59414d6ebcbc687e66d600000000bd0a58ea6d36fc2cf9b9a71c137a2a22adb1006f371d4faf47285fd66fe0389afb96854bb360edcdf11b4ff6dd578bba93e949d240cde9b5836cb46032484dc19c93db7b6e5afa10547c78e76a3111557346e52566df196fd630561bb908fff4d2e19562aabd43742a26a43799f8636fa04ceb40c9e4ca1cfbbc7b949cd245a3ee118fd0d4f639444539af8766028d4ac4d4c548e290199e0dacbb4f6796b39bf32934d941ba2f88e3ebd0cf8e24f99eca86e4ca9b2cd2b54044a7fc4631572a6378a32df288785f146275c1f548e2a0c1016744e05f9de5044373d7650125027547eefe7b2d8c8871bb65395fae99d8456883705bfdfb00001854b2e5efa8aaf25827d659f592b1575281ec125de7fb91cd81d91dcb19f5cdf1e1e2b4a8a1389753a09110538689e38e07fb2dc72bd4fd11d7bc16aac5d85c6101bb722895248e463a5fb45ce0e564e90cb19d5993b471687ae4165e29cf2f58082115f5f8569896eedfd798733223e6d6584997510c374912ab798bd4af4654c01bb2c411bc36468ddd62b4eba5cfc8953526e0e5b1359797956152d0098ce47c62c3fe5a23219389622b7f65bf03527d25c3941b9cf1ffeedf6d99082bb57ea871c12213cc40900f83033bc18c529171fae324c315bc6ce358831d0230412212acfd5fc8d5cb0d028cf568e8bb40e27befe2ff01f7c6674a4d86d900633ea36641e0a781ea0ea7f2d928b8b22e2f97dd13348927375baea6863bef4acf4299096ada5cdd2a0eaafaa760a79d102d1e0c0000000000000000007926653b8d79ce16a432f124786a0bc3c5b7d196822492ae1ccf91aeac16406ad6f9cd3d96d57fceba8360ae49f73351814c9c2972f11064aaf3739d9100f9c0e4d0cb17d50c82e305ba7d62cf1cc6da26e34982a8c74dd8122cf5b5e7c34fd2712a0cef05e4d8ec7dd363219676bd9b19943185b132eb35a695e208dfa5cecdb1d6425c8879063c0f11bd64291a4209ee6dc1d9e9010013f6148c603e6a335e298efd6ab5cccc47a2c568c6afec54f8251bd840752addf200371361c9eedf05ed98585cf6d99e9e56055064bda2d373369761238c278147cd0eb7799f6b9c9fcaa3fd282154994f5b25420c86db9b6401e885de1c615a719a1c83e8fbbb181282dbaf3313a4e4a4877e9f37607e2cd6da0cf6371ec06a75f5a4206b2418ad8897ae149085d63f01f22eca44033234b3930b4d5da756669a1d59d69e7de54abf439988ed7ec33c2d0a901bb0985a24878984d8a4340fa9a356d100926fb5f2ef9976366a61b8cc2bcb1c072b0e9c564852388e1edff10d75b3832792e471cc15b40380f94d834243080158603fbc9134d6983c540525447478984611c0d9666941bfc0a30db47a8828b6e5c51aee2094599b4ce52795750e1764f1657ca8c5633c71287239dddf5c651496f7bbd148c937f083d2e4e0197dbc6ff0649c749707b17399b1d7efad23abb8b40b38704737e15662ae4913a4a001cd3b71c7af75b5ffad9780650c800a40ca80ddc41987919142fd28dbf22db5f4c435415a03455e1d55d1783ccef97d7e4655cf839d06f06e137bbe462a03b3100231914b19739dd57b4f12d026ad0c7fd3"], &(0x7f00002bf000)='GPL\x00', 0x4, 0x436, &(0x7f0000000040)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffc95}, 0x48) (async, rerun: 64) r2 = socket$kcm(0x29, 0x2, 0x0) (async) syz_usb_connect(0x3, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400"], 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000180)={r0, r1}) (async, rerun: 32) sendmmsg$inet(r2, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000400)="03", 0x1}], 0x1}}], 0x1, 0x40) (async, rerun: 32) ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f00000011c0)={r0}) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="040e05ad380c"], 0x8) 1m21.565571419s ago: executing program 8 (id=1423): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) r1 = dup(0xffffffffffffffff) read(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) r3 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000000140)={{0x0, 0x1}, {0xf}}) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbef6, 0x8031, 0xffffffffffffffff, 0x1b5c7000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r5, 0x8, &(0x7f0000000000)=0x3b) syz_open_dev$tty1(0xc, 0x4, 0x3) read$FUSE(r1, &(0x7f0000008180)={0x2020, 0x0, 0x0}, 0xfffffdfc) setns(0xc9, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000580)=ANY=[@ANYRES8=r7], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r8, 0x0, 0x2d, 0x0, @val=@perf_event={0xa}}, 0x18) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000300)="00ad", 0x2}], 0x1}}], 0x1, 0x22008805) socket$nl_route(0x10, 0x3, 0x0) 1m19.906523813s ago: executing program 8 (id=1427): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x32) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x800, 0x0) fcntl$notify(r1, 0x402, 0x6) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$sock_int(r2, 0x1, 0x12, &(0x7f00000000c0)=0xb40, 0x4) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r3, &(0x7f0000000140)={0x1a, 0x0, 0x4, 0x0, 0x2, 0x9}, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) sendfile(r3, r4, 0x0, 0xffffffff000) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/tty/ttyS1/console\x00', 0x2, 0x0) write(r5, &(0x7f0000000900)='1', 0x1) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x90}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/tty/ttyS1/console\x00', 0x4a) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) timer_create(0x5, &(0x7f0000000440)={0x0, 0x200023, 0x1}, &(0x7f0000000300)=0x0) timer_settime(r6, 0x7ebe15194cbacdd9, &(0x7f0000000380)={{0x0, 0x989680}, {0x0, 0x989680}}, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3, 0x2}, 0x30, 0x0) socket$inet6(0xa, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="44000000100001002dbd7021ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="88dd030000720100140003006272696467655f736c6176655f300000040016800a000100aaaaaaaaaa1c"], 0x44}, 0x1, 0x8100, 0x0, 0x4010}, 0x2800804c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000004c0)=0x1, 0x4) 1m19.015951255s ago: executing program 8 (id=1432): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="7f454c4600040000ff7f00000000000003003e00ecfffbff94020000200000004000000000000000e503000000000000000000002c9f38000004"], 0x78) close(r1) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r1, 0x0, 0x4004814) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r2, 0x26, &(0x7f0000000000)={0x1, 0x0, 0x800000000c, 0xfffffffffffffffd}) fcntl$lock(r2, 0x24, &(0x7f00000000c0)={0x2, 0x2, 0x9, 0x3}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000002c0)={'erspan0\x00', &(0x7f0000000240)={'erspan0\x00', 0x0, 0x1, 0x40, 0x0, 0x2, {{0x17, 0x4, 0x2, 0x39, 0x5c, 0x68, 0x0, 0x0, 0x4, 0x0, @rand_addr=0x64010102, @multicast1, {[@noop, @timestamp_addr={0x44, 0x44, 0x58, 0x1, 0x2, [{@broadcast, 0xd8}, {@rand_addr=0x64010100, 0x7}, {@private=0xa010102, 0x2c7}, {@private=0xa010102, 0x9}, {@empty, 0x5}, {@rand_addr=0x64010101, 0x4}, {@rand_addr=0x64010100, 0xfffff001}, {@multicast1, 0x5}]}]}}}}}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0x4, 0x8, 0x43, 0x10c00, r2, 0x7, '\x00', r3, r1, 0x2, 0x2, 0x4, 0x6, @void, @value, @value=r1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), r1) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000600)={&(0x7f0000000380), 0xc, &(0x7f00000005c0)={&(0x7f00000004c0)={0xc4, r7, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x20, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfffb}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x40, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vlan1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x80000000}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x101}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0xa453}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e22}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20000010}, 0x4000000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r8 = socket$kcm(0x11, 0x200000000000002, 0x300) r9 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r9, @ANYBLOB="0000000000000000b703000000000000850000002f000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006d00000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000140)=r10, 0x4) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) r12 = syz_open_procfs(0x0, &(0x7f0000000040)='net/connector\x00') ioctl$OCFS2_IOC_GROUP_ADD64(r0, 0x40186f03, &(0x7f0000000080)={0x1000, 0x7fff, 0x4, 0x40}) read(r12, &(0x7f0000001b00)=""/194, 0xc2) 1m18.926785835s ago: executing program 9 (id=1433): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000b40), 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f00000001c0)=@ethtool_regs={0x7, 0x0, 0x8, "a8702cce82258cf1"}}) write$selinux_load(r0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e131d"], 0x16) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r2 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r6 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0x2, 0xffff}, {0x3, 0xffe0}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x2, 0xb, 0x5}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8805}, 0x10) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x40049366, 0x0) 1m18.799214492s ago: executing program 8 (id=1435): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) r1 = dup(0xffffffffffffffff) read(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) r3 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000000140)={{0x0, 0x1}, {0xf}}) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbef6, 0x8031, 0xffffffffffffffff, 0x1b5c7000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r5, 0x8, &(0x7f0000000000)=0x3b) syz_open_dev$tty1(0xc, 0x4, 0x3) read$FUSE(r1, &(0x7f0000008180)={0x2020, 0x0, 0x0}, 0xfffffdfc) setns(0xc9, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000580)=ANY=[@ANYRES8=r7], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r8, 0x0, 0x2d, 0x0, @val=@perf_event={0xa}}, 0x18) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r9, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000300)="00ad", 0x2}], 0x1}}], 0x1, 0x22008805) socket$nl_route(0x10, 0x3, 0x0) 1m17.81380782s ago: executing program 8 (id=1436): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000b40), 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f00000001c0)=@ethtool_regs={0x7, 0x0, 0x8, "a8702cce82258cf1"}}) write$selinux_load(r0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e131d"], 0x16) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r2 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r6 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0x2, 0xffff}, {0x3, 0xffe0}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x2, 0xb, 0x5}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8805}, 0x10) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x40049366, 0x0) 1m17.63240076s ago: executing program 0 (id=1438): syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1e, 0x0, 0x4, 0xff}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1m17.25980068s ago: executing program 0 (id=1441): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0xe26, 0x101400) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000140)=""/76) r2 = syz_open_dev$dri(&(0x7f0000000300), 0x2, 0x4c0503) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x8000) bind$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x7, 0x6776, 0x4}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x24, 0x24, 0x8, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xa9d31e3098960501}}}, 0x24}, 0x1, 0x0, 0x0, 0x44885}, 0x20040084) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) write(0xca, &(0x7f0000000040)="0564", 0x2) 1m17.109743548s ago: executing program 0 (id=1443): io_setup(0x8, &(0x7f0000000600)=0x0) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000d00)="0f198d5aa5caa1", 0x7}], 0x1, 0x0, 0x0, 0x10}, 0x0) recvmmsg(r1, &(0x7f0000006fc0)=[{{0x0, 0x0, 0x0}, 0x400002}], 0x1, 0x20000020, 0x0) syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0) r2 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/bmAttributes\x00', 0x1, 0x0) io_submit(r0, 0x1, &(0x7f0000000080)=[&(0x7f0000000140)={0x0, 0x4, 0x0, 0x1, 0x208, r2, &(0x7f00000001c0)="1b4f", 0x2, 0x7}]) 1m17.091855357s ago: executing program 9 (id=1444): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r0, &(0x7f0000000540)="494e564954452073ba759568adad2fc52245732000b8fed3695b3a74657374402532372e302e302e31205449502f322e300000000000000009443a207465737431323334350d0a20", 0x48, 0x0, &(0x7f0000000c00)={0x2, 0x13c4, @loopback}, 0x10) (fail_nth: 1) 1m16.481094484s ago: executing program 7 (id=1445): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='select \n', 0x10) write(r0, &(0x7f0000000100)='file read \\}/c/passwd task.uid=0-0xec.argv[0]=\"sh\" exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c000200000000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="900100008ba5072f1c00128009000100626f6e64000000000c00028008001400ff000000"], 0x3c}, 0x1, 0x0, 0x0, 0x40010}, 0x240080c1) ioctl$NS_GET_OWNER_UID(r0, 0xb704, &(0x7f0000000180)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) r3 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x2f}}, 0x10, 0x0}, 0x300060c1) setsockopt$sock_int(r3, 0x1, 0x9, &(0x7f00000001c0)=0x4, 0x4) setsockopt$sock_int(r3, 0x1, 0x9, &(0x7f0000000300)=0xa, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff5}, [@call={0x85, 0x0, 0x0, 0xd0}]}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x0, 0xe, 0x0, &(0x7f0000000040)="f7edad00"/14, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$tipc(r5, &(0x7f00000000c0)=@name, &(0x7f0000000140)=0x10) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/locks\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0xfffff000, 0x2000, 0x1, 0x11, r6, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r7 = socket(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f0000000000), 0x400000000000235, 0x0) 1m16.313192982s ago: executing program 7 (id=1446): mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='udf\x00', 0x8080, 0x0) r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x1ffd, @remote}, 0x10, 0x0}, 0x3000c041) socket$kcm(0x10, 0x2, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x16, 0xf, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f00000000c0)="c0fbedd8cbc20fb9b8209a08efe4", 0x0, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1m15.745117621s ago: executing program 8 (id=1447): writev(0xffffffffffffffff, &(0x7f0000000780)=[{&(0x7f00000005c0)}], 0x1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x2, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x1, 0xd3, 0xa8d, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbf8, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x407, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x137, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x100, 0x8, 0x26e, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x40, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x4, 0x5, 0x9, 0x8], 0x25000, 0x304}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000200)=[{0x0}, {&(0x7f0000000140)}], 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1m15.398539139s ago: executing program 7 (id=1448): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x29, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioprio_get$uid(0x3, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}}) r4 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r4, 0x404c534a, 0x0) r5 = socket(0x2, 0x80805, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10) unshare(0x42000000) 1m15.387891614s ago: executing program 0 (id=1449): ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000140)={0x1000, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x55, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c001090400000102020100052400100104240202052401000105240600010705810308000a09040100020a0000000705820200020007050302"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyACM0\x00', 0x2, 0x1) mlockall(0x2) r3 = shmget$private(0x0, 0x1000, 0x78000000, &(0x7f0000246000/0x1000)=nil) shmctl$SHM_LOCK(r3, 0xb) shmat(r3, &(0x7f0000ffd000/0x1000)=nil, 0x7000) shmctl$SHM_UNLOCK(r3, 0xc) syz_usb_control_io(r1, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r2, 0x18, &(0x7f0000000040)={0x2a, r0, 0x8, {0x3, 0xffffffff}, 0x5}, 0x1) write$UHID_INPUT(r2, &(0x7f0000000440)={0x8, {"e67a3cfe312468b193603d1ab12b4039222907a3b528f7757a807ecf6d9a2933de71f424480285878e7a273ed1443c05e63fbaebe9326c7fe1534a07c5cace2e4b6a2b82774b33f620e59351415bf60bf09c644c687319dd268eb7d0d254ecbdf6a22cb1be72e03085ba045d71884b288c6a07062f64caa858091221b789b5e369cde3cdb6a05f68a8f8a7edfcc2d76e8e5d8ec17ca5defb390334bb3897a094b120d9fba028a3f8cbf8133fe3d6402f3d0dd225df0dc007d589790188035b0c48696c2219cf712b9ab82fae45a7275dcdb5fed70e700d7cf82b8f48c229aa2f6ae3e12a338fffae1b291d1c8cae39236c2eac6c2b951fd39b59e1f8abced99ece3aced5438d690d98f7eb29b95f6667894605e46017e5a878b194721af63fe84c868ca09ba7d926763543f06d6497a5016cc2b430c51ef52c541dbb193c1f213344ce654ace926403abf3d29fa40547eb8dd13b6656b3f1c5ca02cafc8c2761ded33674fd3daeffb615378642febd99d91af841bd4d8ef583b2122365ac811b4879061b81573bfbb0f0570d18e99ad08252d818eb6e5bb9ddbc19e9d55c755d28ac2e5927aaa35a7c5417790cdb5932b87ccf5eb01f9b5cf7fa215a9c0c0f9a3ee7cf4bc5a14fad12f2182900231ce02dd24deb937af538514241d5fd9e4c3a5994a02dafe749fa4902bf6d2ab804968783cadb8304d606b197273be2a79c7b354613b2cca266693dd01af788025786f77cf4c885ae4ac31daad074d101a750fa708b288fd5f4f3cad6e75306c196204821123bc2632cab53027d6ebd065fece056abd89d0e80a2ff5500ce101feee48dd626110d750e793efada572ffe68ecc2278c035fce08465103e4b3f53cc64a8be576eb9cf4b3298034e5a5206c329b0ace3e414343d51d70aaf1e467a2b1675a0264f04eeed71c4ffaf81dd8e618e53badd44f641f647c9e710d5a44cc6765f98cf997cd4188c9e93424eacef99850d4e42d8ed191502016fc5793e2e7349c0546edffaf8f49a8b72414cfb2b60686ad10a0048bf2e39d30f8303d98d40cda98e8551cd28de283fe7ebef704ca4db6b6617f6b0327fca1fec4d60b1123d6da88086bf3c08caa3cf2b6d1a3fae40fa0f0639f0d97f7dae47c4c59161bf95e7405f94899989d52ec1f5a1faa7cb0f10004294c45cbc11248d5711e0a1df729cc1b8dc3d66ebde11cfbe14dac9de9bdbc1e5cab699e7683a6712a2493b69666f132c70ced1a447780f8e675fea9342513d017861193761b295fc4255309b8113407cd826f06623801718d650a2087c3e5ac2967afbee152dbc743cd97c2dd2e04730ce93ba617102a46a03b0ae76b2e45383001f6d57b413edf20ba67e98b92726acc26ebdb5f86d3d3291fbd3f63037c150b626f57ea8bfa980e312cb94d8688d886298c73e7abc05a4ae1059a0d313587c7427dc775e85fd715f8cad25dfd053286c02f8a9e83f49c201e731721bd15c1585330940f3abc2e0be0d2c617c53c733e4e32878d2f2c27bd2256b56734b809a626f781e2989befdec7496381477884cf05cf4aa1c7c3dffdac00b1b9735f122f3f8f79d4261fed16d9d6aef470b53813253118e83aa051419ef5955ee76162bdef9bc20e384156e0397cc03f556d34e2534874c0226e2cdc32e35a69a4f28ab3a5207e87043856725c752a0f6b51bbd33a7425cc5a91d5a29afc962acaf02cff0f490aae5e622d2b543047aeb6b92baf1b9eea88a4c172c5c6dbd41b279d40a90d692eb07cf77ec40e875ff1cb5e7e7afbb05d2f07dbf4902c0912d232c136add68dabd7644a3267a525d201732bc1805e0fbf4f3fd193fc00c6c46baed1e95f1492c1dabf9af1f4b3015b4cbdc25baf5703c0deb8f1e042db9388cd9d734c1342da246a2a5f2557faba2bc242cda05ec3f9856466961aadd6cc14b037feda033a08f64743c687b608bd238894fb687e22ff1b231019d6beb9d3bbbd956019d720bc28f3cdb6edaa58b9eff3d2ed5aab57883814fb579b758ab62db140599780281f0a8608f8df4ae750da8335c0804d8a14dd60a40019a31ef95fe7cb8aae663dd9eba872cbbbf9355193fc1bfcb738ec2a8e812e5648a32afd656dc187d1b2c0ae1505b203859718cf93e54f2f6ac21914cb67b2ee84e3cf2e0e23d67888e629b991b00acf1ec128eee740d6a5ce20e87da5bc01aaeb6e728d910047ac5cc377338a008e1ef24d64e95256dd199e0f4bf0f147ae93c311b1f3645ec9d3cdbd1eaeee4cd85000126f94e00f5676f9759fb5c1d02b85aa065d94c85df7ca94e3dc8b6e6dc33eac1278a82911b56a859b33c5a77a3be0e7a62920dfe19d5553bbafb70f55e03e24b6907feb80f9089e6809a849581ff47410010d2124acdb9481a2d86bd0b0eb3563bfee38742ac4289c5072c1d249e8f58b4b98094de348efbfdc03e804809116f27acdeecf9d049ed39856c22649c30c59efcaaf7b5e7eb9a7d3af39c6c38536821fea3dbbdbf66925fa356e3774dee0b87a723838d8d9e310e2979cd0a00860e159fa3e7a74914bc25b4e85eb41df71b8bebe19b13003a5de69f32b031e2fd63f9eb93b48ba735b776261bc2ec200e3b828380479f41dc2ac7979a16e3e2c57d19810e430bc474dc96e7cdef527cde02c1c816713d18d23cf034b8d251b5eec4f2c30963b89b94bf3f29bdaae3e573aacd93c14d8e39fca992df49f66142dd49ba7846c9ca3f805abbe7096c747c1810049194d89f3461be1422e1374b8454c6eca2ccf64f14d3a577a283cd167cb980b2fd49e707305c863a546ba0598d19ffd496f209e494bc612bff827f81d564fcfc6358a8330b6dcbe8fc0498fdd376e6513dfbe8268b82911300cc3351d5ffbc1384c9c7d147276924404bc77305329c70855f66ef858276d24c0f840d0baac7fdab8e2090522f8889c46f7f8b6fdd9a70a52bb35aee83b9108f8755a5a66d2003d0426fdcf8c251c2677676f324898fc87bb1e54a95ee0dcc045e1535dc3102700a734baa8442e7782ff2ce8c5458e091b04c23eb99fad0c4ca8078ed006cc5fdcbe31dee7e57cc2277c9b68cc30a49f952b92f2f181af158a1f3c4efad83e868f0ce3357071b6235aacbc6f1847d3f0952a28a3ffecbcbb9704fe3ff9624baa039389c62e853016e2e995000f13dd10b459e553daf8a0fc284cc1f6e58078c81e2850bef39d0775cacf4e0737420ce04fb2b5848bcf1ee567d918698451476f7235036a5dfc3acce99bdd742053c2bbaf71c1c6423d0fc70506d7065f25df746012a3d9b6e81803710dc478d1e7ad264cc9887f0ea3f690df5e6d41bbc357c871b9cd19b367900f4041be38e091e9f1eb7abf01f439b1205295afdb4d1300136fc0f4f72e8c6fc3745d16815cbda569213f22a84cf30789c508eb6dc737fe4dc734b6f3415e7e17ff78ac25bea6456b181807eb52435cde24e3ab5d69b0e9cdd89aa58710b42d298f2b8e7b7b51aad697733da07dbd3b249f38a2e33df974f072fc3df93022bcbf06242a199de6b178da9ace127f797922b2bd97d4574ac0b64cc931c8f3a591cef0c7b3d523ba1c204d8ac5f4b7f949c5e6619795c8b84256f99c3ba8cba7b061147a4ed0aed1c0129c4199f4b89854b5f4266d453fb85ff18f4ee134cc0aa0b50ebf0b70d7fe2328e381b0ec257dfbd8fc9905e2ce21b6745cd74cb836ea62855129ee4a782a286aa7303b36d2dd79c01c0476dc98db53223e87f8d4746accf6250e0cdf2f76da0969652fec4f55f994836c9de63c093c8022034828cb457ca4d0bd01a26aa0de089f836964db7cf0870f74d3068c90a7826f3f15d678785f82568b53dea502ad7089f7ee4ee6f090ee6e717eeb3f8b79ab7ecb2ee5e4ac34be24cc206829cc028ff4343af699dd2e09670db3fa2069458d370b79b6f8fc3ca09f4e266405fcea55e2dfbb224aa2ba1bed2d16aeae6140ab2d31c035666d1ca372a2d1afdd9ca9d780223f3a958863486512b94833fa7bc3a52608c77ae8af369f8a267d581dc8134a75a2bb2c6d07c802cfb5f0f050c74150343fa48a2cf3c6a74aa13d25db020626115cd88855d0c95f6a93739bbf9a9ba0ab9b99330da9625cf97996305a970393ff4e3a118432d1fdfc146c050eeb3b1b0c3fe5d568596ba148e56fcde92f8849aa8357cbc1d65b023dfebd66c16950c26d9d1dcc6c8b30c8ceadb398758292fd2f40090f2a99b1170567a1f1a6161c317dee1cda55b4044b84f3dba8e4f49beaa1737bd9ec36fac7103ae89f2819cac4aa277b5517f42d81133371a166d45ea53ef7cbf954db60844bac9015eec9c3f08766cbd677cb4a477ba991ff5838d71f6ad13ef3a192bcdc15860ea8518d1bd4be1b705c5147696c902c562ee473565e74398741f30b61f3375f7ec818d415dd7b3e9561be3bf790b6a4d9ab0d7015cc1529f69dd3f2d9273edf6af66731fca361ba278038b6e443ad3b41445cd136dc399f533187c29d89ca3eb84f8f4b265174331a45b2394091086cec6b2836cfbcccf96462d0405504a72ab490845d8c609663b9412e472785f18877e78f2c1180fea370fa452da7353faa458feb98c01af503b574db20bec024e59618ccaf7f82606a3e71d4ea3871e96b2fe4e564179f33c93fc0569006b8c8b2a4897d31b94d2e0f03f8459e04a2551abf0148e8449dbb156f4459d731ecd7295192c35f53baded54dbc66653abbc667e81c7904b6a24d50b6eb2760b788fd7db0daaae181500eb5b44d8b5aaf771f8a4dc07472ab62d72a31837e94aaaf1a9c647ab26eb6f5989e88381bd92925a664523aebb89e468d4b8f64ba77657bf9eebd069f3fb21ee39c4fafe3811cf7fdf56e3cbf20765de4011a3ce1be6128b04897d618a3969bf4305f874c7a3b0f47f95d3c336a8703fb7184905597e79fa5e44f8f928b839dbc6eeb0e12f7a79218642436812acdbc1b97d77da3a889a1aed6daa026ef2bbf68301539a6ad1dbbd490eaa50307cb8cc1463fa6cb3f8b8056583918146eaec1228a940197b29344b7851866f2cdf326eb4bdb6f847667d24f08b33584dae673dec5249add0bef3653781bf8a9e091d0a8fbb0a2706bb1bfaea10fcd1115ee5816c829a3212227c7c2e51cd8f375a62c778a0acc42b9dcc2aa912bb394d218ea59a324865ede18f65baab25343765e3d5c6374ff046521a5ce3864ab72c2d70818cc3e31f677537a0207960f93bb14703953f9a0f74cedac24542453b0167eeb966c430e4742b299872e10b0aa2e8012d989911dc3440af1b320a46aad48379d2cf10e57822fbf267f0fdab7c18e2ee557e4ee24c5f63b54ce5aa88008b707065c6fc95e40413154e067266aec4c41a0f38376c772e73f2628c1fc13dcd2c3988625a910e6204433ab0ae9be75a0ce4425dcccc348be3785cc2e6ca893034ef1ca5b45209c2baca77c95989fcd44f5dc77933900ba9ccb141bea90e7a82862f23be66c858da8dc9a2add85f53228b5212155897f3327dbef79676e9a09adc2d43b7a82506a465b31dd6992749cd96fd3ffc9e77e5d90caf020ad3d75b397303d13a920db653e20e70cb755ddaf29642559ceb76691ae0050f8b2e141f1150b2325eea184fba6c40d37711498c55b785615c7f0c1a2f2f2cc35eca8c31e602319b061c2adf7ec6ab155065b8f234c8fc5e8bc56c9cfe7aab8143c167af774ac1181a694d2a5e2ed394a3c9668a07f15ec0876abaa1ca269e19c773e3e0d82e835d1530bc342aef6861f86fe2f7e63d6bf090ab6ffa8", 0x1000}}, 0x1006) 1m13.520128789s ago: executing program 7 (id=1453): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0xe26, 0x101400) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000140)=""/76) r2 = syz_open_dev$dri(&(0x7f0000000300), 0x2, 0x4c0503) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x8000) bind$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x7, 0x6776, 0x4}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x24, 0x24, 0x8, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xa9d31e3098960501}}}, 0x24}, 0x1, 0x0, 0x0, 0x44885}, 0x20040084) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) write(0xca, &(0x7f0000000040)="0564", 0x2) 1m12.765801388s ago: executing program 7 (id=1454): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000b40), 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f00000001c0)=@ethtool_regs={0x7, 0x0, 0x8, "a8702cce82258cf1"}}) write$selinux_load(r0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e131d"], 0x16) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r2 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r6 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0x2, 0xffff}, {0x3, 0xffe0}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x2, 0xb, 