last executing test programs: 4m2.672518494s ago: executing program 3 (id=465): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x801d) request_key(0x0, 0x0, 0x0, 0xfffffffffffffffd) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_SET_SREGS2(r3, 0x4140aecd, &(0x7f0000000140)={{0xc000, 0x3000, 0xf000, 0x9, 0x0, 0xe3, 0x81, 0x1, 0x40, 0x85, 0x0, 0xb}, {0x26000, 0xd000, 0xc, 0x3, 0x3, 0x7, 0x5, 0x6, 0x1, 0x4, 0xfa, 0x5}, {0xf000, 0x8000000, 0x4, 0x4, 0x11, 0x81, 0xe, 0xbb, 0x5, 0x4, 0x92, 0x9}, {0x58000, 0x58000, 0x1b, 0x7, 0x1, 0x40, 0x4, 0x0, 0xfa, 0x29, 0x6, 0x29}, {0xeeee8000, 0x4000, 0x4, 0x9, 0x5, 0x2, 0x87, 0xf1, 0x2, 0x1, 0x8, 0x8}, {0x4000, 0xfec00000, 0xb, 0x2, 0xad, 0x2, 0x5, 0x4, 0x1, 0xe, 0x6, 0x8a}, {0x3d0178791b53fadb, 0x10000, 0x4, 0x0, 0xcd, 0x5, 0x5, 0xf, 0x24, 0x6, 0xff, 0x6}, {0xc000, 0x6000, 0xb, 0xe, 0x13, 0x1e, 0x3, 0x0, 0x7f, 0x5, 0x2, 0x96}, {0x70000, 0x405}, {0x80a0000, 0x2}, 0x7237efa2c7a3a116, 0x0, 0x6000, 0x61, 0x5, 0xa800, 0x6000, 0x1, [0x6, 0x400, 0x8000000000000003, 0x1]}) syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x1608e2) syz_ublk_setup_io_uring(0x1d, 0x0, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120101023b4f31103b0904a101000102030904610d0025eafb0b7ef7b482fd7b8586a50a872f4576990c3effbd446872625321f1249aabca"], 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080003006400000008000200c8"], 0x2c}}, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000140), 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000440)={0x0, 0x5961, 0x8000, 0x2, 0x14f}, &(0x7f0000000540), &(0x7f0000000400), 0x0) socket(0x6, 0x2, 0x7) socket(0x400000000010, 0x3, 0x0) write(r5, &(0x7f0000000580)="3a0300001900252000bd6f0082030004000500e1000c040007008000030000000000000000000000c832a9e706000000000000003d37a3e2a01fd64203efbfec045771ddac8683c7efbea5c43643e7a45e1b2ebfcdf57b432cba203c98274b472f832cf59ff0639b45288a26c9952ab2b6a34e24850ef079f2cf8f305f1968f4d520a1b3065bb6cc88be81ea2088596c075551b2db928c9c80c11410500c93e996cb60375f10efa7374439ce412955be19c38ffca582446be7805514587cd9fbaff3a877a0144fd596b78e9b9d51", 0xce) socket$inet6_tcp(0xa, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x654000, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000080)=0x6) 3m58.823971386s ago: executing program 3 (id=475): prlimit64(0x0, 0xe, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e5876e4040200516940a000000010902"], 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() accept$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs, 0x0) sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) getrlimit(0x7, &(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000280)={0x9}) ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f0000000300)) 3m54.980390923s ago: executing program 3 (id=484): r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000013906c08e90f01db9be9010203010902120001000000000904"], 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000140)={0x1, 0x9, 0x4, &(0x7f0000000100)={0x16, "537a1468df08000000758bd16868e0bf22c7b844c1b1f10186854fff98d2870c38"}}) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f01ebbeef, 0x10, r1, 0xf11c1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) fstat(r0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(0xffffffffffffffff, &(0x7f0000000640)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r9 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000002680)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000002980)={0x0, 0x0}, &(0x7f00000029c0)=0xc) r11 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r12 = syz_ublk_setup_io_uring(0x31cf, &(0x7f0000000180)={0x0, 0x5000, 0x400, 0x0, 0x1005}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r12, r13, r14, r15, &(0x7f0000000280)={0x2e, 0x0, 0x0, r11, 0xc0207504, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000041c0)=@new_dev={0x1, 0x379, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc151d6d7a959815c}}}, 0x0) r16 = fsmount(r9, 0x0, 0x3) getpid() sendmmsg$unix(r4, &(0x7f0000006100)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000300)="cba529577989a82eae9f5e698f7d4c700018edbffdeb3bf03f03918afd3cc3ba7cc2751c173bce870e4b4b39da987e16fe0d0c9387a883e16bd7113f001ee72077749089826fc6542f8beab41a29edadd6af3e88511ccd7c27e3db45f30a79975495161fea0bdfc38174d75765a028e2ad6c757745f35e1fc287a436c113abfadee11869", 0x84}, {&(0x7f00000003c0)="6c42ec10973c7bce6b819955edc2440926bd99b9972236228f0843a02505fedc59d3c52d8eb03e0a0bf5eca3ac1a2c59292bf76c4ac91fb4c2f14734294256b532f7bdce846826710b2d9b946ad640eb991a7eedd15735b0f51c0e80f37ba1affacc98901497fe177d8377758fe5b05b81137ce469003047e8ec79cf38589729eec596ffe15b49d5afa135a514ac9a6bfc52db6ab8da4b78d191", 0x9a}, {&(0x7f0000000480)="6c8d545a6a34bb16c68d6ad1fd992bc8e127b6f22bccad6c170b58f66cc32b409a13132bbe8ccbfbd35ad639b6c5d325730fc9b241934b0d74410058352d3b8ddd01f0b8d309897f6882d216386756e52327d60ef9e79dea69d78c408c05f4842e0975fa6308a7fedd4f52c4582dab1e5071bfea2f070dbc51d886589d580249128077af1b4f926842a112e404f527e8ad9e057ea71a879897dd9344c26221e5028bcd4c58151590f0594094e81859c1a1b83f2dd35b625c2473bb6f068f1e603169a59f18caa2a6bc91ef109e2b498190e3398d53853f3c49cbc24b0d35a4a30dda9be802896f6d03c738b6459b96d365db20e745ff", 0xf6}], 0x3, &(0x7f00000026c0)=[@rights={{0x18, 0x1, 0x1, [r1, r3]}}, @cred={{0x1c, 0x1, 0x2, {r2, r5, r7}}}, @rights={{0x24, 0x1, 0x1, [r0, r4, r3, r4, r1]}}, @rights={{0x24, 0x1, 0x1, [r3, r9, r1, r1, r3]}}], 0x88, 0x4c840}}, {{&(0x7f0000002780)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000002940)=[{&(0x7f0000002800)="07dbe05366e0fc9f92f7948672bc39677a1a1512f48c6187f37f71ed38c0c040b138d966d960aa90d3fd4cd6a49b541e760181a15c3c258119e4f39fd8f3df3d095b7de0a53b906338d261c4dddf20f8533e514e806c3c0d538013f07a", 0x5d}, {&(0x7f0000002880)="38b0e1bfd06704c7e06ed3398cb78929fe79c4d8291a0e17a51483fbc048439e9503f263236d8d67049088fbc85fc45264b374390a74573f9df878e8a2d5c4351860f3f681fb8eae39ee20cb0514b40786a84fa9df27d9b90a5ed61b862cce80d784f4c9e61a179053bb58d72603924445b31859c6cc725c64777b5a1427fd3ae704756595d7e4dab106b13983dbdd5b4e7ada338f40dea86d9d701a01f4fe26900c0d2a3d57ca0682c0273069e798bb8b4369be545798", 0xb7}], 0x2, &(0x7f0000004ac0)=[@cred={{0x1c, 0x1, 0x2, {r8, r10, r6}}}, @rights={{0x38, 0x1, 0x1, [r9, r9, r9, r4, 0xffffffffffffffff, r1, r0, r0, r9, r11]}}, @rights={{0x18, 0x1, 0x1, [r0, r9]}}, @rights={{0x30, 0x1, 0x1, [r0, r0, r4, r16, r1, r4, 0xffffffffffffffff, r9]}}, @cred={{0x1c, 0x1, 0x2, {r8, 0x0, r6}}}, @cred={{0x1c, 0x1, 0x2, {r2, 0x0, r7}}}], 0xe0, 0x20000000}}, {{&(0x7f0000004bc0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000006000)=[{&(0x7f0000004c40)="8a3046e60ec2821a337cf4ee3bb5a12a8566b2", 0x13}, {&(0x7f0000004c80)="cd03e17880438353daf1502299bbce1158847d8d00761e2dee88f334c4755a6df3c0faef2b086503b7164f3619a191038f45a5e3bd73779b98a7a0365335bd1b327c62b63d8c2fe88f277a3f1a722df76ba4b05b5afe9559c6f597d74a7c1e9082116bff69d60e50860f2e79b144137dee023746903226e5b0865fddfd4e5f3de0487020e4f06e1daa9c719a378650b284f4fc69b61b54693b06485692154f6d2c0a457e6e43e74ee65ebdb1ad850cc2b53fba", 0xb3}, {&(0x7f0000004d40)="03f4ae37747e4a303788001e87294abca69e641c6968bf45a9508666ae1a909b223ab14ad9dddba8d03e1fe710eccd5e7188904eb02f3dc2bf34bc829cf9d6a1cc83579bf604711ebbe71fe72bbddc2a6e4136348d3e0e1adf0a61a09cf01eef14e239d52319f987d2fea89551088991c7f10117943e635e7da02feffcfef09a7973295bc06c1073047782ecea91887ca3c9d1b6bdecce6b7d3733baf3dc7c2cdd10a5b61a65e3fb6107", 0xaa}, {&(0x7f0000004e00)="bb93d8667c0a7bc4930e7577f059e08d9ecb814a05ee5fe5632507b4cbaa1cc366c0a57480202e01441e83371548e5ae7d99f1693c8f478035828decf821cfee77cba31a7fe98f4b48ad861e0a4e64bb07778fb94b2b24211296dd7af4", 0x5d}, {&(0x7f0000004e80)="1b5df3df", 0x4}, {&(0x7f0000004ec0)="1b22bc6f8390f07aff1021c1c69c40b867a7f0b108e0", 0x16}, {&(0x7f0000004f00)="f042e18c386ac4b1e161d64d61827e8e950be583fcf3a0541cc716548833a5a2936f5c55455743867120b276db887a3c477b8638f857f9ce55a7fcd9d482f62b911dbd4cfe9d015c9d9c3c1a49a1940b75cecd8eca676f0e0589f007f0e2b5c6641de5d5c586b38c06531f358792b669df80c43244f3571c70a9001f4a3a1433741fff80b802f5d8b420b10db98cee8b5d32b1065504feaf880868e36ab053cfb8a63085021c3d96ff04b60b441150ff80d938410d28c0655579dc9e6a92aa9cec0ac9d9f9630a869ba7af85579cd12a497660fde074816795c4cb17a01bb96324de86df3f5a599ed256a95b69f6ecd6954e83d88f07eef319701bac64d861", 0xff}, {&(0x7f0000005000)="8fde7039b2539e2d41648dd466c2b50c974bc83eb31b43f6b143796bc8fcfcd8f233695bb15102a2d4d909c8edcaf73e7251037cccc2d1a2573a76f910a4870421249d14c1628d9b504d603b3011bb2c3ff7fd4977de37466c7b3931b280d8d340561e19179f4bc74824c4737eae9d06ea692c617cb7fd250f06556fbd734509ef05687980952a8a880b81ebd705516334e2b98e250ed13bf3afb54fddf715effaa2076c983d12e68609125aad52c0531fa4ae5dddaaa672092e8d31fbe288fd7c0112c3e6ac33c1f713d12485861819e8d97eaf7e6f6a9608b7f656fa8dbe21dddd075c3814750b3cbc7181a8572ea6288ccd9f40bcc3d90b740585b952973bc204f9be0933129ca830f54a87df35d56acc6db8bae7d62c1939855cc3de8d59261634588afbc9ca15bb92de27d0748c913e5e8e7cc3e7df1dc88e99cd0928ea1df2e01998ee7e4025e82bf1f920c548cbbe65557b68533fa331b7b93a21549cb97762c2fa583f0e93cefdb8c0478bbd573d4abf6d3466621cd1586915111efa5b2fc170e8eed8af9cea8fd0ab05eecc42e75d6247d63d27645d8d781668220fb0327fbbeac2aa0e563c51495b53c6e37ec509767b9ec602ee76ebc721116fa628e52a61e9e4fdc6a891c0449ada634c2fc1f569e0565634e1424ee657faa61899a0db738732901ba4c243e5e258bf6f2832e1060bc11dddeea76cc45161fe5f2b2aa90a353fc17ae54f8656853a2ccf7ccf2db9235fadee3b12c29fe673eaffae6330783f558f85b171d656870c55ee56078bb5bf20c095e2b6d64b414baefa6bd198b82c4e1a903a86bf7b706257abc3acfacf0db15f9aed89c08c8ddd2154273cf817a91a9594a330051e7bf02debe781b516de3d4ff0520d39c5b5bd207ef1c198fc106fd73b3c269946340d50904b5eab8d32ba912fe913e4a074320910f0dffc1ec5d5718e74c499be89d2946106ad7bf799210817898f6e03ca3327063a9cde2115c6660f27b2ea6976be175a0f5547a719e7090dcdfd007db8e0e45251983b76ff0be1df40622e25eba95ddafa532f0082596e84cb5a1221dcf847b9122f9f7a431da8a3e60102191711b51e03da8886b4dcb2caa8728082380e37a9d18e9213665620a5020d374826fe8cd2d82c12aee7a9ec983da7c8d0e3452e32cc5e63c3c9342bfd5153377fa370f2d7873871d874f0282505400c79cd079d1ab0bc6a03021f4e07cbe2d4476cc3b28c2195f4b2ff7f46afcd288dc9fc094953021cda4011a70864ace4eb61952949b2bc4f4f14bff84ef404cac0664f5cf86d832c78437bb1fab7171405dec1397bd5cf55357887181414bf2c7dd4dfde6e4ed86970754fd82f9be587482e4b55f17e43845c4b567c2982e0801c007b94b97389d0c53096f196a6f75dcdab82a6ac2639aefb824c3c32453dcdda448d0db80d0d7a0e19c32d68c5c01ca36e74a2dbc57e1ca61a180920961ad1c8232b87b7de032e3b726bb2a35b5b69b71b5d9b5b666ac7f8736abd8b02e750f38e42cd172673b49f9ae178c5905a818caa28a3b55664ad646e85e7121aa5be1888e1a2cf1d013043a618356a0d758b9692b3fad719e9dd768e62b00d891a8d81babb56c261ef510d34078f05f720a47f14d551f89f5a8dd19960d23ceb1a832f2cac4324b48355087c63da89897bc34630c8a708bc1a7dfb85f5da4be741d8a192bce38ea311c76dde921dacb745c54af9c40dca56cf8e7f4eb39ec982a91f4cfdeb6bd4e240dc806dba2db765a879c6510dcb2405d1345ef8ea272180b9dcfd41de8cb79c0635cdc057becaa70ad68c6416226fbfbb8871a73bcb45f2552e206ea29ca915625d3ebce07e184849043b3fe243e1c7334bd5545a74bf70585be66ffb41edadffa63df77e4b9ccb651575de38a0a81179a2b522f350fc90ea6da269a3705dc8860428a78c2d8af81ba7d72f9a96c0d2f78ab7f883ca001380f60ecfa0eaa3a8a87cf1dde58355109651d6a8b948289b8d0200f5ddf327429fe974625a0484c4fdbe519bce8cd08e3e5202d39c9e1aabecf42d7c6c8c008eca883c133766c2b9788581fea543e216c915200d566f6faf3806796d5dd9cd7adfd28e47020e60cc73a9cf91f6bc0276669480e227341d90328ff040650922bb3069df16ad0639a7314a78d9a9e5df3895bebbbf7b5a6187f23bad55d86cd289d388aa6c43857048282bfec0806b672a799d5c6cc4931aed9abfa894390a01f8c86505b6d39bb66a98f97b6c46f01ab7cd26076916a868275bfa298934b191d9993f5a03ecf0adb58c87bb784f5c16bdad8edb170c7e36dce52c1e41b0acc3a5cae4ca03b75274c40133fd22aa27265b7c38116b6bfc510e6fa0f05b9a70853c6089e01975d06e9c502d9ce26da28382c32c949d05105ae972622cd682e0a6754c57dae4756cbc1cdc309b46b2d79a751a611af00e0e80ab96ef13e4aeb3cdfca44bcfdb6318d05f01463a81fc63d0ed1e5ee66499faaebb5a44432f6433a71df996c12d264ce8a1e53a0c541aee939e7f7699a8beb6c253252cd06eb4f5cc2011365177a209fd734e5f1a40728523174e1e826f790ddc40d7a77ab15f4aed104ac69b47d898765ac91a2c63c2f06fa9728eb71381f8a1889ff6f166946771d494cb68e5f6ce446e5c29ba8147ff589cb025a470265baf693efd2ff744954e6beccefc7db3b593993923e9ffc0c9f50da90623ad469819a80fd78857966a977eb763a70dad58a950b4ac986ea6373bea52d66818b91de1e83e054f90336a336eef6695370e63d8e0ed9a09b8030dd9c21d2487747a363fb4a793281f11b3ea1b6b2830bbdab1b7282888ccf86703c3644d7bf488248cb35d62023b187423a56fd793c141681dbeac79abdf11bb34c1e66ffc695ecc40f8d59613b778e11a7d5d26bb8ad10e806f3bd8a72a75b1960b96353144a7e612b93579c8cd78193fff03e9dd65847dd9da4feaa639716e62c053a5cba8c37cf628a9eaba5b916de5ac9f1251a56419bba0d2d218d09b4b73a006924f8ae43f585537aa0a7e93ed1a892c245b91e8f696a4d8953cbeaf62acbfc809493ac011cea32d58e1b82209c1c2bd73afbcf649fc03b2a18b43ce48b12164a5bfcdbdb51580044add36cc1f3811d42aacda540867d36e6ffa7e9fed4928e1fccb7da1b5443fbd0d0bdbba65c7b2a3a7e7273ec6effa40e7a5b5d246370f67537d939bb72cc027c818e36768ed4024ed2d9569599228038bffe5a9baf8a5689c6b31c752c206300ea68262f162a90d3e4ae0dfca895dd405325a6a507b9097be41ab98df8e2c062aec8bd9297f92b0e1050da7bfb772bb7cb449c9dbe92d1e62d041fe7f2b9534942dd69da4157fb9e966f9cf1064970ee4f60f768000832b15acfa631bdb0ec5ffa38684901793b13de3c72ced3dcba497c44af1191032d84aa6ca0af5d2d67b800fee1df950bc0a8fa491135888296c4884457b13786b344c2ac23eefea84a3a993f1d736ba85b62f0ea4c38cfa84dd2e055e7ecc78d4c1facf1d00b0b8d0116b9ef1c3343bb514b0f949315749de78e1f70b9c835bd55ca9ca956dd7e097091770fd4c3ddeb6c7cafb8a40f4607c75d461878a9ea4d893fa56464f873b7a6609db8f1813ee6795cf31a23f2a2aa3f3cb175f856fcb25c632c5bf5b150a3d05682e516b1e3a97fcc0eefc864a97b7548ef7e4f3dcece3e02cd58e31347215d4bdb7ccbeed805904b12312a91b3ed70fdf733f92d166fcefb553c4c50f083a2e219c6ff090fd5da9e79f7d09e38a16e76c2a19381a9baec9e3818aae3fa773456c643c633118141cb5b02b48e4d022c022b9815c80baa361d638680d0981321427a416b260bf187e86f18fdcf98fbd57bb792e3c4bd6c11805b9f2e41be1312ee7ad984c9855a4f81c8bb714965591654e2a4e546ff404be5debba5afffa77365a9919145d4618480b66c1de6ada9339945b3f45fe5e425b8697b840567465c7530a2da6c2af780340d5ab4eb65aa9ea61887a7d623cd063604cd3578469e8b1ffa7d1c54d216eccae5904864a0f4a25aa1e0098a32da2ea79548ab4b20abe806d725e4de11d10d10ec13fe7c45c76a0d3a26087b692e9f570e2eb646c226fe6b562d631f47b743a3996328f4f6ddd40607c07bf6c21951cea93385d970f9041d3f80342b7ad4c90cff0294a65b162eff9b62d174d5f3676edf6afaa747a04b6eef8572572ff738dc8cf077872a18f160a361a96b3e3eb2d2a8054aab80754bcfb41febe54df87fefccde6e021e685c8f3319fb15cca2def9fe796ade76dd111753c4748a42cff9363effe12e32867bfbb9f142d8dc87a6573cea4b0c9ef7d3ccd863275008414726a2a5a453adb5294ccb289fa1e967173d35dd55c07876b1589534bafb81750805da97d2aa162e2caa90a435520227d189744c7db67e2196295a76a3e7659f46ce504957f142f8093e1f4fcfcf1b9b00b275410c6223fc37f7b63bb74751d28b8271222168f10163afd15e745fc1a42a600f9f148998c73456eb1e725fa031d560be71982f54f641f38b7ebe02f9a8d78665d215dbd7a8520a6c5741b97a664e89affa0cbe84c89e42a2d8b298c6fef29e18d941781accfb1b37a27ab94108dd2cda8893835cfeec1e6147a195a02a86a80877b2587952bf22d2f95d0ca70e6e39fca2f7b7d092ef3cbf699c702488ed5cbcbfc0794153d8e64d25275eda546005702ab9e40864739b6fbc27d4bc19c1a2c5c0f76266c0a394165fe214fc38f8dfe8b716cb199edb93fd8a7bba4bdd6ae6b17047d2518993c64c31fa09b396b897f582232b5fa1caebdd4ed689cb9b57a049e44ecf47af7d39e0e9bbfac6abdf1e0d2a3c721cc292407f6e01db046818905fa6aa68078c215e2cfda35676be6f1ff047f3c57e4b21d636f4a8a529cee96aa959bcc8db4cfd1919605ccfd406b9c39a545e5ba331a59c2074d2bae819cd4ca85640ded57323f46005f7fa500aa29bf141ce4855eec2f2dba3a93cc292d786606052147c610c2b9ea5731c6a792775baad1e0d7ea8425a85a47e23001e7d4da4f75a3f582c01dec231c0cc775d656a4d3446ea9242b47c47e690559d8d37180acac63a69442427bb5ba175cd3bf98e7133c315cac35fd6be1175bec7db22f74953958da82ab62f687204ce7a350399d692ae7a68cd855dc79f0ad69159ede582409eb213337e934ef49edecb12b1fa55ee37fc7460ec4852709b9551ddd914eb62fab4e8de1b37853a6993501c6de3282250b0962426b202524fb58e5847d35c7dfe61e704648c5ceadc0e34709d39b4014b0fc0d47b0c68e93f786ae4b92f04a6c68247db396bc7d7cc348d639c3e6ec9cf41d03922f542e465b9ae7a7aa22b05cb670f8a45be115df3497e97f38607f88fb70abe54879a5ca86cb541ff8d57c088e5b5c0a2beb1c76df8994e981d37a1a5ef07e66ea4a774ca97bb79fb7e339eac51b78d6dec2ec29fd16e6aba11909e4e23295562957f5ce1519053e401f6239c4c6889e622d00b2e1cbd36052faa410b762087676598f4f229576791c059a71befce31a3c272eeedd52b016f5e003c24971696ceee5f76d95af89cc587cb5d50aebd17f50298348587de5abdc1dc022e0443b47208b200f4a560baf31f637004a23a29ea62e40c6c034c36f03d658f995e13a1e031db3374a7999c20d72df2d082bf3e1e5bf614d4061449f2c6594118e344ea2bb8d9d9b2c09ca5f3ebe50931c6cdf1974ff2e63adc680d9a7afa2edb39a221608", 0x1000}], 0x8, &(0x7f00000060c0)=ANY=[@ANYBLOB="100000000000"], 0x10, 0x80}}], 0x3, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r17 = socket(0x2b, 0x80801, 0x1) connect$inet6(r17, &(0x7f00000002c0)={0xa, 0x0, 0x1, @loopback, 0x1}, 0x1c) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) listen(0xffffffffffffffff, 0x5) r18 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r18, 0xffffffffffffffff, 0x0) 3m51.441807458s ago: executing program 3 (id=492): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000003b40)={0x28, 0x1e, 0x221, 0x0, 0x0, {0x7}, [@nested={0x14, 0x144, 0x0, 0x1, [@nested={0x10, 0xf3, 0x0, 0x1, [@nested={0xc, 0x28, 0x0, 0x1, [@nested={0x8, 0xa, 0x0, 0x1, [@nested={0x4, 0x11d}]}]}]}]}]}, 0x28}}, 0x4000080) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000280)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x185093, 0x0) 3m49.251035408s ago: executing program 3 (id=494): prlimit64(0x0, 0xe, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e5876e4040200516940a000000010902"], 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() accept$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs, 0x0) sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) getrlimit(0x7, &(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000280)={0x9}) ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f0000000300)) 3m46.339450667s ago: executing program 3 (id=501): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f0000000080)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) prlimit64(r0, 0xe, &(0x7f0000000380)={0x81, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000280)={0x0, 0x5, 0x4000003}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="02c90009000000000000000200f9"], 0xf) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() connect$unix(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r2 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r2, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r4, 0x0, 0x0) 3m45.754822274s ago: executing program 32 (id=501): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f0000000080)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) prlimit64(r0, 0xe, &(0x7f0000000380)={0x81, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000280)={0x0, 0x5, 0x4000003}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="02c90009000000000000000200f9"], 0xf) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() connect$unix(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r2 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r2, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r4, 0x0, 0x0) 2m48.738903199s ago: executing program 0 (id=603): r0 = syz_io_uring_complete(0x0, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000040)={0xfffffffffffffffd}, 0x1, 0x0, 0x0, 0x10}, 0x4008010) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x7, 0x7, 0x3, 0x6}, {0x400, 0x6, 0x6, 0x3}]}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r4, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x34, r4, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x48c41}, 0x4040140) ioctl$HCIINQUIRY(r2, 0x400448e4, 0x0) 2m46.543142978s ago: executing program 0 (id=607): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000008000000000000000000910095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r0, r0, 0x2f, 0x0, @void}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/4\x00') read$FUSE(r1, &(0x7f0000002dc0)={0x2020}, 0x2020) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0xc020660b, 0x0) setsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)=0x2, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setns(0xc9, 0x0) r2 = socket(0x8, 0x2, 0x0) setsockopt(r2, 0x108, 0x42020054, &(0x7f0000000000)="010000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000005000000", 0x54) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, 0x0, 0x20000014) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x268}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x80000a, 0x31, 0xffffffffffffffff, 0xd0fb8000) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'\x00', 0x52d35ce30131f272}) ioctl$TUNSETPERSIST(r6, 0x400454cb, 0x1) ioctl$TUNSETPERSIST(r6, 0x400454cb, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300000100000000fbdbdf25fc000000000000000000000000000001e000000200000000000000000000000000000004000000000a0060803b000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000000200000000000000000000000000000000000000000002004000000000000000fdfd7fffffffffff50000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006000000000000400001020000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}, 0x1, 0x0, 0x0, 0x4041}, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000"], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) 2m44.714941506s ago: executing program 0 (id=612): r0 = syz_ublk_setup_io_uring(0x57c, &(0x7f0000000500)={0x0, 0xd58c, 0x80, 0x2, 0x30b}, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r4) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x4, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x10}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x21, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x200009, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x3, 0x43c, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1a0}}}, 0x0) 2m44.656801799s ago: executing program 0 (id=613): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb6, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@ccm_128={{0x304}, '\x00', "64018d5ff2b9450a337a0e02ff73fa00", '\x00', '\v\x00'}, 0x28) sendto$inet6(r0, &(0x7f0000000500)="00000000000000000012a15f3f2b40a3187ba90a5e88d47d804f4e85d0cce76a95ede1b0fb4cd20d500afbd31b4d1dc2e15dd616662a822db93d5bfc57025a1ccda9d78de9bc1a81e77157f6de0d838c3b31b8787f3b7057e9bdbd36de31d1b96cd507f44cf90f9896535b06084567625d4b904363e2857a12ac5b6718089ea0a1ce68e0774561eab791f242afdaf4636210e150f0f1bf24ca1440bc51", 0x9d, 0xc000, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x80, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/anycast6\x00') preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000180)=""/64, 0x40}], 0x1, 0x9, 0x1) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000020c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) add_key(&(0x7f0000002340)='big_key\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r3, 