0x5}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8805}, 0x10) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x40049366, 0x0) 1m12.150889753s ago: executing program 7 (id=1456): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) r1 = dup(0xffffffffffffffff) read(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) r3 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000000140)={{0x0, 0x1}, {0xf}}) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbef6, 0x8031, 0xffffffffffffffff, 0x1b5c7000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r5, 0x8, &(0x7f0000000000)=0x3b) syz_open_dev$tty1(0xc, 0x4, 0x3) read$FUSE(r1, &(0x7f0000008180)={0x2020, 0x0, 0x0}, 0xfffffdfc) setns(0xc9, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000580)=ANY=[@ANYRES8=r7], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r8, 0x0, 0x2d, 0x0, @val=@perf_event={0xa}}, 0x18) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r9, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000300)="00ad", 0x2}], 0x1}}], 0x1, 0x22008805) socket$nl_route(0x10, 0x3, 0x0) 1m8.513782238s ago: executing program 0 (id=1466): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000b40), 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f00000001c0)=@ethtool_regs={0x7, 0x0, 0x8, "a8702cce82258cf1"}}) write$selinux_load(r0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e131d"], 0x16) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r2 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r3 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0x2, 0xffff}, {0x3, 0xffe0}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x2, 0xb, 0x5}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8805}, 0x10) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x40049366, 0x0) 1m6.993224137s ago: executing program 0 (id=1468): r0 = timerfd_create(0x8, 0x80800) timerfd_settime(r0, 0x3, &(0x7f0000000140), 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b9ac9ff, 0x0, 0x0, 0x2, 0x0, 0x5a6c103, 0x0, 0x6, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x4}) timerfd_settime(r0, 0x3, &(0x7f00000001c0)={{}, {0x77359400}}, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) clock_adjtime(0x4, &(0x7f0000000240)={0x23, 0xda, 0x2, 0x9, 0x100000000, 0x0, 0x7fffffff, 0x0, 0x8834, 0x9, 0x2, 0x6, 0x888c, 0x3, 0x0, 0x5, 0xfffffffffffffffe, 0x2, 0xc2, 0xd81, 0xfffffffffffffffe, 0x5, 0x80, 0x5, 0x3ff, 0x7}) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000000c0)={0x2, 0x4e23, @empty}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000681800000002000004080000001300000002000000000000000100000001000000200000000076616c0062"], 0x0, 0x80}, 0x28) sendto$inet(r1, &(0x7f0000000580)="17", 0x501, 0x10008095, 0x0, 0x0) 1m5.767464944s ago: executing program 6 (id=1474): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001435010026bd0c333c84df250a4022fe", @ANYRES32, @ANYBLOB="140006000000000005"], 0x40}, 0x1, 0x0, 0x0, 0x811}, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=@ipv4_newaddr={0x40, 0x14, 0x509, 0x70bd27, 0x25dfdbfe, {0x2, 0x20, 0x7b, 0xcb, r4}, [@IFA_ADDRESS={0x8, 0x1, @loopback}, @IFA_LOCAL={0x8, 0x2, @rand_addr=0x64010102}, @IFA_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3d}}, @IFA_FLAGS={0x8, 0x8, 0x8}, @IFA_TARGET_NETNSID={0x8, 0xa, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x4040054}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="180000"], 0x18}}, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) sysfs$3(0x3) 1m5.64874809s ago: executing program 6 (id=1475): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0xe26, 0x101400) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000140)=""/76) syz_open_dev$dri(&(0x7f0000000300), 0x2, 0x4c0503) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x8000) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x4e23, @multicast1}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) write(0xca, &(0x7f0000000040)="0564", 0x2) 1m5.604474976s ago: executing program 6 (id=1476): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/mtdblock0\x00', 0x8800, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0x20000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x811, 0x5, 0xcf}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240448a4}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r5, &(0x7f0000000280)='0', 0x1, 0x40000, &(0x7f0000000340)={0x11, 0x6, 0x0, 0x1, 0x2, 0x6, @local}, 0x14) 1m4.131878765s ago: executing program 6 (id=1477): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x29, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioprio_get$uid(0x3, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}}) r4 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r4, 0x404c534a, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="1695", 0x2}], 0x1}}], 0x2, 0x48000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10) unshare(0x42000000) 1m3.238479144s ago: executing program 6 (id=1478): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000b40), 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f00000001c0)=@ethtool_regs={0x7, 0x0, 0x8, "a8702cce82258cf1"}}) write$selinux_load(r0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e131d"], 0x16) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r2 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r3 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0x2, 0xffff}, {0x3, 0xffe0}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x2, 0xb, 0x5}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8805}, 0x10) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x40049366, 0x0) 1m2.685719474s ago: executing program 6 (id=1479): bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x4, 0x4, 0xe, 0x10, 0xffffffffffffffff, 0xfffffffd}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xb, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000002080000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) sendmsg$unix(r2, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 1m1.389783259s ago: executing program 38 (id=1444): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r0, &(0x7f0000000540)="494e564954452073ba759568adad2fc52245732000b8fed3695b3a74657374402532372e302e302e31205449502f322e300000000000000009443a207465737431323334350d0a20", 0x48, 0x0, &(0x7f0000000c00)={0x2, 0x13c4, @loopback}, 0x10) (fail_nth: 1) 1m0.353455885s ago: executing program 39 (id=1447): writev(0xffffffffffffffff, &(0x7f0000000780)=[{&(0x7f00000005c0)}], 0x1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x2, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x1, 0xd3, 0xa8d, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbf8, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x407, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x137, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x100, 0x8, 0x26e, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x40, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x4, 0x5, 0x9, 0x8], 0x25000, 0x304}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000200)=[{0x0}, {&(0x7f0000000140)}], 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 56.84408527s ago: executing program 40 (id=1456): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) r1 = dup(0xffffffffffffffff) read(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) r3 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000000140)={{0x0, 0x1}, {0xf}}) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbef6, 0x8031, 0xffffffffffffffff, 0x1b5c7000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r5, 0x8, &(0x7f0000000000)=0x3b) syz_open_dev$tty1(0xc, 0x4, 0x3) read$FUSE(r1, &(0x7f0000008180)={0x2020, 0x0, 0x0}, 0xfffffdfc) setns(0xc9, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000580)=ANY=[@ANYRES8=r7], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r8, 0x0, 0x2d, 0x0, @val=@perf_event={0xa}}, 0x18) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r9, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000300)="00ad", 0x2}], 0x1}}], 0x1, 0x22008805) socket$nl_route(0x10, 0x3, 0x0) 51.854158158s ago: executing program 41 (id=1468): r0 = timerfd_create(0x8, 0x80800) timerfd_settime(r0, 0x3, &(0x7f0000000140), 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b9ac9ff, 0x0, 0x0, 0x2, 0x0, 0x5a6c103, 0x0, 0x6, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x4}) timerfd_settime(r0, 0x3, &(0x7f00000001c0)={{}, {0x77359400}}, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) clock_adjtime(0x4, &(0x7f0000000240)={0x23, 0xda, 0x2, 0x9, 0x100000000, 0x0, 0x7fffffff, 0x0, 0x8834, 0x9, 0x2, 0x6, 0x888c, 0x3, 0x0, 0x5, 0xfffffffffffffffe, 0x2, 0xc2, 0xd81, 0xfffffffffffffffe, 0x5, 0x80, 0x5, 0x3ff, 0x7}) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000000c0)={0x2, 0x4e23, @empty}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000681800000002000004080000001300000002000000000000000100000001000000200000000076616c0062"], 0x0, 0x80}, 0x28) sendto$inet(r1, &(0x7f0000000580)="17", 0x501, 0x10008095, 0x0, 0x0) 46.871996051s ago: executing program 42 (id=1479): bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x4, 0x4, 0xe, 0x10, 0xffffffffffffffff, 0xfffffffd}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xb, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000002080000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) sendmsg$unix(r2, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 34.878220516s ago: executing program 4 (id=1517): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/mtdblock0\x00', 0x8800, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0x20000) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x811, 0x5, 0xcf}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240448a4}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r5, &(0x7f0000000280)='0', 0x1, 0x40000, &(0x7f0000000340)={0x11, 0x6, r4, 0x1, 0x2, 0x6, @local}, 0x14) 32.491871286s ago: executing program 4 (id=1522): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000380)={'syz', 0x1}, &(0x7f0000000200)='q\xa9', 0x0) 30.962320463s ago: executing program 4 (id=1524): socket$nl_audit(0x10, 0x3, 0x9) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000880)={0x0, 0xfffffffe, 0x0, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x0, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 29.952034452s ago: executing program 4 (id=1525): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) r5 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101401, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000400)={0x2, 0x0, &(0x7f00000002c0)=""/86, &(0x7f0000000340)=""/126, &(0x7f00000003c0)=""/53, 0xeeee8000}) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@gettclass={0x24, 0x2a, 0x400, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0xf, 0xffe0}, {0xa, 0xa}, {0x6, 0x7}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) r8 = socket$inet6(0xa, 0x80001, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000680)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000006800010000002000000000000a000000000000000800060000000000"], 0x20}}, 0x0) setsockopt$inet6_MCAST_MSFILTER(r8, 0x29, 0x30, 0x0, 0x310) setsockopt$inet6_group_source_req(r8, 0x29, 0x2b, 0x0, 0x0) r9 = openat(0xffffffffffffff9c, 0x0, 0x50440, 0x29) getpid() setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r9, 0x6, 0x1d, &(0x7f0000000080)={0x2, 0x5, 0x300e, 0x8}, 0x14) rename(0x0, &(0x7f00000000c0)='./file1/file0\x00') sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x7, 0x7fffffff, 0x8, 0x4, 0x9, 0xf5, 0x4, 0x8080ffa, 0x5, 0x0, 0x9, 0x0, 0x1000004, 0x1, 0x4, 0xfff7ffa8, 0x7ffffffd, 0x1ef, 0x9, 0x2000000f, 0x55, 0x8, 0x9, 0x4, 0x100008, 0x6, 0x10, 0xee, 0x4, 0x7ffd]}) bind$can_j1939(r2, &(0x7f0000000280)={0x1d, r3, 0x2, {0x0, 0x1, 0x2}, 0xfe}, 0x18) bind$can_j1939(r0, &(0x7f0000000a40)={0x1d, r3, 0x3, {0x1, 0xff}, 0xff}, 0x18) 29.199859211s ago: executing program 4 (id=1527): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000b40), 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f00000001c0)=@ethtool_regs={0x7, 0x0, 0x8, "a8702cce82258cf1"}}) write$selinux_load(r0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e131d"], 0x16) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'xfrm0\x00'}) 27.382146874s ago: executing program 4 (id=1531): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000353000/0x2000)=nil, 0x2000, 0x0, 0x1000, 0x2000) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x9957a571a1b0e73) set_mempolicy(0x1, 0x0, 0xb) r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f0000000140)="1ba0000016001d0d89fdc5cbdd045798707bed4dca141a780f0f8e", 0xff3b, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000000)="48050000150019", 0x7}], 0x1) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3e616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000440)=ANY=[@ANYBLOB="000001000000124ab38ba4150055f5e505127d667eb9789c89e8053701a8395c3e321af1ee7f8ccee094111052ee93be948ba77291b57df585a6298cabd4d1dd1717fdb67dfbfe46a070b66e0e7a7359768d77e0f73d29b3835409dc6e6bf27bc94987c8a553cc0bef0c4d9327e0fc166b14d29da59ceb7124c16562e64aa89a9110cee59eee520db650dd1c520d562331c3b3ee4cde3f5efce634d486c8a8f1bccb64d0acc47ed2bf7ecb6a520345343c21ad46a05d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="f40000000001010400000000141a00000200ffff0800074000000001240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e02010c000280050001000000000090000d80080002007f00000114000500ff02000000000000000000000000000108000200ac1e01011400050000000000000000000000ffffffffffff08000200e0000001140004002001000005000000000000000000000214000380060002004e200000060001004e2000"], 0xf4}}, 0x0) unshare(0x6a040000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffffff, &(0x7f0000000240)='./config/usb_gadget/g1/file0\x00', 0x80) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/UDC\x00', 0x0, 0x90) read(r4, &(0x7f0000000100), 0x1000) r5 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4) faccessat2(0xffffffffffffffff, &(0x7f0000000340)='./config\x00', 0x128, 0x200) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r4, 0xc0189378, &(0x7f0000000180)={{0x1, 0x1, 0x18, r5}, './config/usb_gadget/g1/UDC\x00'}) mount(0x0, &(0x7f0000000080)='./cfg\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000280)='./config\x00', 0xfb) symlinkat(&(0x7f00000001c0)='./cfg/usb_gadget/g1/functions/eem.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./cfg/usb_gadget/g1/configs/c.1/eem.usb0\x00') 12.112574466s ago: executing program 43 (id=1531): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000353000/0x2000)=nil, 0x2000, 0x0, 0x1000, 0x2000) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x9957a571a1b0e73) set_mempolicy(0x1, 0x0, 0xb) r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f0000000140)="1ba0000016001d0d89fdc5cbdd045798707bed4dca141a780f0f8e", 0xff3b, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000000)="48050000150019", 0x7}], 0x1) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3e616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000440)=ANY=[@ANYBLOB="000001000000124ab38ba4150055f5e505127d667eb9789c89e8053701a8395c3e321af1ee7f8ccee094111052ee93be948ba77291b57df585a6298cabd4d1dd1717fdb67dfbfe46a070b66e0e7a7359768d77e0f73d29b3835409dc6e6bf27bc94987c8a553cc0bef0c4d9327e0fc166b14d29da59ceb7124c16562e64aa89a9110cee59eee520db650dd1c520d562331c3b3ee4cde3f5efce634d486c8a8f1bccb64d0acc47ed2bf7ecb6a520345343c21ad46a05d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="f40000000001010400000000141a00000200ffff0800074000000001240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e02010c000280050001000000000090000d80080002007f00000114000500ff02000000000000000000000000000108000200ac1e01011400050000000000000000000000ffffffffffff08000200e0000001140004002001000005000000000000000000000214000380060002004e200000060001004e2000"], 0xf4}}, 0x0) unshare(0x6a040000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffffff, &(0x7f0000000240)='./config/usb_gadget/g1/file0\x00', 0x80) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/UDC\x00', 0x0, 0x90) read(r4, &(0x7f0000000100), 0x1000) r5 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={0xffffffffffffffff}, 0x4) faccessat2(0xffffffffffffffff, &(0x7f0000000340)='./config\x00', 0x128, 0x200) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r4, 0xc0189378, &(0x7f0000000180)={{0x1, 0x1, 0x18, r5}, './config/usb_gadget/g1/UDC\x00'}) mount(0x0, &(0x7f0000000080)='./cfg\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000280)='./config\x00', 0xfb) symlinkat(&(0x7f00000001c0)='./cfg/usb_gadget/g1/functions/eem.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./cfg/usb_gadget/g1/configs/c.1/eem.usb0\x00') 10.482276568s ago: executing program 3 (id=1580): bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x4, 0xc, 0x0, 0x0, 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f0000000140)='securityfs\x00', 0x18, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000940)=[{&(0x7f0000000440)=""/151, 0x97}], 0x1, 0xd69d, 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0) write(r1, &(0x7f0000000100)="3c5c0f2397b4d84500b5f812365f00000000000000", 0xff40) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xb, 0x4, &(0x7f0000000240)=ANY=[], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="04002dbd7000fbdbdf250300"], 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x80004) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@newsa={0x144, 0x10, 0x1, 0x1, 0x25dfdbfd, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@multicast2, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x80, 0x87}, {@in6=@loopback, 0x4d4, 0x6c}, @in6=@rand_addr=' \x01\x00', {0x2, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8, 0x2}, {0xffffffffffffffff, 0x2a, 0x1f, 0x7b8}, {0x2, 0xfffffffc, 0xfffffbbc}, 0x70bd2a, 0x0, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075b, 0x8}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcffffff, 0x20031, 0xffffffffffffffff, 0xbe9f5000) r5 = landlock_create_ruleset(&(0x7f0000000040)={0xc015, 0x3}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r5, 0x2, &(0x7f0000000240)={0x3, 0x3}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x22, @multicast1}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffffffffffa}, {}, 0x3, 0x0, 0x1}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x39}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe, 0xfffffffe}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x1c) 10.344245742s ago: executing program 2 (id=1581): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0xe26, 0x101400) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000140)=""/76) r2 = syz_open_dev$dri(&(0x7f0000000300), 0x2, 0x4c0503) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x8000) bind$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x7, 0x6776, 0x4}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x24, 0x24, 0x8, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xa9d31e3098960501}}}, 0x24}, 0x1, 0x0, 0x0, 0x44885}, 0x20040084) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x3cd) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) sendfile(r4, 0xffffffffffffffff, 0x0, 0x400) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) write(0xca, &(0x7f0000000040)="0564", 0x2) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000001800050000000000000000002d00000000000001010100000500010008000000080004"], 0x2c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0xfffffff7) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000140000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',\x00']) r8 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000003c0)={'team_slave_0\x00', 0x0}) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000c00)=@newqdisc={0x3c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r9, {}, {0xffff, 0xfff2}, {0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_INGRESS={0x8}]}}]}, 0x3c}}, 0x0) 9.550328764s ago: executing program 3 (id=1584): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000380)={'syz', 0x1}, &(0x7f0000000200)='q\xa9', 0x0) 9.404802477s ago: executing program 2 (id=1585): setns(0xc9, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000140)={0xb, 0x29, 0x1, {0x26}}, 0xb) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0xfffffffffffffffe]}, 0x8, 0x0) read$FUSE(r1, &(0x7f0000001e00)={0x2020}, 0x2020) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) r5 = mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) mq_unlink(&(0x7f00000000c0)='eth0\x00') close(r5) syz_usbip_server_init(0x3) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_ENUMINPUT(r6, 0xc050561a, &(0x7f0000000000)={0x1, "86f582d3280e64b6c8a81daa4a45427927d9e098b0affaabf5d6763218b88d3d", 0x3, 0xcb, 0x1, 0xc00000, 0x2000000, 0x2}) openat$cgroup_subtree(r1, &(0x7f0000003e40), 0x2, 0x0) signalfd4(r1, &(0x7f0000000100)={[0x5]}, 0x8, 0x800) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f0000000080)={0xffffffff, 0xfffff6e8, 0xf9f7, 0x6, 0x7, "e80f4f3102297b470f75a93aa1ca719cf35900", 0x200, 0x7}) read$FUSE(r0, &(0x7f00000001c0)={0x2020}, 0x2020) socket(0x1f, 0x5, 0x8) 9.064133194s ago: executing program 5 (id=1587): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x29, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioprio_get$uid(0x3, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, 0x0) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="1695", 0x2}], 0x1}}], 0x2, 0x48000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10) unshare(0x42000000) 8.533764641s ago: executing program 3 (id=1588): r0 = socket$inet6(0xa, 0x80001, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x84000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000640)={'wlan0\x00'}) r5 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r5, &(0x7f00000002c0)={0x2, 0x4ea0, @empty}, 0x10) connect$inet(r5, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r5, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) sendto$l2tp6(r0, 0x0, 0x0, 0x20000800, &(0x7f0000000600)={0xa, 0x0, 0xfffffdbb, @remote, 0x1}, 0x20) setsockopt$inet6_buf(r0, 0x29, 0x32, &(0x7f0000000000)="d2f15270c1f2824de5ea159eadf70f75a80d6c68", 0x14) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r6, &(0x7f0000000100)="b00627285bd0a93c8ff7f3ec36830b02b9532c9831eedcc3d125055d4a8e8195", 0x20) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_NOACK_MAP(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000843bd7000fcdbdf255700000008000300", @ANYRES32=0x0, @ANYBLOB="0c0099000300000078000000060095000700000006009500c9d1000006009500ff7f000006009500ff030000"], 0x48}, 0x1, 0x0, 0x0, 0x4001}, 0x0) 7.019947961s ago: executing program 3 (id=1590): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r1) sendmsg$ETHTOOL_MSG_PAUSE_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01fffff0000000000000200100000c000280080002006c6f0000180003800400010008000200050000000800040076"], 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=@newqdisc={0x6c, 0x24, 0x405, 0x40000, 0x25dfdbff, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}, {0x5}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x3e8, 0xa, 0x64, 0x40000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0xfb, 0x41, 0x0, 0x0, 0x0, 0x9}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40001}, 0x8000) (async) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904"], 0x0) (async, rerun: 64) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file1\x00', 0x42, 0x5) (rerun: 64) quotactl_fd$Q_GETNEXTQUOTA(r4, 0xffffffff80000900, 0x0, &(0x7f00000003c0)) (async, rerun: 64) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) (async, rerun: 64) r6 = syz_clone(0x400000, 0x0, 0xfffffeb6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) (async) tgkill(0x0, r6, 0x20) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x10, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000002000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000060000007b8af8ff00000000bca2000000000000a6020000f8ffffffb7030000eaffffffb704000000000000850000003300000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r8, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) (async) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r4, 0xc4c85512, &(0x7f0000000600)={{0xa, 0x5, 0x4, 0x1ff, 'syz0\x00', 0x7}, 0x0, [0xffffffffffffffff, 0xffffffff, 0x6, 0x3, 0x401, 0x9, 0x4, 0x7, 0x6, 0xfffffffffffffff0, 0x200, 0x0, 0x0, 0x7, 0x10000, 0x0, 0x1, 0x1e, 0x1, 0x7, 0x2, 0x1bfffffffffd, 0xa5, 0x100, 0x2, 0x3, 0x1, 0x6, 0x200, 0x9, 0x1, 0x9, 0x6, 0xff, 0xfffffffffffff4bf, 0xa8, 0x5, 0x2, 0x38000000000, 0x6bc6ee27, 0xffffffff, 0xa, 0x14, 0xffff, 0x43, 0x10001, 0x9, 0x25a, 0xffffffffffffffff, 0x3, 0x3, 0xff, 0x3, 0x6, 0x8, 0xfffffffffffffff8, 0xa0c, 0x9, 0x8, 0x4ab5, 0x6, 0x3, 0x3, 0x7, 0x870, 0xb0, 0x6380f3dd, 0x1, 0x0, 0x9, 0x5, 0xd, 0x20, 0xffffffffffff7fff, 0xffffffffffff0001, 0x4, 0x9, 0x5, 0x8001, 0x100, 0x100000001, 0x7f, 0x2, 0x9, 0x9, 0x4, 0x1, 0x9, 0x6, 0xfffffffffffffffd, 0x7, 0x100000000, 0x967, 0xfff, 0x800, 0x3f, 0x7fff, 0x2, 0xdb37, 0x9, 0x0, 0x9, 0x5, 0x9, 0x4, 0x6, 0x2, 0xfffffffffffffffd, 0x7, 0x7, 0x3ff, 0x2, 0x9, 0xfffffffffffffffa, 0x40, 0x800, 0x4, 0x6ba, 0x101, 0x81, 0xa9a7, 0xfffffffffffffff8, 0x0, 0x5, 0x1, 0x7872298, 0x2, 0x46]}) syz_usb_control_io$printer(r3, 0x0, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async, rerun: 32) r10 = socket(0x400000000010, 0x2, 0x0) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r11, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newtfilter={0x8c, 0x2c, 0xf3f, 0x70bd2a, 0x25dddbb9, {0x0, 0x0, 0x0, r11, {0xc, 0xe}, {}, {0x7, 0xfffa}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_EMATCHES={0x58, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x4c, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x6, 0x3, 0x2}, {0x4, 0x8, 0x0, 0x3}}}, @TCF_EM_CANID={0x2c, 0x2, 0x0, 0x0, {{0xc50, 0x7, 0x2}, {{0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}}}, @TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x5, 0x1, 0xe}, {0x9, 0xce28, 0x7fff, 0x3, 0xe, 0x2, 0x1}}}]}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20041089}, 0x4880) (rerun: 64) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000340)={0x40, 0x1c, 0x4, "0acac930"}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect$uac3(0x3, 0x86, &(0x7f0000000100)=ANY=[@ANYBLOB="1201100300000010820582054000010203010902740003010f6003080b0002010130000904000000010130000a2401050a00e58a000009040100000102300009040101010102300006240201000709050109100090060f0a2525040000000a040009040200ffff023000090402010101023000090506", @ANYRESHEX=0x0], &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x6, [{0x4, &(0x7f0000000000)=@lang_id={0x4, 0x3, 0x2c0a}}, {0x4, &(0x7f0000000040)=@lang_id={0x4, 0x3, 0x820}}, {0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x415}}, {0x4, &(0x7f00000000c0)=@lang_id={0x4, 0x3, 0x420}}, {0xcf, &(0x7f0000000280)=@string={0xcf, 0x3, "dd08a155e1c3eaf4fdb5c74d9ccd773cc1ac5df90fce42090df4094340b05eb46fa837210344e18d8f21c2fd4954382e1b77382b5fa589eae01e9bf55ef4ffe28c07708c74080fee30a32e6f60660f34c217bb374d1cc077ec6e44e6bfeb621fb2cb8a3278341def46569450b9f1666fcfbaf6f736157895badd0fee51d401bf0e68c072427cf277b14b83e3e3a336749bf583e74ef94bd742fe77ee4ae0433b973741830353a64913f95ded30523e194dfe67c2e84f37b4675ad7e4ccde1332c5284cf81eb23a2e4670dd9da5"}}, {0xad, &(0x7f0000000380)=@string={0xad, 0x3, "2b82dcd2672732f54e31026dc7f206eea8394d0fe46f5be04395ff34d94c5867e8fae8742caf1e0ead3464ef8dab2fa52ad923d57a1df37b3838889692120a8aabb20cc5b122a6f9242ab078e8a4ac6b828646a99a43ef7746c8c7c295d88de1a6de054459dc24e703c2bc9e2a9da03fb8acf48795c8aad410a25ec67c5c351860a326834b4368e348e17122803a564d16213a1c634c6396510c2c2cdc61560fec32deab579b1642fe25c3"}}]}) 6.534582746s ago: executing program 2 (id=1591): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0xe26, 0x101400) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000140)=""/76) r2 = syz_open_dev$dri(&(0x7f0000000300), 0x2, 0x4c0503) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x8000) bind$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x7, 0x6776, 0x4}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x24, 0x24, 0x8, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xa9d31e3098960501}}}, 0x24}, 0x1, 0x0, 0x0, 0x44885}, 0x20040084) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x3cd) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) sendfile(r4, 0xffffffffffffffff, 0x0, 0x400) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(0xca, &(0x7f0000000040)="0564", 0x2) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000001800050000000000000000002d00000000000001010100000500010008000000080004"], 0x2c}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0xfffffff7) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000140000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',\x00']) r8 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000003c0)={'team_slave_0\x00', 0x0}) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000c00)=@newqdisc={0x3c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r9, {}, {0xffff, 0xfff2}, {0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_INGRESS={0x8}]}}]}, 0x3c}}, 0x0) 6.030974841s ago: executing program 1 (id=1592): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x0, 0x0}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x200000b, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) sendfile(r1, r1, 0x0, 0xfffa83) r2 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000ffff25bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="210a04002300726964676504000c000280150003000900"/36], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x4008000) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, 0x0, &(0x7f0000002000)) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000640), 0xc0000, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x2}, 0x10) sendmsg$tipc(r5, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r6, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r6, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x351000, 0x1) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) utimensat(r8, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000400)={{}, {r9, r10/1000+60000}}, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r7, 0x0, 0x10000, 0x0, 0x6, 0x455e9, 0x1f97e6}) r11 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r11, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r7, 0x0, 0x10000, 0x0, 0x8, 0x2ea473, 0x2eb80b, 0xf4}) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="a6fa62d9183d33e5e34499597b5800babf4977b06e7914c54ff8cdf793afe0af830a4074d9295e0448bf78c981d6ba6a2c649c36e3441e798ed273c31b8d236d58d6e6a6cf1ebc2836d7c4263328211d"], 0x8) 6.027492503s ago: executing program 2 (id=1593): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) setitimer(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000001080)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001040)={&(0x7f0000000480)={0xb94, r2, 0x100, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x100, 0x13}}}}, [@NL80211_ATTR_TX_RATES={0x138, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x70, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x35, 0x2, [{0x1, 0x7}, {0x5, 0x2}, {0x1, 0xa}, {0x7, 0x9}, {0x7, 0xa}, {0x0, 0xa}, {0x7, 0x8}, {0x6, 0xa}, {0x2, 0x4}, {0x1, 0x7}, {0x0, 0x7}, {0x2, 0x9}, {0x3, 0x7}, {0x3}, {0x1, 0x9}, {0x6, 0x3}, {0x7, 0x4}, {0x4}, {0x4, 0xa}, {0x0, 0x5}, {0x1, 0x2}, {}, {0x2, 0x3}, {0x0, 0xa}, {0x4, 0x1}, {0x6, 0x7}, {0x0, 0x9}, {0x1}, {0x7, 0x8}, {0x5, 0x2}, {0x2, 0x8}, {0x3, 0x9}, {0x6}, {0x5, 0x8}, {0x6, 0x9}, {0x0, 0x6}, {0x1, 0x4}, {0x6, 0x3}, {0x0, 0x8}, {0x5, 0x7}, {0x6, 0x3}, {0x7, 0x7}, {0x3, 0x2}, {0x6, 0x8}, {0x3, 0x1}, {0x5, 0x8}, {0x7, 0x6}, {0x4, 0x1}, {0x4}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x81, 0x7, 0x1, 0x5, 0x1, 0x5, 0x800]}}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x24, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x2627, 0xfff, 0xe7d, 0x9, 0xc6b, 0x40, 0xf, 0x7f]}}, @NL80211_TXRATE_HT={0x9, 0x2, [{0x7, 0x8}, {0x6, 0x4}, {0x3, 0xa}, {0x4, 0x6}, {0x6, 0x5}]}]}, @NL80211_BAND_6GHZ={0xa0, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x8, 0x1, [0x48, 0x12, 0x12, 0x5]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x8001, 0xff, 0xf, 0x0, 0x4, 0x1, 0x9]}}, @NL80211_TXRATE_LEGACY={0xc, 0x1, [0x6c, 0xc, 0x0, 0x48, 0x24, 0x36, 0x24, 0x24]}, @NL80211_TXRATE_HT={0xe, 0x2, [{0x7, 0x4}, {0x0, 0xa}, {0x7, 0x7}, {0x1, 0x1}, {0x6, 0x8}, {0x4}, {0x7, 0x2}, {0x1, 0x7}, {0x4}, {0x6, 0x5}]}, @NL80211_TXRATE_HT={0x13, 0x2, [{0x0, 0x5}, {0x7, 0x8}, {0x0, 0xa}, {0x0, 0x8}, {0x0, 0xa}, {0x4, 0x9}, {0x3, 0x5}, {0x4, 0x2}, {0x2, 0x6}, {0x3, 0x9}, {0x3, 0x7}, {0x1, 0x6}, {0x4, 0x4}, {}, {0x6, 0x1}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0xfff, 0x0, 0x3, 0x6, 0xbe2, 0x5, 0x9]}}, @NL80211_TXRATE_LEGACY={0x1c, 0x1, [0x16, 0x3, 0x16, 0x30, 0x1, 0xc, 0x12, 0xc, 0x4, 0x6c, 0x5, 0x60, 0xc, 0x1, 0x0, 0x3, 0x18, 0x1b, 0x4, 0x1, 0x4, 0x1, 0x4, 0x5]}, @NL80211_TXRATE_LEGACY={0x12, 0x1, [0x8, 0x24, 0x53d2404585fc857f, 0x2, 0x4, 0x2, 0x48, 0x30, 0x6, 0x12, 0x1b, 0x60, 0x16, 0x1]}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x24, 0x35, 0x2, 0x1, 0x6c, 0x24, 0x4b]}]}]}, @NL80211_ATTR_TX_RATES={0x2ac, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x24, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_2GHZ={0x30, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x400, 0x5300, 0x6, 0x4, 0x8, 0x101, 0xb2]}}]}, @NL80211_BAND_5GHZ={0x28, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x22, 0x1, [0x1, 0x5, 0xb, 0x16, 0xb, 0x18, 0x18, 0x6, 0x2, 0x24, 0x16, 0x4, 0x12, 0xb, 0x3, 0x1b, 0x12, 0xc, 0x9, 0x1b, 0x4, 0x30, 0x12, 0x5, 0x6c, 0x12, 0x36, 0x16, 0x2, 0x5]}]}, @NL80211_BAND_5GHZ={0x88, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x2, 0x81, 0xe1, 0xfff1, 0xff, 0x5, 0x2]}}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x12]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_LEGACY={0x1c, 0x1, [0x6c, 0x1b, 0x9, 0x0, 0x9, 0xb, 0x24, 0x1b, 0x16, 0x9, 0x6c, 0x1, 0x9, 0x48, 0x4, 0x1b, 0x6, 0x5, 0x9, 0x1b, 0x3, 0x6, 0x60, 0x16]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0xa, 0x81, 0x1, 0x24, 0x0, 0x4, 0x1]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xbd4, 0x1, 0x1fc, 0x8, 0x1003, 0x40, 0x0, 0x6]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0xfffc, 0x4, 0x2, 0x5, 0x3, 0x9]}}]}, @NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x58, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xff, 0x0, 0x3725, 0x81, 0x7, 0xff, 0x0, 0xa4e]}}, @NL80211_TXRATE_HT={0x2b, 0x2, [{0x1, 0x9}, {0x1, 0x8}, {0x5, 0x4}, {0x1, 0x1}, {0x4, 0x9}, {0x4, 0x2}, {0x7, 0x7}, {0x6, 0x3}, {0x4, 0xf}, {0x2, 0x3}, {0x1, 0x8}, {0x7, 0x4}, {0x2, 0x3}, {0x1, 0x3}, {0x6, 0x2}, {0x4, 0xa}, {0x6, 0x4}, {0x0, 0xa}, {0x6, 0x5}, {0x1, 0xa}, {0x0, 0x2}, {0x1, 0x3}, {0x6, 0x9}, {0x4, 0x1}, {0x0, 0x8}, {0x0, 0xa}, {0x5, 0x9}, {0x4, 0x1}, {0x0, 0x7}, {0x7, 0xa}, {0x6, 0x6}, {}, {0x0, 0x6}, {0x3, 0x6}, {0x3, 0xa}, {0x4, 0x5}, {0x2, 0x5}, {0x2, 0x2}, {0x2, 0x9}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_2GHZ={0x68, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xe, 0x5, 0x743, 0x0, 0x3, 0x4128, 0x7ff, 0x7]}}, @NL80211_TXRATE_HT={0x45, 0x2, [{0x0, 0x3}, {0x2, 0xa}, {0x3, 0x5}, {0x7, 0x4}, {0x3}, {0x2, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x2, 0x6}, {0x5}, {0x3, 0x1}, {0x6, 0x3}, {0x5, 0x1}, {0x4, 0x9}, {0x6}, {0x6, 0x6}, {0x0, 0x8}, {0x3, 0x8}, {0x5, 0x3}, {0x3, 0x8}, {}, {0x6, 0x7}, {0x2, 0x9}, {}, {0x5, 0x3}, {0x6, 0xa}, {0x5, 0x6}, {0x0, 0x4}, {0x4, 0x9}, {0x3, 0xa}, {0x7, 0x4}, {}, {0x6, 0x9}, {0x2, 0x1}, {0x1}, {0x1, 0x1}, {0x3, 0x2}, {0x5, 0xa}, {0x7, 0x1}, {0x2, 0xa}, {0x3, 0x2}, {0x2, 0x3}, {0x3}, {0x2}, {0x6, 0x5}, {0x4, 0x8}, {0x5, 0x2}, {0x5, 0x3}, {0x4, 0x6}, {0x1, 0x7}, {0x7, 0x2}, {0x0, 0xa}, {0x5, 0x3}, {0x2, 0x2}, {0x6, 0x7}, {0x7, 0x3}, {0x7, 0x5}, {0x7}, {0x1, 0x6}, {0x4, 0x2}, {0x2}, {0x5, 0x8}, {0x2, 0x7}, {0x0, 0x8}, {0x0, 0x4}]}]}, @NL80211_BAND_6GHZ={0x4c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x38, 0x2, [{0x3, 0x9}, {0x1, 0x6}, {0x4, 0xa}, {0x0, 0x9}, {0x7, 0x6}, {0x1}, {0x3, 0xa}, {0x1, 0x1}, {0x7, 0x7}, {0x0, 0x6}, {0x5, 0x7}, {0x7, 0x3}, {0x1, 0x3}, {0x0, 0x1}, {0x0, 0x7}, {0x3, 0x3}, {0x2, 0xa}, {0x3}, {0x0, 0x1}, {0x5, 0x6}, {0x1, 0x8}, {0x4, 0xa}, {0x4, 0x3}, {0x2, 0x1}, {0x7, 0x6}, {0x1, 0x7}, {0x1, 0x8}, {0x7, 0x1}, {0x2}, {0x3, 0x3}, {0x6, 0xa}, {0x4, 0x9}, {0x5, 0x9}, {0x1, 0x5}, {0x2, 0xa}, {0x1, 0x6}, {0x4, 0x1}, {0x7, 0x5}, {0x2, 0x1}, {0x5, 0x9}, {0x5, 0x7}, {0x1, 0x4}, {0x5, 0x4}, {0x3, 0xa}, {0x4, 0x6}, {0x3, 0x8}, {0x7, 0x5}, {0x6, 0x8}, {0x6, 0x4}, {0x4, 0x5}, {0x6, 0x2}, {0x2, 0x1}]}, @NL80211_TXRATE_HT={0x6, 0x2, [{0x4, 0x4}, {0x4, 0x3}]}]}, @NL80211_BAND_60GHZ={0x8c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2e, 0x2, [{0x1, 0x2}, {0x2}, {0x5, 0xa}, {0x1, 0x2}, {0x2, 0xa}, {0x2}, {0x7, 0x4}, {0x5, 0x8}, {0x0, 0x4}, {0x7, 0x2}, {0x0, 0x4}, {0x6, 0x5}, {0x5, 0x3}, {0x7, 0x6}, {0x2, 0x4}, {0x1, 0x9}, {0x6, 0x3}, {0x1, 0x4}, {0x2, 0x2}, {}, {0x2, 0x5}, {0x1, 0x9}, {0x5, 0x8}, {0x1, 0x4}, {0x6, 0xa}, {0x7, 0x1}, {0x2}, {0x6, 0x1}, {0x7, 0x4}, {0x2, 0x8}, {0x2, 0x7}, {0x0, 0x1}, {0x6, 0x5}, {0x2, 0x9}, {0x4, 0xa}, {0x6, 0x1}, {0x3}, {0x2, 0x8}, {0x3, 0x7}, {0x4, 0x7}, {0x4, 0x5}, {0x0, 0x1}]}, @NL80211_TXRATE_HT={0x44, 0x2, [{0x6, 0x9}, {0x3, 0x7}, {0x1, 0x6}, {0x4}, {0x6, 0x4}, {0x6, 0x7}, {0x6, 0x1}, {}, {0x7, 0x6}, {0x3}, {0x3, 0x9}, {0x4, 0x7}, {0x6, 0x5}, {0x0, 0x3}, {0x1, 0x1}, {}, {0x2, 0x2}, {0x6, 0x4}, {0x5, 0x5}, {0x0, 0x9}, {0x3, 0x5}, {0x3, 0x9}, {0x0, 0x7}, {0x0, 0x8}, {0x4, 0x1}, {0x0, 0x3}, {0x5, 0x3}, {0x5, 0xa}, {0x7, 0x9}, {0x1, 0x6}, {0x4, 0x1}, {0x6}, {0x4}, {0x7, 0x3}, {0x0, 0xa}, {0x1, 0x3}, {0x0, 0x8}, {0x1, 0x1}, {0x3, 0x2}, {0x7, 0x3}, {0x1, 0x3}, {0x1, 0x1}, {0x0, 0x4}, {0x1, 0x7}, {0x7, 0x3}, {0x0, 0x5}, {0x5, 0x8}, {0x6}, {0x3, 0x6}, {0x4, 0xa}, {0x1, 0x1}, {0x1}, {0x2, 0x7}, {0x3}, {0x6, 0x6}, {0x3, 0x9}, {0x7, 0x6}, {0x3, 0x1}, {0x6, 0x8}, {0x0, 0x3}, {0x0, 0x8}, {0x6, 0x9}, {0x5, 0x1}, {0x3, 0x8}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x0, 0x7, 0x4, 0xa, 0xb, 0xb, 0x1]}}]}]}, @NL80211_ATTR_TX_RATES={0x394, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x6c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x24, 0x9, 0x9, 0x6, 0x2, 0x1b, 0x48, 0x30, 0xb, 0x36, 0x4, 0x30, 0x24, 0x1, 0x16, 0x6c, 0x6, 0x1b, 0x1b, 0x5, 0x1, 0x5, 0x11, 0x1, 0x12]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2d, 0x1, 0x5d, 0x800, 0x8001, 0x6, 0xfffa, 0x9]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0xc, 0x3, 0x60, 0x30, 0x6]}, @NL80211_TXRATE_LEGACY={0x20, 0x1, [0x2, 0x36, 0x30, 0x6, 0x1b, 0x3, 0xb, 0x60, 0x36, 0x55, 0xc, 0x24, 0x9, 0x60, 0x4, 0x5, 0xb, 0x60, 0x7d, 0x4, 0x1, 0x16, 0x6, 0x48, 0x1, 0x36, 0x1b, 0x1]}]}, @NL80211_BAND_6GHZ={0x44, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6e1, 0xab, 0x6, 0x101, 0xef1, 0x2, 0x6, 0x8]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8e1, 0xd37, 0xfff5, 0x0, 0x539, 0x1275, 0x7, 0x8]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_6GHZ={0x94, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x1b, 0x2, 0x3, 0x0, 0x60, 0x60, 0x39]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x401, 0x7, 0x2, 0x81, 0x800, 0x1, 0x1c, 0x3]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x7, 0x3, 0x140, 0x8, 0x8, 0x4, 0x1000]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x36, 0x36, 0x18, 0x9, 0x48, 0x4, 0xa, 0x1, 0xc, 0x60, 0x6c, 0x6, 0x4, 0x3, 0x18, 0x53, 0x4, 0x2d, 0x12, 0x9, 0x6c, 0x1b]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x10, 0x4e5, 0x2, 0x3, 0x3, 0x6, 0xdf1]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc, 0x800, 0x6a, 0x7847, 0xfff8, 0xfff, 0x3, 0x6]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_6GHZ={0x44, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x2d, 0x2, [{0x6, 0x8}, {0x6, 0x4}, {0x0, 0x9}, {0x4, 0x7}, {0x0, 0x7}, {0x5, 0x4}, {0x1, 0xa}, {0x5, 0x8}, {0x5, 0xa}, {0x3}, {0x7, 0x2}, {0x2}, {0x5, 0x3}, {0x5, 0x7}, {0x6, 0x2}, {0x3, 0x8}, {0x0, 0x2}, {0x3, 0x5}, {0x1, 0x2}, {0x2, 0xa}, {0x1, 0x7}, {0x5}, {0x6, 0xa}, {0x3, 0x6}, {0x1, 0x4}, {0x1, 0x8}, {0x6, 0x1}, {0x4, 0x8}, {0x3, 0x8}, {0x1, 0x2}, {0x1, 0x8}, {0x0, 0x5}, {0x0, 0x8}, {0x0, 0x2}, {0x1, 0x8}, {0x4}, {0x3, 0x4}, {0x4, 0x8}, {0x6, 0x3}, {0x1, 0x8}, {0x4, 0x5}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0xcc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x41, 0x2, [{0x6, 0x5}, {0x0, 0x7}, {0x4, 0x5}, {0x3}, {0x1, 0x3}, {0x0, 0x5}, {0x2}, {0x6, 0x4}, {0x0, 0x5}, {0x7, 0x4}, {0x1, 0x6}, {0x3, 0x5}, {0x7, 0x6}, {0x0, 0x6}, {0x6, 0x8}, {0x4, 0x6}, {0x1, 0x3}, {0x0, 0x1}, {0x3, 0x7}, {0x3, 0x3}, {0x7, 0x8}, {0x1}, {0x7, 0x9}, {0x4, 0x4}, {0x0, 0xa}, {0x3, 0x1}, {0x2, 0x1}, {0x5, 0x3}, {}, {0x0, 0x1}, {0x7, 0xa}, {0x2, 0x6}, {0x4, 0x9}, {0x1, 0x4}, {0x7, 0x9}, {0x1, 0x1}, {0x5, 0xa}, {0x1, 0x2}, {0x3, 0x8}, {0x4, 0xa}, {0x0, 0x2}, {0x4, 0x6}, {0x2, 0x1}, {0x5, 0x8}, {0x0, 0x3}, {0x4, 0xa}, {0x2, 0x1}, {0x3, 0x2}, {0x4, 0x6}, {0x7, 0x9}, {0x5}, {0x4, 0x5}, {0x4, 0x6}, {0x1, 0x4}, {0x2, 0x4}, {0x1, 0x1}, {0x0, 0x8}, {0x4}, {0x5, 0x4}, {0x0, 0xa}, {0x6, 0x6}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x7, 0x3, 0x200, 0x19b, 0x9, 0x6, 0x5]}}, @NL80211_TXRATE_HT={0x40, 0x2, [{0x0, 0x2}, {0x6, 0x1}, {0x6, 0xa}, {0x1, 0x8}, {0x3, 0xa}, {0x5, 0x3}, {0x4, 0x6}, {0x1}, {0x2, 0x1}, {0x4, 0x2}, {0x7, 0x7}, {0x5, 0x5}, {0x4, 0x3}, {0x4, 0x5}, {0x1, 0x2}, {0x2, 0x5}, {0x4, 0x9}, {0x4, 0xa}, {0x4, 0x4}, {0x1, 0x7}, {0x7, 0x8}, {0x1, 0x1}, {0x3, 0x3}, {0x4}, {0x0, 0x4}, {0x1, 0x9}, {0x6}, {0x4, 0x5}, {0x5, 0x8}, {0x2, 0xa}, {0x6, 0x3}, {0x5, 0x7}, {0x5, 0x3}, {0x1, 0x8}, {0x5, 0x8}, {0x2, 0x4}, {0x5, 0x8}, {}, {0x0, 0x6}, {0x1, 0x3}, {0x6, 0x1}, {0x3, 0x7}, {0x0, 0x3}, {0x6, 0x8}, {0x5, 0x3}, {0x7, 0x3}, {0x1, 0x5}, {0x3}, {0x2, 0x4}, {0x1, 0x9}, {0x1, 0x8}, {0x3, 0x8}, {0x2, 0x1}, {0x3, 0x4}, {0x4, 0x9}, {0x6}, {0x2, 0x2}, {0x0, 0x2}, {0x0, 0x8}, {0x0, 0x4}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_LEGACY={0x20, 0x1, [0x9, 0x4, 0x16, 0x48, 0x24, 0x2, 0x24, 0x9, 0x24, 0x30, 0x1c, 0x4, 0x18, 0x30, 0xd, 0x9, 0x3, 0xc, 0x3, 0x28, 0x16, 0x3, 0x16, 0x3, 0x4, 0x12, 0x30, 0x16]}]}, @NL80211_BAND_6GHZ={0x2c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xf000, 0x2, 0x0, 0xf, 0x8, 0x7, 0x6d, 0x6]}}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x2, 0x3, 0x1, 0x5, 0x36, 0x86fb7eb1b2732d4b, 0x12, 0x6, 0x0, 0x36, 0x24, 0xc, 0x9]}]}, @NL80211_BAND_2GHZ={0x54, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x200, 0x2, 0x0, 0x8, 0x11d8, 0x7fff, 0x13, 0x1]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc805, 0xd, 0x5, 0x3, 0x4fa4, 0x36, 0xfffb, 0x7]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x40, 0x293, 0x9, 0xaa71, 0x5, 0x8001, 0x1, 0x1]}}]}, @NL80211_BAND_2GHZ={0x8c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x3c, 0x2, [{0x7, 0x9}, {0x5}, {0x3, 0x7}, {0x2, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x3, 0x3}, {0x0, 0x6}, {0x7}, {0x7, 0x9}, {0x3, 0x1}, {0x0, 0x3}, {0x1, 0x9}, {0x6, 0x7}, {0x7, 0x6}, {0x0, 0x1}, {0x0, 0x2}, {0x6, 0x4}, {0x4, 0x3}, {0x0, 0x4}, {0x2, 0xa}, {0x2, 0xa}, {}, {0x0, 0x5}, {0x7, 0x9}, {0x2, 0x6}, {0x2, 0x2}, {0x1, 0x5}, {0x2, 0xa}, {0x5, 0x6}, {0x6, 0x7}, {0x5, 0x3}, {0x2, 0x1}, {0x7, 0x3}, {0x7, 0x1}, {0x5, 0x6}, {0x5, 0x3}, {0x1, 0x6}, {0x6, 0x4}, {0x5, 0x5}, {0x4, 0x3}, {0x0, 0x5}, {0x3, 0x9}, {0x4, 0x5}, {0x2, 0x1}, {0x0, 0x3}, {0x1, 0x4}, {0x0, 0x6}, {0x5, 0x4}, {0x1}, {0x4, 0x6}, {0x1, 0x3}, {0x5, 0x9}, {0x2, 0x2}, {0x1, 0xa}, {0x0, 0x4}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x81, 0x3, 0x8000, 0x9, 0xff, 0xa, 0xb, 0x2]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x101, 0x5, 0x1, 0x7f, 0x7, 0x22d, 0x8000]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xfffa, 0x1, 0x3, 0x4, 0x6, 0x7fff, 0x1, 0x4]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_6GHZ={0x30, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x18, 0x60, 0x1b, 0x16, 0xb, 0x4, 0x6c, 0x36, 0x0, 0x30, 0xb, 0x5, 0x2, 0x5, 0x2, 0x36, 0x6, 0x48, 0x18, 0x1b, 0x60, 0xc]}]}]}, @NL80211_ATTR_TX_RATES={0x1ec, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1b, 0x1, [0x30, 0x26, 0x0, 0x48, 0x1b, 0x48, 0x60, 0x24, 0x3, 0x5, 0x5, 0x36, 0x1, 0x24, 0x1b, 0x1b, 0x48, 0x48, 0x3, 0x16, 0x6, 0x1b, 0xb]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0xe, 0x380, 0x5, 0x5, 0x8, 0x6, 0x4]}}]}, @NL80211_BAND_60GHZ={0x40, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x7f, 0x7f, 0x3, 0x5, 0x8, 0x2, 0x5]}}]}, @NL80211_BAND_6GHZ={0x78, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x52d2, 0x400, 0x3, 0x7, 0xfff7, 0xd61d, 0xff]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x9, 0x9, 0xbc7e, 0x1, 0x1, 0x0, 0xe01]}}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x52, 0x2, 0xc, 0x3, 0x3, 0x24, 0x36, 0x12, 0x48, 0x18, 0x72, 0x75, 0x1b, 0xc, 0x36, 0x48, 0x60, 0x6, 0x48, 0x60, 0x6, 0x16]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x8, 0x4, 0x5, 0x8, 0x4, 0x7, 0x4]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x9, 0x5, 0x0, 0x7, 0x9, 0x1, 0xbbe]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_5GHZ={0x9c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x1, 0x6, 0x3, 0x2, 0x13, 0x0, 0x6]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x1d27, 0x90, 0xd, 0x4f7, 0xcd, 0x7f, 0x9]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3ff, 0xfff9, 0x0, 0x0, 0x8, 0x3, 0x7, 0x5c49]}}, @NL80211_TXRATE_HT={0x4b, 0x2, [{0x7, 0x7}, {0x5, 0x7}, {0x3, 0x3}, {0x5, 0x5}, {0x4, 0x7}, {0x4, 0x9}, {0x7, 0xa}, {0x5, 0x9}, {0x6}, {0x3, 0x1}, {0x4, 0xa}, {0x6, 0xa}, {0x1, 0xa}, {0x0, 0x8}, {0x3, 0x5}, {}, {0x1, 0x4}, {0x6}, {0x4, 0x4}, {0x2, 0x7}, {0x1, 0x9}, {0x7, 0x7}, {0x4, 0x1}, {0x0, 0x5}, {0x6, 0x3}, {0x4, 0x8}, {0x4, 0x8}, {0x6, 0xa}, {0x0, 0x3}, {0x5, 0x1}, {0x6, 0x4}, {0x5, 0x8}, {0x3}, {0x1, 0x4}, {0x7, 0x7}, {0x3, 0x1}, {0x3, 0x4}, {0x3}, {0x1, 0xa}, {0x2, 0x4}, {0x0, 0x6}, {0x3, 0x5}, {0x1, 0x2}, {0x2, 0x3}, {0x2}, {0x1, 0x8}, {0x3, 0x6}, {0x4, 0x1}, {0x4, 0x3}, {0x1, 0x5}, {0x2, 0x4}, {0x1, 0x7}, {0x0, 0x4}, {0x4, 0x3}, {0x6}, {0x0, 0x7}, {0x7, 0x4}, {0x2, 0x9}, {0x3, 0xa}, {0x2, 0x6}, {0x0, 0x2}, {0x0, 0x7}, {0x0, 0x6}, {0x3, 0x4}, {0x6, 0x4}, {0x4, 0x5}, {0x2, 0x3}, {0x6, 0xa}, {0x1, 0x8}, {0x5, 0x5}, {0x6, 0x9}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_6GHZ={0x20, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0xb09, 0x1000, 0x6, 0x6, 0x8, 0xfe, 0x9]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_2GHZ={0x38, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x8, 0xd4a, 0x0, 0x3a4b, 0x2, 0x2, 0x1ff]}}, @NL80211_TXRATE_LEGACY={0x7, 0x1, [0x18, 0x6c, 0x5]}]}]}, @NL80211_ATTR_TX_RATES={0x210, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xac, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x44, 0x2, [{0x1, 0xa}, {0x0, 0x5}, {0x6, 0x2}, {0x1, 0xa}, {0x3, 0xa}, {0x1, 0x8}, {0x3, 0x6}, {0x0, 0x8}, {0x5, 0x6}, {0x1, 0x4}, {0x6, 0x2}, {0x7, 0x7}, {0x0, 0x5}, {0x0, 0x1}, {0x0, 0x2}, {0x4}, {0x3, 0x7}, {0x5, 0x6}, {0x7, 0x2}, {0x6, 0x1}, {0x0, 0x5}, {0x4, 0x9}, {0x7, 0x5}, {0x2, 0x7}, {0x7, 0x1}, {0x5, 0x7}, {0x1, 0x1}, {0x1, 0x5}, {0x6, 0x3}, {0x2, 0x7}, {0x5, 0x9}, {0x4, 0x2}, {0x0, 0x8}, {0x5, 0x2}, {0x7, 0x5}, {0x3, 0x8}, {0x0, 0x7}, {0x7, 0x6}, {0x3}, {0x3, 0x9}, {0x3, 0x9}, {0x3, 0xa}, {0x0, 0x2}, {0x1, 0x6}, {0x2, 0x5}, {0x3, 0x4}, {0x6, 0x1}, {0x6, 0xa}, {0x1, 0x3}, {0x5, 0x1}, {0x5, 0x6}, {0x2, 0x1}, {0x0, 0xa}, {0x3, 0x5}, {0x2, 0x8}, {0x3, 0x7}, {0x1, 0x5}, {0x0, 0x2}, {0x0, 0x4}, {0x1, 0x3}, {0x1, 0x1}, {0x4, 0x9}, {0x0, 0x4}, {0x6, 0x4}]}, @NL80211_TXRATE_HT={0x2f, 0x2, [{0x0, 0x1}, {0x1, 0x6}, {0x3, 0x2}, {0x4, 0x9}, {0x5, 0x7}, {0x0, 0x4}, {0x0, 0x7}, {0x0, 0x7}, {0x4, 0x3}, {0x2, 0x9}, {0x0, 0x4}, {0x2, 0x9}, {0x7, 0x3}, {0x4, 0x3}, {0x6, 0x7}, {0x5, 0x8}, {0x3, 0x7}, {}, {0x5, 0x2}, {0x0, 0x9}, {0x1, 0x1}, {0x1, 0x6}, {0x4, 0x4}, {0x1, 0x7}, {0x0, 0x1}, {0x6, 0x3}, {0x2, 0x8}, {0x7, 0x6}, {0x1, 0xa}, {0x7, 0x6}, {0x1}, {0x5, 0x9}, {0x2, 0x4}, {0x2, 0x6}, {0x6, 0x6}, {0x0, 0x1}, {0x5, 0x7}, {0x3, 0x7}, {0x4, 0x8}, {0x6}, {0x7, 0x1}, {0x6, 0x3}, {0x1, 0x1}]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x80, 0x8001, 0x2, 0x3, 0x100, 0x9, 0x9, 0x8]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_60GHZ={0xa0, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0xf, 0x2, [{0x1, 0x7}, {0x6, 0x6}, {0x2, 0xa}, {0x6, 0x2}, {0x4}, {0x7, 0x4}, {0x2, 0x3}, {0x1, 0x7}, {0x3, 0x2}, {0x3, 0x2}, {0x3}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x9, 0x3, 0x8, 0xffe0, 0x1, 0x4f, 0x7ff]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x1f, 0x1, [0x48, 0x30, 0x48, 0x60, 0x18, 0x6c, 0x6c, 0x12, 0x32, 0xc, 0x16, 0x9, 0x36, 0x47, 0x3, 0x4, 0x683337d0c46fc915, 0x60, 0x24, 0x2, 0x24, 0x1b, 0x5, 0x46, 0xc, 0x48, 0x5]}, @NL80211_TXRATE_HT={0x3f, 0x2, [{0x1, 0x9}, {0x1, 0x2}, {0x2, 0x1}, {0x7, 0x6}, {0x2, 0xa}, {0x4, 0x5}, {0x4, 0xa}, {0x2, 0x8}, {0x0, 0xa}, {0x0, 0x9}, {0x3, 0x2}, {0x2, 0x1}, {0x5, 0xa}, {0x1, 0x4}, {0x0, 0x2}, {0x5, 0xa}, {0x3, 0x2}, {0x6, 0x6}, {0x4, 0xa}, {0x2, 0x2}, {0x1, 0x7}, {0x2, 0x4}, {0x6, 0x7}, {0x0, 0x9}, {}, {0x6, 0x1}, {0x6, 0x5}, {0x5, 0x4}, {0x5}, {0x4, 0x3}, {0x6, 0xa}, {0x2}, {0x0, 0x4}, {0x4, 0x2}, {0x1, 0x9}, {0x1, 0xa}, {0x6, 0x7}, {0x7, 0x1}, {0x7, 0x7}, {0x7, 0xa}, {0x2, 0x8}, {0x4, 0x1}, {0x3}, {0x5, 0x9}, {0x6, 0x6}, {0x1, 0x7}, {0x5, 0x5}, {0x1}, {0x5, 0x8}, {0x5, 0xa}, {0x4, 0xa}, {0x2, 0x4}, {0x2, 0x8}, {0x5, 0x5}, {0x6, 0x6}, {0x2, 0x6}, {0x0, 0x2}, {0x6}, {0x6, 0x1}]}]}, @NL80211_BAND_60GHZ={0xa4, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x1, 0x5, 0x5, 0x400, 0x3cd1, 0x7, 0x5]}}, @NL80211_TXRATE_HT={0x20, 0x2, [{0x7, 0x8}, {0x1, 0x8}, {0x5, 0x5}, {0x5, 0x4}, {0x1, 0x9}, {0x0, 0x3}, {0x1, 0x4}, {0x0, 0xa}, {0x2, 0x3}, {0x5, 0x6}, {}, {0x3}, {0x3, 0x8}, {0x7, 0x9}, {0x3, 0x9}, {0x5, 0xa}, {0x0, 0x1}, {0x6, 0x3}, {0x6, 0x4}, {0x2, 0xa}, {0x7, 0x9}, {0x2, 0x5}, {0x5, 0x5}, {0x0, 0x8}, {0x3, 0x3}, {0x1, 0x1}, {0x0, 0x6}, {0x2, 0x9}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x5746, 0x1, 0xd, 0x0, 0x1, 0x7f, 0x8]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x32, 0x2, [{0x2, 0xa}, {0x1, 0x6}, {0x4, 0x4}, {0x1, 0x1}, {0x0, 0x9}, {0x1, 0x7}, {0x0, 0x4}, {0x0, 0x4}, {0x4, 0x7}, {0x7, 0x8}, {0x1, 0x7}, {0x2, 0x9}, {0x6, 