0x0, 0x25, 0x4, @val=@iter={&(0x7f00000001c0)=@map_fd=r1, 0x10}}, 0x18) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mknod(&(0x7f0000000300)='./bus\x00', 0x8000, 0x9) r5 = openat$mice(0xffffffffffffff9c, &(0x7f0000000880), 0x41) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x8000000001cb, 0x12) r6 = syz_io_uring_setup(0x5860, &(0x7f00000005c0)={0x0, 0x979a, 0x0, 0x0, 0x329}, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x800a}}) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x20}}, 0x0) io_uring_enter(r6, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) write$char_usb(r5, 0x0, 0x0) 2m42.819196786s ago: executing program 0 (id=614): bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000ff0d1400bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r0) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x50, r1, 0x1, 0x200, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'lo\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}]}]}, 0x50}}, 0x0) setns(0xc9, 0x0) r2 = socket(0x8, 0x2, 0x0) setsockopt(r2, 0x108, 0x42020054, &(0x7f0000000000)="010000000000000000000000000000000000000000000000000000000000000000000000000000000100"/79, 0x4f) bind(r2, &(0x7f0000000100)=@generic={0x8, "0000ffff01002000"}, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r4 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x44, r4, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x4000004) syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r0) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r4, 0x400, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x24000004) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r1, 0x301}, 0x14}}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={0x1, 0xffffffffffffffff}, 0x4) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@bloom_filter={0x1e, 0xc, 0x10, 0x0, 0x200, r6, 0xef, '\x00', r3, r0, 0x767d, 0x0, 0x3, 0xc}, 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000140)={0xffffffffffffffff, r7}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r7}, &(0x7f0000000100), &(0x7f0000000000)=r6}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r7, &(0x7f0000000900)}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000140)={{r5}, &(0x7f00000000c0), &(0x7f0000000100)='%ps \x00'}, 0x20) 2m41.354108367s ago: executing program 0 (id=617): syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) openat$dir(0xffffffffffffff9c, 0x0, 0x140, 0x1a0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xd, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000000)={@remote, 0x9c960000, 0x1, 0x3, 0xa, 0x1, 0xfffe}, 0x20) r2 = syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x101701) clock_gettime(0x0, &(0x7f0000000180)) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r2, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) (fail_nth: 2) 2m25.917518672s ago: executing program 33 (id=617): syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) openat$dir(0xffffffffffffff9c, 0x0, 0x140, 0x1a0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xd, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000000)={@remote, 0x9c960000, 0x1, 0x3, 0xa, 0x1, 0xfffe}, 0x20) r2 = syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x101701) clock_gettime(0x0, &(0x7f0000000180)) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r2, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) (fail_nth: 2) 1m0.885259552s ago: executing program 1 (id=818): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = openat$panthor(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$inet6(r1, 0x0, 0x0, 0x20004855) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg1\x00'}) sendmsg$nl_route_sched(r3, 0x0, 0x0) writev(r2, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) mlockall(0x2) r4 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_LOCK(r4, 0xb) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4048aecb, &(0x7f00000006c0)={0x7, 0x0, [{0xc0000000, 0xffffffff, 0x0, 0x7fffffff, 0x40006, 0x6, 0x1}, {0xc0000001, 0x4, 0x0, 0x11, 0x27, 0x7, 0xf8d1}, {0xd, 0x8, 0x0, 0xffff, 0x7fffffff, 0x2, 0x2}, {0x1, 0x10, 0x1, 0x0, 0xdf4, 0x6, 0x80000001}, {0xd, 0x2bb, 0x0, 0xa, 0x800, 0x80000001, 0x400}, {0x80000000, 0x100, 0x0, 0x2, 0x1, 0x2000001, 0x7}, {0x80000001, 0x200, 0x6, 0x68be, 0x8, 0x2}]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2802) io_uring_enter(0xffffffffffffffff, 0x8ad, 0x9398, 0x20, 0x0, 0x11) getpgid(0xffffffffffffffff) shmat(r4, &(0x7f0000ffd000/0x1000)=nil, 0x7000) shmctl$SHM_UNLOCK(r4, 0xc) 58.132272294s ago: executing program 1 (id=825): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff}, 0x0) tee(r2, r1, 0x9, 0x1) ioctl$SOUND_PCM_READ_CHANNELS(r1, 0x80045006, &(0x7f0000000000)) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0xeed7e89f6334d838}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000200)=[@acquire], 0x0, 0x0, 0x0}) 55.586807868s ago: executing program 1 (id=829): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = mq_open(&(0x7f0000000100)='&\x00', 0x40, 0x100, 0x0) mq_notify(r1, &(0x7f0000000380)={0x110c230000, 0x3, 0x2, @tid=0xffffffffffffffff}) mq_notify(r1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc040, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000456000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x28, 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000480)={0x5, 0x0, [{0x9aa, 0x0, 0xd38}, {0x2e6, 0x0, 0x9}, {0x987, 0x0, 0x4da}, {0x999, 0x0, 0x1}, {0xc0010117, 0x0, 0x3}]}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) r4 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x4) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0xffffffffffffffff) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000500)={0x5, 0x0, [{0xfa, 0x0, 0x5}, {0xb46}, {0x9cf, 0x0, 0x8}, {0x12f, 0x0, 0x1}, {0xa05, 0x0, 0x4fdb}]}) sendfile(r3, r2, 0x0, 0x20000023892) socket$inet6_udp(0xa, 0x2, 0x0) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x2049c0, 0x0) pipe2$watch_queue(&(0x7f0000000240), 0x80) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f0000000180)="6916db0920cb36c67ea58a8bd21d3d72eb26a35125e573a32be3ee955bcf12b10aa5b07b67b043cd9217571b5ca2e1fe2181d23325c4019ab2ab4e8ef8bf0dff4eb3f4b828f7cb56abab42bf0491b0a2e61faa75a5411556e2f6f2340971a0f182f00000000000000000", 0x6a, 0xfffffffffffffffd) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r0, 0x400000000000007c) r8 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000005c0)={'syz', 0x1}, &(0x7f0000000f80)='G', 0x1, 0xfffffffffffffffb) keyctl$KEYCTL_WATCH_KEY(0x20, r8, 0xffffffffffffffff, 0x47) close_range(r7, 0xffffffffffffffff, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r9) r10 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) ioctl$SYNC_IOC_MERGE(r0, 0xc0303e03, &(0x7f0000000080)={"69a2a06fd8b5697578057b32ed23217f30dcc8863536822e6b478858ca85f6d6", r0, 0xffffffffffffffff}) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r11, 0x8008f513, &(0x7f0000000300)) syz_usb_ep_read(r10, 0x82, 0x0, &(0x7f0000000180)) 53.89869777s ago: executing program 1 (id=835): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x5c}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x818d4, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl$USBDEVFS_GET_SPEED(r1, 0x551f) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x40003) socket$nl_route(0x10, 0x3, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_ublk_setup_io_uring(0x222cd, &(0x7f00000003c0)={0x0, 0xd40d, 0x0, 0x40002, 0x1de}, 0x0, &(0x7f0000000040), &(0x7f0000000340)) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000640)=[{{&(0x7f0000000240)=@file={0x0, './file1/file0\x00'}, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000440)="fa40a4ea1ea45cc557d1a61b2db5a7bcbd768c7fc435cf2d8779122b3d1e7a6f2a24812ad07b13ae33c25a59424b79ff6aa9a7373db3db77c3e452e3aa9c8c10103bd7317d12beeeb9cd7b45f72ffa5637caa12a3e83b0be598835ba1d9015b28fcfcaf5c6c244d40e1b015df6089ab404ff205577ca0165d8c9260e644470ae103e68fcb158b339d1e50fc8f302cede23a4789784f48ddc06844030f5dd86cbbbff3d4139d3a66261e30944d0b59fc685377df1db0c56f597b788f5d9bdf511cf51f98d75735ba6a72144cb3d16b1e95c305c0ca8ee51c09f", 0xd9}, {&(0x7f0000000540)="88580190229d984a8139c56c093241e83a10bab5a1b1fa07c0e4a0fe90d7", 0x1e}, {&(0x7f0000000580)="7d95eb72c37c3c08efd0e755f721f81d4e25fca798820841613ca1e7cfb748e72253d326786f103adb72406c1335b0312b0ce39e08d37f3963ca552cc09313fe1fc7725e0872b456c4636123a0ece3245e26fc1288", 0x55}], 0x3, 0x0, 0x0, 0x40000}}], 0x1, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r6, 0x110, 0x3) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x6, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/pm_trace', 0x2, 0x6) 51.351460372s ago: executing program 1 (id=841): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = gettid() r1 = getpgrp(r0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/sched/sched_switch/trigger\x00', 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = getpgid(r0) sched_getattr(r3, &(0x7f00000000c0)={0x38}, 0x38, 0x0) socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x100000e, 0x401d031, r2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x101001, 0x0) r4 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x1b5cb000) ptrace$ARCH_GET_UNTAG_MASK(0x1e, r4, &(0x7f0000000100), 0x4001) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019340)=""/102385, 0x18ff1) socketpair$unix(0x1, 0x5, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) 50.883395285s ago: executing program 1 (id=842): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x1e, &(0x7f0000000b80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}, {}, {}, [@call={0x85, 0x0, 0x0, 0xbe}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @tail_call], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x8000002, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = syz_io_uring_complete(0x0, 0x0) ioctl$COMEDI_CANCEL(r1, 0x6407) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x80002, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x34, 0x0, 0x3, 0x70bd2c, 0xe, {}, [@GTPA_LINK={0x8, 0x1, r3}, @GTPA_VERSION={0x8}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x11}}, @GTPA_FAMILY={0x5, 0xd, 0x2b}]}, 0x34}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)=@newlink={0x48, 0x10, 0x401, 0x70bd29, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCI={0xc, 0x1, 0xffffffffffffffff}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x48}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000500)={'ip6_vti0\x00', &(0x7f00000003c0)={'syztnl2\x00', 0x0, 0x29, 0x40, 0xe3, 0x9, 0x4, @private1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x10, 0x1, 0x2, 0x2}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f00000005c0)={'ip6_vti0\x00', &(0x7f0000000540)={'ip6gre0\x00', 0x0, 0x29, 0x42, 0x6, 0xdfc, 0x4, @mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x7800, 0x80, 0x2, 0x80000001}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000680)={'syztnl1\x00', &(0x7f0000000600)={'ip6tnl0\x00', 0x0, 0x29, 0xc, 0xf6, 0x8, 0x78, @loopback, @local, 0x7, 0x8, 0x6dde, 0xee}}) getsockopt$inet6_mreq(r1, 0x29, 0xfef39a494c2d81e3, &(0x7f00000006c0)={@rand_addr, 0x0}, &(0x7f0000000700)=0x14) sendmsg$ETHTOOL_MSG_COALESCE_GET(r2, &(0x7f0000000940)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000980)={0x158, 0x0, 0x100, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6tnl0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x4}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x20000000}, 0xc0000) sendfile(r2, r2, 0x0, 0x2000009) openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ac000000210001000000000000000000fe8000"/64, @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000005000110000000000000000000000000000000000fc02000000000000000000000000000020010000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000a001000fe"], 0xac}}, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_KEY(r10, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r11, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r12}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004030}, 0x8025) ioctl$SNDCTL_FM_LOAD_INSTR(r1, 0x40285107) r13 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r13, &(0x7f0000019680)=""/102392, 0x18ff8) 35.652153506s ago: executing program 34 (id=842): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x1e, &(0x7f0000000b80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}, {}, {}, [@call={0x85, 0x0, 0x0, 0xbe}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @tail_call], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x8000002, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = syz_io_uring_complete(0x0, 0x0) ioctl$COMEDI_CANCEL(r1, 0x6407) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x80002, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x34, 0x0, 0x3, 0x70bd2c, 0xe, {}, [@GTPA_LINK={0x8, 0x1, r3}, @GTPA_VERSION={0x8}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x11}}, @GTPA_FAMILY={0x5, 0xd, 0x2b}]}, 0x34}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)=@newlink={0x48, 0x10, 0x401, 0x70bd29, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCI={0xc, 0x1, 0xffffffffffffffff}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x48}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000500)={'ip6_vti0\x00', &(0x7f00000003c0)={'syztnl2\x00', 0x0, 0x29, 0x40, 0xe3, 0x9, 0x4, @private1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x10, 0x1, 0x2, 0x2}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f00000005c0)={'ip6_vti0\x00', &(0x7f0000000540)={'ip6gre0\x00', 0x0, 0x29, 0x42, 0x6, 0xdfc, 0x4, @mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x7800, 0x80, 0x2, 0x80000001}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000680)={'syztnl1\x00', &(0x7f0000000600)={'ip6tnl0\x00', 0x0, 0x29, 0xc, 0xf6, 0x8, 0x78, @loopback, @local, 0x7, 0x8, 0x6dde, 0xee}}) getsockopt$inet6_mreq(r1, 0x29, 0xfef39a494c2d81e3, &(0x7f00000006c0)={@rand_addr, 0x0}, &(0x7f0000000700)=0x14) sendmsg$ETHTOOL_MSG_COALESCE_GET(r2, &(0x7f0000000940)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000980)={0x158, 0x0, 0x100, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6tnl0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x4}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x20000000}, 0xc0000) sendfile(r2, r2, 0x0, 0x2000009) openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ac000000210001000000000000000000fe8000"/64, @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000005000110000000000000000000000000000000000fc02000000000000000000000000000020010000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000a001000fe"], 0xac}}, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_KEY(r10, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r11, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r12}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004030}, 0x8025) ioctl$SNDCTL_FM_LOAD_INSTR(r1, 0x40285107) r13 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r13, &(0x7f0000019680)=""/102392, 0x18ff8) 32.815502323s ago: executing program 4 (id=885): r0 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r2, 0x0}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setresuid(0xee00, 0xee00, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000780)={r3, 0x0, 0x4, 0x0, 0x2, [], [0x0, 0x0, 0x400, 0x10000], [0x0, 0x0, 0xfffffffc], [0x1, 0x0, 0x7]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, 0x0) 32.672827351s ago: executing program 4 (id=887): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x10006, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) r2 = dup(r0) sendmmsg$inet(r1, &(0x7f0000004b80)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000180)="93", 0x1}], 0x1}}], 0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='bond_slave_1\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000a40)={0x0, @in6={{0xa, 0x4e24, 0x5, @loopback, 0x5}}, 0x4, 0x1, 0xf06, 0x0, 0xac, 0x7d, 0x5}, 0x9c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty, 0x3}}, 0x1000000, 0x31, 0xffff1896, 0x3, 0x6, 0x8, 0x1b}, 0x9c) 32.412817578s ago: executing program 4 (id=888): r0 = syz_usb_connect$hid(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0022190000000501150025ff090491"], 0x0}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r1) socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000400)={0x2, 0x100}) 29.774389242s ago: executing program 4 (id=897): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c00090502020002020000090582020002"], 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f00000001c0)={0x0, 0x12, 0x1, "84"}, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000200)={@loopback={0x300}, @dev={0xfe, 0x80, '\x00', 0x3f}, @ipv4={'\x00', '\xff\xff', @loopback}, 0x10000006, 0x0, 0x4, 0x100, 0x4000000010000009, 0x10200}) sendto$inet6(r1, &(0x7f0000000400)="2ae0e710", 0x4, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x3c, &(0x7f0000000040)=0x6, 0x4) recvmmsg(r1, &(0x7f0000000d80), 0x4000000000001e9, 0x10162, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000000340)={0x0, 0x30, 0x1, 'D'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) pipe2(&(0x7f0000000000), 0x84080) syz_usb_control_io$uac3(r0, 0x0, 0x0) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write(r2, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f0000000180)={0xc, &(0x7f0000000080)={0x0, 0x24, 0xa1, {0xa1, 0x21, "2b42f359fc814d67ab5ece2de4869bc196c76b236fb5f560965e415b52bf943166665e75975f8d21965b6f2ec2ec5ae8eef49fcb3101a5c67010db6cc32d6cafcbcee9e91d3005f5ef67c7e02b53f7161aab86573b50c45bfb7c1dde42b59e56a9d21f6c3e8b5cefd2087e67cc3164a1894846fb2e129ae97365b3341d15da6413c7b50c9468680aed6327e3e2e1523be10a9bd5966ae1c5f5eeb447509d7a"}}, &(0x7f0000000140)={0x0, 0x3, 0x39, @string={0x39, 0x3, "2062cd3df81e6e6503f89c29d995ac89b598017cc9217eef272554e9ff686533959d1ffe3b81f67d751604da5c2a1b377689b0750b67f7"}}}, &(0x7f00000005c0)={0x1c, &(0x7f0000000280)={0x10, 0x13, 0xab, "c14ef2be43220ec876055a69596fb2ba017725eebb535aabac86af64ff92171ba58bf09092f412bb1bb6ac41d284c9f9c50b166108bc7d6f2e3368303e031bd7364694ffcc6e41b1b7fd904a25c874e6d3c1a5e021ef699dc8d0f502450d876683577574c94ce484bf35474307820453f1b865e71832f45345959813a810ac804f2f1bffbd9d3c17f6ff742f655fa8e5b90c91644264e2c9f66a235e50fb49ce44a8feb82b1664e06bd68f"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000440)={0xc0, 0xa1, 0x4, 0x7fffffff}, &(0x7f0000000480)={0x40, 0xa0, 0x4}, &(0x7f00000004c0)={0xc0, 0xa2, 0x2f, "73b7636454f594801aa9478b8f535d7f3a6741428a8ac1cdc8f2bfddaea10246e851f71486fe285fc2883c0707048a"}}) syz_usb_control_io$printer(r0, 0x0, 0x0) 27.288784096s ago: executing program 4 (id=901): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x18, &(0x7f0000000200)={0x5, 0xffffffffffffffff, 0x30, {0xa, 0x8000000000000003}, 0xb}, 0x1) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x44, 0x0, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xbf}], @NL80211_ATTR_HIDDEN_SSID={0x8}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x5}, @NL80211_ATTR_HE_BSS_COLOR={0x10, 0x11b, 0x0, 0x1, [@NL80211_HE_BSS_COLOR_ATTR_PARTIAL={0x4}, @NL80211_HE_BSS_COLOR_ATTR_COLOR={0x5, 0x1, 0x9}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40800}, 0x20000881) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) 24.595001722s ago: executing program 4 (id=903): r0 = socket$l2tp(0x2, 0x2, 0x73) prctl$PR_SET_IO_FLUSHER(0x39, 0x1000000) bind$inet(r0, 0x0, 0x0) r1 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) syz_usb_connect(0xb, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000097ff8208582005109bc10000000109021200010000000009048f0000bf575a00b7cac6c59f827fbda30ad8a745e653846cc64cc3122e92a8eda8809552da0683ba094f3dba3eb63dd45b3392cd9a6340f6cea82390e6a3b46af5a50dc0a471ceffb2d170b075cb4240b119ef70991c2d5ee6bbedfa3f665bab33da9d8a558416586aa4f9984903774e41ae6faa2b04ce7c3bd6497330aa858c4339c1859b2c56c298d36e62936b8d58641ee7e8eacc88179d32e2f7050ea20e94726bc73249e373"], 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xf, 0x204031, 0xffffffffffffffff, 0x2d5c000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f00001a9000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000160000/0x2000)=nil, &(0x7f00000f2000/0x4000)=nil, &(0x7f0000afd000/0x1000)=nil, &(0x7f00006b6000/0x1000)=nil, &(0x7f00001dd000/0x4000)=nil, &(0x7f000004e000/0x1000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f00000c4000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x2) io_uring_setup(0x1b7c, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x39d}) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000000)={0x0, 0x1, 'hub\x00'}) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)={0x18, r4, 0x4c1dad3e3d6a7499, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x24000884}, 0x2400c000) ioctl$USBDEVFS_FORBID_SUSPEND(r2, 0x5521) close(r2) socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x3, 0x0, 0x5}, 0x0, 0x0) mq_timedsend(r1, 0x0, 0x0, 0x7, 0x0) close(r0) 12.447320918s ago: executing program 2 (id=927): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa07, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) 11.689468663s ago: executing program 2 (id=929): r0 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x31, 0x2, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x7, 0x0, 0x1000004, 0x1, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1eb, 0x200009ea, 0x20000010, 0x55, 0x8, 0x4008, 0x746f, 0x7, 0x6, 0x4, 0xee, 0x4, 0x7ffd]}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x1c0, 0x5e, 0x113, 0x0, 0x0, {}, [@nested={0x1ac, 0x2, 0x0, 0x1, [@typed={0x8, 0x0, 0x0, 0x0, @uid}, @typed={0x14, 0x9, 0x0, 0x0, @ipv6=@empty}, @nested={0x18c, 0x26, 0x0, 0x1, [@generic, @nested={0x10, 0x10b, 0x0, 0x1, [@typed={0x8, 0xa, 0x0, 0x0, @fd=r0}, @nested={0x4, 0x47}]}, @typed={0x14, 0x3b, 0x0, 0x0, @ipv6=@mcast1}, @generic="9b5e44549a37c60e1aad2b2e7464b738d373b1b91413988a6c0160a3bf94def13c3b3a356fc98307e2c03140d3b6f2ee1c2a7ef3fea3d679cd7269609798b219e5b6145338ba30a0954ba73882d3b77776233d3ab4308f", @generic="53ab2157c3812682792c8b77973bb0be3edb3c7a02eeaf52c2c37fb42941183203dba1e25c34c77acc0b2b43093480aa7bad897e2159a744ecb0c9de92380056d29ad385fa1fd2af62ab41d402592ac5a20fc459c1a5c7990e5bd0e5a7a294c3ec2cd18b90c607c7ea6b4f68b664c5d2962fa8", @generic="e82bacf8b38da2e127d6f9fefbf14af6f5ad2a9f25f5c26ef2bf712ac8061b43b2f7352aa4b22e66a520c012a0f5b4aaefb7904bb558871a7db8547bd03bb8a1932be960df9297ecaff2dd33f677f540150734c4a11bfe5e0a5411723c68f83f6fd14c7a67076a2a133401bcc6d392c1363ddadd334b97387d37d0cbb292e8f2e8897325d94ff545b1", @typed={0x8, 0x135, 0x0, 0x0, @u32=0x1ff}, @generic="66922e08eaac460df2"]}]}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x20044819}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r4 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r5 