0xa}, {0x1, 0x6}, {0x4, 0x3}, {0x3, 0x2}, {0x2, 0x5}, {0x0, 0xa}, {0x1, 0xa}, {0x5, 0x9}, {0x3, 0x2}, {0x3, 0x1}, {0x0, 0x2}, {0x6, 0x1}, {0x5, 0x6}, {0x6, 0x5}, {0x0, 0x5}, {0x7, 0x5}, {0x5, 0x5}, {0x5, 0x7}, {0x0, 0x8}, {0x3, 0x4}, {0x7, 0x2}, {0x0, 0x8}, {0x0, 0x9}, {0x1, 0x8}, {0x0, 0x4}, {0x7, 0x3}, {0x4, 0x5}, {0x6, 0x6}, {0x2, 0x9}, {0x2, 0x6}, {0x4, 0x7}, {0x2, 0xa}, {0x2, 0xa}, {0x1, 0x5}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x400, 0x3, 0x3, 0x2, 0x3, 0x3, 0x8000, 0x9]}}]}, @NL80211_BAND_2GHZ={0x1c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}]}, 0xb94}, 0x1, 0x0, 0x0, 0x4008840}, 0x0) r3 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd=r0, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r3, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x124411, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="02c90012000e00050014010a0023e340008000a0db165553426c39caccd0a1566484269dc913d99e0cd14fe4cb4ab8c1e0cf96a0a49439348bb0ac9345272876a4f36b3b590a9e764cd624e4d8ef630e1b5c361352a48c8800598bec81854242276001198692eff07eb4c449f8c422abc6a6377f091ef31e106fc1617fe9eb39582ee6a42a7f0dacf697072e7c3aa27f84b4984ecddca9bee742d3eda7bfe7185e8c6c8e4121763ffe17465fa9c6b0cf7fc0dafcec5d046de793b0f1a2b82cc563ff29f6b6f2137a46244b83e5b20fda26e458aa3811738b"], 0x17) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) r7 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0x2c, &(0x7f00000002c0)=ANY=[@ANYBLOB="000001"], 0x0, 0x0, 0x0, 0x0}) r8 = syz_open_dev$evdev(&(0x7f0000000100), 0x0, 0x862b01) write$char_usb(r8, &(0x7f0000000040)="e2", 0x2250) ioctl$EVIOCSCLOCKID(r7, 0x400445a0, &(0x7f0000000000)=0x1) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r9, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 5.955093717s ago: executing program 5 (id=1594): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0xc54827b730b6982b, 0x800, 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) syz_extract_tcp_res(&(0x7f0000000000), 0x4, 0xfffffffe) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) fsopen(&(0x7f0000000140)='cgroup\x00', 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7fff0000000000002800128009000100766c616e000000001800028006000100340200000c0002001f0000001e00000008000500", @ANYRES32=r4], 0x50}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000001000008000500", @ANYRES32=0x0], 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x2) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4044050) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'hsr0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r8, {0x0, 0xa}, {0x10}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r9, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r10 = syz_io_uring_setup(0x111, &(0x7f00000002c0)={0x0, 0x39c4, 0x100, 0x4, 0xfffffffe}, &(0x7f0000000580), &(0x7f0000000280), &(0x7f0000000040)) io_uring_register$IORING_REGISTER_IOWQ_AFF(r10, 0x11, &(0x7f0000000500)='n', 0x1) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r10, 0x13, &(0x7f0000000180)=[0x2, 0x6], 0x2) 5.209007046s ago: executing program 5 (id=1595): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) r1 = dup(0xffffffffffffffff) read(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) r3 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000000140)={{0x0, 0x1}, {0xf}}) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbef6, 0x8031, 0xffffffffffffffff, 0x1b5c7000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r5, 0x8, &(0x7f0000000000)=0x3b) syz_open_dev$tty1(0xc, 0x4, 0x3) read$FUSE(r1, &(0x7f0000008180)={0x2020, 0x0, 0x0}, 0xfffffdfc) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000580)=ANY=[@ANYRES8=r7], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r8, 0x0, 0x2d, 0x0, @val=@perf_event={0xa}}, 0x18) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r9, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000300)="00ad", 0x2}], 0x1}}], 0x1, 0x22008805) socket$nl_route(0x10, 0x3, 0x0) 4.238936872s ago: executing program 5 (id=1596): syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1e, 0x0, 0x4, 0xff}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.878742758s ago: executing program 2 (id=1597): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x0, 0x0}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x200000b, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) sendfile(r1, r1, 0x0, 0xfffa83) r2 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000ffff25bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="210a04002300726964676504000c000280150003000900"/36], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x4008000) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, 0x0, &(0x7f0000002000)) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000640), 0xc0000, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x2}, 0x10) sendmsg$tipc(r5, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r6, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r6, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x351000, 0x1) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) utimensat(r8, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000400)={{}, {r9, r10/1000+60000}}, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r7, 0x0, 0x10000, 0x0, 0x6, 0x455e9, 0x1f97e6}) r11 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r11, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r7, 0x0, 0x10000, 0x0, 0x8, 0x2ea473, 0x2eb80b, 0xf4}) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="a6fa62d9183d33e5e34499597b5800babf4977b06e7914c54ff8cdf793afe0af830a4074d9295e0448bf78c981d6ba6a2c649c36e3441e798ed273c31b8d236d58d6e6a6cf1ebc2836d7c4263328211d"], 0x8) 3.720429711s ago: executing program 5 (id=1598): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000040)={0xf0f043}) ioctl$EVIOCGMASK(r1, 0x5b02, 0x0) memfd_create(&(0x7f0000000080)='-B\xd5\x9appp\xf0\x00\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}\x00\x10\x00\x00\x00\x00\x00\x00\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb90a\xa9\xb2\x04\x1d\xa1\xce\x8b\x11\xea\xef\xe3\x00\x00\x00\x00\x00\x00\x00\x00', 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r4 = memfd_create(&(0x7f0000000840)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\n%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05\x9dR\xde\xf6\xc9!R#\xd7\xc0\xea\x9a\x04v\x85\xbcx\x9ai\xd2\r\x05ZY\x0e\"d\xc7\xd7\x02v32Z\xe0\n3\x8b\xa0\x83z\v\x90\x8ce\x12\xbcw\x1e\x7f \xdaPh: \x8e\x95\xb2\xee\xd9\xd9\xe47\x1c\xab\x97P\x86\x8c\xcb]Q\x83\xaaM\xc0\xd4\tQ\xee\x9c\x98\xe4\x18cb\xbd/\xd8\xe95\x7f\x00\xfd6#\x87\x8c\xf9\xa3\x041U\xb9\x14\xce\x9b', 0x2) ftruncate(r4, 0xffff) fcntl$addseals(r4, 0x409, 0x2) close(0x3) ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f0000000000)={r4, 0x0, 0x0, 0x2000}) 2.667814112s ago: executing program 1 (id=1599): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x29, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioprio_get$uid(0x3, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, 0x0) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="1695", 0x2}], 0x1}}], 0x2, 0x48000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10) unshare(0x42000000) unshare(0x64000600) unshare(0x10010400) 1.660615047s ago: executing program 1 (id=1600): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/mtdblock0\x00', 0x8800, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0x20000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x811, 0x5, 0xcf}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240448a4}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r5, &(0x7f0000000280)='0', 0x1, 0x40000, &(0x7f0000000340)={0x11, 0x6, r4, 0x1, 0x2, 0x6, @local}, 0x14) 1.273340845s ago: executing program 5 (id=1601): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev_mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000407d1e5a2d0000000000010902240001000000000904000001030102000921000000012222000905810308"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0) 1.196118103s ago: executing program 3 (id=1602): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080), 0x8200, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000880)={0x0, 0xfffffffe, 0x0, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x0, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) readv(r0, &(0x7f00000002c0), 0x0) 699.668397ms ago: executing program 2 (id=1603): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev_mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000407d1e5a2d0000000000010902240001000000000904000001030102000921000000012222000905810308"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0) (fail_nth: 1) 652.439531ms ago: executing program 1 (id=1604): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20044095}, 0x8042) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x6, 0x3, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x40008, 0x7fffffff}, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000180)={'mpc624\x00', [0x100, 0x5, 0x2, 0xc, 0x10, 0x5, 0x79, 0x0, 0xb, 0x4, 0x2, 0x1, 0x7, 0x8, 0x40, 0xfd, 0xfffffffb, 0xdd, 0x4000003, 0x7fff, 0xffffffff, 0xca9d, 0x7, 0x5, 0xfffffffb, 0xf39e, 0xffffffff, 0x8, 0x7, 0x0, 0xfffffff8]}) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffccc, &(0x7f00000002c0)=0x400000bce) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000000)={'wlan1\x00', @random="01000500"}) socket$kcm(0xf, 0x3, 0x2) syz_open_dev$MSR(&(0x7f0000000100), 0xdc, 0x0) setpriority(0x2, 0x0, 0x7) 429.822971ms ago: executing program 1 (id=1605): pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000180)={0x1, 0x0, [{0xb, 0x0, 0x6, 0x203, 0xa, 0x2, 0x1}]}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000040)={@remote}, 0x14) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/tcp6\x00') lseek(r1, 0xfffd, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r0, 0x5761, &(0x7f0000000600)={0x1, 0x0, [{0xfd85f50, 0x0, 0x0, [0x5, 0x8, 0x1000, 0xa2, 0x1, 0x1, 0xea, 0x1ff]}]}) (fail_nth: 1) 205.517742ms ago: executing program 3 (id=1606): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x29, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioprio_get$uid(0x3, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, 0x0) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="1695", 0x2}], 0x1}}], 0x2, 0x48000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10) unshare(0x42000000) unshare(0x64000600) unshare(0x10010400) 0s ago: executing program 1 (id=1607): syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1e, 0x0, 0x4, 0xff}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) kernel console output (not intermixed with test programs): e 2 family 0 port 6081 - 0 [ 622.827765][ T1370] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 622.827778][ T1370] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 622.897607][ T976] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 622.897628][ T976] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 622.979430][ T12] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 623.215511][ T1516] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 623.215531][ T1516] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 624.023906][T11166] 8021q: adding VLAN 0 to HW filter on device bond0 [ 624.036025][T11166] 8021q: adding VLAN 0 to HW filter on device team0 [ 624.116771][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 624.116858][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 624.126786][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 624.126873][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 624.150494][T11166] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 624.480178][T11511] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1358'. [ 624.496346][ T31] audit: type=1400 audit(1789993845.849:1078): avc: denied { bind } for pid=11503 comm="syz.6.1358" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 625.385108][ T31] audit: type=1400 audit(1789993846.769:1079): avc: denied { write } for pid=11487 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 626.092109][ T31] audit: type=1400 audit(1789993847.469:1080): avc: denied { write } for pid=11517 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 626.152541][ T31] audit: type=1400 audit(1789993847.539:1081): avc: denied { ioctl } for pid=11526 comm="syz.8.1360" path="/dev/mtd0" dev="devtmpfs" ino=702 ioctlcmd=0x48e2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 626.189038][T11528] xt_hashlimit: size too large, truncated to 1048576 [ 626.305377][T11532] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1359'. [ 626.423362][T11535] jffs2: notice: (11535) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 626.477105][ T31] audit: type=1400 audit(1789993847.859:1082): avc: denied { write } for pid=11533 comm="syz.6.1361" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 628.420159][ T5268] 8021q: adding VLAN 0 to HW filter on device eth20 [ 629.104972][T11541] syzkaller0: entered promiscuous mode [ 629.104997][T11541] syzkaller0: entered allmulticast mode [ 630.331161][T11570] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 631.016246][ T31] audit: type=1400 audit(1789993852.399:1083): avc: denied { write } for pid=11559 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 631.167768][ T31] audit: type=1400 audit(1789993852.549:1084): avc: denied { write } for pid=11588 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 632.583238][ T9768] Bluetooth: hci3: ISO packet too small [ 632.699811][T11609] FAULT_INJECTION: forcing a failure. [ 632.699811][T11609] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 632.699840][T11609] CPU: 1 UID: 0 PID: 11609 Comm: syz.7.1375 Not tainted syzkaller #0 PREEMPT(full) [ 632.699861][T11609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 632.699872][T11609] Call Trace: [ 632.699878][T11609] [ 632.699885][T11609] dump_stack_lvl+0x100/0x190 [ 632.699916][T11609] should_fail_ex.cold+0x5/0xa [ 632.699942][T11609] _copy_to_user+0x32/0xd0 [ 632.699965][T11609] simple_read_from_buffer+0xcb/0x170 [ 632.699991][T11609] proc_fail_nth_read+0x1af/0x230 [ 632.700021][T11609] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 632.700046][T11609] ? rw_verify_area+0xce/0x6d0 [ 632.700074][T11609] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 632.700099][T11609] vfs_read+0x1e4/0xb40 [ 632.700118][T11609] ? lock_acquire+0x1d1/0x380 [ 632.700136][T11609] ? __fget_files+0x34/0x3d0 [ 632.700157][T11609] ? __pfx_vfs_read+0x10/0x10 [ 632.700172][T11609] ? find_held_lock+0x2b/0x80 [ 632.700198][T11609] ? __fget_files+0x215/0x3d0 [ 632.700224][T11609] ? __fget_files+0x21f/0x3d0 [ 632.700253][T11609] ksys_read+0x12a/0x250 [ 632.700271][T11609] ? __pfx_ksys_read+0x10/0x10 [ 632.700297][T11609] do_syscall_64+0x123/0x790 [ 632.700326][T11609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.700344][T11609] RIP: 0033:0x7fb64895e98e [ 632.700360][T11609] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 632.700377][T11609] RSP: 002b:00007fb6497e4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 632.700395][T11609] RAX: ffffffffffffffda RBX: 00007fb6497e56c0 RCX: 00007fb64895e98e [ 632.700407][T11609] RDX: 000000000000000f RSI: 00007fb6497e50a0 RDI: 0000000000000003 [ 632.700417][T11609] RBP: 00007fb6497e5090 R08: 0000000000000000 R09: 0000000000000000 [ 632.700427][T11609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 632.700437][T11609] R13: 00007fb648c26038 R14: 00007fb648c25fa0 R15: 00007ffe0434eea8 [ 632.700463][T11609] [ 632.868698][T11612] netlink: 'syz.7.1376': attribute type 10 has an invalid length. [ 633.882081][T11602] : renamed from bond_slave_0 (while UP) [ 633.946113][T11612] bridge0: port 2(bridge_slave_1) entered disabled state [ 633.946390][T11612] bridge0: port 1(bridge_slave_0) entered disabled state [ 633.956499][T11612] bridge0: port 2(bridge_slave_1) entered blocking state [ 633.956581][T11612] bridge0: port 2(bridge_slave_1) entered forwarding state [ 633.957293][T11612] bridge0: port 1(bridge_slave_0) entered blocking state [ 633.957378][T11612] bridge0: port 1(bridge_slave_0) entered forwarding state [ 633.972961][T11612] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 634.216991][T11624] capability: warning: `syz.8.1378' uses deprecated v2 capabilities in a way that may be insecure [ 634.932914][ T31] audit: type=1400 audit(1789993856.319:1085): avc: denied { unmount } for pid=10989 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 634.983848][T11639] netlink: 24 bytes leftover after parsing attributes in process `syz.9.1381'. [ 634.986212][T11637] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1380'. [ 636.183433][T11166] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 636.396080][ T31] audit: type=1400 audit(1789993857.779:1086): avc: denied { create } for pid=11656 comm="syz.6.1385" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 636.409252][T11166] veth0_vlan: entered promiscuous mode [ 636.414047][T11166] veth1_vlan: entered promiscuous mode [ 636.419703][ T31] audit: type=1400 audit(1789993857.809:1087): avc: denied { write } for pid=11656 comm="syz.6.1385" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 636.483376][T11166] veth0_macvtap: entered promiscuous mode [ 636.493678][T11166] veth1_macvtap: entered promiscuous mode [ 636.538622][T11166] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 636.567909][T11166] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 636.591116][ T5702] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 636.642295][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.649134][ T1462] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.652135][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.652189][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.664878][ T9768] Bluetooth: hci2: Unable to find connection for big 0x00 [ 636.732051][ T31] audit: type=1400 audit(1789993858.119:1088): avc: denied { write } for pid=11655 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 636.781442][ T5702] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 636.782318][ T5702] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 636.782339][ T5702] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 636.782372][ T5702] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 636.782407][ T5702] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 636.842060][ T31] audit: type=1400 audit(1789993858.229:1089): avc: denied { write } for pid=11676 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 636.845317][ T1377] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 636.845333][ T1377] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 636.915096][ T1377] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 636.915114][ T1377] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 636.920745][ T5268] 8021q: adding VLAN 0 to HW filter on device eth21 [ 636.950713][ T7308] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 637.015304][ T31] audit: type=1400 audit(1789993858.399:1090): avc: denied { connect } for pid=11657 comm="syz.9.1384" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 637.017447][ T31] audit: type=1400 audit(1789993858.399:1091): avc: denied { write } for pid=11657 comm="syz.9.1384" path="socket:[34481]" dev="sockfs" ino=34481 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 637.129129][ T7308] usb 9-1: Using ep0 maxpacket: 32 [ 637.130785][ T7308] usb 9-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 637.131639][ T7308] usb 9-1: config 0 has an invalid interface number: 85 but max is 0 [ 637.131659][ T7308] usb 9-1: config 0 has no interface number 0 [ 637.131702][ T7308] usb 9-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 637.131727][ T7308] usb 9-1: config 0 interface 85 has no altsetting 0 [ 637.164240][ T7308] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 637.164263][ T7308] usb 9-1: Product: syz [ 637.164275][ T7308] usb 9-1: Manufacturer: syz [ 637.164288][ T7308] usb 9-1: SerialNumber: syz [ 637.171343][ T7308] usb 9-1: config 0 descriptor?? [ 637.756787][ T31] audit: type=1400 audit(1789993859.139:1092): avc: denied { read write } for pid=11692 comm="syz.6.1389" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 637.757248][ T31] audit: type=1400 audit(1789993859.139:1093): avc: denied { open } for pid=11692 comm="syz.6.1389" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 637.758132][ T31] audit: type=1400 audit(1789993859.139:1094): avc: denied { ioctl } for pid=11692 comm="syz.6.1389" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x5628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 637.765607][ T31] audit: type=1400 audit(1789993859.149:1095): avc: denied { getopt } for pid=11692 comm="syz.6.1389" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 638.024400][ T7308] appletouch 9-1:0.85: Geyser mode initialized. [ 638.031305][ T7308] input: appletouch as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.85/input/input21 [ 638.687354][ T25] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 638.793473][ T5268] 8021q: adding VLAN 0 to HW filter on device eth22 [ 638.838939][ T25] usb 1-1: Using ep0 maxpacket: 8 [ 638.839639][ T25] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 638.840544][ T25] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 638.840586][ T25] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 638.840606][ T25] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 638.840626][ T25] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 638.840646][ T25] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 638.840679][ T25] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 639.340542][T11715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 639.340888][T11715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 639.374932][ T25] usb 1-1: usb_control_msg returned -32 [ 639.374971][ T25] usbtmc 1-1:16.0: can't read capabilities [ 641.026136][ T25] usb 10-1: USB disconnect, device number 2 [ 641.108024][T11739] xt_hashlimit: max too large, truncated to 1048576 [ 641.116033][T11739] xt_IDLETIMER: timeout value is zero [ 641.262028][ T25] usb 9-1: USB disconnect, device number 2 [ 641.293438][ T25] appletouch 9-1:0.85: input: appletouch disconnected [ 641.379270][ T5716] usb 1-1: USB disconnect, device number 10 [ 641.469368][T11757] FAULT_INJECTION: forcing a failure. [ 641.469368][T11757] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 641.469398][T11757] CPU: 0 UID: 0 PID: 11757 Comm: syz.7.1400 Not tainted syzkaller #0 PREEMPT(full) [ 641.469425][T11757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 641.469436][T11757] Call Trace: [ 641.469442][T11757] [ 641.469449][T11757] dump_stack_lvl+0x100/0x190 [ 641.469480][T11757] should_fail_ex.cold+0x5/0xa [ 641.469506][T11757] _copy_from_user+0x2e/0xd0 [ 641.469529][T11757] move_addr_to_kernel+0x65/0x170 [ 641.469549][T11757] __sys_sendto+0x1b8/0x4e0 [ 641.469572][T11757] ? __pfx___sys_sendto+0x10/0x10 [ 641.469600][T11757] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 641.469638][T11757] ? ksys_write+0x1ac/0x250 [ 641.469657][T11757] ? __pfx_ksys_write+0x10/0x10 [ 641.469679][T11757] __x64_sys_sendto+0xe0/0x1c0 [ 641.469699][T11757] ? do_syscall_64+0xae/0x790 [ 641.469726][T11757] ? lockdep_hardirqs_on+0x7d/0x110 [ 641.469751][T11757] do_syscall_64+0x123/0x790 [ 641.469780][T11757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 641.469799][T11757] RIP: 0033:0x7fb64899e159 [ 641.469814][T11757] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 641.469831][T11757] RSP: 002b:00007fb6497c4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 641.469849][T11757] RAX: ffffffffffffffda RBX: 00007fb648c26090 RCX: 00007fb64899e159 [ 641.469860][T11757] RDX: 0000000000000048 RSI: 0000200000000540 RDI: 0000000000000003 [ 641.469871][T11757] RBP: 00007fb6497c4090 R08: 0000200000000c00 R09: 0000000000000010 [ 641.469883][T11757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 641.469893][T11757] R13: 00007fb648c26128 R14: 00007fb648c26090 R15: 00007ffe0434eea8 [ 641.469917][T11757] [ 641.531405][ T31] kauditd_printk_skb: 5 callbacks suppressed [ 641.531419][ T31] audit: type=1400 audit(1789993862.839:1101): avc: denied { read } for pid=5268 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 642.082504][ T7308] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 642.356623][ T7308] usb 10-1: Using ep0 maxpacket: 16 [ 642.358787][ T7308] usb 10-1: New USB device found, idVendor=056a, idProduct=0003, bcdDevice= 0.00 [ 642.361747][ T7308] usb 10-1: too many endpoints for config 0 interface 0 altsetting 3: 255, using maximum allowed: 30 [ 642.361784][ T7308] usb 10-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 642.361805][ T7308] usb 10-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 642.361829][ T7308] usb 10-1: config 0 interface 0 has no altsetting 0 [ 642.361856][ T7308] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.377396][T11750] netlink: 17279 bytes leftover after parsing attributes in process `syz.8.1399'. [ 642.669358][ T25] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 642.677470][T11775] FAULT_INJECTION: forcing a failure. [ 642.677470][T11775] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 642.677537][T11775] CPU: 1 UID: 0 PID: 11775 Comm: syz.6.1404 Not tainted syzkaller #0 PREEMPT(full) [ 642.677563][T11775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 642.677574][T11775] Call Trace: [ 642.677580][T11775] [ 642.677587][T11775] dump_stack_lvl+0x100/0x190 [ 642.677618][T11775] should_fail_ex.cold+0x5/0xa [ 642.677647][T11775] _copy_from_user+0x2e/0xd0 [ 642.677669][T11775] copy_msghdr_from_user+0x9f/0x4c0 [ 642.677689][T11775] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 642.677713][T11775] ? preempt_schedule_irq+0x79/0x90 [ 642.677744][T11775] ___sys_sendmsg+0x106/0x1e0 [ 642.677763][T11775] ? __pfx____sys_sendmsg+0x10/0x10 [ 642.677793][T11775] ? __rcu_read_unlock+0x26a/0x5e0 [ 642.677831][T11775] __sys_sendmsg+0x160/0x210 [ 642.677855][T11775] ? __pfx___sys_sendmsg+0x10/0x10 [ 642.677891][T11775] do_syscall_64+0x123/0x790 [ 642.677920][T11775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 642.677939][T11775] RIP: 0033:0x7ffad679e159 [ 642.677954][T11775] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 642.677970][T11775] RSP: 002b:00007ffad767d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 642.677988][T11775] RAX: ffffffffffffffda RBX: 00007ffad6a25fa0 RCX: 00007ffad679e159 [ 642.677999][T11775] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 642.678010][T11775] RBP: 00007ffad767d090 R08: 0000000000000000 R09: 0000000000000000 [ 642.678021][T11775] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 642.678030][T11775] R13: 00007ffad6a26038 R14: 00007ffad6a25fa0 R15: 00007ffe88970798 [ 642.678054][T11775] [ 642.968979][ T25] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 642.991041][ T25] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.092512][T11779] FAULT_INJECTION: forcing a failure. [ 643.092512][T11779] name failslab, interval 1, probability 0, space 0, times 0 [ 643.092546][T11779] CPU: 1 UID: 0 PID: 11779 Comm: syz.6.1406 Not tainted syzkaller #0 PREEMPT(full) [ 643.092567][T11779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 643.092579][T11779] Call Trace: [ 643.092585][T11779] [ 643.092592][T11779] dump_stack_lvl+0x100/0x190 [ 643.092623][T11779] should_fail_ex.cold+0x5/0xa [ 643.092649][T11779] should_failslab+0xc2/0x120 [ 643.092673][T11779] __kmalloc_noprof+0xfc/0x840 [ 643.092695][T11779] ? rcu_is_watching+0x13/0xc0 [ 643.092720][T11779] ? tomoyo_realpath_from_path+0xb6/0x690 [ 643.092749][T11779] tomoyo_realpath_from_path+0xb6/0x690 [ 643.092779][T11779] tomoyo_path_number_perm+0x23c/0x580 [ 643.092797][T11779] ? tomoyo_path_number_perm+0x22e/0x580 [ 643.092818][T11779] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 643.092848][T11779] ? __lock_acquire+0x5c0/0x1f40 [ 643.092880][T11779] ? __fget_files+0x34/0x3d0 [ 643.092904][T11779] ? find_held_lock+0x2b/0x80 [ 643.092929][T11779] ? hook_file_ioctl_common+0x140/0x440 [ 643.092960][T11779] ? __fget_files+0x21f/0x3d0 [ 643.092987][T11779] security_file_ioctl+0xd3/0x230 [ 643.093009][T11779] __x64_sys_ioctl+0xb7/0x210 [ 643.093030][T11779] do_syscall_64+0x123/0x790 [ 643.093059][T11779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 643.093078][T11779] RIP: 0033:0x7ffad679e159 [ 643.093093][T11779] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 643.093110][T11779] RSP: 002b:00007ffad767d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 643.093128][T11779] RAX: ffffffffffffffda RBX: 00007ffad6a25fa0 RCX: 00007ffad679e159 [ 643.093140][T11779] RDX: 0000200000000480 RSI: 00000000c0386105 RDI: 0000000000000003 [ 643.093151][T11779] RBP: 00007ffad767d090 R08: 0000000000000000 R09: 0000000000000000 [ 643.093161][T11779] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 643.093172][T11779] R13: 00007ffad6a26038 R14: 00007ffad6a25fa0 R15: 00007ffe88970798 [ 643.093197][T11779] [ 643.094187][T11779] ERROR: Out of memory at tomoyo_realpath_from_path. [ 643.201526][ T7308] usb 10-1: config 0 descriptor?? [ 643.554902][ T31] audit: type=1400 audit(1789993864.939:1102): avc: denied { append } for pid=11798 comm="syz.7.1411" name="001" dev="devtmpfs" ino=744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 643.656313][ T7308] usbhid 10-1:0.0: can't add hid device: -71 [ 643.656415][ T7308] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 643.679641][ T7308] usb 10-1: USB disconnect, device number 3 [ 643.695465][ T31] audit: type=1400 audit(1789993865.079:1103): avc: denied { write } for pid=11756 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 643.747126][ T25] cdc_acm 9-1:1.0: ttyACM0: USB ACM device [ 643.973724][ T7308] usb 9-1: USB disconnect, device number 3 [ 644.578793][ T31] audit: type=1400 audit(1789993865.959:1104): avc: denied { write } for pid=11809 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 645.788798][T11826] FAULT_INJECTION: forcing a failure. [ 645.788798][T11826] name failslab, interval 1, probability 0, space 0, times 0 [ 645.788826][T11826] CPU: 0 UID: 0 PID: 11826 Comm: syz.6.1414 Not tainted syzkaller #0 PREEMPT(full) [ 645.788847][T11826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 645.788857][T11826] Call Trace: [ 645.788863][T11826] [ 645.788869][T11826] dump_stack_lvl+0x100/0x190 [ 645.788901][T11826] should_fail_ex.cold+0x5/0xa [ 645.788926][T11826] should_failslab+0xc2/0x120 [ 645.788951][T11826] __kmalloc_noprof+0xfc/0x840 [ 645.788970][T11826] ? rcu_is_watching+0x13/0xc0 [ 645.788994][T11826] ? tomoyo_realpath_from_path+0xb6/0x690 [ 645.789028][T11826] tomoyo_realpath_from_path+0xb6/0x690 [ 645.789057][T11826] tomoyo_path_number_perm+0x23c/0x580 [ 645.789075][T11826] ? tomoyo_path_number_perm+0x22e/0x580 [ 645.789096][T11826] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 645.789126][T11826] ? __lock_acquire+0x5c0/0x1f40 [ 645.789158][T11826] ? __fget_files+0x34/0x3d0 [ 645.789182][T11826] ? find_held_lock+0x2b/0x80 [ 645.789206][T11826] ? hook_file_ioctl_common+0x140/0x440 [ 645.789237][T11826] ? __fget_files+0x21f/0x3d0 [ 645.789263][T11826] security_file_ioctl+0xd3/0x230 [ 645.789285][T11826] __x64_sys_ioctl+0xb7/0x210 [ 645.789307][T11826] do_syscall_64+0x123/0x790 [ 645.789336][T11826] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 645.789355][T11826] RIP: 0033:0x7ffad679e159 [ 645.789369][T11826] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 645.789386][T11826] RSP: 002b:00007ffad767d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 645.789403][T11826] RAX: ffffffffffffffda RBX: 00007ffad6a25fa0 RCX: 00007ffad679e159 [ 645.789414][T11826] RDX: 0000200000000000 RSI: 000000008038550a RDI: 0000000000000003 [ 645.789425][T11826] RBP: 00007ffad767d090 R08: 0000000000000000 R09: 0000000000000000 [ 645.789435][T11826] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 645.789445][T11826] R13: 00007ffad6a26038 R14: 00007ffad6a25fa0 R15: 00007ffe88970798 [ 645.789471][T11826] [ 645.792562][T11826] ERROR: Out of memory at tomoyo_realpath_from_path. [ 646.166445][ T9768] Bluetooth: hci4: ISO packet too small [ 646.539124][ T31] audit: type=1400 audit(1789993867.919:1105): avc: denied { ioctl } for pid=11834 comm="syz.6.1418" path="/dev/video37" dev="devtmpfs" ino=1049 ioctlcmd=0x561a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 646.546101][T11855] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(8) [ 646.546126][T11855] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 646.546236][T11855] vhci_hcd vhci_hcd.0: Device attached [ 646.614003][ T5716] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 646.781212][ T5716] usb 10-1: Using ep0 maxpacket: 16 [ 646.782593][ T5716] usb 10-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 646.783579][ T5716] usb 10-1: config 0 has an invalid descriptor of length 112, skipping remainder of the config [ 646.783608][ T5716] usb 10-1: too many endpoints for config 0 interface 0 altsetting 97: 99, using maximum allowed: 30 [ 646.783639][ T5716] usb 10-1: config 0 interface 0 altsetting 97 has 0 endpoint descriptors, different from the interface descriptor's value: 99 [ 646.783663][ T5716] usb 10-1: config 0 interface 0 has no altsetting 0 [ 646.786953][ T5716] usb 10-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 646.786975][ T5716] usb 10-1: Manufacturer: syz [ 646.816205][ T31] audit: type=1400 audit(1789993868.189:1106): avc: denied { write } for pid=11836 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 646.859942][ T10] usb 45-1: new high-speed USB device number 2 using vhci_hcd [ 646.899109][T11856] vhci_hcd: connection reset by peer [ 646.904906][ T1413] vhci_hcd vhci_hcd.6: stop threads [ 646.904925][ T1413] vhci_hcd vhci_hcd.6: release socket [ 646.907030][ T1413] vhci_hcd vhci_hcd.6: disconnect device [ 647.530434][ T5716] usb 10-1: config 0 descriptor?? [ 648.801852][ T31] audit: type=1400 audit(1789993870.189:1107): avc: denied { write } for pid=11872 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 648.805434][ T5716] usb 10-1: USB disconnect, device number 4 [ 648.917940][ T31] audit: type=1400 audit(1789993870.299:1108): avc: denied { setopt } for pid=11879 comm="syz.8.1427" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 648.926721][ T9768] Bluetooth: hci4: ISO packet too small [ 648.962316][T11883] FAULT_INJECTION: forcing a failure. [ 648.962316][T11883] name failslab, interval 1, probability 0, space 0, times 0 [ 648.962343][T11883] CPU: 1 UID: 0 PID: 11883 Comm: syz.7.1428 Not tainted syzkaller #0 PREEMPT(full) [ 648.962364][T11883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 648.962375][T11883] Call Trace: [ 648.962381][T11883] [ 648.962388][T11883] dump_stack_lvl+0x100/0x190 [ 648.962419][T11883] should_fail_ex.cold+0x5/0xa [ 648.962446][T11883] should_failslab+0xc2/0x120 [ 648.962470][T11883] __kvmalloc_node_noprof+0x113/0x9b0 [ 648.962496][T11883] ? _kstrtoull+0x144/0x200 [ 648.962520][T11883] ? __pfx__kstrtoull+0x10/0x10 [ 648.962544][T11883] ? seq_read_iter+0x819/0x1270 [ 648.962571][T11883] seq_read_iter+0x819/0x1270 [ 648.962592][T11883] ? register_lock_class+0x3f/0x7b0 [ 648.962612][T11883] ? __lock_acquire+0x5c0/0x1f40 [ 648.962640][T11883] seq_read+0x344/0x4d0 [ 648.962661][T11883] ? __pfx_seq_read+0x10/0x10 [ 648.962679][T11883] ? get_pid_task+0x2a/0x250 [ 648.962708][T11883] ? lock_acquire+0x1d1/0x380 [ 648.962729][T11883] ? fdget_pos+0x2aa/0x380 [ 648.962755][T11883] ? selinux_file_permission+0x8f/0x6d0 [ 648.962781][T11883] ? __pfx_seq_read+0x10/0x10 [ 648.962803][T11883] proc_reg_read+0x240/0x330 [ 648.962830][T11883] ? __pfx_proc_reg_read+0x10/0x10 [ 648.962858][T11883] vfs_read+0x1e4/0xb40 [ 648.962878][T11883] ? lock_acquire+0x1d1/0x380 [ 648.962896][T11883] ? __fget_files+0x34/0x3d0 [ 648.962918][T11883] ? __pfx_vfs_read+0x10/0x10 [ 648.962934][T11883] ? find_held_lock+0x2b/0x80 [ 648.962960][T11883] ? __fget_files+0x215/0x3d0 [ 648.962986][T11883] ? __fget_files+0x21f/0x3d0 [ 648.963016][T11883] ksys_read+0x12a/0x250 [ 648.963035][T11883] ? __pfx_ksys_read+0x10/0x10 [ 648.963061][T11883] do_syscall_64+0x123/0x790 [ 648.963090][T11883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.963108][T11883] RIP: 0033:0x7fb64899e159 [ 648.963123][T11883] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 648.963140][T11883] RSP: 002b:00007fb6497e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 648.963158][T11883] RAX: ffffffffffffffda RBX: 00007fb648c25fa0 RCX: 00007fb64899e159 [ 648.963171][T11883] RDX: 00000000000000c2 RSI: 0000200000001b00 RDI: 0000000000000004 [ 648.963182][T11883] RBP: 00007fb6497e5090 R08: 0000000000000000 R09: 0000000000000000 [ 648.963194][T11883] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 648.963205][T11883] R13: 00007fb648c26038 R14: 00007fb648c25fa0 R15: 00007ffe0434eea8 [ 648.963231][T11883] [ 649.109724][T11880] bridge0: adding interface bridge_slave_0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 649.561248][ T9768] Bluetooth: hci0: Unable to find connection for big 0x00 [ 650.580280][ T9768] Bluetooth: hci4: ISO packet too small [ 650.644925][ T31] audit: type=1400 audit(1789993872.029:1109): avc: denied { write } for pid=11894 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 650.783178][T11921] netlink: 9286 bytes leftover after parsing attributes in process `syz.7.1437'. [ 650.873985][ T31] audit: type=1400 audit(1789993872.259:1110): avc: denied { write } for pid=11922 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 650.950942][ T5268] 8021q: adding VLAN 0 to HW filter on device eth4 [ 651.129420][T11931] netlink: 9286 bytes leftover after parsing attributes in process `syz.6.1440'. [ 651.155388][ T9768] Bluetooth: hci4: ISO packet too small [ 651.264693][T11937] jffs2: notice: (11937) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 651.290538][ T31] audit: type=1400 audit(1789993872.669:1111): avc: denied { write } for pid=11936 comm="syz.6.1442" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 651.337605][ T31] audit: type=1400 audit(1789993872.719:1112): avc: denied { read } for pid=11939 comm="syz.0.1443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 651.510632][T11937] syzkaller0: entered promiscuous mode [ 651.510656][T11937] syzkaller0: entered allmulticast mode [ 651.512696][ T9768] Bluetooth: hci1: Unable to find connection for big 0x00 [ 651.574118][ T31] audit: type=1400 audit(1789993872.959:1113): avc: denied { write } for pid=11934 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 651.579588][ T5716] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 651.691018][ T31] audit: type=1400 audit(1789993873.069:1114): avc: denied { write } for pid=11952 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 651.752463][ T5716] usb 1-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice= 1.00 [ 651.772107][ T5716] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 651.867103][ T5716] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 651.867131][ T5716] usb 1-1: Product: syz [ 651.867144][ T5716] usb 1-1: Manufacturer: syz [ 652.531513][ T5716] input: Samsung SUR40 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input23 [ 652.849056][ T5716] usb 1-1: USB disconnect, device number 11 [ 653.559476][ T10] vhci_hcd vhci_hcd.6: vhci_device speed not set [ 653.712835][ T5716] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 653.864255][ T5716] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 653.865173][ T5716] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid maxpacket 44431, setting to 1024 [ 653.865201][ T5716] usb 1-1: config 1 interface 1 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 653.865233][ T5716] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 654.109679][ T5716] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 654.491685][ T5268] 8021q: adding VLAN 0 to HW filter on device eth23 [ 654.640230][ T31] audit: type=1400 audit(1789993876.029:1115): avc: denied { ioctl } for pid=11971 comm="syz.6.1450" path="socket:[36143]" dev="sockfs" ino=36143 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 654.766855][T11978] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 655.524887][ T9768] Bluetooth: hci3: ISO packet too small [ 655.536077][ T31] audit: type=1400 audit(1789993876.919:1116): avc: denied { write } for pid=11968 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 655.610135][ T9768] Bluetooth: hci3: Unable to find connection for big 0x00 [ 655.614653][ T31] audit: type=1400 audit(1789993876.999:1117): avc: denied { write } for pid=11994 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 656.034738][ T31] audit: type=1400 audit(1789993877.419:1118): avc: denied { write } for pid=11998 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 656.121715][ T31] audit: type=1400 audit(1789993877.509:1119): avc: denied { write } for pid=12012 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 656.343474][ T31] audit: type=1400 audit(1789993877.729:1120): avc: denied { write } for pid=12014 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 656.406919][ T31] audit: type=1400 audit(1789993877.789:1121): avc: denied { write } for pid=12025 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 656.719316][ T31] audit: type=1400 audit(1789993878.039:1122): avc: denied { write } for pid=12027 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 656.719385][ T31] audit: type=1400 audit(1789993878.099:1123): avc: denied { write } for pid=12038 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 656.806157][ T31] audit: type=1400 audit(1789993878.189:1124): avc: denied { read } for pid=12040 comm="syz.6.1457" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 656.968851][ T31] audit: type=1400 audit(1789993878.349:1125): avc: denied { ioctl } for pid=12040 comm="syz.6.1457" path="socket:[36249]" dev="sockfs" ino=36249 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 656.982393][T12053] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1457'. [ 657.005127][ T31] audit: type=1400 audit(1789993878.359:1126): avc: denied { bind } for pid=12040 comm="syz.6.1457" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 657.005163][ T31] audit: type=1400 audit(1789993878.359:1127): avc: denied { setopt } for pid=12040 comm="syz.6.1457" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 657.049774][ T31] audit: type=1400 audit(1789993878.429:1128): avc: denied { write } for pid=12042 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 657.127219][ T31] audit: type=1400 audit(1789993878.509:1129): avc: denied { write } for pid=12057 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 657.256743][ T31] audit: type=1400 audit(1789993878.639:1130): avc: denied { mounton } for pid=12062 comm="syz.6.1459" path="/syzcgroup/unified/syz6" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 658.207791][ T31] audit: type=1400 audit(1789993879.589:1131): avc: denied { write } for pid=12061 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 658.594325][T12088] netlink: 'syz.6.1461': attribute type 4 has an invalid length. [ 658.630075][T12088] netlink: 'syz.6.1461': attribute type 50 has an invalid length. [ 659.346455][T12099] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 659.427688][T12104] FAULT_INJECTION: forcing a failure. [ 659.427688][T12104] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 659.427717][T12104] CPU: 1 UID: 0 PID: 12104 Comm: syz.6.1463 Not tainted syzkaller #0 PREEMPT(full) [ 659.427737][T12104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 659.427747][T12104] Call Trace: [ 659.427753][T12104] [ 659.427775][T12104] dump_stack_lvl+0x100/0x190 [ 659.427804][T12104] should_fail_ex.cold+0x5/0xa [ 659.427829][T12104] _copy_from_user+0x2e/0xd0 [ 659.427850][T12104] copy_msghdr_from_user+0x9f/0x4c0 [ 659.427869][T12104] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 659.427891][T12104] ? lock_acquire+0x1d1/0x380 [ 659.427909][T12104] ? get_pid_task+0x2a/0x250 [ 659.427936][T12104] ___sys_sendmsg+0x106/0x1e0 [ 659.427956][T12104] ? __pfx____sys_sendmsg+0x10/0x10 [ 659.427974][T12104] ? get_pid_task+0x106/0x250 [ 659.428008][T12104] ? find_held_lock+0x2b/0x80 [ 659.428047][T12104] __sys_sendmsg+0x160/0x210 [ 659.428070][T12104] ? __pfx___sys_sendmsg+0x10/0x10 [ 659.428107][T12104] do_syscall_64+0x123/0x790 [ 659.428137][T12104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 659.428155][T12104] RIP: 0033:0x7ffad679e159 [ 659.428170][T12104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 659.428186][T12104] RSP: 002b:00007ffad767d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 659.428205][T12104] RAX: ffffffffffffffda RBX: 00007ffad6a25fa0 RCX: 00007ffad679e159 [ 659.428217][T12104] RDX: 0000000000000040 RSI: 0000200000000440 RDI: 0000000000000003 [ 659.428228][T12104] RBP: 00007ffad767d090 R08: 0000000000000000 R09: 0000000000000000 [ 659.428238][T12104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 659.428248][T12104] R13: 00007ffad6a26038 R14: 00007ffad6a25fa0 R15: 00007ffe88970798 [ 659.428272][T12104] [ 659.489508][ T9768] Bluetooth: hci2: ISO packet too small [ 659.769475][ T986] usb 1-1: USB disconnect, device number 12 [ 660.309510][ T9768] Bluetooth: hci4: Unable to find connection for big 0x00 [ 662.385794][T12175] FAULT_INJECTION: forcing a failure. [ 662.385794][T12175] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 662.385814][T12175] CPU: 0 UID: 0 PID: 12175 Comm: syz.6.1472 Not tainted syzkaller #0 PREEMPT(full) [ 662.385827][T12175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 662.385833][T12175] Call Trace: [ 662.385837][T12175] [ 662.385841][T12175] dump_stack_lvl+0x100/0x190 [ 662.385862][T12175] should_fail_ex.cold+0x5/0xa [ 662.385877][T12175] _copy_from_user+0x2e/0xd0 [ 662.385890][T12175] copy_msghdr_from_user+0x9f/0x4c0 [ 662.385902][T12175] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 662.385916][T12175] ? lock_acquire+0x1d1/0x380 [ 662.385929][T12175] ? get_pid_task+0x2a/0x250 [ 662.385945][T12175] ___sys_sendmsg+0x106/0x1e0 [ 662.385956][T12175] ? __pfx____sys_sendmsg+0x10/0x10 [ 662.385967][T12175] ? get_pid_task+0x106/0x250 [ 662.385986][T12175] ? find_held_lock+0x2b/0x80 [ 662.386010][T12175] __sys_sendmsg+0x160/0x210 [ 662.386024][T12175] ? __pfx___sys_sendmsg+0x10/0x10 [ 662.386045][T12175] do_syscall_64+0x123/0x790 [ 662.386063][T12175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 662.386075][T12175] RIP: 0033:0x7ffad679e159 [ 662.386084][T12175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 662.386095][T12175] RSP: 002b:00007ffad767d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 662.386106][T12175] RAX: ffffffffffffffda RBX: 00007ffad6a25fa0 RCX: 00007ffad679e159 [ 662.386113][T12175] RDX: 0000000004080040 RSI: 0000200000000400 RDI: 0000000000000003 [ 662.386120][T12175] RBP: 00007ffad767d090 R08: 0000000000000000 R09: 0000000000000000 [ 662.386126][T12175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 662.386132][T12175] R13: 00007ffad6a26038 R14: 00007ffad6a25fa0 R15: 00007ffe88970798 [ 662.386145][T12175] [ 662.722615][ T9768] Bluetooth: hci2: ISO packet too small [ 662.759891][T12191] jffs2: notice: (12191) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 662.763165][ T31] kauditd_printk_skb: 10 callbacks suppressed [ 662.763178][ T31] audit: type=1400 audit(1789993884.149:1142): avc: denied { write } for pid=12190 comm="syz.6.1476" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 662.843671][T12191] syzkaller0: entered promiscuous mode [ 662.843685][T12191] syzkaller0: entered allmulticast mode [ 665.144036][ T9768] Bluetooth: hci2: Unable to find connection for big 0x00 [ 666.169557][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 666.960390][ T9768] Bluetooth: hci2: command 0x0406 tx timeout [ 667.055013][ T9768] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 667.058291][ T9768] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 667.076386][ T9768] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 667.077068][ T9768] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 667.077483][ T9768] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 667.450313][ T62] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.492646][T12211] bridge0: port 1(bridge_slave_0) entered blocking state [ 667.492755][T12211] bridge0: port 1(bridge_slave_0) entered disabled state [ 667.492835][T12211] bridge_slave_0: entered allmulticast mode [ 667.493865][T12211] bridge_slave_0: entered promiscuous mode [ 667.500151][T12211] bridge0: port 2(bridge_slave_1) entered blocking state [ 667.500216][T12211] bridge0: port 2(bridge_slave_1) entered disabled state [ 667.500296][T12211] bridge_slave_1: entered allmulticast mode [ 667.501429][T12211] bridge_slave_1: entered promiscuous mode [ 667.562913][ T62] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.577939][T12211] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 667.580022][T12211] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 667.603097][T12211] team0: Port device team_slave_0 added [ 667.605103][T12211] team0: Port device team_slave_1 added [ 667.630415][ T62] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.633216][T12211] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 667.633228][T12211] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 667.633247][T12211] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 667.634081][T12211] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 667.634092][T12211] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 667.634112][T12211] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 667.660922][T12211] hsr_slave_0: entered promiscuous mode [ 667.661563][T12211] hsr_slave_1: entered promiscuous mode [ 667.662182][T12211] debugfs: 'hsr0' already exists in 'hsr' [ 667.662195][T12211] Cannot create hsr debugfs directory [ 667.861088][ T62] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 668.016930][ T31] audit: type=1400 audit(1789993889.399:1143): avc: denied { write } for pid=12231 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 668.129281][ T9768] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 