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r4) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000040)={r5, 0x5}, &(0x7f0000000180)={'enc=', 'pkcs1', ' hash=', {'sha256\x00'}}, &(0x7f0000000280)="50241d7ab0", &(0x7f0000000340)) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="3c00000010000100ffffffff0000000200000000", @ANYRES32=0x0, @ANYBLOB="60a00200000000001400030076657468305f766c616e00000000000008000a00", @ANYRES32=r3], 0x3c}}, 0x8000) 11.270931412s ago: executing program 2 (id=930): waitid(0x1, 0x0, 0x0, 0x4, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000005700), 0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x64, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200"/15], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070, 0x0, '\x00', 0x0, 0x25, r0}, 0x94) close(0x3) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000000480)={0x2020}, 0x2020) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x4c) r4 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r4, 0xc00c9207, &(0x7f0000000080)={&(0x7f0000000040)=[0x0], 0x1, 0x7fff}) readv(r4, &(0x7f0000000040), 0x2000000000000213) syz_open_dev$usbfs(&(0x7f0000000240), 0x10, 0x80100) 9.059540747s ago: executing program 35 (id=903): r0 = socket$l2tp(0x2, 0x2, 0x73) prctl$PR_SET_IO_FLUSHER(0x39, 0x1000000) bind$inet(r0, 0x0, 0x0) r1 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) syz_usb_connect(0xb, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000097ff8208582005109bc10000000109021200010000000009048f0000bf575a00b7cac6c59f827fbda30ad8a745e653846cc64cc3122e92a8eda8809552da0683ba094f3dba3eb63dd45b3392cd9a6340f6cea82390e6a3b46af5a50dc0a471ceffb2d170b075cb4240b119ef70991c2d5ee6bbedfa3f665bab33da9d8a558416586aa4f9984903774e41ae6faa2b04ce7c3bd6497330aa858c4339c1859b2c56c298d36e62936b8d58641ee7e8eacc88179d32e2f7050ea20e94726bc73249e373"], 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xf, 0x204031, 0xffffffffffffffff, 0x2d5c000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f00001a9000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000160000/0x2000)=nil, &(0x7f00000f2000/0x4000)=nil, &(0x7f0000afd000/0x1000)=nil, &(0x7f00006b6000/0x1000)=nil, &(0x7f00001dd000/0x4000)=nil, &(0x7f000004e000/0x1000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f00000c4000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x2) io_uring_setup(0x1b7c, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x39d}) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000000)={0x0, 0x1, 'hub\x00'}) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)={0x18, r4, 0x4c1dad3e3d6a7499, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x24000884}, 0x2400c000) ioctl$USBDEVFS_FORBID_SUSPEND(r2, 0x5521) close(r2) socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x3, 0x0, 0x5}, 0x0, 0x0) mq_timedsend(r1, 0x0, 0x0, 0x7, 0x0) close(r0) 8.338905829s ago: executing program 2 (id=933): r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x2730, 0x800, 0x1, 0x82}, &(0x7f0000000180)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000240)=0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x34000, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x30, 0x0}) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r0}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r4 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) openat$vga_arbiter(0xffffff9c, &(0x7f0000000100), 0x10000, 0x0) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x400, 0x2) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003580)={0x14, 0x2f, 0x107, 0x870bd2e, 0x25dfdbfb, {0x2, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0x7, 0x2) r7 = fsopen(&(0x7f0000000180)='ceph\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000880)='test_dummy_encryption', &(0x7f0000000080)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_80211_inject_frame(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x305) 5.233173906s ago: executing program 6 (id=935): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0x48, 0x30, 0xffff, 0x70bd27, 0x25dfdbfc, {}, [{0x34, 0x1, [@m_police={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000020)=@filename='none\x00', &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/max_speed\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='high-speed\x00', 0xa) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/Loopback.0\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/Loopback.0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/Loopback.0\x00') 4.953780093s ago: executing program 6 (id=937): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x8, 0x1) mbind(&(0x7f00005b4000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x1) 4.691514019s ago: executing program 6 (id=938): socket$inet_sctp(0x2, 0x5, 0x84) r0 = socket(0x2, 0x80805, 0x0) recvmsg$kcm(r0, &(0x7f0000002840)={&(0x7f0000000200)=@pppol2tp, 0x80, &(0x7f0000002700)=[{&(0x7f0000000280)=""/60, 0x3c}, {&(0x7f00000002c0)=""/115, 0x73}, {&(0x7f0000000440)=""/4096, 0x1000}, {0x0}, {&(0x7f0000001700)=""/4096, 0x1000}], 0x5, &(0x7f0000002740)=""/243, 0xf3}, 0x3dfdbfbdd7a869e0) r1 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) statx(0xffffffffffffffff, 0x0, 0x1000, 0xf0cb2f4a0c2cfc5d, 0x0) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f0000000080)={'dt2801\x00', [0x3c8, 0x1013, 0x2, 0x8, 0x1, 0x9, 0x3, 0xa, 0xefd, 0x7ffe, 0x9, 0xfffff60c, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x6, 0x34d, 0x1, 0x3ff, 0x9, 0x200, 0x860, 0xaa14, 0x1, 0x4, 0xfffffffe, 0x15, 0xf58, 0x9]}) 3.971299406s ago: executing program 6 (id=941): r0 = socket$unix(0x1, 0x2, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000200), 0x10) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r2) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2b, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r3, 0xffffffffffffffff, 0x0) sendmsg$sock(r1, &(0x7f0000001940)={&(0x7f00000002c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x2, 0x3, 0x2, 0x2, {0xa, 0x4e20, 0x1, @empty, 0xffffffde}}}, 0x80}, 0x0) 3.89470901s ago: executing program 2 (id=943): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x90, 0x0, 0x1, 0x405, 0x0, 0x0, {0x2}, [@generic="3400018014000180080001007f000001080002007f0000011c00028005000100110000000600020006b700000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b700000600030006b700000c00058008000100524153000800070000"]}, 0x90}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0xffffffff, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40844}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$unix(r3, &(0x7f00000059c0)={&(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, &(0x7f0000005940)=[@rights={{0x14, 0x1, 0x1, [r2, r2]}}, @cred={{0x18, 0x1, 0x2, {r1}}}, @cred={{0x18, 0x1, 0x2, {r1, 0xee00}}}], 0x44, 0x4000010}, 0x4840) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x3}, 0x50) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) unlink(&(0x7f00000002c0)='./file0\x00') link(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000000)='./file0\x00') r5 = openat(0xffffffffffffff9c, 0x0, 0x20846, 0x2d) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x6, 0x30, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xd}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@ldst={0x2, 0x1, 0x3, 0x9, 0x9, 0xffffffffffffffe0}, @printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x9}}, @cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xa}, @map_idx={0x18, 0xa, 0x5, 0x0, 0x2}, @alu={0x4, 0x1, 0xc, 0x6, 0xb, 0xfffffffffffffff8, 0x1}, @map_idx={0x18, 0x3, 0x5, 0x0, 0xf}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x1}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000004c0)='syzkaller\x00', 0xcd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r6, 0x29, 0x30, &(0x7f0000000680)=ANY=[@ANYBLOB="3bd900000a00462000000407ff0200000000000000000000000000017f00"/102], 0x8c) 2.367972483s ago: executing program 5 (id=944): socket$unix(0x1, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/netlink\x00') openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xaca82, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x612d, 0x0, 0x3, 0xbd}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x102100, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0xaf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x20, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x24c}}], 0x1, &(0x7f0000000340)={0x2e, 0x4c, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 1.968204649s ago: executing program 5 (id=945): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0x48, 0x30, 0xffff, 0x70bd27, 0x25dfdbfc, {}, [{0x34, 0x1, [@m_police={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000020)=@filename='none\x00', &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/max_speed\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='high-speed\x00', 0xa) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/Loopback.0\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/Loopback.0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/Loopback.0\x00') 1.673251657s ago: executing program 7 (id=874): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r2) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0x70}}, 0x20008084) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r3, 0x125, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x24}}, 0x0) 1.656302253s ago: executing program 5 (id=946): syz_emit_vhci(&(0x7f00000003c0)=ANY=[@ANYBLOB="02"], 0x3) 1.480852303s ago: executing program 5 (id=947): syz_emit_vhci(&(0x7f0000001300)=ANY=[@ANYBLOB], 0xd) getsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, 0x0) 1.339238008s ago: executing program 7 (id=948): socket$inet_smc(0x2b, 0x1, 0x0) mkdir(&(0x7f0000000000)='./dev\x00', 0x1fe) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/console\x00', 0x1, 0x0) write$eventfd(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r5) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) socket(0x2b, 0x1, 0x1) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000480), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x38, r8, 0x701, 0x10, 0xfffffffe, {0x2e}, [{{@pci={{0x8}, {0xfffffffffffffe83}}, {0x8, 0x3, 0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc008}, 0x4008010) r10 = dup(r7) syz_ublk_setup_queues(r10, r6, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) 1.302567669s ago: executing program 6 (id=949): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r3, 0x0) poll(&(0x7f0000000000)=[{0xffffffffffffffff, 0xd010}], 0x1, 0x9) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000002800)={0x2, 0x0, [{0xe000, 0xe4, &(0x7f0000000680)=""/228}, {0x4, 0x0, 0x0}]}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_PUBL_GET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="18000000", @ANYRES16], 0x18}}, 0x0) read$FUSE(r5, &(0x7f00000011c0)={0x2020}, 0x2020) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000200)=ANY=[@ANYRESOCT, @ANYRESHEX, @ANYRES64=0x0, @ANYRES64=r4, @ANYRESHEX=r5], 0x57) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r6, &(0x7f0000000080)=ANY=[], 0xbfb3) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000340)=0x4) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x7, 0x0, 0x0) write$uinput_user_dev(r0, &(0x7f0000000540)={'syz1\x00', {0x6, 0x7fff, 0xb25, 0xb}, 0x6, [0x9, 0x8, 0x5, 0x6, 0x6, 0x3, 0xafc, 0x32, 0x838, 0x9, 0x6ff5, 0x9f5, 0x5, 0x1000000, 0x0, 0x6, 0x8001, 0x6, 0x4a4c, 0x3, 0xfffffffd, 0x9, 0x10, 0x8001, 0x5, 0x4, 0xd4a, 0xffefe87a, 0x1, 0x8, 0x9, 0x9, 0x101, 0x9, 0x0, 0xe, 0xf9c6, 0x3ff, 0x3ff, 0x4, 0xd, 0xff, 0x8, 0x9, 0x80000001, 0x83f5, 0x0, 0x2, 0xfe0, 0x7ff, 0x8, 0x3, 0x4, 0x2, 0xa45, 0x1df, 0xffff, 0x0, 0x2, 0x9, 0x4, 0x901, 0x200, 0x9a0], [0x3, 0x8, 0x6, 0xd, 0x1, 0xad10, 0x6, 0x13a0, 0x86, 0x7fff, 0x101, 0x8, 0x5, 0x1, 0x2, 0xffff, 0x4, 0x4a, 0xf, 0xfffff326, 0xfffffff7, 0x63ae, 0x400, 0x8007f, 0x10000, 0x7, 0x4, 0x8, 0x30, 0x9, 0x1, 0x3, 0x4c6fbc51, 0x10001, 0xd35, 0xa, 0x63, 0xfffffffc, 0x1, 0x200, 0x20, 0x9, 0x0, 0x3ec8d8d2, 0x0, 0x3, 0x3, 0x2, 0x8, 0x6, 0xe51, 0x1, 0x7, 0x8, 0x3, 0x2, 0x0, 0x62, 0x7, 0x6, 0x4, 0x6, 0xfff, 0x4], [0x1, 0x9, 0x6, 0x10000, 0x6, 0x8, 0xfffffff7, 0xfd, 0x20, 0x8, 0x9, 0x4, 0x283, 0x2, 0x4d, 0x2006, 0x4, 0x3ff, 0x10000, 0x5, 0x40, 0x4, 0x8, 0x0, 0x4, 0x2, 0x80008001, 0x9, 0x1, 0xffff, 0x5, 0x7, 0x1, 0xec000000, 0x4, 0xfff, 0x3, 0x0, 0x5, 0x80000001, 0x53c2, 0x4, 0x4, 0x3, 0x80, 0x50, 0x3, 0xc, 0x8, 0x5, 0x4, 0x400, 0x3, 0x5, 0x86, 0x6, 0x400000, 0xb, 0x4, 0x0, 0x420, 0xfe6c, 0x2, 0x9], [0x3, 0x9, 0xffffffff, 0x2, 0x66, 0xffff, 0x401, 0x6, 0x8, 0x3, 0x102, 0x4, 0x3, 0x7, 0xce, 0x2, 0x8001, 0x2, 0x7, 0x6, 0x601000, 0x9, 0x5, 0xd, 0x1, 0x446, 0x800, 0x3, 0x0, 0x3, 0x2, 0x375, 0xfffffff1, 0x7, 0x5, 0x4, 0x7fff, 0x4, 0x3a2, 0x3, 0x2008, 0xe, 0xee6, 0x800, 0x7, 0x3, 0x1, 0x7, 0x3, 0x9, 0xc, 0x3, 0x1, 0x1, 0x3, 0x296, 0x6, 0xb, 0xf, 0x4, 0x6, 0x7, 0xd, 0x400]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r7, 0x0, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6, 0x101}, 0xfffffffd, [0x8, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x3, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x2, 0x0, 0x0, 0x80, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x3, 0x0, 0x8, 0x0, 0x0, 0x4, 0x0, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x3, 0xff, 0x0, 0xffff1e04, 0x3], [0xfffffffd, 0x3, 0x6, 0x6, 0x0, 0x2, 0x3, 0xff, 0x2, 0x6, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x4, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e2b, 0x0, 0xfffffffa, 0x5, 0x7aae62b1, 0x100000, 0x2, 0x40002, 0xffffffff, 0x1c, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x7ff, 0x4, 0xfd5], [0x0, 0xfffffffc, 0x0, 0x75, 0x0, 0x0, 0xb78b, 0xfa, 0x0, 0x0, 0x3, 0x3, 0x4, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffe, 0x3, 0x8000000, 0x4, 0x0, 0x0, 0x99, 0xfffffffd, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x835, 0x1, 0xfffffffd, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4bdf, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0xffffffff, 0x0, 0x2000, 0x40, 0x0, 0xfffffffe, 0x7fffffff, 0x0, 0xfffff9bf, 0x0, 0x2008000, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0xfffffffc, 0xfffffffe, 0x0, 0x5, 0xc, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x2, 0x0, 0x0, 0x10000, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) 1.261103522s ago: executing program 5 (id=950): r0 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x31, 0x2, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x7, 0x0, 0x1000004, 0x1, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1eb, 0x200009ea, 0x20000010, 0x55, 0x8, 0x4008, 0x746f, 0x7, 0x6, 0x4, 0xee, 0x4, 0x7ffd]}) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x1c0, 0x5e, 0x113, 0x0, 0x0, {}, [@nested={0x1ac, 0x2, 0x0, 0x1, [@typed={0x8, 0x0, 0x0, 0x0, @uid}, @typed={0x14, 0x9, 0x0, 0x0, @ipv6=@empty}, @nested={0x18c, 0x26, 0x0, 0x1, [@generic, @nested={0x10, 0x10b, 0x0, 0x1, [@typed={0x8, 0xa, 0x0, 0x0, @fd=r0}, @nested={0x4, 0x47}]}, @typed={0x14, 0x3b, 0x0, 0x0, @ipv6=@mcast1}, @generic="9b5e44549a37c60e1aad2b2e7464b738d373b1b91413988a6c0160a3bf94def13c3b3a356fc98307e2c03140d3b6f2ee1c2a7ef3fea3d679cd7269609798b219e5b6145338ba30a0954ba73882d3b77776233d3ab4308f", @generic="53ab2157c3812682792c8b77973bb0be3edb3c7a02eeaf52c2c37fb42941183203dba1e25c34c77acc0b2b43093480aa7bad897e2159a744ecb0c9de92380056d29ad385fa1fd2af62ab41d402592ac5a20fc459c1a5c7990e5bd0e5a7a294c3ec2cd18b90c607c7ea6b4f68b664c5d2962fa8", @generic="e82bacf8b38da2e127d6f9fefbf14af6f5ad2a9f25f5c26ef2bf712ac8061b43b2f7352aa4b22e66a520c012a0f5b4aaefb7904bb558871a7db8547bd03bb8a1932be960df9297ecaff2dd33f677f540150734c4a11bfe5e0a5411723c68f83f6fd14c7a67076a2a133401bcc6d392c1363ddadd334b97387d37d0cbb292e8f2e8897325d94ff545b1", @typed={0x8, 0x135, 0x0, 0x0, @u32=0x1ff}, @generic="66922e08eaac460df2"]}]}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x20044819}, 0x0) 874.240177ms ago: executing program 5 (id=951): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, 0x0, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004091) sendmsg$xdp(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000300)="b18e9804d2", 0x5}], 0x1, 0x0, 0x0, 0x404}, 0x0) sendmsg$kcm(r0, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x2400c094) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30068016) 231.101538ms ago: executing program 7 (id=952): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000040)='memory.pressure\x00', 0x2, 0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@RTM_NEWMDB={0x38, 0x55, 0x2e5, 0x270bd26, 0xfffffffe, {0x7, r5}, [@MDBA_SET_ENTRY={0x20, 0x1, {r5, 0x0, 0x0, 0x0, {@ip4=@empty}}}]}, 0x38}, 0x1, 0x2000000, 0x0, 0x2000c044}, 0x20000114) openat$cgroup_root(0xffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r6 = syz_open_dev$evdev(&(0x7f0000000100), 0x593c, 0x201081) ioctl$EVIOCGABS2F(r6, 0x8018456f, &(0x7f0000000280)=""/171) write$cgroup_pressure(r3, &(0x7f0000000240)={'some', 0x20, 0x9, 0x20, 0xd}, 0x2f) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x700, 0x0, 0x1c, 0x11, 0x1a001000000}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x20010, r2, 0xdb964000) close_range(r3, r3, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl(r7, 0x4048aecb, &(0x7f0000000100)) 104.59869ms ago: executing program 6 (id=953): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) 0s ago: executing program 2 (id=954): syz_usb_connect(0x6, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f"], 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x8000000004) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) getpid() mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION2(r2, 0x40a0ae49, &(0x7f0000000180)={0x4, 0x4, 0x6000, 0xa7000, &(0x7f0000ffc000/0x2000)=nil, 0x0, r3}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040080000000001300020000000900010073797a300000000058000000120a01040000000000000000020000000900010073797a30000000000900020073797a30000000000800030000000004240004800c00010000000000000000010c00020000002db287ef0001080004000000"], 0xbc}, 0x1, 0x0, 0x0, 0x44000055}, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) close(r3) kernel console output (not intermixed with test programs): =system_u:object_r:device_t tclass=filesystem permissive=1 [ 414.455266][ T8356] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 414.468383][ T8356] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 415.389482][ T8356] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 416.462487][ T8356] 8021q: adding VLAN 0 to HW filter on device bond0 [ 416.483963][ T8487] FAULT_INJECTION: forcing a failure. [ 416.483963][ T8487] name failslab, interval 1, probability 0, space 0, times 0 [ 416.484013][ T8487] CPU: 0 UID: 0 PID: 8487 Comm: syz.2.684 Not tainted syzkaller #0 PREEMPT(full) [ 416.484032][ T8487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 416.484041][ T8487] Call Trace: [ 416.484046][ T8487] [ 416.484052][ T8487] dump_stack_lvl+0x100/0x190 [ 416.484079][ T8487] should_fail_ex.cold+0x5/0xa [ 416.484103][ T8487] should_failslab+0xc2/0x120 [ 416.484124][ T8487] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 416.484142][ T8487] ? __alloc_skb+0x5b7/0x710 [ 416.484159][ T8487] ? __alloc_skb+0x140/0x710 [ 416.484178][ T8487] __alloc_skb+0x140/0x710 [ 416.484192][ T8487] ? __alloc_skb+0x5b7/0x710 [ 416.484206][ T8487] ? __pfx___alloc_skb+0x10/0x10 [ 416.484228][ T8487] netlink_alloc_large_skb+0x69/0x150 [ 416.484255][ T8487] netlink_sendmsg+0x680/0xda0 [ 416.484281][ T8487] ? __pfx_netlink_sendmsg+0x10/0x10 [ 416.484299][ T8487] ? selinux_socket_sendmsg+0x198/0x2f0 [ 416.484327][ T8487] ____sys_sendmsg+0xa4d/0xbe0 [ 416.484347][ T8487] ? __pfx_netlink_sendmsg+0x10/0x10 [ 416.484364][ T8487] ? __pfx_____sys_sendmsg+0x10/0x10 [ 416.484389][ T8487] ? lock_acquire+0x1d1/0x380 [ 416.484406][ T8487] ? get_pid_task+0x2a/0x250 [ 416.484429][ T8487] ___sys_sendmsg+0x190/0x1e0 [ 416.484452][ T8487] ? __pfx____sys_sendmsg+0x10/0x10 [ 416.484473][ T8487] ? get_pid_task+0x106/0x250 [ 416.484501][ T8487] ? find_held_lock+0x2b/0x80 [ 416.484536][ T8487] __sys_sendmsg+0x160/0x210 [ 416.484553][ T8487] ? __pfx___sys_sendmsg+0x10/0x10 [ 416.484581][ T8487] do_syscall_64+0x123/0x790 [ 416.484605][ T8487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.484621][ T8487] RIP: 0033:0x7fac3cd9e159 [ 416.484635][ T8487] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 416.484650][ T8487] RSP: 002b:00007fac3dbdf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 416.484666][ T8487] RAX: ffffffffffffffda RBX: 00007fac3d025fa0 RCX: 00007fac3cd9e159 [ 416.484676][ T8487] RDX: 0000000004040140 RSI: 00002000000000c0 RDI: 0000000000000003 [ 416.484686][ T8487] RBP: 00007fac3dbdf090 R08: 0000000000000000 R09: 0000000000000000 [ 416.484695][ T8487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 416.484705][ T8487] R13: 00007fac3d026038 R14: 00007fac3d025fa0 R15: 00007ffca1e24c88 [ 416.484726][ T8487] [ 416.635324][ T8356] 8021q: adding VLAN 0 to HW filter on device team0 [ 416.723839][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 416.723920][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 416.774248][ T1018] bridge0: port 2(bridge_slave_1) entered blocking state [ 416.774338][ T1018] bridge0: port 2(bridge_slave_1) entered forwarding state [ 417.076080][ T5706] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 417.139538][ T5698] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 417.230090][ T5706] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 417.241689][ T5706] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 417.241725][ T5706] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 417.241744][ T5706] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 417.241759][ T5706] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 417.241788][ T5706] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.306503][ T5706] usb 3-1: config 0 descriptor?? [ 417.318466][ T5698] usb 6-1: Using ep0 maxpacket: 8 [ 417.325102][ T5698] usb 6-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 417.348077][ T5698] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 417.348131][ T5698] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 417.348185][ T5698] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 417.348428][ T5698] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.417857][ T5698] usb 6-1: config 0 descriptor?? [ 417.860874][ T5706] plantronics 0003:047F:FFFF.001A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 418.216477][ T31] audit: type=1400 audit(1788962227.803:602): avc: denied { execute } for pid=8505 comm="syz.4.683" path="/158/file0" dev="tmpfs" ino=890 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 418.337927][ T31] audit: type=1804 audit(1788962227.923:603): pid=8510 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.4.683" name="/newroot/158/file0" dev="tmpfs" ino=890 