668.132677][ T9768] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 668.134280][ T9768] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 668.137767][ T9768] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 668.153315][ T9768] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 668.247970][ T31] audit: type=1400 audit(1789993889.629:1144): avc: denied { write } for pid=12245 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 668.357399][ T62] bridge_slave_1: left allmulticast mode [ 668.357419][ T62] bridge_slave_1: left promiscuous mode [ 668.357546][ T62] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.381308][ T62] bridge_slave_0: left allmulticast mode [ 668.381325][ T62] bridge_slave_0: left promiscuous mode [ 668.381462][ T62] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.512981][ T62] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 668.514349][ T62] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 668.515096][ T62] bond0 (unregistering): Released all slaves [ 668.792367][ T62] hsr_slave_0: left promiscuous mode [ 668.804418][ T62] hsr_slave_1: left promiscuous mode [ 668.805068][ T62] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 668.805084][ T62] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 668.805738][ T62] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 668.805752][ T62] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 668.815046][ T62] veth1_macvtap: left promiscuous mode [ 668.815073][ T62] veth0_macvtap: left promiscuous mode [ 668.815145][ T62] veth1_vlan: left promiscuous mode [ 668.815239][ T62] veth0_vlan: left promiscuous mode [ 668.905335][ T31] audit: type=1400 audit(1789993890.279:1145): avc: denied { write } for pid=12251 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 669.012789][ T31] audit: type=1400 audit(1789993890.399:1146): avc: denied { write } for pid=12266 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 669.091294][ T62] team0 (unregistering): Port device team_slave_1 removed [ 669.110995][ T62] team0 (unregistering): Port device team_slave_0 removed [ 669.119018][ T5619] Bluetooth: hci5: command tx timeout [ 669.350845][ T31] audit: type=1400 audit(1789993890.739:1147): avc: denied { write } for pid=12268 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 669.447527][ T31] audit: type=1400 audit(1789993890.829:1148): avc: denied { write } for pid=12280 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 669.827405][ T62] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.857858][T12243] bridge0: port 1(bridge_slave_0) entered blocking state [ 669.857979][T12243] bridge0: port 1(bridge_slave_0) entered disabled state [ 669.858069][T12243] bridge_slave_0: entered allmulticast mode [ 669.866749][ T31] audit: type=1400 audit(1789993891.249:1149): avc: denied { write } for pid=12292 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 669.908575][T12243] bridge_slave_0: entered promiscuous mode [ 669.915862][T12211] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 669.928529][T12211] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 669.933540][T12211] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 669.943366][ T31] audit: type=1400 audit(1789993891.329:1150): avc: denied { write } for pid=12306 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 669.945815][T12211] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 669.948052][T12211] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 669.979926][T12211] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 669.980458][T12211] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 669.987515][T12211] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 669.987803][T12243] bridge0: port 2(bridge_slave_1) entered blocking state [ 669.987872][T12243] bridge0: port 2(bridge_slave_1) entered disabled state [ 669.987950][T12243] bridge_slave_1: entered allmulticast mode [ 669.997416][T12243] bridge_slave_1: entered promiscuous mode [ 670.047005][T12243] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 670.071310][ T62] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.078463][T12243] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 670.105568][T12243] team0: Port device team_slave_0 added [ 670.119632][T12243] team0: Port device team_slave_1 added [ 670.163186][ T62] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.182774][T12243] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 670.182788][T12243] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 670.182808][T12243] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 670.184244][T12243] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 670.184255][T12243] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 670.184275][T12243] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 670.230046][T12243] hsr_slave_0: entered promiscuous mode [ 670.230701][T12243] hsr_slave_1: entered promiscuous mode [ 670.231167][T12243] debugfs: 'hsr0' already exists in 'hsr' [ 670.231180][T12243] Cannot create hsr debugfs directory [ 670.239534][ T5619] Bluetooth: hci0: command tx timeout [ 670.327461][ T62] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.434270][ T31] audit: type=1400 audit(1789993891.819:1151): avc: denied { write } for pid=12314 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 670.461894][T12211] 8021q: adding VLAN 0 to HW filter on device bond0 [ 670.544946][ T31] audit: type=1400 audit(1789993891.929:1152): avc: denied { write } for pid=12325 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 670.611569][T12211] 8021q: adding VLAN 0 to HW filter on device team0 [ 670.705718][ T62] bridge_slave_1: left allmulticast mode [ 670.705741][ T62] bridge_slave_1: left promiscuous mode [ 670.705899][ T62] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.707910][ T62] bridge_slave_0: left allmulticast mode [ 670.707940][ T62] bridge_slave_0: left promiscuous mode [ 670.708080][ T62] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.901332][ T62] bond0 (unregistering): (slave 30): Releasing backup interface [ 670.902950][ T62] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 670.904814][ T62] bond0 (unregistering): Released all slaves [ 670.941353][ T1370] bridge0: port 1(bridge_slave_0) entered blocking state [ 670.941434][ T1370] bridge0: port 1(bridge_slave_0) entered forwarding state [ 670.945574][ T1370] bridge0: port 2(bridge_slave_1) entered blocking state [ 670.945664][ T1370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 671.172470][ T62] hsr_slave_0: left promiscuous mode [ 671.173584][ T62] hsr_slave_1: left promiscuous mode [ 671.173980][ T62] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 671.173991][ T62] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 671.175863][ T62] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 671.175879][ T62] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 671.199736][ T5619] Bluetooth: hci5: command tx timeout [ 671.200913][ T62] veth1_macvtap: left promiscuous mode [ 671.200937][ T62] veth0_macvtap: left promiscuous mode [ 671.201006][ T62] veth1_vlan: left promiscuous mode [ 671.201051][ T62] veth0_vlan: left promiscuous mode [ 671.443476][ T62] team0 (unregistering): Port device team_slave_1 removed [ 671.463172][ T62] team0 (unregistering): Port device team_slave_0 removed [ 671.765559][ T9768] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 671.776761][ T9768] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 671.789464][ T9768] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 671.793680][ T9768] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 671.795737][ T9768] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 672.321516][ T5619] Bluetooth: hci0: command tx timeout [ 672.336811][T12211] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 672.457527][ T62] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 672.522483][T12243] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 672.525249][T12243] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 672.525967][T12243] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 672.552828][T12243] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 672.553446][T12243] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 672.574691][T12243] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 672.575368][T12243] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 672.596557][T12243] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 672.666909][ T62] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 672.762962][ T62] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 672.823460][ T62] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 672.915184][T12211] veth0_vlan: entered promiscuous mode [ 672.967912][T12211] veth1_vlan: entered promiscuous mode [ 673.142845][T12243] 8021q: adding VLAN 0 to HW filter on device bond0 [ 673.157725][ T62] bridge_slave_1: left allmulticast mode [ 673.157743][ T62] bridge_slave_1: left promiscuous mode [ 673.157895][ T62] bridge0: port 2(bridge_slave_1) entered disabled state [ 673.180555][ T62] bridge_slave_0: left allmulticast mode [ 673.180573][ T62] bridge_slave_0: left promiscuous mode [ 673.181116][ T62] bridge0: port 1(bridge_slave_0) entered disabled state [ 673.258783][ T31] kauditd_printk_skb: 8 callbacks suppressed [ 673.258797][ T31] audit: type=1400 audit(1789993894.639:1161): avc: denied { write } for pid=12413 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 673.295090][ T5619] Bluetooth: hci5: command tx timeout [ 673.326059][ T31] audit: type=1400 audit(1789993894.709:1162): avc: denied { write } for pid=12426 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 673.398669][ T62] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 673.414014][ T62] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 673.415219][ T62] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 673.415938][ T62] bond0 (unregistering): Released all slaves [ 673.436694][T12243] 8021q: adding VLAN 0 to HW filter on device team0 [ 673.476310][ T1413] bridge0: port 1(bridge_slave_0) entered blocking state [ 673.476395][ T1413] bridge0: port 1(bridge_slave_0) entered forwarding state [ 673.505770][T12211] veth0_macvtap: entered promiscuous mode [ 673.565260][ T1413] bridge0: port 2(bridge_slave_1) entered blocking state [ 673.565310][ T1413] bridge0: port 2(bridge_slave_1) entered forwarding state [ 673.566126][T12211] veth1_macvtap: entered promiscuous mode [ 673.578942][T12359] bridge0: port 1(bridge_slave_0) entered blocking state [ 673.579051][T12359] bridge0: port 1(bridge_slave_0) entered disabled state [ 673.579134][T12359] bridge_slave_0: entered allmulticast mode [ 673.580317][T12359] bridge_slave_0: entered promiscuous mode [ 673.582338][T12359] bridge0: port 2(bridge_slave_1) entered blocking state [ 673.582403][T12359] bridge0: port 2(bridge_slave_1) entered disabled state [ 673.582477][T12359] bridge_slave_1: entered allmulticast mode [ 673.583640][T12359] bridge_slave_1: entered promiscuous mode [ 673.611010][T12359] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 673.613197][T12359] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 673.632750][T12359] team0: Port device team_slave_0 added [ 673.634724][T12359] team0: Port device team_slave_1 added [ 673.664118][T12359] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 673.664131][T12359] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 673.664148][T12359] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 673.666965][T12359] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 673.666974][T12359] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 673.666992][T12359] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 673.834799][T12359] hsr_slave_0: entered promiscuous mode [ 673.835585][T12359] hsr_slave_1: entered promiscuous mode [ 673.836125][T12359] debugfs: 'hsr0' already exists in 'hsr' [ 673.836139][T12359] Cannot create hsr debugfs directory [ 673.855139][T12211] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 673.923094][ T5619] Bluetooth: hci1: command tx timeout [ 673.924162][T12211] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 673.946433][ T62] hsr_slave_0: left promiscuous mode [ 673.946794][ T62] hsr_slave_1: left promiscuous mode [ 673.947182][ T62] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 673.947192][ T62] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 673.948256][ T62] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 673.948269][ T62] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 673.972274][ T62] veth1_macvtap: left promiscuous mode [ 673.972300][ T62] veth0_macvtap: left promiscuous mode [ 673.972369][ T62] veth1_vlan: left promiscuous mode [ 673.972430][ T62] veth0_vlan: left promiscuous mode [ 674.049388][ T31] audit: type=1400 audit(1789993895.439:1163): avc: denied { write } for pid=12433 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 674.125592][ T31] audit: type=1400 audit(1789993895.509:1164): avc: denied { write } for pid=12444 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 674.226675][ T62] team0 (unregistering): Port device team_slave_1 removed [ 674.238487][ T62] team0 (unregistering): Port device team_slave_0 removed [ 674.313710][ T5268] 8021q: adding VLAN 0 to HW filter on device eth1 [ 674.404320][ T5619] Bluetooth: hci0: command tx timeout [ 674.506806][ T431] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.516122][ T1370] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.516571][ T1370] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.516609][ T1370] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 674.516622][ T1370] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 674.549014][ T1370] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.781178][ T31] audit: type=1400 audit(1789993896.169:1165): avc: denied { write } for pid=12446 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 674.858613][ T1370] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 674.858632][ T1370] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 674.895775][ T31] audit: type=1400 audit(1789993896.279:1166): avc: denied { write } for pid=12463 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 675.114912][ T31] audit: type=1400 audit(1789993896.499:1167): avc: denied { append } for pid=12468 comm="syz.4.1480" name="video9" dev="devtmpfs" ino=953 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 675.190829][T12243] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 675.334337][T12243] veth0_vlan: entered promiscuous mode [ 675.345711][T12243] veth1_vlan: entered promiscuous mode [ 675.359525][ T5619] Bluetooth: hci5: command tx timeout [ 675.376804][T12359] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 675.431744][T12359] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 675.432303][T12359] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 675.500009][T12359] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 675.503129][ T31] audit: type=1400 audit(1789993896.889:1168): avc: denied { write } for pid=12471 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 675.508511][T12359] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 675.527201][T12359] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 675.967586][T12359] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 675.985037][T12359] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 675.992319][T12243] veth0_macvtap: entered promiscuous mode [ 675.995353][T12243] veth1_macvtap: entered promiscuous mode [ 675.999363][ T5619] Bluetooth: hci1: command tx timeout [ 676.006333][T12243] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 676.010016][T12243] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 676.109050][ T1370] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.143205][ T1370] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.143408][ T1370] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.143715][ T1370] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.192473][ T31] audit: type=1400 audit(1789993897.579:1169): avc: denied { write } for pid=12493 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 676.371213][ T8806] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 676.371233][ T8806] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 676.433944][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 676.433961][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 676.444606][T12359] 8021q: adding VLAN 0 to HW filter on device bond0 [ 676.479339][ T5619] Bluetooth: hci0: command tx timeout [ 676.484663][T12359] 8021q: adding VLAN 0 to HW filter on device team0 [ 676.650848][ T9768] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 676.653074][ T9768] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 676.653687][ T9768] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 676.654374][ T9768] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 676.654898][ T9768] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 676.655919][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 676.656001][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 676.704268][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 676.704342][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 676.987685][ T5619] Bluetooth: hci5: ISO packet too small [ 677.276721][T12539] xt_hashlimit: size too large, truncated to 1048576 [ 677.342026][ T31] audit: type=1400 audit(1789993898.659:1170): avc: denied { setopt } for pid=12529 comm="syz.4.1488" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 677.356579][T12541] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1488'. [ 678.075509][ T1384] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.079543][ T5619] Bluetooth: hci1: command tx timeout [ 678.756397][ T5619] Bluetooth: hci3: command tx timeout [ 678.787513][ T1384] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.854976][ T31] kauditd_printk_skb: 1 callbacks suppressed [ 678.854992][ T31] audit: type=1400 audit(1789993900.239:1172): avc: denied { write } for pid=12557 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 678.997761][ T1384] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 679.223520][ T1384] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 679.239834][T12359] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 679.515133][ T31] audit: type=1400 audit(1789993900.899:1173): avc: denied { write } for pid=12566 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 679.616012][ T31] audit: type=1400 audit(1789993900.999:1174): avc: denied { write } for pid=12583 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 679.636933][T12359] veth0_vlan: entered promiscuous mode [ 679.658279][ T1384] bridge_slave_1: left allmulticast mode [ 679.658300][ T1384] bridge_slave_1: left promiscuous mode [ 679.658450][ T1384] bridge0: port 2(bridge_slave_1) entered disabled state [ 679.682907][ T1384] bridge_slave_0: left allmulticast mode [ 679.682928][ T1384] bridge_slave_0: left promiscuous mode [ 679.683086][ T1384] bridge0: port 1(bridge_slave_0) entered disabled state [ 680.179474][ T5619] Bluetooth: hci1: command tx timeout [ 680.244906][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 680.244968][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 680.339363][ T1384] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 680.343190][ T1384] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 680.344468][ T1384] bond0 (unregistering): Released all slaves [ 680.360870][T12359] veth1_vlan: entered promiscuous mode [ 681.418538][ T5619] Bluetooth: hci3: command tx timeout [ 681.830484][ T9768] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 681.833430][ T9768] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 681.835134][ T9768] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 681.835940][ T9768] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 681.836350][ T9768] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 682.075064][T12509] bridge0: port 1(bridge_slave_0) entered blocking state [ 682.075155][T12509] bridge0: port 1(bridge_slave_0) entered disabled state [ 682.080934][T12509] bridge_slave_0: entered allmulticast mode [ 682.082082][T12509] bridge_slave_0: entered promiscuous mode [ 682.118069][T12509] bridge0: port 2(bridge_slave_1) entered blocking state [ 682.118148][T12509] bridge0: port 2(bridge_slave_1) entered disabled state [ 682.118249][T12509] bridge_slave_1: entered allmulticast mode [ 682.131564][T12509] bridge_slave_1: entered promiscuous mode [ 682.729666][T12509] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 682.731870][T12509] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 682.796609][ T31] audit: type=1400 audit(1789993904.179:1175): avc: denied { write } for pid=12603 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 682.921005][T12509] team0: Port device team_slave_0 added [ 682.923043][T12509] team0: Port device team_slave_1 added [ 682.934022][ T1384] hsr_slave_0: left promiscuous mode [ 682.937251][ T1384] hsr_slave_1: left promiscuous mode [ 682.937826][ T1384] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 682.937840][ T1384] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 682.943772][ T1384] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 682.943786][ T1384] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 682.957168][ T1384] veth1_macvtap: left promiscuous mode [ 682.957195][ T1384] veth0_macvtap: left promiscuous mode [ 682.957264][ T1384] veth1_vlan: left promiscuous mode [ 682.957311][ T1384] veth0_vlan: left promiscuous mode [ 683.112651][ T9768] Bluetooth: hci5: ISO packet too small [ 683.113685][ T31] audit: type=1400 audit(1789993904.499:1176): avc: denied { write } for pid=12633 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 683.324232][ T9768] Bluetooth: hci0: ISO packet too small [ 683.327154][ T1384] team0 (unregistering): Port device team_slave_1 removed [ 683.344831][ T1384] team0 (unregistering): Port device team_slave_0 removed [ 683.429779][T12359] veth0_macvtap: entered promiscuous mode [ 683.435167][T12509] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 683.435180][T12509] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 683.435201][T12509] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 683.438019][T12509] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 683.438031][T12509] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 683.438061][T12509] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 683.440919][ T9768] Bluetooth: hci3: command tx timeout [ 683.446144][T12359] veth1_macvtap: entered promiscuous mode [ 683.550629][ T5702] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 683.583328][T12509] hsr_slave_0: entered promiscuous mode [ 683.584051][T12509] hsr_slave_1: entered promiscuous mode [ 683.651672][T12359] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 683.667455][ T31] audit: type=1400 audit(1789993905.049:1177): avc: denied { read } for pid=12654 comm="syz.2.1502" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 683.710552][ T5702] usb 5-1: Using ep0 maxpacket: 16 [ 683.712747][ T5702] usb 5-1: New USB device found, idVendor=056a, idProduct=0003, bcdDevice= 0.00 [ 683.715671][T12359] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 683.716736][ T5702] usb 5-1: too many endpoints for config 0 interface 0 altsetting 3: 255, using maximum allowed: 30 [ 683.716770][ T5702] usb 5-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 683.716789][ T5702] usb 5-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 683.716811][ T5702] usb 5-1: config 0 interface 0 has no altsetting 0 [ 683.716835][ T5702] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 683.726353][ T5702] usb 5-1: config 0 descriptor?? [ 683.921030][ T9768] Bluetooth: hci4: command tx timeout [ 684.054350][ T1384] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 684.055853][ T1377] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 684.055889][ T1377] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 684.055918][ T1377] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 684.056903][ T31] audit: type=1400 audit(1789993905.439:1178): avc: denied { write } for pid=12650 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 684.184159][ T5702] wacom 0003:056A:0003.0006: Unknown device_type for 'HID 056a:0003'. Assuming pen. [ 684.188722][ T5702] wacom 0003:056A:0003.0006: hidraw0: USB HID v0.00 Joystick [HID 056a:0003] on usb-dummy_hcd.4-1/input0 [ 684.230762][ T5702] input: Wacom Cintiq Partner Pen as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:056A:0003.0006/input/input26 [ 684.404498][ T31] audit: type=1400 audit(1789993905.789:1179): avc: denied { write } for pid=12665 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 684.451042][ T5702] usb 5-1: USB disconnect, device number 8 [ 684.670984][ T1384] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.819614][ T1377] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 684.819633][ T1377] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 684.905031][ T1384] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.081080][ T431] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 685.081098][ T431] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 685.107156][ T31] audit: type=1400 audit(1789993906.489:1180): avc: denied { bind } for pid=12673 comm="syz.4.1503" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 685.160052][T12674] overlayfs: missing 'lowerdir' [ 685.190990][ T1384] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.434844][ T1384] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.533169][ T31] audit: type=1800 audit(1789993906.909:1181): pid=12684 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.1504" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 685.572001][ T9768] Bluetooth: hci3: command tx timeout [ 685.775722][ T31] audit: type=1400 audit(1789993907.159:1182): avc: denied { write } for pid=12668 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 685.999849][ T9768] Bluetooth: hci4: command tx timeout [ 686.042390][ T31] audit: type=1400 audit(1789993907.429:1183): avc: denied { write } for pid=12688 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 687.047817][T12700] xt_hashlimit: size too large, truncated to 1048576 [ 687.087548][T12702] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 687.113981][T12703] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1505'. [ 687.167460][T12706] xt_hashlimit: size too large, truncated to 1048576 [ 687.238136][T12711] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1506'. [ 687.471979][T12719] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1508'. [ 687.472135][T12719] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 688.078943][ T9768] Bluetooth: hci4: command tx timeout [ 688.494207][T12607] bridge0: port 1(bridge_slave_0) entered blocking state [ 688.494289][T12607] bridge0: port 1(bridge_slave_0) entered disabled state [ 688.494415][T12607] bridge_slave_0: entered allmulticast mode [ 688.522952][T12607] bridge_slave_0: entered promiscuous mode [ 688.538271][T12607] bridge0: port 2(bridge_slave_1) entered blocking state [ 688.542287][T12607] bridge0: port 2(bridge_slave_1) entered disabled state [ 688.542402][T12607] bridge_slave_1: entered allmulticast mode [ 688.543725][T12607] bridge_slave_1: entered promiscuous mode [ 688.690643][T12607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 688.696772][T12607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 688.742000][ T1384] bridge_slave_1: left allmulticast mode [ 688.742022][ T1384] bridge_slave_1: left promiscuous mode [ 688.742179][ T1384] bridge0: port 2(bridge_slave_1) entered disabled state [ 688.834170][ T1384] bridge_slave_0: left allmulticast mode [ 688.834454][ T1384] bridge_slave_0: left promiscuous mode [ 688.837660][ T1384] bridge0: port 1(bridge_slave_0) entered disabled state [ 689.387464][ T31] audit: type=1400 audit(1789993910.769:1184): avc: denied { write } for pid=12710 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 689.615304][ T1384] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 689.616440][ T31] audit: type=1400 audit(1789993910.999:1185): avc: denied { write } for pid=12737 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 689.628133][ T1384] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 689.664219][ T1384] bond0 (unregistering): Released all slaves [ 689.967780][T12607] team0: Port device team_slave_0 added [ 689.979381][T12607] team0: Port device team_slave_1 added [ 690.047570][T12509] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 690.056481][T12509] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 690.169243][ T9768] Bluetooth: hci4: command tx timeout [ 690.194045][T12509] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 690.196907][T12509] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 690.197683][T12607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 690.197694][T12607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 690.197712][T12607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 690.206462][T12607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 690.206472][T12607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 690.206496][T12607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 690.207701][T12509] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 690.221228][T12509] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 690.228669][T12509] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 690.264299][T12509] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 690.437098][ T9768] Bluetooth: hci5: Unable to find connection for big 0x00 [ 690.498238][T12607] hsr_slave_0: entered promiscuous mode [ 690.500851][T12607] hsr_slave_1: entered promiscuous mode [ 690.501365][T12607] debugfs: 'hsr0' already exists in 'hsr' [ 690.501379][T12607] Cannot create hsr debugfs directory [ 690.608984][T12647] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 690.684435][ T1384] hsr_slave_0: left promiscuous mode [ 690.684938][ T1384] hsr_slave_1: left promiscuous mode [ 690.685543][ T1384] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 690.685558][ T1384] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 690.686132][ T1384] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 690.686146][ T1384] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 690.701306][ T1384] veth1_macvtap: left promiscuous mode [ 690.701336][ T1384] veth0_macvtap: left promiscuous mode [ 690.701431][ T1384] veth1_vlan: left promiscuous mode [ 690.701496][ T1384] veth0_vlan: left promiscuous mode [ 691.088934][T12647] usb 2-1: Using ep0 maxpacket: 8 [ 691.089461][T12647] usb 2-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 691.090324][T12647] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 691.090360][T12647] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 691.096959][T12647] usb 2-1: config 0 descriptor?? [ 691.103777][T12647] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 691.334086][ T1384] team0 (unregistering): Port device team_slave_1 removed [ 691.348322][ T1384] team0 (unregistering): Port device team_slave_0 removed [ 691.510147][ T31] audit: type=1400 audit(1789993912.899:1186): avc: denied { read write } for pid=12747 comm="syz.1.1510" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 691.510454][ T31] audit: type=1400 audit(1789993912.899:1187): avc: denied { open } for pid=12747 comm="syz.1.1510" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 691.512155][ T31] audit: type=1400 audit(1789993912.899:1188): avc: denied { ioctl } for pid=12747 comm="syz.1.1510" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x937a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 692.102613][T12647] gspca_vc032x: reg_r err -110 [ 692.102654][T12647] vc032x 2-1:0.0: probe with driver vc032x failed with error -110 [ 692.241242][T12748] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1510'. [ 692.443315][T12647] usb 2-1: USB disconnect, device number 16 [ 692.585959][T12774] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 694.384830][T12509] 8021q: adding VLAN 0 to HW filter on device bond0 [ 694.411783][T12509] 8021q: adding VLAN 0 to HW filter on device team0 [ 694.423094][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 694.423168][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 694.649034][ T10] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 694.782339][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 694.782407][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 694.801334][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 694.805887][ T10] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 694.937983][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 694.938040][ T10] usb 2-1: config 0 has no interfaces? [ 694.968440][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 694.968490][ T10] usb 2-1: Product: syz [ 694.968518][ T10] usb 2-1: Manufacturer: syz [ 694.968560][ T10] usb 2-1: SerialNumber: syz [ 695.127909][ T10] usb 2-1: config 0 descriptor?? [ 695.197503][T12791] jffs2: notice: (12791) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (1 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 695.225384][ T31] audit: type=1400 audit(1789993916.609:1189): avc: denied { write } for pid=12790 comm="syz.4.1517" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 695.473092][T12784] kAFS: No cell specified [ 695.490996][T12784] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 695.491174][T12784] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 695.803526][T12607] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 695.817046][T12607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 695.822299][T12607] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 695.833756][T12607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 695.834596][T12607] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 695.844168][T12607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 695.844858][T12607] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 695.861529][T12607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 696.549948][ T31] audit: type=1400 audit(1789993917.939:1190): avc: denied { write } for pid=12799 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 696.621446][T12607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 696.647826][T12607] 8021q: adding VLAN 0 to HW filter on device team0 [ 696.696987][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 696.697036][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 696.703836][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 696.703909][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 696.726289][ T31] audit: type=1400 audit(1789993918.109:1191): avc: denied { write } for pid=12836 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 696.783197][ C0] vcan0: j1939_tp_rxtimer: 0xffff888033db9c00: rx timeout, send abort [ 696.801033][ T31] audit: type=1400 audit(1789993918.189:1192): avc: denied { read } for pid=4955 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 696.803357][ T31] audit: type=1400 audit(1789993918.189:1193): avc: denied { search } for pid=4955 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 696.805435][ T31] audit: type=1400 audit(1789993918.189:1194): avc: denied { write search } for pid=4955 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 696.805476][ T31] audit: type=1400 audit(1789993918.189:1195): avc: denied { add_name } for pid=4955 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 696.805511][ T31] audit: type=1400 audit(1789993918.189:1196): avc: denied { create } for pid=4955 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 696.805961][ T31] audit: type=1400 audit(1789993918.189:1197): avc: denied { append open } for pid=4955 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 696.808116][ T31] audit: type=1400 audit(1789993918.189:1198): avc: denied { getattr } for pid=4955 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 696.997824][T12509] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 697.236922][T12509] veth0_vlan: entered promiscuous mode [ 697.259504][T12509] veth1_vlan: entered promiscuous mode [ 697.284607][ C0] vcan0: j1939_tp_rxtimer: 0xffff888033db9c00: abort rx timeout. Force session deactivation [ 697.300301][ T5610] usb 2-1: USB disconnect, device number 17 [ 697.351463][T12509] veth0_macvtap: entered promiscuous mode [ 697.363249][T12509] veth1_macvtap: entered promiscuous mode [ 697.384940][ T10] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 697.407450][T12509] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 697.423974][T12509] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 697.636299][ T10] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 697.651935][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 697.652100][ T10] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 697.652150][ T10] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 697.652198][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 697.652301][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 698.157665][ T7013] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.158563][ T7013] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.160786][ T7013] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.161268][ T7013] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.234832][T12838] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 698.234929][T12838] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 698.237887][ T10] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 698.263684][ T10] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 698.263743][ T10] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 698.385738][ T10] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 698.434107][ T10] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 698.434176][ T10] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 698.447870][ T10] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 698.484678][ T1377] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 698.484694][ T1377] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 698.588568][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 698.588587][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 699.035428][ T9768] Bluetooth: hci1: Unable to find connection for big 0x00 [ 699.190592][T12607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 699.820429][ T9768] Bluetooth: hci5: Unable to find connection for big 0x00 [ 699.925026][ T1228] usb 3-1: USB disconnect, device number 12 [ 700.025942][ T1228] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 700.092111][ T1228] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 700.111943][ T1228] keyspan 3-1:1.0: device disconnected [ 700.756021][T12607] veth0_vlan: entered promiscuous mode [ 700.974866][T12607] veth1_vlan: entered promiscuous mode [ 700.986863][ T31] kauditd_printk_skb: 5 callbacks suppressed [ 700.986878][ T31] audit: type=1400 audit(1789993922.369:1204): avc: denied { write } for pid=12910 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 701.314583][T12607] veth0_macvtap: entered promiscuous mode [ 701.318693][T12607] veth1_macvtap: entered promiscuous mode [ 701.346057][T12607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 701.367429][T12607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 701.382364][ T10] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 701.493124][ T1384] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.521500][ T431] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.521535][ T431] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.521560][ T431] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.529579][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 701.530159][ T10] usb 2-1: New USB device found, idVendor=056a, idProduct=0003, bcdDevice= 0.00 [ 701.531119][ T10] usb 2-1: too many endpoints for config 0 interface 0 altsetting 3: 255, using maximum allowed: 30 [ 701.531150][ T10] usb 2-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 701.531165][ T10] usb 2-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 701.531185][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 701.531208][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 701.533049][ T10] usb 2-1: config 0 descriptor?? [ 701.592512][ T1370] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 701.592529][ T1370] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 702.082158][ T10] wacom 0003:056A:0003.0007: Unknown device_type for 'HID 056a:0003'. Assuming pen. [ 702.087237][ T10] wacom 0003:056A:0003.0007: hidraw0: USB HID v0.00 Joystick [HID 056a:0003] on usb-dummy_hcd.1-1/input0 [ 702.115683][ T10] input: Wacom Cintiq Partner Pen as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:056A:0003.0007/input/input29 [ 702.179021][ T31] audit: type=1400 audit(1789993923.559:1205): avc: denied { create } for pid=12931 comm="syz.2.1534" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 702.181794][ T31] audit: type=1400 audit(1789993923.569:1206): avc: denied { setopt } for pid=12931 comm="syz.2.1534" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 703.478929][ T10] usb 2-1: USB disconnect, device number 18 [ 703.574173][ T431] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 703.574192][ T431] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 703.586952][T12940] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 703.737487][ T31] audit: type=1400 audit(1789993925.119:1207): avc: denied { write } for pid=12923 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 703.816405][T12943] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 703.865185][ T31] audit: type=1400 audit(1789993925.249:1208): avc: denied { write } for pid=12952 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 703.945418][ T9768] Bluetooth: hci0: Unable to find connection for big 0x00 [ 705.489835][ T31] audit: type=1400 audit(1789993926.879:1209): avc: denied { write } for pid=12958 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 706.149110][ T25] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 706.369616][ T25] usb 6-1: Using ep0 maxpacket: 16 [ 706.375906][ T25] usb 6-1: New USB device found, idVendor=056a, idProduct=0003, bcdDevice= 0.00 [ 706.457316][ T25] usb 6-1: too many endpoints for config 0 interface 0 altsetting 3: 255, using maximum allowed: 30 [ 706.457384][ T25] usb 6-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 706.457405][ T25] usb 6-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 706.457429][ T25] usb 6-1: config 0 interface 0 has no altsetting 0 [ 706.457458][ T25] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 706.532635][ T25] usb 6-1: config 0 descriptor?? [ 706.981629][ T31] audit: type=1400 audit(1789993928.369:1210): avc: denied { write } for pid=12999 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 707.078802][T13002] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 707.158808][ T25] wacom 0003:056A:0003.0008: Unknown device_type for 'HID 056a:0003'. Assuming pen. [ 707.171940][ T25] wacom 0003:056A:0003.0008: hidraw0: USB HID v0.00 Joystick [HID 056a:0003] on usb-dummy_hcd.5-1/input0 [ 707.200881][ T25] input: Wacom Cintiq Partner Pen as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:056A:0003.0008/input/input32 [ 707.427873][ T25] usb 6-1: USB disconnect, device number 8 [ 707.658961][ T31] audit: type=1800 audit(1789993928.959:1211): pid=13013 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.1550" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 708.125403][T13017] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 708.152507][ T31] audit: type=1400 audit(1789993929.539:1212): avc: denied { write } for pid=13005 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 708.314459][ T31] audit: type=1400 audit(1789993929.699:1213): avc: denied { write } for pid=13025 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 711.420438][ T31] audit: type=1400 audit(1789993932.799:1214): avc: denied { shutdown } for pid=13049 comm="syz.5.1557" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 711.422702][ T31] audit: type=1400 audit(1789993932.809:1215): avc: denied { getopt } for pid=13049 comm="syz.5.1557" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 711.424214][ T31] audit: type=1400 audit(1789993932.809:1216): avc: denied { connect } for pid=13049 comm="syz.5.1557" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 711.450357][ T31] audit: type=1400 audit(1789993932.819:1217): avc: denied { listen } for pid=13049 comm="syz.5.1557" lport=60532 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 711.538169][T13044] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 711.538267][T13044] block device autoloading is deprecated and will be removed. [ 713.197826][T13042] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1553'. [ 713.364323][T13064] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 714.697242][T13078] syz.5.1564 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 714.697273][T13078] CPU: 0 UID: 0 PID: 13078 Comm: syz.5.1564 Not tainted syzkaller #0 PREEMPT(full) [ 714.697295][T13078] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 714.697306][T13078] Call Trace: [ 714.697312][T13078] [ 714.697320][T13078] dump_stack_lvl+0x100/0x190 [ 714.697355][T13078] dump_header+0xfb/0x606 [ 714.697376][T13078] oom_kill_process.cold+0xd/0x380 [ 714.697400][T13078] out_of_memory+0x340/0x14f0 [ 714.697432][T13078] ? __pfx_out_of_memory+0x10/0x10 [ 714.697464][T13078] mem_cgroup_out_of_memory+0xc6/0x130 [ 714.697487][T13078] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 714.697507][T13078] ? find_held_lock+0x2b/0x80 [ 714.697538][T13078] ? do_raw_spin_unlock+0x145/0x1e0 [ 714.697563][T13078] ? _raw_spin_unlock+0x28/0x50 [ 714.697591][T13078] try_charge_memcg+0x783/0xf60 [ 714.697625][T13078] ? __pfx_try_charge_memcg+0x10/0x10 [ 714.697651][T13078] ? find_held_lock+0x2b/0x80 [ 714.697676][T13078] ? rcu_read_unlock+0x17/0x60 [ 714.697704][T13078] ? rcu_read_unlock+0x17/0x60 [ 714.697732][T13078] ? find_held_lock+0x2b/0x80 [ 714.697759][T13078] ? rcu_read_unlock+0x17/0x60 [ 714.697798][T13078] charge_memcg+0x1ae/0x210 [ 714.697826][T13078] mem_cgroup_swapin_charge_folio+0xc1/0x450 [ 714.697849][T13078] swap_cache_alloc_folio+0x548/0xc50 [ 714.697876][T13078] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 714.697896][T13078] ? swap_cache_get_folio+0x28d/0x360 [ 714.697915][T13078] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 714.697935][T13078] ? is_bpf_text_address+0x25/0x1a0 [ 714.697962][T13078] ? find_held_lock+0x2b/0x80 [ 714.697992][T13078] swap_cache_read_folio+0x47/0x140 [ 714.698015][T13078] swap_cluster_readahead+0x369/0x5d0 [ 714.698041][T13078] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 714.698066][T13078] ? lock_acquire+0x1d1/0x380 [ 714.698085][T13078] ? swap_table_get+0x28/0x2c0 [ 714.698116][T13078] swapin_readahead+0xf0/0x260 [ 714.698137][T13078] ? __pfx_swapin_readahead+0x10/0x10 [ 714.698156][T13078] ? __pfx_get_swap_device+0x10/0x10 [ 714.698182][T13078] ? __x64_sys_socket+0x72/0xb0 [ 714.698207][T13078] do_swap_page+0xf72/0x5580 [ 714.698248][T13078] ? __pfx_do_swap_page+0x10/0x10 [ 714.698271][T13078] ? lock_acquire+0x1d1/0x380 [ 714.698291][T13078] ? __pte_offset_map+0x2f/0x310 [ 714.698319][T13078] ? rcu_is_watching+0x13/0xc0 [ 714.698345][T13078] ? __pte_offset_map+0x179/0x310 [ 714.698370][T13078] __handle_mm_fault+0x15bd/0x2f60 [ 714.698403][T13078] ? lock_vma_under_rcu+0x11d/0x590 [ 714.698431][T13078] ? __pfx___handle_mm_fault+0x10/0x10 [ 714.698463][T13078] ? lock_vma_under_rcu+0x17c/0x590 [ 714.698506][T13078] handle_mm_fault+0x363/0xa20 [ 714.698539][T13078] do_user_addr_fault+0x59c/0x12f0 [ 714.698567][T13078] exc_page_fault+0x6f/0xd0 [ 714.698590][T13078] asm_exc_page_fault+0x26/0x30 [ 714.698604][T13078] RIP: 0033:0x7f79d079e161 [ 714.698618][T13078] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 714.698632][T13078] RSP: 002b:00007f79d1681028 EFLAGS: 00010207 [ 714.698645][T13078] RAX: 0000000000000006 RBX: 00007f79d0a26090 RCX: 00007f79d079e159 [ 714.698655][T13078] RDX: 000000000000000c RSI: 0000000000000003 RDI: 0000000000000010 [ 714.698664][T13078] RBP: 00007f79d083506b R08: 0000000000000000 R09: 0000000000000000 [ 714.698673][T13078] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 714.698682][T13078] R13: 00007f79d0a26128 R14: 00007f79d0a26090 R15: 00007ffc7d2c3e28 [ 714.698703][T13078] [ 714.710138][T13078] memory: usage 8kB, limit 8kB, failcnt 29 [ 714.710152][T13078] memory+swap: usage 12kB, limit 9007199254740988kB, failcnt 0 [ 714.710163][T13078] kmem: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 714.710172][T13078] Memory cgroup stats for /syz5/test: [ 714.710303][T13078] cache 0 [ 714.710310][T13078] rss 0 [ 714.710316][T13078] rss_huge 0 [ 714.710321][T13078] shmem 0 [ 714.710327][T13078] mapped_file 0 [ 714.710333][T13078] dirty 0 [ 714.710338][T13078] writeback 0 [ 714.710344][T13078] workingset_refault_anon 1 [ 714.710350][T13078] workingset_refault_file 0 [ 714.710356][T13078] swap 4096 [ 714.710362][T13078] swapcached 12288 [ 714.710367][T13078] pgpgin 3 [ 714.710373][T13078] pgpgout 2 [ 714.710378][T13078] pgfault 3 [ 714.710384][T13078] pgmajfault 0 [ 714.710389][T13078] inactive_anon 0 [ 714.710395][T13078] active_anon 4096 [ 714.710401][T13078] inactive_file 0 [ 714.710407][T13078] active_file 0 [ 714.710413][T13078] unevictable 0 [ 714.710419][T13078] hierarchical_memory_limit 8192 [ 714.710425][T13078] hierarchical_memsw_limit 9223372036854771712 [ 714.710432][T13078] total_cache 0 [ 714.710438][T13078] total_rss 0 [ 714.710444][T13078] total_rss_huge 0 [ 714.710449][T13078] total_shmem 0 [ 714.710455][T13078] total_mapped_file 0 [ 714.710461][T13078] total_dirty 0 [ 714.710467][T13078] total_writeback 0 [ 714.710472][T13078] total_workingset_refault_anon 1 [ 714.710479][T13078] total_workingset_refault_file 0 [ 714.710486][T13078] total_swap 