res=1 errno=0 [ 418.405439][ T31] audit: type=1400 audit(1788962227.993:604): avc: denied { load_policy } for pid=8505 comm="syz.4.683" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 418.536468][ T8510] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -834, delta: 1 [ 418.536514][ T8510] ref_ctr increment failed for inode: 0x37a offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88802d4cb300 [ 418.626803][ T5698] sony 0003:054C:042F.001B: failed to retrieve feature report 0xf2 with the Sixaxis MAC address [ 418.666885][ T8506] SELinux: policydb magic number 0x7665642f does not match expected magic number 0xf97cff8c [ 418.682404][ T5698] sony 0003:054C:042F.001B: hidraw1: USB HID v0.00 Joystick [HID 054c:042f] on usb-dummy_hcd.5-1/input0 [ 418.693650][ T8506] SELinux: failed to load policy [ 418.698826][ T5698] sony 0003:054C:042F.001B: failed to claim input [ 418.716727][ T5698] usb 6-1: USB disconnect, device number 12 [ 418.825454][ T8516] fido_id[8516]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 418.892305][ T8505] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -834, delta: -1 [ 418.892355][ T8505] ref_ctr decrement failed for inode: 0x37a offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88802d4cb300 [ 418.892399][ T8505] uprobe: syz.4.683:8505 failed to unregister, leaking uprobe [ 418.926969][ T8514] FAULT_INJECTION: forcing a failure. [ 418.926969][ T8514] name fail_futex, interval 1, probability 0, space 0, times 0 [ 418.927003][ T8514] CPU: 0 UID: 0 PID: 8514 Comm: syz.2.687 Not tainted syzkaller #0 PREEMPT(full) [ 418.927026][ T8514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 418.927038][ T8514] Call Trace: [ 418.927045][ T8514] [ 418.927053][ T8514] dump_stack_lvl+0x100/0x190 [ 418.927086][ T8514] should_fail_ex.cold+0x5/0xa [ 418.927116][ T8514] get_futex_key+0x1d0/0x14f0 [ 418.927142][ T8514] ? __pfx_get_futex_key+0x10/0x10 [ 418.927164][ T8514] ? wakeup_preempt_fair+0x5c3/0xdc0 [ 418.927188][ T8514] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 418.927216][ T8514] futex_wait_setup+0x91/0x540 [ 418.927252][ T8514] __futex_wait+0x19f/0x300 [ 418.927282][ T8514] ? __pfx___futex_wait+0x10/0x10 [ 418.927310][ T8514] ? __pfx_try_to_wake_up+0x10/0x10 [ 418.927342][ T8514] ? futex_hash+0x311/0x400 [ 418.927368][ T8514] ? __pfx_futex_wake_mark+0x10/0x10 [ 418.927422][ T8514] ? find_held_lock+0x2b/0x80 [ 418.927448][ T8514] ? futex_wake+0x4ea/0x5e0 [ 418.927484][ T8514] futex_wait+0xe6/0x370 [ 418.927514][ T8514] ? __pfx_futex_wait+0x10/0x10 [ 418.927557][ T8514] do_futex+0x265/0x440 [ 418.927581][ T8514] ? __pfx_do_futex+0x10/0x10 [ 418.927613][ T8514] __x64_sys_futex+0x34f/0x4d0 [ 418.927637][ T8514] ? __pfx___x64_sys_futex+0x10/0x10 [ 418.927668][ T8514] do_syscall_64+0x123/0x790 [ 418.927691][ T8514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.927708][ T8514] RIP: 0033:0x7fac3cd9e159 [ 418.927722][ T8514] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 418.927739][ T8514] RSP: 002b:00007fac3dbbe0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 418.927758][ T8514] RAX: ffffffffffffffda RBX: 00007fac3d026098 RCX: 00007fac3cd9e159 [ 418.927772][ T8514] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fac3d026098 [ 418.927784][ T8514] RBP: 00007fac3d026090 R08: 0000000000000000 R09: 0000000000000000 [ 418.927796][ T8514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 418.927806][ T8514] R13: 00007fac3d026128 R14: 00007ffca1e24ba0 R15: 00007ffca1e24c88 [ 418.927829][ T8514] [ 419.036379][ T5757] usb 3-1: USB disconnect, device number 53 [ 419.176049][ T8356] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 421.409311][ T8539] siw: device registration error -23 [ 422.731825][ T8356] veth0_vlan: entered promiscuous mode [ 422.784820][ T8356] veth1_vlan: entered promiscuous mode [ 423.068181][ T8356] veth0_macvtap: entered promiscuous mode [ 423.211832][ T8552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.212230][ T8552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.219578][ T8356] veth1_macvtap: entered promiscuous mode [ 423.360924][ T8356] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 423.539330][ T8356] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 423.660545][ T1453] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.671270][ T1453] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.678653][ T4614] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.678849][ T4614] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.015892][ T31] audit: type=1400 audit(1788962233.603:605): avc: denied { read write } for pid=8557 comm="syz.5.699" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 424.017067][ T31] audit: type=1400 audit(1788962233.603:606): avc: denied { open } for pid=8557 comm="syz.5.699" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 424.051788][ T31] audit: type=1400 audit(1788962233.633:607): avc: denied { mounton } for pid=8557 comm="syz.5.699" path="/36/file0" dev="tmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 424.186536][ T31] audit: type=1400 audit(1788962233.773:608): avc: denied { mount } for pid=8557 comm="syz.5.699" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 424.233322][ T4614] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 424.233385][ T4614] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 424.316306][ T31] audit: type=1400 audit(1788962233.903:609): avc: denied { write } for pid=8560 comm="syz.4.700" path="socket:[19368]" dev="sockfs" ino=19368 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 424.408456][ T50] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 424.542313][ T1453] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 424.542359][ T1453] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 424.568558][ T50] usb 6-1: Using ep0 maxpacket: 16 [ 424.584622][ T50] usb 6-1: unable to get BOS descriptor or descriptor too short [ 424.584745][ T50] usb 6-1: New USB device found, idVendor=093a, idProduct=260e, bcdDevice=18.85 [ 424.593843][ T50] usb 6-1: config 1 has an invalid interface number: 151 but max is 0 [ 424.593868][ T50] usb 6-1: config 1 has no interface number 0 [ 424.593891][ T50] usb 6-1: config 1 interface 151 has no altsetting 0 [ 424.605721][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 424.605747][ T50] usb 6-1: Product: syz [ 424.605760][ T50] usb 6-1: Manufacturer: syz [ 424.605773][ T50] usb 6-1: SerialNumber: syz [ 424.605780][ T31] audit: type=1400 audit(1788962234.183:610): avc: denied { mounton } for pid=8356 comm="syz-executor" path="/root/syzkaller.esbaCo/syz-tmp" dev="sda1" ino=2050 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 424.605824][ T31] audit: type=1400 audit(1788962234.183:611): avc: denied { mount } for pid=8356 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 424.678536][ T31] audit: type=1400 audit(1788962234.233:612): avc: denied { mounton } for pid=8356 comm="syz-executor" path="/root/syzkaller.esbaCo/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 424.678617][ T31] audit: type=1400 audit(1788962234.243:613): avc: denied { mounton } for pid=8356 comm="syz-executor" path="/root/syzkaller.esbaCo/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=20519 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 424.716198][ T31] audit: type=1400 audit(1788962234.293:614): avc: denied { unmount } for pid=8356 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 425.055318][ T8574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 425.073163][ T8574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 425.105562][ T8574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 425.115078][ T8574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 425.295816][ T50] gspca_main: pac7311-2.14.0 probing 093a:260e [ 425.304647][ T50] gspca_pac7311: reg_w() failed index 0xff, value 0x01, error -71 [ 425.304732][ T50] pac7311 6-1:1.151: probe with driver pac7311 failed with error -71 [ 425.318014][ T50] usb 6-1: USB disconnect, device number 13 [ 425.430611][ T8578] netlink: 'syz.1.702': attribute type 1 has an invalid length. [ 425.585598][ T8578] bond1: entered promiscuous mode [ 425.621789][ T8578] 8021q: adding VLAN 0 to HW filter on device bond1 [ 425.632368][ T8577] IPVS: Error connecting to the multicast addr [ 426.711204][ T8592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 426.755360][ T8592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 426.818479][ T8592] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 426.818557][ T8592] TCP: tcp_parse_options: Illegal window scaling value 215 > 14 received [ 426.835164][ T5706] usb 3-1: new full-speed USB device number 54 using dummy_hcd [ 427.012493][ T5706] usb 3-1: device descriptor read/64, error -71 [ 427.590829][ T5706] usb 3-1: new full-speed USB device number 55 using dummy_hcd [ 427.728313][ T5706] usb 3-1: device descriptor read/64, error -71 [ 427.808783][ T5699] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 427.839262][ T5706] usb usb3-port1: attempt power cycle [ 427.956279][ T8610] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 427.999605][ T5699] usb 6-1: Using ep0 maxpacket: 8 [ 428.002301][ T5699] usb 6-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 428.096982][ T5699] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.097067][ T5699] usb 6-1: Product: syz [ 428.098081][ T5699] usb 6-1: Manufacturer: syz [ 428.098147][ T5699] usb 6-1: SerialNumber: syz [ 428.127582][ T8610] CIFS: Attempting to mount //1#7.0.0.1/Ë7Ì/Ðä…¯»—yshare [ 428.188917][ T5706] usb 3-1: new full-speed USB device number 56 using dummy_hcd [ 428.211482][ T5706] usb 3-1: device descriptor read/8, error -71 [ 428.255879][ T5699] usb 6-1: config 0 descriptor?? [ 428.358461][ T5699] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 428.358774][ T5699] dvb-usb: bulk message failed: -22 (2/0) [ 428.460659][ T5706] usb 3-1: new full-speed USB device number 57 using dummy_hcd [ 428.523971][ T5706] usb 3-1: device descriptor read/8, error -71 [ 428.628453][ T5699] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 428.639296][ T5706] usb usb3-port1: unable to enumerate USB device [ 428.671092][ T5699] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 428.671152][ T5699] usb 6-1: media controller created [ 429.087970][ T5699] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 429.365154][ T8610] CIFS: VFS: Error connecting to socket. Aborting operation. [ 429.365558][ T8610] CIFS: VFS: cifs_mount failed w/return code = -111 [ 429.576183][ T5699] cxusb: set interface failed [ 429.576217][ T5699] dvb-usb: bulk message failed: -22 (1/0) [ 429.680169][ T5699] DVB: Unable to find symbol mt352_attach() [ 429.680196][ T5699] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 429.918299][ T5699] rc_core: IR keymap rc-dvico-portable not found [ 429.918330][ T5699] Registered IR keymap rc-empty [ 429.919255][ T5699] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 429.967995][ T5699] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input44 [ 430.009121][ T5699] dvb-usb: schedule remote query interval to 100 msecs. [ 430.017275][ T5699] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 430.047562][ T5699] usb 6-1: USB disconnect, device number 14 [ 430.406004][ T8630] IPVS: Error connecting to the multicast addr [ 430.421175][ T31] kauditd_printk_skb: 4 callbacks suppressed [ 430.421216][ T31] audit: type=1400 audit(1788962240.013:619): avc: denied { setopt } for pid=8625 comm="syz.5.713" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 430.484950][ T5699] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 431.153635][ T8636] sd 0:0:1:0: PR command failed: 1026 [ 431.153692][ T8636] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 431.153738][ T8636] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 431.175174][ T31] audit: type=1400 audit(1788962240.753:620): avc: denied { ioctl } for pid=8635 comm="syz.2.716" path="socket:[20685]" dev="sockfs" ino=20685 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 431.424880][ T8641] netlink: 'syz.1.718': attribute type 2 has an invalid length. [ 431.550434][ T8641] bridge2: entered promiscuous mode [ 433.062349][ T8652] FAULT_INJECTION: forcing a failure. [ 433.062349][ T8652] name failslab, interval 1, probability 0, space 0, times 0 [ 433.062397][ T8652] CPU: 1 UID: 0 PID: 8652 Comm: syz.1.721 Not tainted syzkaller #0 PREEMPT(full) [ 433.062418][ T8652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 433.062429][ T8652] Call Trace: [ 433.062436][ T8652] [ 433.062443][ T8652] dump_stack_lvl+0x100/0x190 [ 433.062477][ T8652] should_fail_ex.cold+0x5/0xa [ 433.062504][ T8652] should_failslab+0xc2/0x120 [ 433.062526][ T8652] __kmalloc_cache_noprof+0x91/0x6d0 [ 433.062553][ T8652] ? snd_pcm_oss_change_params_locked+0x211/0x39f0 [ 433.062606][ T8652] snd_pcm_oss_change_params_locked+0x211/0x39f0 [ 433.062633][ T8652] ? rcu_is_watching+0x13/0xc0 [ 433.062662][ T8652] ? trace_contention_end+0x126/0x160 [ 433.062687][ T8652] ? snd_pcm_oss_write+0x49a/0xa30 [ 433.062710][ T8652] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 433.062736][ T8652] ? __pfx___mutex_lock+0x10/0x10 [ 433.062766][ T8652] ? get_pid_task+0x2a/0x250 [ 433.062793][ T8652] ? get_pid_task+0xfc/0x250 [ 433.062815][ T8652] ? get_pid_task+0xfc/0x250 [ 433.062841][ T8652] snd_pcm_oss_make_ready_locked+0xb7/0x130 [ 433.062867][ T8652] snd_pcm_oss_write+0x4bb/0xa30 [ 433.062891][ T8652] ? bpf_lsm_file_permission+0x9/0x10 [ 433.062914][ T8652] ? security_file_permission+0x76/0x210 [ 433.062939][ T8652] vfs_write+0x2aa/0x1050 [ 433.062959][ T8652] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 433.062982][ T8652] ? lock_acquire+0x1d1/0x380 [ 433.063001][ T8652] ? __fget_files+0x34/0x3d0 [ 433.063022][ T8652] ? __pfx_vfs_write+0x10/0x10 [ 433.063038][ T8652] ? find_held_lock+0x2b/0x80 [ 433.063062][ T8652] ? __fget_files+0x215/0x3d0 [ 433.063083][ T8652] ? __fget_files+0x215/0x3d0 [ 433.063109][ T8652] ? __fget_files+0x21f/0x3d0 [ 433.063137][ T8652] ksys_write+0x12a/0x250 [ 433.063154][ T8652] ? __pfx_ksys_write+0x10/0x10 [ 433.063180][ T8652] do_syscall_64+0x123/0x790 [ 433.063205][ T8652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.063225][ T8652] RIP: 0033:0x7fef5659e159 [ 433.063241][ T8652] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 433.063257][ T8652] RSP: 002b:00007fef574dc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 433.063274][ T8652] RAX: ffffffffffffffda RBX: 00007fef56825fa0 RCX: 00007fef5659e159 [ 433.063285][ T8652] RDX: 0000000000004000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 433.063296][ T8652] RBP: 00007fef574dc090 R08: 0000000000000000 R09: 0000000000000000 [ 433.063307][ T8652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 433.063317][ T8652] R13: 00007fef56826038 R14: 00007fef56825fa0 R15: 00007ffd322becd8 [ 433.063343][ T8652] [ 433.864548][ T8659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 433.864812][ T8659] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.950951][ T8670] FAULT_INJECTION: forcing a failure. [ 434.950951][ T8670] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 434.951058][ T8670] CPU: 0 UID: 0 PID: 8670 Comm: syz.1.725 Not tainted syzkaller #0 PREEMPT(full) [ 434.951080][ T8670] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 434.951091][ T8670] Call Trace: [ 434.951097][ T8670] [ 434.951104][ T8670] dump_stack_lvl+0x100/0x190 [ 434.951136][ T8670] should_fail_ex.cold+0x5/0xa [ 434.951162][ T8670] _copy_from_user+0x2e/0xd0 [ 434.951191][ T8670] memdup_user+0x6b/0xe0 [ 434.951220][ T8670] strndup_user+0x78/0xe0 [ 434.951248][ T8670] __do_sys_fsconfig+0x276/0xcb0 [ 434.951270][ T8670] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 434.951300][ T8670] do_syscall_64+0x123/0x790 [ 434.951326][ T8670] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.951344][ T8670] RIP: 0033:0x7fef5659e159 [ 434.951360][ T8670] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 434.951377][ T8670] RSP: 002b:00007fef574bb028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 434.951396][ T8670] RAX: ffffffffffffffda RBX: 00007fef56826090 RCX: 00007fef5659e159 [ 434.951408][ T8670] RDX: 0000200000000000 RSI: 0000000000000001 RDI: 0000000000000005 [ 434.951419][ T8670] RBP: 00007fef574bb090 R08: 0000000000000000 R09: 0000000000000000 [ 434.951429][ T8670] R10: 00002000000004c0 R11: 0000000000000246 R12: 0000000000000001 [ 434.951440][ T8670] R13: 00007fef56826128 R14: 00007fef56826090 R15: 00007ffd322becd8 [ 434.951465][ T8670] [ 435.896074][ T31] audit: type=1400 audit(1788962245.483:621): avc: denied { mount } for pid=8669 comm="syz.6.726" name="/" dev="ramfs" ino=21506 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 435.919487][ T5727] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 436.014455][ T31] audit: type=1400 audit(1788962245.603:622): avc: denied { read append } for pid=8680 comm="syz.2.729" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 436.021298][ T31] audit: type=1400 audit(1788962245.603:623): avc: denied { open } for pid=8680 comm="syz.2.729" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 436.078371][ T5727] usb 6-1: Using ep0 maxpacket: 32 [ 436.084301][ T5727] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 436.096457][ T5727] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 436.104301][ T31] audit: type=1400 audit(1788962245.693:624): avc: denied { create } for pid=8680 comm="syz.2.729" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 436.127607][ T5727] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 436.127648][ T5727] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.171003][ T5727] usb 6-1: config 0 descriptor?? [ 436.183286][ T31] audit: type=1400 audit(1788962245.773:625): avc: denied { connect } for pid=8680 comm="syz.2.729" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 436.194918][ T31] audit: type=1400 audit(1788962245.783:626): avc: denied { write } for pid=8680 comm="syz.2.729" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 436.219905][ T31] audit: type=1400 audit(1788962245.803:627): avc: denied { read } for pid=8680 comm="syz.2.729" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 436.725747][ T5727] ft260 0003:0403:6030.001C: unknown main item tag 0x0 [ 436.725794][ T5727] ft260 0003:0403:6030.001C: unknown main item tag 0x0 [ 436.881703][ T8681] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 436.881956][ T8681] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 436.923240][ T5727] ft260 0003:0403:6030.001C: chip code: 0000 0000 [ 436.942907][ T8686] IPVS: Error connecting to the multicast addr [ 437.142865][ T5727] ft260 0003:0403:6030.001C: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.5-1/input0 [ 437.209389][ T8681] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 437.319183][ T8681] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 437.319270][ T8681] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 437.345398][ T5727] ft260 0003:0403:6030.001C: failed to retrieve status: -32, no wakeup [ 437.619201][ T8681] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 437.645511][ T5727] usb 6-1: USB disconnect, device number 15 [ 438.433708][ T8681] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 438.477272][ T8681] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 438.621013][ T53] Bluetooth: hci2: command 0x0406 tx timeout [ 439.339074][ T53] Bluetooth: hci1: command 0x0406 tx timeout [ 439.363882][ T8681] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 439.363961][ T8681] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 439.490838][ T8681] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 439.514059][ T8681] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 439.515695][ T8681] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 439.545519][ T8681] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 439.978645][ T5757] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 440.137348][ T5757] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 440.168861][ T5757] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.425061][ T5757] usb 6-1: config 0 descriptor?? [ 440.462536][ T53] Bluetooth: hci4: command 0x0406 tx timeout [ 440.703208][ T53] Bluetooth: hci2: command 0x0406 tx timeout [ 441.428602][ T5615] Bluetooth: hci1: command 0x0406 tx timeout [ 441.442644][ T53] Bluetooth: hci3: command 0x0c1a tx timeout [ 441.590802][ T53] Bluetooth: hci5: command 0x0c1a tx timeout [ 441.978695][ T5757] ath6kl: Failed to submit usb control message: -110 [ 441.978779][ T5757] ath6kl: unable to send the bmi data to the device: -110 [ 441.978805][ T5757] ath6kl: Unable to send get target info: -110 [ 442.355617][ T5757] ath6kl: Failed to init ath6kl core: -110 [ 442.356458][ T5757] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 442.558078][ T53] Bluetooth: hci4: command 0x0406 tx timeout [ 442.783592][ T53] Bluetooth: hci2: command 0x0406 tx timeout [ 444.385566][ T5615] Bluetooth: hci3: command 0x0c1a tx timeout [ 444.385618][ T5615] Bluetooth: hci1: command 0x0406 tx timeout [ 444.385655][ T5615] Bluetooth: hci5: command 0x0c1a tx timeout [ 444.386310][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 444.386360][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 444.398438][ T31] audit: type=1400 audit(1788962253.963:628): avc: denied { setopt } for pid=8707 comm="syz.6.733" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 444.448950][ T31] audit: type=1400 audit(1788962254.033:629): avc: denied { map } for pid=8707 comm="syz.6.733" path="socket:[20766]" dev="sockfs" ino=20766 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 444.448995][ T31] audit: type=1400 audit(1788962254.033:630): avc: denied { read write } for pid=8707 comm="syz.6.733" path="socket:[20766]" dev="sockfs" ino=20766 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 444.768171][ T5699] usb 6-1: USB disconnect, device number 16 [ 444.965088][ T8717] FAULT_INJECTION: forcing a failure. [ 444.965088][ T8717] name failslab, interval 1, probability 0, space 0, times 0 [ 444.965143][ T8717] CPU: 0 UID: 0 PID: 8717 Comm: syz.1.736 Not tainted syzkaller #0 PREEMPT(full) [ 444.965162][ T8717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 444.965171][ T8717] Call Trace: [ 444.965178][ T8717] [ 444.965185][ T8717] dump_stack_lvl+0x100/0x190 [ 444.965211][ T8717] should_fail_ex.cold+0x5/0xa [ 444.965236][ T8717] should_failslab+0xc2/0x120 [ 444.965253][ T8717] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 444.965266][ T8717] ? __alloc_skb+0x5b7/0x710 [ 444.965279][ T8717] ? __alloc_skb+0x140/0x710 [ 444.965292][ T8717] __alloc_skb+0x140/0x710 [ 444.965302][ T8717] ? __alloc_skb+0x5b7/0x710 [ 444.965312][ T8717] ? __pfx___alloc_skb+0x10/0x10 [ 444.965327][ T8717] netlink_alloc_large_skb+0x69/0x150 [ 444.965346][ T8717] netlink_sendmsg+0x680/0xda0 [ 444.965359][ T8717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 444.965371][ T8717] ? selinux_socket_sendmsg+0x198/0x2f0 [ 444.965392][ T8717] ____sys_sendmsg+0xa4d/0xbe0 [ 444.965406][ T8717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 444.965418][ T8717] ? __pfx_____sys_sendmsg+0x10/0x10 [ 444.965436][ T8717] ? lock_acquire+0x1d1/0x380 [ 444.965449][ T8717] ? get_pid_task+0x2a/0x250 [ 444.965465][ T8717] ___sys_sendmsg+0x190/0x1e0 [ 444.965481][ T8717] ? __pfx____sys_sendmsg+0x10/0x10 [ 444.965497][ T8717] ? get_pid_task+0x106/0x250 [ 444.965516][ T8717] ? find_held_lock+0x2b/0x80 [ 444.965542][ T8717] __sys_sendmsg+0x160/0x210 [ 444.965555][ T8717] ? __pfx___sys_sendmsg+0x10/0x10 [ 444.965574][ T8717] do_syscall_64+0x123/0x790 [ 444.965590][ T8717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 444.965602][ T8717] RIP: 0033:0x7fef5659e159 [ 444.965612][ T8717] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 444.965623][ T8717] RSP: 002b:00007fef574dc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 444.965635][ T8717] RAX: ffffffffffffffda RBX: 00007fef56825fa0 RCX: 00007fef5659e159 [ 444.965642][ T8717] RDX: 0000000004000014 RSI: 0000200000000100 RDI: 0000000000000003 [ 444.965649][ T8717] RBP: 00007fef574dc090 R08: 0000000000000000 R09: 0000000000000000 [ 444.965655][ T8717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 444.965662][ T8717] R13: 00007fef56826038 R14: 00007fef56825fa0 R15: 00007ffd322becd8 [ 444.965676][ T8717] [ 445.988765][ T7016] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 446.158421][ T7016] usb 6-1: Using ep0 maxpacket: 8 [ 446.167517][ T7016] usb 6-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 446.460579][ T53] Bluetooth: hci5: command 0x0c1a tx timeout [ 446.460641][ T53] Bluetooth: hci3: command 0x0c1a tx timeout [ 446.560663][ T7016] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.560704][ T7016] usb 6-1: Product: syz [ 446.560720][ T7016] usb 6-1: Manufacturer: syz [ 446.560738][ T7016] usb 6-1: SerialNumber: syz [ 446.587148][ T7016] usb 6-1: config 0 descriptor?? [ 446.642134][ T7016] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 446.642192][ T7016] dvb-usb: bulk message failed: -22 (2/0) [ 446.692805][ T7016] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 446.702765][ T7016] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 446.702816][ T7016] usb 6-1: media controller created [ 446.731323][ T7016] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 446.821664][ T8721] dvb-usb: bulk message failed: -22 (7/0) [ 446.832379][ T31] audit: type=1400 audit(1788962256.423:631): avc: denied { map } for pid=8718 comm="syz.5.735" path="/dev/i2c-1" dev="devtmpfs" ino=4137 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 446.832444][ T31] audit: type=1400 audit(1788962256.423:632): avc: denied { execute } for pid=8718 comm="syz.5.735" path="/dev/i2c-1" dev="devtmpfs" ino=4137 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 447.006146][ T7016] cxusb: set interface failed [ 447.006180][ T7016] dvb-usb: bulk message failed: -22 (1/0) [ 447.170238][ T7016] DVB: Unable to find symbol mt352_attach() [ 447.178336][ T7016] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 447.408341][ T7016] rc_core: IR keymap rc-dvico-portable not found [ 447.416150][ T7016] Registered IR keymap rc-empty [ 447.425295][ T7016] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 447.445957][ T7016] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input45 [ 447.460447][ T7016] dvb-usb: schedule remote query interval to 100 msecs. [ 447.468440][ T7016] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 447.492062][ T7016] usb 6-1: USB disconnect, device number 17 [ 447.602914][ T7016] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 448.058555][ T30] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 449.035598][ T30] usb 3-1: device descriptor read/64, error -71 [ 449.279007][ T30] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 450.313792][ T31] audit: type=1400 audit(1788962259.403:633): avc: denied { remount } for pid=8746 comm="syz.5.743" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 450.398346][ T7016] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 450.408404][ T30] usb 3-1: device descriptor read/64, error -71 [ 450.529632][ T30] usb usb3-port1: attempt power cycle [ 450.558344][ T7016] usb 2-1: Using ep0 maxpacket: 16 [ 450.569085][ T7016] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 450.580921][ T7016] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 450.593961][ T7016] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 450.594017][ T7016] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 450.594039][ T7016] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 450.594061][ T7016] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 450.661508][ T7016] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 450.672618][ T7016] usb 2-1: Manufacturer: syz [ 450.684293][ T7016] usb 2-1: config 0 descriptor?? [ 451.048302][ T7016] rc_core: IR keymap rc-hauppauge not found [ 451.048334][ T7016] Registered IR keymap rc-empty [ 451.049500][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.080374][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.113298][ T7016] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 451.135489][ T7016] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input46 [ 451.179330][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.208734][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.228558][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.258390][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.278411][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.309347][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.339886][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.368524][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.389177][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.418702][ T7016] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 451.447728][ T7016] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 451.460345][ T7016] mceusb 2-1:0.0: 2 tx ports (0x1 cabled) and 2 rx sensors (0x0 active) [ 451.494127][ T7016] usb 2-1: USB disconnect, device number 46 [ 451.776626][ T8757] siw: device registration error -23 [ 452.906836][ T7016] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 453.272132][ T7016] usb 7-1: Using ep0 maxpacket: 8 [ 453.284409][ T7016] usb 7-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 453.285281][ T7016] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 453.285312][ T7016] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 453.285329][ T7016] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 453.285361][ T7016] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.365963][ T7016] usb 7-1: config 0 descriptor?? [ 454.855014][ T5699] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 454.928333][ T5798] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 455.020378][ T5699] usb 2-1: Using ep0 maxpacket: 8 [ 455.025812][ T5699] usb 2-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 455.047699][ T5699] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.047771][ T5699] usb 2-1: Product: syz [ 455.047785][ T5699] usb 2-1: Manufacturer: syz [ 455.047798][ T5699] usb 2-1: SerialNumber: syz [ 455.054462][ T5699] usb 2-1: config 0 descriptor?? [ 455.062549][ T5699] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 455.062584][ T5699] pctv452e: pctv452e_power_ctrl: 1 [ 455.062584][ T5699] [ 455.062632][ T5699] usb 2-1: selecting invalid altsetting 3 [ 455.062645][ T5699] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 455.062645][ T5699] [ 455.062658][ T5699] dvb-usb: bulk message failed: -22 (5/0) [ 455.079804][ T5699] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 455.083764][ T5699] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 455.083825][ T5699] usb 2-1: media controller created [ 455.083861][ T5699] dvb-usb: bulk message failed: -22 (8/0) [ 455.083873][ T5699] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 455.083918][ T5699] dvb-usb: MAC address reading failed. [ 455.113502][ T5699] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 455.242483][ T5798] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0099, bcdDevice=bd.95 [ 455.264073][ T5798] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 455.264107][ T5798] usb 6-1: config 2 has 1 interface, different from the descriptor's value: 3 [ 455.499276][ T5798] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.499322][ T5798] usb 6-1: Product: syz [ 455.499349][ T5798] usb 6-1: Manufacturer: syz [ 455.499361][ T5798] usb 6-1: SerialNumber: syz [ 455.558547][ T8766] dvb-usb: bulk message failed: -22 (7/0) [ 455.567655][ T8766] pctv452e: I2C error -22; AA 02 00 00 00 -> aa 02 31 03 00 00 00 [ 456.371334][ T5699] DVB: Unable to find symbol stb0899_attach() [ 456.371388][ T5699] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 456.412692][ T5798] usb 6-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 456.450251][ T7016] sony 0003:054C:042F.001D: failed to retrieve feature report 0xf2 with the Sixaxis MAC address [ 456.464464][ T5798] dvb_usb_af9015 6-1:2.0: probe with driver dvb_usb_af9015 failed with error -22 [ 456.477018][ T5798] usb 6-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 456.484771][ T5798] dvb_usb_af9035 6-1:2.0: probe with driver dvb_usb_af9035 failed with error -22 [ 456.487399][ T7016] sony 0003:054C:042F.001D: hidraw0: USB HID v0.00 Joystick [HID 054c:042f] on usb-dummy_hcd.6-1/input0 [ 456.487429][ T7016] sony 0003:054C:042F.001D: failed to claim input [ 456.519583][ T5798] usb 6-1: USB disconnect, device number 18 [ 456.522812][ T7016] usb 7-1: USB disconnect, device number 2 [ 456.660403][ T5699] rc_core: IR keymap rc-tt-1500 not found [ 456.660441][ T5699] Registered IR keymap rc-empty [ 456.661333][ T5699] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 456.667487][ T5699] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input48 [ 456.704151][ T5699] dvb-usb: schedule remote query interval to 100 msecs. [ 456.704191][ T5699] pctv452e: pctv452e_power_ctrl: 0 [ 456.704191][ T5699] [ 456.704214][ T5699] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 456.818535][ T7016] dvb-usb: bulk message failed: -22 (4/0) [ 456.818574][ T7016] dvb-usb: error -22 while querying for an remote control event. [ 456.935651][ T30] dvb-usb: bulk message failed: -22 (4/0) [ 456.935692][ T30] dvb-usb: error -22 while querying for an remote control event. [ 457.008871][ T8781] fido_id[8781]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 457.052581][ T30] dvb-usb: bulk message failed: -22 (4/0) [ 457.052641][ T30] dvb-usb: error -22 while querying for an remote control event. [ 458.144367][ T30] dvb-usb: bulk message failed: -22 (4/0) [ 458.144418][ T30] dvb-usb: error -22 while querying for an remote control event. [ 458.240985][ T7016] usb 2-1: USB disconnect, device number 47 [ 458.524966][ T7016] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 458.681815][ T5699] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 458.830582][ T5699] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 458.831474][ T5699] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 458.831509][ T5699] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 458.831542][ T5699] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.837768][ T5699] usb 7-1: config 0 descriptor?? [ 458.849090][ T5699] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 458.909964][ T8793] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 458.924072][ T8793] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.170580][ T5699] usb 7-1: USB disconnect, device number 3 [ 459.948398][ T5699] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 460.018560][ T30] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 460.111612][ T5699] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 460.112468][ T5699] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 460.112505][ T5699] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 460.112527][ T5699] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 460.114155][ T5699] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.114176][ T5699] usb 7-1: Product: syz [ 460.114188][ T5699] usb 7-1: Manufacturer: syz [ 460.114201][ T5699] usb 7-1: SerialNumber: syz [ 460.180225][ T30] usb 2-1: Using ep0 maxpacket: 16 [ 460.183769][ T30] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 460.187390][ T30] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 460.187435][ T30] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 460.187476][ T30] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 460.187494][ T30] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 460.187513][ T30] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 460.190366][ T30] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 460.190388][ T30] usb 2-1: Manufacturer: syz [ 460.195955][ T30] usb 2-1: config 0 descriptor?? [ 460.777212][ T8804] syzkaller0: entered promiscuous mode [ 460.777311][ T8804] syzkaller0: entered allmulticast mode [ 460.881358][ T8787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 460.881931][ T8787] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 460.899188][ T30] rc_core: IR keymap rc-hauppauge not found [ 460.899205][ T30] Registered IR keymap rc-empty [ 460.899291][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 460.921196][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 460.982559][ T30] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 460.991623][ T30] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input49 [ 461.012333][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 461.032749][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 461.051925][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 461.071344][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 461.088449][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 461.108508][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 461.129499][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 461.148991][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 461.170475][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 461.189090][ T30] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 461.209986][ T30] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 461.210018][ T30] mceusb 2-1:0.0: 2 tx ports (0x1 cabled) and 2 rx sensors (0x0 active) [ 461.263669][ T5706] usb 2-1: USB disconnect, device number 48 [ 461.494819][ T30] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 461.650037][ T30] usb 3-1: Using ep0 maxpacket: 8 [ 461.652701][ T30] usb 3-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 461.654622][ T30] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 461.654698][ T30] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 461.654718][ T30] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 461.654749][ T30] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.677359][ T30] usb 3-1: config 0 descriptor?? [ 462.102218][ T5699] usb 7-1: USB disconnect, device number 4 [ 462.102299][ C1] usb 7-1: comm data receiver aborted. [ 462.305015][ T8817] IPVS: Error connecting to the multicast addr [ 462.343606][ T5612] udevd[5612]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 462.766834][ T8825] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 462.767479][ T8825] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 463.093341][ T30] sony 0003:054C:042F.001E: failed to retrieve feature report 0xf2 with the Sixaxis MAC address [ 463.102117][ T30] sony 0003:054C:042F.001E: hidraw0: USB HID v0.00 Joystick [HID 054c:042f] on usb-dummy_hcd.2-1/input0 [ 463.102155][ T30] sony 0003:054C:042F.001E: failed to claim input [ 463.163836][ T30] usb 3-1: USB disconnect, device number 61 [ 463.373731][ T8826] fido_id[8826]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 463.768384][ T5699] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 464.130562][ T5699] usb 7-1: Using ep0 maxpacket: 8 [ 464.137512][ T5699] usb 7-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 464.149905][ T5699] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.149956][ T5699] usb 7-1: Product: syz [ 464.149969][ T5699] usb 7-1: Manufacturer: syz [ 464.149982][ T5699] usb 7-1: SerialNumber: syz [ 464.154637][ T5699] usb 7-1: config 0 descriptor?? [ 464.165991][ T5699] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 464.166027][ T5699] dvb-usb: bulk message failed: -22 (2/0) [ 464.175787][ T5699] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 464.176628][ T5699] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 464.176668][ T5699] usb 7-1: media controller created [ 464.198348][ T5699] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 464.715413][ T8814] dvb-usb: bulk message failed: -22 (7/0) [ 465.707837][ T31] audit: type=1400 audit(1788962274.823:634): avc: denied { create } for pid=8840 comm="syz.2.770" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 465.707900][ T31] audit: type=1400 audit(1788962274.823:635): avc: denied { connect } for pid=8840 comm="syz.2.770" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 466.054445][ T5699] cxusb: set interface failed [ 466.054489][ T5699] dvb-usb: bulk message failed: -22 (1/0) [ 466.267452][ T5699] DVB: Unable to find symbol mt352_attach() [ 466.267481][ T5699] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 466.378303][ T5798] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 466.440934][ T5699] rc_core: IR keymap rc-dvico-portable not found [ 466.440974][ T5699] Registered IR keymap rc-empty [ 466.441841][ T5699] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.6/usb7/7-1/rc/rc0 [ 466.449368][ T5699] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.6/usb7/7-1/rc/rc0/input51 [ 466.457577][ T5699] dvb-usb: schedule remote query interval to 100 msecs. [ 466.457598][ T5699] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 466.491283][ T5699] usb 7-1: USB disconnect, device number 5 [ 466.571604][ T5798] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 466.581793][ T5798] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.597889][ T5798] usb 2-1: config 0 descriptor?? [ 466.657912][ T5699] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 467.271814][ T5798] ath6kl: Failed to submit usb control message: -71 [ 467.271878][ T5798] ath6kl: unable to send the bmi data to the device: -71 [ 467.271913][ T5798] ath6kl: Unable to send get target info: -71 [ 467.295840][ T5798] ath6kl: Failed to init ath6kl core: -71 [ 467.296761][ T5798] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 467.607109][ T5798] usb 2-1: USB disconnect, device number 49 [ 471.446088][ T31] audit: type=1400 audit(1788962281.033:636): avc: denied { write } for pid=8888 comm="syz.1.776" name="001" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 472.033968][ T31] audit: type=1400 audit(1788962281.033:637): avc: denied { map } for pid=8888 comm="syz.1.776" path="/dev/bus/usb/007/001" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 472.084591][ T8890] ip_tables: iptables: counters copy to user failed while replacing table [ 472.117054][ T31] audit: type=1400 audit(1788962281.343:638): avc: denied { write } for pid=8888 comm="syz.1.776" name="renderD128" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 472.573213][ T8894] siw: device registration error -23 [ 472.659936][ T31] audit: type=1400 audit(1788962282.243:639): avc: denied { ioctl } for pid=8895 comm="syz.6.781" path="socket:[21842]" dev="sockfs" ino=21842 ioctlcmd=0x8982 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 472.725520][ T8892] gadgetfs: bound to dummy_udc driver [ 472.757985][ T31] audit: type=1400 audit(1788962282.343:640): avc: denied { getopt } for pid=8895 comm="syz.6.781" laddr=fe80::409d:ebff:fe99:7373 lport=58 faddr=ff02::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 473.951970][ T31] audit: type=1400 audit(1788962283.543:641): avc: denied { setopt } for pid=8916 comm="syz.5.787" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 474.963292][ T31] audit: type=1400 audit(1788962284.553:642): avc: denied { create } for pid=8923 comm="syz.2.790" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 474.986201][ T31] audit: type=1326 audit(1788962284.573:643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8923 comm="syz.2.790" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fac3cd9e159 code=0x0 [ 475.982832][ T8945] siw: device registration error -23 [ 476.030249][ T8941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.030611][ T8941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.085301][ T8941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.144187][ T8941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.145044][ T8941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.145357][ T8941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.167273][ T8941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.167626][ T8941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.190402][ T8941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.190723][ T8941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.191470][ T8941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.217502][ T8941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.652604][ T31] audit: type=1400 audit(1788962286.233:644): avc: denied { ioctl } for pid=8947 comm="syz.1.795" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 476.685379][ T31] audit: type=1400 audit(1788962286.273:645): avc: denied { read write } for pid=8951 comm="syz.5.796" name="video1" dev="devtmpfs" ino=930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 476.710295][ T31] audit: type=1400 audit(1788962286.273:646): avc: denied { open } for pid=8951 comm="syz.5.796" path="/dev/video1" dev="devtmpfs" ino=930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 476.749374][ T31] audit: type=1400 audit(1788962286.343:647): avc: denied { ioctl } for pid=8951 comm="syz.5.796" path="/dev/video1" dev="devtmpfs" ino=930 ioctlcmd=0x5602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 476.777034][ T8953] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 477.330146][ T5698] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 477.758424][ T5698] usb 6-1: Using ep0 maxpacket: 8 [ 477.769783][ T5698] usb 6-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 477.801260][ T5698] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.809617][ T5698] usb 6-1: Product: syz [ 477.815064][ T5698] usb 6-1: Manufacturer: syz [ 477.815107][ T5698] usb 6-1: SerialNumber: syz [ 477.820093][ T31] audit: type=1400 audit(1788962287.403:648): avc: denied { bind } for pid=8971 comm="syz.1.801" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 477.820137][ T31] audit: type=1400 audit(1788962287.403:649): avc: denied { node_bind } for pid=8971 comm="syz.1.801" saddr=172.20.20.