4096 [ 714.710492][T13078] total_swapcached 12288 [ 714.710498][T13078] total_pgpgin 3 [ 714.710504][T13078] total_pgpgout 2 [ 714.710510][T13078] total_pgfault 3 [ 714.710516][T13078] total_pgmajfault 0 [ 714.710521][T13078] total_inactive_anon 0 [ 714.710528][T13078] total_active_anon 4096 [ 714.710534][T13078] total_inactive_file 0 [ 714.710540][T13078] total_active_file 0 [ 714.710546][T13078] total_unevictable 0 [ 714.710552][T13078] anon_cost 0 [ 714.710558][T13078] file_cost 0 [ 714.710564][T13078] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz5/test,task_memcg=/syz5/test,task=syz.5.1564,pid=13072,uid=0 [ 714.712099][T13078] Memory cgroup out of memory: Killed process 13072 (syz.5.1564) total-vm:112624kB, anon-rss:1356kB, file-rss:21752kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 715.043335][T13073] socket: no more sockets [ 715.259415][ T31] audit: type=1400 audit(1789993936.649:1218): avc: denied { write } for pid=13062 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 715.472541][ T31] audit: type=1400 audit(1789993936.859:1219): avc: denied { write } for pid=13089 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 715.560360][T13093] jffs2: notice: (13093) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 715.567035][ T31] audit: type=1400 audit(1789993936.949:1220): avc: denied { write } for pid=13091 comm="syz.5.1566" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 715.822932][ T31] audit: type=1400 audit(1789993937.209:1221): avc: denied { create } for pid=13091 comm="syz.5.1566" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 715.850347][ T31] audit: type=1400 audit(1789993937.219:1222): avc: denied { write } for pid=13091 comm="syz.5.1566" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 716.106613][ T31] audit: type=1400 audit(1789993937.489:1223): avc: denied { write } for pid=13092 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 716.349735][T13137] ALSA: seq fatal error: cannot create timer (-22) [ 716.434448][ T31] audit: type=1400 audit(1789993937.819:1224): avc: denied { write } for pid=13135 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 716.587551][ T5619] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 716.593429][ T5619] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 716.597786][ T5619] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 716.615802][ T5619] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 716.620511][ T5619] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 716.670142][T13142] jffs2: notice: (13142) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 716.714050][T13149] fuse: Unknown parameter 'group_id00000000000000000000' [ 716.733509][ T31] audit: type=1400 audit(1789993938.099:1225): avc: denied { write } for pid=13140 comm="syz.2.1572" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 717.574929][T13180] syz.1.1577 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 717.642657][ T1462] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.728118][ T31] audit: type=1400 audit(1789993939.109:1226): avc: denied { write } for pid=13148 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 717.837863][ T31] audit: type=1400 audit(1789993939.199:1227): avc: denied { create } for pid=13187 comm="syz.5.1578" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 717.902805][ T1462] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.080720][ T1462] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.700838][ T9768] Bluetooth: hci0: ISO packet too small [ 718.740569][ T5619] Bluetooth: hci2: command tx timeout [ 718.793069][ T1462] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.837248][T13215] jffs2: notice: (13215) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 719.390665][T13231] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 719.390691][T13231] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 719.391481][T13231] vhci_hcd vhci_hcd.0: Device attached [ 719.867297][T13233] vhci_hcd: connection closed [ 719.897483][ T62] vhci_hcd vhci_hcd.2: stop threads [ 719.898006][ T62] vhci_hcd vhci_hcd.2: release socket [ 719.898593][ T62] vhci_hcd vhci_hcd.2: disconnect device [ 719.948561][ T5610] usb 37-1: new high-speed USB device number 2 using vhci_hcd [ 719.956328][ T5610] usb 37-1: enqueue for inactive port 0 [ 720.032861][ T5610] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 721.266995][ T9768] Bluetooth: hci2: command tx timeout [ 721.269466][ T31] kauditd_printk_skb: 3 callbacks suppressed [ 721.269481][ T31] audit: type=1400 audit(1789993941.939:1231): avc: denied { bind } for pid=13243 comm="syz.3.1588" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 721.269518][ T31] audit: type=1400 audit(1789993941.949:1232): avc: denied { name_bind } for pid=13243 comm="syz.3.1588" src=20128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 721.269553][ T31] audit: type=1400 audit(1789993941.949:1233): avc: denied { connect } for pid=13243 comm="syz.3.1588" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 721.840972][ T1462] bridge_slave_1: left allmulticast mode [ 721.840994][ T1462] bridge_slave_1: left promiscuous mode [ 721.841141][ T1462] bridge0: port 2(bridge_slave_1) entered disabled state [ 721.843895][ T1462] bridge_slave_0: left allmulticast mode [ 721.843913][ T1462] bridge_slave_0: left promiscuous mode [ 721.844054][ T1462] bridge0: port 1(bridge_slave_0) entered disabled state [ 721.893391][ T31] audit: type=1400 audit(1789993943.279:1234): avc: denied { write } for pid=13227 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 721.985784][ T9768] Bluetooth: hci0: ISO packet too small [ 722.009462][ T31] audit: type=1400 audit(1789993943.399:1235): avc: denied { write } for pid=13264 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 722.168859][ T1462] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 722.178543][ T1462] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 722.182031][ T1462] bond0 (unregistering): Released all slaves [ 722.333569][T13143] bridge0: port 1(bridge_slave_0) entered blocking state [ 722.333688][T13143] bridge0: port 1(bridge_slave_0) entered disabled state [ 722.333788][T13143] bridge_slave_0: entered allmulticast mode [ 722.335088][T13143] bridge_slave_0: entered promiscuous mode [ 722.363044][T13143] bridge0: port 2(bridge_slave_1) entered blocking state [ 722.363168][T13143] bridge0: port 2(bridge_slave_1) entered disabled state [ 722.363261][T13143] bridge_slave_1: entered allmulticast mode [ 722.364510][T13143] bridge_slave_1: entered promiscuous mode [ 722.558517][T13282] xt_hashlimit: size too large, truncated to 1048576 [ 722.579698][ T31] audit: type=1400 audit(1789993943.969:1236): avc: denied { ioctl } for pid=13272 comm="syz.5.1594" path="socket:[43227]" dev="sockfs" ino=43227 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 722.583103][T13283] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1594'. [ 722.586711][T13143] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 722.634705][T13288] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1592'. [ 722.650548][T13273] vlan2: entered promiscuous mode [ 722.650568][T13273] hsr0: entered promiscuous mode [ 722.650818][T13273] vlan2: entered allmulticast mode [ 722.650831][T13273] hsr0: entered allmulticast mode [ 722.650842][T13273] hsr_slave_0: entered allmulticast mode [ 722.650856][T13273] hsr_slave_1: entered allmulticast mode [ 722.720955][T13283] hsr_slave_0: left promiscuous mode [ 722.736232][T13283] hsr_slave_1: left promiscuous mode [ 722.850534][ T1228] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 722.941620][T13143] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 722.980355][ T1228] usb 4-1: device descriptor read/64, error -71 [ 723.090465][ T31] audit: type=1400 audit(1789993944.479:1237): avc: denied { write } for pid=13271 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 724.096129][ T9768] Bluetooth: hci2: command tx timeout [ 724.096866][ T1228] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 724.142008][T13143] team0: Port device team_slave_0 added [ 724.143288][T13143] team0: Port device team_slave_1 added [ 724.406751][ T31] audit: type=1400 audit(1789993945.789:1238): avc: denied { write } for pid=13311 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 724.449335][ T1228] usb 4-1: device descriptor read/64, error -71 [ 724.485128][ T1462] hsr_slave_0: left promiscuous mode [ 724.492437][ T1462] hsr_slave_1: left promiscuous mode [ 724.493052][ T1462] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 724.493067][ T1462] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 724.495832][ T1462] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 724.495847][ T1462] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 724.534520][ T1462] veth1_macvtap: left promiscuous mode [ 724.534554][ T1462] veth0_macvtap: left promiscuous mode [ 724.534645][ T1462] veth1_vlan: left promiscuous mode [ 724.534696][ T1462] veth0_vlan: left promiscuous mode [ 724.561566][ T1228] usb usb4-port1: attempt power cycle [ 724.754975][T13322] xt_hashlimit: size too large, truncated to 1048576 [ 724.806923][T13323] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1597'. [ 724.898941][ T5607] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 724.899166][ T1228] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 724.926648][ T1228] usb 4-1: device descriptor read/8, error -71 [ 725.048909][ T5607] usb 6-1: Using ep0 maxpacket: 8 [ 725.049503][ T5607] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 725.051006][ T5607] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 725.051048][ T5607] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 725.051069][ T5607] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 725.051091][ T5607] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 725.051161][ T5607] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 725.051195][ T5607] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 725.154097][ T1462] team0 (unregistering): Port device team_slave_1 removed [ 725.169005][ T1228] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 725.191673][ T1462] team0 (unregistering): Port device team_slave_0 removed [ 725.191969][ T1228] usb 4-1: device descriptor read/8, error -71 [ 725.304812][ T1228] usb usb4-port1: unable to enumerate USB device [ 725.371915][ T5607] usb 6-1: usb_control_msg returned -32 [ 725.371955][ T5607] usbtmc 6-1:16.0: can't read capabilities [ 725.461417][T13143] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 725.461432][T13143] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 725.461452][T13143] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 725.462996][T13143] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 725.463007][T13143] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 725.463028][T13143] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 725.633577][T13143] hsr_slave_0: entered promiscuous mode [ 725.634242][T13143] hsr_slave_1: entered promiscuous mode [ 725.634541][T13143] debugfs: 'hsr0' already exists in 'hsr' [ 725.634557][T13143] Cannot create hsr debugfs directory [ 726.169010][ T9768] Bluetooth: hci2: command tx timeout [ 726.434371][ T1228] usb 6-1: USB disconnect, device number 9 [ 726.444526][T13330] usbtmc 6-1:16.0: usb_control_msg returned -71 [ 726.637090][ T31] audit: type=1400 audit(1789993948.019:1239): avc: denied { write } for pid=13326 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 726.800472][T13349] jffs2: notice: (13349) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 726.849012][ T31] audit: type=1400 audit(1789993948.229:1240): avc: denied { write } for pid=13348 comm="syz.1.1600" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 726.885461][ T31] audit: type=1400 audit(1789993948.269:1241): avc: denied { write } for pid=13350 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 727.688953][ T5610] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 727.856045][ T5610] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 727.873481][ T5610] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 727.873521][ T5610] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 727.914091][ T5610] usb 6-1: config 0 descriptor?? [ 727.929110][ T10] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 728.079415][ T10] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 728.080319][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 728.080357][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 728.082617][ T10] usb 3-1: config 0 descriptor?? [ 728.214687][T13378] FAULT_INJECTION: forcing a failure. [ 728.214687][T13378] name failslab, interval 1, probability 0, space 0, times 0 [ 728.214715][T13378] CPU: 1 UID: 0 PID: 13378 Comm: syz.1.1605 Not tainted syzkaller #0 PREEMPT(full) [ 728.214735][T13378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 728.214746][T13378] Call Trace: [ 728.214752][T13378] [ 728.214760][T13378] dump_stack_lvl+0x100/0x190 [ 728.214794][T13378] should_fail_ex.cold+0x5/0xa [ 728.214820][T13378] should_failslab+0xc2/0x120 [ 728.214843][T13378] __kmalloc_noprof+0xfc/0x840 [ 728.214861][T13378] ? rcu_is_watching+0x13/0xc0 [ 728.214887][T13378] ? tomoyo_realpath_from_path+0xb6/0x690 [ 728.214917][T13378] tomoyo_realpath_from_path+0xb6/0x690 [ 728.214946][T13378] tomoyo_path_number_perm+0x23c/0x580 [ 728.214964][T13378] ? tomoyo_path_number_perm+0x22e/0x580 [ 728.214984][T13378] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 728.215013][T13378] ? __lock_acquire+0x5c0/0x1f40 [ 728.215046][T13378] ? __fget_files+0x34/0x3d0 [ 728.215068][T13378] ? find_held_lock+0x2b/0x80 [ 728.215096][T13378] ? hook_file_ioctl_common+0x140/0x440 [ 728.215124][T13378] ? __fget_files+0x21f/0x3d0 [ 728.215157][T13378] security_file_ioctl+0xd3/0x230 [ 728.215179][T13378] __x64_sys_ioctl+0xb7/0x210 [ 728.215200][T13378] do_syscall_64+0x123/0x790 [ 728.215228][T13378] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.215246][T13378] RIP: 0033:0x7fdac019e159 [ 728.215260][T13378] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 728.215276][T13378] RSP: 002b:00007fdac1118028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 728.215294][T13378] RAX: ffffffffffffffda RBX: 00007fdac0425fa0 RCX: 00007fdac019e159 [ 728.215305][T13378] RDX: 0000200000000600 RSI: 0000000000005761 RDI: 0000000000000004 [ 728.215316][T13378] RBP: 00007fdac1118090 R08: 0000000000000000 R09: 0000000000000000 [ 728.215326][T13378] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 728.215335][T13378] R13: 00007fdac0426038 R14: 00007fdac0425fa0 R15: 00007ffc47895b68 [ 728.215360][T13378] [ 728.215384][T13378] ERROR: Out of memory at tomoyo_realpath_from_path. [ 728.422831][ T31] audit: type=1400 audit(1789993949.809:1242): avc: denied { write } for pid=13365 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 728.431635][ T5610] savu 0003:1E7D:2D5A.0009: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.5-1/input0 [ 729.069438][ T10] savu 0003:1E7D:2D5A.000A: hidraw1: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 729.089970][T13364] ------------[ cut here ]------------ [ 729.089983][T13364] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 729.089992][T13364] WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x944/0x1bd0, CPU#1: syz.5.1601/13364 [ 729.094690][T13372] FAULT_INJECTION: forcing a failure. [ 729.094690][T13372] name failslab, interval 1, probability 0, space 0, times 0 [ 729.094711][T13372] CPU: 0 UID: 0 PID: 13372 Comm: syz.2.1603 Not tainted syzkaller #0 PREEMPT(full) [ 729.094729][T13372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 729.094738][T13372] Call Trace: [ 729.094743][T13372] [ 729.094749][T13372] dump_stack_lvl+0x100/0x190 [ 729.094774][T13372] should_fail_ex.cold+0x5/0xa [ 729.094792][T13372] ? kmem_cache_alloc_noprof+0x6b/0x6a0 [ 729.094810][T13372] should_failslab+0xc2/0x120 [ 729.094830][T13372] kmem_cache_alloc_noprof+0x92/0x6a0 [ 729.094845][T13372] ? do_getname+0x35/0x390 [ 729.094869][T13372] do_getname+0x35/0x390 [ 729.094891][T13372] do_sys_openat2+0xc7/0x1e0 [ 729.094911][T13372] ? __pfx_do_sys_openat2+0x10/0x10 [ 729.094932][T13372] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 729.094955][T13372] ? __fget_files+0x21f/0x3d0 [ 729.094975][T13372] __x64_sys_openat+0x12d/0x210 [ 729.094996][T13372] ? __pfx___x64_sys_openat+0x10/0x10 [ 729.095017][T13372] ? ksys_write+0x1ac/0x250 [ 729.095034][T13372] ? rcu_is_watching+0x13/0xc0 [ 729.095055][T13372] do_syscall_64+0x123/0x790 [ 729.095078][T13372] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 729.095094][T13372] RIP: 0033:0x7f745239e159 [ 729.095106][T13372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 729.095121][T13372] RSP: 002b:00007f74531a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 729.095137][T13372] RAX: ffffffffffffffda RBX: 00007f7452625fa0 RCX: 00007f745239e159 [ 729.095147][T13372] RDX: 0000000000000002 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 729.095156][T13372] RBP: 00007f74531a4090 R08: 0000000000000000 R09: 0000000000000000 [ 729.095165][T13372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 729.095174][T13372] R13: 00007f7452626038 R14: 00007f7452625fa0 R15: 00007ffd97a4a938 [ 729.095189][T13372] [ 729.182657][T13143] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 729.258905][ T31] audit: type=1400 audit(1789993950.629:1243): avc: denied { write } for pid=13396 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 729.350031][T13364] Modules linked in: [ 729.353908][T13364] CPU: 1 UID: 0 PID: 13364 Comm: syz.5.1601 Not tainted syzkaller #0 PREEMPT(full) [ 729.363484][T13364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 729.373553][T13364] RIP: 0010:__mutex_lock+0x94b/0x1bd0 [ 729.378943][T13364] Code: 0f b6 14 11 38 d0 7c 08 84 d2 0f 85 c0 10 00 00 44 8b 05 48 50 72 05 45 85 c0 75 13 48 8d 3d dc 5b 75 05 48 c7 c6 00 f7 ef 8b <67> 48 0f b9 3a 90 e9 1b f8 ff ff 4d 8d a7 f0 0a 00 00 4c 89 e7 e8 [ 729.398553][T13364] RSP: 0000:ffffc9000550f790 EFLAGS: 00010246 [ 729.404615][T13364] RAX: 0000000000000003 RBX: ffff888033d6c880 RCX: 1ffffffff228aec0 [ 729.412601][T13364] RDX: 0000000000000000 RSI: ffffffff8beff700 RDI: ffffffff914881a0 [ 729.420577][T13364] RBP: ffffc9000550f900 R08: 0000000000000000 R09: 0000000000000000 [ 729.428537][T13364] R10: 0000000000000000 R11: 0000000000002a44 R12: 0000000000000000 [ 729.436676][T13364] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888033d6c808 [ 729.444818][T13364] FS: 00007f79d16a26c0(0000) GS:ffff888123c54000(0000) knlGS:0000000000000000 [ 729.454030][T13364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 729.460629][T13364] CR2: 00007f91f07212c0 CR3: 0000000076602000 CR4: 00000000003526f0 [ 729.468597][T13364] Call Trace: [ 729.471887][T13364] [ 729.474811][T13364] ? roccat_open+0x105/0x660 [ 729.479421][T13364] ? __pfx___mutex_lock+0x10/0x10 [ 729.484449][T13364] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 729.489998][T13364] ? lock_acquire+0x1d1/0x380 [ 729.494667][T13364] ? roccat_open+0x8b/0x660 [ 729.499171][T13364] ? roccat_open+0x105/0x660 [ 729.503766][T13364] roccat_open+0x105/0x660 [ 729.508167][T13364] ? __pfx_roccat_open+0x10/0x10 [ 729.513117][T13364] chrdev_open+0x234/0x6a0 [ 729.517535][T13364] ? __pfx_chrdev_open+0x10/0x10 [ 729.522893][T13364] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 729.529497][T13364] do_dentry_open+0x6ab/0x14d0 [ 729.534246][T13364] ? __pfx_chrdev_open+0x10/0x10 [ 729.539380][T13364] vfs_open+0x82/0x3f0 [ 729.543444][T13364] path_openat+0x19fa/0x2440 [ 729.548014][T13364] ? __pfx_path_openat+0x10/0x10 [ 729.553145][T13364] do_file_open+0x20e/0x430 [ 729.557660][T13364] ? __pfx_do_file_open+0x10/0x10 [ 729.562695][T13364] ? _raw_spin_unlock+0x28/0x50 [ 729.567541][T13364] ? alloc_fd+0x471/0x7a0 [ 729.571887][T13364] do_sys_openat2+0x10f/0x1e0 [ 729.576565][T13364] ? __pfx_do_sys_openat2+0x10/0x10 [ 729.581839][T13364] ? __pfx_get_timespec64+0x10/0x10 [ 729.587031][T13364] ? raw_ioctl+0x26f/0x2b80 [ 729.591539][T13364] __x64_sys_openat+0x12d/0x210 [ 729.596394][T13364] ? __pfx___x64_sys_openat+0x10/0x10 [ 729.601820][T13364] do_syscall_64+0x123/0x790 [ 729.606420][T13364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 729.612312][T13364] RIP: 0033:0x7f79d079e159 [ 729.616715][T13364] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 729.636326][T13364] RSP: 002b:00007f79d16a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 729.644871][T13364] RAX: ffffffffffffffda RBX: 00007f79d0a25fa0 RCX: 00007f79d079e159 [ 729.653034][T13364] RDX: 0000000000000002 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 729.661014][T13364] RBP: 00007f79d083506b R08: 0000000000000000 R09: 0000000000000000 [ 729.668978][T13364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 729.676938][T13364] R13: 00007f79d0a26038 R14: 00007f79d0a25fa0 R15: 00007ffc7d2c3e28 [ 729.684916][T13364] [ 729.687926][T13364] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 729.695186][T13364] CPU: 1 UID: 0 PID: 13364 Comm: syz.5.1601 Not tainted syzkaller #0 PREEMPT(full) [ 729.704544][T13364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 729.714580][T13364] Call Trace: [ 729.717848][T13364] [ 729.720762][T13364] dump_stack_lvl+0x100/0x190 [ 729.725429][T13364] vpanic+0x553/0x970 [ 729.729390][T13364] ? __pfx_vpanic+0x10/0x10 [ 729.733874][T13364] ? lock_release+0x24d/0x310 [ 729.738534][T13364] panic+0xd1/0xe0 [ 729.742238][T13364] ? __pfx_panic+0x10/0x10 [ 729.746644][T13364] check_panic_on_warn.cold+0x19/0x34 [ 729.752000][T13364] ? __mutex_lock+0x944/0x1bd0 [ 729.756754][T13364] __warn.cold+0x191/0x318 [ 729.761156][T13364] __report_bug+0x30f/0x440 [ 729.765646][T13364] ? __mutex_lock+0x944/0x1bd0 [ 729.770397][T13364] ? __pfx___report_bug+0x10/0x10 [ 729.775425][T13364] ? __lock_acquire+0x5c0/0x1f40 [ 729.780347][T13364] report_bug_entry+0xe2/0x290 [ 729.785099][T13364] ? __mutex_lock+0x94b/0x1bd0 [ 729.789853][T13364] handle_bug+0x1cd/0x2a0 [ 729.794163][T13364] exc_invalid_op+0x17/0x50 [ 729.798645][T13364] asm_exc_invalid_op+0x1a/0x20 [ 729.803489][T13364] RIP: 0010:__mutex_lock+0x94b/0x1bd0 [ 729.808849][T13364] Code: 0f b6 14 11 38 d0 7c 08 84 d2 0f 85 c0 10 00 00 44 8b 05 48 50 72 05 45 85 c0 75 13 48 8d 3d dc 5b 75 05 48 c7 c6 00 f7 ef 8b <67> 48 0f b9 3a 90 e9 1b f8 ff ff 4d 8d a7 f0 0a 00 00 4c 89 e7 e8 [ 729.828451][T13364] RSP: 0000:ffffc9000550f790 EFLAGS: 00010246 [ 729.834511][T13364] RAX: 0000000000000003 RBX: ffff888033d6c880 RCX: 1ffffffff228aec0 [ 729.842464][T13364] RDX: 0000000000000000 RSI: ffffffff8beff700 RDI: ffffffff914881a0 [ 729.850416][T13364] RBP: ffffc9000550f900 R08: 0000000000000000 R09: 0000000000000000 [ 729.858377][T13364] R10: 0000000000000000 R11: 0000000000002a44 R12: 0000000000000000 [ 729.866340][T13364] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888033d6c808 [ 729.874307][T13364] ? roccat_open+0x105/0x660 [ 729.878884][T13364] ? __pfx___mutex_lock+0x10/0x10 [ 729.883897][T13364] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 729.889429][T13364] ? lock_acquire+0x1d1/0x380 [ 729.894087][T13364] ? roccat_open+0x8b/0x660 [ 729.898572][T13364] ? roccat_open+0x105/0x660 [ 729.903144][T13364] roccat_open+0x105/0x660 [ 729.907555][T13364] ? __pfx_roccat_open+0x10/0x10 [ 729.912474][T13364] chrdev_open+0x234/0x6a0 [ 729.916874][T13364] ? __pfx_chrdev_open+0x10/0x10 [ 729.921795][T13364] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 729.928112][T13364] do_dentry_open+0x6ab/0x14d0 [ 729.932861][T13364] ? __pfx_chrdev_open+0x10/0x10 [ 729.937782][T13364] vfs_open+0x82/0x3f0 [ 729.941836][T13364] path_openat+0x19fa/0x2440 [ 729.946412][T13364] ? __pfx_path_openat+0x10/0x10 [ 729.951337][T13364] do_file_open+0x20e/0x430 [ 729.955824][T13364] ? __pfx_do_file_open+0x10/0x10 [ 729.960838][T13364] ? _raw_spin_unlock+0x28/0x50 [ 729.965672][T13364] ? alloc_fd+0x471/0x7a0 [ 729.969987][T13364] do_sys_openat2+0x10f/0x1e0 [ 729.974650][T13364] ? __pfx_do_sys_openat2+0x10/0x10 [ 729.979832][T13364] ? __pfx_get_timespec64+0x10/0x10 [ 729.985011][T13364] ? raw_ioctl+0x26f/0x2b80 [ 729.989497][T13364] __x64_sys_openat+0x12d/0x210 [ 729.994334][T13364] ? __pfx___x64_sys_openat+0x10/0x10 [ 729.999693][T13364] do_syscall_64+0x123/0x790 [ 730.004271][T13364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.010143][T13364] RIP: 0033:0x7f79d079e159 [ 730.014540][T13364] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 730.034125][T13364] RSP: 002b:00007f79d16a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 730.042533][T13364] RAX: ffffffffffffffda RBX: 00007f79d0a25fa0 RCX: 00007f79d079e159 [ 730.050485][T13364] RDX: 0000000000000002 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 730.058435][T13364] RBP: 00007f79d083506b R08: 0000000000000000 R09: 0000000000000000 [ 730.066386][T13364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 730.074337][T13364] R13: 00007f79d0a26038 R14: 00007f79d0a25fa0 R15: 00007ffc7d2c3e28 [ 730.082294][T13364] [ 730.085477][T13364] Kernel Offset: disabled [ 730.089775][T13364] Rebooting in 86400 seconds..