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 477.874946][ T5698] usb 6-1: config 0 descriptor?? [ 477.889526][ T5698] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 477.889579][ T5698] pctv452e: pctv452e_power_ctrl: 1 [ 477.889579][ T5698] [ 477.889636][ T5698] usb 6-1: selecting invalid altsetting 3 [ 477.889652][ T5698] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 477.889652][ T5698] [ 477.889668][ T5698] dvb-usb: bulk message failed: -22 (5/0) [ 477.935255][ T5698] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 477.946774][ T5698] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 477.955349][ T5698] usb 6-1: media controller created [ 477.960820][ T5698] dvb-usb: bulk message failed: -22 (8/0) [ 477.967157][ T5698] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 477.978647][ T5698] dvb-usb: MAC address reading failed. [ 478.009781][ T5698] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 478.124955][ T8965] dvb-usb: bulk message failed: -22 (7/0) [ 478.124996][ T8965] pctv452e: I2C error -22; AA 02 00 00 00 -> aa 02 31 03 00 00 00 [ 478.804594][ T5698] DVB: Unable to find symbol stb0899_attach() [ 478.811672][ T5698] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 479.058894][ T5698] rc_core: IR keymap rc-tt-1500 not found [ 479.058926][ T5698] Registered IR keymap rc-empty [ 479.084736][ T5698] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 479.108030][ T5698] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input53 [ 479.128339][ T5698] dvb-usb: schedule remote query interval to 100 msecs. [ 479.135474][ T5698] pctv452e: pctv452e_power_ctrl: 0 [ 479.135474][ T5698] [ 479.142963][ T5698] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 479.239347][ T5698] dvb-usb: bulk message failed: -22 (4/0) [ 479.239390][ T5698] dvb-usb: error -22 while querying for an remote control event. [ 479.349302][ T5698] dvb-usb: bulk message failed: -22 (4/0) [ 479.349342][ T5698] dvb-usb: error -22 while querying for an remote control event. [ 479.458687][ T30] dvb-usb: bulk message failed: -22 (4/0) [ 479.458740][ T30] dvb-usb: error -22 while querying for an remote control event. [ 479.593692][ T30] dvb-usb: bulk message failed: -22 (4/0) [ 479.603114][ T30] dvb-usb: error -22 while querying for an remote control event. [ 479.633306][ T31] audit: type=1400 audit(1788962289.223:650): avc: denied { read write } for pid=8983 comm="syz.1.804" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 479.648429][ T31] audit: type=1400 audit(1788962289.223:651): avc: denied { open } for pid=8983 comm="syz.1.804" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 479.696931][ T31] audit: type=1400 audit(1788962289.283:652): avc: denied { ioctl } for pid=8983 comm="syz.1.804" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9376 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 479.722078][ T30] dvb-usb: bulk message failed: -22 (4/0) [ 479.722111][ T30] dvb-usb: error -22 while querying for an remote control event. [ 479.828383][ T5706] dvb-usb: bulk message failed: -22 (4/0) [ 479.828426][ T5706] dvb-usb: error -22 while querying for an remote control event. [ 479.938855][ T5706] dvb-usb: bulk message failed: -22 (4/0) [ 479.948716][ T5706] dvb-usb: error -22 while querying for an remote control event. [ 480.059022][ T5706] dvb-usb: bulk message failed: -22 (4/0) [ 480.059139][ T5706] dvb-usb: error -22 while querying for an remote control event. [ 480.120799][ T5339] usb 6-1: USB disconnect, device number 19 [ 480.182500][ T8995] siw: device registration error -23 [ 480.359362][ T5339] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 481.490064][ T31] audit: type=1400 audit(1788962290.633:653): avc: denied { setopt } for pid=9000 comm="syz.5.809" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 481.635543][ T9006] openvswitch: netlink: Message has 1 unknown bytes. [ 481.635573][ T9006] openvswitch: netlink: Actions may not be safe on all matching packets [ 484.371200][ T31] kauditd_printk_skb: 6 callbacks suppressed [ 484.371248][ T31] audit: type=1400 audit(1788962293.963:660): avc: denied { create } for pid=9017 comm="syz.2.817" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 484.412569][ T31] audit: type=1400 audit(1788962294.003:661): avc: denied { ioctl } for pid=9017 comm="syz.2.817" path="socket:[22103]" dev="sockfs" ino=22103 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 484.518568][ T9020] netlink: 4 bytes leftover after parsing attributes in process `syz.2.817'. [ 485.298592][ T9027] netlink: 8 bytes leftover after parsing attributes in process `syz.2.819'. [ 485.298642][ T9027] netlink: 12 bytes leftover after parsing attributes in process `syz.2.819'. [ 485.400799][ T31] audit: type=1400 audit(1788962294.993:662): avc: denied { getopt } for pid=9026 comm="syz.2.819" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 486.408882][ T9041] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 486.409276][ T9041] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 486.513265][ T31] audit: type=1400 audit(1788962296.103:663): avc: denied { listen } for pid=9039 comm="syz.4.813" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 486.576308][ T9041] binder: 9039:9041 ioctl 4018620d 0 returned -22 [ 486.634874][ T31] audit: type=1400 audit(1788962296.223:664): avc: denied { ioctl } for pid=9039 comm="syz.4.813" path="socket:[21230]" dev="sockfs" ino=21230 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 489.609059][ T9062] ip6gretap2: entered allmulticast mode [ 489.615394][ T9062] batman_adv: batadv0: Adding interface: ip6gretap2 [ 489.615410][ T9062] batman_adv: batadv0: The MTU of interface ip6gretap2 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 489.615434][ T9062] batman_adv: batadv0: Interface activated: ip6gretap2 [ 489.990463][ T31] audit: type=1400 audit(1788962299.583:665): avc: denied { setattr } for pid=9068 comm="syz.4.831" path="socket:[22163]" dev="sockfs" ino=22163 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 490.059636][ T9070] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.060358][ T9070] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.077701][ T30] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 490.231506][ T30] usb 2-1: New USB device found, idVendor=072f, idProduct=2200, bcdDevice= 1.00 [ 490.243972][ T30] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.475804][ T30] usb 2-1: NFC: Reader power on cmd error -71 [ 490.475843][ T30] pn533_usb 2-1:1.0: NFC: Couldn't poweron the reader (error -71) [ 490.475945][ T30] pn533_usb 2-1:1.0: probe with driver pn533_usb failed with error -71 [ 490.533354][ T30] usb 2-1: USB disconnect, device number 50 [ 490.908778][ T5698] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 491.134383][ T5698] usb 7-1: Using ep0 maxpacket: 8 [ 491.145858][ T5698] usb 7-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 491.286231][ T5698] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239 [ 491.286274][ T5698] usb 7-1: Product: syz [ 491.286305][ T5698] usb 7-1: Manufacturer: syz [ 491.286332][ T5698] usb 7-1: SerialNumber: syz [ 491.326373][ T5698] usb 7-1: config 0 descriptor?? [ 491.337603][ T5698] gspca_main: sq905-2.14.0 probing 2770:9120 [ 491.749055][ T31] audit: type=1400 audit(1788962301.343:666): avc: denied { setopt } for pid=9084 comm="syz.1.835" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 491.839494][ T5698] gspca_sq905: sq905_command: usb_control_msg failed (-110) [ 491.848149][ T5698] sq905 7-1:0.0: probe with driver sq905 failed with error -110 [ 492.086090][ T25] usb 7-1: USB disconnect, device number 6 [ 493.295711][ T9101] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.306436][ T9101] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.318842][ T31] audit: type=1400 audit(1788962302.913:667): avc: denied { mounton } for pid=9100 comm="syz.4.839" path="/195/file0" dev="tmpfs" ino=1094 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 493.469610][ T31] audit: type=1400 audit(1788962303.053:668): avc: denied { block_suspend } for pid=9095 comm="syz.5.837" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 493.803637][ T31] audit: type=1400 audit(1788962303.383:669): avc: denied { mount } for pid=9095 comm="syz.5.837" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 493.825956][ T5698] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 493.862124][ T31] audit: type=1400 audit(1788962303.453:670): avc: denied { mount } for pid=9109 comm="syz.1.841" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 493.871997][ T31] audit: type=1400 audit(1788962303.453:671): avc: denied { search } for pid=9109 comm="syz.1.841" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 493.876876][ T31] audit: type=1400 audit(1788962303.453:672): avc: denied { search } for pid=9109 comm="syz.1.841" name="events" dev="tracefs" ino=4019 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 493.876938][ T31] audit: type=1400 audit(1788962303.453:673): avc: denied { search } for pid=9109 comm="syz.1.841" name="sched" dev="tracefs" ino=21299 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 493.876970][ T31] audit: type=1400 audit(1788962303.453:674): avc: denied { search } for pid=9109 comm="syz.1.841" name="sched_switch" dev="tracefs" ino=21301 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 494.057818][ T5698] usb 7-1: Using ep0 maxpacket: 8 [ 494.058651][ T5698] usb 7-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 494.077848][ T5698] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.086179][ T5698] usb 7-1: Product: syz [ 494.086204][ T5698] usb 7-1: Manufacturer: syz [ 494.086220][ T5698] usb 7-1: SerialNumber: syz [ 494.132639][ T5698] usb 7-1: config 0 descriptor?? [ 494.142021][ T5698] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 494.150637][ T5698] pctv452e: pctv452e_power_ctrl: 1 [ 494.150637][ T5698] [ 494.158168][ T5698] usb 7-1: selecting invalid altsetting 3 [ 494.164178][ T5698] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 494.164178][ T5698] [ 494.174687][ T5698] dvb-usb: bulk message failed: -22 (5/0) [ 494.184746][ T5698] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 494.195853][ T5698] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 494.205591][ T5698] usb 7-1: media controller created [ 494.213515][ T5698] dvb-usb: bulk message failed: -22 (8/0) [ 494.220943][ T5698] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 494.229045][ T5698] dvb-usb: MAC address reading failed. [ 494.245032][ T5698] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 494.301207][ T5698] DVB: Unable to find symbol stb0899_attach() [ 494.307435][ T5698] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 494.346614][ T9107] dvb-usb: bulk message failed: -22 (7/0) [ 494.353420][ T9107] pctv452e: I2C error -22; AA 02 00 00 00 -> aa 02 31 03 00 00 00 [ 494.622621][ T5698] rc_core: IR keymap rc-tt-1500 not found [ 494.622653][ T5698] Registered IR keymap rc-empty [ 494.623744][ T5698] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.6/usb7/7-1/rc/rc0 [ 494.658570][ T5698] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.6/usb7/7-1/rc/rc0/input54 [ 494.672832][ T5698] dvb-usb: schedule remote query interval to 100 msecs. [ 494.672870][ T5698] pctv452e: pctv452e_power_ctrl: 0 [ 494.672870][ T5698] [ 494.672882][ T5698] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 494.778319][ T5698] dvb-usb: bulk message failed: -22 (4/0) [ 494.778358][ T5698] dvb-usb: error -22 while querying for an remote control event. [ 495.523325][ T31] kauditd_printk_skb: 35 callbacks suppressed [ 495.523367][ T31] audit: type=1400 audit(1788962304.573:710): avc: denied { connect } for pid=9115 comm="syz.4.843" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 495.523411][ T31] audit: type=1400 audit(1788962304.593:711): avc: denied { name_bind } for pid=9115 comm="syz.4.843" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 495.574707][ T5698] dvb-usb: bulk message failed: -22 (4/0) [ 495.580620][ T5698] dvb-usb: error -22 while querying for an remote control event. [ 495.588491][ T31] audit: type=1400 audit(1788962305.173:712): avc: denied { write } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 495.588568][ T31] audit: type=1400 audit(1788962305.173:713): avc: denied { write } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 495.588627][ T31] audit: type=1400 audit(1788962305.173:714): avc: denied { write } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 495.912210][ T31] audit: type=1400 audit(1788962305.173:715): avc: denied { write } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 495.912247][ T31] audit: type=1400 audit(1788962305.183:716): avc: denied { write } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 495.968509][ T31] audit: type=1400 audit(1788962305.183:717): avc: denied { write } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 495.984711][ T31] audit: type=1400 audit(1788962305.553:718): avc: denied { write } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 495.984757][ T31] audit: type=1400 audit(1788962305.553:719): avc: denied { write } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 496.058900][ T5698] dvb-usb: bulk message failed: -22 (4/0) [ 496.058929][ T5698] dvb-usb: error -22 while querying for an remote control event. [ 496.168432][ T5698] dvb-usb: bulk message failed: -22 (4/0) [ 496.168496][ T5698] dvb-usb: error -22 while querying for an remote control event. [ 496.278385][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 496.278434][ T25] dvb-usb: error -22 while querying for an remote control event. [ 496.390082][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 496.390129][ T25] dvb-usb: error -22 while querying for an remote control event. [ 496.498366][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 496.504848][ T25] dvb-usb: error -22 while querying for an remote control event. [ 496.621909][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 496.621952][ T25] dvb-usb: error -22 while querying for an remote control event. [ 496.730580][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 496.736882][ T25] dvb-usb: error -22 while querying for an remote control event. [ 496.869595][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 496.869640][ T25] dvb-usb: error -22 while querying for an remote control event. [ 496.978325][ T5698] dvb-usb: bulk message failed: -22 (4/0) [ 496.985473][ T5698] dvb-usb: error -22 while querying for an remote control event. [ 497.098328][ T5698] dvb-usb: bulk message failed: -22 (4/0) [ 497.098371][ T5698] dvb-usb: error -22 while querying for an remote control event. [ 497.208439][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 497.214396][ T25] dvb-usb: error -22 while querying for an remote control event. [ 497.318429][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 497.318475][ T25] dvb-usb: error -22 while querying for an remote control event. [ 497.428274][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 497.428315][ T25] dvb-usb: error -22 while querying for an remote control event. [ 497.538287][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 497.538328][ T25] dvb-usb: error -22 while querying for an remote control event. [ 497.648425][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 497.654332][ T25] dvb-usb: error -22 while querying for an remote control event. [ 497.768560][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 497.768611][ T25] dvb-usb: error -22 while querying for an remote control event. [ 497.888331][ T25] dvb-usb: bulk message failed: -22 (4/0) [ 497.894270][ T25] dvb-usb: error -22 while querying for an remote control event. [ 497.993108][ T25] usb 7-1: USB disconnect, device number 7 [ 498.245231][ T25] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 498.778577][ T9138] loop5: detected capacity change from 0 to 1471 [ 498.813620][ T9133] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 498.863333][ T9138] loop5: detected capacity change from 1471 to 1919 [ 499.820979][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 500.530120][ T31] kauditd_printk_skb: 952 callbacks suppressed [ 500.530215][ T31] audit: type=1400 audit(1788962310.123:1672): avc: denied { search } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 500.569453][ T31] audit: type=1400 audit(1788962310.163:1673): avc: denied { write search } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 500.569738][ T31] audit: type=1400 audit(1788962310.163:1674): avc: denied { search } for pid=5602 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 500.570628][ T31] audit: type=1400 audit(1788962310.163:1675): avc: denied { search } for pid=5602 comm="syz-executor" name="instances" dev="tracefs" ino=4087 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 500.571080][ T31] audit: type=1400 audit(1788962310.163:1676): avc: denied { search } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 500.598861][ T31] audit: type=1400 audit(1788962310.193:1677): avc: denied { search } for pid=5602 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 500.599023][ T31] audit: type=1400 audit(1788962310.193:1678): avc: denied { search } for pid=5602 comm="syz-executor" name="instances" dev="tracefs" ino=4087 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 500.600064][ T31] audit: type=1400 audit(1788962310.193:1679): avc: denied { search } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 500.601074][ T31] audit: type=1400 audit(1788962310.193:1680): avc: denied { write search } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 500.601543][ T31] audit: type=1400 audit(1788962310.193:1681): avc: denied { search } for pid=5602 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 503.618435][ T9184] block nbd4: shutting down sockets [ 504.741517][ T9197] process 'syz.2.854' launched './file1' with NULL argv: empty string added [ 505.500356][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 505.500415][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 505.547291][ T31] kauditd_printk_skb: 2605 callbacks suppressed [ 505.547343][ T31] audit: type=1400 audit(1788962315.133:4287): avc: denied { write search } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 505.547376][ T31] audit: type=1400 audit(1788962315.133:4288): avc: denied { search } for pid=5602 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 505.547404][ T31] audit: type=1400 audit(1788962315.133:4289): avc: denied { search } for pid=5602 comm="syz-executor" name="instances" dev="tracefs" ino=4087 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 505.547433][ T31] audit: type=1400 audit(1788962315.133:4290): avc: denied { search } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 505.564963][ T31] audit: type=1400 audit(1788962315.143:4291): avc: denied { search } for pid=5602 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 505.565006][ T31] audit: type=1400 audit(1788962315.143:4292): avc: denied { search } for pid=5602 comm="syz-executor" name="instances" dev="tracefs" ino=4087 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 505.565038][ T31] audit: type=1400 audit(1788962315.143:4293): avc: denied { search } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 505.565068][ T31] audit: type=1400 audit(1788962315.143:4294): avc: denied { write search } for pid=5602 comm="syz-executor" name="foo" dev="tracefs" ino=14224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 505.565098][ T31] audit: type=1400 audit(1788962315.143:4295): avc: denied { search } for pid=5602 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 505.565128][ T31] audit: type=1400 audit(1788962315.143:4296): avc: denied { search } for pid=5602 comm="syz-executor" name="instances" dev="tracefs" ino=4087 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 505.959952][ T25] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 506.438327][ T25] usb 7-1: Using ep0 maxpacket: 16 [ 506.446954][ T25] usb 7-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 506.467796][ T25] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 506.467889][ T25] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 506.535155][ T25] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 506.558977][ T25] usb 7-1: Product: syz [ 506.559029][ T25] usb 7-1: Manufacturer: syz [ 506.559046][ T25] usb 7-1: SerialNumber: syz [ 506.585179][ T25] usb 7-1: config 0 descriptor?? [ 506.862554][ T5699] usb 7-1: USB disconnect, device number 8 [ 508.240816][ T9228] netlink: 'syz.4.870': attribute type 11 has an invalid length. [ 508.430189][ T9233] PKCS7: Unknown OID: [4] 2.19.16263.96.12508(bad) [ 508.430221][ T9233] PKCS7: Only support pkcs7_signedData type [ 508.464610][ T9235] netlink: 12 bytes leftover after parsing attributes in process `syz.4.870'. [ 508.464668][ T9235] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 508.498554][ T5757] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 508.649812][ T5757] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 508.664160][ T5757] usb 7-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0x79, changing to 0x9 [ 508.664215][ T5757] usb 7-1: config 0 interface 0 altsetting 255 endpoint 0x9 has invalid wMaxPacketSize 0 [ 508.667267][ T5757] usb 7-1: config 0 interface 0 has no altsetting 0 [ 508.700025][ T5757] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 508.700084][ T5757] usb 7-1: Product: syz [ 508.700096][ T5757] usb 7-1: Manufacturer: syz [ 508.700107][ T5757] usb 7-1: SerialNumber: syz [ 508.724473][ T5757] usb 7-1: config 0 descriptor?? [ 508.739729][ T5757] usb 7-1: selecting invalid altsetting 0 [ 508.977826][ T9234] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 508.991265][ T9234] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 509.272147][ T5757] usb 7-1: USB disconnect, device number 9 [ 509.556941][ T5832] udevd[5832]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 509.884466][ T9249] lo speed is unknown, defaulting to 1000 [ 509.884745][ T9249] lo speed is unknown, defaulting to 1000 [ 509.892960][ T9249] lo speed is unknown, defaulting to 1000 [ 509.902974][ T9249] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 509.903060][ T9249] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 509.903112][ T9249] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 510.038019][ T9249] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 510.222397][ T9249] lo speed is unknown, defaulting to 1000 [ 510.253221][ T9249] lo speed is unknown, defaulting to 1000 [ 510.279141][ T9249] lo speed is unknown, defaulting to 1000 [ 510.323457][ T9249] lo speed is unknown, defaulting to 1000 [ 510.344744][ T9249] lo speed is unknown, defaulting to 1000 [ 510.361601][ T9249] lo speed is unknown, defaulting to 1000 [ 510.906944][ T9253] FAULT_INJECTION: forcing a failure. [ 510.906944][ T9253] name fail_futex, interval 1, probability 0, space 0, times 0 [ 510.906992][ T9253] CPU: 1 UID: 0 PID: 9253 Comm: syz.2.877 Not tainted syzkaller #0 PREEMPT(full) [ 510.907016][ T9253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 510.907028][ T9253] Call Trace: [ 510.907037][ T9253] [ 510.907045][ T9253] dump_stack_lvl+0x100/0x190 [ 510.907078][ T9253] should_fail_ex.cold+0x5/0xa [ 510.907108][ T9253] get_futex_key+0x1d0/0x14f0 [ 510.907136][ T9253] ? __pfx_get_futex_key+0x10/0x10 [ 510.907168][ T9253] futex_wake+0xf4/0x5e0 [ 510.907199][ T9253] ? __pfx_futex_wake+0x10/0x10 [ 510.907227][ T9253] ? kasan_quarantine_put+0x104/0x240 [ 510.907254][ T9253] ? putname+0xb1/0x110 [ 510.907274][ T9253] ? kmem_cache_free+0x127/0x6c0 [ 510.907304][ T9253] do_futex+0x2b2/0x440 [ 510.907326][ T9253] ? __pfx_do_futex+0x10/0x10 [ 510.907346][ T9253] ? __pfx_do_sys_openat2+0x10/0x10 [ 510.907374][ T9253] __x64_sys_futex+0x34f/0x4d0 [ 510.907397][ T9253] ? __x64_sys_openat+0x12d/0x210 [ 510.907421][ T9253] ? __pfx___x64_sys_futex+0x10/0x10 [ 510.907455][ T9253] do_syscall_64+0x123/0x790 [ 510.907482][ T9253] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.907502][ T9253] RIP: 0033:0x7fac3cd9e159 [ 510.907518][ T9253] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 510.907536][ T9253] RSP: 002b:00007fac3dbdf0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 510.907555][ T9253] RAX: ffffffffffffffda RBX: 00007fac3d025fa8 RCX: 00007fac3cd9e159 [ 510.907565][ T9253] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fac3d025fac [ 510.907575][ T9253] RBP: 00007fac3d025fa0 R08: 0000000000000001 R09: 0000000000000000 [ 510.907586][ T9253] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 [ 510.907596][ T9253] R13: 00007fac3d026038 R14: 00007ffca1e24ba0 R15: 00007ffca1e24c88 [ 510.907615][ T9253] [ 511.097290][ T31] kauditd_printk_skb: 3788 callbacks suppressed [ 511.097308][ T31] audit: type=1400 audit(1788962320.693:8085): avc: denied { read } for pid=9256 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 511.123452][ T31] audit: type=1400 audit(1788962320.693:8086): avc: denied { open } for pid=9256 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 511.128527][ T31] audit: type=1400 audit(1788962320.713:8087): avc: denied { ioctl } for pid=9256 comm="syz-executor" path="socket:[22734]" dev="sockfs" ino=22734 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 511.148822][ T9259] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 511.157804][ T53] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 511.174661][ T53] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 511.215596][ T9260] 9pnet_virtio: no channels available for device syz [ 511.230602][ T53] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 511.263821][ T53] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 511.272428][ T31] audit: type=1400 audit(1788962320.863:8088): avc: denied { mounton } for pid=9256 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 511.383388][ T9260] netlink: 48 bytes leftover after parsing attributes in process `syz.4.878'. [ 511.426666][ T9260] tmpfs: Unknown parameter 'usrquotad' [ 511.426802][ T31] audit: type=1400 audit(1788962321.013:8089): avc: denied { mounton } for pid=9254 comm="syz.4.878" path="/syzcgroup/cpu/syz4/cgroup.procs" dev="cgroup" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 511.491125][ T9255] pim6reg: entered allmulticast mode [ 511.494466][ T9257] pim6reg: left allmulticast mode [ 511.540920][ T31] audit: type=1400 audit(1788962321.133:8090): avc: denied { sys_module } for pid=9256 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 511.652244][ T9268] netlink: 4 bytes leftover after parsing attributes in process `syz.5.879'. [ 511.753149][ T31] audit: type=1400 audit(1788962321.343:8091): avc: denied { read } for pid=9269 comm="syz.2.881" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 511.753392][ T31] audit: type=1400 audit(1788962321.343:8092): avc: denied { open } for pid=9269 comm="syz.2.881" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 511.851159][ T31] audit: type=1400 audit(1788962321.433:8093): avc: denied { ioctl } for pid=9269 comm="syz.2.881" path="/dev/binderfs/binder0" dev="binder" ino=4 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 511.851289][ T9270] binder: 9269:9270 ioctl c0306201 200000000180 returned -14 [ 511.958733][ T31] audit: type=1400 audit(1788962321.543:8094): avc: denied { write } for pid=9272 comm="syz.6.882" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 512.148552][ T9281] FAULT_INJECTION: forcing a failure. [ 512.148552][ T9281] name failslab, interval 1, probability 0, space 0, times 0 [ 512.148607][ T9281] CPU: 1 UID: 0 PID: 9281 Comm: syz.2.884 Not tainted syzkaller #0 PREEMPT(full) [ 512.148632][ T9281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 512.148645][ T9281] Call Trace: [ 512.148652][ T9281] [ 512.148660][ T9281] dump_stack_lvl+0x100/0x190 [ 512.148693][ T9281] should_fail_ex.cold+0x5/0xa [ 512.148722][ T9281] should_failslab+0xc2/0x120 [ 512.148749][ T9281] __kmalloc_cache_noprof+0x91/0x6d0 [ 512.148776][ T9281] ? x509_cert_parse+0x162/0x910 [ 512.148807][ T9281] x509_cert_parse+0x162/0x910 [ 512.148833][ T9281] x509_key_preparse+0x65/0x9c0 [ 512.148858][ T9281] asymmetric_key_preparse+0xce/0x1d0 [ 512.148878][ T9281] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 512.148900][ T9281] __key_create_or_update+0x463/0xe30 [ 512.148922][ T9281] ? __pfx___key_create_or_update+0x10/0x10 [ 512.148942][ T9281] ? lookup_user_key+0x3f3/0x1300 [ 512.148977][ T9281] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 512.149009][ T9281] key_create_or_update+0x42/0x60 [ 512.149029][ T9281] __do_sys_add_key+0x2e8/0x460 [ 512.149052][ T9281] ? __pfx___do_sys_add_key+0x10/0x10 [ 512.149082][ T9281] do_syscall_64+0x123/0x790 [ 512.149105][ T9281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.149122][ T9281] RIP: 0033:0x7fac3cd9e159 [ 512.149137][ T9281] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 512.149151][ T9281] RSP: 002b:00007fac3dbdf028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 512.149168][ T9281] RAX: ffffffffffffffda RBX: 00007fac3d025fa0 RCX: 00007fac3cd9e159 [ 512.149179][ T9281] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 512.149189][ T9281] RBP: 00007fac3ce3503b R08: ffffffffffffffff R09: 0000000000000000 [ 512.149199][ T9281] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 [ 512.149209][ T9281] R13: 00007fac3d026038 R14: 00007fac3d025fa0 R15: 00007ffca1e24c88 [ 512.149233][ T9281] [ 512.544933][ T4725] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.803343][ T9289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.803718][ T9289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 513.151138][ T4725] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.338383][ T53] Bluetooth: hci1: command tx timeout [ 513.491043][ T9298] netlink: 20 bytes leftover after parsing attributes in process `syz.5.891'. [ 513.666722][ T9300] FAULT_INJECTION: forcing a failure. [ 513.666722][ T9300] name failslab, interval 1, probability 0, space 0, times 0 [ 513.666789][ T9300] CPU: 1 UID: 0 PID: 9300 Comm: syz.6.890 Not tainted syzkaller #0 PREEMPT(full) [ 513.666814][ T9300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 513.666826][ T9300] Call Trace: [ 513.666834][ T9300] [ 513.666842][ T9300] dump_stack_lvl+0x100/0x190 [ 513.666877][ T9300] should_fail_ex.cold+0x5/0xa [ 513.666902][ T9300] ? __pfx_binderfs_fill_super+0x10/0x10 [ 513.667004][ T9300] should_failslab+0xc2/0x120 [ 513.667027][ T9300] ? __pfx_binderfs_fill_super+0x10/0x10 [ 513.667050][ T9300] __kmalloc_cache_noprof+0x91/0x6d0 [ 513.667077][ T9300] ? binderfs_fill_super+0x1f1/0x13d0 [ 513.667101][ T9300] ? __pfx_binderfs_fill_super+0x10/0x10 [ 513.667121][ T9300] binderfs_fill_super+0x1f1/0x13d0 [ 513.667145][ T9300] ? __pfx_binderfs_fill_super+0x10/0x10 [ 513.667165][ T9300] ? __init_swait_queue_head+0xca/0x150 [ 513.667205][ T9300] ? rcu_is_watching+0x13/0xc0 [ 513.667226][ T9300] ? cap_capable+0x107/0x430 [ 513.667255][ T9300] ? __pfx_binderfs_fill_super+0x10/0x10 [ 513.667276][ T9300] get_tree_nodev+0xdd/0x190 [ 513.667295][ T9300] vfs_get_tree+0x92/0x320 [ 513.667318][ T9300] path_mount+0x7d0/0x24c0 [ 513.667347][ T9300] ? __pfx_path_mount+0x10/0x10 [ 513.667371][ T9300] ? lockdep_hardirqs_on+0x7d/0x110 [ 513.667398][ T9300] ? putname+0xb1/0x110 [ 513.667417][ T9300] ? kmem_cache_free+0x127/0x6c0 [ 513.667449][ T9300] ? __x64_sys_mount+0x293/0x310 [ 513.667471][ T9300] __x64_sys_mount+0x293/0x310 [ 513.667493][ T9300] ? __pfx___x64_sys_mount+0x10/0x10 [ 513.667522][ T9300] do_syscall_64+0x123/0x790 [ 513.667544][ T9300] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.667562][ T9300] RIP: 0033:0x7f481d79e159 [ 513.667577][ T9300] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 513.667592][ T9300] RSP: 002b:00007f481e6b5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 513.667611][ T9300] RAX: ffffffffffffffda RBX: 00007f481da25fa0 RCX: 00007f481d79e159 [ 513.667622][ T9300] RDX: 0000200000000040 RSI: 0000200000000080 RDI: 0000200000000300 [ 513.667632][ T9300] RBP: 00007f481d83503b R08: 0000000000000000 R09: 0000000000000000 [ 513.667642][ T9300] R10: 0000000002200892 R11: 0000000000000246 R12: 0000000000000000 [ 513.667652][ T9300] R13: 00007f481da26038 R14: 00007f481da25fa0 R15: 00007ffc01ce0848 [ 513.667675][ T9300] [ 513.702534][ T4725] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.070720][ T4725] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.128083][ T9256] lo speed is unknown, defaulting to 1000 [ 514.739065][ T9316] netlink: 12 bytes leftover after parsing attributes in process `syz.5.895'. [ 515.387070][ T9321] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.387446][ T9321] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.418383][ T53] Bluetooth: hci1: command tx timeout [ 515.432997][ T9320] netlink: 40 bytes leftover after parsing attributes in process `syz.2.896'. [ 515.553672][ T9321] nvme_fabrics: missing parameter 'transport=%s' [ 515.560918][ T9321] nvme_fabrics: missing parameter 'nqn=%s' [ 516.988465][ T5699] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 517.141187][ T5699] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 517.175160][ T5699] usb 6-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 517.175217][ T5699] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 517.175256][ T5699] usb 6-1: config 0 interface 0 has no altsetting 0 [ 517.224568][ T5699] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 517.224618][ T5699] usb 6-1: Product: syz [ 517.224647][ T5699] usb 6-1: Manufacturer: syz [ 517.224663][ T5699] usb 6-1: SerialNumber: syz [ 517.250347][ T5699] usb 6-1: config 0 descriptor?? [ 517.268583][ T5699] usb 6-1: selecting invalid altsetting 0 [ 517.306055][ T31] kauditd_printk_skb: 23 callbacks suppressed [ 517.306094][ T31] audit: type=1400 audit(1788962326.893:8118): avc: denied { mount } for pid=9326 comm="syz.2.898" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 517.353674][ T31] audit: type=1400 audit(1788962326.943:8119): avc: denied { unmount } for pid=5604 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 517.401398][ T4725] bridge_slave_1: left allmulticast mode [ 517.401442][ T4725] bridge_slave_1: left promiscuous mode [ 517.401641][ T4725] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.444960][ T4725] bridge_slave_0: left allmulticast mode [ 517.445002][ T4725] bridge_slave_0: left promiscuous mode [ 517.445190][ T4725] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.498443][ T53] Bluetooth: hci1: command tx timeout [ 517.598799][ T4725] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 517.679195][ T31] audit: type=1400 audit(1788962327.273:8120): avc: denied { read } for pid=9335 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 517.704843][ T31] audit: type=1400 audit(1788962327.293:8121): avc: denied { read open } for pid=9335 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 517.735856][ T31] audit: type=1400 audit(1788962327.323:8122): avc: denied { getattr } for pid=9335 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 517.783392][ T30] usb 6-1: USB disconnect, device number 20 [ 517.957761][ T31] audit: type=1400 audit(1788962327.543:8123): avc: denied { map } for pid=9334 comm="syz.2.900" path="socket:[23102]" dev="sockfs" ino=23102 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 518.270593][ T31] audit: type=1400 audit(1788962327.803:8124): avc: denied { create } for pid=9334 comm="syz.2.900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 518.270747][ T31] audit: type=1400 audit(1788962327.813:8125): avc: denied { bind } for pid=9334 comm="syz.2.900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 518.288816][ T9341] cgroup: Unknown subsys name 'rlimit' [ 518.735320][ T31] audit: type=1400 audit(1788962328.323:8126): avc: denied { setopt } for pid=9344 comm="syz.4.901" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 519.578459][ T53] Bluetooth: hci1: command tx timeout [ 520.884972][ T31] audit: type=1400 audit(1788962330.473:8127): avc: denied { bind } for pid=9351 comm="syz.4.903" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 521.003937][ T4725] batman_adv: batadv0: Removing interface: ip6gretap1 [ 521.273821][ T4725] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 521.344916][ T4725] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 521.436179][ T4725] bond0 (unregistering): (slave team0): Releasing backup interface [ 521.490077][ T4725] bond0 (unregistering): Released all slaves [ 521.511050][ T4725] bond1 (unregistering): Released all slaves [ 521.552547][ T1453] smbdirect: ib_dev[syz5] removed [ 521.668269][ T5699] usb 3-1: new full-speed USB device number 62 using dummy_hcd [ 521.815007][ T9357] 0ªî{X¹¦: left allmulticast mode [ 521.831239][ T5699] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 521.842708][ T5699] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 521.842751][ T5699] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 521.842780][ T5699] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 521.886022][ T5699] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.886060][ T5699] usb 3-1: Product: syz [ 521.886087][ T5699] usb 3-1: Manufacturer: syz [ 521.886104][ T5699] usb 3-1: SerialNumber: syz [ 521.911808][ T5699] usb 3-1: config 0 descriptor?? [ 521.917575][ T9369] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 522.008257][ T5699] rc_core: IR keymap rc-streamzap not found [ 522.014468][ T53] Bluetooth: hci5: ACL packet for unknown connection handle 201 [ 522.014543][ T5699] Registered IR keymap rc-empty [ 522.015456][ T5699] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 522.046207][ T5699] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input55 [ 522.143964][ T9357] bridge0: port 2(bridge_slave_1) entered disabled state [ 522.144893][ T9357] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.235886][ T5757] infiniband syz5: ib_query_port failed (-19) [ 522.238539][ T5757] usb 3-1: USB disconnect, device number 62 [ 523.548420][ T5268] 8021q: adding VLAN 0 to HW filter on device eth5 [ 523.866607][ T4725] rxrpc: Leaked peer 18b {1} [0000:0000:0000:0000:0000:0000:0000:0000]:7003 [ 523.879844][ T31] kauditd_printk_skb: 17 callbacks suppressed [ 523.879882][ T31] audit: type=1400 audit(1788962333.463:8145): avc: denied { mount } for pid=9389 comm="syz.2.910" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 523.920022][ T31] audit: type=1400 audit(1788962333.503:8146): avc: denied { unmount } for pid=5604 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 524.157910][ T31] audit: type=1400 audit(1788962333.743:8147): avc: denied { write } for pid=9396 comm="syz.5.912" name="event0" dev="devtmpfs" ino=912 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 524.157971][ T31] audit: type=1400 audit(1788962333.743:8148): avc: denied { open } for pid=9396 comm="syz.5.912" path="/dev/input/event0" dev="devtmpfs" ino=912 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 524.229874][ T31] audit: type=1400 audit(1788962333.823:8149): avc: denied { ioctl } for pid=9396 comm="syz.5.912" path="/dev/input/event0" dev="devtmpfs" ino=912 ioctlcmd=0x4518 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 524.232761][ T9256] bridge0: port 1(bridge_slave_0) entered blocking state [ 524.232890][ T9256] bridge0: port 1(bridge_slave_0) entered disabled state [ 524.233008][ T9256] bridge_slave_0: entered allmulticast mode [ 524.255439][ T9256] bridge_slave_0: entered promiscuous mode [ 524.271224][ T9256] bridge0: port 2(bridge_slave_1) entered blocking state [ 524.271301][ T9256] bridge0: port 2(bridge_slave_1) entered disabled state [ 524.271416][ T9256] bridge_slave_1: entered allmulticast mode [ 524.276331][ T9256] bridge_slave_1: entered promiscuous mode [ 524.694728][ T9256] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 524.721332][ T9256] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 524.822185][ T31] audit: type=1400 audit(1788962334.413:8150): avc: denied { setopt } for pid=9410 comm="syz.5.913" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 524.846982][ T31] audit: type=1400 audit(1788962334.433:8151): avc: denied { getopt } for pid=9410 comm="syz.5.913" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 525.125047][ T9256] team0: Port device team_slave_0 added [ 525.156577][ T9256] team0: Port device team_slave_1 added [ 525.422601][ T4725] hsr_slave_0: left promiscuous mode [ 525.457669][ T4725] hsr_slave_1: left promiscuous mode [ 525.461967][ T4725] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 525.461989][ T4725] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 525.482481][ T4725] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 525.482546][ T4725] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 525.492727][ T31] audit: type=1400 audit(1788962335.083:8152): avc: denied { write } for pid=9399 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 525.601447][ T4725] veth1_macvtap: left promiscuous mode [ 525.601511][ T4725] veth0_macvtap: left promiscuous mode [ 525.601577][ T4725] veth1_vlan: left promiscuous mode [ 525.601643][ T4725] veth0_vlan: left promiscuous mode [ 525.927096][ T31] audit: type=1400 audit(1788962335.513:8153): avc: denied { write } for pid=9425 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 526.658784][ T9433] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 526.658784][ T9433] [ 526.659028][ T9433] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 526.659520][ T9433] CIFS: Attempting to mount //127.0.0.1/share [ 526.792667][ T31] audit: type=1400 audit(1788962336.383:8154): avc: denied { ioctl } for pid=9432 comm="syz.6.915" path="socket:[23276]" dev="sockfs" ino=23276 ioctlcmd=0x8b1a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 527.176940][ T9440] netlink: 4 bytes leftover after parsing attributes in process `syz.2.916'. [ 527.423723][ T4725] team0 (unregistering): Port device team_slave_1 removed [ 527.468937][ T4725] team0 (unregistering): Port device team_slave_0 removed [ 527.495960][ T9433] CIFS: VFS: cifs_mount failed w/return code = -112 [ 527.796614][ T9256] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 527.796657][ T9256] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 527.796898][ T9256] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 527.800364][ T9256] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 527.800380][ T9256] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 527.800400][ T9256] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 527.966084][ T5268] 8021q: adding VLAN 0 to HW filter on device eth6 [ 528.608619][ T9256] hsr_slave_0: entered promiscuous mode [ 528.609410][ T9256] hsr_slave_1: entered promiscuous mode [ 528.621788][ T9256] debugfs: 'hsr0' already exists in 'hsr' [ 528.621824][ T9256] Cannot create hsr debugfs directory [ 529.276268][ T9463] 9pnet_virtio: no channels available for device syz [ 529.908510][ T9462] pim6reg: entered allmulticast mode [ 530.761588][ T31] kauditd_printk_skb: 8 callbacks suppressed [ 530.761632][ T31] audit: type=1400 audit(1788962340.353:8163): avc: denied { unmount } for pid=7658 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 530.802958][ T31] audit: type=1400 audit(1788962340.393:8164): avc: denied { unmount } for pid=7658 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 530.986257][ T31] audit: type=1400 audit(1788962340.573:8165): avc: denied { connect } for pid=9449 comm="syz.2.919" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 531.083427][ T9469] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 531.182844][ T31] audit: type=1400 audit(1788962340.773:8166): avc: denied { create } for pid=9468 comm="syz.5.922" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 531.240784][ T31] audit: type=1326 audit(1788962340.833:8167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9449 comm="syz.2.919" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac3cd9e159 code=0x7ffc0000 [ 531.274270][ T31] audit: type=1326 audit(1788962340.833:8168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9449 comm="syz.2.919" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=92 compat=0 ip=0x7fac3cd9e159 code=0x7ffc0000 [ 531.288887][ T31] audit: type=1326 audit(1788962340.833:8169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9449 comm="syz.2.919" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac3cd9e159 code=0x7ffc0000 [ 531.288931][ T31] audit: type=1326 audit(1788962340.833:8170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9449 comm="syz.2.919" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac3cd9e159 code=0x7ffc0000 [ 531.321213][ T31] audit: type=1400 audit(1788962340.893:8171): avc: denied { create } for pid=9474 comm="syz.6.923" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 531.336328][ T31] audit: type=1400 audit(1788962340.923:8172): avc: denied { bind } for pid=9474 comm="syz.6.923" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 531.826438][ T9256] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 531.860292][ T9256] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 531.868971][ T9256] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 531.896370][ T9256] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 531.914964][ T9256] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 531.958232][ T9256] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 531.958883][ T9256] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 531.995258][ T9256] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 532.176204][ T5268] 8021q: adding VLAN 0 to HW filter on device eth7 [ 532.460762][ T9256] 8021q: adding VLAN 0 to HW filter on device bond0 [ 532.527860][ T9256] 8021q: adding VLAN 0 to HW filter on device team0 [ 532.543228][ T4746] bridge0: port 1(bridge_slave_0) entered blocking state [ 532.543318][ T4746] bridge0: port 1(bridge_slave_0) entered forwarding state [ 532.585045][ T4725] bridge0: port 2(bridge_slave_1) entered blocking state [ 532.585162][ T4725] bridge0: port 2(bridge_slave_1) entered forwarding state [ 533.050371][ T9513] 9pnet_virtio: no channels available for device syz [ 533.190585][ T9506] netlink: 8 bytes leftover after parsing attributes in process `syz.5.928'. [ 533.566717][ T9520] team0: Device veth0_vlan failed to register rx_handler [ 533.813709][ T5699] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 533.833449][ T9513] gadgetfs: bound to dummy_udc driver [ 534.015662][ T5699] usb 6-1: Using ep0 maxpacket: 8 [ 534.058767][ T5699] usb 6-1: New USB device found, idVendor=0582, idProduct=e6ca, bcdDevice=d3.0b [ 534.077715][ T5699] usb 6-1: config 3 has an invalid interface number: 45 but max is 0 [ 534.086258][ T5699] usb 6-1: config 3 contains an unexpected descriptor of type 0x1, skipping [ 534.086318][ T5699] usb 6-1: config 3 has no interface number 0 [ 534.102595][ T5699] usb 6-1: config 3 interface 45 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 534.115818][ T5699] usb 6-1: config 3 interface 45 has no altsetting 0 [ 534.202967][ T5699] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.203020][ T5699] usb 6-1: Product: syz [ 534.217125][ T5699] usb 6-1: Manufacturer: syz [ 534.217179][ T5699] usb 6-1: SerialNumber: syz [ 535.451890][ T9506] fuse: Unknown parameter 'use00000000000000000000' [ 535.915694][ T5699] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 536.015365][ T31] kauditd_printk_skb: 12 callbacks suppressed [ 536.015407][ T31] audit: type=1400 audit(1788962345.603:8185): avc: denied { write } for pid=9530 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 536.291586][ T5698] usb 5-1: USB disconnect, device number 33 [ 536.321697][ T5699] usb 6-1: USB disconnect, device number 21 [ 536.471976][ T5832] udevd[5832]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:3.45/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 536.523396][ T5268] 8021q: adding VLAN 0 to HW filter on device eth8 [ 536.748021][ T31] audit: type=1400 audit(1788962346.333:8186): avc: denied { unmount } for pid=8356 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 536.857118][ T5615] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 536.875180][ T5615] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 536.888422][ T5615] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 536.901948][ T5615] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 536.912006][ T5615] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 537.031250][ T9256] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 538.164148][ T9552] netlink: zone id is out of range [ 538.164180][ T9552] netlink: zone id is out of range [ 538.164204][ T9552] netlink: zone id is out of range [ 538.164215][ T9552] netlink: zone id is out of range [ 538.164226][ T9552] netlink: zone id is out of range [ 539.081528][ T53] Bluetooth: hci6: command tx timeout [ 540.074357][ T9576] syzkaller0: entered promiscuous mode [ 540.080183][ T9576] syzkaller0: entered allmulticast mode [ 540.325651][ T9543] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 540.419016][ T31] audit: type=1400 audit(1788962350.013:8187): avc: denied { write } for pid=9584 comm="syz.5.939" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 540.454790][ T31] audit: type=1400 audit(1788962350.043:8188): avc: denied { set_context_mgr } for pid=9584 comm="syz.5.939" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 540.493803][ T31] audit: type=1400 audit(1788962350.083:8189): avc: denied { mount } for pid=9584 comm="syz.5.939" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 540.543902][ T9256] veth0_vlan: entered promiscuous mode [ 540.559436][ T31] audit: type=1400 audit(1788962350.153:8190): avc: denied { map } for pid=9584 comm="syz.5.939" path="/dev/binderfs/binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 540.638455][ T9256] veth1_vlan: entered promiscuous mode [ 540.648012][ T9587] pim6reg: left allmulticast mode [ 540.687904][ T9256] veth0_macvtap: entered promiscuous mode [ 540.694857][ T31] audit: type=1400 audit(1788962350.273:8191): avc: denied { call } for pid=9584 comm="syz.5.939" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 540.717638][ T9587] 9pnet_virtio: no channels available for device syz [ 540.726155][ T9585] binder: 9584:9585 ioctl c0306201 200000000280 returned -14 [ 540.740109][ T9256] veth1_macvtap: entered promiscuous mode [ 540.773171][ T9256] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 540.786824][ T9256] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 540.827566][ T9542] lo speed is unknown, defaulting to 1000 [ 540.834834][ T31] audit: type=1400 audit(1788962350.423:8192): avc: denied { unmount } for pid=7658 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 540.838358][ T4746] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.838395][ T4746] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.838421][ T4746] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.838451][ T4746] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 541.099995][ T53] Bluetooth: hci6: command tx timeout [ 541.579128][ T31] audit: type=1400 audit(1788962351.003:8193): avc: denied { create } for pid=9597 comm="syz.6.941" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 541.741465][ T5757] libceph: connect (1)[c::]:6789 error -101 [ 541.756613][ T5757] libceph: mon0 (1)[c::]:6789 connect error [ 542.165955][ T5757] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 542.184115][ T8700] libceph: connect (1)[c::]:6789 error -101 [ 542.190417][ T8700] libceph: mon0 (1)[c::]:6789 connect error [ 542.218473][ T9602] ceph: No mds server is up or the cluster is laggy [ 542.328495][ T5757] usb 7-1: Using ep0 maxpacket: 8 [ 542.329896][ T5757] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 542.331299][ T5757] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 542.331355][ T5757] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 542.331394][ T5757] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 542.331424][ T5757] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 542.331454][ T5757] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 542.331493][ T5757] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.550427][ T5757] usb 7-1: usb_control_msg returned -32 [ 542.550474][ T5757] usbtmc 7-1:16.0: can't read capabilities [ 542.680141][ T4614] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 542.680174][ T4614] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 542.794669][ T31] audit: type=1400 audit(1788962352.383:8194): avc: denied { write } for pid=9614 comm="syz.5.944" name="netlink" dev="proc" ino=4026533576 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 542.812728][ T5339] usb 7-1: USB disconnect, device number 10 [ 542.853025][ T31] audit: type=1400 audit(1788962352.443:8195): avc: denied { read write } for pid=9614 comm="syz.5.944" name="nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 542.855379][ T31] audit: type=1400 audit(1788962352.443:8196): avc: denied { open } for pid=9614 comm="syz.5.944" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 542.873807][ T31] audit: type=1400 audit(1788962352.463:8197): avc: denied { read write } for pid=9614 comm="syz.5.944" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 542.874245][ T31] audit: type=1400 audit(1788962352.463:8198): avc: denied { open } for pid=9614 comm="syz.5.944" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 543.004695][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 543.004735][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 543.072018][ T31] audit: type=1400 audit(1788962352.663:8199): avc: denied { mounton } for pid=9256 comm="syz-executor" path="/root/syzkaller.uW0rUL/syz-tmp" dev="sda1" ino=2054 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 543.076749][ T31] audit: type=1400 audit(1788962352.663:8200): avc: denied { mount } for pid=9256 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 543.104855][ T31] audit: type=1400 audit(1788962352.693:8201): avc: denied { mounton } for pid=9256 comm="syz-executor" path="/root/syzkaller.uW0rUL/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 543.105696][ T31] audit: type=1400 audit(1788962352.693:8202): avc: denied { mounton } for pid=9256 comm="syz-executor" path="/root/syzkaller.uW0rUL/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=24224 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 543.188935][ T53] Bluetooth: hci6: command tx timeout [ 543.430584][ T9542] bridge0: port 1(bridge_slave_0) entered blocking state [ 543.441534][ T9542] bridge0: port 1(bridge_slave_0) entered disabled state [ 543.441715][ T9542] bridge_slave_0: entered allmulticast mode [ 543.460349][ T9542] bridge_slave_0: entered promiscuous mode [ 543.468583][ T53] Bluetooth: hci3: ACL packet too small [ 543.477692][ T9542] bridge0: port 2(bridge_slave_1) entered blocking state [ 543.495864][ T9542] bridge0: port 2(bridge_slave_1) entered disabled state [ 543.503845][ T9542] bridge_slave_1: entered allmulticast mode [ 543.521315][ T9542] bridge_slave_1: entered promiscuous mode [ 543.539848][ T9629] 9pnet_virtio: no channels available for device syz [ 543.671085][ T9542] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 543.750474][ T9542] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 543.918998][ T9633] netlink: 28 bytes leftover after parsing attributes in process `syz.7.948'. [ 543.932976][ T9542] team0: Port device team_slave_0 added [ 543.943322][ T9542] team0: Port device team_slave_1 added [ 543.986924][ T9542] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 543.994315][ T9542] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 544.021454][ T9542] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 544.037939][ T9542] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 544.045027][ T9542] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 544.068488][ T9542] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 544.175164][ T9640] input: syz1 as /devices/virtual/input/input56 [ 544.237458][ T9542] hsr_slave_0: entered promiscuous mode [ 544.244766][ T9542] hsr_slave_1: entered promiscuous mode [ 544.254879][ T9542] debugfs: 'hsr0' already exists in 'hsr' [ 544.260867][ T9542] Cannot create hsr debugfs directory [ 545.180657][ T32] INFO: task syz.0.617:8228 blocked for more than 143 seconds. [ 545.180709][ T32] Not tainted syzkaller #0 [ 545.180729][ T32] "echo 0 > /proc/sys/kernel/hung_task_time ** replaying previous printk message ** [ 545.180729][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 545.180740][ T32] task:syz.0.617 state:D stack:28280 pid:8228 tgid:8225 ppid:5607 task_flags:0x400140 flags:0x00080002 [ 545.180801][ T32] Call Trace: [ 545.180810][ T32] [ 545.180823][ T32] __schedule+0x1259/0x6920 [ 545.180851][ T32] ? __lock_acquire+0x5c0/0x1f40 [ 545.180880][ T32] ? do_raw_spin_lock+0x128/0x260 [ 545.180911][ T32] ? __pfx___schedule+0x10/0x10 [ 545.180933][ T32] ? find_held_lock+0x2b/0x80 [ 545.180966][ T32] ? schedule+0x225/0x2c0 [ 545.180995][ T32] schedule+0xdd/0x2c0 [ 545.181014][ T32] schedule_preempt_disabled+0x13/0x30 [ 545.181031][ T32] __mutex_lock+0xccb/0x1bd0 [ 545.181050][ T32] ? usbdev_open+0x1b6/0x870 [ 545.181106][ T32] ? klist_put+0xcb/0x1d0 [ 545.181202][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 545.181221][ T32] ? _raw_spin_unlock+0x28/0x50 [ 545.181239][ T32] ? kobject_put+0xb9/0x640 [ 545.181266][ T32] ? __pfx_bus_find_device+0x10/0x10 [ 545.181344][ T32] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 545.181385][ T32] ? usbdev_open+0x9d/0x870 [ 545.181413][ T32] ? usbdev_open+0x1b6/0x870 [ 545.181435][ T32] usbdev_open+0x1b6/0x870 [ 545.181461][ T32] ? kobject_get_unless_zero+0x156/0x200 [ 545.181486][ T32] ? __pfx_usbdev_open+0x10/0x10 [ 545.181507][ T32] ? chrdev_open+0x10b/0x6a0 [ 545.181525][ T32] ? chrdev_open+0x10b/0x6a0 [ 545.181548][ T32] ? __pfx_usbdev_open+0x10/0x10 [ 545.181571][ T32] chrdev_open+0x234/0x6a0 [ 545.181591][ T32] ? __pfx_chrdev_open+0x10/0x10 [ 545.181612][ T32] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 545.181641][ T32] do_dentry_open+0x6ab/0x14d0 [ 545.181659][ T32] ? __pfx_chrdev_open+0x10/0x10 [ 545.181683][ T32] vfs_open+0x82/0x3f0 [ 545.181707][ T32] path_openat+0x19fa/0x2440 [ 545.181731][ T32] ? __pfx_path_openat+0x10/0x10 [ 545.181758][ T32] do_file_open+0x20e/0x430 [ 545.181780][ T32] ? __pfx_do_file_open+0x10/0x10 [ 545.181817][ T32] ? _raw_spin_unlock+0x28/0x50 [ 545.181835][ T32] ? alloc_fd+0x471/0x7a0 [ 545.181863][ T32] do_sys_openat2+0x10f/0x1e0 [ 545.181885][ T32] ? __pfx_do_sys_openat2+0x10/0x10 [ 545.181915][ T32] __x64_sys_openat+0x12d/0x210 [ 545.181938][ T32] ? __pfx___x64_sys_openat+0x10/0x10 [ 545.181969][ T32] do_syscall_64+0x123/0x790 [ 545.181993][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 545.182011][ T32] RIP: 0033:0x7f983d15e98e [ 545.182026][ T32] RSP: 002b:00007f983e01db28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 545.182044][ T32] RAX: ffffffffffffffda RBX: 00007f983e01e6c0 RCX: 00007f983d15e98e [ 545.182056][ T32] RDX: 0000000000101701 RSI: 00007f983e01dc00 RDI: ffffffffffffff9c [ 545.182068][ T32] RBP: 00007f983e01dc00 R08: 0000000000000000 R09: 0000000000000000 [ 545.182079][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 545.182090][ T32] R13: 00007f983d426128 R14: 00007f983d426090 R15: 00007ffe36994328 [ 545.182114][ T32] [ 545.182143][ T32] [ 545.182143][ T32] Showing all locks held in the system: [ 545.182152][ T32] locks held by kworker/0:1/10: 5, last CPU#0: [ 545.182164][ T32] #0: ffff888021e8d540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 545.182212][ T32] #1: ffffc900000f7d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 545.182259][ T32] #2: ffff88802b0951d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 [ 545.182315][ T32] #3: ffff88802cb671d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 [ 545.182361][ T32] #4: ffff88802cb601a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 [ 545.182400][ T32] locks held by pr/ttyS0/16: 2, last CPU#1: [ 545.182412][ T32] #0: ffffffff8edd85b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 [ 545.182454][ T32] #1: ffffffff9bc67c78 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x64/0xc0 [ 545.182535][ T32] locks held by kworker/1:0/25: 3, on CPU#1: [ 545.182547][ T32] #0: ffff88801c05b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 545.182593][ T32] #1: ffffc900001f7d08 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 545.182639][ T32] #2: ffffffff90cd0580 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 545.182691][ T32] locks held by khungtaskd/32: 1, last CPU#0: [ 545.182702][ T32] #0: ffffffff8edec2e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 545.186185][ T32] locks held by getty/5363: 2, on CPU#1: [ 545.186203][ T32] #0: ffff888035f7b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 545.186257][ T32] #1: ffffc900032262e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 545.186390][ T32] locks held by kworker/u8:7/8130: 2, last CPU#1: [ 545.186404][ T32] #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 545.186456][ T32] #1: ffffc90002ecfd08 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 545.186502][ T32] locks held by syz.0.617/8228: 1, on CPU#0: [ 545.186515][ T32] #0: ffff88802b0951d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 [ 545.186566][ T32] locks held by syz.4.903/9365: 1, on CPU#1: [ 545.186578][ T32] #0: ffff88802b0951d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 [ 545.186623][ T32] locks held by syz-executor/9542: 6, last CPU#1: [ 545.186635][ T32] #0: ffff88802d8ae460 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 545.186677][ T32] #1: ffff888058c50c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 545.186717][ T32] #2: ffff88802a6eab48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 545.186769][ T32] #3: ffffffff90236b00 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0xfe/0x6d0 [ 545.186853][ T32] #4: ffff88802bcbf128 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 [ 545.186893][ T32] #5: ffff88802bcba258 (&devlink->lock_key#9){+.+.}-{4:4}, at: nsim_drv_probe+0xcd/0x1350 [ 545.186946][ T32] locks held by syz.5.951/9647: 2, last CPU#1: [ 545.186959][ T32] #0: ffff88802d4cf678 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 [ 545.187002][ T32] #1: ffffffff8edec2e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 [ 545.187039][ T32] locks held by syz.7.952/9651: 1, last CPU#1: [ 545.187051][ T32] #0: ffffffff90cd0580 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x371/0xe90 [ 545.187157][ T32] locks held by syz.6.953/9654: 1, last CPU#1: [ 545.187169][ T32] #0: ffff88807c195038 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x35/0x6f0 [ 545.187218][ T32] [ 545.187223][ T32] ============================================= [ 545.187223][ T32] [ 545.187231][ T32] NMI backtrace for cpu 0 [ 545.187243][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 545.187261][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 545.187271][ T32] Call Trace: [ 545.187278][ T32] [ 545.187285][ T32] dump_stack_lvl+0x100/0x190 [ 545.187311][ T32] nmi_cpu_backtrace.cold+0x12d/0x151 [ 545.187337][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 545.187356][ T32] nmi_trigger_cpumask_backtrace+0x21f/0x2a0 [ 545.187461][ T32] sys_info+0x141/0x190 [ 545.187488][ T32] watchdog+0xcb1/0x1030 [ 545.187516][ T32] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 545.187535][ T32] ? __pfx_watchdog+0x10/0x10 [ 545.187553][ T32] ? __kthread_parkme+0x18f/0x230 [ 545.187575][ T32] ? kthread+0x13a/0x450 [ 545.187595][ T32] ? __pfx_watchdog+0x10/0x10 [ 545.187611][ T32] kthread+0x373/0x450 [ 545.187632][ T32] ? __pfx_kthread+0x10/0x10 [ 545.187654][ T32] ret_from_fork+0x730/0xd60 [ 545.187676][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 545.187695][ T32] ? __switch_to+0x800/0x10f0 [ 545.187717][ T32] ? __pfx_kthread+0x10/0x10 [ 545.187930][ T32] ret_from_fork_asm+0x1a/0x30 [ 545.187964][ T32] [ 545.187987][ T32] Sending NMI from CPU 0 to CPUs 1: [ 545.188010][ C1] NMI backtrace for cpu 1 [ 545.188021][ C1] CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) [ 545.188037][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 545.188046][ C1] RIP: 0010:delay_tsc+0x22/0xc0 [ 545.188063][ C1] Code: 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 55 49 89 fd bf 01 00 00 00 41 54 55 53 e8 99 29 08 f6 e8 74 7e 01 00 41 89 c4 0f 01 f9 <66> 90 48 c1 e2 20 48 09 c2 48 89 d5 eb 16 f3 90 bf 01 00 00 00 e8 [ 545.188076][ C1] RSP: 0018:ffffc90000157950 EFLAGS: 00000096 [ 545.188089][ C1] RAX: 000000007100cc62 RBX: 0000000000000000 RCX: 0000000000000001 [ 545.188098][ C1] RDX: 000000000000016b RSI: ffffffff8c621000 RDI: ffffffff8c621040 [ 545.188108][ C1] RBP: ffffffff9bc67c60 R08: 0000000000000005 R09: 0000000000000000 [ 545.188117][ C1] R10: 0000000000000785 R11: 205d323354202020 R12: 0000000000000001 [ 545.188126][ C1] R13: 0000000000000af1 R14: fffffbfff378cfe9 R15: dffffc0000000000 [ 545.188135][ C1] FS: 0000000000000000(0000) GS:ffff888123c5d000(0000) knlGS:0000000000000000 [ 545.188150][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 545.188159][ C1] CR2: 00002000001e9000 CR3: 000000000eb96000 CR4: 00000000003526f0 [ 545.188169][ C1] Call Trace: [ 545.188174][ C1] [ 545.188180][ C1] wait_for_lsr+0xf3/0x210 [ 545.188198][ C1] serial8250_fifo_wait_for_lsr_thre+0x5f/0xd0 [ 545.188215][ C1] __serial8250_console_fifo_write+0xa5/0x290 [ 545.188231][ C1] ? __pfx_io_serial_out+0x10/0x10 [ 545.188253][ C1] serial8250_console_write+0xf46/0x1330 [ 545.188274][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 545.188292][ C1] ? __nbcon_context_update_unsafe+0x1b6/0x220 [ 545.188316][ C1] ? __pfx___nbcon_context_update_unsafe+0x10/0x10 [ 545.188340][ C1] nbcon_emit_next_record+0x8f7/0xa70 [ 545.188362][ C1] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 545.188382][ C1] ? nbcon_context_try_acquire+0x3a6/0xc60 [ 545.188402][ C1] ? do_raw_spin_lock+0x70/0x260 [ 545.188429][ C1] ? __pfx___cant_migrate+0x10/0x10 [ 545.188447][ C1] ? _raw_spin_lock_irqsave+0x42/0x60 [ 545.188463][ C1] nbcon_emit_one+0x1a8/0x2b0 [ 545.188484][ C1] ? __pfx_nbcon_emit_one+0x10/0x10 [ 545.188507][ C1] nbcon_kthread_func+0x613/0x7d0 [ 545.188522][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 545.188538][ C1] ? __kthread_parkme+0x18f/0x230 [ 545.188554][ C1] ? kthread+0x13a/0x450 [ 545.188571][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 545.188584][ C1] kthread+0x373/0x450 [ 545.188601][ C1] ? __pfx_kthread+0x10/0x10 [ 545.188619][ C1] ret_from_fork+0x730/0xd60 [ 545.188634][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 545.188650][ C1] ? __switch_to+0x800/0x10f0 [ 545.188668][ C1] ? __pfx_kthread+0x10/0x10 [ 545.188686][ C1] ret_from_fork_asm+0x1a/0x30 [ 545.188705][ C1] [ 545.199174][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 546.260040][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 546.269214][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 546.279685][ T32] Call Trace: [ 546.282970][ T32] [ 546.285898][ T32] dump_stack_lvl+0x100/0x190 [ 546.290613][ T32] vpanic+0x553/0x970 [ 546.294714][ T32] ? __pfx_vpanic+0x10/0x10 [ 546.299251][ T32] panic+0xd1/0xe0 [ 546.302993][ T32] ? __pfx_panic+0x10/0x10 [ 546.307440][ T32] ? nmi_trigger_cpumask_backtrace+0x263/0x2a0 [ 546.313639][ T32] ? nmi_trigger_cpumask_backtrace+0x26d/0x2a0 [ 546.319832][ T32] ? watchdog.cold+0x1ec/0x234 [ 546.324633][ T32] watchdog.cold+0x1fd/0x234 [ 546.329253][ T32] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 546.335094][ T32] ? __pfx_watchdog+0x10/0x10 [ 546.339800][ T32] ? __kthread_parkme+0x18f/0x230 [ 546.344937][ T32] ? kthread+0x13a/0x450 [ 546.349295][ T32] ? __pfx_watchdog+0x10/0x10 [ 546.353996][ T32] kthread+0x373/0x450 [ 546.358359][ T32] ? __pfx_kthread+0x10/0x10 [ 546.362979][ T32] ret_from_fork+0x730/0xd60 [ 546.367590][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 546.372730][ T32] ? __switch_to+0x800/0x10f0 [ 546.377428][ T32] ? __pfx_kthread+0x10/0x10 [ 546.382072][ T32] ret_from_fork_asm+0x1a/0x30 [ 546.386873][ T32] [ 546.390183][ T32] Kernel Offset: disabled [ 546.394513][ T32] Rebooting in 86400 seconds..